joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ef34
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 0x10]
inc ebx
push edi
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
test edi, edi
je 0x41ef6e
mov dword [edi], edx
push ecx
push eax
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov esi, eax
cmp esi, 0xc0000034
jne 0x41ef9a
test byte [ebp + 8], 1
je 0x41efb0
push 2
pop ebx
test edi, edi
je 0x41ef8f
mov dword [edi], ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp esi, 0xc000017c
jne 0x41efac
test byte [ebp + 8], 2
je 0x41efb0
push 3
jmp 0x41ef88
test esi, esi
jns 0x41ef89
mov eax, dword [esp + 0x18]
cmp byte [eax], 0
je 0x41f066
mov ecx, dword [esp + 0x10]
mov eax, ecx
or eax, dword [esp + 0xc]
jne 0x41f048
mov edx, dword [0x7ffe0004]
mov eax, 0x7ffe0324
mov dword [esp + 0x10], edx
mov ecx, dword [eax]
add eax, 0xfffffffc
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov eax, 0x7ffe0328
mov eax, dword [eax]
cmp ecx, eax
je 0x41f014
mov edx, 0x7ffe0324
lea edi, [edx - 4]
lea ebx, [edx + 4]
pause
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [esp + 0x14], eax
mov eax, dword [ebx]
cmp ecx, eax
jne 0x41eff9
mov edi, dword [esp + 0x1c]
xor ebx, ebx
mov edx, dword [esp + 0x10]
inc ebx
mov eax, ecx
mul edx
mov ecx, eax
mov eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mul dword [esp + 0x10]
shl ecx, 8
shrd eax, edx, 0x18
shr edx, 0x18
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
jmp 0x41f04c
mov eax, dword [esp + 0xc]
push ecx
push eax
push ecx
mov ecx, dword [esp + 0x24]
push esi
call fcn.0041d2f3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
jmp 0x41ef6e
and dword [esp + 0x34], 0
lea ecx, [esp + 0x28]
push esi
mov dword [esp + 0x2c], 0x4044f4
mov dword [esp + 0x30], 0x404768
mov dword [esp + 0x34], 0x557
call fcn.00455c22
mov eax, esi
jmp 0x41ef91
Function at 0x420bcc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x45e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4019e0]
or dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], eax
mov eax, dword [0x4019e4]
mov dword [ebp - 0x18], eax
mov eax, dword [0x4019d8]
push ebx
mov dword [ebp - 0x14], eax
mov ebx, ecx
mov eax, dword [0x4019dc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push esi
push edi
mov dword [ebp - 0x30], eax
xor edi, edi
lea eax, [ebp - 0x38]
mov dword [ebp - 8], edi
push eax
push 0x20019
lea eax, [ebp - 0x20]
mov dword [ebp - 0x44], edi
push eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov esi, eax
test esi, esi
js 0x420ce1
lea eax, [ebp - 8]
push eax
push edi
push edi
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp esi, 0x80000005
je 0x420c7c
cmp esi, 0xc0000023
jne 0x420cab
lea edx, [ebp - 0x44]
mov ecx, eax
call fcn.00454ade
mov edi, dword [ebp - 0x3c]
mov esi, eax
test esi, esi
js 0x420ce1
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push edi
push 2
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
mov eax, dword [ebp - 0xc]
test esi, esi
js 0x420ce1
cmp eax, 0x10
jb 0x420cf7
test edi, edi
je 0x420d01
mov ecx, dword [edi + 8]
mov edx, ebx
call fcn.00454ade
mov esi, eax
test esi, esi
js 0x420ce1
push dword [edi + 8]
lea eax, [edi + 0xc]
push eax
push dword [ebx + 8]
call sub.ntdll.dll_memcpy
mov eax, dword [edi + 8]
add esp, 0xc
mov dword [ebx], eax
jmp 0x420cf7
mov eax, esi
cmp esi, 0xc0000034
je 0x420cf2
cmp eax, 0xc000003a
jne 0x420cf7
mov esi, 0xc015001a
test edi, edi
je 0x420d01
push edi
call fcn.0045879e
cmp dword [ebp - 0x20], 0xffffffff
je 0x420d10
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d1ae
leave
ret
Function at 0x42a21b
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 4], ebx
jbe 0x42a257
xor eax, eax
mov dword [ebp - 4], eax
mov esi, dword [edi + 8]
add esi, eax
lea ecx, [esi + 0x20]
call fcn.00423f6e
mov ecx, esi
call fcn.00429030
mov eax, dword [ebp - 4]
inc ebx
add eax, 0x88
mov dword [ebp - 4], eax
cmp ebx, dword [edi + 4]
jb 0x42a232
push dword [edi + 8]
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
and dword [edi + 8], 0
mov esi, dword [edi + 0xc]
test esi, esi
je 0x42a284
mov ecx, esi
call fcn.0042a21b
mov ecx, esi
call fcn.0041c046
and dword [edi + 0xc], 0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42b15b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x45e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], 0x18
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
push 4
push ebx
push ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], ebx
push eax
push 0x2001f
lea eax, [ebp - 8]
mov dword [ebp - 0x18], 0x40
push eax
mov edi, ecx
mov dword [ebp - 0x1c], 0x4019f4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ntdll.dll_NtCreateKey]
mov esi, eax
test esi, esi
jns 0x42b1c6
mov dword [ebp - 0x2c], 0x5d
mov dword [ebp - 0x28], 0x4078e0
jmp 0x42b1ee
push 0x10
push edi
push 3
push ebx
push 0x401a04
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov esi, eax
test esi, esi
jns 0x42b21f
mov dword [ebp - 0x2c], 0x66
mov dword [ebp - 0x28], 0x4079c8
push esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], 0x407870
mov dword [ebp - 0x30], 0x4078a4
call fcn.00455c22
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x42b21b
cmp ecx, 0xffffffff
je 0x42b21b
push ecx
mov dword [ebp - 8], ebx
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x42b237
mov eax, dword [ebp - 8]
test eax, eax
je 0x42b235
cmp eax, 0xffffffff
je 0x42b235
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d1ae
leave
ret
Function at 0x42ba23
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, 0x7ffe0030
mov ecx, esi
push edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ba37
sub ecx, edx
mov dword [ebp - 4], esi
sar ecx, 1
lea esi, [ebp - 0xc]
lea eax, [ecx + ecx]
mov dword [ebp - 0xc], eax
add eax, 2
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret 4

Function at 0x44cbaf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x45e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x5c], ecx
push esi
push edi
lea edi, [ebp - 0x18]
mov dword [ebp - 0x48], 0x18
stosd dword es:[edi], eax
xor edx, edx
mov dword [ebp - 0x1c], edx
mov bl, dl
mov dword [ebp - 0x20], edx
mov byte [ecx], dl
stosd dword es:[edi], eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x38], edx
stosd dword es:[edi], eax
mov dword [ebp - 0x34], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x401ed0]
mov dword [ebp - 0x30], eax
mov eax, dword [0x401ed4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x401ed8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x401edc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
push eax
push 0x20019
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov esi, eax
mov edi, 0xc0000034
cmp esi, edi
je 0x44cc64
test esi, esi
jns 0x44cc45
mov dword [ebp - 0x50], 0x2e
jmp 0x44cc73
lea eax, [ebp - 0x20]
push eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
cmp esi, edi
jne 0x44cc68
xor esi, esi
jmp 0x44cc91
test esi, esi
jns 0x44ccac
mov dword [ebp - 0x50], 0x3c
push esi
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], 0x412ac0
mov dword [ebp - 0x54], 0x412af4
mov dword [ebp - 0x4c], 0x407fb8
call fcn.00455c22
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x44cca8
cmp ecx, 0xffffffff
je 0x44cca8
and dword [ebp - 0x1c], 0
push ecx
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x44ccdd
cmp dword [ebp - 0x14], 4
je 0x44ccb8
cmp dword [ebp - 0x10], 4
jne 0x44ccbf
cmp dword [ebp - 0xc], 0
setne bl
mov eax, dword [ebp - 0x5c]
mov byte [eax], bl
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x44ccdb
cmp eax, 0xffffffff
je 0x44ccdb
and dword [ebp - 0x1c], 0
push eax
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d1ae
leave
ret
Function at 0x44f9bd
Capabilities:
Parse credit card information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
mov edi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebx + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 8], ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x14]
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ecx
mov eax, dword [ebx + 0x10]
cmp dword [ebx + 0x14], eax
jb 0x44fa07
mov dword [edi + 4], eax
mov dword [edi], 3
xor eax, eax
jmp 0x44faab
mov esi, dword [ebx + 0x18]
mov ecx, esi
call dword [0x46023c]
mov ecx, dword [ebp - 4]
jmp 0x44fa96
cmp ecx, 0x61
jb 0x44fa21
cmp ecx, 0x7a
jbe 0x44fa82
lea eax, [ecx - 0x41]
cmp eax, 0x19
jbe 0x44fa82
lea eax, [ecx - 0x30]
cmp eax, 9
jbe 0x44fa82
cmp ecx, 0x2f
ja 0x44fa64
cmp ecx, 0x28
jae 0x44fa82
cmp ecx, 0xa
je 0x44fa82
cmp ecx, 0xd
je 0x44fa82
cmp ecx, 0x1f
jbe 0x44fab0
cmp ecx, 0x21
jbe 0x44fa82
cmp ecx, 0x22
jbe 0x44fab0
cmp ecx, 0x25
jbe 0x44fa82
cmp ecx, 0x27
jne 0x44fab0
cmp dword [ebx + 0x24], 0xa
jmp 0x44fa80
cmp ecx, 0x3a
jb 0x44fab0
cmp ecx, 0x3b
jbe 0x44fa82
cmp ecx, 0x3d
je 0x44fa82
cmp ecx, 0x3e
jbe 0x44fab0
cmp ecx, 0x40
jbe 0x44fa82
cmp ecx, 0x5f
jne 0x44fab0
mov esi, dword [ebx + 0x18]
mov ecx, esi
inc dword [ebp - 8]
mov dword [ebp - 4], edx
call dword [0x46023c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call esi
mov ecx, eax
mov dword [ebp - 0x10], edx
cmp ecx, 0xffffffff
jne 0x44fa17
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 4]
mov dword [edi], 0xc
sub eax, dword [ebx + 0x14]
mov dword [edi + 8], eax
mov eax, dword [ebp - 8]
mov dword [edi + 0x10], eax
jmp 0x44fa00
Function at 0x4562fd
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x45e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ecx]
xor eax, eax
push esi
mov esi, dword [ecx + 8]
add ebx, esi
push edi
mov edi, edx
mov dword [ebp - 0x20c], eax
lea edx, [ebp - 0x208]
mov dword [ebp - 0x214], edi
xor ecx, ecx
mov dword [ebp - 0x21c], 0x200
mov dword [ebp - 0x220], ecx
mov eax, edx
mov dword [ebp - 0x218], eax
cmp esi, ebx
jae 0x4564d3
lea eax, [ebp - 8]
mov dword [ebp - 0x224], esi
sub eax, edx
and eax, 0xfffffffe
cmp eax, 8
jl 0x45646b
mov al, byte [esi]
inc esi
mov byte [ebp - 0x20d], cl
mov byte [ebp - 0x20e], cl
mov byte [ebp - 0x20f], al
cmp esi, ebx
je 0x456393
mov al, byte [esi]
mov byte [ebp - 0x20d], al
mov eax, ecx
push 2
pop ecx
jmp 0x456399
push 0x3d
xor ecx, ecx
pop eax
inc ecx
mov esi, dword [ebp - 0x224]
add esi, ecx
mov word [edx + 4], ax
cmp esi, ebx
je 0x4563b6
mov al, byte [esi]
inc esi
mov byte [ebp - 0x20e], al
xor eax, eax
jmp 0x4563b9
push 0x3d
pop eax
movzx ecx, byte [ebp - 0x20f]
movzx edi, byte [ebp - 0x20d]
mov word [edx + 6], ax
mov eax, ecx
shr eax, 2
and ecx, 3
shl ecx, 4
movzx eax, byte [eax + 0x415010]
mov word [edx], ax
mov eax, edi
shr eax, 4
or eax, ecx
movzx ecx, byte [ebp - 0x20e]
movzx eax, byte [eax + 0x415010]
mov word [edx + 2], ax
xor eax, eax
cmp word [edx + 4], ax
jne 0x45641b
and edi, 0xf
mov eax, ecx
shr eax, 6
shl edi, 2
or edi, eax
movzx eax, byte [edi + 0x415010]
mov word [edx + 4], ax
xor eax, eax
cmp word [edx + 6], ax
jne 0x45642f
and ecx, 0x3f
movzx eax, byte [ecx + 0x415010]
mov word [edx + 6], ax
mov edi, dword [ebp - 0x214]
lea eax, [ebp - 8]
add edx, 8
cmp edx, eax
jne 0x456460
push edi
push ecx
lea edx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x200
call fcn.0045846c
test eax, eax
js 0x4564d9
lea edx, [ebp - 0x208]
cmp esi, ebx
jae 0x45646b
xor ecx, ecx
jmp 0x456354
lea eax, [ebp - 0x208]
cmp edx, eax
je 0x4564d3
sub edx, eax
mov dword [ebp - 0x220], edx
cmp edx, dword [ebp - 0x21c]
jbe 0x4564c2
mov esi, 0xc000042b
mov dword [ebp - 0x234], 0x41482c
push esi
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x230], 0x414b40
mov dword [ebp - 0x22c], 0x4f5
mov dword [ebp - 0x228], 0x414b58
call fcn.00455c22
mov eax, esi
jmp 0x4564d9
push edi
push ecx
lea edx, [ebp - 0x220]
call fcn.0045846c
test eax, eax
js 0x4564d9
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d1ae
leave
ret
Function at 0x45c8d5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x45e040]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x45e538]
push ebx
push esi
push edi
xor edi, edi
mov esi, edx
mov ebx, ecx
test eax, eax
jne 0x45c941
lea edi, [esp + 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
call fcn.0045cd59
xor edi, edi
cmp dword [esp + 0x28], edi
je 0x45c933
push 0x10
push edi
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_wcstoul]
and eax, 0xfffe
add esp, 0xc
or eax, 1
mov dword [0x45e538], eax
lea ecx, [esp + 0x28]
call fcn.0041c15b
mov eax, dword [0x45e538]
or dword [ebx + 8], eax
lea eax, [esp + 0x34]
push esi
push eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
test al, al
je 0x45ca33
lea eax, [esp + 0x28]
mov dword [esp + 0x28], edi
push eax
lea edx, [esp + 0x38]
mov dword [esp + 0x30], edi
mov esi, edi
call fcn.0045ce42
cmp word [esp + 0x28], 0
je 0x45c997
push 0x10
push edi
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_wcstoul]
add esp, 0xc
mov esi, eax
jmp 0x45ca27
lea eax, [esp + 0xc]
mov dword [esp + 0x24], edi
push eax
push 0x101
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], 0x18
push eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x20], 0x402708
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jne 0x45ca0f
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], edi
push eax
push 0x14
lea eax, [esp + 0x48]
push eax
push 2
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x45ca0f
cmp dword [esp + 0x44], 4
jne 0x45ca0f
cmp dword [esp + 0x48], 4
jne 0x45ca0f
mov esi, dword [esp + 0x4c]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x45ca27
cmp eax, 0xffffffff
je 0x45ca27
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebx + 8], esi
lea ecx, [esp + 0x28]
call fcn.0041caca
lea ecx, [esp + 0x34]
call fcn.0041caca
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045d1ae
mov esp, ebp
pop ebp
ret
Function at 0x4024f0
Capabilities:
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x29a0
call fcn.004490b0
mov edi, dword [ebp + 0x4c]
mov ebx, dword [ebp + 0x1c]
xor eax, eax
test ebx, ebx
sete al
xor ecx, ecx
cmp dword [ebp + 0x50], 0
sete cl
lea eax, [eax + ecx*8]
xor ecx, ecx
test edi, edi
sete cl
shl ecx, 9
or eax, ecx
movd xmm0, dword [ebp + 0x48]
movd xmm1, dword [ebp + 0x34]
punpckldq xmm1, xmm0
movq xmm0, qword [ebp + 0x2c]
punpcklqdq xmm0, xmm1
movd xmm1, dword [ebp + 0x20]
movd xmm2, dword [ebp + 0x18]
punpckldq xmm2, xmm1
movq xmm1, qword [ebp + 0x24]
punpcklqdq xmm2, xmm1
pxor xmm1, xmm1
pcmpeqd xmm2, xmm1
pshufd xmm3, xmm2, 0xf6
pcmpeqd xmm0, xmm1
pshufd xmm1, xmm0, 0xf6
pshufd xmm0, xmm0, 0xd4
pshufd xmm2, xmm2, 0x50
movdqa xmm4, xmm2
pandn xmm4, xmmword [0x44d7c0]
pand xmm2, xmmword [0x44d7d0]
por xmm2, xmm4
pand xmm0, xmmword [0x44d7e0]
por xmm0, xmm2
pand xmm1, xmmword [0x44d7f0]
pand xmm3, xmmword [0x44d800]
por xmm3, xmm1
por xmm3, xmm0
pshufd xmm0, xmm3, 0xee
por xmm0, xmm3
movd ecx, xmm0
or eax, ecx
pshufd xmm0, xmm0, 0x55
movd ecx, xmm0
tzcnt ecx, ecx
add ecx, 0x20
tzcnt esi, eax
test eax, eax
cmovne ecx, esi
cmp ecx, 0xa
call fcn.004025e2

Function at 0x4113f0
Capabilities:
Encode data using base64
Encrypt data using chaskey
Encrypt data using rc4 ksa
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x28e0
call fcn.004490b0
mov esi, esp
xor ecx, ecx
cmp dword [ebp + 0x50], 0
sete cl
xor eax, eax
cmp dword [ebp + 0x68], 0
sete al
shl eax, 0xa
or eax, ecx
movd xmm0, dword [ebp + 0x18]
movd xmm2, dword [ebp + 0x1c]
punpckldq xmm2, xmm0
movq xmm0, qword [ebp + 0x20]
punpcklqdq xmm2, xmm0
movd xmm0, dword [ebp + 0x54]
movd xmm3, dword [ebp + 0x4c]
punpckldq xmm3, xmm0
movq xmm1, qword [ebp + 0x44]
punpcklqdq xmm1, xmm3
movdqu xmm3, xmmword [ebp + 0x58]
movdqu xmm4, xmmword [ebp + 0x28]
pxor xmm5, xmm5
pcmpeqd xmm4, xmm5
pcmpeqd xmm3, xmm5
pcmpeqd xmm1, xmm5
pshufd xmm0, xmm4, 0xf6
pcmpeqd xmm2, xmm5
pshufd xmm5, xmm2, 0xf6
pshufd xmm2, xmm2, 0x50
movdqa xmm6, xmm2
pandn xmm6, xmmword [0x44ee00]
pand xmm2, xmmword [0x44ee10]
por xmm2, xmm6
pshufd xmm6, xmm1, 0xf6
pand xmm6, xmmword [0x44ee20]
pand xmm5, xmmword [0x44ee30]
por xmm5, xmm6
pshufd xmm6, xmm3, 0xf6
pand xmm6, xmmword [0x44ee40]
pand xmm0, xmmword [0x44ee50]
por xmm0, xmm6
por xmm0, xmm5
pshufd xmm4, xmm4, 0xd4
pshufd xmm3, xmm3, 0xd4
pand xmm3, xmmword [0x44ee70]
pand xmm4, xmmword [0x44ee80]
por xmm4, xmm3
pshufd xmm1, xmm1, 0xd4
pand xmm1, xmmword [0x44ee60]
por xmm4, xmm1
por xmm4, xmm2
por xmm4, xmm0
pshufd xmm0, xmm4, 0xee
por xmm0, xmm4
movd ecx, xmm0
or ecx, eax
pshufd xmm0, xmm0, 0x55
movd eax, xmm0
tzcnt eax, eax
add eax, 0x20
tzcnt edx, ecx
test ecx, ecx
cmovne eax, edx
cmp eax, 0x11
call fcn.0041152c
Function at 0x42c880
Capabilities:
Query environment variable

Disassembly:
push str.HL_NUM_THREADS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
jne 0x42c8a6
push str.HL_NUMTHREADS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x42c930
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
add esp, 4
ret
push str.NUMBER_OF_PROCESSORS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x42c94b
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
add esp, 4
ret
mov eax, 8
ret

Function at 0x42c8e0
Capabilities:
Create thread

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push 0xc
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
mov dword [eax], ebx
mov dword [eax + 4], edi
push 0
push 0
push eax
push 0x42c920
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [esi + 8], eax
mov eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x42d700
Capabilities:
Query environment variable
Reference absolute stream path on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
nop dword [eax + eax]
mov al, 1
xchg byte [0x461c5c], al
test al, al
jne 0x42d710
cmp dword [0x45dff8], 0
js 0x42d735
mov eax, dword [0x45dff8]
mov byte [0x461c5c], 0
pop esi
pop edi
pop ebp
ret
push str.HL_TRACE_FILE
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x42d7bc
push 0x4514a9
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
add esp, 8
mov esi, eax
test eax, eax
jne 0x42d76d
push str.C:_build_botworkerhalide_nightly_release_17_x86_32_windows_cmakehalide_source_src_runtime_tracing.cpp:371_halide_abort_if_false___failed:_file___Failed_to_open_trace_file_n__n
push edi
call fcn.0042b270
add esp, 8
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
add esp, 4
push eax
call fcn.0042d7d0
add esp, 4
mov dword [0x461c60], esi
cmp dword [0x461c58], 0
jne 0x42d725
push 0x10000c
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [0x461c58], eax
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax], 0
mfence
jmp 0x42d725
push 0
call fcn.0042d7d0
add esp, 4
jmp 0x42d725

Function at 0x434ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a58d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45e064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0xd], 0
push str.Calling_get_on_an_empty_PerfectHashMap
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov dword [ebp - 4], 0
call fcn.0042f6a0
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x437640
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x43769d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x437660
mov eax, dword [esi]
jmp 0x437777
cmp eax, 0x4e0
jb 0x437777
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x4376b6
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
nop
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x437700
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret