joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103c489f
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esi + ecx - 0x69362e1b]
shr ecx, 0xae
push ecx
lea esi, [ecx + esi - 0x1a4d4]
xor edx, ebx
sub byte [esp + ecx - 0x1a4d8], 0x2d
movsx eax, word [esp + ecx*2 - 0x349b0]
ror cl, 0x24
neg edx
mov dword [esp + ecx*8 - 0xd2464], 0xe0b0ac8a
inc edx
xor edx, 0x621d71a7
sub edx, 0x961b4cb5
sar cl, 0x85
sbb eax, ecx
neg edx
inc edx
xor ax, cx
ja 0x10183fea

Function at 0x103c4c95
Capabilities:
Encode data using base64

Disassembly:
or eax, dword [esp + edx*2 - 0x493005a4]
mov dword [esp + edx*2 - 0x493005a8], edx
mov word [edi + edx - 0x249802d8], cx
call fcn.102540d5

Function at 0x103cdc5a
Capabilities:
Encode data using base64

Disassembly:
mov dword [esi + ecx - 0x6236c327], eax
add ecx, 0xd096579c
add cx, 0x160c
lea edx, [ecx + ecx - 0x25c0466b]
lea esi, [ecx + esi - 0x32cd30cf]
pop ecx
pop ecx
pop edx
pop edx
pop ecx
jne fcn.102e41c2
mov ecx, dword [edi]
mov edx, 0xe019f212
add edi, 4
xor ecx, ebx
inc ecx
lea eax, [edx*2 - 0x46f913c5]
xadd eax, edx
neg ecx
dec ecx
and edx, edx
call fcn.10391049
movzx edx, bp
pop ecx
shl dl, 0xc3
lea edi, [edx*8 - 0x5a775b43]
pop ebx
shl ebp, 0x44
ja 0x101d87b2
or eax, 0x4080628a
xor ebx, edx
and dword [esp + eax - 0x61cb77e6], eax
adc edi, edx
mov ecx, dword [ebp + eax - 0x61cb77ea]
inc eax
movzx edx, ax
mov dl, byte [eax + ebp - 0x61cb77e7]
call fcn.101fcd3f
pop ebp
push edx
push dword [esp + 4]
popfd
lea edi, [edx - 0x1ed23cdf]
not edx
lea edx, [edi*4 + 0x763c0299]
mov edi, dword [esp + 8]
jmp 0x1028f1ce
mov edx, dword [esi]
inc ax
ror eax, 0x5c
add esi, 4
push eax
movzx ecx, byte [esp]
add eax, ecx
xor edx, ebx
not edx
jmp 0x103e0597
mov dword [esp + ecx - 0x6e14ef0c], eax
ror edx, 3
dec byte [esp + ecx - 0x6e14ef0c]
neg edx
rol cl, 0xc7
shr ecx, cl
bswap edx
je 0x10283164
xadd dword [esp + ecx - 0x1b853bc], ecx
not edx
xor ebx, edx
call fcn.101877bc
xor ebx, eax
jmp 0x1016c55a
xadd ecx, eax
rol edx, cl
and al, 0x23
lea edx, [edx + ecx - 0x6574840]
or eax, 0xc3965dab
push eax
sar ax, cl
xor edx, 0xef2a8e94
shr eax, cl
jb 0x101933fd
lea eax, [eax*8 + 0x75a34b16]
add edi, ecx
shr byte [esp + eax - 0x1744c3ed], 0xc4
lea ecx, [eax*4 - 0x49638d7e]
lea edx, [eax + ecx*4 - 0x6aea82ce]
mov dword [esp + eax - 0x1744c3ee], edi
ret

Function at 0x103d557b
Capabilities:
Encode data using xor

Disassembly:
and ax, 0x9d93
lea eax, [eax + eax*2 - 0x6df167de]
neg cl
add cl, 0x28
push eax
ror cl, 1
pop eax
xor eax, 0xf580043b
sar al, 0x41
Function at 0x103e4dad
Capabilities:
Encode data using xor

Disassembly:
sal bh, cl
ror byte [ebx], 1
leave
call fcn.102f61a6
mov dword [esp], 0xfd0700ae
add al, 0x24
scasb al, byte es:[edi]
add byte [edi], al
std
add dl, cl
ror ax, 1
sub ecx, 0x8a9d590a
neg cx
xor ax, 0x5a0e
pop ecx
call fcn.10161d1c
je 0x103e4dae
sbb edi, dword [edx]
adc eax, dword [edx]
pushfd
dec edi
push ss
push ebx
add bl, byte [edi + ecx*2 + 0x26f7278]
pushfd
dec edi
dec eax
inc eax
pop es
add bl, byte [edi + ecx*2 - 0x3f96fbda]
jns 0x103e4d97
out 0xcd, al
pop edx
fst dword [edx - 0x6b]
inc ecx
in eax, 0xed
mov bh, 0x90
or dword [ecx], esi
dec edi
lcall 0x3434, 0xa1402742
inc edi
push edx
ljmp 0xdbd0

