joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a0c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x5c0078]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x40]
lea esi, [edi + 0x30]
cmp ecx, 0x64
jb 0x40a101
mov dword [esi + 0x10], 0x64
cmp dword [esi + 0x14], 0x10
jb 0x40a0f9
mov eax, dword [esi]
mov byte [eax + 0x64], 0
jmp 0x40a112
mov eax, esi
mov byte [eax + 0x64], 0
jmp 0x40a112
mov eax, 0x64
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00405de0
mov al, byte [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x10], al
mov word [esp + 0x11], 0x3a
cmp dword [esi + 0x14], 0x10
jb 0x40a12f
mov eax, dword [esi]
jmp 0x40a131
mov eax, esi
push dword [edi + 0x40]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
xor edx, edx
mov ecx, eax
or ecx, edx
jne 0x40a186
call ebx
cmp eax, 0x7a
jne 0x40a1d9
mov eax, dword [edi + 0x40]
mov ecx, dword [esi + 0x10]
add eax, eax
cmp eax, ecx
ja 0x40a178
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 0x10
jb 0x40a170
mov ecx, dword [esi]
mov byte [ecx + eax], 0
jmp 0x40a125
mov ecx, esi
mov byte [ecx + eax], 0
jmp 0x40a125
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00405de0
jmp 0x40a125
test edx, edx
jl 0x40a1d9
jg 0x40a191
cmp eax, 2
jbe 0x40a1d9
mov ecx, dword [esi + 0x10]
add eax, 0xfffffffe
cmp eax, ecx
ja 0x40a1bb
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 0x10
jb 0x40a1a6
mov esi, dword [esi]
mov byte [esi + eax], dl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004351b3
mov esp, ebp
pop ebp
ret
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00405de0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004351b3
mov esp, ebp
pop ebp
ret
call ebx
push eax
push ecx
mov edx, str.QueryDosDeviceA_failed_w_e
mov ecx, 0x5c85e0
call fcn.00407340
add esp, 4
mov ecx, eax
call fcn.004156e0
mov edx, 0x5b28c4
mov ecx, eax
call fcn.00407340
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x40a211
mov esi, dword [esi]
mov ecx, dword [esp + 0x14]
pop edi
mov byte [esi], 0
pop esi
pop ebx
xor ecx, esp
call fcn.004351b3
mov esp, ebp
pop ebp
ret
Function at 0x40a230
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
lea eax, [esi + 0x18]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x40a27e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov edx, str.GetDiskFreeSpaceExA_failed_w_e
mov ecx, 0x5c85e0
call fcn.00407340
add esp, 4
mov ecx, eax
call fcn.004156e0
mov edx, 0x5b28c4
mov ecx, eax
call fcn.00407340
lea eax, [esi + 0x2c]
push eax
lea eax, [esi + 0x28]
push eax
lea eax, [esi + 0x24]
push eax
lea eax, [esi + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x40a2c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov edx, str.GetDiskFreeSpaceA_failed_w_e
mov ecx, 0x5c85e0
call fcn.00407340
add esp, 4
mov ecx, eax
call fcn.004156e0
mov edx, 0x5b28c4
mov ecx, eax
call fcn.00407340
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a2d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x5c0078]
xor eax, esp
mov dword [esp + 8], eax
push ebx
mov ebx, ecx
mov eax, 0x105
mov ecx, dword [ebx + 0x5c]
push esi
push edi
lea edi, [ebx + 0x4c]
cmp ecx, eax
jb 0x40a317
mov dword [edi + 0x10], eax
cmp dword [edi + 0x14], 0x10
jb 0x40a30c
mov ecx, dword [edi]
mov byte [ecx + 0x105], 0
jmp 0x40a328
mov ecx, edi
mov byte [ecx + 0x105], 0
jmp 0x40a328
sub eax, ecx
mov ecx, edi
push 0
push eax
call fcn.00405de0
mov eax, 0x105
mov ecx, dword [ebx + 0x80]
lea esi, [ebx + 0x70]
cmp ecx, 0x105
jb 0x40a35c
mov dword [esi + 0x10], 0x105
cmp dword [esi + 0x14], 0x10
jb 0x40a351
mov eax, dword [esi]
mov byte [eax + 0x105], 0
jmp 0x40a368
mov eax, esi
mov byte [eax + 0x105], 0
jmp 0x40a368
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00405de0
cmp dword [esi + 0x14], 0x10
jb 0x40a372
mov eax, dword [esi]
jmp 0x40a374
mov eax, esi
cmp dword [edi + 0x14], 0x10
jb 0x40a37e
mov ecx, dword [edi]
jmp 0x40a380
mov ecx, edi
push dword [ebx + 0x80]
push eax
lea eax, [ebx + 0x6c]
push eax
lea eax, [ebx + 0x68]
push eax
lea eax, [ebx + 0x64]
push eax
push dword [ebx + 0x5c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x40a3cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov edx, str.GetVolumeInformationA_failed_w_e
mov ecx, 0x5c85e0
call fcn.00407340
add esp, 4
mov ecx, eax
call fcn.004156e0
mov edx, 0x5b28c4
mov ecx, eax
call fcn.00407340
push 1
push 0
