joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409780
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ce16
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x466014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x11c], esi
lea eax, [ebp - 0x118]
mov dword [ebp - 0x11c], esi
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
sub esp, 0x18
mov ecx, esp
push 0x46735c
call fcn.0041b210
lea ecx, [ebp - 0x14c]
call fcn.00405ca0
add esp, 0x18
mov edi, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x124], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x120], 0xf
mov byte [ebp - 0x134], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409820
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x134]
call fcn.0041ba30
push edi
lea edx, [ebp - 0x134]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.0041bb90
mov edx, dword [ebp - 0x120]
add esp, 4
cmp edx, 0x10
jb 0x409887
mov ecx, dword [ebp - 0x134]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40987d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4098f5
push edx
push ecx
call fcn.00420fd3
add esp, 8
mov edx, dword [ebp - 0x138]
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0xf
mov byte [ebp - 0x134], 0
cmp edx, 0x10
jb 0x4098d8
mov ecx, dword [ebp - 0x14c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4098ce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4098f5
push edx
push ecx
call fcn.00420fd3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00420961
mov esp, ebp
pop ebp
ret
call fcn.0043a5da
int3
Function at 0x40b0b0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x467238], 0x10
mov eax, 0x467224
cmovae eax, dword [0x467224]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b0f7
test edi, edi
je 0x40b0f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40b0f9
pop edi
ret
push 0
call fcn.00439f99
int3
Function at 0x40b670
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d056
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x466014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x414], ebx
push 0
mov dword [ebp - 0x414], ebx
call fcn.0043c466
push eax
call fcn.00439fd0
add esp, 8
call fcn.00439faf
cdq
mov ecx, 0x3313
idiv ecx
mov edi, edx
call fcn.00439faf
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov esi, edx
shr esi, 0x1f
add esi, edx
imul esi, edi
call fcn.00439faf
imul edx, eax, 0x4d
lea ecx, [ebp - 0x444]
add edx, 0x64
add edx, esi
call fcn.00404570
mov dword [ebp - 4], 0
lea eax, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
lea edx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x444]
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x40b720
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x40b736
push 0x40
push 0
push 0x46c530
sub esi, ecx
call fcn.00437a60
add esp, 0xc
mov dword [0x46c524], 0
mov edx, esi
mov dword [0x46c520], 0
lea ecx, [ebp - 0x410]
mov dword [0x46c510], 0x67452301
mov dword [0x46c514], 0xefcdab89
mov dword [0x46c518], 0x98badcfe
mov dword [0x46c51c], 0x10325476
call fcn.004055c0
call fcn.00405680
mov ecx, 0x46a570
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0xf
mov byte [ebp - 0x42c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b7c1
sub ecx, edx
push ecx
push 0x46a570
lea ecx, [ebp - 0x42c]
call fcn.0041ba30
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0x40b81c
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b812
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b8dc
push edx
push ecx
call fcn.00420fd3
add esp, 8
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x41c]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
cmp eax, 1
jb 0x40b8d7
dec eax
mov ecx, 0xa
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push ecx
inc eax
mov ecx, ebx
push eax
call fcn.0041ba30
mov edx, dword [ebp - 0x418]
cmp edx, 0x10
jb 0x40b8b9
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b8af
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b8dc
push edx
push ecx
call fcn.00420fd3
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00420961
mov esp, ebp
pop ebp
ret
call fcn.0041bb70
call fcn.0043a5da
int3
Function at 0x40c140
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d150
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x466014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov eax, dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
add eax, ecx
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.0041be80
mov byte [ebp - 4], 1
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push 0
cmovae esi, dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x40c1d7
lea eax, [ebp - 0x2c]
push eax
push 0x45d078
push 1
push 0
push 0x45d068
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x40c257
call dword [sym.imp.ole32.dll_CoUninitialize]
xor esi, esi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40c213
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c209
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c2da
push edx
push ecx
call fcn.00420fd3
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 0x10
jb 0x40c2be
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c2b4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c2da
jmp 0x40c2b4
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x30]
push edx
push 0x45d0fc
push 0x45cf50
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x20]
test eax, eax
jns 0x40c1d7
cmp eax, 0x80070050
jne 0x40c1d7
mov eax, dword [ebp - 0x2c]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x40c2a4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x40c1d7
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 1
jmp 0x40c1d9
push edx
push ecx
call fcn.00420fd3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00420961
mov esp, ebp
pop ebp
ret
call fcn.0043a5da
int3
Function at 0x40de00
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d3e0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x466014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
mov edx, dword [ebp + 0x1c]
mov eax, edx
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 1
jb 0x40de57
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x18], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
mov word [eax + ecx], 0
jmp 0x40de6c
push 0
push 1
mov byte [ebp - 0x34], 0
lea ecx, [ebp + 8]
push dword [ebp - 0x34]
push 1
call fcn.0041c750
mov edx, dword [ebp + 0x34]
mov eax, edx
mov ecx, dword [ebp + 0x30]
sub eax, ecx
cmp eax, 1
jb 0x40de93
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov word [eax + ecx], 0
jmp 0x40dea8
push 0
push 1
mov byte [ebp - 0x34], 0
lea ecx, [ebp + 0x20]
push dword [ebp - 0x34]
push 1
call fcn.0041c750
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x16], 0
cmovae eax, dword [ebp + 8]
cmp dword [ebp + 0x34], 0x10
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, 0x610
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
push eax
movlpd qword [ebp - 0x1e], xmm0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov edx, dword [ebp + 0x1c]
mov esi, eax
cmp edx, 0x10
jb 0x40df26
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40df1c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df84
push edx
push ecx
call fcn.00420fd3
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x40df68
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40df5e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df84
push edx
push ecx
call fcn.00420fd3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00420961
mov esp, ebp
pop ebp
ret
call fcn.0043a5da
int3
Function at 0x40f0f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x466014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x46c5b4
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ecx
call fcn.0042001c
add esp, 4
test eax, eax
jne 0x40f1fb
mov ecx, dword [0x46c528]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_send]
push esi
push edi
mov dword [ebp - 0xc], ecx
xor esi, esi
mov edi, 4
push 0
push edi
lea eax, [ebp - 8]
add eax, esi
push eax
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40f151
mov ecx, dword [ebp - 0xc]
add esi, eax
sub edi, eax
cmp esi, 4
jl 0x40f134
xor ecx, ecx
mov edi, 8
cmp eax, 0xffffffff
setne cl
dec ecx
xor esi, esi
mov dword [ebp - 0xc], ecx
mov ecx, dword [0x46c528]
mov dword [ebp - 0x10], ecx
nop dword [eax]
push 0
push edi
lea eax, [ebp + 8]
add eax, esi
push eax
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40f18d
mov ecx, dword [ebp - 0x10]
add esi, eax
sub edi, eax
cmp esi, 8
jl 0x40f170
mov edi, dword [ebp - 0xc]
or ecx, 0xffffffff
cmp eax, ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmove edi, ecx
mov ecx, dword [0x46c528]
xor esi, esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x18], ecx
test eax, eax
jle 0x40f1d7
mov edi, eax
mov eax, dword [ebp - 0x14]
push 0
push edi
add eax, esi
push eax
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40f1d4
mov ecx, dword [ebp - 0x18]
add esi, eax
sub edi, eax
cmp esi, dword [ebp - 0x10]
jl 0x40f1b2
mov edi, dword [ebp - 0xc]
jmp 0x40f1d7
or edi, 0xffffffff
push 0x46c5b4
call fcn.00420041
add esp, 4
test eax, eax
jne 0x40f201
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420961
mov esp, ebp
pop ebp
ret
push eax
call fcn.0041fbda
push eax
call fcn.0041fbda
int3
Function at 0x40f870
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Convert ip address from string
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x20f8
call fcn.00421ac0
mov eax, dword [0x466014]
xor eax, esp
mov dword [esp + 0x20f4], eax
push esi
push edi
call fcn.0043ae83
cmp dword [0x467130], 0x10
mov edi, eax
push 0xa
lea eax, [esp + 0x10]
mov esi, 0x46711c
cmovae esi, dword [0x46711c]
push eax
push esi
mov dword [edi], 0
call fcn.0043c3b9
add esp, 0xc
cmp esi, dword [esp + 0xc]
je 0x40fa04
cmp dword [edi], 0x22
je 0x40f9fa
movzx edi, ax
lea eax, [esp + 0x28]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x40f9e3
cmp dword [0x467478], 0x10
xorps xmm0, xmm0
mov eax, 2
movaps xmmword [esp + 0x10], xmm0
mov esi, 0x467464
mov word [esp + 0x10], ax
cmovae esi, dword [0x467464]
push edi
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
lea eax, [esp + 0x14]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 0x10
lea ecx, [esp + 0x14]
mov dword [0x46c528], eax
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x40f993
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
push 0xbb8
call edi
push dword [0x46c528]
call esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 0x10
lea ecx, [esp + 0x14]
mov dword [0x46c528], eax
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x40f960
lea ecx, [esp + 0x1b8]
call fcn.0040f5d0
cmp eax, 0xffffffff
je 0x40f9e3
cmp byte [0x46a46c], 1
je 0x40f9d4
lea ecx, [esp + 0x1b8]
call fcn.0040f5d0
cmp eax, 0xffffffff
jne 0x40f9a4
or eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x20f4]
xor ecx, esp
call fcn.00420961
mov esp, ebp
pop ebp
ret
push dword [0x46c528]
call esi
mov byte [0x46a46c], 0
mov ecx, dword [esp + 0x20fc]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.00420961
mov esp, ebp
pop ebp
ret
push str.stoi_argument_out_of_range
call fcn.0041fb49
push str.invalid_stoi_argument
call fcn.0041fb09
int3
Function at 0x41a510
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x41a390
push 0
push 0
call esi
push 0
push 0
push 0
push 0x41a420
push 0
push 0
call esi
push 0
push 0
push 0
push 0x41a4b0
push 0
push 0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7530
call esi
jmp 0x41a500
push ebp
mov ebp, esp
and esp, 0xfffffff8
call fcn.0040b0b0
mov ecx, 1
call fcn.0040e350
call fcn.0040ebe0
call fcn.00416e80
call fcn.004060b0
jmp 0x41a4c0

Function at 0x4234ff
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x401784
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
not eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jmp 0x40183a
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xfdb4c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 1
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xfdb4c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 2
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xfdb4c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 3
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xfdb4c0]
xor eax, edx
mov dword [ebp - 4], eax
add dword [ebp - 8], 4
sub dword [ebp + 0x10], 4
cmp dword [ebp + 0x10], 3
ja 0x40179d
jmp 0x401871
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xfdb4c0]
xor eax, edx
mov dword [ebp - 4], eax
add dword [ebp - 8], 1
sub dword [ebp + 0x10], 1
cmp dword [ebp + 0x10], 0
jne 0x401846
mov eax, dword [ebp - 4]
not eax
leave
ret
Function at 0x420110
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004269a0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004269a0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x420170
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x10fe07c]
test esi, esi
jle 0x420290
mov eax, dword [0x10fe080]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4201a4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x420227
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x420190
mov dword [esp], ebx
call fcn.00420af0
mov edi, eax
test eax, eax
je 0x4202b7
mov eax, dword [0x10fe080]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00420c30
mov edx, dword [0x10fe080]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x420297
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x420220
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x420230
add dword [0x10fe07c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x10fe080]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x420220
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00420110
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4201ae
mov eax, dword [0x10fe080]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00420110
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00420110
lea esi, [esi]
nop
Function at 0x420770
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x10fe098
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x10fe090]
sub esp, 4
test ebx, ebx
je 0x4207c5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4207be
test esi, esi
je 0x4207be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4207a0
mov dword [esp], 0x10fe098
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x420af0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x420b15
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x420b20
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x420b15
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x420b68
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x420b5e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x420b6a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x420b50
xor eax, eax
pop ebx
pop esi
ret
Function at 0x10001000
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10001010
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x1000101c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10001026
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10001030
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x1000103a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10001044
or eax, 4
shr ecx, 1
test cl, 1
je 0x1000104e
or eax, 2
test cl, 2
je 0x10001056
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001110
test al, 1
je 0x1000111d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001110
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10001004
pop edi
pop ebx
ret

Function at 0x10001140
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1001e018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push 0x100166a4
push eax
lea eax, [ebp - 0x408]
push eax
or esi, 0xffffffff
mov dword [ebp - 0x408], 0
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x10001192
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012ae6
mov esp, ebp
pop ebp
ret 8
push ebx
push edi
mov ecx, dword [ebp - 0x408]
push ecx
push 0x400
lea edx, [ebp - 0x404]
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
mov ecx, eax
lea edx, [ebp - 0x404]
test eax, eax
je 0x100011da
mov edi, edi
movzx ebx, byte [edx]
mov edi, esi
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr esi, 8
xor esi, dword [ebx + edi*4]
inc edx
dec ecx
jne 0x100011c0
cmp eax, 0x400
je 0x10001194
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop ebx
xor ecx, ebp
not eax
pop esi
call fcn.10012ae6
mov esp, ebp
pop ebp
ret 8