joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cbd40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x4cbd64
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x4cbd81
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4cbd70
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x4cbdba
cmp eax, edi
jne 0x4cbdb2
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x4cbdc2
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4cbdc2
cmp eax, edi
jne 0x4cbdc2
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.004b60f0
push 0x48
push edi
call fcn.0051ec14
mov eax, dword [ebp - 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4d2990
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
cmp dword [ebx + 0x10], 0
jne 0x4d29b0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 8]
mov ecx, edi
cmp dword [edi + 0x14], 0x10
jb 0x4d29bd
mov ecx, dword [edi]
call fcn.004c5a30
cmp eax, 0x24
jne 0x4d2a2d
push 0xa
xor edx, edx
mov ecx, ebx
call fcn.0040f9a0
add esp, 4
mov dword [esp + 0xc], eax
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4d29fa
mov eax, dword [esi + 0x24]
shr eax, 1
test al, 1
jne 0x4d29fa
push 0
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0xc]
push eax
mov dword [esi + 0x60], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4d2a26
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x60]
shr eax, 1
test al, 1
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
je 0x4d2a21
push 0
jmp 0x4d2a23
push 5
push ecx
call eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x44]
push ebx
push edi
mov ecx, esi
call fcn.004c73f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4dc2a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4dc2ab
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004dc2c0
Function at 0x4e8470
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x5b706c]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x338
push 8
push 0
push ebx
call edi
mov ecx, eax
add esp, 0x10
mov dword [esp + 0xc], ecx
test ecx, ecx
jne 0x4e84b8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0051e9d8
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 4]
mov dword [esp + 0x1c], 0x583a98
lea esi, [ecx + 0x80]
mov dword [eax], 0
xor ecx, ecx
mov byte [eax + 4], 8
mov byte [esi + 0x3c], 1
mov word [eax + 6], cx
mov dword [eax + 0x60], ecx
mov dword [eax + 0x30], ecx
mov word [eax + 0x6e], cx
mov byte [eax + 5], 1
mov dword [eax + 0x10], esi
mov dword [eax + 0x20], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x2c], eax
mov dword [eax + 0x58], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x64], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x24], ecx
mov ecx, 1
mov byte [eax + 0x74], 1
mov word [eax + 0x6c], cx
mov byte [eax + 8], 0
mov dword [eax + 0x5c], 0
mov dword [esi + 0x7c], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esi + 4], ebx
lea ebx, [ecx + 0xf]
push 0
mov dword [esi], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], fcn.004e8470
call fcn.0052fa75
mov edi, eax
add esp, 4
xor edi, ebx
movzx edx, byte [esp + ebx + 0x13]
mov ecx, edi
shl ecx, 5
mov eax, edi
add edx, ecx
shr eax, 2
add edx, eax
dec ebx
xor edi, edx
cmp ebx, 1
jae 0x4e8553
mov dword [esi + 0x38], edi
mov edx, 0x4e8130
mov word [esi + 0x3e], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x80], 0
mov byte [esi + 0x3d], 7
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x68], 0
mov dword [esi + 8], 0x338
mov dword [esi + 0xc], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0xc8
mov dword [esi + 0x74], 0xc8
mov dword [esi + 0xe8], 0
mov dword [esi + 0xec], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov esi, dword [esp + 0xc]
add esi, 4
push 0
mov ecx, esi
call fcn.004ee440
add esp, 4
test eax, eax
je 0x4e869e
mov ecx, esi
call fcn.004e8360
xor esi, esi
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051e9d8
mov esp, ebp
pop ebp
ret
Function at 0x4ef850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov dword [ebp - 0x10], edx
mov esi, ecx
call fcn.00536846
