joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45dcb4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x45de70
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x45dd15
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x45de8c
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x45dd87
xor eax, eax
push ebp
push 0x45dd80
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.0045db0c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x45dd69
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x45deac
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dd87
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x45de68
cmp byte [ebp - 0xd], 0
jne 0x45ddc9
cmp byte [ebp - 0x12], 0
je 0x45de68
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x45dde2
dec ebx
cmp byte [ebx], 0x2e
je 0x45ddf1
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x45dde1
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x45de68
inc ebx
cmp byte [ebp - 0x12], 0
je 0x45de1e
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x45de68
cmp byte [ebp - 0xd], 0
je 0x45de68
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x45de68
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e25c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x45e344
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x487af0], 1
jae 0x45e336
xor eax, eax
mov dword [0x4876fc], eax
xor eax, eax
mov dword [0x487704], eax
xor eax, eax
mov dword [0x487708], eax
mov byte [0x48770e], 2
mov byte [0x48770f], 2
mov byte [0x487710], 3
mov word [0x487ab8], 0
mov word [0x487ac8], 1
mov word [0x487ad8], 0xa
mov dword [0x487ae0], 0x80020004
mov dword [0x487aac], 0x45d448
mov dword [0x487ab0], 0x45d440
mov dword [0x487ab4], 0x45d448
call fcn.0045bb5c
test al, al
je 0x45e2f5
call fcn.0045bb8c
call fcn.0045bc50
mov eax, 0x487714
mov edx, 0x45e350
call fcn.0045932e
mov eax, 0x4878e0
mov edx, 0x45e350
call fcn.0045932e
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x4876f4], eax
call fcn.0045a294
mov dword [0x4876f0], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x4876e8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e34b
ret

Function at 0x45ffbc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x45ffd8
call fcn.0046145c
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x45fff4
test bl, 1
je 0x45fff4
call fcn.00464f14
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4601d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00460ff8
test byte [ebp + 0xd], 0xc0
jne 0x4601fc
mov eax, dword [0x483f1c]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x460209
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x460236
je 0x460248
sub ecx, 0x100
je 0x460256
sub ecx, 0x100
je 0x46025d
sub ecx, 0x100
je 0x46024f
jmp 0x460264
sub ecx, 0x600
je 0x46025d
sub ecx, 0x100
je 0x460248
jmp 0x460264
mov edi, 1
jmp 0x460269
mov edi, 2
jmp 0x460269
mov edi, 4
jmp 0x460269
mov edi, 5
jmp 0x460269
mov edi, 3
test byte [ebp + 0xd], 1
je 0x460290
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x483994]
test al, 0x80
je 0x460289
mov ebx, 0x80
jmp 0x4602a2
mov ebx, 1
jmp 0x4602a2
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4602a2
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4602b4
je 0x4602bd
dec eax
je 0x4602c6
jmp 0x4602cf
mov dword [ebp - 4], 0x80000000
jmp 0x4602de
mov dword [ebp - 4], 0x40000000
jmp 0x4602de
mov dword [ebp - 4], 0xc0000000
jmp 0x4602de
push 1
call fcn.004613f0
pop ecx
mov ebx, eax
jmp 0x4603ca
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4602fa
sub eax, 0x10
je 0x460301
sub eax, 0x10
je 0x46030a
sub eax, 0x10
je 0x460313
jmp 0x460313
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x46031a
mov dword [ebp - 8], 1
jmp 0x46031a
mov dword [ebp - 8], 2
jmp 0x46031a
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x460383
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x460378
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x460378
add ebx, 0xffffffb2
push ebx
call fcn.004613f0
pop ecx
mov ebx, eax
jmp 0x4603ca
mov edi, esi
push edi
call fcn.0046013c
pop ecx
test eax, eax
je 0x460397
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4603a3
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00461118
add esp, 8
mov ebx, eax
inc eax
jne 0x4603ca
push 4
call fcn.004613f0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0046102c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464eac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x464f0e
call fcn.00464e5c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0045eeb4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0045eeb4
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x464f8c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x484dbc], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x465066
cmp dword [0x484db8], 0
jne 0x465066
cmp dword [0x484f9c], 0
je 0x465020
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00464d5c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x465006
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00464d5c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x465006
lea ebx, [ebp - 0x84]
jmp 0x465007
inc ebx
call fcn.00464f48
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4650a1
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x484dc0
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0045eeb4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x484dc3
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4650a1
cmp dword [0x484db8], 0
je 0x465080
cmp dword [0x484db8], 0xffffffff
je 0x4650a1
push esi
call dword [0x484db8]
pop ecx
mov eax, dword [0x484dbc]
test eax, eax
je 0x4650a1
cmp dword [0x484dbc], 0xffffffff
je 0x4650a1
cmp byte [eax], 0
je 0x4650a1
push esi
push eax
call fcn.00464eac
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465838
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4883f8], 0
jne 0x4658b9
cmp dword [0x488418], 0
jne 0x465868
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x488418], eax
test eax, eax
jne 0x465868
push str.GetEnvironmentStrings_failed
call fcn.004650b8
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x488418]
jmp 0x46587c
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0045eeb4
pop ecx
mov edi, eax
test eax, eax
jne 0x465874
lea edi, [ebp + 1]
push edi
call fcn.0045e878
pop ecx
mov ebx, eax
mov dword [0x4883fc], ebx
test ebx, ebx
jne 0x4658a6
xor eax, eax
jmp 0x46597c
push edi
mov edx, dword [0x488418]
push edx
push ebx
call fcn.0045ece8
add esp, 0xc
jmp 0x4658d9
xor esi, esi
mov ebx, dword [0x4883f8]
jmp 0x4658d3
push eax
call fcn.0045eeb4
pop ecx
test eax, eax
jne 0x4658cf
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4658c3
lea ebx, [esi + 4]
push 4
mov dword [0x488400], ebx
inc ebx
push ebx
call fcn.0045e354
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4658fc
xor eax, eax
jmp 0x46597c
cmp dword [0x4883f8], 0
jne 0x46592d
xor esi, esi
mov ebx, dword [0x4883fc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x46591e
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0045eeb4
pop ecx
mov edi, eax
test eax, eax
jne 0x465914
jmp 0x46595e
xor esi, esi
mov ebx, dword [0x4883f8]
mov eax, dword [esp]
mov edi, eax
jmp 0x465958
push eax
call fcn.0045eeb4
pop ecx
test eax, eax
je 0x46594d
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x465951
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x46593c
mov eax, dword [0x4883f8]
test eax, eax
je 0x46596e
push eax
call fcn.0045e888
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4883f8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46bd88
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x46bdb6
mov eax, ebx
call fcn.0046c82c
cmp dword [ebx + 0x3c], 0
je 0x46bdaf
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x46be27
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x46be19
cmp dword [ebx + 8], 0
je 0x46bdd8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x46bdea
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46be19
cmp dword [ebx + 8], 0
je 0x46bdcb
cmp eax, 3
je 0x46bdfd
dec eax
jne 0x46bdcb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46bdcb
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x46bdcb
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x46be45
cmp dword [ebx + 0x10], 0xcc
je 0x46be45
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046be50
pop ebx
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40633c
pop dword [ebp - 0x30]
mov eax, 0x40633c
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x80864806
sub dword [ebp - 0x40], 0x323402bb
mov dword [ebp - 0x3c], 0xde6a4a9b
sub dword [ebp - 0x3c], 0xac36fe56
mov dword [ebp - 0x38], 0x4fdcbdcd
sub dword [ebp - 0x38], 0x390799f
mov dword [ebp - 0x34], 0xe3e72e44
add dword [ebp - 0x34], 0x1c18d1bc
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xda9825e6
add dword [ebp - 0x40], 0x99da4370
mov dword [ebp - 0x3c], 0xb8097210
