joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b73c
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x100ab7c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004ab1f2
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x100b45a8
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x100b44f0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x100ad0a4]
push eax
mov ecx, edi
call fcn.004b085a
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004b1d76
test eax, eax
je 0x47b858
mov ecx, dword [esp + 0x3c]
call fcn.004b0887
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x100ad3e4]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x47b81c
push edi
mov ecx, esi
call fcn.004aded7
mov ecx, esi
call fcn.0047b9fc
cmp dword [esp + 0x38], 1
jne 0x47b851
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004ae012
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x47da3c
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x47da6f
push esi
call fcn.0048bddc
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x47da68
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x47daf5
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x47dade
mov eax, dword [esi + 8]
test eax, eax
je 0x47da93
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x47dada
cmp eax, 2
je 0x47dade
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x47da86
cmp eax, 3
je 0x47dab9
cmp eax, 1
jne 0x47da86
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x47da86
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x47da86
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0047db1c
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x47db04
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0047db1c
add esp, 4
pop esi
ret
Function at 0x51c30f
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x51c33d
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x51c334
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x51c32c
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x51c35e
mov esp, ebp
pop ebp
ret

Function at 0x51c362
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x51c3ce
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x51c3fb
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x51c3ea
xor ecx, eax
xor edx, ebx
dec edi
jne 0x51c3db
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x51c421
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x51c3c2
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x51c44d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51ca43
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x51ca53
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0
jle 0x51caa8
push dword [ebp + 8]
call fcn.0051cc54
mov dword [ebp - 0x24], eax
cmp word [ebp - 0x24], 0x5a4d
jne 0x51caa8
xor eax, eax
jmp 0x51caad
mov eax, 1
test eax, eax
je 0x51cabf
mov eax, 0
jmp 0x51cc4e
push 0x3c
push dword [ebp + 8]
call fcn.0051cc96
push eax
call fcn.0051cc70
push eax
push dword [ebp + 8]
call fcn.0051cc96
mov dword [ebp - 4], eax
push dword [ebp - 4]
call fcn.0051cc70
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4550
jne 0x51cb1a
push 0x7c
push dword [ebp - 4]
call fcn.0051cc96
push eax
call fcn.0051cc70
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x51cb1a
xor eax, eax
jmp 0x51cb1f
mov eax, 1
test eax, eax
je 0x51cb31
mov eax, 0
jmp 0x51cc4e
push 0x78
push dword [ebp - 4]
call fcn.0051cc96
push eax
call fcn.0051cc70
push eax
push dword [ebp + 8]
call fcn.0051cc96
mov dword [ebp - 8], eax
push 0x20
push dword [ebp - 8]
call fcn.0051cc96
push eax
call fcn.0051cc70
push eax
push dword [ebp + 8]
call fcn.0051cc96
push eax
call fcn.0051cc70
push eax
push dword [ebp + 8]
call fcn.0051cc96
mov dword [ebp - 0xc], eax
push 0x18
push dword [ebp - 8]
call fcn.0051cc96
push eax
call fcn.0051cc70
mov dword [ebp - 0x10], eax
push 1
push dword [ebp - 0x10]
call fcn.0051ccbd
push eax
lea eax, [ebp - 0x10]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x51cc41
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.0051cc96
mov dword [ebp - 0x14], eax
