joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444160
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446b9f
mov eax, dword fs:[0]
push eax
sub esp, 0x6a8
mov eax, dword [0x45b080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6b4], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x46c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x450e34
lea edx, [ebp - 0x46c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x46c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0xffffffff
jne 0x4441de
xor al, al
jmp 0x444350
mov edx, 1
test edx, edx
je 0x444337
mov eax, dword [ebp - 0x264]
and eax, 0x10
je 0x444267
movzx ecx, word [ebp - 0x238]
cmp ecx, 0x2e
je 0x444262
lea edx, [ebp - 0x474]
push edx
mov ecx, dword [ebp + 8]
call fcn.004057c0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x238]
lea eax, [ebp - 0x474]
call fcn.004058b0
mov edx, 0x450e3c
lea eax, [ebp - 0x474]
call fcn.004058b0
lea eax, [ebp - 0x474]
call fcn.004059d0
push eax
mov ecx, dword [ebp - 0x6b4]
call sym.nsUninstall.exe_private:_bool___thiscall_CNsUninstaller::DelDir_wchar_t_const__
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x474]
call fcn.004059b0
jmp 0x444318
xor eax, eax
mov word [ebp - 0x684], ax
push 0x206
push 0
lea ecx, [ebp - 0x682]
push ecx
call fcn.00415590
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x684]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x684]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x684]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x6b4]
mov edx, dword [ecx + 0xc]
add edx, 1
mov eax, dword [ebp - 0x6b4]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x6b4]
mov eax, dword [ecx + 0xc]
imul eax, eax, 0x64
mov ecx, dword [ebp - 0x6b4]
cdq
idiv dword [ecx + 8]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
jl 0x444318
cmp dword [ebp - 0x478], 0x64
jg 0x444318
push 0
mov edx, dword [ebp - 0x478]
push edx
push 0x7e9
mov eax, dword [ebp - 0x6b4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [ebp - 0x264]
push edx
mov eax, dword [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x444332
jmp 0x444337
jmp 0x4441de
mov ecx, dword [ebp - 0x470]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004144ca
mov esp, ebp
pop ebp
ret 4
Function at 0x444370
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446bd2
mov eax, dword fs:[0]
push eax
sub esp, 0x4a0
mov eax, dword [0x45b080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4ac], ecx
mov dword [ebp - 0x268], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x474]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x450e2c
lea edx, [ebp - 0x474]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x474]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0xffffffff
jne 0x4443fc
mov eax, dword [ebp - 0x268]
jmp 0x4444cf
mov edx, 1
test edx, edx
je 0x4444bc
mov eax, dword [ebp - 0x264]
and eax, 0x10
je 0x44448e
movzx ecx, word [ebp - 0x238]
cmp ecx, 0x2e
je 0x44448c
lea edx, [ebp - 0x47c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004057c0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x238]
lea eax, [ebp - 0x47c]
call fcn.004058b0
mov edx, 0x450de4
lea eax, [ebp - 0x47c]
call fcn.004058b0
lea eax, [ebp - 0x47c]
call fcn.004059d0
push eax
mov ecx, dword [ebp - 0x4ac]
call sym.nsUninstall.exe_private:_int___thiscall_CNsUninstaller::CountFiles_wchar_t_const__
add eax, dword [ebp - 0x268]
mov dword [ebp - 0x268], eax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x47c]
call fcn.004059b0
jmp 0x44449d
mov eax, dword [ebp - 0x268]
add eax, 1
mov dword [ebp - 0x268], eax
lea ecx, [ebp - 0x264]
push ecx
mov edx, dword [ebp - 0x478]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4444b7