sub dword [ebp - 0x3c], 0x769d109b
mov dword [ebp - 0x38], 0x3eb26e06
sub dword [ebp - 0x38], 0xdb43019a
mov dword [ebp - 0x34], 0x31114968
add dword [ebp - 0x34], 0xceeeb698
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x9b06bbf7
add eax, 0x6539b509
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x34ecd
push 0
call eax
mov ecx, 0x9285b1f4
add ecx, 0x6d7a8f46
xor ebx, ebx
add ebx, eax
mov edi, 0x977bb83
add edi, 0xf6c9447d
add edi, dword [ebp - 0x30]
mov edx, 0x280e114b
sub edx, 0x472d5721
xor dword [ebp - 0x10], ecx
mov esi, dword [edi]
add dword [ebp - 0x1c], 0x9da83c7f
xor esi, edx
sub dword [ebp - 0x18], 0x9b075435
mov dword [ebx], esi
add dword [ebp - 0x20], 0xdd4c5b2f
add ebx, 4
add edi, 4
loop 0x406456
add eax, 0xf7bb
mov ebx, eax
add eax, 0x9fd575c1
add eax, 0x602a8a44
mov ecx, 0x1bf72b55
sub ecx, 0x1bb72b55
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4055f0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4056a1
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword fs:[0x2c]
mov edi, eax
mov edx, dword [ecx]
mov ecx, dword [0x637cdc]
cmp ecx, dword [edx + 4]
jle 0x40564f
push 0x637cdc
call fcn.0056e68a
add esp, 4
cmp dword [0x637cdc], esi
jne 0x40564f
call fcn.00404790
push 0x637cdc
call fcn.0056e64b
add esp, 4
mov ecx, dword [0x637d08]
mov eax, dword [0x637d0c]
mov dword [ebp - 0xc], edi
cmp ecx, 0x25c5e09b
jne 0x40566c
cmp eax, 0x8fafd21e
je 0x40567b
cmp ecx, 0x257edf0d
jne 0x405682
cmp eax, 0xb2ab117a
jne 0x405682
test edi, edi
setne al
jmp 0x405692
mov eax, dword [0x637d00]
mov ecx, 0x637d00
push edi
mov eax, dword [eax + 0x18]
call eax
mov byte [ebp - 8], al
mov dword [ebp - 4], 0x637d00
pop edi
test al, al
jne 0x4056a8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x5fe5ac
lea ecx, [ebp - 0xc]
call fcn.00405440
int3

Function at 0x4056c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x626fe8]
xor eax, esp
mov dword [esp + 0x194], eax
push 0x637cd4
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x405702
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
push 0x637cd8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0056e545
mov esp, ebp
pop ebp
ret

Function at 0x405a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
push 0
push 0xff
call fcn.004058a0
mov byte [esi + edi], al
add esp, 8
inc esi
cmp esi, 8
jb 0x405a61
xor esi, esi
nop dword [eax + eax]
xor byte [esi + ebx], 0x40
mov eax, esi
and eax, 7
mov ecx, esi
and ecx, 0x1ff
mov dl, byte [eax + edi]
xor dl, byte [esi + ebx]
mov byte [esi + ebx], dl
mov al, byte [eax + edi]
add al, dl
xor al, byte [ecx + 0x5fe198]
sub al, byte [ecx + 0x5fdd98]
add al, byte [ecx + 0x5fd598]
xor al, byte [ecx + 0x5fdb98]
add al, byte [ecx + 0x5fd998]
xor al, byte [ecx + 0x5fd390]
sub al, byte [ecx + 0x5fd798]
sub al, byte [ecx + 0x5fdf98]
mov byte [esi + ebx], al
inc esi
cmp esi, 0x40
jl 0x405a80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
xor esi, esi
push edi
mov edi, ecx
test ebx, ebx
jle 0x405b6f
mov eax, 0x81020409
imul ebx
add edx, ebx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 4], eax
nop word [eax + eax]
mov ecx, dword [ebp + 8]
mov eax, esi
and eax, 0x1ff
mov dl, byte [eax + 0x5fdf98]
add dl, byte [eax + 0x5fd798]
add dl, byte [esi + edi]
xor dl, byte [eax + 0x5fd390]
sub dl, byte [eax + 0x5fd998]
xor dl, byte [eax + 0x5fdb98]
sub dl, byte [eax + 0x5fd598]
add dl, byte [eax + 0x5fdd98]
xor dl, byte [eax + 0x5fe198]
mov eax, esi
and eax, 7
mov byte [esi + edi], dl
add ecx, eax
mov al, byte [ebp - 4]
add al, al
add al, bl
sub dl, byte [ecx]
mov byte [esi + edi], dl
xor al, dl
xor al, byte [ecx]
mov byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x405b10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4064a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 1
mov dword [0x637d98], edi
mov dword [0x637d9c], ecx
nop dword [eax]
push 0x5851f42d
mov edx, ecx
xor eax, eax
push 0x4c957f2d
shr edx, 0x1e
xor eax, ecx
xor edx, edi
push eax
push edx
call fcn.0056f140
mov edi, eax
mov ecx, edx
mov eax, esi
cdq
add edi, eax
mov dword [esi*8 + 0x637d98], edi
adc ecx, edx
mov dword [esi*8 + 0x637d9c], ecx
inc esi
cmp esi, 0x138
jl 0x4064c0
pop edi
mov dword [0x637d90], 0x138
pop esi
pop ebp
ret 0x10
Function at 0x407c60
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
mov eax, 0x40
push edi
mov edi, ecx
mov edx, dword [esi]
and edx, 0x3f
mov byte [edx + esi + 0x18], 0x80
inc edx
sub eax, edx
cmp eax, 8
jae 0x407ca1
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.00573e40