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0xc], ecx
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], esi
mov cl, byte [esi]
movzx eax, cl
test byte [eax + 0x584291], 8
je 0x4ef8b0
nop
mov cl, byte [esi + 1]
inc esi
movzx eax, cl
test byte [eax + 0x584291], 8
jne 0x4ef8a0
lea edx, [esi + 1]
cmp cl, 0x2d
jne 0x4ef8c1
mov dword [ebp - 0x14], 1
jmp 0x4ef8ca
cmp cl, 0x2b
mov dword [ebp - 0x14], edi
cmovne edx, esi
cmp byte [edx], 0x30
jne 0x4efa11
mov al, byte [edx + 1]
cmp al, 0x78
je 0x4ef8e2
cmp al, 0x58
jne 0x4efa11
movsd xmm2, qword [0x599df8]
add edx, 2
xor esi, esi
nop
mov al, byte [edx]
movsx ecx, al
mov dword [ebp - 0x1c], edx
mov byte [ebp - 1], al
cmp ecx, dword [ebp - 0x18]
jne 0x4ef90c
test esi, esi
jne 0x4ef962
mov esi, 1
inc edx
jmp 0x4ef8f0
movzx eax, al
test byte [eax + 0x584291], 0x10
je 0x4ef962
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4ef92a
cmp byte [ebp - 1], 0x30
jne 0x4ef92a
inc dword [ebp - 0xc]
jmp 0x4ef95a
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x1e
jg 0x4ef959
test byte [ecx + 0x584291], 2
je 0x4ef941
add ecx, 0xffffffd0
jmp 0x4ef947
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x4ef95a
inc edi
test esi, esi
je 0x4ef95f
dec edi
inc edx
jmp 0x4ef8f0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
je 0x4efa11
mov eax, dword [ebp - 0x10]
shl edi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x4ef980
cmp al, 0x50
jne 0x4ef9e2
inc edx
xor ecx, ecx
mov dl, byte [edx]
cmp dl, 0x2d
jne 0x4ef992
lea esi, [ecx + 1]
lea eax, [ecx + 2]
jmp 0x4ef99d
xor eax, eax
xor esi, esi
cmp dl, 0x2b
sete al
inc eax
mov edx, dword [ebp - 0x1c]
add edx, eax
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x584291], 2
je 0x4efa11
movsx eax, byte [ebp - 1]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x584291], 2
jne 0x4ef9b3
mov eax, ecx
neg eax
test esi, esi
cmove eax, ecx
add edi, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
cmp dword [ebp - 0x14], 0
je 0x4ef9ef
xorps xmm1, xmmword [0x599f40]
push edi
sub esp, 8
movsd qword [esp], xmm1
call fcn.005370db
fstp qword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x20]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
xorps xmm0, xmm0
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4efc60
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x5b706c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
lea edx, [ebp - 0xe0]
call fcn.004efab0
mov edx, eax
test edx, edx
je 0x4efcba
mov ecx, dword [ebp - 0xe0]
sub edx, esi
mov dword [ebx], ecx
mov eax, 0x13
mov ecx, dword [ebp - 0xdc]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], eax
lea eax, [edx + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051e9d8
mov esp, ebp
pop ebp
ret
push str..xXnN
push esi
call fcn.00535120
add esp, 8
test eax, eax
je 0x4efcea
movzx edi, byte [eax]
or edi, 0x20
cmp edi, 0x6e
jne 0x4efcec
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051e9d8
mov esp, ebp
pop ebp
ret
xor edi, edi
push edi
lea edx, [ebp - 0xf0]
mov ecx, esi
call fcn.004efa20
mov edx, eax
add esp, 4
test edx, edx
jne 0x4efd9e
push 0x2e
push esi
call fcn.00524370
mov edx, esi
mov dword [ebp - 0xdc], eax
add esp, 8
lea ecx, [edx + 1]
mov dword [ebp - 0xe4], ecx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4efd23
sub edx, dword [ebp - 0xe4]
cmp edx, 0xc8
ja 0x4efcd7
test eax, eax
je 0x4efcd7
lea edx, [ebp - 0xd8]
mov ecx, esi
sub edx, esi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4efd46
call fcn.00536846
mov ecx, dword [ebp - 0xdc]
lea edx, [ebp - 0xf0]
sub ecx, esi
push edi
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp + ecx - 0xd8], al
lea ecx, [ebp - 0xd8]
call fcn.004efa20
mov edx, eax
add esp, 4
test edx, edx
je 0x4efcd7
mov eax, esi
lea ecx, [ebp - 0xd8]
sub eax, ecx
add edx, eax
test edx, edx
je 0x4efcd7
movsd xmm0, qword [ebp - 0xf0]
sub edx, esi
mov ecx, dword [ebp - 4]
mov eax, 3
pop edi
movsd qword [ebx], xmm0
xor ecx, ebp
mov dword [ebx + 8], eax
lea eax, [edx + 1]
pop esi
pop ebx
call fcn.0051e9d8
mov esp, ebp
pop ebp
ret

