joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410a4d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x410b84
cmp byte [edi + 0x3d], bl
je 0x410b84
call fcn.00403a7d
mov esi, eax
mov ecx, edi
mov eax, dword [edi]
push esi
call dword [eax + 0xc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
push eax
call fcn.0040e095
pop ecx
pop ecx
test al, al
je 0x410aa3
xor al, al
jmp 0x410b86
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.00405dec
lea ebp, [edi + 0x40]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
call fcn.0040309c
mov ecx, eax
call fcn.00403f7b
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.0040305c
add esi, eax
lea ecx, [esp + 0x2c]
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.0040309c
mov ecx, eax
call fcn.00403f7b
mov ecx, dword [edi + 0x38]
push eax
push ebp
call fcn.0040e419
sub eax, ebx
je 0x410b0b
sub eax, 1
je 0x410b0e
dec eax
sub eax, 1
jne 0x410b77
inc eax
jmp 0x410b75
mov byte [edi + 0x3d], bl
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
call fcn.0040309c
mov ecx, eax
call fcn.00403f7b
mov esi, dword [esp + 0x1c]
sub esi, eax
je 0x410b53
push dword [edi + 0x4c]
lea eax, [esp + 0x28]
push esi
push 1
push eax
lea ecx, [esp + 0x38]
call fcn.0040309c
mov ecx, eax
call fcn.00403f7b
push eax
call fcn.0044009c
add esp, 0x10
cmp esi, eax
jne 0x410b73
cmp byte [edi + 0x3d], bl
je 0x410b71
test esi, esi
jne 0x410ab2
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.00403631
jmp 0x410ab2
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [esp + 0x28]
call fcn.00402bb8
mov al, bl
jmp 0x410b86
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411ae7
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov esi, dword [ebx]
mov edx, dword [ebx + 0x3c]
movzx ebp, word [esi + 0x14]
add ebp, esi
mov eax, dword [ebp + 0x20]
mov ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
call fcn.0041191e
lea edx, [ebp + 0x18]
mov dword [esp + 0x28], eax
mov ecx, ebx
call fcn.00411a2b
mov ebx, dword [ebp + 0x3c]
mov edi, eax
and dword [esp + 0x34], 0
xor eax, eax
inc eax
mov dword [esp + 0x2c], edi
add ebp, 0x40
mov dword [esp + 0x30], ebx
cmp ax, word [esi + 6]
mov esi, ecx
mov dword [esp + 0x20], eax
jae 0x411bf9
mov eax, dword [ebp + 8]
mov ecx, eax
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x1c], eax
call fcn.0041191e
mov edx, ebp
mov dword [esp + 0x14], eax
mov ecx, esi
call fcn.00411a2b
mov edx, dword [esp + 0x10]
mov ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x28], eax
je 0x411bb0
lea ecx, [edi + edx]
cmp ecx, eax
ja 0x411bac
lea edx, [esp + 0x24]
mov ecx, esi
call fcn.00411a4a
test eax, eax
je 0x411c16
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebx, dword [ebp + 0x24]
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
jmp 0x411bd4
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0x24]
mov edi, 0x2000000
test edi, eax
je 0x411bc4
test edi, ebx
je 0x411bc4
or ebx, eax
jmp 0x411bcc
or ebx, eax
and ebx, 0xfdffffff
mov edi, ecx
sub edi, edx
add edi, dword [esp + 0x1c]
mov eax, dword [esi]
add ebp, 0x28
mov ecx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edi
movzx eax, word [eax + 6]
mov dword [esp + 0x20], ecx
cmp ecx, eax
jl 0x411b43
xor eax, eax
inc eax
lea edx, [esp + 0x24]
mov dword [esp + 0x34], eax
mov ecx, esi
call fcn.00411a4a
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor eax, eax
jmp 0x411c0e
Function at 0x421ba6
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [ecx + 4]
xor eax, eax
xor edx, edx
movzx ecx, word [esi]
cmp ax, cx
jae 0x421bd1
movzx eax, dx
mov al, byte [eax + esi + 4]
cmp al, 0x13
je 0x421bd1
cmp al, 0xc0
je 0x421bd1
cmp al, 0xcc
je 0x421bd1
add edx, 2
cmp dx, cx
jb 0x421bb6
pop esi
ret

Function at 0x424680
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
mov edx, dword [esp + 0x10]
lea esi, [edi + 4]
push esi
call fcn.0042461d
mov edx, dword [esp + 0x10]
pop ecx
push 4
sub edx, edi
pop ecx
mov al, byte [edx + edi]
mov byte [edi], al
inc edi
sub ecx, 1
jne 0x42469b
push 8
pop ecx
mov al, byte [esi + edx]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x4246a9
pop edi
pop esi
ret

Function at 0x426904
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x42691c
sub edx, ecx
mov eax, dword [edx + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub esi, 1
jne 0x42690f
pop esi
ret

Function at 0x42691e
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
or eax, edx
push esi
mov esi, dword [esp + 8]
or eax, esi
test al, 3
jne 0x426939
shr esi, 2
push esi
call fcn.00426904
pop ecx
pop esi
ret
test esi, esi
je 0x42694a
sub edx, ecx
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x42693f
pop esi
ret

Function at 0x42694c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov esi, edx
mov ebx, ecx
test edi, edi
jle 0x426970
sub ebx, esi
movzx edx, byte [ebx + esi]
movzx ecx, byte [esi]
xor edx, ecx
or eax, edx
inc esi
sub edi, 1
jne 0x42695f
pop edi
pop esi
pop ebx
ret
Function at 0x42b3db
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [edx + 0x3f]
push esi
shr eax, 6
mov esi, edx
sub esi, eax
mov dword [esp + 0x10], edx
push edi
xor edi, edi
mov ebx, ecx
and dword [esp + 0x18], edi
inc esi
imul eax, esi, 3
shr eax, 2
cmp eax, dword [ebp]
jbe 0x42b412
mov eax, 0xffffff53
jmp 0x42b5e5
mov esi, dword [esp + 0x20]
cmp edx, 3
jbe 0x42b5d3
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
lea edx, [esp + 0x18]
call fcn.0042b37d
add esp, 4
test eax, eax
jne 0x42b5cc
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
mov byte [esp + 0x13], cl
mov dword [esp + 0x18], eax
test cl, cl
je 0x42b5d3
dec dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.0042b37d
add esp, 4
test eax, eax
jne 0x42b5e5
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x12], cl
mov ecx, ebx
push eax
call fcn.0042b37d
add esp, 4
test eax, eax
jne 0x42b5e5
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x24], cl
mov ecx, ebx
push eax
call fcn.0042b37d
add esp, 4
test eax, eax
jne 0x42b5e5
mov eax, dword [esp + 0x18]
mov dl, byte [esp + 0x13]
mov dh, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
cmp dl, 0x2b
jb 0x42b5c5
mov cl, byte [esp + 0x12]
cmp cl, 0x2b
jb 0x42b5c5
mov al, byte [esp + 0x24]
cmp al, 0x2b
jb 0x42b5c5
cmp dh, 0x2b
jb 0x42b5c5
cmp dl, 0x7a
ja 0x42b5c5
cmp cl, 0x7a
ja 0x42b5c5
cmp al, 0x7a
ja 0x42b5c5
cmp dh, 0x7a
ja 0x42b5c5
xor ecx, ecx
cmp al, 0x3d
setne cl
xor eax, eax
inc ecx
cmp dh, 0x3d
setne al
add ecx, edi
add eax, ecx
cmp eax, dword [ebp]
ja 0x42b408
mov cl, byte [esp + 0x12]
movzx eax, dl
mov al, byte [eax + 0xd3882d]
mov byte [esp + 0x13], al
movzx eax, cl
mov ch, byte [eax + 0xd3882d]
mov al, byte [esp + 0x24]
cmp al, 0x3d
jne 0x42b568
xor cl, cl
jmp 0x42b571
movzx eax, al
mov cl, byte [eax + 0xd3882d]
cmp dh, 0x3d
jne 0x42b57a
xor al, al
jmp 0x42b583
movzx eax, dh
mov al, byte [eax + 0xd3882d]
mov ah, byte [esp + 0x13]
mov dl, cl
shl dl, 6
or dl, al
shl ah, 2
mov al, ch
shr al, 4
or al, ah
mov byte [edi + esi], al
inc edi
cmp byte [esp + 0x24], 0x3d
je 0x42b5af
shr cl, 2
shl ch, 4
or cl, ch
mov byte [edi + esi], cl
inc edi
cmp dh, 0x3d
je 0x42b5d3
mov byte [edi + esi], dl
inc edi
cmp dword [esp + 0x14], 3
ja 0x42b41f
jmp 0x42b5d3
