joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40af40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d1114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x40af70
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e00c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40afac
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40afac
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e00c
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x40b093
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x40afd4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40b007
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0047e6f7
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e00c
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x40b093
cmp eax, 1
jle 0x40b066
cmp eax, 3
jne 0x40b093
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00404c90
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e00c
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40b083
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00480d1e
add esp, 0x10
cmp edi, eax
jne 0x40b093
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x40af97
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045e00c
mov esp, ebp
pop ebp
ret 4
Function at 0x40d520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d1114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x40d5cf
cmp byte [esi + 0x3e], 0
je 0x40d5cf
mov eax, dword [esi]
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x40d585
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x40d597
sub eax, 1
je 0x40d59b
sub eax, 2
je 0x40d5cf
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e00c
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40d5b8
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00480d1e
add esp, 0x10
cmp edi, eax
jne 0x40d585
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e00c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0045e00c
mov esp, ebp
pop ebp
ret
Function at 0x40d830
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49cb80
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4d1114]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
push 8
mov dword [ebp - 0x18], eax
mov dword [ecx], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0045e2c2
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0045bcaf
mov dword [esi + 4], eax
add esp, 8
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + 8]
mov dword [ecx + 0x34], esi
lea ebx, [ecx + 4]
mov dword [ecx + 0xc], ebx
lea edi, [ecx + 0x14]
mov dword [ecx + 0x1c], edi
lea esi, [ecx + 0x18]
mov dword [ecx + 0x20], esi
lea edx, [ecx + 0x24]
mov dword [ecx + 0x2c], edx
add ecx, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], ecx
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0x20]
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0x30]
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0xc]
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0x1c]
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0x2c]
mov dword [eax], 0
mov eax, ebx
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, eax
mov dword [eax], vtable.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov byte [eax + 0x48], 0
mov byte [eax + 0x3e], 0
lea eax, [ebx + 8]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x2c], edx
mov dword [eax], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, ebx
mov ecx, dword [ebx + 0x1c]
mov dword [ecx], 0
mov ecx, dword [ebx + 0x2c]
mov dword [ecx], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebx + 0x4c], ecx
mov ecx, dword [0x4da7a0]
mov dword [ebx + 0x40], ecx
mov ecx, dword [0x4da7a4]
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40db50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d1114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x40dbf3
cmp byte [esi + 0x3d], 0
je 0x40dbf3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40dba9
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x40dbbb
sub eax, 1
je 0x40dbbf
sub eax, 2
je 0x40dbf3
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e00c
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40dbdc
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00480d1e
add esp, 0x10
cmp edi, eax
jne 0x40dba9
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e00c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0045e00c
mov esp, ebp
pop ebp
ret

Function at 0x40de00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49cc10
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d1114]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0045e2c2
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0045bcaf
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x10], ecx
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x34], esi
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov ecx, edi
mov eax, dword [edi + 0x20]
push 0
push dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
call fcn.0040dc10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40f050
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49bf70
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4d1114]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0045e2c2
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0045bcaf
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40f2c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49bf70
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4d1114]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0045e2c2
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0045bcaf
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412150
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x4121ae
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x412170
mov eax, dword [edi]
jmp 0x412299
cmp eax, 0x4e0
jb 0x412299
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4121d0
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x412220
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415770
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c1e0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4d1114]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x30]
rep stosb byte es:[edi], al
call fcn.0044cd00
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x20]
rep stosb byte es:[edi], al
call fcn.0044cd00
add esp, 8
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4157f7
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x415808
push 0x40
push esi
call fcn.0045e56f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41e340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e629
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4d1114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov eax, edi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x14], 0
jb 0x41e395
mov eax, dword [edi]
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push 2
push eax
push 0
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x41e443
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
push 0x20
mov word [esi], cx
mov ecx, esi
push eax
call fcn.0040ce80
mov dword [ebp - 4], 0
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x18], 1
jb 0x41e3ec
mov eax, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x41e3f4
mov edi, dword [edi]
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0
push 2
push edi
push 0
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x41e413
push str.Cannot_get_string_value:_RegGetValueW_failed.
jmp 0x41e448
mov ecx, dword [ebp - 0x14]
shr ecx, 1
dec ecx
push 0
push ecx
mov ecx, esi
call fcn.00422570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e00c
mov esp, ebp
pop ebp
ret 8
push str.Cannot_get_size_of_string_value:_RegGetValueW_failed.
push eax
lea ecx, [ebp - 0x30]
call fcn.0041e460
push 0x4cf664
lea eax, [ebp - 0x30]
push eax
call fcn.00475741
int3
Function at 0x422ef0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ef77
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4d1114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
push 0x64
mov dword [ebp - 0x34], eax
call fcn.0045e2c2
add esp, 4
mov dword [ebp - 0x30], eax
push esi
mov esi, eax
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00408f90
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
push edi
call fcn.00408ad0
push dword [ebp - 0x34]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00408ad0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x48]
push dword [ebp - 0x28]
call fcn.00408ad0
mov eax, dword [ebp + 8]
mov dword [esi + 0x60], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x24]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x24], xmm0
call fcn.00415390
mov dword [ebp - 0x24], 0x4ba4b0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 5
push eax
push 0x415460
push dword [ebp - 0x2c]
call fcn.0045d1ce
add esp, 0xc
mov ecx, 1
cmp eax, 4
cmovne ecx, eax
test ecx, ecx
je 0x422fdf
push ecx
call fcn.0045c817
add esp, 4
cmp byte [ebp - 0x18], 0
jne 0x423006
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.0045cfb0
add esp, 8
test eax, eax
je 0x423000
push eax
call fcn.0045c817
add esp, 4
cmp byte [ebp - 0x18], 0
je 0x422fe5
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x42301f
mov ecx, esi
call fcn.00423790
push 0x64
push esi
call fcn.0045e56f
add esp, 8
mov byte [ebp - 4], 6
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
push esi
call fcn.0045ccbc
add esp, 4
test eax, eax
je 0x42303f
push eax
call fcn.0045c817
add esp, 4
push esi
call fcn.0045cc00
push edi
call fcn.0045cf27
mov eax, dword [ebp - 0x2c]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e00c
mov esp, ebp
pop ebp
ret 0x14
Function at 0x448e90
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1a88
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4d1114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0xf0000000
push 1
push 0
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x448f06
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x448f06
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
je 0x448f24
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e00c
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.CryptAcquireContext
lea ecx, [ebp - 0x28]
call fcn.00408f50
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x50]
call fcn.00448ff0
push 0x4cc114
lea eax, [ebp - 0x50]
push eax
call fcn.00475741
int3
Function at 0x44cd10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x44ce41
test al, 3
jne 0x44ce41
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x44cdfc
cmp edi, 8
jb 0x44cdc5
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x44cd74
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x44ce00
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x44cde2
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x44ce04
xor edi, edi
jmp 0x44ce04
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x44ce18
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x44cf00
cmp ecx, 0x20
jb 0x44ceda
mov esi, ecx
xorps xmm3, xmm3
and esi, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x1c], esi
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x44ce75
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x44cf00
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
nop dword [eax]
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x44cef0
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x4503b0
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x4d93d4], 0
jne 0x4503be
call fcn.00458a20
cmp byte [0x4d93dd], 0
je 0x4503dc
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.0045a440
add esp, 0x10
ret
jmp fcn.0044e6f0
Function at 0x4611c1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x48c390
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048c053

Function at 0x48c39b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048c1d4

Function at 0x4934ba
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049317a