joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10350f7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1007478
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x103514f
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x10074b4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1035142
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1035151
xor eax, eax
pop esi
leave
ret 4
Function at 0x403140
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.00403149

Function at 0x405040
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.00405057

Function at 0x405440
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.00405457
Function at 0x40a660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
add ecx, 2
mov esi, 4
mov edi, edi
mov dl, byte [ecx + 1]
lea ecx, [ecx + 4]
mov bh, byte [ecx - 4]
mov dh, dl
mov al, byte [ecx - 6]
xor dh, bh
mov bl, byte [ecx - 5]
mov ah, 0x1b
mov byte [ebp - 2], al
mov byte [ebp - 3], dl
mov dl, dh
xor dl, al
xor dl, bl
mov byte [ebp - 1], dl
mov dl, al
xor dl, bl
mov al, dl
add dl, dl
shr al, 7
imul ah
mov ah, 0x1b
xor al, dl
mov dl, bl
xor al, byte [ebp - 2]
xor dl, bh
xor al, byte [ebp - 1]
mov byte [ecx - 6], al
mov al, dl
shr al, 7
add dl, dl
imul ah
xor al, dl
mov dl, 0x1b
xor al, bl
mov bl, byte [ebp - 1]
xor al, bl
mov byte [ecx - 5], al
mov al, dh
shr al, 7
add dh, dh
imul dl
mov dl, byte [ebp - 3]
mov ah, 0x1b
xor dl, byte [ebp - 2]
xor al, dh
xor al, bh
xor al, bl
mov byte [ecx - 4], al
mov al, dl
shr al, 7
add dl, dl
imul ah
xor al, dl
xor al, byte [ebp - 3]
xor al, bl
mov byte [ecx - 3], al
dec esi
jne 0x40a670
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aad0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, edx
mov edi, ecx
mov dword [ebp - 0xc], eax
sub edx, edi
mov esi, edi
mov ebx, 4
lea esp, [esp]
mov ecx, 4
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
dec ecx
jne 0x40aaf5
dec ebx
jne 0x40aaf0
mov esi, dword [ebp - 0xc]
add esi, 0x10
mov dword [ebp - 8], 0xd
mov edi, edi
mov ebx, edi
mov dword [ebp - 4], 4
lea esp, [esp]
mov ecx, ebx
mov edx, 4
jmp 0x40ab30
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + str.cw]
mov byte [ecx - 4], al
dec edx
jne 0x40ab30
inc ebx
dec dword [ebp - 4]
jne 0x40ab20
mov cl, byte [edi + 1]
movzx eax, byte [edi + 5]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
mov byte [edi + 7], cl
mov ecx, edi
mov byte [edi + 0xb], al
call fcn.0040a660
mov eax, edi
mov ebx, 4
mov edx, 4
jmp 0x40abb0
mov cl, byte [esi]
inc esi
xor byte [eax], cl
inc eax
dec edx
jne 0x40abb0
dec ebx
jne 0x40aba6
dec dword [ebp - 8]
jne 0x40ab10
mov esi, edi
lea ebx, [edx + 4]
lea ebx, [ebx]
mov ecx, esi
mov edx, 4
jmp 0x40abe0
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + str.cw]
mov byte [ecx - 4], al
dec edx
jne 0x40abe0
inc esi
dec ebx
jne 0x40abd0
mov cl, byte [edi + 1]
lea esi, [edx + 4]
movzx eax, byte [edi + 5]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
mov byte [edi + 7], cl
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0xb], al
add ecx, 0xe0
mov edx, 4
mov al, byte [ecx]
inc ecx
xor byte [edi], al
inc edi
dec edx
jne 0x40ac57
dec esi
jne 0x40ac52
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ac70
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov ebx, 4
push esi
push edi
mov dword [ebp - 8], eax
mov esi, ecx
lea edi, [eax + 0xe0]
jmp 0x40ac90
mov edx, 4
mov al, byte [edi]
inc edi
xor byte [ecx], al
inc ecx
dec edx
jne 0x40ac95
dec ebx
jne 0x40ac90
mov eax, dword [ebp - 8]
add eax, 0xd0
mov byte [ebp - 1], 0xd
mov dword [ebp - 0xc], eax
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
jmp 0x40ad10
mov ecx, edi
mov edx, 4
jmp 0x40ad20
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x4ffb90]
mov byte [ecx - 4], al
dec edx
jne 0x40ad20
inc edi
dec ebx
jne 0x40ad10
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ebx, 4
mov edi, 4
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