jmp 0x4444bc
jmp 0x4443fc
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004144ca
mov esp, ebp
pop ebp
ret 4
Function at 0x4444f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447033
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x45b080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], ecx
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00415590
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
call sym.nsUninstall.exe_int___cdecl_GetProgramsPath_wchar_t__
add esp, 4
push 0x451088
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp - 0x234]
add ecx, 0x13c
push ecx
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x45108c
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp - 0x234]
call sym.nsUninstall.exe_private:_bool___thiscall_CNsUninstaller::DelDir_wchar_t_const__
lea edx, [ebp - 0x21c]
push edx
call sym.nsUninstall.exe_int___cdecl_GetDesktopPath_wchar_t__
add esp, 4
lea esi, [ebp - 0x220]
call fcn.004057a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x234]
add eax, 0xd8
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0x451090
lea edi, [ebp - 0x220]
call fcn.00405f90
add esp, 0xc
lea eax, [ebp - 0x220]
call fcn.004059d0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x224], 0
jmp 0x444615
mov edx, dword [ebp - 0x224]
add edx, 1
mov dword [ebp - 0x224], edx
mov ecx, dword [ebp - 0x234]
add ecx, 0x318
call fcn.0040fc20
cmp dword [ebp - 0x224], eax
jae 0x444652
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x318
call fcn.0040fc40
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x444606
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x220]
call fcn.004059b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004144ca
mov esp, ebp
pop ebp
ret
Function at 0x444d50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
je 0x444d71
cmp dword [ebp + 0xc], 0
je 0x444d71
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x1e
jl 0x444d76
jmp 0x444e14
push 0x294
call fcn.00414bd6
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push 0x294
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.00415590
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
add eax, 0x190
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp + 0x10], 0
je 0x444de8
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x64
jge 0x444de8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
add eax, 0x1cc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x444b60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x444e14
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427004]
jne 0x401010
repz ret
jmp fcn.0040176d

Function at 0x40655b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004032f4
and dword [ebp - 4], 0
cmp dword [0x4290dc], 0
mov ebx, eax
jne 0x40660c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4066bd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4066bd
push eax
call fcn.00403282
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4290dc], eax
call esi
push eax
call fcn.00403282
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4290e0], eax
call esi
push eax
call fcn.00403282
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4290e4], eax
call esi
push eax
call fcn.00403282
pop ecx
mov dword [0x4290ec], eax
test eax, eax
je 0x40660c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403282
pop ecx
mov dword [0x4290e8], eax
mov eax, dword [0x4290e8]
cmp eax, ebx
je 0x406664
cmp dword [0x4290ec], ebx
je 0x406664
push eax
call fcn.004032fd
push dword [0x4290ec]
mov esi, eax
call fcn.004032fd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406664
test edi, edi
