joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412060
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x518eb0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x5521f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
push 0x6d
call fcn.00429000
add esp, 8
test al, al
jne 0x4120d5
mov dword [ebp - 4], 0
jmp 0x412247
sub esp, 8
lea ecx, [ebp - 0x28]
mov eax, esp
mov dword [eax], str.ScreenSaver
mov dword [eax + 4], 0xb
lea eax, [ebp - 0x40]
push eax
call fcn.00425800
mov byte [ebp - 4], 2
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x412115
shr eax, 4
and al, 1
jne 0x41212f
xor edx, edx
lea ecx, [ebp - 0x40]
call fcn.004248d0
test al, al
jne 0x41212f
mov dword [ebp - 4], 2
jmp 0x41221a
sub esp, 8
lea ecx, [ebp - 0x40]
mov eax, esp
mov dword [eax], 0x5433d8
mov dword [eax + 4], 4
lea eax, [ebp - 0x5c]
push eax
call fcn.00425640
add esi, 0x2bc
mov byte [ebp - 4], 4
cmp esi, eax
je 0x412167
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00408f60
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x48]
cmp eax, 8
jb 0x412180
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.00406490
xor eax, eax
mov dword [ebp - 0x48], 7
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
jb 0x41219e
mov eax, dword [esi]
jmp 0x4121a0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4121b3
shr eax, 4
and al, 1
jne 0x4121bc
xor edx, edx
mov ecx, esi
call fcn.004248d0
sub esp, 8
mov ecx, esi
mov eax, esp
mov dword [eax], str.a1.data
mov dword [eax + 4], 7
lea eax, [ebp - 0x5c]
push eax
call fcn.00425640
mov byte [ebp - 4], 5
cmp esi, eax
je 0x4121ed
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00408f60
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x48]
cmp eax, 8
jb 0x412206
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.00406490
xor eax, eax
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x412233
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00406490
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x412263
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00406490
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret
Function at 0x414e70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519368
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5521f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [edx]
lea esi, [edi + 8]
push dword [ebp + 0x14]
mov ecx, esi
mov dword [ebp - 0x14], 0
mov dword [edi], eax
mov dword [ebp - 0x10], esi
call fcn.00415d90
push 0xffffffffffffffff
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov dword [ebp - 0x18], ecx
mov byte [ecx], 0
call fcn.00405c30
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 0x28], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0x30], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415ea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519488
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5521f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ebp + 8]
lea esi, [ebx + 8]
mov ecx, esi
mov eax, dword [edx]
lea edi, [edx + 8]
push edi
mov dword [ebx], eax
mov dword [ebp + 8], esi
call fcn.00415d90
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push 0
lea eax, [edi + 0xc]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [ebp - 0x10], ecx
mov byte [ecx], 0
call fcn.00405c30
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x417230
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
mov eax, 0x40
push edi
mov edi, ecx
mov edx, dword [esi]
and edx, 0x3f
mov byte [edx + esi + 0x18], 0x80
inc edx
sub eax, edx
cmp eax, 8
jae 0x417271
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.004b0ce0
push 0x40
lea edx, [esi + 0x18]
mov ecx, esi
call fcn.004167b0
add esp, 0x10
mov eax, 0x40
xor edx, edx
add eax, 0xfffffff8
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.004b0ce0
shl dword [esi], 3
lea edx, [esi + 0x18]
movzx eax, byte [esi]
mov ecx, esi
mov byte [esi + 0x50], al
mov eax, dword [esi]
shr eax, 8
mov byte [esi + 0x51], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x52], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x53], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x54], al
mov eax, dword [esi + 4]
shr eax, 8
mov byte [esi + 0x55], al
movzx eax, byte [esi + 6]
mov byte [esi + 0x56], al
movzx eax, byte [esi + 7]
push 0x40
mov byte [esi + 0x57], al
call fcn.004167b0
movzx eax, byte [esi + 8]
mov byte [edi], al
mov eax, dword [esi + 8]
shr eax, 8
mov byte [edi + 1], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 2], al