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call fcn.0051cce4
test eax, eax
je 0x51cc24
push 0x1c
push dword [ebp - 8]
call fcn.0051cc96
push eax
call fcn.0051cc70
push eax
push dword [ebp + 8]
call fcn.0051cc96
mov dword [ebp - 0x24], eax
push 4
push dword [ebp - 0x10]
call fcn.0051cd18
push eax
push dword [ebp - 0x24]
call fcn.0051cc96
push eax
call fcn.0051cc70
push eax
push dword [ebp + 8]
call fcn.0051cc96
jmp 0x51cc4e
push dword [ebp - 0x14]
call fcn.0051cd40
push eax
push dword [ebp - 0x18]
call fcn.0051cc96
mov dword [ebp - 0x18], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x51cbad
add esp, 0xc
mov eax, 0
jmp 0x51cc4e
mov esp, ebp
pop ebp
ret 8
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409e8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x409e9b
pop dword [ebp - 0x30]
mov eax, 0xdb5dcf10
sub eax, 0xdb1d3075
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x95b30484
add dword [ebp - 0x40], 0xb89f40c7
mov dword [ebp - 0x3c], 0xd36e6548
sub dword [ebp - 0x3c], 0xa13b1903
mov dword [ebp - 0x38], 0xa736562c
sub dword [ebp - 0x38], 0x5aea11fe
mov dword [ebp - 0x34], 0xc62475ba
sub dword [ebp - 0x34], 0xc62475ba
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xc03a6d4d
sub dword [ebp - 0x40], 0x4bc803f7
mov dword [ebp - 0x3c], 0x7553a72
add dword [ebp - 0x3c], 0x3a172703
mov dword [ebp - 0x38], 0xf7af740b
sub dword [ebp - 0x38], 0x9440079f
mov dword [ebp - 0x34], 0x446b3370
add dword [ebp - 0x34], 0xbb94cc90
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xd828a7f4
sub eax, 0xd7e7d7a8
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38f9e
push 0
call eax
mov ecx, 0x455c
xor edi, edi
add edi, eax
mov edx, 0x141e8089
sub edx, 0x13dcd089
add edx, dword [ebp - 0x30]
mov esi, 0x50a4c51a
mov ebx, dword [edx]
xor dword [ebp - 0x18], edi
sub ebx, esi
sub dword [ebp - 0x10], edx
mov dword [edi], ebx
sub dword [ebp - 0x28], ecx
add edi, 0xd64c9eb8
add edi, 0x29b3614c
add edx, 0xb700af16
add edx, 0x48ff50ee
loop 0x409fae
add eax, 0x10843
mov ebx, eax
add eax, 0x2dfd245e
sub eax, 0x2dfd2459
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4015a6
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
lea eax, [ebp - 0x20]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
lea eax, [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetDiskFreeSpaceExA_16
sub esp, 0x10
test eax, eax
setne al
test al, al
je 0x401654
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
shrd eax, edx, 0x14
shr edx, 0x14
mov ebx, eax
mov esi, edx
mov dword [esp + 4], str.Free_space_on
mov dword [esp], sym.imp.libstdc_6.dll_std::cout
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp + 4], 0x4050dc
mov dword [esp], eax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], ebx
mov dword [esp + 4], esi
mov ecx, eax
call sym.std::ostream::operator___unsigned_long_long_
sub esp, 8
mov dword [esp + 4], 0x4050df
mov dword [esp], eax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
jmp 0x4016ae
call sym._GetLastError_0
mov ebx, eax
mov dword [esp + 4], str.Error_getting_free_space_on
mov dword [esp], sym.imp.libstdc_6.dll_std::cerr
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp + 4], str.._Error_code:
mov dword [esp], eax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], ebx
mov ecx, eax
call sym.std::ostream::operator___unsigned_long_
sub esp, 4
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
nop
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x407a60
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push esi
push edx
push str.ERROR:__s_n_E_02d__n
push 2
call fcn.0040a9ed
add esp, 4
push eax
call fcn.00401010
add esp, 0x10
push esi
call fcn.0040a841
int3

Function at 0x407a90
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x426004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, ecx
push dword [ebp + 0x10]
mov ebx, edx
mov dword [ebp - 0x20], 0x3000013
push esi
push str.____s__CODE__lu__lu__n
push 1
mov dword [ebp - 0x28], ebx
mov word [ebp - 0xe], 0x8000
mov byte [ebp - 9], 0xff
call fcn.0040a9ed
add esp, 4
push eax
call fcn.00401010
movzx eax, byte [esi]
add esp, 0x14