lea eax, [esp + 0x18]
mov byte [esp + 0x18], 0
push eax
mov ecx, edi
call fcn.004178b0
mov ecx, dword [edi + 0x10]
cmp eax, ecx
ja 0x40a3fc
mov dword [edi + 0x10], eax
cmp dword [edi + 0x14], 0x10
jb 0x40a3f6
mov edi, dword [edi]
mov byte [edi + eax], 0
jmp 0x40a408
sub eax, ecx
mov ecx, edi
push 0
push eax
call fcn.00405de0
push 1
push 0
lea eax, [esp + 0x18]
mov byte [esp + 0x18], 0
push eax
mov ecx, esi
call fcn.004178b0
mov ecx, dword [esi + 0x10]
cmp eax, ecx
ja 0x40a445
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 0x10
jb 0x40a42f
mov esi, dword [esi]
mov byte [esi + eax], 0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004351b3
mov esp, ebp
pop ebp
ret
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00405de0
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004351b3
mov esp, ebp
pop ebp
ret
Function at 0x40a4e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55017e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5c0078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x5c3a41
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
test esi, esi
je 0x40a557
lea edi, [esi - 1]
mov dword [ebp - 0x18], 0
mov ecx, edi
xor ecx, esi
bsr eax, ecx
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 0x18], eax
add al, 0x41
mov byte [ebp - 0x14], al
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40a591
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
call dword [eax + 8]
and esi, edi
jne 0x40a524
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x40a576
mov edx, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004351b3
mov esp, ebp
pop ebp
ret
call fcn.0041ea94
int3

Function at 0x40a5a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5501bb
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x5c0078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x148], esi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14c], 0
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x114], 0
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
jne 0x40a61b
xor ecx, ecx
jmp 0x40a62d
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a624
sub ecx, edx
push ecx
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x12c]
call fcn.00404850
push 1
push 0
lea eax, [ebp - 0x144]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x12c]
call fcn.00402a40
push eax
mov ecx, esi
call fcn.00402ac0
mov eax, dword [ebp - 0x130]
cmp eax, 0x10
jb 0x40a683
inc eax
lea ecx, [ebp - 0x144]
push eax
push dword [ebp - 0x144]
call fcn.00404f30
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0x130], 0xf
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x144], 0
cmp ecx, 0x10
jb 0x40a6bc
inc ecx
push ecx
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x12c]
call fcn.00404f30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004351b3
mov esp, ebp
pop ebp
ret
Function at 0x40b5d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5c0078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 0
push eax
push 0
mov esi, ecx
xorps xmm0, xmm0
push 0
mov dword [ebp - 0x14], esi
push 0
mov byte [ebp - 0x10], 0
movq qword [ebp - 0xf], xmm0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x40b667
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push str._08lX
push 9
push eax
call fcn.004017f0
mov dword [esi + 0x14], 0xf
add esp, 0x10
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x10], 0
jne 0x40b646
xor ecx, ecx
jmp 0x40b659
lea ecx, [ebp - 0x10]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b650
sub ecx, edx
push ecx
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00404850
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004351b3
mov esp, ebp
pop ebp
ret
Function at 0x40c660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x550648
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5c0078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
xorps xmm0, xmm0
mov dword [ebp - 0x30], esi
push 0x20
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], 0
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x20], 0
call fcn.00406da0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push 0x10
movq qword [ebp - 0x1c], xmm0
call fcn.00406da0
mov byte [ebp - 4], 1
push 0x20
push dword [ebp - 0x28]
call fcn.00436500
add esp, 8
cmp eax, 1
je 0x40c6ee
push 1
call fcn.0052e5d8
push 0x10
push dword [ebp - 0x1c]
call fcn.00436500
add esp, 8
cmp eax, 1
je 0x40c707
push 1
call fcn.0052e5d8
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0041a9d0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
lea ecx, [esi + 0xc]
call fcn.0041a9d0
lea ecx, [ebp - 0x1c]
call fcn.00404670
lea ecx, [ebp - 0x28]
call fcn.00404670
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004351b3
mov esp, ebp
pop ebp
ret
Function at 0x411910
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x5c0078]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
lea eax, [ebp - 0x354]
push 0
push eax
call fcn.00527720
add esp, 0xc
lea eax, [ebp - 0x108]
xorps xmm0, xmm0
movups xmmword [ebp - 0x364], xmm0
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push eax
push str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
lea eax, [ebp - 0x310]
push 0x208
push eax
call fcn.004118b0
add esp, 0x10
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x354]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x360]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x364]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004351b3
mov esp, ebp
pop ebp
ret
Function at 0x417e90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x551a58
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5c0078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x417fbe
cmp byte [ebx + 0x3d], 0
je 0x417fbe
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x417ee9
xor al, al
jmp 0x417fc0
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00404780
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x417f4f
sub eax, 1
je 0x417f53
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x417fa6
xor bl, bl
jmp 0x417fa8
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x417f88
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0053001c
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x417f4b
cmp byte [ebx + 0x3d], 0
je 0x417fa6
test esi, esi
jne 0x417f11
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00405de0
jmp 0x417f0e
mov bl, 1
cmp ecx, 0x10
jb 0x417fba
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00404f30
mov al, bl
jmp 0x417fc0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004351b3
mov esp, ebp
pop ebp
ret
Function at 0x41d7e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041d2e0
add esp, 0xc
test eax, eax
js 0x41d9d3
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [eax + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x41d860
lea esi, [eax + 8]
add eax, 8
lea esi, [esi + edi*4]
nop word [eax + eax]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x41d820
mov ebx, dword [ebp + 0x10]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x41d9ce
lea esi, [ebx + 2]
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + str.cc]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x5afab8]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x5af1b8]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x5af5b8]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x5b0ae0]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + str.cc]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x5afab8]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x5af1b8]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x5af5b8]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x5b0ae0]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + str.cc]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x5afab8]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x5af1b8]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x5af5b8]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x5b0ae0]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + str.cc]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x5afab8]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x5af1b8]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x5af5b8]
movzx eax, dl
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x5b0ae0]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x41d877
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4379a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor dl, dl
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x4379c6
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x4379b6
pop edi
movzx eax, dl
pop esi
ret

Function at 0x438490
