joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10174a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x24]
lea ecx, [ecx]
mov eax, dword [edi + 0x24]
mov edx, dword [edi + 0x34]
add eax, 0xfffffefa
sub edx, dword [edi + 0x6c]
add eax, esi
sub edx, dword [edi + 0x64]
mov dword [ebp + 8], edx
cmp dword [edi + 0x64], eax
jb 0x10174b0c
mov ecx, dword [edi + 0x30]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.10153210
mov edx, dword [edi + 0x44]
add esp, 0xc
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], esi
sub dword [edi + 0x64], esi
sub dword [edi + 0x54], esi
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x10174adf
sub eax, esi
jmp 0x10174ae1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x10174ad0
mov eax, dword [edi + 0x38]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x10174aff
sub eax, esi
jmp 0x10174b01
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x10174af0
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x10174bc1
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x10174b39
xor eax, eax
jmp 0x10174b85
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x10174b56
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.1017ab20
jmp 0x10174b66
cmp eax, 2
jne 0x10174b6f
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.10174f60
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 0x30], eax
push ecx
push dword [ebx]
push dword [ebp - 4]
call fcn.10153210
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x6c], eax
mov ebx, dword [edi + 0x6c]
cmp ebx, 3
jb 0x10174bad
mov eax, dword [edi + 0x30]
add eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x50]
movzx edx, byte [eax]
mov dword [edi + 0x40], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x4c]
mov dword [edi + 0x40], edx
cmp ebx, 0x106
jae 0x10174bc1
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x10174a90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10174f60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x10174f6c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.10174f80
Function at 0x101760c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101923f1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
mov dword [esi], vtable.CZipStorage.0
call fcn.10175e60
mov dword [ebp - 4], 0
call fcn.100308cf
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x1017611b
push 0x80004005
call fcn.1001f790
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 1
call fcn.10175c80
push 3
push 0x101cb664
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0x10000
mov dword [esi + 0x54], 0xffffffff
mov dword [esi + 0x20], 0
call fcn.1001f5e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10176180
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10192426
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101f7210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CZipStorage.0
lea ecx, [esi + 0x40]
mov dword [ebp - 4], 1
call fcn.10175ca0
mov edx, dword [esi + 0x30]
or ecx, 0xffffffff
sub edx, 0x10
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x101761df
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esi + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.10175ec0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1017a130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test edi, edi
jne 0x1017a14c
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, 2
mul edx
push esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002fb37
add esp, 4
mov byte [ebp - 1], 1
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1017a18d
push esi
mov byte [ebp - 1], al
call fcn.1002fb32
mov al, byte [ebp - 1]
add esp, 4
pop esi
pop edi
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x1017a195
xor ecx, ecx
jmp 0x1017a1af
mov ecx, esi
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1017a1a0
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp + 8]
push esi
call fcn.1001f5e0
push esi
call fcn.1002fb32
mov al, byte [ebp - 1]
add esp, 4
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1017a1f0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10192bc0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x101f7210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
lea ecx, [ebp - 0x3c]
call fcn.1016e080
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x3c]
call fcn.1017a300
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call edi
test eax, eax
jne 0x1017a283
lea eax, [ebp - 0x10]
push eax
call fcn.1016f560
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
add esp, 4
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call edi
test eax, eax
jne 0x1017a283
xor edi, edi
jmp 0x1017a295
mov edi, dword [ebp - 0x18]
imul edi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0
imul edi, dword [ebp - 0x20]
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1017a2b3
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
call fcn.10179b60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1017a2e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x1017a2f7
xor al, al
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov al, 1
pop ebp
ret

Function at 0x1017a3a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x1017a3c7
xor al, al
pop esi
pop ebp
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
jne 0x1017a3e5
pop edi
xor al, al
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov al, 1
pop edi
pop esi
pop ebp
ret
Function at 0x1017a6e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10192c18
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x101f7210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.1016e080
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x28]
call fcn.1017a300
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, dword [ebp - 0x10]
cmp eax, 2
sete bl
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1017a750
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10179b60
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1017a7e0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
sbb eax, eax
neg eax
pop ebp
ret

Function at 0x1017ab20
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x1017ab3c
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1017ac3d
jmp 0x1017ab50
mov edx, 0x15b0
cmp ebx, edx
cmovb edx, ebx
sub ebx, edx
mov dword [ebp + 0x10], ebx
cmp edx, 0x10
jl 0x1017ac02
mov ebx, edx
shr ebx, 4
mov eax, ebx
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
dec ebx
jne 0x1017ab76
mov ebx, dword [ebp + 0x10]
test edx, edx
je 0x1017ac11
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
dec edx
jne 0x1017ac06
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul edx, edx, 0xffff000f
add esi, edx
test ebx, ebx
jne 0x1017ab50
shl esi, 0x10
pop ebx
or esi, ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4025e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402680
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402660
xor eax, eax
push ebp
push 0x402659
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40269c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402660
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x403218
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4033b4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4032c8
xor eax, eax
push ebp
push 0x4032c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4032aa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4033d4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4032c8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4033a9
cmp byte [ebp - 0xd], 0
jne 0x40330a
cmp byte [ebp - 0x12], 0
je 0x4033a9
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x403323
dec ebx
cmp byte [ebx], 0x2e
je 0x403332
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x403322
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4033a9
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40335f
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4033a9
cmp byte [ebp - 0xd], 0
je 0x4033a9
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4033a9
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403e00
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x403e2f
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00402e3c
jmp 0x403e4d
call sub.kernel32.dll_GetCommandLineA_1
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00403d14
mov edi, eax
test ebx, ebx
je 0x403e4d
cmp dword [esi], 0
je 0x403e4d
dec ebx
jmp 0x403e36
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x404138
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x40c], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x40421a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
xor eax, eax
call fcn.00403e00
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0040408c
lea ecx, [ebp - 0x40c]
mov edx, 0x404234
mov eax, dword [ebp - 8]
call fcn.00403ff8
mov edx, dword [ebp - 0x40c]
lea eax, [ebp - 8]
call fcn.00402df0
mov eax, dword [ebp - 8]
call fcn.00404128
test al, al
jne 0x4041b7
mov edx, dword [ebx]
lea eax, [ebp - 8]
mov ecx, 0x404244
call fcn.00402ec8
mov eax, dword [ebp - 8]
call fcn.00403040
push eax
push 0x400
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebp - 4]
call fcn.00403040
push eax
mov eax, edi
call fcn.00403040
push eax
mov eax, esi
call fcn.00403040
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x408]
mov eax, ebx
call fcn.00402e3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404221
lea eax, [ebp - 0x40c]
call fcn.00402d58
lea eax, [ebp - 8]
call fcn.00402d58
ret
Function at 0x6ad415d0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, eax
sub esp, 0x1c
mov eax, dword [eax + 0x100]
test eax, eax
je 0x6ad4163f
xor ebx, ebx
mov edi, dword fs:[0x18]
nop
mov eax, dword [esi + ebx*4]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov eax, dword [esi + ebx*4 + 0x80]
sub esp, 0xc
add ebx, 1
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
sub esp, 0xc
cmp dword [esi + 0x100], ebx
ja 0x6ad415f0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4120e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d85d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x461580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0042690f
mov edi, eax
add esp, 4
test edi, edi
je 0x41217d
push 1
mov dword [ebp - 4], 0
call fcn.00425d4a
add esp, 4
mov dword [edi + 4], eax
jmp 0x41217f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.0040a2a0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x4121da
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x4121da
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x4121f6
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x412219
cmp byte [ebp + 0xc], 0
je 0x412205
push esi
call fcn.004261e0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x412225
mov esi, str.ios_base::badbit_set
jmp 0x412235
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.00412670
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.0040b800
push 0x45e188
lea eax, [ebp - 0x28]
push eax
call fcn.00427a03
int3
Function at 0x41c0f0
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.004269e0
mov eax, dword [0x461580]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x452b9c
push eax
mov esi, ecx
call fcn.0041cd70
mov edi, eax
add esp, 8
test edi, edi
je 0x41c1c6
push edi
push 0x10000
lea eax, [ebp - 0x10004]
mov dword [esi + 0x10], 0
push 1
push eax
mov dword [esi + 0x14], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.0043118e
add esp, 0x10
test eax, eax
je 0x41c19a
nop
push eax
lea eax, [ebp - 0x10004]
mov ecx, esi
push eax
call fcn.00423df0
push edi
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.0043118e
add esp, 0x10
test eax, eax
jne 0x41c170
mov ecx, esi
call fcn.0041ca40
push edi
call fcn.004308de
movups xmm0, xmmword [esi + 0x58]
add esp, 4
mov al, 1
movups xmmword [ebx], xmm0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426952
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00426952
mov esp, ebp
pop ebp
ret 8
Function at 0x41e230
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x461580]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x462c88]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24c], ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x462890]
cmp eax, dword [ecx + 4]
jg 0x41e3f7
cmp dword [0x4614b0], 0
jne 0x41e3da
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call fcn.0041ebd0
test al, al
jne 0x41e2e9
push esi
lea eax, [ebp - 0x1c]
push str._05d
push eax
call fcn.0041a7f0
mov esi, eax
add esp, 0xc
cmp esi, 0x4614a0
je 0x41e3d1
mov ecx, dword [0x4614b4]
cmp ecx, 0xf
jbe 0x41e38e
mov edx, dword [0x4614a0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41e384
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e42d
jmp 0x41e384
push edi
push 0
push 2
mov dword [ebp - 0x24c], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x228
mov edi, eax
lea eax, [ebp - 0x244]
push 0
push eax
call fcn.004283a0
add esp, 0xc
mov dword [ebp - 0x248], 0x22c
lea eax, [ebp - 0x248]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x41e357
cmp dword [ebp - 0x240], esi
je 0x41e34b
lea eax, [ebp - 0x248]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41e330
jmp 0x41e357
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x24c], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push dword [ebp - 0x24c]
lea eax, [ebp - 0x1c]
push str._05d__05d
push eax
call fcn.0041a7f0
add esp, 0x10
mov esi, eax
cmp esi, 0x4614a0
pop edi
jmp 0x41e2a6
push ecx
push edx
call fcn.0042693f
add esp, 8
mov dword [0x4614b0], 0
mov dword [0x4614b4], 0xf
mov byte [0x4614a0], 0
movups xmm0, xmmword [esi]
movups xmmword [0x4614a0], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x4614b0], xmm0
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov dword [esi + 0x14], 0xf
lea ecx, [ebp - 0x1c]
call fcn.0040c3e0
pop esi
push 0x4614a0
mov ecx, ebx
call fcn.0040acf0
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00426952
mov esp, ebp
pop ebp
ret
push 0x462890
call fcn.00426cd0
add esp, 4
cmp dword [0x462890], 0xffffffff
jne 0x41e26d
push 0x44f140
call fcn.00426c6a
push 0x462890
call fcn.00426c7f
add esp, 8
jmp 0x41e26d
call fcn.0042b6bf
int3