mov eax, 0xffffff66
jmp 0x42b5e5
cmp eax, 0xffffff7c
jne 0x42b5e5
test esi, esi
je 0x42b5e0
cmp dword [ebp], edi
jbe 0x42b5e0
mov byte [edi + esi], 0
mov dword [ebp], edi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x42ece1
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x42eddb
cmp dword [esp + 0x14], 0
mov esi, dword [esp + 0x18]
jne 0x42ed02
test esi, esi
jne 0x42eddb
cmp edx, 3
je 0x42ed38
cmp edx, 4
je 0x42ed38
cmp edx, 5
je 0x42ed38
cmp edx, 6
je 0x42ed38
cmp edx, 7
je 0x42ed38
cmp edx, 8
je 0x42ed38
cmp edx, 0xa
je 0x42ed38
cmp edx, 0xb
je 0x42ed38
cmp edx, 0xc
je 0x42ed38
cmp edx, 0xd
jne 0x42eddb
xor ebx, ebx
mov byte [edi + 0x114], dl
push ecx
mov byte [edi + 0x115], bl
call fcn.0042ecc4
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x42ede0
cmp byte [edi + 0x114], 6
lea ecx, [edi + 0x70]
jne 0x42eddb
cmp esi, 0x40
ja 0x42ed7e
cmp dword [esp + 0x14], ebx
je 0x42eda7
push esi
push dword [esp + 0x18]
push ecx
call fcn.004364d0
add esp, 0xc
jmp 0x42eda4
mov edx, dword [esp + 0x14]
mov ecx, edi
push esi
call fcn.00433bc3
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x42edd7
lea edx, [edi + 0x70]
mov ecx, edi
call fcn.00433c9e
mov ebp, eax
test ebp, ebp
jne 0x42edd7
push 0x20
pop esi
lea ecx, [edi + 0x70]
cmp esi, 0x40
jae 0x42edbf
push 0x40
pop eax
sub eax, esi
push eax
lea eax, [ecx + esi]
push ebx
push eax
call fcn.00436a50
add esp, 0xc
mov al, byte [ebx + edi + 0x70]
xor al, 0x5c
mov byte [edi + ebx + 0xb0], al
xor byte [ebx + edi + 0x70], 0x36
inc ebx
cmp ebx, 0x40
jb 0x42edbf
mov eax, ebp
jmp 0x42ede0
mov eax, 0xffffff53
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x432c5f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd4
push ebx
push ebp
push esi
xor ebx, ebx
xor esi, esi
push edi
inc ebx
inc esi
cmp dword [esp + 0xe8], 0
mov edi, ecx
push 0
cmovne ebx, dword [esp + 0xec]
mov ebp, edx
pop ecx
test bl, 0x1f
mov eax, ebx
push 0x37
push dword [esp + 0xf0]
setne cl
shr eax, 5
add eax, ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x44]
push eax
call fcn.004364d0
and dword [esp + 0x20], 0
add esp, 0xc
cmp dword [esp + 0x10], 0
jbe 0x432d9d
lea ecx, [esp + 0x74]
call fcn.00433cdd
mov esi, eax
test esi, esi
jne 0x432d9d
push 0x37
lea edx, [esp + 0x40]
lea ecx, [esp + 0x78]
call fcn.00433bc3
mov esi, eax
pop ecx
test esi, esi
jne 0x432d9d
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x74]
call fcn.00433c9e
mov esi, eax
test esi, esi
jne 0x432d9d
push 4
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004364d0
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [edi], 1
jbe 0x432d48
cmp eax, dword [edi + 4]
jne 0x432d48
cmp byte [edi + 0x76], 1
je 0x432dbb
mov edx, dword [esp + 0x10]
mov byte [edi + 0x76], 1
lea eax, [edx - 1]
cmp dword [esp + 0x14], eax
lea ecx, [edx + 1]
cmovne ecx, edx
mov dword [esp + 0x10], ecx
jmp 0x432d4f
mov byte [edi + 0x76], 0
mov dword [edi + 4], eax
test ebp, ebp
je 0x432d8a
test ebx, ebx
je 0x432d8a
lea eax, [esp + 0x1c]
cmp ebx, 0x20
jb 0x432d7d
push 0x20
push eax
push ebp
call fcn.004364d0
add esp, 0xc
lea ecx, [esp + 0x3c]
sub ebx, 0x20
add ebp, 0x20
call fcn.00432c50
jmp 0x432d8a
push ebx
push eax
push ebp
call fcn.004364d0
add esp, 0xc
xor ebx, ebx
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x10]
jl 0x432cbd
push 0x37
pop edx
lea ecx, [esp + 0x3c]
call fcn.0041d211
xor eax, eax
test esi, esi
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret
push 3
pop eax
jmp 0x432db0