Function at 0x103ece3a
Capabilities:
Encode data using xor

Disassembly:
add al, 0x80
xor dl, 0x31
call fcn.101f997d

Function at 0x103f40a4
Capabilities:
Encode data using xor

Disassembly:
dec al
lea ecx, [edx + ecx + 0x599e30ae]
ror eax, 0x50
pop edx
neg ecx
not byte [esp + eax - 0x20ff43d0]
not ecx
rol eax, 0xb4
dec ecx
rol ecx, 2
neg byte [esp + eax - 0x3d220ff4]
mov edx, dword [esp + eax*2 - 0x7a441fe8]
bswap ecx
xor ebx, ecx
xor eax, eax
rol edx, 0x95
adc esi, ecx
mov ecx, 0x590a22aa
pop edx
jmp fcn.1031e0c1
Function at 0x100023dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100023eb
pop dword [ebp - 0x4c]
mov eax, 0x100023eb
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x89ac3b23
sub dword [ebp - 0x5c], 0x3b59f5d8
mov dword [ebp - 0x58], 0x1c994fb0
sub dword [ebp - 0x58], 0xea66036b
mov dword [ebp - 0x54], 0x66cf1270
sub dword [ebp - 0x54], 0x1a82ce42
mov dword [ebp - 0x50], 0x3b6cbbad
sub dword [ebp - 0x50], 0x3b6cbbad
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x8c2b04b0
add eax, 0x83d59b54
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xa1375878
sub dword [ebp - 0x5c], 0x2cc4ef22
mov dword [ebp - 0x58], 0xf4bab83f
sub dword [ebp - 0x58], 0xb34e56ca
mov dword [ebp - 0x54], 0xaf344bd4
sub dword [ebp - 0x54], 0x4bc4df68
mov dword [ebp - 0x50], 0x65f4ad42
sub dword [ebp - 0x50], 0x65f4ad42
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xd9a865a0
add eax, 0x36583a68
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x34d0b
push 0
call eax
mov ecx, 0x927ac858
add ecx, 0x6d857881
xor esi, esi
add esi, eax
mov edi, 0x5cedc66d
sub edi, 0x4cecce6d
add edi, dword [ebp - 0x4c]
mov edx, 0x33e2bacf
sub edx, 0xc30b4380
xor dword [ebp - 0x3c], 0x58dbab0c
mov ebx, dword [edi]
sub dword [ebp - 0x44], 0x9caf306d
add ebx, edx
xor dword [ebp - 0x28], edx
mov dword [esi], ebx
xor dword [ebp - 4], ecx
add esi, 4
add edi, 0x74ff3c72
add edi, 0x8b00c392
loop 0x1000250a
add eax, 0xb73a3433
add eax, 0x48c6c204
mov ebx, eax
add eax, 0x1f6559f2
sub eax, 0x1f6559ed
mov ecx, 0x31ece1ac
sub ecx, 0x21ece1ac
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x403e59
pop dword [ebp - 0x1c]
mov eax, 0xc46958cc
add eax, 0x3bd6e58d
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xbae9b705
add dword [ebp - 0x2c], 0x93688e46
mov dword [ebp - 0x28], 0xab7f64e7
add dword [ebp - 0x28], 0x86b3e75e
mov dword [ebp - 0x24], 0xc361aa5a
add dword [ebp - 0x24], 0x88ea99d4
mov dword [ebp - 0x20], 0x8f834ea5
add dword [ebp - 0x20], 0x707cb15b
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xfd6d8ab9
add eax, 0x2d2e5ab
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xa41171cd
sub dword [ebp - 0x2c], 0x2f9f0877
mov dword [ebp - 0x28], 0x8a89df19
add dword [ebp - 0x28], 0xb6e2825c
mov dword [ebp - 0x24], 0xa30981cc
add dword [ebp - 0x24], 0xc065eaa0
mov dword [ebp - 0x20], 0x15d16c16
add dword [ebp - 0x20], 0xea2e93ea
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x39f35
push 0
call eax
mov ecx, 0x12cfe173
sub ecx, 0x12cf8ca3
mov ebx, eax
mov esi, 0xc1f6f42c
sub esi, 0xc1b5f42c
add esi, dword [ebp - 0x1c]
mov edx, 0x7786023a
add edx, 0x54787b53
mov edi, dword [esi]
add dword [ebp - 4], esi
xor edi, edx
add dword [ebp - 4], 0x2c62f3f2
mov dword [ebx], edi
add dword [ebp - 0x14], 0xe4704a10
add ebx, 0x2f2c2eca
add ebx, 0xd0d3d13a
add esi, 0x87eba763
add esi, 0x781458a1
loop 0x403f76
add eax, 0xc4fa658a
sub eax, 0xc4f91f77
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x418280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x401047
mov ecx, dword [ebp - 0x1c]
mov eax, 0x4e20
add ecx, 0x1e
mov word [ebp - 0x1e], ax
mov word [ebp - 0x20], cx
push dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x1d
mov word [ebp - 0x24], ax
mov eax, 0x32
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push str.vulkaninfo
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040468b
mov esp, ebp
pop ebp
ret

