joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57c32f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x59daa0]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x59dd68]
je 0x57c35c
inc eax
cmp eax, 0x12
jb 0x57c34d
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x59dd68]
jne 0x57c490
mov eax, dword [0x5c4610]
cmp eax, 1
je 0x57c46b
cmp eax, edx
jne 0x57c38c
cmp dword [0x59d334], 1
je 0x57c46b
cmp ecx, 0xfc
je 0x57c490
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x57c3c5
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call fcn.00575310
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.00575280
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x57c407
lea eax, [ebp - 0x10c]
push eax
call fcn.00575280
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x597770
push edi
call fcn.00570120
add esp, 0x10
push edi
call fcn.00575280
push dword [esi + 0x59dd6c]
mov ebx, eax
call fcn.00575280
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00571390
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00575310
push edi
push ebx
call fcn.00575320
push 0x597750
push ebx
call fcn.00575320
push dword [esi + 0x59dd6c]
push ebx
call fcn.00575320
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0058001e
add esp, 0x2c
jmp 0x57c490
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x59dd6c]
push dword [esi]
call fcn.00575280
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.00578069
pop edi
pop esi
pop ebx
leave
ret
Function at 0x58001e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x5c49e0], ebx
push esi
push edi
jne 0x58009e
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x5800d9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x5c49e0], eax
je 0x5800d9
push 0x597ad8
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x5c49e4], eax
call esi
cmp dword [0x5c45a0], 2
mov dword [0x5c49e8], eax
jne 0x58009e
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x5c49f0], eax
je 0x58009e
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x5c49ec], eax
mov eax, dword [0x5c49ec]
test eax, eax
je 0x5800e3
call eax
test eax, eax
je 0x5800ca
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x5c49f0]
test eax, eax
je 0x5800ca
test byte [ebp - 8], 1
jne 0x5800e3
cmp dword [0x5c45ac], 4
jb 0x5800dd
or byte [ebp + 0x12], 0x20
jmp 0x580102
xor eax, eax
jmp 0x580112
or byte [ebp + 0x12], 4
jmp 0x580102
mov eax, dword [0x5c49e4]
test eax, eax
je 0x580102
call eax
mov ebx, eax
test ebx, ebx
je 0x580102
mov eax, dword [0x5c49e8]
test eax, eax
je 0x580102
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x5c49e0]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x580aae
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00571390
mov eax, dword [0x59daa0]
xor eax, dword [ebp + 4]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0057aad0
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x580bd8
push 2
push esi
push dword [ebp + 8]
call fcn.0057aad0
add esp, 0xc
cmp eax, ebx
je 0x580bd8
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x580b7b
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x100c]
push esi
push eax
call fcn.00574900
push 0x8000
push dword [ebp + 8]
call fcn.00580f51
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp edi, ebx
mov eax, ebx
jge 0x580b34
mov eax, edi
push eax
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0057abef
add esp, 0xc
cmp eax, 0xffffffff
je 0x580b54
sub edi, eax
test edi, edi
jg 0x580b2c
jmp 0x580b6c
call fcn.00576ab3
cmp dword [eax], 5
jne 0x580b69
call fcn.00576aaa
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00580f51
pop ecx
pop ecx
jmp 0x580bc3
jge 0x580bc3
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0057aad0
push dword [ebp + 8]
call fcn.0057ee60
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x580bc3
call fcn.00576aaa
mov dword [eax], 0xd
call fcn.00576ab3
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0057aad0
add esp, 0xc
mov eax, esi
pop edi
jmp 0x580bda
mov eax, ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.00578069
leave
ret
Function at 0x5819b5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x59daa0]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x581a30
push ebx
call fcn.0058197e
test eax, eax
pop ecx
jne 0x581a02
call fcn.00576ab3
mov dword [eax], 0xf
call fcn.00576aaa
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop ebx
call fcn.00578069
leave
ret
and byte [ebp + 0xb], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x581a42
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x5819f2
inc eax
cmp eax, 0x104
ja 0x5819f2
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x581a7a
cmp eax, dword [ebp + 0x10]
jg 0x581a5d
mov eax, dword [ebp + 0x10]
push eax
call fcn.00570098
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x581a8f
call fcn.00576aaa
mov dword [eax], 0xc
jmp 0x5819f2
cmp eax, dword [ebp + 0x10]
jle 0x581a8f
call fcn.00576aaa
mov dword [eax], 0x22
jmp 0x5819f2
lea eax, [ebp - 0x10c]
push eax
push ecx
call fcn.00575310
pop ecx
pop ecx
jmp 0x5819f4

Function at 0x581b15
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x581b35
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00576abc
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x581b58
test byte [esp + 8], 2
je 0x581b58
call fcn.00576aaa
mov dword [eax], 0xd
call fcn.00576ab3
mov dword [eax], 5
jmp 0x581b31
xor eax, eax
ret
Function at 0x419eb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4

Function at 0x41ad00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x461074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x41ada3
cmp byte [esi + 0x3d], 0
je 0x41ada3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x41ad59
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x41ad6b
sub eax, 1
je 0x41ad6f
sub eax, 2
je 0x41ada3
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438c59
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x41ad8c
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0043e9ce
add esp, 0x10
cmp edi, eax
jne 0x41ad59
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438c59
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00438c59
mov esp, ebp
pop ebp
ret
Function at 0x41f8a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x461074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x41f8d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438c59
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x41f90c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x41f90c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438c59
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x41f9f3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x41f934
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x41f967
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0043e079
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438c59
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x41f9f3
cmp eax, 1
jle 0x41f9c6
cmp eax, 3
jne 0x41f9f3
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.004015d0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438c59
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x41f9e3
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0043e9ce
add esp, 0x10
cmp edi, eax
jne 0x41f9f3
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x41f8f7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00438c59
mov esp, ebp
pop ebp
ret 4
Function at 0x420c50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x420d24
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x420d13
jg 0x420c88
test edx, edx
je 0x420d13
call fcn.0041b090
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x420cd8
jg 0x420c9e
test esi, esi
je 0x420cd8
cmp ebx, eax
jg 0x420cad
jl 0x420ca8
cmp edi, esi
jae 0x420cad
mov esi, edi
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [ebp + 8]
call fcn.0043a2f0
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [ebp + 8]
jmp 0x420cfa
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x420d0d
mov eax, dword [ebp + 8]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [ebp - 4]
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jg 0x420c88
jl 0x420d0d
test edi, edi
jne 0x420c88
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x420d43
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x420d45
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x420ded
jg 0x420d5f
test esi, esi
je 0x420ded
test eax, eax
jl 0x420d9e
jg 0x420d69
test ebx, ebx
je 0x420d9e
cmp edi, eax
jg 0x420d78
jl 0x420d73
cmp esi, ebx
jae 0x420d78
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0043a2f0
mov ecx, dword [ebp - 4]
add esp, 0xc
add dword [ebp + 8], ebx
sub esi, ebx
sbb edi, dword [ebp + 0x10]
mov eax, dword [ecx + 0x2c]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x420da4
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test edi, edi
jl 0x420ded
jg 0x420dae
test esi, esi
je 0x420ded
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x420ded
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x420dd9
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [ebp + 8]
call fcn.0043e361
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x420ed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x420f9e
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x420f8d
jg 0x420f08
test edx, edx
je 0x420f8d
call fcn.0041b3b0
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x420f56
jg 0x420f1e
test esi, esi
je 0x420f56
cmp ebx, eax
jg 0x420f2d
jl 0x420f28
cmp edi, esi
jae 0x420f2d
mov esi, edi
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.0043a2f0
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x420f7a
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x420f87
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp + 8], esi
test ebx, ebx
jg 0x420f08
jl 0x420f87
test edi, edi
jne 0x420f08
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x420fbd
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x420fbf
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x421038
jg 0x420fd1
test esi, esi
je 0x421038
test eax, eax
jl 0x421012
jg 0x420fdb
test ebx, ebx
je 0x421012
cmp edi, eax
jg 0x420fea
jl 0x420fe5
cmp esi, ebx
jae 0x420fea
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.0043a2f0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [ebp + 0x10]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x421015
mov edx, dword [ebp + 8]
test edi, edi
jl 0x421038
jg 0x42101f
test esi, esi
je 0x421038
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x421038
push eax
push esi
push 1
push edx
call fcn.0043e9ce
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x436970
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450e43
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x461074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x461f8c
push 0x401630
push 0x461f88
mov dword [ebp - 4], 0
mov dword [ebp - 0x270], 0
call fcn.00437664
add esp, 0xc
test eax, eax
je 0x436c1b
mov dword [ebp - 0x26c], 0x461f8c
xor eax, eax
mov dword [ebp - 0x238], 0x630065
mov dword [ebp - 0x234], 0x710072
mov dword [ebp - 0x230], 0x600071
mov dword [ebp - 0x22c], 0x3e007c
mov dword [ebp - 0x228], 0x7e0079
mov dword [ebp - 0x224], 0x100076
mov dword [ebp - 0x220], 0xb
mov dword [ebp - 0x21c], 0xc
nop dword [eax + eax]
xor word [ebp + eax*2 - 0x238], 0x10
inc eax
mov ecx, dword [ebp - 0x220]
cmp eax, ecx
jb 0x436a30
xor eax, eax
mov word [ebp + ecx*2 - 0x238], ax
lea ecx, [ebp - 0x238]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436a57
sub ecx, edx
mov dword [ebp - 0x258], 0
xor eax, eax
sar ecx, 1
mov word [ebp - 0x268], ax
lea eax, [ebp - 0x238]
push ecx
push eax
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x254], 7
call fcn.0041c280
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.00403f40
mov edx, dword [ebp - 0x254]
add esp, 0xc
cmp edx, 8
jb 0x436af4
mov ecx, dword [ebp - 0x268]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x436aea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436c20
push edx
push ecx
call fcn.00438c46
add esp, 8
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.0041d420
add esp, 8
test al, al
je 0x436b6a
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0043adf0
add esp, 0xc
lea edx, [ebp - 0x218]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
lea eax, [ebp - 0x250]
cmovae ecx, dword [ebp + 8]
cmp dword [ebp - 0x23c], 8
push 0
cmovae eax, dword [ebp - 0x250]
push 0
push 0x104
push edx
push 0x200
push 1
push ecx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfW]
test eax, eax
je 0x436b6a
mov bl, 1
jmp 0x436b6c
xor bl, bl
mov edx, dword [ebp - 0x23c]
cmp edx, 8
jb 0x436bac
mov ecx, dword [ebp - 0x250]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x436ba2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436c25
push edx
push ecx
call fcn.00438c46
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
cmp edx, 8
jb 0x436bff
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x436bf5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436c2a
push edx
push ecx
call fcn.00438c46
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438c59
mov esp, ebp
pop ebp
ret
call fcn.0043ed38
call fcn.0043d89c
call fcn.0043d89c
call fcn.0043d89c
int3
Function at 0x436c30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x9c0]
cmp eax, 0x270
jb 0x436cfc
xor eax, eax
nop word [eax + eax]
mov edx, dword [esi + eax*4 + 4]
xor edx, dword [esi + eax*4]
and edx, 0x7fffffff
xor edx, dword [esi + eax*4]
mov ecx, edx
shr edx, 1
and ecx, 1
xor edx, dword [ecx*4 + section..data]
xor edx, dword [esi + eax*4 + 0x634]
mov dword [esi + eax*4], edx
inc eax
cmp eax, 0xe3
jb 0x436c50
cmp eax, 0x26f
jae 0x436cc0
nop word [eax + eax]
mov edx, dword [esi + eax*4 + 4]
xor edx, dword [esi + eax*4]
and edx, 0x7fffffff
xor edx, dword [esi + eax*4]
mov ecx, edx
shr edx, 1
and ecx, 1
xor edx, dword [ecx*4 + section..data]
xor edx, dword [esi + eax*4 - 0x38c]
mov dword [esi + eax*4], edx
inc eax
cmp eax, 0x26f
jb 0x436c90
mov ecx, dword [esi + 0x9bc]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x9bc]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [eax*4 + section..data]
xor eax, dword [esi + 0x630]
xor eax, ecx
mov dword [esi + 0x9bc], eax
xor eax, eax
mov dword [esi + 0x9c0], 0
mov ecx, dword [esi + eax*4]
xor edx, edx
inc eax
mov dword [esi + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov esi, dword [ebp + 0xc]
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov ecx, dword [ebp + 0x10]
sub ecx, esi
inc ecx
div ecx
lea eax, [esi + edx]
pop esi
pop ebp
ret

Function at 0x436d40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
mov dword [eax], ecx
mov dword [eax + 0x9c0], 1
nop word [eax + eax]
mov esi, dword [eax + 0x9c0]
mov edx, dword [eax + esi*4 - 4]
shr edx, 0x1e
xor edx, dword [eax + esi*4 - 4]
imul ecx, edx, 0x6c078965
add ecx, esi
mov dword [eax + esi*4], ecx
inc dword [eax + 0x9c0]
cmp dword [eax + 0x9c0], 0x270
jb 0x436d60
pop esi
pop ebp
ret

Function at 0x444ae6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044495c

Function at 0x44a8c6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044a53f