mov byte [ebp - 0x1c], al
mov edx, 2
movzx eax, byte [esi + 1]
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 0x1b], al
movzx eax, byte [esi + 2]
mov byte [ebp - 0x1a], al
movzx eax, byte [esi + 3]
mov byte [ebp - 0x19], al
movzx eax, byte [esi + 4]
mov byte [ebp - 0x18], al
movzx eax, byte [esi + 5]
mov byte [ebp - 0x17], al
movzx eax, byte [esi + 6]
mov byte [ebp - 0x16], al
movzx eax, byte [esi + 7]
mov byte [ebp - 0x15], al
movzx eax, byte [esi + 8]
mov byte [ebp - 0x14], al
movzx eax, byte [esi + 9]
mov byte [ebp - 0x13], al
mov eax, dword [ebp + 0x10]
mov byte [ebp - 0x10], al
mov byte [ebp - 0xf], ah
lea eax, [ecx + 2]
mov byte [ebp - 0xb], al
shr eax, 8
mov byte [ebp - 0x12], cl
xor cl, cl
mov byte [ebp - 0x11], ch
mov byte [ebp - 0xa], al
mov byte [ebp - 0xc], 0
nop dword [eax + eax]
mov al, byte [ebp + edx - 0x20]
xor al, cl
mov byte [ebp - 0xc], al
mov cl, byte [ebp + edx - 0x1f]
xor cl, al
mov byte [ebp - 0xc], cl
mov al, byte [ebp + edx - 0x1e]
xor al, cl
mov byte [ebp - 0xc], al
mov cl, byte [ebp + edx - 0x1d]
xor cl, al
mov byte [ebp - 0xc], cl
mov al, byte [ebp + edx - 0x1c]
xor al, cl
mov byte [ebp - 0xc], al
mov cl, byte [ebp + edx - 0x1b]
add edx, 6
xor cl, al
mov byte [ebp - 0xc], cl
cmp edx, 0x14
jl 0x407b50
push ebx
push 1
lea eax, [ebp - 0x20]
push 0x18
push eax
call fcn.0040d184
mov eax, dword [ebp + 0xc]
add esp, 0x10
xor ecx, ecx
mov byte [ebp - 0x21], 0xff
test eax, eax
je 0x407bc2
or bl, 0xff
nop
mov dl, byte [edi + ecx]
inc ecx
xor dl, bl
mov byte [ebp - 0x21], dl
mov bl, dl
cmp ecx, eax
jb 0x407bb0
mov ebx, dword [ebp - 0x28]
push ebx
push 1
push eax
push edi
call fcn.0040d184
push ebx
push 1
lea eax, [ebp - 0x21]
push 1
push eax
call fcn.0040d184
mov ecx, dword [ebp - 8]
add esp, 0x20
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00408400
mov esp, ebp
pop ebp
ret

Function at 0x408ce0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408d1f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408d1f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408d1f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408d1f
cmp dword [ecx + 0x74], 0xe
jbe 0x408d1f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41311e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00412f94

Function at 0x41bc00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41bc2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41bc2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40fff0
Capabilities:
Hash data using sha256

Disassembly:
push esi
push edi
push 0xf0
mov esi, ecx
push 0
push esi
mov edi, eax
call fcn.00453e70
mov dword [esi + 0x100], 0
mov byte [esi + 0x104], 0
mov eax, dword [esi + 0xf4]
mov dword [eax], 0x6a09e667
mov ecx, dword [esi + 0xf4]
mov dword [ecx + 4], 0xbb67ae85
mov edx, dword [esi + 0xf4]
mov dword [edx + 8], 0x3c6ef372
mov eax, dword [esi + 0xf4]
mov dword [eax + 0xc], 0xa54ff53a
mov ecx, dword [esi + 0xf4]
mov dword [ecx + 0x10], 0x510e527f
mov edx, dword [esi + 0xf4]
mov dword [edx + 0x14], 0x9b05688c
mov eax, dword [esi + 0xf4]
mov edx, dword [esp + 0x18]
mov dword [eax + 0x18], 0x1f83d9ab
mov ecx, dword [esi + 0xf4]
mov dword [ecx + 0x1c], 0x5be0cd19
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov eax, dword [esi + 0xf4]
xor dword [eax + 8], edx
mov esi, dword [esi + 0xf4]
or edi, 0x2000
shl edi, 0x10
xor dword [esi + 0xc], edi
add esp, 0xc
pop edi
pop esi
ret 4
Function at 0x411200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46157b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x46bee0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea edi, [esi + 0x14]
mov ecx, edi
call fcn.00434cc0
mov eax, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], eax
mov dword [esi + 0x3c], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], 1
call fcn.00447110
mov ecx, dword [esi]
push 0x40000
push ecx
push 0x4110f0
mov ecx, edi
mov dword [esi + 4], eax
call fcn.00434ce0
mov ecx, edi
call fcn.00434c90
mov dword [esi + 0x10], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4118f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4615ab