Function at 0x4334b7
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x433463
mov eax, 0xffffff53
pop esi
ret
push edi
push 0x20
xor edi, edi
push edi
push esi
call fcn.00436a50
add esp, 0xc
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
xor eax, eax
mov dword [esi + 0x68], edi
mov dword [esi], 0x6a09e667
pop edi
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
ret
test ecx, ecx
jne 0x4334c1
mov eax, 0xffffff53
ret
mov dword [ecx + 0x6c], edx
jmp 0x433455
Function at 0x433be2
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x433bf0
mov eax, 0xffffff53
pop ebx
ret
mov eax, dword [ebx + 0x60]
push ebp
push esi
push edi
push 0x40
pop edi
lea ebp, [ebx + 0x20]
mov byte [eax + ebp], 0x80
inc dword [ebx + 0x60]
mov ecx, dword [ebx + 0x60]
push 0x38
pop esi
cmp ecx, esi
jbe 0x433c3d
mov eax, edi
sub eax, ecx
push eax
lea eax, [ecx + ebp]
push 0
push eax
call fcn.00436a50
push edi
mov edx, ebp
mov dword [ebx + 0x60], edi
mov ecx, ebp
call fcn.0043342b
add esp, 0x10
mov edx, ebp
mov ecx, ebx
call fcn.004334c9
test eax, eax
jne 0x433c99
and dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x60]
sub esi, eax
push esi
add eax, ebp
push 0
push eax
call fcn.00436a50
lea edi, [ebx + 0x64]
mov edx, ebp
mov ecx, dword [edi]
lea esi, [ebx + 0x68]
mov eax, dword [esi]
shr ecx, 0x1d
push 0x40
lea eax, [ecx + eax*8]
mov ecx, ebp
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 3
mov dword [edi], eax
call fcn.0043342b
push 4
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.004364d0
push 4
lea eax, [ebp + 0x3c]
push edi
push eax
call fcn.004364d0
add esp, 0x28
mov edx, ebp
mov ecx, ebx
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.004334c9
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x433c9e
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x433cd5
test edi, edi
je 0x433cd5
call fcn.00433be2
test eax, eax
jne 0x433cda
push 0x20
mov edx, esi
mov ecx, esi
call fcn.0043342b
push 0x20
push esi
push edi
call fcn.004364d0
add esp, 0x10
mov ecx, esi
pop edi
pop esi
jmp 0x433455
mov eax, 0xffffff53
pop edi
pop esi
ret