je 0x406664
call esi
test eax, eax
je 0x40665b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40665b
test byte [ebp - 0xc], 1
jne 0x406664
or dword [ebp + 0x10], 0x200000
jmp 0x40669d
mov eax, dword [0x4290e0]
cmp eax, ebx
je 0x40669d
push eax
call fcn.004032fd
pop ecx
test eax, eax
je 0x40669d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40669d
mov eax, dword [0x4290e4]
cmp eax, ebx
je 0x40669d
push eax
call fcn.004032fd
pop ecx
test eax, eax
je 0x40669d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4290dc]
call fcn.004032fd
pop ecx
test eax, eax
je 0x4066bd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4066bf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420b52
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x437044]
push dword [0x436d60]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x420be1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp ebx, 0x19f
jne 0x420bf5
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x420c19
push esi
and dword [ebp - 4], 0
lea esi, [ebp - 4]
call fcn.00420bd6
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, ebx
jl 0x420bfd
pop esi
pop edi
cmp ebx, 0x2d
jne 0x420c30
or dword [0x437054], 0xffffffff
mov dword [0x437050], 0xa62e7790
leave
ret
Function at 0x44b610
Capabilities:
Accept command line arguments

Disassembly:
mov ecx, dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 2
mov byte [0x663210], al
mov byte [0xa656f4], al
mov eax, 0xd7b0
push esi
mov dword [0x663228], ecx
mov word [0xa6574c], ax
mov word [0xa6574e], ax
mov word [0x663624], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x663258], eax
call esi
and eax, 0x80000000
cmp eax, 0x80000000
je 0x44b665
call esi
cmp al, 4
ja 0x44b66b
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x663254], eax
pop esi
ret

Function at 0x574029
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x1e
lahf
xor dword [esi - 0x577b7e7e], eax
inc eax
jge 0x574056
push edi
mov ecx, 0x81c283c
pop edi
sub ecx, dword [ebp + 0x7c0cecc1]
cld
adc eax, 0x3c7fdcf2
das
in eax, dx
lahf
pop ecx
mov ebx, dword [ecx - 0xf]
mov byte [0xb16e06ac], al
stosd dword es:[edi], eax
outsb dx, byte [esi]
mov cl, 0xab
xor byte [ecx + 0x45673bdf], dh
test byte [edx], cl
or al, byte [edx + 0x4976c447]
loope 0x574032
pop ss
mov ecx, 0x5f6c2154
pop edi
xor byte [edi - 0x4d], dh
inc esp
int1
and cl, byte [edi + 0x61316723]
popal
add byte [ebp - 0x7f], dh
add ebp, esi
push ss
adc dword [ecx + esi*2], ebp
rol dword [ebp + 0x4eee9929], 1
adc byte [eax - 0x4b], cl
push edi
jmp 0x574008
Function at 0x652fd9
Capabilities:
Encode data using xor

Disassembly:
rcl byte [edx + ecx - 0x1fed2bc7], 0xfa
cmp ch, byte [ebx - 0x3f]
fisubr dword [ecx + ebp*4 - 0x10809c1e]
xchg ebx, eax
push eax
test al, 0xa7
salc
popfd
mov dh, 0xcf
sub eax, 0x62c7be21
cmpsb byte [esi], byte es:[edi]
sbb esi, dword [edi - 0x4ace8a1e]
movsd dword es:[edi], dword [esi]
xor eax, 0x95a392c7
or dword [ecx - 0x785af2cd], esi
popfd
xchg dword [eax + 0x5d], ebx
sbb bl, byte [ebx - 0x13]
adc dword [edi - 0xd], 0xb8b2f09d
jno 0x652fef
add edx, dword [edx]
push ebp
dec edi
sal dword [edi], cl
fcom dword [ecx + ecx*2 + 0x7750ff79]
test dword [esi + 0x7dcac3eb], 0x60ed004d
dec ebp
add byte [ebp + 0x4c], bh
out 0xb1, al
mov esp, 0xd0c28665
insd dword es:[edi], dx
cmpsb byte [esi], byte es:[edi]
lahf
pop eax
xor eax, 0x4b961eee
inc edi
mov bl, 0xcd
into
mov bl, 6
mov esp, 0xa231538a
mov esi, 0xa8199d8d
dec edi
test al, 0x4f
mov edx, 0x338e68a3
lds ecx, ss:[ecx]
pop edi
mov al, pe_nt_image_headers32
adc dword [ecx + 0x566a3067], esp
fadd qword [ebx - 0x52e83f34]
xchg cl, dh
stc
dec edi
loope 0x653036
dec ebp
or eax, 0xa0491eab