Function at 0x4f1560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov edi, esi
mov eax, esi
xor eax, dword [ebp + 8]
shr edi, 5
inc edi
cmp esi, edi
jb 0x4f159b
nop dword [eax]
movzx edx, byte [ebx + esi - 1]
mov ecx, eax
shl ecx, 5
sub esi, edi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, edi
jae 0x4f1580
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4f16f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
mov dword [ebp - 8], eax
mov edi, dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov esi, eax
mov edx, eax
mov dword [ebp - 4], edi
shr edx, 5
mov ebx, dword [edi + 0x38]
inc edx
xor ebx, eax
cmp eax, edx
jb 0x4f173e
mov edi, dword [ebp - 0xc]
nop
movzx ecx, byte [edi + esi - 1]
mov eax, ebx
shl eax, 5
sub esi, edx
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, eax
xor ebx, ecx
cmp esi, edx
jae 0x4f1720
mov edi, dword [ebp - 4]
mov edx, dword [edi + 0x20]
mov eax, dword [edi + 0x18]
lea ecx, [edx - 1]
and ecx, ebx
mov edi, dword [eax + ecx*4]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x4f17ec
mov ecx, dword [ebp + 8]
nop dword [eax]
movzx eax, byte [edi + 7]
cmp ecx, eax
jne 0x4f17bb
mov edx, dword [ebp - 0xc]
lea eax, [edi + 0x10]
mov esi, ecx
sub esi, 4
jb 0x4f1786
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x4f178b
add edx, 4
add eax, 4
sub esi, 4
jae 0x4f1775
cmp esi, 0xfffffffc
je 0x4f17ca
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x4f17b8
cmp esi, 0xfffffffd
je 0x4f17ca
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x4f17b8
cmp esi, 0xfffffffe
je 0x4f17ca
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x4f17b8
cmp esi, 0xffffffff
je 0x4f17ca
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x4f17ca
mov ecx, dword [ebp + 8]
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4f1760
mov esi, dword [ebp - 4]
mov edx, dword [esi + 0x20]
jmp 0x4f17ef
mov ecx, dword [ebp - 4]
mov al, byte [edi + 5]
xor al, 3
mov cl, byte [ecx + 0x3c]
xor cl, 3
test al, cl
jne 0x4f1875
mov byte [edi + 5], al
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cmp dword [esi + 0x1c], edx
jl 0x4f1817
cmp edx, 0x3fffffff
jg 0x4f1817
add edx, edx
mov ecx, edi
call fcn.004f15a0
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x18]
dec ecx
and ecx, ebx
lea eax, [eax + ecx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov esi, dword [edi + 0x10]
add eax, 0x11
push eax
push 4
mov ecx, edi
call fcn.004f24e0
mov cl, byte [esi + 0x3c]
mov edi, eax
and cl, 3
mov byte [edi + 5], cl
lea eax, [edi + 0x10]
mov byte [edi + 4], 4
mov ecx, dword [esi + 0x40]
mov dword [edi], ecx
mov dword [esi + 0x40], edi
mov dword [edi + 8], ebx
mov ebx, dword [ebp + 8]
push ebx
push dword [ebp - 0xc]
mov byte [edi + 6], 0
push eax
mov byte [edi + ebx + 0x10], 0
call fcn.00524840
mov ecx, dword [ebp - 0x10]
add esp, 0x14
mov byte [edi + 7], bl
mov eax, dword [ecx]
mov dword [edi + 0xc], eax
mov dword [ecx], edi
mov ecx, dword [ebp - 4]
inc dword [ecx + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x500750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esp + 0x1c], edx
push edi
mov dword [esp + 0x24], esi
mov edi, 1
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
sub ecx, dword [eax]
sub ecx, 0x10
sar ecx, 4
sub ecx, ebx
jne 0x500794
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0x24]
dec ecx
mov edx, ebx
mov dword [esp + 0x2c], ecx
mov ecx, esi
call fcn.004e4b80
cmp eax, 0x583a98
je 0x5008a2
mov eax, dword [eax + 8]
and eax, 0xf
cmp al, 3
jne 0x5008a2
mov edx, ebx
mov ecx, esi
call fcn.004e4b80
mov ecx, dword [esp + 0x24]
mov edx, ebx
mov esi, eax
call fcn.004e4b80
cmp dword [eax + 8], 0x13
jne 0x500822
cmp dword [esi + 8], 0x13
jne 0x5007f6
mov eax, dword [esi]
mov dword [esp + 0x30], eax
mov eax, dword [esi + 4]
push eax
push dword [esp + 0x34]
mov dword [esp + 0x3c], eax
push str._lld
jmp 0x500861
push 0
lea edx, [esp + 0x34]
mov ecx, esi
call fcn.004e8900
add esp, 4
test eax, eax
jne 0x500813
xorps xmm0, xmm0
movlpd qword [esp + 0x30], xmm0
push dword [esp + 0x34]
push dword [esp + 0x34]
push str._lld
jmp 0x500861
cmp dword [esi + 8], 3
jne 0x500834
movsd xmm0, qword [esi]
movsd qword [esp + 0x38], xmm0
jmp 0x500854
lea edx, [esp + 0x38]
mov ecx, esi
call fcn.004e8830
test eax, eax
jne 0x50084e
xorps xmm0, xmm0
movsd qword [esp + 0x38], xmm0
jmp 0x500854
movsd xmm0, qword [esp + 0x38]
sub esp, 8
movsd qword [esp], xmm0
push str._.14g
push dword [esp + 0x2c]
call fcn.004e6030
add esp, 0x10
test edi, edi
je 0x500875
test eax, eax
jg 0x5008d3
xor edi, edi
mov ecx, dword [esp + 0x2c]
inc ebx
test ecx, ecx
jne 0x500790
test edi, edi
jne 0x500780
mov ecx, dword [esp + 0x24]
xor edx, edx
push edi
call fcn.004e69b0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x28]
mov edx, ebx
push eax
mov ecx, esi
call fcn.004e4fb0
add esp, 4
test eax, eax
je 0x5008da
test edi, edi
je 0x500875
push dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
push esi
push 1
push eax
call fcn.00529aba
add esp, 0x10
cmp eax, esi
jne 0x500875
mov edi, 1
jmp 0x500877
push 4
mov edx, ebx
mov ecx, esi
call fcn.004e68d0
int3
Function at 0x51fca0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55f478
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5b706c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov esi, dword [ebp + 0xc]
lea eax, [edi + 4]
push eax
mov dword [edi], vtable.std::exception.0
movq qword [eax], xmm0
lea eax, [esi + 4]
push eax
call fcn.00523d1a
add esp, 8
mov dword [edi], vtable.boost::system::system_error.0
lea ecx, [edi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.00409180
mov dword [edi + 0x2c], vtable.boost::exception.0
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x51fe50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55f520
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b706c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
lea eax, [esi + 4]
xorps xmm0, xmm0
mov dword [esi], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [ebx + 4]
push eax
call fcn.00523d1a
add esp, 8
mov dword [esi], vtable.boost::system::system_error.0
lea ecx, [esi + 0x14]
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x10], eax
lea eax, [ebx + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.00409180
mov dword [esi], vtable.boost::lock_error.0
lea edi, [esi + 0x2c]
mov dword [ebp - 4], 1
mov dword [edi], vtable.boost::exception.0
mov ecx, dword [ebx + 0x30]
mov dword [ebp + 8], edi
mov dword [edi + 4], ecx
test ecx, ecx
je 0x51fee8
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 0x34]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x38]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x3c]
mov dword [edi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x522170
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55f798
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5b706c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5b70a0]
cmp eax, 0xffffffff
jne 0x5221a6
xor ebx, ebx
jmp 0x5221af
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x5221ef
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x52222e
test esi, esi
jne 0x522232
push 0x520a20
push 0x5be638
call fcn.00520710
mov eax, dword [0x5b70a0]
add esp, 8
cmp eax, 0xffffffff
je 0x5221ef
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x52221c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x52221c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x522274
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x52225d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x522232
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x5221c0
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x522299
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x522299
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.00427060
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x522280
jmp 0x5221c0

Function at 0x5222c0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x522320
push 0
push 0
call fcn.0052f687
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x5222e9
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x522307
cmp eax, 0xffffffff
je 0x522307
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret

Function at 0x53e73a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0053e5b9

Function at 0x541b15
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00541a1a
Function at 0x546224
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00545ee4

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.00401554
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401e00
sub eax, fcn.004015cb
push eax
push fcn.004015cb
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40107d
mov eax, ebx
lea edx, [ebp - 2]
call fcn.00401478
mov eax, ebx
call fcn.004014c9
lea eax, [ebx + 0x1b600]
lea edx, [ebx - 1]
lea ecx, [ebp - 2]
and edx, eax
test ebx, ebx
je 0x401071
mov eax, 0x402054
add eax, eax
jmp 0x401076
mov eax, 0x402054
mov ebx, ecx
call fcn.004015cb
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop edx
pop ecx
pop ebx
ret

Function at 0x401554
Capabilities:
Delete file
Encode data using base64 via winapi

Disassembly:
push ebx
push ecx
push edx
enter 0x11c, 0
lea ebx, [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push ebx
call dword [sym.imp.USER32.DLL_GetCursorPos]
push 0
push 0
lea ebx, [ebp - 4]
call dword [sym.imp.USER32.DLL_GetWindow]
push ebx
lea ebx, [ebp - 0x18]
push ebx
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
lea eax, [ebp - 0x18]
movzx ebx, byte [ebp - 0x18]
push eax
sub ebx, 0x41
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, ebx
leave
pop edx
pop ecx
pop ebx
ret

Function at 0x4015cb
Capabilities:
Delete file

Disassembly:
hlt
push edi
mov edi, 0x72647246
jb 0x401617
ror byte [ecx + 0x6ed8c765], 0
inc edi
add al, 0xe8
push edi
jbe 0x4015a9
popal
mov dword [ebx + edx*2 + 0x6c], ebp
mov dword [ecx + 0x45], esp
jae 0x401612
and byte [ebp + eax*2], 0x8d
mov dword [edx - 0x39], edx
invalid
inc ebp
call 0x6e75775d
outsb dx, byte [esi]
inc ebp
inc ebp
add al, 0xa2
invalid
Function at 0x411390
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
pop ebp
jmp 0x411419
ret