joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ae20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
and esp, 0xfffffff8
sub esp, 0x24
mov esi, dword [ebp + 8]
test byte [0x100173c0], 8
jne 0x1000aec8
mov edx, dword [ebx + 8]
test edx, edx
je 0x1000ae80
cmp esi, 0xffffffff
jne 0x1000ae60
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [ebx + 0x4c]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_fputc]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov ecx, ebx
call sym.msvcirt.dll_protected:_int___thiscall_streambuf::allocate_void_
cmp eax, 0xffffffff
je 0x1000afae
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x1000af38
mov edx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x18]
cmp eax, edx
jb 0x1000af00
cmp esi, 0xffffffff
je 0x1000ae4a
mov eax, dword [ebx + 0x20]
cmp dword [ebx + 0x18], eax
jae 0x1000ae60
mov eax, dword [ebx + 0x1c]
lea edx, [eax + 1]
mov dword [ebx + 0x1c], edx
mov edx, esi
mov byte [eax], dl
jmp 0x1000ae4a
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.__p__d__n
mov dword [esp + 8], str.stdiobuf_overflow
mov dword [esp + 4], 0x100173c0
mov dword [esp], 3
call fcn.10007110
jmp 0x1000ae3e
mov edi, edx
mov edx, dword [ebx + 0x4c]
mov dword [esp + 4], 1
sub edi, eax
mov dword [esp], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], edx
call dword [sym.imp.msvcrt.dll_fwrite]
cmp edi, eax
jne 0x1000afae
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x1c], eax
jmp 0x1000aea5
mov edi, dword [ebx + 0x14]
mov eax, dword [ebx + 0x10]
mov ecx, edi
sub ecx, eax
mov edx, ecx
shr edx, 0x1f
add edx, ecx
sar edx, 1
add eax, edx
movd xmm0, eax
movdqa xmm1, xmm0
punpckldq xmm1, xmm0
test byte [0x100173c0], 8
jne 0x1000af70
movq qword [ebx + 0x18], xmm1
mov dword [ebx + 0x20], edi
jmp 0x1000aea5
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__p__p__n
mov dword [esp + 8], str.streambuf_setp
mov dword [esp + 4], 0x100173c0
mov dword [esp], 3
movq qword [esp + 0x1c], xmm1
call fcn.10007110
movq xmm1, qword [esp + 0x1c]
jmp 0x1000af62
mov eax, 0xffffffff
jmp 0x1000ae4f
Function at 0x1000b510
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
and esp, 0xfffffff8
sub esp, 0x30
test byte [0x100173c0], 8
jne 0x1000b5e8
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1000b6a0
mov edx, dword [ebx + 8]
test edx, edx
jne 0x1000b5d0
mov ecx, ebx
call sym.msvcirt.dll_protected:_int___thiscall_streambuf::allocate_void_
cmp eax, 0xffffffff
je 0x1000b6a0
mov edx, dword [ebx + 0x2c]
test edx, edx
je 0x1000b618
mov eax, dword [ebx + 0x28]
cmp eax, edx
jae 0x1000b578
lea edx, [eax + 1]
mov dword [ebx + 0x28], edx
movzx eax, byte [eax]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebx + 0x24]
sub edx, esi
test esi, esi
je 0x1000b6a0
mov eax, dword [ebx + 0x4c]
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], esi
mov dword [esp + 0xc], eax
call dword [sym.imp.msvcrt.dll_fread]
test eax, eax
jle 0x1000b6a0
mov dword [esp + 8], eax
mov edx, dword [ebx + 0x24]
mov esi, eax
neg esi
mov dword [esp + 4], edx
mov edx, dword [ebx + 0x2c]
sub edx, eax
mov dword [esp], edx
call dword [sym.imp.msvcrt.dll_memmove]
mov eax, dword [ebx + 0x2c]
add eax, esi
jmp 0x1000b563
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_fgetc]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.stdiobuf_underflow
mov dword [esp + 4], 0x100173c0
mov dword [esp], 3
call fcn.10007110
jmp 0x1000b52b
mov esi, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
movd xmm0, esi
sub eax, esi
mov edx, eax
shr edx, 0x1f
add edx, eax
sar edx, 1
lea edi, [esi + edx]
movd xmm1, edi
punpckldq xmm0, xmm1
test byte [0x100173c0], 8
jne 0x1000b650
movq qword [ebx + 0x24], xmm0
mov dword [ebx + 0x2c], edi
jmp 0x1000b57d
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__p__p__p__n
mov dword [esp + 8], str.streambuf_setg
mov dword [esp + 4], 0x100173c0
mov dword [esp], 3
mov dword [esp + 0x24], edx
movq qword [esp + 0x28], xmm0
call fcn.10007110
mov edx, dword [esp + 0x24]
movq xmm0, qword [esp + 0x28]
jmp 0x1000b641
mov eax, 0xffffffff
jmp 0x1000b56c
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, ecx
mov eax, ecx
nop
mov eax, ebx
mov eax, 0x152c4e18
cmp eax, 0xffffffc6
inc eax
cmp eax, 0xcc77e644
inc eax
mov eax, ecx
mov eax, ecx
nop
mov eax, ebx
cmp eax, 0x30
nop
cmp eax, 0x19
mov eax, ecx
inc eax
mov eax, ecx
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
mov eax, 0x1821e59f
