joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x4031a4
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x40313f
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00402c60
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40310d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x40325d
call fcn.00403151
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x4031fc
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00402d90
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4031b5
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x40325d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00402d90
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x403258
jmp 0x40325d
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a0e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40a0fe
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x40a140
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40a15e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret
Function at 0x40a1a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40a1c2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x40a220
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40a242
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x40a2a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40a2ca
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret

Function at 0x40a330
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40a35a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x40a3c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x40a41f
Function at 0x40a42e
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40a410
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x40a4a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x40a4ff

Function at 0x40a50e
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40a4f0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x40cb80
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x40d0a0
test edx, edx
je 0x40d0a0
call fcn.0040cb97
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x40d0e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0040cb80
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x40d151
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x40d116
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x40da60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x40dae4
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x40dabc
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x40dac4
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.0040dae9
Function at 0x443d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x443e6a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x443dfd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00443540
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x443dc3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x443f33
call fcn.00443e0f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x443eca
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00443960
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x443e7b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x443f33
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00443960
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x443f2e
jmp 0x443f33
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x447ff1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
push edi
movlpd qword [ebp - 0x10], xmm0
mov edx, dword [esi]
mov ebx, dword [esi + 4]
jl 0x448065
jg 0x44801a
cmp dword [ebp + 8], 0
jbe 0x448065
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], eax
inc dl
movzx edx, dl
mov ecx, dword [esi + edx*4 + 8]
lea eax, [ebx + ecx]
movzx ebx, al
mov eax, dword [esi + ebx*4 + 8]
mov dword [esi + edx*4 + 8], eax
mov dword [esi + ebx*4 + 8], ecx
add cl, al
movzx eax, cl
mov ecx, dword [ebp - 8]
mov al, byte [esi + eax*4 + 8]
xor byte [edi + ecx], al
add edi, 1
mov eax, dword [ebp - 4]
adc eax, 0
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jl 0x448023
jg 0x448065
cmp edi, dword [ebp + 8]
jb 0x448023
pop edi
mov dword [esi + 4], ebx
mov dword [esi], edx
pop esi
pop ebx
leave
ret
Function at 0x448433
Capabilities:
Check mutex on windows

Disassembly:
push 0x5c
mov eax, 0x6104dc
call fcn.00524043
mov esi, ecx
lea ecx, [ebp - 0x2c]
xor ebx, ebx
call fcn.00461f9f
push 0x694794
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], ebx
call fcn.004625ae
xor eax, eax
lea ecx, [ebp - 0x28]
inc eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x44]
push eax
call fcn.00465045
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.00462a54
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.0044f15c
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x68]
call fcn.00467473
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
movzx ebx, bl
push 1
pop ecx
cmove ebx, ecx
cmp eax, 0xb7
jne 0x4484d0
mov bl, cl
test edi, edi
je 0x4484d0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
xor esi, esi
lea ecx, [ebp - 0x2c]
test bl, bl
cmove esi, edi
call fcn.00462a54
mov eax, esi
call fcn.00523fed
ret