push 0x40
lea edx, [esi + 0x18]
mov ecx, esi
call fcn.004071e0
add esp, 0x10
mov eax, 0x40
xor edx, edx
add eax, 0xfffffff8
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.00573e40
shl dword [esi], 3
lea edx, [esi + 0x18]
movzx eax, byte [esi]
mov ecx, esi
mov byte [esi + 0x50], al
mov eax, dword [esi]
shr eax, 8
mov byte [esi + 0x51], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x52], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x53], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x54], al
mov eax, dword [esi + 4]
shr eax, 8
mov byte [esi + 0x55], al
movzx eax, byte [esi + 6]
mov byte [esi + 0x56], al
movzx eax, byte [esi + 7]
push 0x40
mov byte [esi + 0x57], al
call fcn.004071e0
movzx eax, byte [esi + 8]
mov byte [edi], al
mov eax, dword [esi + 8]
shr eax, 8
mov byte [edi + 1], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 2], al
movzx eax, byte [esi + 0xb]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 4], al
mov eax, dword [esi + 0xc]
shr eax, 8
mov byte [edi + 5], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 8], al
mov eax, dword [esi + 0x10]
shr eax, 8
mov byte [edi + 9], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xc], al
mov eax, dword [esi + 0x14]
shr eax, 8
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x16]
push 0x98
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x17]
push 0
push esi
mov byte [edi + 0xf], al
call fcn.00573e40
add esp, 0x1c
pop edi
pop esi
ret

Function at 0x407d90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [0x626fe8]
xor eax, esp
mov dword [esp + 0xa0], eax
push esi
mov esi, dword [ebp + 8]
push edx
mov edx, ecx
mov dword [esp + 0x14], 0x67452301
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.00407bb0
add esp, 4
lea edx, [esp + 8]
mov ecx, esi
call fcn.00407c60
mov ecx, dword [esp + 0xa4]
pop esi
xor ecx, esp
call fcn.0056e545
mov esp, ebp
pop ebp
ret
Function at 0x407e50
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af5d2
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x626fe8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x2c0], esi
push edi
mov dword [ebp - 0x2bc], 0
lea eax, [ebp - 0x220]
push 0x200
push 1
push eax
mov dword [ebp - 0x2c4], esi
mov dword [ebp - 0x2b0], 0x67452301
mov dword [ebp - 0x2ac], 0xefcdab89
mov dword [ebp - 0x2a8], 0x98badcfe
mov dword [ebp - 0x2a4], 0x10325476
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0
call fcn.0057aaf2
add esp, 0x10
test eax, eax
je 0x407f1d
nop
push eax
lea edx, [ebp - 0x220]
lea ecx, [ebp - 0x2b8]
call fcn.00407bb0
push edi
push 0x200
lea eax, [ebp - 0x220]
push 1
push eax
call fcn.0057aaf2
add esp, 0x14
test eax, eax
jne 0x407ef0
lea edx, [ebp - 0x2b8]
lea ecx, [ebp - 0x20]
call fcn.00407c60
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x407f51
mov eax, dword [esi]
jmp 0x407f53
mov eax, esi
mov byte [eax], 0
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x2bc], 1
nop dword [eax]
mov bh, byte [ebp + edi - 0x20]
mov ecx, dword [esi + 0x14]
mov al, bh
shr al, 4
cmp al, 0xa
sbb bl, bl
add al, 0x57
and bl, 0xd9
add bl, al
mov eax, dword [esi + 0x10]
cmp eax, ecx
jne 0x407fbe
inc eax
cmp eax, 0xfffffffe
ja 0x408064
cmp ecx, eax
jae 0x407fa9
push dword [esi + 0x10]
mov ecx, esi
push eax
call fcn.00406760
jmp 0x407fbe
test eax, eax
jne 0x407fbe
mov dword [esi + 0x10], eax
cmp ecx, 0x10
jb 0x407fb9
mov eax, dword [esi]
jmp 0x407fbb
mov eax, esi
mov byte [eax], 0
cmp dword [esi + 0x14], 0x10
jb 0x407fc8
mov ecx, dword [esi]
jmp 0x407fca
mov ecx, esi
mov eax, dword [esi + 0x10]
and bh, 0xf
mov byte [ecx + eax], bl
inc dword [esi + 0x10]
cmp bh, 0xa
mov eax, dword [esi + 0x10]
sbb bl, bl
and bl, 0xd9
add bl, 0x57
mov byte [eax + ecx], 0
add bl, bh
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
jne 0x408020
inc eax
cmp eax, 0xfffffffe
ja 0x408064
cmp ecx, eax
jae 0x40800b
push dword [esi + 0x10]
mov ecx, esi
push eax
call fcn.00406760
jmp 0x408020
test eax, eax
jne 0x408020
mov dword [esi + 0x10], eax
cmp ecx, 0x10
jb 0x40801b
mov eax, dword [esi]
jmp 0x40801d
mov eax, esi
mov byte [eax], 0
cmp dword [esi + 0x14], 0x10
jb 0x40802a
mov ecx, dword [esi]
jmp 0x40802c
mov ecx, esi
mov eax, dword [esi + 0x10]
inc edi
mov byte [ecx + eax], bl
inc dword [esi + 0x10]
mov eax, dword [esi + 0x10]
mov byte [eax + ecx], 0
cmp edi, 0x10
jb 0x407f70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e545
mov esp, ebp
pop ebp
ret
push 0x5fd344
call fcn.0056f9e0
int3