Function at 0x433d8d
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov eax, edx
mov ebp, ecx
neg eax
mov dword [esp + 8], eax
test ebp, ebp
je 0x433e27
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x433e27
mov edx, dword [ebp]
mov ecx, ebx
inc edx
call fcn.0042f470
mov dword [esp + 0xc], eax
test eax, eax
jne 0x433e2c
xor edx, edx
push esi
push edi
cmp dword [ebp], edx
jle 0x433ded
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00433d77
mov ecx, ebx
mov esi, eax
call fcn.00433d77
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebp]
jl 0x433dc7
jmp 0x433e12
mov ecx, dword [esp + 0x10]
jmp 0x433e12
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00433d77
mov ecx, ebx
mov esi, eax
call fcn.00433d77
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebx]
jl 0x433df3
mov eax, dword [ebp]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
jmp 0x433e2c
mov eax, 0xffffff53
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x44bbb5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044ba34
Function at 0x407207
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x38], edi
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
call fcn.0040714b
mov ebx, dword [ebp - 0x14]
mov eax, dword [esi + 8]
add ebx, 0x23f
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xc]
push 0x20
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], eax
pop edi
mov dword [ebp - 0x20], 2
add dword [ebp - 0x20], 3
mov esi, dword [ebp - 8]
mov eax, esi
mov ecx, dword [0x70f954]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x407292
push 0x401130
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [0x70f954]
mov edx, dword [ebp - 0x1c]
add eax, dword [ebp - 0x28]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x70f998]
mov dword [ebp - 0x24], 0xedeb2e40
cmove eax, dword [ebp - 0x24]
and dword [ebp - 0x24], 0
cmp ecx, 0x3eb
mov dword [0x70f998], eax
mov eax, dword [0x70f9a0]
cmove eax, dword [ebp - 0x24]
mov dword [0x70f9a0], eax
lea eax, [ebx + esi]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0x70f99c], 0xf4ea3dee
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x1c]
sub edx, eax
mov dword [ebp - 0x10], eax
mov eax, edx
mov dword [ebp - 0x1c], edx
shl eax, 4
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov eax, edx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
xor eax, dword [ebp - 0x24]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 8], eax
add ebx, 0x61c88647
mov dword [ebp - 0x14], ebx
dec edi
jne 0x407257
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
mov dword [edi], eax
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407371
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
shr esi, 3
push edi
mov edi, ecx
test esi, esi
je 0x4073af
cmp dword [0x70f954], 0x959
jne 0x40739f
push 0
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.00407207
add edi, 8
dec esi
jne 0x407381
pop edi
pop esi
pop ebp
ret 4
Function at 0x4103df
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x430f30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a5f3
mov dword [ebp - 0x14], eax
cmp dword [0x710734], esi
jne 0x4104d2
push 0x800
push esi
push 0x4050fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41045f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4105b2
push esi
push esi
push 0x4050fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4105b2
push 0x405114
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4105b2
push eax
call ebx
push 0x405120
push edi
mov dword [0x710734], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x405130
push edi
mov dword [0x710738], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x405144
push edi
mov dword [0x71073c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x710744], eax
test eax, eax
je 0x4104cf
push 0x405160
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x710740], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4104f7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4104ea
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41050c
push 4
pop eax
jmp 0x4105b4
cmp dword [ebp - 0x14], esi
je 0x41050c
push dword [0x710734]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4104f1
mov eax, dword [0x710740]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41056a
cmp dword [0x710744], edi
je 0x41056a
push eax
call ebx
push dword [0x710744]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41056a
test eax, eax
je 0x41056a
call ecx
test eax, eax
je 0x41055f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41055f
test byte [ebp - 8], 1
jne 0x41056a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41059a
mov eax, dword [0x710738]
cmp eax, edi
je 0x410597
push eax
call ebx
test eax, eax
je 0x410597
call eax
mov esi, eax
test esi, esi
je 0x410597
mov eax, dword [0x71073c]
cmp eax, edi
je 0x410597
push eax
call ebx
test eax, eax
je 0x410597
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x710734]
call ebx
test eax, eax
je 0x4105b2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4105b4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409c2e
mov esp, ebp
pop ebp
ret
Function at 0x1009b454
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1014fef1
call fcn.10147df8
mov esi, ecx
mov dword [ebp - 0x14], esi
call fcn.1008f6dc
xor ebx, ebx
mov dword [esi], vtable.ScObjects::Thread.0
push 0x10
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], bl
call fcn.10102eea
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
je 0x1009b49b
mov dword [eax], vtable.ScObjects::ThreadData.0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x1009b49d
mov eax, ebx
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push 0x1009b680
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
cmp ecx, 0xffffffff
jne 0x1009b4d0
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 0x20
mov dword [esi + 0xc], ebx
mov dword [eax + 4], ebx
jmp 0x1009b4dc
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
mov dword [eax + 4], ecx
mov eax, esi
call fcn.10147dc1
ret

Function at 0x1009b790
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0x10], 0
jne 0x1009b7a2
mov eax, dword [ecx + 8]
push dword [eax + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret

Function at 0x100a1d60
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x2c
mov eax, 0x10150bd0
call fcn.10147e2c
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x38], esi
mov ecx, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], edi
call fcn.1009b955
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], 1
call fcn.100a1e88
test eax, eax
jne 0x100a1da4
push 0xffffffffffffffff
push 0x10159980
mov ecx, esi
call fcn.10102eea
jmp 0x100a1dea
lea ecx, [ebp - 0x20]
push ecx
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ecx, esi
push 0xffffffffffffffff
push 0x10159980
test eax, eax
je 0x100a1d9d
call fcn.10102eea
movzx eax, byte [ebp + edi - 0x20]
push eax
lea eax, [ebp - 0x30]
push 0x10165c80
push eax
call fcn.10102eea
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.10102eea
add esp, 0x14
inc edi
cmp edi, 0x10
jb 0x100a1dc3
mov eax, esi
call fcn.10147dd6
ret

Function at 0x100a1e88
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push esi
mov esi, dword [0x107d4410]
test esi, esi
jne 0x100a1edc
push edi
push esi
push 1
push esi
push esi
mov edi, 0x107d4410
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x100a1ed5
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x100a1ed5
push 8
push 1
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x100a1ed5
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [0x107d4410], esi
jmp 0x100a1edb
mov esi, dword [0x107d4410]
pop edi
mov eax, esi
pop esi
ret