Function at 0x44970b
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
test esi, esi
jne 0x44971d
push 0xffffffffffffff88
pop eax
jmp 0x4497af
push edi
push dword [ebp + 8]
movzx eax, dx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x449737
or eax, 0xffffffff
jmp 0x4497ae
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x449748
push 0xfffffffffffffffe
pop eax
jmp 0x4497ae
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x44975a
push 0xfffffffffffffffd
jmp 0x4497ac
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jle 0x4497aa
mov ecx, dword [ebp + 0xc]
add ecx, 4
cmp dword [ecx + 0x14], 8
jb 0x449776
mov ecx, dword [ecx]
push 0x694838
push ecx
call fcn.0052c4ce
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x44978d
push 0xfffffffffffffffc
jmp 0x4497ac
push esi
push 1
push edi
push ebx
call fcn.0052c2f4
push esi
call fcn.0052bf6d
push esi
call fcn.0052c03c
add esp, 0x18
xor eax, eax
jmp 0x4497ad
push 0xfffffffffffffffa
pop eax
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x44a462
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x44a4a6
mov edi, dword [ebp + 0xc]
test edi, edi
jl 0x44a4a6
mov ebx, dword [ebp + 8]
jg 0x44a47e
test ebx, ebx
je 0x44a4a6
or edx, 0xffffffff
movzx eax, byte [esi]
add ebx, 0xffffffff
movzx ecx, dl
adc edi, 0xffffffff
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x693f68]
mov ecx, ebx
inc esi
or ecx, edi
jne 0x44a481
not edx
mov eax, edx
jmp 0x44a4a8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44a4ad
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
test esi, esi
je 0x44a501
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jl 0x44a500
mov eax, dword [ebp + 0xc]
jg 0x44a4cb
test eax, eax
je 0x44a500
push ebx
mov ebx, dword [edx + 8]
add eax, 0xffffffff
movzx ecx, bl
mov dword [ebp + 8], eax
movzx eax, byte [esi]
adc edi, 0xffffffff
xor ecx, eax
shr ebx, 8
mov eax, dword [ebp + 8]
xor ebx, dword [ecx*4 + 0x693f68]
inc esi
or eax, edi
mov dword [edx + 8], ebx
mov eax, dword [ebp + 8]
jne 0x44a4cf
add dword [edx], 0xffffffff
pop ebx
adc dword [edx + 4], 0xffffffff
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x44a7d4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x610895
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6ad2ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
lea ecx, [esi + 0x54]
mov dword [ebp - 4], edi
call fcn.0044b075
lea ecx, [esi + 0x48]
mov dword [ebp - 4], 1
call fcn.0044b075
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], 2
call fcn.0044b075
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.0044b075
lea ecx, [esi + 0x24]
mov dword [ebp - 4], 4
call fcn.0044b075
cmp dword [esi + 0xc], edi
je 0x44a876
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.0044b050
mov eax, dword [esi + 0x14]
sub eax, dword [esi + 0xc]
push 0x58
pop ecx
cdq
idiv ecx
imul eax, eax, 0x58
push eax
push dword [esi + 0xc]
call fcn.00447a7d
mov dword [esi + 0xc], edi
pop ecx
mov dword [esi + 0x10], edi
pop ecx
mov dword [esi + 0x14], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x44b664
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0x6948c0
mov edi, ecx
call esi
push str.psapi.dll
mov dword [ebp - 4], eax
call esi
push str.Wlanapi.dll
mov dword [ebp - 8], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], eax
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x44b746
push str.CreateToolhelp32Snapshot
push eax
call esi
push str.Process32First
push dword [ebp - 4]
mov dword [edi], eax
call esi
push str.Process32Next
push dword [ebp - 4]
mov dword [edi + 4], eax
call esi
push str.Module32First
push dword [ebp - 4]
mov dword [edi + 8], eax
call esi
push str.Module32Next
push dword [ebp - 4]
mov dword [edi + 0xc], eax
call esi
push str.Thread32First
push dword [ebp - 4]
mov dword [edi + 0x10], eax
call esi
push str.Thread32Next
push dword [ebp - 4]
mov dword [edi + 0x14], eax
call esi
push str.GlobalMemoryStatusEx
push dword [ebp - 4]
mov dword [edi + 0x18], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x44b78c
push str.EnumProcesses
push eax
call esi
push str.EnumProcessModules
push dword [ebp - 8]
mov dword [edi + 0x1c], eax
call esi
push str.EnumProcessModulesEx
push dword [ebp - 8]
mov dword [edi + 0x24], eax
call esi
push str.GetModuleFileNameExW
push dword [ebp - 8]
mov dword [edi + 0x28], eax
call esi
push str.GetProcessImageFileNameW
push dword [ebp - 8]
mov dword [edi + 0x20], eax
call esi
mov dword [edi + 0x2c], eax
test ebx, ebx
je 0x44b809
push str.WlanOpenHandle
push ebx
call esi
push str.WlanEnumInterfaces
push ebx
mov dword [edi + 0x34], eax
call esi
push str.WlanGetAvailableNetworkList
push ebx
mov dword [edi + 0x38], eax
call esi
push str.WlanGetProfile
push ebx
mov dword [edi + 0x3c], eax
call esi
push str.WlanCloseHandle
push ebx
mov dword [edi + 0x40], eax
call esi
push str.WlanFreeMemory
push ebx
mov dword [edi + 0x44], eax
call esi
push str.WlanDeleteProfile
push ebx
mov dword [edi + 0x48], eax
call esi
push str.WlanDisconnect
push ebx
mov dword [edi + 0x4c], eax
call esi
push str.WlanSetProfile
push ebx
mov dword [edi + 0x50], eax
call esi
push str.WlanConnect
push ebx
mov dword [edi + 0x54], eax
call esi
push str.WlanGetNetworkBssList
push ebx
mov dword [edi + 0x58], eax
call esi
mov dword [edi + 0x5c], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44bc4b
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x6ad2ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x200
mov esi, ecx
lea eax, [ebp - 0x204]
push 0
mov dword [ebp - 0x208], esi
push eax
mov dword [ebp - 0x208], esi
call fcn.00524e30
add esp, 0xc
mov dword [ebp - 0x208], 0x100
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x204]
mov ecx, esi
push eax
call fcn.004625ae
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00522ca8
leave
ret