mov eax, ebx
cmp eax, 0x24
cmp eax, 0xa0e69c4b
cmp eax, 0x60
nop
mov eax, 0x34cbcba
nop
inc eax
mov eax, ebx
mov eax, ecx
mov eax, 0x2f101e88
cmp eax, 0x47
mov eax, ecx
nop
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 0xffffffb3
mov eax, ebx
mov eax, ecx
inc eax
cmp eax, 0x6395a66f
cmp eax, 0x1e
inc eax
mov eax, 0xea323cac
mov eax, ebx
mov eax, 0x45784395
cmp eax, 0x23
mov eax, ecx
cmp eax, 0x33e030e6
inc eax
mov eax, ecx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp eax, 0xffffff93
inc eax
cmp eax, 0xc5bf1ebb
inc eax
mov eax, ecx
cmp eax, 0xffffff91
cmp eax, 0x1b605446
inc eax
inc eax
inc eax
inc eax
nop
mov eax, ecx
cmp eax, 0x2ffcde1d
mov eax, ebx
mov eax, ebx
mov eax, ecx
nop
inc eax
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
cmp eax, 0x53
mov eax, 0xfc36b8a6
cmp eax, 0x4c10cc64
inc eax
mov eax, 0x7c5d4fd7
inc eax
inc eax
mov eax, ecx
cmp eax, 0x56
nop
nop
mov eax, 0xe2f7ac8
mov eax, 0xedf9ecad
mov eax, ecx
inc eax
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
inc eax
cmp eax, 0xe7de267a
inc eax
mov eax, ecx
mov eax, ebx
mov eax, ecx
nop
inc eax
nop
inc eax
mov eax, ebx
nop
cmp eax, 0xf69c16ad
mov eax, ebx
mov eax, ecx
mov eax, ebx
cmp eax, 0x72670813
nop
nop
mov eax, ecx
nop
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001e770
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001e5e6

Function at 0x4e3030
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xdd000]
push edi
or ebp, 0xffffffff
jmp 0x4e3052
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e3059
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e3048
mov eax, 1
add ebx, ebx
jne 0x4e306b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e3060
jne 0x4e307c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e3060
xor ecx, ecx
sub eax, 3
jb 0x4e3090
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e3102
mov ebp, eax
add ebx, ebx
jne 0x4e309b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4e30a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4e30cc
inc ecx
add ebx, ebx
jne 0x4e30b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e30ad
jne 0x4e30c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e30ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e30ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e30dd
jmp 0x4e304e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e30ec
add edi, ecx
jmp 0x4e304e
pop esi
mov edi, esi
mov ecx, 0x88
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e310a
cmp byte [edi], 3
jne 0x4e310a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e310f
lea edi, [esi + 0xe1000]
mov eax, dword [edi]
or eax, eax
je 0x4e3187
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe7aac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe7b40]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e313c
mov ecx, edi
jns 0x4e316b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe7b48]
or eax, eax
je 0x4e3181
mov dword [ebx], eax
add ebx, 4
jmp 0x4e3159
call dword [esi + 0xe7b44]
mov ebp, dword [esi + 0xe7b4c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e31bb
sub esp, 0xffffff80
jmp 0x401a7e
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x438caf
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
sub esi, edi
sub esi, esi
mov esi, edi
call fcn.00438ced
push 0xda7d55c
mov edi, dword [esp]
add esp, 4
mov edi, esi
xor dword [eax], ebx
sub edi, 1
sub esp, 4
mov dword [esp], esi
pop esi
inc eax
mov esi, 0x38b580d3
cmp eax, edx
jne fcn.00438caf
mov esi, esi
inc edi
ret
Function at 0x425a60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
jmp 0x425a7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x425a81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x425a70
mov eax, 1
add ebx, ebx
jne 0x425a93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x425a88
jne 0x425aa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x425a88
xor ecx, ecx
sub eax, 3
jb 0x425ab8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x425b2a
mov ebp, eax
add ebx, ebx
jne 0x425ac3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x425ad0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x425af4
inc ecx
add ebx, ebx
jne 0x425ae0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x425ad5
jne 0x425af1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x425ad5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x425b14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x425b05
