joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a004
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov esi, ecx
call fcn.00403fa8
push eax
lea ecx, [ebp - 4]
call fcn.00404df3
push str.430FD4D0_B729_4F61_AA34_91526481799D
lea ecx, [ebp - 8]
call fcn.00404b61
mov cl, byte [esi]
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
call fcn.00414d2a
pop ecx
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.00403f90
lea ecx, [ebp - 4]
call fcn.0040d642
cmp edx, 0x10003
ja 0x41a064
jb 0x41a05a
test eax, eax
jae 0x41a064
mov ebx, 0x80004001
jmp 0x41a156
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.00408311
call fcn.00403fa8
push eax
lea ecx, [ebp + 8]
call fcn.00404df3
lea edx, [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.00408c72
push 0x1e
lea ecx, [ebp - 0x3c]
call fcn.0041a8d6
mov edi, dword [ebp + 8]
lea ecx, [ebp + 8]
mov edx, edi
push dword [edi - 0xc]
call fcn.00408433
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00404b09
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00403f90
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0041a9d1
mov cl, byte [esi]
lea eax, [ebp + 8]
and dword [ebp + 8], 0
push eax
push dword [ebp - 8]
call fcn.00413dbb
mov esi, dword [ebp + 8]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
js 0x41a125
cmp dword [ebp + 0xc], 0
je 0x41a123
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [ebp + 0xc], 0
test eax, eax
jne 0x41a10c
lea eax, [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x41a11c
mov ebx, dword [ebp + 0xc]
jmp 0x41a125
cmp eax, 0x102
jne 0x41a11c
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x80004005
jmp 0x41a125
xor ebx, ebx
test esi, esi
je 0x41a130
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.00403f90
lea ecx, [ebp - 0x3c]
call fcn.0041a96e
lea ecx, [edi - 0x10]
call fcn.00403f90
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.00403f90
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00403f90
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x41b58c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0x13]
mov byte [esp + 0x13], 0
push eax
push 0x41b651
mov edi, ecx
call dword [sym.imp.USER32.dll_EnumWindows]
call fcn.00403fa8
push eax
lea ecx, [esp + 0x18]
call fcn.00404df3
push dword [ebp + 0xc]
lea eax, [esp + 0x18]
push dword [ebp + 8]
push str._s_s.dmp
push eax
call fcn.00410ae2
lea ecx, [esp + 0x24]
call fcn.004123d5
mov bl, byte [esp + 0x23]
lea eax, [esp + 0x24]
mov dl, byte [edi]
add esp, 0xc
mov cl, bl
push eax
call fcn.0041ef34
cmp byte [edi + 1], 0
pop ecx
pop ecx
je 0x41b63c
push dword [ebp + 0xc]
lea eax, [esp + 0x18]
push dword [ebp + 8]
push str._s_s_full.dmp
push eax
call fcn.00410ae2
add esp, 0x10
lea ecx, [esp + 0x14]
call fcn.004123d5
mov esi, dword [esp + 0x14]
mov ecx, esi
call fcn.00404187
test al, al
je 0x41b640
mov dl, byte [edi]
lea eax, [esp + 0x14]
push ecx
push eax
mov cl, bl
call fcn.0041ef34
pop ecx
pop ecx
jmp 0x41b640
mov esi, dword [esp + 0x14]
lea ecx, [esi - 0x10]
call fcn.00403f90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41ede1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
mov ebx, ecx
movzx ecx, byte [0x558e46]
neg ecx
mov dword [ebp - 0xc], ebx
push esi
sbb ecx, ecx
push edi
and ecx, 0x557fc0
je 0x41ee30
or dword [ebp - 0x1c], 0xffffffff
push 7
pop eax
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
call fcn.0040b7e8
push dword [ebx]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push str._StartProcessWithNoExceptionHandler___s_
push eax
call fcn.004041cc
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.0040742b
push 0x53d85c
lea ecx, [ebp - 8]
call fcn.00404b61
push 0x53d718
lea ecx, [ebp - 4]
call fcn.00404b61
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
call fcn.004867a3
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00403f90
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.00403f90
xor esi, esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call fcn.00486a0a
mov ebx, dword [ebp - 0x20]
test al, al
je 0x41eef4
cmp ebx, dword [ebp - 0x1c]
je 0x41eef4
push 0x40