Function at 0x4056c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.0040538a
push eax
push esi
push dword [ebp + 8]
call fcn.0040533f
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0040537a
pop ss
sbb dl, byte [edi]
mov ch, 0x8d
inc ebp
call 0x5128b470
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
invalid
inc ebp
invalid

Function at 0x4059d9
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x405a2e
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x405a29
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x405a13
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
cmp edx, ebx
jne 0x405b69
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add al, byte [ebx]
enter 0x4d39, 8
jb 0x4059ea
add eax, dword [eax + 4]
jmp 0x4059d7
mov dword [ebp + 0xc], ebx
jmp 0x405a39
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x405a51
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
add byte [eax], al
pushal
jmp 0x405a6f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405a7d
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x405acd
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x405ab4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x405abd
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x405ac7
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x405aa9
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x405a33
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x405b1a
dec eax
je 0x405b11
sub eax, 3
je 0x405b08
mov dword [ebp - 4], 0x40
jmp 0x405b37
mov dword [ebp - 4], 4
jmp 0x405b1d
mov dword [ebp - 4], 0x20
jmp 0x405b1d
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
cld
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x405b69
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x405ae9
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040537a
xor esi, edi
les edi, [esi + 0x6a1475ff]
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x405b75

Function at 0x406817
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec eax
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
invalid
test edi, ebx
clc
Function at 0x40c460
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x432010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x43201c]
push edi
mov edi, ecx
cmp eax, 0x12
jb 0x40c58b
push ebx
push esi
xor esi, esi
lea eax, [ebp - 0x210]
push 0x105
push eax
push esi
mov dword [0x43201c], esi
mov ebx, esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40c552
cmp eax, 0x105
je 0x40c552
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x210]
push eax
push 2
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x40c552
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40c552
push ebx
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push esi
push eax
push 2
call dword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
test eax, eax
je 0x40c552
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x40189c
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40c552
cmp dword [ebp - 0x220], 0x34
jb 0x40c552
mov eax, dword [ebp - 0x224]
movzx ecx, word [eax + 8]
movzx esi, word [eax + 0xa]
movzx eax, word [eax + 0xe]
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], eax
push ebx
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
push dword [ebp - 0x214]
push dword [ebp - 0x218]
push esi
push 0x4018a0
push 0x432a5c
call fcn.0040c5a3
add esp, 0x18
pop esi
pop ebx
cmp eax, 0x12
jae 0x40c586
mov dword [0x43201c], eax
jmp 0x40c58b
mov eax, dword [0x43201c]
mov ecx, dword [ebp - 4]
mov dword [edi + 4], eax
xor ecx, ebp
mov dword [edi], 0x432a5c
mov eax, edi
pop edi
call fcn.0042ba70
leave
ret
Function at 0x40c766
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
push 0x40
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x28]
pop edx
mov eax, dword [ecx + 0x2c]
xor eax, dword [ecx + 0x18]
xor eax, dword [ecx - 8]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
rol eax, 1
mov dword [ecx + 0x34], eax
sub edx, 1
jne 0x40c77c
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0xc]
mov ebx, dword [esi + 0x10]
mov edi, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov dword [ebp - 8], ecx
lea ecx, [esi + 0x20]
mov dword [ebp - 0x1c], eax
mov esi, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0x14
mov edx, eax
mov ecx, ebx
not ecx
rol edx, 5
and ecx, esi
mov eax, edi
and eax, ebx
or ecx, eax
mov eax, dword [ebp - 8]
add edx, ecx
mov dword [ebp - 8], esi
mov ecx, dword [ebp - 0x14]
mov esi, edi
add eax, 0x5a827999
mov edi, ebx
mov ebx, dword [ebp - 0xc]
ror edi, 2
add edx, dword [ecx]
add ecx, 4
add eax, edx
mov dword [ebp - 0x14], ecx
sub dword [ebp - 0x18], 1
mov dword [ebp - 0xc], eax
jne 0x40c7bb
mov ecx, dword [ebp - 0x10]
mov edx, esi
add ecx, 0x70
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 0x14
mov esi, ecx
mov ecx, eax
mov eax, edx
xor eax, edi
rol ecx, 5
xor eax, ebx
add ecx, eax
mov eax, dword [ebp - 8]
add ecx, dword [esi]
add eax, 0x6ed9eba1
mov dword [ebp - 8], edx
lea esi, [esi + 4]
mov edx, edi
add eax, ecx
mov edi, ebx
mov ebx, dword [ebp - 0xc]
ror edi, 2
sub dword [ebp - 0x18], 1
mov dword [ebp - 0xc], eax
jne 0x40c80d
mov ecx, dword [ebp - 0x10]
mov esi, edx
add ecx, 0xc0
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0x14
mov edx, eax
mov ecx, edi
or ecx, ebx
rol edx, 5
add edx, dword [ebp - 8]
mov eax, edi
and eax, ebx
mov dword [ebp - 8], esi
and ecx, esi
mov esi, edi
or ecx, eax
mov edi, ebx
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x14], 4
mov ebx, dword [ebp - 0xc]
ror edi, 2
add ecx, dword [eax]
lea eax, [edx - 0x70e44324]
add eax, ecx
sub dword [ebp - 0x18], 1
mov dword [ebp - 0xc], eax
jne 0x40c857
mov ecx, dword [ebp - 0x10]
mov edx, esi
add ecx, 0x110
mov dword [ebp - 4], esi
push 0x14
mov dword [ebp - 0x14], ecx
pop esi
mov ecx, eax
mov eax, edx
mov edx, dword [ebp - 0x14]
xor eax, edi
add dword [ebp - 0x14], 4
xor eax, ebx
add eax, dword [ebp - 8]
rol ecx, 5
add ecx, 0xca62c1d6
add ecx, dword [edx]
mov edx, edi
add eax, ecx
mov edi, ebx
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
ror edi, 2
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
sub esi, 1
jne 0x40c8a6
mov esi, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
add dword [esi + 0x10], ebx
add dword [esi + 0x14], edi
add dword [esi + 0x18], edx
add dword [esi + 0x1c], ecx
add dword [esi], 0x200
pop edi
adc dword [esi + 4], 0
and dword [esi + 8], 0
mov dword [esi + 0xc], eax
pop esi
pop ebx
leave
ret
Function at 0x40fc17
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x28
mov eax, 0x42d116
call fcn.0042cccd
lea eax, [ebp + 8]
push eax
lea esi, [ecx + 0xc]
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.0040fe2b
mov eax, dword [ebp - 0x30]
cmp eax, dword [esi]
je 0x40fc41
mov al, byte [eax + 0x28]
jmp 0x40fc8a
push ecx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040d57f
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
jb 0x40fc5e
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov ecx, esi
lea eax, [ebp - 0x29]
push eax
lea eax, [ebp - 0x28]
setne byte [ebp - 0x29]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0040ff00
lea ecx, [ebp - 0x28]
call fcn.0040c297
mov al, byte [ebp - 0x29]
call fcn.0042cc77
ret 8

Function at 0x4103de
Capabilities:
Get file size

Disassembly:
push 0x28
mov eax, 0x42d21f
call fcn.0042cc99
mov dword [ebp - 0x1c], ecx
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov ebx, dword [ebp + 8]
push esi
push 0x8000000
push 3
push esi
push 1
push 0x80000000
push ebx
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x20], edi
lea eax, [edi + 1]
cmp eax, 1
jbe 0x41051f
lea eax, [ebp - 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x410455
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x401eec
call fcn.0041203a
add esp, 0xc
push 0x401f28
jmp 0x410539
cmp dword [ebp - 0x24], esi
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x18], esi
jl 0x410486
jg 0x41046a
cmp esi, 0x7fffffff
jbe 0x410486
push dword [ebp - 0x24]
push esi
push ebx
push 0x401f38
call fcn.0041203a
add esp, 0x10
push 0x401f60
jmp 0x410539
xor eax, eax
push eax
push esi
push eax
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x10], eax
lea ecx, [eax + 1]
cmp ecx, 1
ja 0x4104bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x401f70
call fcn.0041203a
add esp, 0xc
push 0x401fb8
jmp 0x410539
xor ecx, ecx
push ecx
push esi
push ecx
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x4104f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x401fcc
call fcn.0041203a
add esp, 0xc
push 0x402000
jmp 0x410539
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
push dword [ebp - 0x18]
push esi
push ebx
call fcn.00410550
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0042cc62
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x401eb0
call fcn.0041203a
add esp, 0xc
push 0x401ee0
lea ecx, [ebp - 0x34]
call fcn.0040c24d
push 0x430f68
lea eax, [ebp - 0x34]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x411d66
Capabilities:
Hash data via bcrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 4], ecx
test edi, edi
je 0x411dbe
mov eax, dword [ebp + 8]
push ebx
mov ebx, 0x80000000
cmp edi, 0x80000000
ja 0x411d8d
mov ebx, edi
push 0
push ebx
push eax
push dword [ecx]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
mov esi, eax
test esi, esi
js 0x411db0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
add eax, ebx
mov dword [ebp + 8], eax
sub edi, ebx
jne 0x411d7e
jmp 0x411dbd
push esi
push 0x402774
call fcn.0041203a
pop ecx
pop ecx
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x41ba3e
Capabilities:
Query environment variable

Disassembly:
push 0x18
mov eax, 0x42d8b2
call fcn.0042cc99
mov dword [ebp - 0x18], edx
mov ebx, ecx
mov eax, dword [ebx + 0x10]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x1c], 1
and dword [ebp - 4], 0
mov esi, dword [ebx + 0x10]
mov ecx, ebx
sub esi, eax
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x14], esi
jb 0x41ba78
mov ecx, dword [ebx]
push esi
lea eax, [ecx + eax*2]
push eax
push dword [edx]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x41baab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x41baa4
jle 0x41bab4
movzx esi, si
or esi, 0x80070000
jmp 0x41bab2
mov esi, 0x80004005
jmp 0x41bab2
cmp edi, esi
jb 0x41bae7
xor esi, esi
inc esi
test esi, esi
je 0x41bae9
test esi, esi
js 0x41baec
cmp edi, dword [ebp - 0x14]
jbe 0x41bae0
mov eax, dword [ebp - 0x10]
add eax, edi
cmp eax, edi
jb 0x41bad9
push ecx
push eax
mov ecx, ebx
call fcn.00415563
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
jmp 0x41ba66
mov esi, 0x8007000e
jmp 0x41baec
mov esi, 0x8000ffff
jmp 0x41baec
xor esi, esi
add dword [ebp - 0x10], edi
push ecx
mov dword [ebp - 4], 1
mov ecx, ebx
push dword [ebp - 0x10]
call fcn.00415563
mov eax, esi
call fcn.0042cc62
ret

Function at 0x41c0d9
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor edx, edx
cmp dword [ebp + 0xc], edx
je 0x41c0fe
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [edx + esi]
xor eax, dword [ecx]
imul eax, eax, 0x1000193
inc edx
mov dword [ecx], eax
cmp edx, dword [ebp + 0xc]
jne 0x41c0e9
pop esi
pop ebp
ret 8
Function at 0x41d045
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 8
mov edi, ecx
mov ecx, esi
push 0x403104
call fcn.0041c102
xor ebx, ebx
mov ecx, ebx
movzx eax, byte [edi + ecx + 4]
xor eax, dword [esi]
imul eax, eax, 0x1000193
inc ecx
mov dword [esi], eax
cmp ecx, 4
jne 0x41d066
lea eax, [edi + 0x28]
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x41d089
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.0041c102
mov eax, dword [edi + 0xc]
test eax, eax
je 0x41d148
mov ecx, dword [eax + 0x5c]
add eax, 0x4c
cmp dword [eax + 0x14], 8
jb 0x41d0ab
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.0041c102
mov eax, dword [edi + 0xc]
add eax, 0x64
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x41d0c5
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.0041c102
mov eax, dword [edi + 0xc]
add eax, 0xc4
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x41d0e1
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.0041c102
mov eax, dword [edi + 0xc]
add eax, 0xdc
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x41d0fd
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.0041c102
mov eax, dword [edi + 0xc]
add eax, 0xf4
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x41d119
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.0041c102
mov ecx, dword [edi + 0xc]
call fcn.0042971b
test al, al
je 0x41d148
mov eax, dword [edi + 0xc]
add eax, 4
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x41d13f
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.0041c102
xor eax, eax
cmp byte [edi + 0x40], al
setne al
mov dword [ebp - 4], eax
movzx eax, byte [ebp + ebx - 4]
xor eax, dword [esi]
imul eax, eax, 0x1000193
inc ebx
mov dword [esi], eax
cmp ebx, 4
jne 0x41d153
pop edi
pop esi
pop ebx
leave
ret 4