jmp 0x425a76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x425b14
add edi, ecx
jmp 0x425a76
pop esi
mov edi, esi
mov ecx, 0x6ce
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x425b32
cmp byte [edi], 0x11
jne 0x425b32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x425b37
lea edi, [esi + 0x23000]
mov eax, dword [edi]
or eax, eax
je 0x425baf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x26500]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x265c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x425b64
mov ecx, edi
jns 0x425b93
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x265cc]
or eax, eax
je 0x425ba9
mov dword [ebx], eax
add ebx, 4
jmp 0x425b81
call dword [esi + 0x265dc]
mov ebp, dword [esi + 0x265d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x425be3
sub esp, 0xffffff80
jmp 0x40a794
Function at 0x403360
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403393
call fcn.00403340
test eax, eax
je 0x403393
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 8]
shr eax, 0x19
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
shr eax, 0x19
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403400
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403434
call fcn.00403340
cmp eax, 7
jb 0x403434
mov edx, 7
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 0xc]
shr eax, 0x1d
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403440
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403473
call fcn.00403340
test eax, eax
je 0x403473
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 8]
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403570
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x892474]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x4035b9
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4035b9
push 0xc00
call eax
test eax, eax
jne 0x40364e
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x40364e
cmp ecx, 0x104
ja 0x40364e
cmp word [ebp + ecx*2 - 0x2d6], 0x5c
je 0x4035f2
mov eax, 0x5c
mov word [ebp + ecx*2 - 0x2d4], ax
inc ecx
mov al, byte [str.userenv]
push esi
mov esi, str.userenv
test al, al
je 0x40364d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + ecx*2]
mov ecx, edi
inc esi
movzx eax, al
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
mov al, byte [esi]
inc esi
test al, al
jne 0x403615
xor eax, eax
mov dword [ecx], 0x64002e
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ecx + 4], 0x6c006c
call ebx
mov al, byte [esi]
test al, al
jne 0x403612
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443ef5
mov esp, ebp
pop ebp
ret
Function at 0x408b30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x98
push 0
lea eax, [edi + 0x110]
push eax
call fcn.00445650
mov eax, dword [edi + 0x30]
add esp, 0xc
add eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x28]
mov dword [edi + 0x40], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x14], 0
lea esi, [eax + ecx]
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov ecx, 0xc
shr edx, 3
imul eax, edx, 0x54
mov edx, esi
sub edx, eax
mov eax, dword [edi + 0x18]
cmp eax, ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x44], edx
cmovb ecx, eax
mov dword [edi + 8], edx
not ecx
lea eax, [edx + 0x600]
mov dword [edi + 0x24], ecx
mov dword [edi + 0x20], ecx
lea ecx, [esi - 0xc]
mov dword [edi + 0x38], eax
xor eax, eax
mov dword [edi + 0x3c], ecx
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [ecx + 4], edx
add edx, 2
mov dword [ecx], 0x1010100
mov dword [ecx + 8], 0
mov byte [edx - 2], al
lea edx, [edx + 6]
xor ecx, ecx
mov byte [edx - 7], 1
inc eax
mov dword [edx - 6], ecx
cmp eax, 0x100
jb 0x408bc7
lea eax, [edi + 0x9fc]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
nop word [eax + eax]
mov esi, eax
xor edi, edi
movzx eax, word [edi + 0x455570]
lea ecx, [ebx + 2]
xor edx, edx
div ecx
mov ecx, 0x4000
sub ecx, eax
xor eax, eax
movzx ecx, cx
nop
mov word [esi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x408c10
add edi, 2
add esi, 2
cmp edi, 0x10
jb 0x408bf4
mov eax, dword [ebp - 4]
inc ebx
sub eax, 0xffffff80
mov dword [ebp - 4], eax
cmp ebx, 0x80
jb 0x408bf0
mov edi, dword [ebp + 8]
mov edx, 0x50
pop ebx
lea esi, [edi + 0x3bc]
nop dword [eax + eax]
mov eax, esi
mov ecx, 0x10
nop word [eax + eax]
mov word [eax], dx
lea eax, [eax + 4]
mov word [eax - 2], 0x403
sub ecx, 1
jne 0x408c60
add edx, 0x28
add esi, 0x40
cmp edx, 0x438