dec edi
jne 0x40ad45
dec ebx
jne 0x40ad40
mov ecx, esi
call fcn.0040a710
mov dl, byte [ebp - 1]
sub dword [ebp - 0xc], 0x10
dec dl
mov byte [ebp - 1], dl
test dl, dl
jne 0x40acb0
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
mov ecx, edi
mov edx, 4
lea ebx, [ebx]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x4ffb90]
mov byte [ecx - 4], al
dec edx
jne 0x40add0
inc edi
dec ebx
jne 0x40adc3
sub dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
mov ecx, 4
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
dec ecx
jne 0x40adf8
dec dword [ebp - 0xc]
jne 0x40adf0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bc00
Capabilities:
Encrypt data using salsa20 or chacha
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x40bd44
mov dword [edi], 0x61707865
xorps xmm0, xmm0
movzx edx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi]
shl edx, 8
or edx, eax
mov dword [edi + 4], edx
movzx ecx, byte [esi + 7]
movzx eax, byte [esi + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 4]
shl ecx, 8
or ecx, eax
mov dword [edi + 8], ecx
movzx ecx, byte [esi + 0xb]
movzx eax, byte [esi + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 8]
shl ecx, 8
or ecx, eax
mov dword [edi + 0xc], ecx
movzx ecx, byte [esi + 0xf]
movzx eax, byte [esi + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xc]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x14], 0x3320646e
mov dword [edi + 0x10], ecx
movdqu xmmword [edi + 0x18], xmm0
mov dword [edi + 0x28], 0x79622d32
movzx ecx, byte [esi + 0x13]
movzx eax, byte [esi + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x10]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x2c], ecx
movzx ecx, byte [esi + 0x17]
movzx eax, byte [esi + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x30], ecx
movzx ecx, byte [esi + 0x1b]
movzx eax, byte [esi + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x18]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x34], ecx
movzx ecx, byte [esi + 0x1f]
movzx eax, byte [esi + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x3c], 0x6b206574
mov dword [edi + 0x38], ecx
pop edi
pop esi
pop ebp
ret 4
Function at 0x40c500
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push ebx
push eax
push 0
push 0
push 0x1c
push 0
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x40c52c
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.bowsakkdestx.txt
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x104]
push 0x4ffddc
push eax
call fcn.004220b6
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c561
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 2
push 0
push esi
call fcn.0042387f
push esi
call fcn.00423455
push esi
mov edi, eax
call fcn.00420cf4
add esp, 0x14
test edi, edi
je 0x40c5a5
cmp edi, 0x400
jg 0x40c5a5
push esi
push edi
push 1
push ebx
call fcn.004222f5
push esi
call fcn.00423a38
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.00423a38
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c6a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c734
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push 0
push str.SysHelper
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c70c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 4
push 0
push str.SysHelper
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x40e670
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x12
mov dword [ebp - 4], 0x288
call fcn.00420c62
push 0x288
mov edi, eax
call fcn.00420c62
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e6b4
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.00421f2d
push edi
call fcn.00420bed
add esp, 8
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x40e6db
push esi
call fcn.00420bed
push dword [ebp - 4]
call fcn.00420c62
mov esi, eax
add esp, 8
test esi, esi
je 0x40e699
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x40e744
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push str._02X:_02X:_02X:_02X:_02X:_02X
push edi
call fcn.004204a6
push edi
lea eax, [esi + 0x1b0]
push eax
push str.Address:__s__mac:__s_n
call fcn.00421f2d
push 0x4ffecc
call fcn.00421f2d
add esp, 0x30
push esi
call fcn.00420bed
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e870
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ca9e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
push 0
mov dword [ebp - 4], 0
push 0x4ffca4
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
call fcn.004156d0
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x40e8e9
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push 0x5085b8
push eax
call fcn.00430eca
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40e914
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push 0x5085b8
push eax
call fcn.00430eca
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push 0
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x40e943
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push 0x5085b8
push eax
call fcn.00430eca
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea eax, [ebp - 0x18]
push 0
push eax
push 0
push 2
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
call esi
test eax, eax
jne 0x40e974
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push 0x5085b8
push eax
call fcn.00430eca
mov eax, dword [ebp - 0x18]
inc eax
push eax
call fcn.00420be4
mov ecx, dword [ebp - 0x18]
add esp, 4
inc ecx
mov edi, eax
mov dword [ebp - 0x20], edi
push ecx
push 0
push edi
call fcn.0042b420
add esp, 0xc
lea eax, [ebp - 0x18]
push 0
push eax
push edi
push 2
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x40e9b9
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push 0x5085b8
push eax
call fcn.00430eca
xor esi, esi
jmp 0x40e9c0
cmp esi, dword [ebp - 0x18]
jae 0x40ea10
movzx eax, byte [esi + edi]
push eax
lea eax, [ebp - 0x44]
push str._.2X
push eax
call fcn.004204a6
add esp, 0xc
cmp byte [ebp - 0x44], 0
jne 0x40e9f2
xor ecx, ecx
lea eax, [ebp - 0x44]
push ecx
push eax
mov ecx, ebx
call fcn.00413ea0
inc esi
jmp 0x40e9c0
lea ecx, [ebp - 0x44]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e9f8
sub ecx, edx
lea eax, [ebp - 0x44]
push ecx
push eax
mov ecx, ebx
call fcn.00413ea0
inc esi
jmp 0x40e9c0
push edi
call fcn.00422110
add esp, 4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp + 0x1c], 0x10
jb 0x40ea3e
push dword [ebp + 8]
call fcn.00422587
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40eaa0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4caa00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0
push 0x4ffca4
mov ecx, ebx
mov dword [ebp - 0x1c], 0
mov esi, edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
call fcn.004156d0
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x40eb1c
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push 0x5085b8
push eax
call fcn.00430eca
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40eb47
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push 0x5085b8
push eax
call fcn.00430eca
push 0
push esi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x40eb69
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push 0x5085b8
push eax
call fcn.00430eca
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea eax, [ebp - 0x18]
push 0
push eax
push 0
push 2
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
call esi
test eax, eax
jne 0x40eb9a
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push 0x5085b8
push eax
call fcn.00430eca
mov eax, dword [ebp - 0x18]
inc eax
push eax
call fcn.00420be4
mov ecx, dword [ebp - 0x18]
add esp, 4
inc ecx
mov edi, eax
mov dword [ebp - 0x20], edi
push ecx
push 0
push edi
call fcn.0042b420
add esp, 0xc
lea eax, [ebp - 0x18]
push 0
push eax
push edi
push 2
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x40ebdf
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push 0x5085b8
push eax
call fcn.00430eca
xor esi, esi
cmp esi, dword [ebp - 0x18]
jae 0x40ec38
movzx eax, byte [esi + edi]
push eax
lea eax, [ebp - 0x44]
push str._.2X
push eax
call fcn.004204a6
add esp, 0xc
cmp byte [ebp - 0x44], 0
jne 0x40ec13
xor ecx, ecx
lea eax, [ebp - 0x44]
push ecx
push eax
mov ecx, ebx
call fcn.00413ea0
inc esi
jmp 0x40ebe1
lea ecx, [ebp - 0x44]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ec20
sub ecx, edx
lea eax, [ebp - 0x44]
push ecx
push eax
mov ecx, ebx
call fcn.00413ea0
inc esi
jmp 0x40ebe1
push edi
call fcn.00422110
add esp, 4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ef50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 8], ecx
lea eax, [edi*4]
push eax
call fcn.00420c62
xor esi, esi
mov dword [ebx], eax
add esp, 4
mov dword [ebp - 4], esi
test edi, edi
jle 0x40efdc
lea esp, [esp]
push 0x25c
call fcn.00420c62
mov ecx, dword [ebx]
push 0x97
push 0
mov dword [ecx + esi*4], eax
mov eax, dword [ebx]
push dword [eax + esi*4]
call fcn.0042b420
mov edi, dword [ebx]
mov ecx, 0x25
mov edx, dword [ebp - 4]
add esp, 0x10
mov eax, dword [ebp - 8]
mov edi, dword [edi + edx*4]
mov esi, dword [eax + edx*4]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [ecx]
mov ecx, dword [ebx]
mov ecx, dword [ecx + edx*4]
xor byte [ecx + eax], 0x80
inc eax
cmp eax, 0x97
jl 0x40efc0
inc edx
mov esi, edx
mov dword [ebp - 4], edx
cmp edx, dword [ebp + 8]
jl 0x40ef80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f0e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4caa48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, ecx
push 0
push 0x80
push 2
push 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push 2
cmovae eax, dword [ebp + 8]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40f1bf
sub esp, 0x18
mov byte [ebp - 0xd], 0
mov edx, esp
xor eax, eax
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [esi], ax
jne 0x40f15b
xor ecx, ecx
jmp 0x40f16f
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f160
sub ecx, ebx
sar ecx, 1
push ecx
push esi
mov ecx, edx
call fcn.00415c10
mov dl, byte [ebp - 0xd]
lea ecx, [ebp - 0x2c]
call fcn.00412840
add esp, 0x18
lea eax, [ebp - 0x14]
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 0x10
jb 0x40f1bf
push dword [ebp - 0x2c]
call fcn.00422587
add esp, 4
cmp dword [ebp + 0x1c], 8
jb 0x40f1d0
push dword [ebp + 8]
call fcn.00422587
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410a50
Capabilities:
Check if file exists
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cab90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x14], eax
xor ebx, ebx
mov edx, eax
mov ecx, ebx
shr edx, cl
and edx, 1
je 0x410baa
push 1
push 0x4ffed4
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
call fcn.004156d0
mov dword [esp + 0x5c], 0
lea ecx, [esp + 0x20]
cmp dword [esp + 0x34], 0x10
lea eax, [ebx + 0x41]
push 2
cmovae ecx, dword [esp + 0x24]
push 0x500234
mov byte [ecx], al
lea ecx, [esp + 0x28]
call fcn.00413ea0
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [esp + 0x34], 0x10
lea ecx, [esp + 0x20]
mov edi, eax
cmovae ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test esi, esi
je 0x410b8b
cmp dword [esp + 0x34], 0x10
lea eax, [esp + 0x20]
cmovae eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jb 0x410b8b
cmp eax, 4
jbe 0x410b30
cmp eax, 6
jne 0x410b8b
sub esp, 0x18
mov byte [esp + 0x2b], 0
mov ecx, esp
lea eax, [esp + 0x38]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00413ff0
mov dl, byte [esp + 0x2b]
lea ecx, [esp + 0x50]
call fcn.00412900
add esp, 0x18
mov ecx, dword [esp + 0x18]
push eax
mov byte [esp + 0x60], 1
call fcn.00413580
cmp dword [esp + 0x4c], 8
jb 0x410b8b
push dword [esp + 0x38]
call fcn.00422587
add esp, 4
mov dword [esp + 0x5c], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x410ba6
push dword [esp + 0x20]
call fcn.00422587
add esp, 4
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, 0x1a
jl 0x410a81
mov ecx, dword [esp + 0x54]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret