joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410e81
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x419c68
cmp edx, dword [eax]
je 0x410ea3
add eax, 8
inc ecx
cmp eax, 0x419cf8
jl 0x410e94
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x419c68]
jne 0x410fd1
mov eax, dword [0x41be04]
cmp eax, 1
je 0x410fab
test eax, eax
jne 0x410ed4
cmp dword [0x419914], 1
je 0x410fab
cmp edx, 0xfc
je 0x410fd1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x410f0b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040ebe0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00411ba0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x410f4e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00411ba0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4171b4
push edi
call fcn.00413930
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040ebe0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040ebf0
lea eax, [ebp - 0xa0]
push 0x417194
push eax
call fcn.0040ebf0
push dword [esi + 0x419c6c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040ebf0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041389b
add esp, 0x2c
pop edi
jmp 0x410fd1
lea eax, [ebp + 8]
lea esi, [esi + 0x419c6c]
push 0
push eax
push dword [esi]
call fcn.00411ba0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x406de3
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x469e60]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x406ded
mov ebp, dword [esp + 0x14]
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [esp + 0x18]
movzx eax, byte [edx + ebp]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x406e33
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x406e12
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x406e52
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x400
lea eax, [esp]
push ebx
push esi
push edi
push 0x400
push ecx
xor esi, esi
push eax
mov edi, esi
call fcn.004352b0
mov edx, dword [esp + 0x420]
add esp, 0xc
mov ebx, esi
add edx, 1
je 0x406ee2
push ebp
mov ebp, dword [esp + 0x414]
inc esi
and esi, 0x800000ff
jns 0x406e98
dec esi
or esi, 0xffffff00
inc esi
mov eax, dword [esp + esi*4 + 0x10]
add edi, eax
and edi, 0x800000ff
jns 0x406eae
dec edi
or edi, 0xffffff00
inc edi
mov cl, al
mov eax, dword [esp + edi*4 + 0x10]
mov dword [esp + esi*4 + 0x10], eax
movzx eax, cl
mov dword [esp + edi*4 + 0x10], eax
mov ecx, dword [esp + esi*4 + 0x10]
add ecx, eax
and ecx, 0x800000ff
jns 0x406ed5
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [esp + ecx*4 + 0x10]
xor byte [ebx + ebp], al
inc ebx
cmp ebx, edx
jb 0x406e87
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x400
ret 8
Function at 0x40ff0b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x410042
cmp byte [edi + 0x3d], bl
je 0x410042
call fcn.00403a7d
mov esi, eax
mov ecx, edi
mov eax, dword [edi]
push esi
call dword [eax + 0xc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
push eax
call fcn.0040d525
pop ecx
pop ecx
test al, al
je 0x40ff61
xor al, al
jmp 0x410044
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.00405dec
lea ebp, [edi + 0x40]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
call fcn.0040309c
mov ecx, eax
call fcn.00403f7b
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.0040305c
add esi, eax
lea ecx, [esp + 0x2c]
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.0040309c
mov ecx, eax
call fcn.00403f7b
mov ecx, dword [edi + 0x38]
push eax
push ebp
call fcn.0040d8ac
sub eax, ebx
je 0x40ffc9
sub eax, 1
je 0x40ffcc
dec eax
sub eax, 1
jne 0x410035
inc eax
jmp 0x410033
mov byte [edi + 0x3d], bl
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
call fcn.0040309c
mov ecx, eax
call fcn.00403f7b
mov esi, dword [esp + 0x1c]
sub esi, eax
je 0x410011
push dword [edi + 0x4c]
lea eax, [esp + 0x28]
push esi
push 1
push eax
lea ecx, [esp + 0x38]
call fcn.0040309c
mov ecx, eax
call fcn.00403f7b
push eax
call fcn.0043b8c0
add esp, 0x10
cmp esi, eax
jne 0x410031
cmp byte [edi + 0x3d], bl
je 0x41002f
test esi, esi
jne 0x40ff70
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.00403631
jmp 0x40ff70
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [esp + 0x28]
call fcn.00402bb8
mov al, bl
jmp 0x410044
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410fb4
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov esi, dword [ebx]
mov edx, dword [ebx + 0x3c]
movzx ebp, word [esi + 0x14]
add ebp, esi
mov eax, dword [ebp + 0x20]
mov ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
call fcn.00410deb
lea edx, [ebp + 0x18]
mov dword [esp + 0x28], eax
mov ecx, ebx
call fcn.00410ef8
mov ebx, dword [ebp + 0x3c]
mov edi, eax
and dword [esp + 0x34], 0
xor eax, eax
inc eax
mov dword [esp + 0x2c], edi
add ebp, 0x40
mov dword [esp + 0x30], ebx
cmp ax, word [esi + 6]
mov esi, ecx
mov dword [esp + 0x20], eax
jae 0x4110c6
mov eax, dword [ebp + 8]
mov ecx, eax
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x1c], eax
call fcn.00410deb
mov edx, ebp
mov dword [esp + 0x14], eax
mov ecx, esi
call fcn.00410ef8
mov edx, dword [esp + 0x10]
mov ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x28], eax
je 0x41107d
lea ecx, [edi + edx]
cmp ecx, eax
ja 0x411079
lea edx, [esp + 0x24]
mov ecx, esi
call fcn.00410f17
test eax, eax
je 0x4110e3
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebx, dword [ebp + 0x24]
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
jmp 0x4110a1
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0x24]
mov edi, 0x2000000
test edi, eax
je 0x411091
test edi, ebx
je 0x411091
or ebx, eax
jmp 0x411099
or ebx, eax
and ebx, 0xfdffffff
mov edi, ecx
sub edi, edx
add edi, dword [esp + 0x1c]
mov eax, dword [esi]
add ebp, 0x28
mov ecx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edi
movzx eax, word [eax + 6]
mov dword [esp + 0x20], ecx
cmp ecx, eax
jl 0x411010
xor eax, eax
inc eax
lea edx, [esp + 0x24]
mov dword [esp + 0x34], eax
mov ecx, esi
call fcn.00410f17
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor eax, eax
jmp 0x4110db
Function at 0x4209d8
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [ecx + 4]
xor eax, eax
xor edx, edx
movzx ecx, word [esi]
cmp ax, cx
jae 0x420a03
movzx eax, dx
mov al, byte [eax + esi + 4]
cmp al, 0x13
je 0x420a03
cmp al, 0xc0
je 0x420a03
cmp al, 0xcc
je 0x420a03
add edx, 2
cmp dx, cx
jb 0x4209e8
pop esi
ret

Function at 0x4234b2
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
mov edx, dword [esp + 0x10]
lea esi, [edi + 4]
push esi
call fcn.0042344f
mov edx, dword [esp + 0x10]
pop ecx
push 4
sub edx, edi
pop ecx
mov al, byte [edx + edi]
mov byte [edi], al
inc edi
sub ecx, 1
jne 0x4234cd
push 8
pop ecx
mov al, byte [esi + edx]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x4234db
pop edi
pop esi
ret

Function at 0x425736
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x42574e
sub edx, ecx
mov eax, dword [edx + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub esi, 1
jne 0x425741
pop esi
ret

Function at 0x425750
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
or eax, edx
push esi
mov esi, dword [esp + 8]
or eax, esi
test al, 3
jne 0x42576b
shr esi, 2
push esi
call fcn.00425736
pop ecx
pop esi
ret
test esi, esi
je 0x42577c
sub edx, ecx
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x425771
pop esi
ret

Function at 0x42577e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov esi, edx
mov ebx, ecx
test edi, edi
jle 0x4257a2
sub ebx, esi
movzx edx, byte [ebx + esi]
movzx ecx, byte [esi]
xor edx, ecx
or eax, edx
inc esi
sub edi, 1
jne 0x425791
pop edi
pop esi
pop ebx
ret

Function at 0x4257a6
Capabilities:
Encrypt data using aes

Disassembly:
xor eax, eax
mov ecx, 0x465450
push 0x20
pop edx
and eax, dword [ecx]
add ecx, 0x20
sub edx, 1
jne 0x4257b0
cmp ecx, 0x466450
jl 0x4257ad
ret
Function at 0x42a20d
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [edx + 0x3f]
push esi
shr eax, 6
mov esi, edx
sub esi, eax
mov dword [esp + 0x10], edx
push edi
xor edi, edi
mov ebx, ecx
and dword [esp + 0x18], edi
inc esi
imul eax, esi, 3
shr eax, 2
cmp eax, dword [ebp]
jbe 0x42a244
mov eax, 0xffffff53
jmp 0x42a417
mov esi, dword [esp + 0x20]
cmp edx, 3
jbe 0x42a405
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
lea edx, [esp + 0x18]
call fcn.0042a1af
add esp, 4
test eax, eax
jne 0x42a3fe
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
mov byte [esp + 0x13], cl
mov dword [esp + 0x18], eax
test cl, cl
je 0x42a405
dec dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.0042a1af
add esp, 4
test eax, eax
jne 0x42a417
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x12], cl
mov ecx, ebx
push eax
call fcn.0042a1af
add esp, 4
test eax, eax
jne 0x42a417
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x24], cl
mov ecx, ebx
push eax
call fcn.0042a1af
add esp, 4
test eax, eax
jne 0x42a417
mov eax, dword [esp + 0x18]
mov dl, byte [esp + 0x13]
mov dh, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
cmp dl, 0x2b
jb 0x42a3f7
mov cl, byte [esp + 0x12]
cmp cl, 0x2b
jb 0x42a3f7
mov al, byte [esp + 0x24]
cmp al, 0x2b
jb 0x42a3f7
cmp dh, 0x2b
jb 0x42a3f7
cmp dl, 0x7a
ja 0x42a3f7
cmp cl, 0x7a
ja 0x42a3f7
cmp al, 0x7a
ja 0x42a3f7
cmp dh, 0x7a
ja 0x42a3f7
xor ecx, ecx
cmp al, 0x3d
setne cl
xor eax, eax
inc ecx
cmp dh, 0x3d
setne al
add ecx, edi
add eax, ecx
cmp eax, dword [ebp]
ja 0x42a23a
mov cl, byte [esp + 0x12]
movzx eax, dl
mov al, byte [eax + 0x466595]
mov byte [esp + 0x13], al
movzx eax, cl
mov ch, byte [eax + 0x466595]
mov al, byte [esp + 0x24]
cmp al, 0x3d
jne 0x42a39a
xor cl, cl
jmp 0x42a3a3
movzx eax, al
mov cl, byte [eax + 0x466595]
cmp dh, 0x3d
jne 0x42a3ac
xor al, al
jmp 0x42a3b5
movzx eax, dh
mov al, byte [eax + 0x466595]
mov ah, byte [esp + 0x13]
mov dl, cl
shl dl, 6
or dl, al
shl ah, 2
mov al, ch
shr al, 4
or al, ah
mov byte [edi + esi], al
inc edi
cmp byte [esp + 0x24], 0x3d
je 0x42a3e1
shr cl, 2
shl ch, 4
or cl, ch
mov byte [edi + esi], cl
inc edi
cmp dh, 0x3d
je 0x42a405
mov byte [edi + esi], dl
inc edi
cmp dword [esp + 0x14], 3
ja 0x42a251
jmp 0x42a405
mov eax, 0xffffff66
jmp 0x42a417
cmp eax, 0xffffff7c
jne 0x42a417
test esi, esi
je 0x42a412
cmp dword [ebp], edi
jbe 0x42a412
mov byte [edi + esi], 0
mov dword [ebp], edi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x42db13
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x42dc0d
cmp dword [esp + 0x14], 0
mov esi, dword [esp + 0x18]
jne 0x42db34
test esi, esi
jne 0x42dc0d
cmp edx, 3
je 0x42db6a
cmp edx, 4
je 0x42db6a
cmp edx, 5
je 0x42db6a
cmp edx, 6
je 0x42db6a
cmp edx, 7
je 0x42db6a
cmp edx, 8
je 0x42db6a
cmp edx, 0xa
je 0x42db6a
cmp edx, 0xb
je 0x42db6a
cmp edx, 0xc
je 0x42db6a
cmp edx, 0xd
jne 0x42dc0d
xor ebx, ebx
mov byte [edi + 0x114], dl
push ecx
mov byte [edi + 0x115], bl
call fcn.0042daf6
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x42dc12
cmp byte [edi + 0x114], 6
lea ecx, [edi + 0x70]
jne 0x42dc0d
cmp esi, 0x40
ja 0x42dbb0
cmp dword [esp + 0x14], ebx
je 0x42dbd9
push esi
push dword [esp + 0x18]
push ecx
call fcn.004352b0
add esp, 0xc
jmp 0x42dbd6
mov edx, dword [esp + 0x14]
mov ecx, edi
push esi
call fcn.004329f5
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x42dc09
lea edx, [edi + 0x70]
mov ecx, edi
call fcn.00432ad0
mov ebp, eax
test ebp, ebp
jne 0x42dc09
push 0x20
pop esi
lea ecx, [edi + 0x70]
cmp esi, 0x40
jae 0x42dbf1
push 0x40
pop eax
sub eax, esi
push eax
lea eax, [ecx + esi]
push ebx
push eax
call fcn.00435830
add esp, 0xc
mov al, byte [ebx + edi + 0x70]
xor al, 0x5c
mov byte [edi + ebx + 0xb0], al
xor byte [ebx + edi + 0x70], 0x36
inc ebx
cmp ebx, 0x40
jb 0x42dbf1
mov eax, ebp
jmp 0x42dc12
mov eax, 0xffffff53
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x431a91
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd4
push ebx
push ebp
push esi
xor ebx, ebx
xor esi, esi
push edi
inc ebx
inc esi
cmp dword [esp + 0xe8], 0
mov edi, ecx
push 0
cmovne ebx, dword [esp + 0xec]
mov ebp, edx
pop ecx
test bl, 0x1f
mov eax, ebx
push 0x37
push dword [esp + 0xf0]
setne cl
shr eax, 5
add eax, ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x44]
push eax
call fcn.004352b0
and dword [esp + 0x20], 0
add esp, 0xc
cmp dword [esp + 0x10], 0
jbe 0x431bcf
lea ecx, [esp + 0x74]
call fcn.00432b0f
mov esi, eax
test esi, esi
jne 0x431bcf
push 0x37
lea edx, [esp + 0x40]
lea ecx, [esp + 0x78]
call fcn.004329f5
mov esi, eax
pop ecx
test esi, esi
jne 0x431bcf
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x74]
call fcn.00432ad0
mov esi, eax
test esi, esi
jne 0x431bcf
push 4
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004352b0
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [edi], 1
jbe 0x431b7a
cmp eax, dword [edi + 4]
jne 0x431b7a
cmp byte [edi + 0x76], 1
je 0x431bed
mov edx, dword [esp + 0x10]
mov byte [edi + 0x76], 1
lea eax, [edx - 1]
cmp dword [esp + 0x14], eax
lea ecx, [edx + 1]
cmovne ecx, edx
mov dword [esp + 0x10], ecx
jmp 0x431b81
mov byte [edi + 0x76], 0
mov dword [edi + 4], eax
test ebp, ebp
je 0x431bbc
test ebx, ebx
je 0x431bbc
lea eax, [esp + 0x1c]
cmp ebx, 0x20
jb 0x431baf
push 0x20
push eax
push ebp
call fcn.004352b0
add esp, 0xc
lea ecx, [esp + 0x3c]
sub ebx, 0x20
add ebp, 0x20
call fcn.00431a82
jmp 0x431bbc
push ebx
push eax
push ebp
call fcn.004352b0
add esp, 0xc
xor ebx, ebx
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x10]
jl 0x431aef
push 0x37
pop edx
lea ecx, [esp + 0x3c]
call fcn.0041c043
xor eax, eax
test esi, esi
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret
push 3
pop eax
jmp 0x431be2

Function at 0x4322e9
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x432295
mov eax, 0xffffff53
pop esi
ret
push edi
push 0x20
xor edi, edi
push edi
push esi
call fcn.00435830
add esp, 0xc
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
xor eax, eax
mov dword [esi + 0x68], edi
mov dword [esi], 0x6a09e667
pop edi
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
ret
test ecx, ecx
jne 0x4322f3
mov eax, 0xffffff53
ret
mov dword [ecx + 0x6c], edx
jmp 0x432287
Function at 0x432a14
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x432a22
mov eax, 0xffffff53
pop ebx
ret
mov eax, dword [ebx + 0x60]
push ebp
push esi
push edi
push 0x40
pop edi
lea ebp, [ebx + 0x20]
mov byte [eax + ebp], 0x80
inc dword [ebx + 0x60]
mov ecx, dword [ebx + 0x60]
push 0x38
pop esi
cmp ecx, esi
jbe 0x432a6f
mov eax, edi
sub eax, ecx
push eax
lea eax, [ecx + ebp]
push 0
push eax
call fcn.00435830
push edi
mov edx, ebp
mov dword [ebx + 0x60], edi
mov ecx, ebp
call fcn.0043225d
add esp, 0x10
mov edx, ebp
mov ecx, ebx
call fcn.004322fb
test eax, eax
jne 0x432acb
and dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x60]
sub esi, eax
push esi
add eax, ebp
push 0
push eax
call fcn.00435830
lea edi, [ebx + 0x64]
mov edx, ebp
mov ecx, dword [edi]
lea esi, [ebx + 0x68]
mov eax, dword [esi]
shr ecx, 0x1d
push 0x40
lea eax, [ecx + eax*8]
mov ecx, ebp
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 3
mov dword [edi], eax
call fcn.0043225d
push 4
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.004352b0
push 4
lea eax, [ebp + 0x3c]
push edi
push eax
call fcn.004352b0
add esp, 0x28
mov edx, ebp
mov ecx, ebx
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.004322fb
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x432ad0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x432b07
test edi, edi
je 0x432b07
call fcn.00432a14
test eax, eax
jne 0x432b0c
push 0x20
mov edx, esi
mov ecx, esi
call fcn.0043225d
push 0x20
push esi
push edi
call fcn.004352b0
add esp, 0x10
mov ecx, esi
pop edi
pop esi
jmp 0x432287
mov eax, 0xffffff53
pop edi
pop esi
ret

Function at 0x432bbf
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov eax, edx
mov ebp, ecx
neg eax
mov dword [esp + 8], eax
test ebp, ebp
je 0x432c59
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x432c59
mov edx, dword [ebp]
mov ecx, ebx
inc edx
call fcn.0042e2a2
mov dword [esp + 0xc], eax
test eax, eax
jne 0x432c5e
xor edx, edx
push esi
push edi
cmp dword [ebp], edx
jle 0x432c1f
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00432ba9
mov ecx, ebx
mov esi, eax
call fcn.00432ba9
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebp]
jl 0x432bf9
jmp 0x432c44
mov ecx, dword [esp + 0x10]
jmp 0x432c44
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00432ba9
mov ecx, ebx
mov esi, eax
call fcn.00432ba9
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebx]
jl 0x432c25
mov eax, dword [ebp]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
jmp 0x432c5e
mov eax, 0xffffff53
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x4490bf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00448f3e
Function at 0x4046cb
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437bbb
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4047ee
push ecx
lea ecx, [esi + 0x18]
call fcn.00423eeb
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404805
push ecx
lea ecx, [esi + 0x24]
call fcn.00423dfb
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44a210
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
mov dword [esi], 0
call ebx
test ax, ax
jge 0x44a23b
or dword [esi], 0x2000000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a258
or dword [esi], 0x4000000
test edi, edi
je 0x44a26e
mov ecx, dword [0x657a4c]
push 0x657768
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a27d
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x46de5b
Capabilities:
Encode data using xor

Disassembly:
push cs
popal
jp 0x46de74
retf 0x4dc4
sti
mov edx, 0x1493e3fd
invalid
Function at 0x496dcb
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca2bb
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496eee
push ecx
lea ecx, [esi + 0x18]
call fcn.004b65eb
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496f05
push ecx
lea ecx, [esi + 0x24]
call fcn.004b64fb
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c0efb
Capabilities:
Encode data using xor

Disassembly:
ret 0x9c7c
mov dword [0x89e97652], eax
insb byte es:[edi], dx
adc byte [esi + 0x5f], 0x56
push esi
pop edi
push esi
or edi, dword [edx]
in al, dx
movsb byte es:[edi], byte [esi]
xor eax, 0x80b6cf69
dec edi
ja 0x4c0f02
jle 0x4c0eba
pop ds
retf 0x5ae6