xchg edi, eax
loope 0x6530f3
inc edx
add al, bl
xchg dword [esi], ebx
xor al, 0xfb
or ah, byte [ebx - 0x14447ce6]
sub ebx, dword [eax - 0x2e285dee]
inc ecx
mov bl, 0xeb
add eax, 0xff54214
fld qword [ecx + esi]
dec ebp
mov eax, dword [0x773c5d16]
and al, 0x1d
sbb eax, 0x8e755c42
add ah, byte [ebp + ebx*8 + 0x10]
dec ebp
and esi, edi
adc dl, ah
js 0x653057
xchg ch, ah
loope 0x6530d2
popfd
aaa
xchg ebx, eax
aaa
int3
mov eax, 0xe034def5
and byte [ebx - 0x60fca5e0], ah
nop
sub dword [eax], ebp
adc eax, 0xa7d32331
dec ebp
bound edx, qword [ebx]
adc byte [eax], dl
leave
mov eax, 0x4b1cb395
out 0x32, al
jp 0x653109
adc eax, 0x232326c2
push es
pushal
fadd st(6)
mov al, byte [0xc570f508]
test eax, esi
mov ah, 0xc2
mov eax, 0xa8179789
fmul dword [esp + eax*8 + 0x12]
ret 0x2326
xchg edi, eax
pop ss
test al, 0xd8
dec esp
les edx, [edx]
popal
push 0xaff91cbc
bound edx, qword [edx + 0xf783ae]
rcr dword [ebx], 1
inc ebx
invalid

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x12d8668a
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xeba0f5c
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6d001fb0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x53b66a3b
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4090a0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x4c
lea eax, [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
sub esp, 4
mov eax, dword [esp + 0x20]
mov dword [0x50f038], eax
cmp eax, 0xf
jbe 0x4090db
mov dword [esp + 4], 0x10
mov dword [esp], 0x5734c0
call fcn.00411b60
xor eax, eax
add esp, 0x4c
ret
call fcn.00408b90
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualLock]
sub esp, 8
cmp eax, 1
sbb eax, eax
add esp, 0x1c
ret
Function at 0x40b4b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x82c
mov edx, dword [esp + 0x840]
test edx, edx
je 0x40b4d0
mov eax, dword [esp + 0x844]
test eax, eax
jne 0x40b4db
add esp, 0x82c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x844]
mov ecx, 0x100
mov edi, dword [eax]
mov edx, dword [eax + 0x18]
mov esi, dword [edi + 4]
mov dword [esp + 0x14], edi
lea eax, [edx + 0x3fffff]
shl eax, 0xa
mov ebx, eax
lea eax, [esp + 0x20]
add esi, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x844]
mov edi, dword [edi + 0x1c]
mov dword [esp + 0x1c], edi
cmp edi, 1
jbe 0x40b576
add ebx, 0x400
shl edx, 0xb
mov ebp, 1
mov dword [esp + 0x18], ebx
lea edi, [edx - 0x400]
mov ebx, dword [esp + 0x14]
add ebp, 1
xor edx, edx
mov esi, dword [ebx + 4]
add esi, edi
lea esi, [esi]
mov ecx, dword [eax + edx*8]
mov ebx, dword [eax + edx*8 + 4]
xor ecx, dword [esi + edx*8]
xor ebx, dword [esi + edx*8 + 4]
mov dword [eax + edx*8], ecx
mov dword [eax + edx*8 + 4], ebx
add edx, 1
cmp edx, 0x80
jne 0x40b548
mov ebx, dword [esp + 0x18]
add edi, ebx
mov ebx, dword [esp + 0x1c]
cmp ebp, ebx
jne 0x40b533
lea ebx, [esp + 0x420]
mov esi, eax
mov eax, dword [esp + 0x840]
mov ecx, 0x100
lea edi, [esp + 0x420]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], ebx
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x840]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.0040f640
lea eax, [esp + 0x20]
mov dword [esp + 4], 0x400
mov dword [esp], eax
call fcn.00408e00
mov dword [esp + 4], 0x400
mov dword [esp], ebx
call fcn.00408e00
mov eax, dword [esp + 0x840]
test byte [eax + 0x38], 4
je 0x40b63e
mov eax, dword [esp + 0x844]
mov edx, dword [eax]
test edx, edx
je 0x40b60f
mov eax, dword [eax + 0x10]
mov dword [esp + 0x14], eax
shl eax, 0xa
mov dword [esp + 4], eax
mov eax, dword [edx + 4]
mov dword [esp], eax
call fcn.00408e00
mov eax, dword [esp + 0x844]
mov eax, dword [eax + 4]
test eax, eax
je 0x40b648
mov ebx, dword [esp + 0x844]
