joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50d8dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x50d901
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x50d919
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x50d948
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x50d98a
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x50da5e
sub edx, 0x10000
js 0x50da5e
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x50d970
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x50d970
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x50d9e1
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x50d9de
add edx, 8
jne 0x50d9c5
jmp 0x50da4f
add edx, 4
test eax, 0xffff
jne 0x50d9ee
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x50da4f
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x50da22
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x50d970
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x50da5e
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x50d970
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x50da6f
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x50db00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
xor eax, eax
xor ebx, ebx
cmp edx, 0
je 0x50dc63
mov al, byte [edi]
mov bl, byte [edi + 4]
add edi, 8
lea ecx, [esi + edx]
sub ebp, esi
mov dword [esp + 0x18], ecx
inc al
cmp dword [edi + 0x100], 0xffffffff
je 0x50dc30
mov ecx, dword [edi + eax*4]
and edx, 0xfffffffc
je 0x50dc00
lea edx, [esi + edx - 4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebp
lea esp, [esp]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
mov ecx, dword [edi + eax*4]
mov ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [edi + eax*4]
or ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [edi + eax*4]
or ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [esp + 0x20]
or ebp, dword [edi + edx*4]
ror ebp, 8
xor ebp, dword [esi]
cmp esi, dword [esp + 0x1c]
mov dword [ecx + esi], ebp
lea esi, [esi + 4]
mov ecx, dword [edi + eax*4]
jb 0x50db60
cmp esi, dword [esp + 0x18]
je 0x50dc5b
mov ebp, dword [esp + 0x20]
lea esp, [esp]
nop
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
mov edx, dword [edi + edx*4]
xor dl, byte [esi]
lea esi, [esi + 1]
mov ecx, dword [edi + eax*4]
cmp esi, dword [esp + 0x18]
mov byte [ebp + esi - 1], dl
jb 0x50dc00
jmp 0x50dc5b
movzx ecx, byte [edi + eax]
add bl, cl
movzx edx, byte [edi + ebx]
mov byte [edi + ebx], cl
mov byte [edi + eax], dl
add dl, cl
movzx edx, byte [edi + edx]
add al, 1
xor dl, byte [esi]
lea esi, [esi + 1]
movzx ecx, byte [edi + eax]
cmp esi, dword [esp + 0x18]
mov byte [ebp + esi - 1], dl
jb 0x50dc34
dec al
mov byte [edi - 4], bl
mov byte [edi - 8], al
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40611c
pop dword [ebp - 0x40]
mov eax, 0x3e634d08
add eax, 0xc1dd1414
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xb5b5f84b
sub dword [ebp - 0x50], 0x6763b300
mov dword [ebp - 0x4c], 0xaf909283
sub dword [ebp - 0x4c], 0x7d5d463e
mov dword [ebp - 0x48], 0x4895903e
add dword [ebp - 0x48], 0x3b6b3f0
mov dword [ebp - 0x44], 0xc8fb93fc
add dword [ebp - 0x44], 0x37046c04
lea eax, [ebp - 0x50]
push eax
mov eax, 0x9c62e2ec
sub eax, 0x9c22728c
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x25153283
sub dword [ebp - 0x50], 0xb0a2c92d
mov dword [ebp - 0x4c], 0x47277988
sub dword [ebp - 0x4c], 0x5bb1813
mov dword [ebp - 0x48], 0x935a9189
add dword [ebp - 0x48], 0xd014dae3
mov dword [ebp - 0x44], 0x3e9a0a79
add dword [ebp - 0x44], 0xc165f587
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xb8213c62
add eax, 0x481f349e
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x33bb7
push 0
call eax
mov ecx, 0x717767c4
sub ecx, 0x71772b45
mov edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x40]
mov esi, 0xeaeb37d6
add esi, 0x725b5067
xor dword [ebp - 0x20], ecx
mov edi, dword [ebx]
xor dword [ebp - 0x30], esi
sub edi, esi
sub dword [ebp - 0x24], edx
mov dword [edx], edi
xor dword [ebp - 0x24], esi
add edx, 4
add ebx, 0xcef50882
add ebx, 0x310af782
loop 0x406238
add eax, 0xc44057a1
add eax, 0x3bc08d2e
mov ebx, eax
add eax, 5
mov ecx, 0xef9eff9e
add ecx, 0x10a10062
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x414420
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x78
mov eax, dword [0x51f164]
xor eax, esp
mov dword [esp + 0x74], eax
push esi
mov esi, ecx
mov dword [esp + 0x34], 0x40
push edi
lea eax, [esp + 0x38]
mov dword [esp + 0x30], esi
push eax
mov dword [esp + 0x34], esi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
call fcn.004914f0
xorps xmm1, xmm1
sub esp, 8
cvtsd2ss xmm1, xmm0
movss xmm0, dword [0x505650]
mulss xmm1, xmm0
mulss xmm1, xmm0
mulss xmm1, xmm0
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push 0x4f8208
movsd qword [esp + 0x3c], xmm0
call fcn.00402120
add esp, 0xc
mov dword [esi + 0x10], 0
mov edi, eax
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov byte [esi], 0
push 0
push edi
call fcn.00436e70
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x4144c0
mov eax, dword [esi]
movsd xmm0, qword [esp + 0x30]
lea ecx, [edi + 1]
sub esp, 8
movsd qword [esp], xmm0
push 0x4f8208
push ecx
push eax
call fcn.004020c0
mov ecx, dword [esp + 0x90]
add esp, 0x14
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004905bb
mov esp, ebp
pop ebp
ret

Function at 0x414500
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d69b0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 0
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0
push eax
xor edi, edi
push 2
push edi
push edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.NETAPI32.dll_NetUserEnum]
mov ebx, eax
mov dword [ebp - 0x28], ebx
test ebx, ebx
je 0x414581
cmp ebx, 0xea
je 0x414581
mov ecx, dword [ebp - 0x24]
jmp 0x4145fb
mov ecx, dword [ebp - 0x24]
mov esi, ecx
test esi, esi
je 0x41460f
xor ebx, ebx
cmp ebx, dword [ebp - 0x18]
jae 0x4145f8
test esi, esi
je 0x4145f8
mov dword [ebp - 4], 0
mov edx, dword [esi]
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 0x30], ecx
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4145b0
sub eax, dword [ebp - 0x30]
sar eax, 1
push eax
lea eax, [ebx + ebx*2]
push edx
lea ecx, [eax*8 + 0x5296c0]
call fcn.00436c20
inc edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
add esi, 4
mov dword [ebp - 0x2c], edi
inc ebx
jmp 0x414590
mov ebx, dword [ebp - 0x28]
test ecx, ecx
je 0x41460f
mov esi, dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
push ecx
call esi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
jmp 0x414615
mov esi, dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp ebx, 0xea
je 0x414615
test ecx, ecx
je 0x414624
push ecx
call esi
push 7
lea eax, [edi + edi*2]
push 0x4ffa1c
lea ecx, [eax*8 + 0x5296c0]
call fcn.00436c20
lea eax, [edi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004905bb
mov esp, ebp
pop ebp
ret
Function at 0x415920
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6b98
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
lea eax, [edx + edx*2]
cmp dword [eax*8 + 0x51fde4], 8
lea edx, [eax*8 + 0x51fdd0]
mov ecx, edx
jb 0x41596f
mov ecx, dword [edx]
mov eax, dword [edx + 0x10]
lea eax, [ecx + eax*2]
jb 0x415979
mov edx, dword [edx]
push ecx
push eax
push edx
lea ecx, [ebp - 0x38]
call fcn.0043a4d0
push 0x4fab14
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.00431940
cmp dword [ebp - 0x24], 0x10
lea ebx, [ebp - 0x38]
cmovae ebx, dword [ebp - 0x38]
push ebx
mov dword [ebp - 0x40], ebx
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathA]
test eax, eax
setne byte [ebp - 0x39]
test ebx, ebx
je 0x4159ff
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4159c0
sub ecx, edx
lea ebx, [ecx + 1]
cmp ebx, 0x3fffffff
jg 0x4159ff
lea eax, [ebx + ebx]
call fcn.00491660
mov esi, esp
test esi, esi
je 0x4159ff
push ebx
push esi
push 0xffffffffffffffff
push dword [ebp - 0x40]
xor eax, eax
push eax
push 3
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
jmp 0x415a01
xor eax, eax
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [ebp - 0x18]
test eax, eax
mov edx, dword [ebp - 0x14]
mov eax, ecx
setne bl
or eax, edx
je 0x415a5e
test edx, edx
jl 0x415a5e
jg 0x415a2d
test ecx, ecx
jb 0x415a5e
test bl, bl
je 0x415a5e
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov esi, dword [ebp - 0x1c]
mov bl, byte [ebp - 0x39]
sbb edx, esi
test bl, bl
jne 0x415a54
mov ebx, dword [ebp - 0x44]
add dword [ebx], eax
mov eax, dword [ebp - 0x48]
adc dword [ebx + 4], esi
add dword [eax], ecx
adc dword [eax + 4], edx
jmp 0x415a5e
cmp bl, 1
jne 0x415a5e
add dword [edi], ecx
adc dword [edi + 4], edx
mov edx, dword [ebp - 0x24]
cmp edx, 0x10
jb 0x415a8e
mov ecx, dword [ebp - 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x415a84
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415aad
push edx
push ecx
call fcn.00490c3c
add esp, 8
lea esp, [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004905bb
mov esp, ebp
pop ebp
ret
call fcn.004b5132
int3
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40633c
pop dword [ebp - 0x1c]
mov eax, 0x1fce50fa
sub eax, 0x1f8dedbe
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xbcec5ef6
add dword [ebp - 0x2c], 0x9165e655
mov dword [ebp - 0x28], 0xdceb591a
add dword [ebp - 0x28], 0x5547f32b
mov dword [ebp - 0x24], 0xbbfba65e
sub dword [ebp - 0x24], 0x6faf6230
mov dword [ebp - 0x20], 0x7ac76f82
sub dword [ebp - 0x20], 0x7ac76f82
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x4ff3e6a9
sub dword [ebp - 0x2c], 0xdb817d53
mov dword [ebp - 0x28], 0xe5db6f76
add dword [ebp - 0x28], 0x5b90f1ff
mov dword [ebp - 0x24], 0x747424c4
add dword [ebp - 0x24], 0xeefb47a8
mov dword [ebp - 0x20], 0x8d71ee39
add dword [ebp - 0x20], 0x728e11c7
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x2a24e4ff
add eax, 0xd61b8c01
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x356a5
push 0
call eax
mov ecx, 0x2ae6005b
add ecx, 0xd51a42d5
xor edi, edi
add edi, eax
mov edx, 0x3c107601
sub edx, 0x3bcf7601
add edx, dword [ebp - 0x1c]
mov esi, 0x9331c8bd
xor dword [ebp - 0x18], 0x4ff602e0
mov ebx, dword [edx]
xor dword [ebp - 0x10], eax
xor ebx, esi
sub dword [ebp - 0xc], 0x850873ae
mov dword [edi], ebx
add edi, 4
add edx, 0xabffed33
add edx, 0x540012d1
loop 0x406455
add eax, 0xff93
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x86b469fb
add ecx, 0x798b9605
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x419173
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x419182
pop dword [ebp - 0x2c]
mov eax, 0x419182
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x95775224
sub dword [ebp - 0x3c], 0x47250cd9
mov dword [ebp - 0x38], 0x4f356c7
add dword [ebp - 0x38], 0x2d3ff57e
mov dword [ebp - 0x34], 0x84b74e12
sub dword [ebp - 0x34], 0x386b09e4
mov dword [ebp - 0x30], 0xc23960e1
add dword [ebp - 0x30], 0x3dc69f1f
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xd136f043
sub eax, 0xd0f4bfcf
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xe32d164b
sub dword [ebp - 0x3c], 0x6ebaacf5
mov dword [ebp - 0x38], 0x166c7638
add dword [ebp - 0x38], 0x2affeb3d
mov dword [ebp - 0x34], 0x197ceabd
sub dword [ebp - 0x34], 0xb60d7e51
mov dword [ebp - 0x30], 0xcda62ef4
add dword [ebp - 0x30], 0x3259d10c
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x395f60cf
add eax, 0xc6e2d055
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3dd24
push 0
call eax
mov ecx, 0x1056169f
sub ecx, 0x1055ce2e
xor edx, edx
add edx, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x2c]
mov esi, 0x72b82957
add esi, 0x1e1f2dc3
add dword [ebp - 4], edx
mov edi, dword [ebx]
mov dword [ebp - 0x10], 0xaac31fdc
sub edi, esi
xor dword [ebp - 0x28], 0x37afe1a0
mov dword [edx], edi
mov dword [ebp - 0xc], 0xaf40390
add edx, 0xc6abcf06
sub edx, 0xc6abcf02
add ebx, 0x352f36f5
sub ebx, 0x352f36f1
loop 0x41929b
add eax, 0x44a7b0b1
sub eax, 0x44a69c1a
xor ebx, ebx
add ebx, eax
add eax, 0x2c3284ac
sub eax, 0x2c3284a7
mov ecx, 0xfd328f75
add ecx, 0x30d708b
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40ca20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f84a0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x672494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.0040c9e0
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
push dword [ecx]
lea ecx, [esi + 0x10]
call fcn.0040e6e0
mov dword [esi + 0x28], 0
mov eax, esi
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40fde0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.0040ff20
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x410b60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x672494]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x410c01
cmp byte [esi + 0x3d], 0
je 0x410c01
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x410bb7
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x410bc9
sub eax, 1
je 0x410bcd
sub eax, 2
je 0x410c01
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d0a85
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x410bea
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00575508
add esp, 0x10
cmp edi, eax
jne 0x410bb7
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d0a85
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004d0a85
mov esp, ebp
pop ebp
ret
Function at 0x414e60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f8d08
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x672494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
mov dword [ebp - 0x18], 0
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edi]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.00416a30
mov eax, dword [ebp + 8]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 1
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.00415a50
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx ebx, ax
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x414f28
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x414f28
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov byte [ebp - 4], 0
cmp dword [esi + 0x38], 0
mov word [esi + 0x40], bx
jne 0x414f46
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.0040f100
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41f210
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x30]
push ebx
push esi
mov dword [ebp - 0x14], ecx
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor esi, esi
mov edi, dword [eax + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, esi
mov dword [ebp - 0x10], edx
test edx, edx
je 0x41f282
mov eax, edx
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, eax
jne 0x41f250
mov eax, dword [ebp - 8]
cmp ecx, 0xc0323159
je 0x41f286
mov eax, dword [eax]
jmp 0x41f228
mov edx, dword [eax + 0x18]
mov eax, dword [0x67f428]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41f31b
test edx, edx
je 0x41f314
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41f314
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x41f314
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x41f305
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x41f2d4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x4f1731cb
je 0x41f333
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x41f2c4
xor eax, eax
mov dword [0x67f428], eax
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x14]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x41f316
Function at 0x41f350
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x30]
push ebx
push esi
mov dword [ebp - 0x14], ecx
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor esi, esi
mov edi, dword [eax + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, esi
mov dword [ebp - 0x10], edx
test edx, edx
je 0x41f3c2
mov eax, edx
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, eax
jne 0x41f390
mov eax, dword [ebp - 8]
cmp ecx, 0x4f644736
je 0x41f3c6
mov eax, dword [eax]
jmp 0x41f368
mov edx, dword [eax + 0x18]
mov eax, dword [0x67f420]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41f45b
test edx, edx
je 0x41f454
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41f454
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x41f454
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x41f445
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x41f414
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xbac83be9
je 0x41f47e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x41f404
xor eax, eax
mov dword [0x67f420], eax
push 5
push 0
push 0
push dword [ebp - 0x14]
push str.open
push 0
call eax
xor ecx, ecx
cmp eax, 0x20
pop edi
setg cl
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x41f456