Function at 0x44be2a
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x610c52
call fcn.00524043
mov esi, ecx
mov dword [ebp - 0x220], esi
xor edi, edi
lea eax, [ebp - 0x218]
push 0x208
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 0x224], esi
push eax
mov dword [ebp - 0x21c], edi
call fcn.00524e30
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004625ae
mov dword [ebp - 4], edi
mov ecx, esi
push edi
mov dword [ebp - 0x21c], 1
call fcn.00462ed6
mov eax, esi
call fcn.00523fed
ret

Function at 0x44c052
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x610cba
call fcn.00524043
mov esi, ecx
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x240], esi
call fcn.0044bdaf
test al, al
je 0x44c086
mov dl, 1
mov ecx, esi
call fcn.0044bea4
jmp 0x44c140
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.00524e30
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x44c078
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x238]
call fcn.004625ae
and dword [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.00463d23
push 0
lea ecx, [ebp - 0x238]
call fcn.00462ed6
lea edx, [ebp - 0x239]
lea ecx, [ebp - 0x238]
call fcn.0044cf1b
test al, al
jne 0x44c100
lea ecx, [ebp - 0x238]
call fcn.0044c94d
lea ecx, [ebp - 0x238]
call fcn.0044ccb4
test al, al
jne 0x44c11a
mov dl, 1
mov ecx, esi
call fcn.0044bea4
jmp 0x44c135
push 1
lea ecx, [ebp - 0x238]
call fcn.00462ed6
lea eax, [ebp - 0x238]
mov ecx, esi
push eax
call fcn.0046260b
lea ecx, [ebp - 0x238]
call fcn.00462a54
mov eax, esi
call fcn.00523fed
ret
Function at 0x44c3c3
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6ad2ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.00464373
xor esi, esi
cmp dword [ebp + 0xc], esi
jg 0x44c3f0
jl 0x44c3ec
cmp dword [ebp + 8], esi
ja 0x44c3f0
push 0xffffffffffffff9c
jmp 0x44c451
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push esi
cmovae eax, dword [ebp - 0x1c]
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x44c44f
push esi
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x44c443
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
and esi, 3
add esi, 0xfffffffd
jmp 0x44c446
push 0xfffffffffffffffb
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44c452
push 0xfffffffffffffff7
pop esi
lea ecx, [ebp - 0x20]
call fcn.00462a54
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00522ca8
leave
ret