jb 0x408c50
mov dword [edi + 0x3b8], 0x40070000
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x409c30
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edx, dword [esi + 8]
and edx, 0x3f
mov byte [edx + esi + 0x40], 0x80
inc edx
cmp edx, 0x38
jbe 0x409c7b
cmp edx, 0x40
je 0x409c67
mov eax, 0x40
lea ecx, [esi + 0x40]
sub eax, edx
add ecx, edx
push eax
push 0
push ecx
call fcn.00445650
add esp, 0xc
mov eax, dword [esi]
lea edi, [esi + 0x40]
lea ebx, [esi + 0x20]
mov edx, edi
push 1
mov ecx, ebx
call eax
xor edx, edx
jmp 0x409c81
lea edi, [esi + 0x40]
lea ebx, [esi + 0x20]
mov eax, 0x38
sub eax, edx
push eax
lea eax, [esi + 0x40]
add eax, edx
push 0
push eax
call fcn.00445650
mov ecx, dword [esi + 8]
add esp, 0xc
mov eax, dword [esi + 0xc]
mov edx, edi
shld eax, ecx, 3
shl ecx, 3
bswap eax
bswap ecx
mov dword [esi + 0x78], eax
mov eax, dword [esi]
mov dword [esi + 0x7c], ecx
mov ecx, ebx
push 1
call eax
mov edi, dword [ebp + 0xc]
mov edx, ebx
mov ebx, 4
mov ecx, dword [edx + 4]
lea edi, [edi + 8]
mov eax, dword [edx]
lea edx, [edx + 8]
bswap eax
mov dword [edi - 8], eax
bswap ecx
mov dword [edi - 4], ecx
sub ebx, 1
jne 0x409cc4
pop edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebx
pop ebp
ret 8

Function at 0x409d30
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [0x89244c]
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
pop ebp
ret 4

Function at 0x40a4e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.00447fa9
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x40a50d
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40da80
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 0x10]
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push 0x2002
call fcn.00411390
test al, al
jne 0x40dab3
lea ecx, [ebp - 4]
xor bl, bl
call fcn.004113c0
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
mov edi, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40db03
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.004450d0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x40db03
pop edi
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
mov bl, 1
call fcn.004113c0
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
lea ecx, [ebp - 4]
xor bl, bl
call fcn.004113c0
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40db20
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45109d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x892474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne al
mov byte [ebp + 0xb], al
test al, al
je 0x40dc05
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x40dc02
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
lea eax, [eax*2 + 2]
push eax
push dword [esi]
push 0xd
call fcn.0040da80
push 0
mov bl, al
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0040cb80
mov ecx, dword [ebp - 0x14]
inc ecx
mov byte [ebp - 4], 1
push ecx
push dword [ebp - 0x18]
push 1
call fcn.0040da80
mov edi, 1
movzx ebx, bl
push edi
test al, al
lea eax, [ebp - 0x24]
push esi
push eax
cmovne ebx, edi
call fcn.0040cb80
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0040b060
push dword [ebp - 0x24]
call fcn.0044413c
mov eax, dword [ebp - 0x14]
add esp, 4
inc eax
push eax
push dword [ebp - 0x18]
push 7
call fcn.0040da80
push dword [ebp - 0x18]
test al, al
movzx ebx, bl
cmovne ebx, edi
call fcn.0044413c
add esp, 4
jmp 0x40dc0b
mov al, byte [ebp + 0xb]
xor bl, bl
test al, al
je 0x40dc11
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40ecb0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x896098], 0
jne 0x40ece8
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040c750
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0044413c
add esp, 4
test esi, esi
pop esi
jmp 0x40ecf5
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40ecff
mov al, 1
mov esp, ebp
pop ebp
ret 4
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x40ed10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040feb0
cmp eax, 0xffffffff
je 0x40ed3d
mov ecx, eax
and cl, 0x11
cmp cl, 1
jne 0x40ed3d
and eax, 0xfffffffe
push eax
push esi
call fcn.0040f1d0
test al, al
je 0x40ed7c
cmp byte [0x896098], 0
push esi
jne 0x40ed69
lea eax, [ebp - 0xc]
push eax
call fcn.0040c750
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0044413c
add esp, 4
test esi, esi
jmp 0x40ed71
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40ed7c
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4