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
mov eax, 0x6c
call fcn.00436490
mov eax, dword [0x5c0078]
xor eax, esp
mov dword [esp + 0x68], eax
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x438506
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4384fa
mov eax, 8
call fcn.00436490
movsd xmm0, qword [0x558540]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.004364c0
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x43856a
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x43855e
mov eax, 8
call fcn.00436490
movsd xmm0, qword [0x558540]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.004364c0
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call fcn.004385f0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 8
call fcn.00436490
movsd xmm0, qword [0x558538]
lea eax, [esp + 0x10]
movsd qword [esp], xmm0
push 0x20
push eax
call fcn.004364c0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
mov eax, 8
call fcn.00436490
movsd xmm0, qword [0x558538]
lea eax, [esp + 0xc]
movsd qword [esp], xmm0
push 4
push eax
call fcn.004364c0
mov ecx, dword [esp + 0x78]
add esp, 0x10
xor ecx, esp
mov eax, 1
call fcn.004351b3
add esp, 0x6c
ret
Function at 0x4519c0
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.00480e20
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.00529730
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x451a77
push 0x4a
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00439930
push 0x56d94c
push esi
push 0x56d950
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.00439120
add esp, 0x2c
call fcn.0052d258
cmp dword [eax], 2
je 0x451a59
call fcn.0052d258
cmp dword [eax], 6
je 0x451a59
push 0x53
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00439930
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x51
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00439930
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x56d8e8
call fcn.0043b8c0
mov esi, eax
add esp, 4
test esi, esi
jne 0x451a99
push edi
call fcn.0052ea18
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.0043b4d0
push edi
push ebx
push 0x6a
push esi
call fcn.0043b500
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x45d230
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
cmp ebx, 2
je 0x45d28c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x45d27d
push eax
push 0
lea eax, [esp + 0x24]
push eax
push 0
call fcn.0048e180
add esp, 0x10
cmp dword [esp + 0x1c], 0xffffffff
je 0x45d27d
push 0x2f
push str.....openssl_1.1.0fcryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.00439930
add esp, 0x14
xor eax, eax
pop edi
pop ebx
ret
test edi, edi
je 0x45d288
cmp dword [esp + 0x18], 0x20
je 0x45d28c
push 0x35
jmp 0x45d262
push esi
push 0x3a
push str.....openssl_1.1.0fcryptoececx_meth.c
push 0x24
call fcn.00437940
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x45d2c2
push 0x3c
push str.....openssl_1.1.0fcryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.00439930
add esp, 0x14
xor eax, eax
pop esi
pop edi
pop ebx
ret
test ebx, ebx
jne 0x45d2d9
push dword [esp + 0x1c]
push edi
push esi
call fcn.00527130
add esp, 0xc
jmp 0x45d385
push 0x43
push str.....openssl_1.1.0fcryptoececx_meth.c
push 0x20
call fcn.004854d0
add esp, 0xc
mov dword [esi + 0x20], eax
test eax, eax
jne 0x45d31c
push 0x45
push str.....openssl_1.1.0fcryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.00439930
push 0x46
push str.....openssl_1.1.0fcryptoececx_meth.c
push esi
call fcn.00437700
add esp, 0x20
xor eax, eax
pop esi
pop edi
pop ebx
ret
cmp ebx, 2
jne 0x45d36b
push 0x20
push eax
call fcn.00436500
add esp, 8
test eax, eax
jg 0x45d355
push 0x4b
push str.....openssl_1.1.0fcryptoececx_meth.c
push dword [esi + 0x20]
call fcn.004854c0
push 0x4c
push str.....openssl_1.1.0fcryptoececx_meth.c
push esi
call fcn.00437700
add esp, 0x18
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, dword [esi + 0x20]
and byte [eax], 0xf8
mov eax, dword [esi + 0x20]
and byte [eax + 0x1f], 0x7f
mov eax, dword [esi + 0x20]
or byte [eax + 0x1f], 0x40
jmp 0x45d379
movups xmm0, xmmword [edi]
movups xmmword [eax], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + 0x10], xmm0
push dword [esi + 0x20]
push esi
call fcn.0049dc50
add esp, 8
push esi
push 0x40a
push dword [esp + 0x18]
call fcn.00456180
add esp, 0xc
mov eax, 1
pop esi
pop edi
pop ebx
ret