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x46bee0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esi + 8]
push eax
mov dword [esp + 0x1c], 0
call fcn.004542d0
mov eax, dword [esi + 0x30]
add esp, 4
test eax, eax
je 0x411954
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push 0x4112a0
push ecx
push 0x8a4
push eax
call fcn.0045464b
push edi
call fcn.004542d0
add esp, 4
mov edx, dword [esi + 4]
push edx
call fcn.00446fb0
lea ecx, [esi + 0x14]
mov dword [esp + 0x18], 0xffffffff
call fcn.00434c80
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4170e0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, eax
mov byte [esp + 0x13], 1
push 0
push 0
push ebp
call fcn.00446190
test eax, eax
je 0x41716d
sub eax, ebp
sar eax, 1
add eax, 2
mov edi, eax
lea eax, [edi + edi]
push eax
call fcn.004548a7
mov esi, eax
add esp, 4
test esi, esi
je 0x41716d
push edi
push esi
push ebp
call fcn.00446190
mov ebp, eax
test ebp, ebp
je 0x41716d
cmp byte [esp + 0x13], 0
mov bl, 1
jne 0x417152
cmp byte [esp + 0x1c], 0
mov ecx, dword [esp + 0x14]
push esi
je 0x41714d
call fcn.00416f70
mov bl, al
jmp 0x417152
call fcn.00416cc0
push esi
call fcn.00453bc4
add esp, 4
cmp byte [esp + 0x1c], 0
je 0x417166
test bl, bl
je 0x41716d
mov byte [esp + 0x13], 0
jmp 0x4170f8
cmp byte [esp + 0x1c], 0
pop edi
pop esi
pop ebp
pop ebx
jne 0x417181
mov ecx, dword [esp + 4]
call fcn.00414b40
add esp, 8
ret 0xc
Function at 0x417930
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x80c
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0x808], eax
mov eax, dword [esp + 0x810]
push esi
mov esi, ecx
push 0x400
lea ecx, [esp + 0x10]
push ecx
push eax
call fcn.00446240
call fcn.00455a18
add eax, 0x20
cmp esi, eax
jne 0x417973
cmp byte [0x46e4a1], 0
jne 0x417990
call fcn.00455a18
add eax, 0x40
cmp esi, eax
jne 0x417a25
cmp byte [0x46e4a2], 0
je 0x417a25
push edi
push 0
lea edx, [esp + 0x14]
push edx
push 0x1800
push 0x46fcb0
call fcn.00453b5b
add esp, 0x14
push 0x1800
push 0x46e4b0
push 0x46fcb0
call fcn.00447860
push 0x46e4b0
push 0x46e4b0
call dword [sym.imp.USER32.dll_CharToOemA]
call fcn.00455a18
xor ecx, ecx
add eax, 0x20
cmp esi, eax
sete cl
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0x46e4b0
lea esi, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4179f0
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, esi
push ecx
push 0x46e4b0
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.004538da
add esp, 0x80c
ret 4
push edi
push 0
lea eax, [esp + 0x14]
push eax
push 0x1800
push 0x46fcb0
call fcn.00453b5b
add esp, 0x14
call fcn.00455a18
xor ecx, ecx
add eax, 0x40
cmp esi, eax
setne cl
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0x46fcb0
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x417a60
push 0
sub ecx, esi
lea edx, [esp + 8]
push edx
sar ecx, 1
push ecx
push 0x46fcb0
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov ecx, dword [esp + 0x80c]
pop esi
xor ecx, esp
call fcn.004538da
add esp, 0x80c
ret 4

Function at 0x418600
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x41862f
test cl, 7
je 0x41862f
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x47a4b8]
dec esi
inc ecx
test esi, esi
ja 0x418612
cmp esi, 8
jb 0x4186c8
mov edi, esi
push ebx
shr edi, 3
push ebp
nop
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x47a8b8]
mov dword [esp + 0x14], ecx
mov ebp, edx
shr ebp, 0x18
xor ebx, dword [ebp*4 + 0x47a4b8]
mov ecx, edx
shr ecx, 8
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x47acb8]
mov ebp, eax
shr ebp, 0x18
xor ebx, dword [ebp*4 + 0x47b4b8]
mov ecx, eax
shr ecx, 0x10
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x47b8b8]
mov ecx, eax
shr ecx, 8
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x47bcb8]
mov ecx, dword [esp + 0x14]
movzx edx, dl
xor ebx, dword [edx*4 + 0x47b0b8]
movzx eax, al
xor ebx, dword [eax*4 + 0x47c0b8]
sub esi, 8
add ecx, 8
sub edi, 1
mov eax, ebx
jne 0x418640
pop ebp
pop ebx
test esi, esi
jbe 0x4186e8
lea esp, [esp]
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x47a4b8]
dec esi
inc ecx
test esi, esi
ja 0x4186d0
pop edi
pop esi
ret 0xc