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], 0x44
push esi
push eax
call fcn.004e5020
mov ecx, dword [ebp - 0xc]
lea edi, [ebp - 0x34]
xor eax, eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004099b6
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push esi
push ebx
push 0x400
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41eef4
push dword [ebp - 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
xor esi, esi
jmp 0x41eefb
call fcn.00410c11
mov esi, eax
test ebx, ebx
je 0x41ef10
mov ecx, dword [ebp - 0x18]
sub ecx, ebx
and ecx, 0xfffffffe
push ecx
push ebx
call fcn.00407713
pop ecx
pop ecx
mov eax, dword [ebp - 0x14]
push dword [eax + 4]
lea eax, [ebp - 0x14]
push eax
mov ecx, eax
call fcn.00407864
push 0x18
push dword [ebp - 0x14]
call fcn.00407713
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x41efa3
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x41efb3
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x41efb9
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x41efe1
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x514970]
test ax, ax
jne 0x41efc8
mov esi, ecx
jmp 0x41efe4
movzx esi, si
pop edi
cmp cx, si
je 0x41f001
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x514970]
test cx, cx
jne 0x41efe5
mov eax, 0x512ce8
jmp 0x41f009
imul eax, edx, 0x1a
add eax, 0x514972
push eax
mov ecx, ebx
call fcn.00404b61
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x427270
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40228
call fcn.004fdd60
mov eax, dword [0x551008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x40218]
push edi
xor ebx, ebx
mov dword [ebp - 0x40214], 1
push ebx
push eax
mov edi, ecx
lea eax, [ebp - 0x4020c]
push 0x200
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x427488
cmp dword [ebp - 0x40218], 0x200
jne 0x427488
push 4
lea eax, [ebp - 0x4010b]
push 0x515c7c
push eax
call fcn.004fed3d
add esp, 0xc
test eax, eax
jne 0x4272f2
inc eax
mov byte [esi], al
jmp 0x42748a
push 5
lea eax, [ebp - 0x4010b]
push str.ustar
push eax
call fcn.004fed3d
add esp, 0xc
test eax, eax
jne 0x427488
mov ecx, dword [edi]
sub ecx, 0x10
call fcn.00404e70
add eax, 0x10
lea ecx, [ebp - 0x40210]
push 0x53f3b4
mov dword [ebp - 0x40210], eax
call fcn.00417850
lea eax, [ebp - 0x4020c]
push eax
lea ecx, [ebp - 0x40210]
call fcn.00417850
mov esi, dword [ebp - 0x40210]
push ebx
push 0x100
push 2
push ebx
push ebx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40224], eax
cmp eax, 0xffffffff
je 0x42747c
push 8
lea eax, [ebp - 0x40190]
push ebx
push eax
call fcn.0050035d
add esp, 0xc
mov dword [ebp - 0x40220], eax
push 1
push ebx
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp - 0x40220]
mov ecx, edx
neg ecx
add eax, edx
and ecx, 0x1ff
add ecx, eax
mov dword [ebp - 0x40228], ecx
test edx, edx
je 0x427428
mov eax, 0x40000
mov dword [ebp - 0x4021c], eax
cmp edx, eax
jae 0x4273ca
mov eax, edx
mov dword [ebp - 0x4021c], edx
push ebx
lea ecx, [ebp - 0x40218]
push ecx
push eax
lea eax, [ebp - 0x4000c]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x427422
push ebx
lea eax, [ebp - 0x40218]
push eax
push dword [ebp - 0x4021c]
lea eax, [ebp - 0x4000c]
push eax
push dword [ebp - 0x40224]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x427422
mov edx, dword [ebp - 0x40220]
sub edx, dword [ebp - 0x4021c]
mov dword [ebp - 0x40220], edx
jne 0x4273b3
jmp 0x427428
mov byte [ebp - 0x40214], bl
push dword [ebp - 0x40224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x40214], bl
je 0x42745f
cmp byte [edi + 8], bl
je 0x427450
lea eax, [ebp - 0x40210]
push eax
lea ecx, [edi + 0xc]
call fcn.004274c0
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42745f
push esi
push dword [edi + 0x1c]
call eax
pop ecx
pop ecx
mov eax, dword [ebp - 0x40228]
cmp eax, 0xffffffff
je 0x427476
push ebx
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov bl, byte [ebp - 0x40214]
lea ecx, [esi - 0x10]
call fcn.00403f90
mov al, bl
jmp 0x42748a
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e302f
leave
ret 4
Function at 0x42b6b7
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
xor edx, edx
push edi
xor edi, edi
push edi
mov eax, dword [ebx + 0x88]
push 0x80
cmp dword [eax + 0x30], edi
setne dl
lea edx, [edx*2 + 2]
push edx
push edi
push edi
push 0x40000000
push dword [ebx + 0x48]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x42b76f
mov eax, dword [ebx + 0x88]
cmp dword [eax + 0x30], edi
je 0x42b77f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x42b778
cmp eax, 0x7fffffff
ja 0x42b778
mov edx, dword [ebx + 0x88]
push edi
cmp eax, dword [edx + 0x30]
mov ecx, dword [edx + 0x34]
mov dword [ebp - 4], ecx
setg cl
cmp eax, dword [edx + 0x34]
setne al
or cl, al
je 0x42b75f
push 0x80
push 2
push edi
push edi
push 0x40000000
mov dword [edx + 0x34], edi
push dword [ebx + 0x48]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp esi, ebx
je 0x42b75a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
cmp esi, 0xffffffff
jmp 0x42b76d
push edi
push edi
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x42b782
call fcn.00410c11
mov edi, eax
jmp 0x42b78c
mov edi, 0x80004005
jmp 0x42b78c
mov dword [eax + 0x34], edi
mov eax, dword [ebp + 8]
mov ecx, esi
or esi, 0xffffffff
mov dword [eax], ecx
cmp esi, 0xffffffff
je 0x42b798
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42c4c4
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x551008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 8
mov ebx, ecx
lea edi, [ebp - 0x24]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 0x20
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x42c507
push ecx
mov ecx, 0x552b30
call fcn.004256bf
mov eax, 0x80040884
jmp 0x42c5aa
push esi
call fcn.00403fa8
push eax
lea ecx, [ebp - 0x28]
call fcn.00404df3
push ecx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x24]
call fcn.00408c1d
push dword [ebx]
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
call fcn.0042fc65
movzx eax, byte [ebx + 0x10]
mov esi, dword [ebp - 0x28]
push esi
push eax
mov eax, dword [ebx]
add eax, 0xc
push str._d:_S
push eax
call fcn.00410ae2
mov edx, dword [ebx]
lea ecx, [ebp - 0x28]
add esp, 0x1c
call fcn.00409312
mov ecx, dword [ebx]
push eax
add ecx, 0x10
call fcn.00404b09
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00403f90
push 0
push 0x3f
lea ecx, [ebx + 4]
call fcn.0040972f
mov ecx, str._1cup2key_2cup2hreq_3
cmp eax, 0xffffffff
jne 0x42c587
mov ecx, str._1_cup2key_2cup2hreq_3
mov eax, dword [ebx]
push dword [eax + 0x10]
push dword [eax + 0xc]
add eax, 0x14
push dword [ebx + 4]
push ecx
push eax
call fcn.004257b8
add esp, 0x14
lea ecx, [esi - 0x10]
call fcn.00403f90
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004e302f
leave
ret
Function at 0x42d1d7
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0x10]
push esi
push edi
xor esi, esi
mov edi, ecx
mov edx, dword [eax]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov eax, dword [edx - 0xc]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], edx
lea eax, [eax*2 + 2]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
push 1
push esi
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], esi
push eax
push 0x53d928
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x42d233
call fcn.00410c11
jmp 0x42d257
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, ecx
push eax
push ecx
push esi
lea ecx, [ebp - 0x24]
call fcn.0042c2af
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov esi, dword [ebp - 0x24]
test eax, eax
js 0x42d2f8
push ebx
push edi
lea ecx, [ebp - 0x18]
call fcn.0041205a
push dword [ebp + 8]
lea ecx, [edi + 0x1c]
call fcn.0042d75c
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42d2b2
push dword [ebp + 8]
lea ecx, [edi + 0x1c]
call fcn.004274c0
push dword [ebp + 0xc]
lea ecx, [edi + 0x28]
call fcn.004274c0
lea eax, [ebp - 0x24]
push eax
lea ecx, [edi + 0x34]
call fcn.0042d6da
lea eax, [ebp + 8]
mov dword [ebp + 8], 0xffff
push eax
lea ecx, [edi + 0x40]
call fcn.0042d633
jmp 0x42d2ef
push dword [ebp + 0xc]
lea ecx, [edi + 0x28]
push ebx
call fcn.0042749b
mov ecx, eax
call fcn.00404b09
push ebx
lea ecx, [edi + 0x34]
call fcn.0042d6b5
lea ecx, [ebp - 0x24]
cmp eax, ecx
je 0x42d2e0
push dword [ebp - 0x20]
mov ecx, eax
push esi
call fcn.0042d792
push ebx
lea ecx, [edi + 0x40]
call fcn.0042749b
mov dword [eax], 0xffff
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
call dword [eax + 8]
pop ebx
lea ecx, [ebp - 0x24]
call fcn.00411953
pop edi
pop esi
leave
ret 0xc
Function at 0x430bf0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x551008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x124], edi
mov esi, ebx
lea edx, [edi + 0x10]
movzx ecx, byte [edx]
lea edx, [edx + 4]
movzx eax, byte [edx - 3]
shl eax, 0x10
shl ecx, 0x18
or ecx, eax
movzx eax, byte [edx - 2]
shl eax, 8
or ecx, eax
movzx eax, byte [edx - 1]
or ecx, eax
mov dword [ebp + esi*4 - 0x104], ecx
inc esi
cmp esi, 0x10
jl 0x430c15
push 0x40
pop eax
cmp esi, eax
jge 0x430c9d
sub eax, esi
lea ebx, [ebp + esi*4 - 0x10c]
mov dword [ebp - 0x108], eax
mov edi, eax
mov ecx, dword [ebx - 0x34]
mov esi, ecx
mov edx, dword [ebx]
mov eax, ecx
rol esi, 0xe
lea ebx, [ebx + 4]
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
rol eax, 0xd
rol ecx, 0xf
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [ebx - 0x3c]
add esi, dword [ebx - 0x18]
mov dword [ebx + 4], esi
sub edi, 1
jne 0x430c5b
mov edi, dword [ebp - 0x124]
xor ebx, ebx
mov eax, dword [edi + 0x50]
mov edx, dword [edi + 0x54]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], eax
mov eax, dword [edi + 0x58]
mov dword [ebp - 0x114], eax
mov eax, dword [edi + 0x5c]
mov dword [ebp - 0x120], eax
mov eax, dword [edi + 0x60]
mov dword [ebp - 0x10c], eax
mov eax, dword [edi + 0x64]
mov dword [ebp - 0x118], eax
mov eax, dword [edi + 0x68]
mov dword [ebp - 0x11c], eax
mov eax, dword [edi + 0x6c]
mov edi, dword [ebp - 0x128]
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x108], eax
mov ecx, edx
mov esi, edi
xor ecx, edi
ror esi, 0xd
and ecx, dword [ebp - 0x114]
and edx, edi
xor ecx, edx
mov eax, edi
rol eax, 0xa
xor esi, eax
mov eax, edi
ror eax, 2
xor esi, eax
add esi, ecx
mov ecx, dword [ebp - 0x10c]
mov edx, ecx
mov eax, ecx
rol eax, 7
ror edx, 0xb
xor edx, eax
mov eax, ecx
ror eax, 6
not ecx
and ecx, dword [ebp - 0x11c]
xor edx, eax
mov eax, dword [ebp - 0x118]
and eax, dword [ebp - 0x10c]
xor ecx, eax
mov eax, dword [ebp - 0x11c]
add edx, ecx
mov ecx, dword [ebp - 0x120]
add edx, dword [ebx + 0x515fb0]
add edx, dword [ebp + ebx - 0x104]
add ebx, 4
add edx, dword [ebp - 0x108]
mov dword [ebp - 0x108], eax
add ecx, edx
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x110], edi
lea edi, [edx + esi]
mov edx, dword [ebp - 0x110]
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x114], eax
cmp ebx, 0x100
jl 0x430cf1
mov eax, dword [ebp - 0x12c]
add eax, edi
mov edi, dword [ebp - 0x124]
add dword [edi + 0x60], ecx
add dword [edi + 0x54], edx
mov ecx, dword [ebp - 0x118]
add dword [edi + 0x64], ecx
mov edx, dword [ebp - 0x114]
add dword [edi + 0x58], edx
mov ecx, dword [ebp - 0x11c]
add dword [edi + 0x68], ecx
mov ecx, dword [ebp - 0x108]
add dword [edi + 0x6c], ecx
mov edx, dword [ebp - 0x120]
add dword [edi + 0x5c], edx
mov ecx, dword [ebp - 4]
mov dword [edi + 0x50], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004e302f
leave
ret
Function at 0x430e13
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 8], 0
and dword [eax + 0xc], 0
mov dword [eax], fcn.00430e13
mov dword [eax + 0x50], 0x6a09e667
mov dword [eax + 0x54], 0xbb67ae85
mov dword [eax + 0x58], 0x3c6ef372
mov dword [eax + 0x5c], 0xa54ff53a
mov dword [eax + 0x60], 0x510e527f
mov dword [eax + 0x64], 0x9b05688c
mov dword [eax + 0x68], 0x1f83d9ab
mov dword [eax + 0x6c], 0x5be0cd19
pop ebp
ret

Function at 0x432bd1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push 9
sub edx, ecx
pop esi
mov eax, dword [edx + ecx]
xor eax, dword [ecx]
and eax, dword [ebp + 8]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub esi, 1
jne 0x432bda
pop esi
pop ebp
ret
Function at 0x486ebc
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
push 1
push ecx
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ecx
push eax
push ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ecx
push eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x486f0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x486f06
call fcn.00410c11
jmp 0x486f33
mov eax, 0x8007000d
jmp 0x486f33
push dword [ebp + 8]
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add edx, esi
push edx
push esi
mov eax, dword [ecx]
push eax
mov dword [ecx + 4], eax
call fcn.0042c2af
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
leave
ret
Function at 0x488087
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
sub esp, 0xc
lea edx, [ebx + 0x1c]
lea ecx, [ebx + 0x40]
mov esi, eax
lea eax, [ebx + 0x38]
push edx
push ecx
lea ecx, [ebx + 0x3c]
push ecx
push eax
push edi
push esi
push ecx
lea ecx, [ebp - 0x88]
call fcn.00487f48
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push 0x2c
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], esi
push eax
push 0x2c
lea eax, [ebp - 0x88]
mov dword [ebp - 0x2c], esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x48817a
cmp dword [ebp - 0x30], 2
jne 0x48817a
cmp dword [ebp - 0x2c], esi
je 0x48817a
cmp dword [ebp - 0x10], esi
je 0x48817a
cmp dword [ebp - 0xc], esi
je 0x48817a
cmp dword [ebp - 8], esi
je 0x48817a
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
lea edi, [ebp - 0x48]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x2c
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x3c], esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x5c], 3
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x48817a
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x34], eax
mov al, 1
jmp 0x48817c
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4a45cd
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x551008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
call fcn.00493e85
dec eax
xor ebx, ebx
push 0xf
pop edi
cmp eax, 9
ja case.default.0x4a45f5
jmp dword [eax*4 + 0x4a4781]
push 0xb
push str.Unsupported
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], str.T:_srcpiper_branchesomaha_M36_release_branchgoogle3_third_party_protobuf_legacy_opensource_src_google_protobuf_map_field.h
mov dword [ebp - 0x20], 0x11f
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edi
mov byte [ebp - 0x1c], bl
call fcn.0041be35
lea eax, [ebp - 0x28]
push eax
call fcn.004886e5
lea ecx, [ebp - 0x1c]
call fcn.00409c0e
push edi
push str.Cant_get_here.
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], str.T:_srcpiper_branchesomaha_M36_release_branchgoogle3_third_party_protobuf_legacy_opensource_src_google_protobuf_map_field.h
mov dword [ebp - 0x20], 0x137
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edi
mov byte [ebp - 0x1c], bl
call fcn.0041be35
lea eax, [ebp - 0x28]
push eax
call fcn.004886e5
lea ecx, [ebp - 0x1c]
call fcn.00409c0e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e302f
leave
ret 4
mov ecx, esi
call fcn.00494382
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x4a469c
mov eax, dword [eax]
push ecx
push eax
push 0x811c9dc5
call fcn.0042555c
add esp, 0xc
jmp 0x4a4679
mov ecx, esi
call fcn.00493f0f
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov edx, 0x811c9dc5
movzx eax, byte [ebp + ecx - 0x30]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 8
jb 0x4a46c1
mov eax, edx
jmp 0x4a4679
mov ecx, esi
call fcn.004940db
mov ecx, esi
call fcn.004940db
mov dword [ebp - 0x2c], eax
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x2c]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x4a46f0
jmp 0x4a46d4
mov ecx, esi
call fcn.00493ff5
mov ecx, esi
call fcn.00493ff5
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov edx, 0x811c9dc5
movzx eax, byte [ebp + ecx - 0x30]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 8
jb 0x4a4720
jmp 0x4a46d4
mov ecx, esi
call fcn.004941be
mov ecx, esi
call fcn.004941be
mov dword [ebp - 0x2c], eax
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x2c]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x4a474d
jmp 0x4a46d4
mov ecx, esi
call fcn.0049429f
movzx eax, al
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
jmp 0x4a4679