mov ebx, dword [ebx + 0x14]
mov dword [esp], eax
lea edx, [ebx*8]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], edx
call fcn.00408e00
mov eax, dword [esp + 0x844]
mov eax, dword [eax + 4]
mov dword [esp], eax
call fcn.0045d1c8
mov eax, dword [esp + 0x844]
mov ebx, dword [eax]
mov dword [eax + 4], 0
test ebx, ebx
je 0x40b672
mov eax, dword [ebx]
test eax, eax
je 0x40b672
mov dword [esp], eax
call fcn.0045d1c8
mov dword [esp], ebx
call fcn.0045d1c8
mov eax, dword [esp + 0x844]
mov dword [eax], 0
add esp, 0x82c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41e9d0
Capabilities:
Hash data using sha256

Disassembly:
push edi
push ebx
sub esp, 0x44
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
lea ecx, [eax - 1]
cmp cl, 0x3f
ja 0x41ea91
mov byte [esp], al
lea ebx, [edx + 0x40]
xor eax, eax
mov ecx, 0x49
mov word [esp + 5], ax
mov edi, ebx
xor eax, eax
mov dword [edx + 8], 0x84caa73b
mov dword [edx + 0xc], 0xbb67ae85
mov dword [edx + 0x10], 0xfe94f82b
mov dword [edx + 0x14], 0x3c6ef372
mov dword [edx + 0x18], 0x5f1d36f1
mov dword [edx + 0x1c], 0xa54ff53a
mov dword [edx + 0x20], 0xade682d1
mov dword [edx + 0x24], 0x510e527f
mov dword [edx + 0x28], 0x2b3e6c1f
mov dword [edx + 0x2c], 0x9b05688c
mov dword [edx + 0x30], 0xfb41bd6b
mov dword [edx + 0x34], 0x1f83d9ab
mov dword [edx + 0x38], 0x137e2179
mov dword [edx + 0x3c], 0x5be0cd19
rep stosd dword es:[edi], eax
mov dword [esp + 1], 0x10100
mov ecx, dword [esp]
mov byte [esp + 7], 0
mov ebx, dword [esp + 4]
xor ecx, 0xf3bcc908
xor ebx, 0x6a09e667
mov byte [edi], 0
mov dword [edx], ecx
mov dword [edx + 4], ebx
add esp, 0x44
pop ebx
pop edi
ret
call fcn.00408b90
lea esi, [esi]
lea esi, [esi]
Function at 0x41eaa0
Capabilities:
Hash data using sha256

Disassembly:
push edi
push esi
push ebx
sub esp, 0x40
mov esi, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
lea edi, [esi - 1]
mov ebx, edi
cmp bl, 0x3f
ja 0x41ec45
mov ebx, esi
mov byte [esp + 1], 0
mov byte [esp], bl
mov ebx, 0x101
mov word [esp + 2], bx
mov dword [esp + 4], 0
test ecx, ecx
je 0x41ebf0
mov ebx, dword [ecx]
mov dword [esp + 0x20], ebx
mov ebx, dword [ecx + 4]
mov dword [esp + 0x24], ebx
mov ebx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ecx
test eax, eax
je 0x41ec20
mov ecx, dword [eax]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x34], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
lea ebx, [edx + 0x40]
xor eax, eax
mov ecx, 0x49
mov dword [edx + 8], 0x84caa73b
mov edi, ebx
mov dword [edx + 0xc], 0xbb67ae85
mov dword [edx + 0x10], 0xfe94f82b
mov ebx, dword [esp + 4]
mov dword [edx + 0x14], 0x3c6ef372
mov dword [edx + 0x18], 0x5f1d36f1
mov dword [edx + 0x1c], 0xa54ff53a
rep stosd dword es:[edi], eax
mov ecx, dword [esp]
xor ebx, 0x6a09e667
xor ecx, 0xf3bcc908
mov byte [edi], 0
mov dword [edx], ecx
mov ecx, dword [esp + 0x20]
mov dword [edx + 4], ebx
mov ebx, dword [esp + 0x24]
xor ecx, 0xade682d1
xor ebx, 0x510e527f
mov dword [edx + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov dword [edx + 0x24], ebx
mov ebx, dword [esp + 0x2c]
xor ecx, 0x2b3e6c1f
xor ebx, 0x9b05688c
mov dword [edx + 0x28], ecx
mov ecx, dword [esp + 0x30]
mov dword [edx + 0x2c], ebx
mov ebx, dword [esp + 0x34]
xor ecx, 0xfb41bd6b
xor ebx, 0x1f83d9ab
mov dword [edx + 0x30], ecx
mov ecx, dword [esp + 0x38]
mov dword [edx + 0x34], ebx
mov ebx, dword [esp + 0x3c]
xor ecx, 0x137e2179
xor ebx, 0x5be0cd19
mov dword [edx + 0x38], ecx
mov dword [edx + 0x3c], ebx
add esp, 0x40
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
test eax, eax
jne 0x41eb0b
lea esi, [esi]
nop
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
jmp 0x41eb26
call fcn.00408b90
lea esi, [esi]