movzx eax, byte [esi + 0xb]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 4], al
mov eax, dword [esi + 0xc]
shr eax, 8
mov byte [edi + 5], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 8], al
mov eax, dword [esi + 0x10]
shr eax, 8
mov byte [edi + 9], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xc], al
mov eax, dword [esi + 0x14]
shr eax, 8
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x16]
push 0x98
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x17]
push 0
push esi
mov byte [edi + 0xf], al
call fcn.004b0ce0
add esp, 0x1c
pop edi
pop esi
ret
Function at 0x4173a0
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519612
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x5521f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x2c0], esi
push edi
mov dword [ebp - 0x2bc], 0
lea eax, [ebp - 0x220]
push 0x200
push 1
push eax
mov dword [ebp - 0x2c4], esi
mov dword [ebp - 0x2b0], 0x67452301
mov dword [ebp - 0x2ac], 0xefcdab89
mov dword [ebp - 0x2a8], 0x98badcfe
mov dword [ebp - 0x2a4], 0x10325476
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0
call fcn.004b7393
add esp, 0x10
test eax, eax
je 0x41746d
nop
push eax
lea edx, [ebp - 0x220]
lea ecx, [ebp - 0x2b8]
call fcn.00417180
push edi
push 0x200
lea eax, [ebp - 0x220]
push 1
push eax
call fcn.004b7393
add esp, 0x14
test eax, eax
jne 0x417440
lea edx, [ebp - 0x2b8]
lea ecx, [ebp - 0x20]
call fcn.00417230
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x2bc], 1
nop
mov bh, byte [ebp + edi - 0x20]
mov ecx, dword [esi + 0x14]
mov al, bh
shr al, 4
cmp al, 0xa
sbb bl, bl
add al, 0x57
and bl, 0xd9
add bl, al
mov eax, dword [esi + 0x10]
cmp eax, ecx
jne 0x4174ee
inc eax
cmp eax, 0xfffffffe
ja 0x417594
cmp ecx, eax
jae 0x4174d9
push dword [esi + 0x10]
mov ecx, esi
push eax
call fcn.00406390
jmp 0x4174ee
test eax, eax
jne 0x4174ee
mov dword [esi + 0x10], eax
cmp ecx, 0x10
jb 0x4174e9
mov eax, dword [esi]
jmp 0x4174eb
mov eax, esi
mov byte [eax], 0
cmp dword [esi + 0x14], 0x10
jb 0x4174f8
mov ecx, dword [esi]
jmp 0x4174fa
mov ecx, esi
mov eax, dword [esi + 0x10]
and bh, 0xf
mov byte [ecx + eax], bl
inc dword [esi + 0x10]
cmp bh, 0xa
mov eax, dword [esi + 0x10]
sbb bl, bl
and bl, 0xd9
add bl, 0x57
mov byte [eax + ecx], 0
add bl, bh
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
jne 0x417550
inc eax
cmp eax, 0xfffffffe
ja 0x417594
cmp ecx, eax
jae 0x41753b
push dword [esi + 0x10]
mov ecx, esi
push eax
call fcn.00406390
jmp 0x417550
test eax, eax
jne 0x417550
mov dword [esi + 0x10], eax
cmp ecx, 0x10
jb 0x41754b
mov eax, dword [esi]
jmp 0x41754d
mov eax, esi
mov byte [eax], 0
cmp dword [esi + 0x14], 0x10
jb 0x41755a
mov ecx, dword [esi]
jmp 0x41755c
mov ecx, esi
mov eax, dword [esi + 0x10]
inc edi
mov byte [ecx + eax], bl
inc dword [esi + 0x10]
mov eax, dword [esi + 0x10]
mov byte [eax + ecx], 0
cmp edi, 0x10
jb 0x4174a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.00495b58
int3
Function at 0x418150
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519842
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5521f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0
call fcn.00496774
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
jne 0x4181e4
mov dword [ebp - 0x18], str.bad_locale_name
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.00402c20
push eax
push esi
call fcn.00496ad4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x418760
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
call fcn.0041bc40
or eax, 0xffffffff
xor esi, esi
test edx, edx
je 0x41878a
movzx ecx, byte [esi + edi]
inc esi
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x567108]
cmp esi, edx
jb 0x418772
pop edi
not eax
pop esi
ret
Function at 0x41b190
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519b8f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5521f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00497eca
mov esi, eax
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
mov dword [ebp - 4], 0
push 1
movq qword [esi], xmm0
call fcn.004969d1
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41baa0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov byte [ebp - 1], 0
push esi
push edi
mov ecx, 0x40
mov esi, 0x543820
mov edi, ebx
mov dword [ebx + 0x200], 1
mov dword [ebx + 0x204], 1
mov word [ebx + 0x208], 0
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, edx
nop
xor edx, edx
mov cl, byte [esi + ebx]
mov eax, esi
div dword [ebp + 8]
movzx eax, byte [edx + edi]
mov dl, byte [ebp - 1]
add al, cl
add dl, al
mov byte [ebp - 1], dl
movzx edx, dl
movzx eax, byte [edx + ebx]
mov byte [esi + ebx], al
inc esi
mov byte [edx + ebx], cl
cmp esi, 0x100
jb 0x41bae0
lea edi, [ebx + 0x100]
mov esi, ebx
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41bb30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi + 0x200]
sub edx, eax
mov bh, byte [edi + 0x208]
add ecx, eax
sub esi, eax
mov dword [ebp - 4], ecx
mov dword [ebp + 8], esi
cmp eax, ecx
jae 0x41bb95
sub edx, esi
mov dword [ebp + 0xc], edx
movzx esi, al
mov bl, byte [esi + edi]
add bh, bl
movzx edx, bh
movzx ecx, byte [edx + edi]
mov byte [esi + edi], cl
mov byte [edx + edi], bl
movzx ecx, byte [esi + edi]
mov edx, dword [ebp + 8]
add cl, bl
mov esi, dword [ebp + 0xc]
add edx, eax
movzx ecx, cl
inc eax
movzx ecx, byte [ecx + edi]
xor cl, byte [esi + edx]
mov byte [edx], cl
cmp eax, dword [ebp - 4]
jb 0x41bb60
mov byte [edi + 0x208], bh
mov dword [edi + 0x200], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bbb0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edi
mov eax, dword [edi + 0x204]
lea esi, [edi + 0x100]
sub dword [ebp + 8], eax
add ecx, eax
mov bh, byte [edi + 0x209]
sub edx, eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], ecx
cmp eax, ecx
jae 0x41bc2a
sub edx, dword [ebp + 8]
mov edi, edx
nop dword [eax]
mov edx, dword [ebp - 4]
movzx ecx, al
add esi, ecx
mov bl, byte [esi]
add bh, bl
movzx ecx, bh
add edx, ecx
movzx ecx, byte [edx]
mov byte [esi], cl
mov byte [edx], bl
movzx ecx, byte [esi]
mov edx, dword [ebp + 8]
add cl, bl
mov esi, dword [ebp - 4]
add edx, eax
movzx ecx, cl
inc eax
movzx ecx, byte [ecx + esi]
xor cl, byte [edi + edx]
mov byte [edx], cl
cmp eax, dword [ebp - 8]
jb 0x41bbf0
mov edi, dword [ebp - 0xc]
mov byte [edi + 0x209], bh
mov dword [edi + 0x204], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519e08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
push eax
mov esi, ecx
mov byte [ebp - 0x14], 0
push 0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x13], 0
mov byte [ebp - 0xf], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov ebx, dword [ebp - 0x18]
push ebx
call fcn.00497f33
mov edi, eax
add esp, 4
test edi, edi
je 0x41f112
push ebx
push 0
push edi
call fcn.004b0ce0
add esp, 0xc
mov byte [edi], 0
jmp 0x41f114
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x41f16c
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x41f16c
mov ebx, dword [ebp - 0x14]
mov esi, edi
lea ecx, [esi + 8]
call fcn.0041edd0
mov ecx, eax
cmp ecx, 1
je 0x41f149
test ecx, ecx
jne 0x41f161
mov ax, word [esi + 0x198]
mov ebx, dword [esi + 0x194]
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x10], ax
test ecx, ecx
je 0x41f167
mov esi, dword [esi]
test esi, esi
jne 0x41f136
mov esi, dword [ebp - 0x1c]
jmp 0x41f16f
mov ebx, dword [ebp - 0x14]
push 0x200
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.004b0ce0
mov eax, dword [ebp - 0x10]
shr eax, 8
movzx eax, al
push eax
movzx eax, byte [ebp - 0x10]
push eax
mov eax, ebx
shr eax, 0x18
push eax
mov eax, ebx
shr ebx, 8
shr eax, 0x10
movzx eax, al
push eax
movzx eax, bl
push eax
movzx eax, byte [ebp - 0x14]
push eax
lea eax, [ebp - 0x224]
push str._02X__02X__02X__02X__02X__02X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
add esp, 0x2c
mov word [esi], ax
cmp word [ebp - 0x224], ax
jne 0x41f1e1
xor ecx, ecx
jmp 0x41f1ff
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f1f0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
call fcn.0040e4f0
test edi, edi
je 0x41f21b
push edi
call fcn.0049816f
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x420b00
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
mov ebx, ecx
lea esi, [edx + 1]
push edi
mov dword [ebp - 0x24], ebx
xor edi, edi
nop word [eax + eax]
movzx edx, byte [esi - 1]
lea esi, [esi + 4]
movzx eax, byte [esi - 4]
shl edx, 8
or edx, eax
movzx eax, byte [esi - 3]
shl edx, 8
or edx, eax
movzx eax, byte [esi - 2]
shl edx, 8
or edx, eax
mov dword [ebp + edi*4 - 0x128], edx
inc edi
cmp edi, 0x10
jb 0x420b20
cmp edi, 0x40
jae 0x420b9f
mov ebx, 0x40
lea eax, [ebp + edi*4 - 0x130]
sub ebx, edi
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, dword [eax - 0x38]
mov edi, edx
mov ecx, edx
rol edi, 0xf
rol ecx, 0xd
xor edi, ecx
shr edx, 0xa
xor edi, edx
mov ecx, esi
mov edx, esi
ror ecx, 7
rol edx, 0xe
xor edx, ecx
shr esi, 3
xor edx, esi
add edi, edx
add edi, dword [eax - 0x3c]
add edi, dword [eax - 0x18]
mov dword [eax + 4], edi
sub ebx, 1
jne 0x420b62
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx + 0x50]
xor edx, edx
mov dword [ebp - 0x28], eax
mov edi, eax
mov eax, dword [ebx + 0x54]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x58]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x64]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x6c]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
nop dword [eax]
mov esi, ebx
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror esi, 0xb
not ecx
and ecx, dword [ebp - 0xc]
xor esi, eax
mov eax, ebx
ror eax, 6
xor esi, eax
mov eax, dword [ebp - 8]
and eax, ebx
xor ecx, eax
mov eax, edi
add esi, ecx
rol eax, 0xa
add esi, dword [edx + 0x5440f0]
add esi, dword [ebp + edx - 0x128]
mov edx, edi
add esi, dword [ebp - 0x1c]
ror edx, 0xd
xor edx, eax
mov eax, edi
ror eax, 2
xor edx, eax
mov eax, dword [ebp - 0x10]
mov ecx, eax
and eax, edi
xor ecx, edi
and ecx, dword [ebp - 4]
xor ecx, eax
mov eax, dword [ebp - 0xc]
add edx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov ecx, edi
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x14]
lea edi, [edx + esi]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x20]
add ebx, esi
mov eax, dword [ebp - 4]
add edx, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], edx
cmp edx, 0x100
jb 0x420be0
mov eax, dword [ebp - 0x28]
add eax, edi
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x24]
pop edi
pop esi
add dword [ebx + 0x54], ecx
mov dword [ebx + 0x50], eax
mov eax, dword [ebp - 4]
add dword [ebx + 0x58], eax
mov eax, dword [ebp - 0x14]
add dword [ebx + 0x5c], eax
mov eax, dword [ebp - 0x18]
add dword [ebx + 0x60], eax
mov eax, dword [ebp - 8]
add dword [ebx + 0x64], eax
mov eax, dword [ebp - 0xc]
add dword [ebx + 0x68], eax
mov eax, dword [ebp - 0x1c]
add dword [ebx + 0x6c], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420cb0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
lea eax, [ebp - 0x210]
push esi
mov esi, ecx
push 0x104
push eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x420cdf
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push 0x5459fc
push eax
call fcn.004b7e8f
add esp, 8
test eax, eax
je 0x420cfd
xor ecx, ecx
mov word [eax + 2], cx
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x420cd8
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420d40
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519f18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
push 0x100
mov dword [ebp - 0x1c], edi
call fcn.00497f33
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x80
push eax
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x44
push eax
push ebx
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edi, eax
test edi, edi
jne 0x420e0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x420e0d
cmp dword [ebp - 0x14], 0x44
jbe 0x420dbe
xor bl, bl
jmp 0x420e12
mov eax, dword [ebp - 0x10]
cmp eax, 0x80
jbe 0x420df2
xor ecx, ecx
mov edx, 2
mul edx
mov edi, esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00497f33
add esp, 4
mov esi, eax
test edi, edi
je 0x420df2
push edi
call fcn.0049816f
add esp, 4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0x1c]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edi, eax
test edi, edi
setne bl
test esi, esi
je 0x420e1f
push esi
call fcn.0049816f
add esp, 4
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x423420
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
test ebx, ebx
je 0x423447
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x423442
mov eax, dword [ebx]
jmp 0x423444
mov eax, ebx
mov byte [eax], 0
call fcn.004258a0
test al, al
je 0x423459
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.004249f0
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x423450
push 0x10000
call fcn.00497f33
add esp, 4
mov dword [ebp - 8], 0
mov esi, eax
push edi
push 0x10000
push 1
push esi
call fcn.004b7393
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4234e6
mov eax, dword [ebp + 8]
nop dword [eax]
test ebx, ebx
je 0x4234bc
mov ecx, eax
mov eax, edi
sub ecx, dword [ebp - 8]
cmp ecx, edi
cmovb eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.00405d60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x4234fc
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.004b7393
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
test edi, edi
jne 0x4234a0
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004b8547
add esp, 4
test eax, eax
jne 0x4234ff
mov byte [ebp - 1], 1
jmp 0x423503
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.004b7147
add esp, 4
test esi, esi
je 0x423519
push esi
call fcn.0049816f
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret