joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5212c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa14
mov eax, dword [0x5c6150]
xor eax, esp
mov dword [esp + 0xa10], eax
cmp byte [0x5d212b], 0
push ebx
push esi
push edi
jne 0x5214f6
cmp byte [0x5d2338], 0
jne 0x521470
cmp dword [0x5c92c8], 8
mov edx, 0x5c92b4
mov byte [0x5d212b], 1
cmovae edx, dword [0x5c92b4]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x521316
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, 0x5c935c
call fcn.00413520
mov ecx, 0x5c935c
call fcn.00513e30
push 1
push 0x597154
mov ecx, 0x5c935c
call fcn.0042c750
push 0xd
push str.imekernel.log
mov ecx, 0x5c935c
call fcn.0042c750
mov ecx, 0x5c935c
call fcn.00513e30
cmp dword [0x5c9370], 8
mov eax, 0x5c935c
push 0x591e94
cmovae eax, dword [0x5c935c]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.004e2a04
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x5213dd
cmp dword [0x5c9370], 8
mov eax, 0x5c935c
push 0x59cfc0
cmovae eax, dword [0x5c935c]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.004e2a04
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0x5213e6
push eax
push 1
push 2
push 0x59cf98
call fcn.004e45f2
mov eax, dword [esp + 0x1c]
add esp, 0x10
test eax, eax
je 0x5213e6
push eax
call fcn.004e24fb
add esp, 4
push 0x208
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004d9fe0
add esp, 0xc
lea eax, [esp + 0x10]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x52145d
xor eax, eax
xor edx, edx
mov word [esp + 0x216], ax
lea edi, [eax + 0x5c]
lea ebx, [eax + 0x2f]
movzx ecx, word [esp + eax*2 + 0x10]
xor esi, esi
cmp si, cx
je 0x521443
cmp di, cx
je 0x521438
cmp bx, cx
jne 0x52143b
lea edx, [eax + 1]
inc eax
cmp eax, 0x103
jl 0x521422
lea eax, [esp + 0x10]
lea eax, [eax + edx*2]
push eax
push 0x104
push 0x5d2130
call fcn.004e1af2
add esp, 0xc
call fcn.00520d80
mov byte [0x5d2338], 1
mov byte [0x5d212b], 0
lea eax, [ebp + 0xc]
mov edx, 0x400
push eax
push ecx
push dword [ebp + 8]
lea ecx, [esp + 0x224]
push 0x400
call fcn.0044e350
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5214f6
cmp dword [0x5c9370], 8
lea eax, [esp + 0xc]
mov ecx, 0x5c935c
mov dword [esp + 0xc], 0
cmovae ecx, dword [0x5c935c]
push 0x59cf9c
push ecx
push eax
call fcn.004e2a04
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0x5214f6
push eax
push esi
lea eax, [esp + 0x220]
push 2
push eax
call fcn.004e45f2
push dword [esp + 0x1c]
call fcn.004e3a2f
add esp, 0x14
push dword [esp + 0xc]
call fcn.004e24fb
add esp, 4
mov ecx, dword [esp + 0xa1c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret

Function at 0x521a20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push 0
mov esi, ecx
push 0
push esi
push dword [ebp + 8]
mov dword [esi + 8], eax
push 0
push 0
mov byte [esi + 0xc], 0
call fcn.004e380e
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
setne al
pop esi
pop ebp
ret 8
Function at 0x521f40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push ebx
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov edi, dword [eax]
test edi, edi
je 0x52200e
movzx eax, word [edi]
mov ecx, 0x82
cmp ax, cx
jae 0x52200e
test al, 1
jne 0x52200e
test ax, ax
je 0x52200e
movsx eax, word [edi]
cdq
push esi
sub eax, edx
xor esi, esi
mov edx, eax
sar edx, 1
lea ecx, [esi + 1]
cmp edx, ecx
jl 0x521f9b
nop dword [eax]
movsx eax, word [edi + ecx*2]
inc ecx
add esi, eax
cmp ecx, edx
jle 0x521f90
cmp dword [0x5d2348], 0
mov word [ebx + 0xc], si
mov ebx, dword [ebp + 8]
je 0x521fc9
mov eax, dword [0x5d2344]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax]
lea eax, [ebx + esi]
lea edx, [edx + esi]
shl ax, cl
shl dx, cl
add dx, ax
movzx edi, dx
jmp 0x521fcb
xor edi, edi
mov edx, dword [ebp - 4]
mov edx, dword [edx]
movzx eax, word [edx]
add edx, 2
and ebx, reloc.WS2_32.dll_getsockopt
jns 0x521fe3
dec ebx
or ebx, 0xfffffff8
inc ebx
mov esi, eax
movzx ecx, bx
shr esi, 1
je 0x522005
nop dword [eax]
mov ax, word [edx]
lea edx, [edx + 2]
xor ax, di
rol ax, cl
mov word [edx - 2], ax
sub esi, 1
jne 0x521ff0
pop esi
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5221d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x5d2348], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, edx
je 0x522204
mov eax, dword [0x5d2344]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax]
lea eax, [esi + edi]
lea edx, [edx + edi]
shl ax, cl
shl dx, cl
add dx, ax
movzx edi, dx
jmp 0x522206
xor edi, edi
mov eax, dword [ebx]
movzx ecx, word [eax]
add eax, 2
and esi, reloc.WS2_32.dll_getsockopt
jns 0x52221b
dec esi
or esi, 0xfffffff8
inc esi
movzx ebx, si
mov esi, ecx
shr esi, 1
je 0x52223c
mov dx, word [eax]
lea eax, [eax + 2]
mov cx, bx
ror dx, cl
xor dx, di
mov word [eax - 2], dx
sub esi, 1
jne 0x522224
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret
Function at 0x524010
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, ecx
push 0
push eax
call fcn.004d9fe0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x5241ab
push 0x59d188
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004e7085
add esp, 0xc
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x218]
xorps xmm0, xmm0
movq qword [ebp - 0x228], xmm0
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x218], eax
test eax, eax
je 0x5241ab
push ebx
push esi
push eax
xor bl, bl
call fcn.004e1b5b
add esp, 4
mov esi, eax
lea eax, [ebp - 0x20c]
push esi
push dword [ebp - 0x218]
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x52412c
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
push eax
push 0x597154
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x52412c
mov eax, dword [ebp - 0x21c]
mov bl, 1
mov cx, word [eax + 0xa]
mov word [ebp - 0x20e], cx
mov cx, word [eax + 8]
mov word [ebp - 0x210], cx
mov cx, word [eax + 0xe]
mov word [ebp - 0x212], cx
jmp 0x524156
mov ax, word [ebp - 0x224]
mov word [ebp - 0x212], ax
mov ax, word [ebp - 0x226]
mov word [ebp - 0x210], ax
mov ax, word [ebp - 0x228]
mov word [ebp - 0x20e], ax
test esi, esi
je 0x524163
push esi
call fcn.004e1b56
add esp, 4
pop esi
test bl, bl
pop ebx
je 0x5241ab
movzx eax, word [ebp - 0x20e]
mov dword [edi + 4], eax
movzx eax, word [ebp - 0x210]
mov dword [edi + 8], eax
movzx eax, word [ebp - 0x212]
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi], 0x114
mov dword [edi + 0x10], 2
mov word [edi + 0x14], ax
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop edi
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret
Function at 0x52bb30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53794d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov edi, dword [ebp + 8]
mov ecx, 7
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x40]
lea eax, [esi + 0x18]
cmp edx, eax
je 0x52bb9f
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x52bb90
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x40]
call fcn.00413520
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
mov dword [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
cmp eax, 0xffffffff
je 0x52bbf2
shr eax, 4
not al
and al, 1
je 0x52bbf2
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
cmovae eax, dword [ebp - 0x40]
push eax
push edi
call fcn.0052ba70
test al, al
jne 0x52bca3
push 0x1e
push str.load_user_path_correct_failed.
mov ecx, edi
call fcn.0042c750
mov ecx, 7
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], ecx
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
cmp eax, esi
je 0x52bc2b
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x52bc1c
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.00413520
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
cmp eax, 0xffffffff
je 0x52bc71
shr eax, 4
not al
and al, 1
je 0x52bc71
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x44]
cmovae eax, dword [ebp - 0x28]
push eax
push edi
call fcn.0052ba70
test al, al
jne 0x52bca7
push 0x1d
push str.load_sys_path_correct_failed.
mov ecx, edi
call fcn.0042c750
xor bl, bl
lea ecx, [ebp - 0x28]
call fcn.004134c0
lea ecx, [ebp - 0x40]
call fcn.004134c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 8
mov bl, 1
jmp 0x52bc7b
mov bl, 1
jmp 0x52bc73
Function at 0x646e37
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x64968e
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x10041758
call fcn.0067d3f4
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x10048578
call fcn.0067838d
xor edi, edi
push 4
mov dword [ebp - 4], edi
call fcn.00671269
mov ebx, eax
cmp ebx, edi
pop ecx
je 0x6496d6
call fcn.006782a9
mov dword [ebx], eax
call fcn.006780dd
mov ecx, eax
call fcn.00641a68
mov eax, ebx
jmp 0x6496d8
xor eax, eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x24]
mov dword [eax], edi
mov eax, dword [esi + 0x34]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x65d51a
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x10041880
call fcn.0067d3f4
push edi
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], eax
mov al, byte [ebp + 0xc]
mov byte [esi + 4], al
lea eax, [ebp + 0x10]
push eax
lea ecx, [esi + 8]
call fcn.0063ebc0
or dword [esi + 0x28], 0xffffffff
push edi
push 1
lea ecx, [ebp + 0x10]
mov dword [esi + 0x24], 0x64
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
call fcn.0063e0ff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
leave
ret 0x24

Function at 0xea23b8
Capabilities:
Encode data using base64

Disassembly:
dec dword [ecx - 0x7842ed53]
or cl, byte [ebp - 0xf41f4b2]
imul ebx, ebx, 0xffffffdf
add byte [ebx - 0x51502025], cl
fld st(1)
and al, 0
jl 0xea232a
out dx, eax
aaa
xchg ebx, eax
sub eax, 0xe34ebaf
lea eax, [ebx]
push ebx
ja 0xea2367
adc dword [esi], edx
push ss
xor dword [esi], edx
mov cl, byte [eax - 0x41]
push esp
mov esi, 0xbcec0320
adc dh, byte [eax + 0x7ffcbce4]
sub al, 0xce
add dh, bh
mov esp, eax
mov ebx, 0x7ca0ffff
out dx, eax
xchg edx, eax
mov dl, 0x35
cmp ecx, 0xffffff81
mov al, byte [ebx + 0xe570897]
inc edi
jo 0xea2357
jno 0xea235c
push es
aad 0xd3
mov cl, byte [ebx - 0x3d]
imul edx, dword [edi - 0x56840f03], 0x70a527f8
aad 0x3f
sahf
jne 0xea23b9
sub byte [ecx - 0x25], ah
in eax, 0x97
mov ebp, 0xa4fb729a
jbe 0xea22d3
and eax, 0xabe0fb84
loopne 0xea22fd
js 0xea2380
int 0xdc
invalid
out dx, eax
lea ebp, [ecx]
pushfd
xor esi, dword [eax - 0x5cac65]
invalid
mov al, 0x9b
push ebx
mov dword [0xffffffff], eax
mov byte [0x9affff3c], al
sub eax, 0x768848dc
call [edx + 0x48dc2d67]
mov byte [esi - 0x6b], dh
lcall 0x7688, 0x48dc2d67
xchg ebp, eax
std
into
aas
mov eax, dword [0x6c27798f]
cmc
invalid
invalid
mov ah, 0xd3
and ecx, dword [esi + ebp - 0x33]
and dword [ebx - 0x6bb7853a], edx
pushal
inc edx
salc
jp 0xea2406
shl dword [ebx], cl
dec esp
int 0x21
xchg ebx, eax
invalid
inc edx
in al, 0xa5
lahf
jne 0xea2350
popal
pop esp
enter 0x3ebf, 0x3d
cmp cl, byte [ecx + 0x3e]
rol ch, 0xa1
jle 0xea2368
mov ebx, 0x1681ec44
adc dword [edi + 0x7a], edx
lahf
in al, dx
adc dword [esi], 0x9f7a5711
cmp eax, dword [eax]
push ecx
mov ecx, dword ss:[ecx - 0x16d]
jge 0xea23df
test al, 0xd3
and al, 0x4e
and eax, 0xf0fffffe
jp 0xea240c
invalid
cmp eax, 0xaf16fffb
add byte [ebx - 0x10851025], ch
stosd dword es:[edi], eax
fucomi st(7)
jp 0xea2400
add dword [edi], ebx
cmp esp, ebp
pop esp
or al, 0x34
shr dword [edi + 0x4a], 0x3c
jnp 0xea2488
invalid
invalid
je 0xea2445
inc edx
inc dword [edi]
pop esi
xor dword [edx], edx
invalid
Function at 0x4028c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x11
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jne 0x4028d8
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x4028e6
xor eax, eax
jmp 0x4028ff
call fcn.004027c0
test eax, eax
je 0x4028e2
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.004027e0
mov eax, dword [ebp - 8]
mov ecx, eax
shr ecx, 1
and ecx, eax
test ecx, 0x8000000
je 0x4028d2
xor ecx, ecx
xgetbv
mov eax, ecx
shr eax, 2
shr ecx, 1
and eax, ecx
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402a30
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x402a6f
push str.SetDefaultDllDirectories
push 0x9a06b8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402a6f
push 0xc00
call eax
test eax, eax
jne 0x402b07
push 0x106
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402b07
cmp eax, 0x104
ja 0x402b07
cmp word [ebp + eax*2 - 0x2d2], 0x5c
je 0x402aa9
mov ecx, 0x5c
mov word [ebp + eax*2 - 0x2d0], cx
inc eax
cmp byte [str.userenv], 0
push esi
mov esi, str.userenv
je 0x402b06
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ebx, [ebp + eax*2 - 0x2d0]
mov cl, byte [esi]
inc esi
mov eax, ebx
test cl, cl
je 0x402ae0
movzx edx, cl
mov cl, byte [esi]
mov word [eax], dx
add eax, 2
inc esi
test cl, cl
jne 0x402ad0
xor ecx, ecx
push 8
push ecx
lea edx, [ebp - 0x2d0]
push edx
mov dword [eax], 0x64002e
mov dword [eax + 4], 0x6c006c
mov word [eax + 8], cx
call edi
cmp byte [esi], 0
jne 0x402ac7
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407410
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0x98
xor ebx, ebx
lea eax, [esi + 0x110]
push ebx
push eax
call fcn.00937030
mov eax, dword [esi + 0x34]
add eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x28]
lea edi, [ecx + eax]
mov dword [esi + 0x40], eax
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [esi + 0x18]
shr edx, 3
imul edx, edx, 0x54
mov ecx, edi
sub ecx, edx
add esp, 0xc
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0xc], eax
mov edx, eax
cmp eax, 0xc
jb 0x407470
mov edx, 0xc
or eax, 0xffffffff
sub eax, edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
lea eax, [edi - 0xc]
lea edx, [ecx + 0x600]
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 8], ecx
mov edx, 0x100
mov word [eax], dx
mov edx, 0x101
mov word [eax + 2], dx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
xor edx, edx
lea eax, [ecx + 2]
xor ecx, ecx
mov byte [eax - 2], dl
mov byte [eax - 1], 1
mov word [eax], cx
mov word [eax + 2], cx
inc edx
add eax, 6
cmp edx, 0x100
jb 0x4074b1
lea edx, [esi + 0x9fc]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edx
jmp 0x4074e2
xor ebx, ebx
mov edi, dword [ebp - 8]
jmp 0x4074f0
movzx eax, word [ebx + 0x9a0700]
mov ecx, dword [ebp - 4]
xor edx, edx
add ecx, 2
div ecx
mov edx, 0x4000
sub edx, eax
movzx ecx, dx
xor eax, eax
lea ecx, [ecx]
mov word [edi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x407510
add ebx, 2
add edi, 2
cmp ebx, 0x10
jb 0x4074f0
mov eax, dword [ebp - 4]
sub dword [ebp - 8], 0xffffff80
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x80
jb 0x4074e0
mov ecx, 0x50
lea edi, [esi + 0x3bc]
lea ebx, [ecx - 0x4c]
jmp 0x407550
mov eax, edi
mov edx, 0x10
jmp 0x407560
mov word [eax], cx
mov word [eax + 2], 0x403
add eax, ebx
dec edx
jne 0x407560
add ecx, 0x28
add edi, 0x40
cmp ecx, 0x438
jb 0x407550
pop edi
mov dword [esi + 0x3b8], 0x40070000
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408450
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [section..data]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x20], 0x6a09e667
mov dword [eax + 0x24], 0xbb67ae85
mov dword [eax + 0x28], 0x3c6ef372
mov dword [eax + 0x2c], 0xa54ff53a
mov dword [eax + 0x30], 0x510e527f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
pop ebp
ret 4
Function at 0x408a40
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
and eax, 0x3f
mov byte [eax + esi + 0x40], 0x80
inc eax
push edi
cmp eax, 0x38
jbe 0x408a84
cmp eax, 0x40
je 0x408a76
mov edx, 0x40
sub edx, eax
push edx
lea ecx, [eax + esi + 0x40]
push 0
push ecx
call fcn.00937030
add esp, 0xc
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
xor eax, eax
mov ecx, 0x38
sub ecx, eax
push ecx
lea edx, [eax + esi + 0x40]
push 0
push edx
call fcn.00937030
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
add esp, 0xc
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], eax
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
mov edx, dword [ebp + 0xc]
lea ecx, [esi + 0x20]
mov dword [ebp + 8], 4
mov edi, edi
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
bswap ebx
bswap eax
mov dword [edx], ebx
mov dword [edx + 4], eax
add edx, 8
add ecx, 8
dec dword [ebp + 8]
jne 0x408ad0
xor eax, eax
pop edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebx
pop ebp
ret 8

Function at 0x408c60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.009371a1
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x408c8c
xor eax, eax
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x408c9b
mov eax, 1
pop ebp
ret 0xc

Function at 0x40b9b0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0x2002
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.0040ea80
test al, al
jne 0x40b9dd
lea ecx, [ebp - 4]
call fcn.0040eab0
xor al, al
mov esp, ebp
pop ebp
ret 8
push esi
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x40b9fd
lea ecx, [ebp - 4]
call fcn.0040eab0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push edi
push ecx
push eax
call fcn.00936b50
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
lea ecx, [ebp - 4]
test eax, eax
je 0x40b9ef
mov dword [ebp - 4], 0
call fcn.0040eab0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x40c580
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret 8
Function at 0x40c5a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, 0xf0000000
je 0x40c5b2
and eax, 0x3fff
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret 8

Function at 0x40c640
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040cfc0
cmp eax, 0xffffffff
je 0x40c670
test al, 0x10
jne 0x40c670
test al, 1
je 0x40c670
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40c670
xor al, al
pop esi
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop esi
pop ebp
ret 4

Function at 0x40c6b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x99d438
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [eax]
push esi
xor ecx, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov word [eax], cx
lea eax, [ebp - 0x244]
push eax
xor edx, edx
push 0x114
mov word [ebp - 0x244], dx
call edi
mov esi, eax
test esi, esi
je 0x40c7bc
cmp esi, 0x114
jae 0x40c739
xor ecx, ecx
lea edx, [ebp - 0x244]
mov word [ebp - 0x1c], cx
mov ecx, dword [ebp + 8]
push edx
call fcn.00409e70
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x18]
call fcn.00409c70
mov dword [ebp - 4], 0
cmp esi, dword [ebp - 0x10]
jbe 0x40c756
push esi
lea ecx, [ebp - 0x18]
call fcn.00409a10
mov eax, dword [ebp - 0x18]
push eax
push esi
call edi
test eax, eax
je 0x40c7b0
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov word [edx + esi*2], cx
cmp word [edx], cx
je 0x40c778
nop
inc ecx
cmp word [edx + ecx*2], 0
jne 0x40c770
mov dword [ebp - 0x14], ecx
cmp ecx, eax
jne 0x40c7b0
dec esi
cmp esi, eax
jne 0x40c7b0
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x18]
push edx
call fcn.00409ee0
mov eax, dword [ebp - 0x18]
push eax
call fcn.00937371
add esp, 4
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00937371
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4