joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4223f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x405408], 0
push ebx
push esi
push edi
je 0x422618
pushal
call 0x422411
pop ebp
mov ebx, dword [ebp + 0x3ae]
add ecx, 0x414d484f
mov dword [esp + 0x20], ebx
mov eax, dword [ebp + 0x3ea]
cmp eax, 0
jne 0x42243c
mov eax, dword [ebp + 0x3ee]
cmp eax, 0
je 0x4225a3
lea edx, [ebp + 0x33a]
push edx
call dword [eax]
mov esi, eax
mov eax, dword [ebp + 0x3f2]
test eax, eax
jne 0x422471
lea eax, [ebp + 0x347]
push eax
push esi
call fcn.004225a5
test eax, eax
je 0x4225a3
lea ebx, [ebp + 0x3ee]
mov dword [ebx], eax
mov dword [ebx + 4], ebx
lea eax, [ebp + 0x356]
call fcn.00422609
mov dword [ebp + 0x300], eax
lea eax, [ebp + 0x36a]
call fcn.00422609
mov dword [ebp + 0x304], eax
lea eax, [ebp + 0x376]
call fcn.00422609
mov dword [ebp + 0x308], eax
lea eax, [ebp + 0x380]
call fcn.00422609
mov dword [ebp + 0x30c], eax
lea eax, [ebp + 0x38c]
call fcn.00422609
mov dword [ebp + 0x310], eax
push 0x100
lea eax, [ebp + 0x380]
push eax
call dword [ebp + 0x300]
lea eax, [ebp + 0x380]
cmp byte [eax], 0
je 0x4224e6
inc eax
jmp 0x4224de
mov byte [eax], 0x5c
inc eax
lea edx, [ebp + 0x39b]
mov cl, byte [edx]
cmp cl, 0
je 0x4224fd
mov byte [eax], cl
inc eax
inc edx
jmp 0x4224f0
mov byte [eax], 0
xor edx, edx
push edx
push 0x20
push 2
push edx
push edx
push 0x40000000
lea eax, [ebp + 0x380]
push eax
call dword [ebp + 0x304]
cmp eax, 0xffffffff
je 0x422571
mov edx, eax
push eax
mov ecx, dword [ebp + 0x3f6]
lea eax, [ebp + 0x3fa]
sub eax, ecx
add eax, 0x800
mov ecx, 0x400
mov bl, byte [eax]
xor bl, 0xff
mov byte [eax], bl
inc eax
loop 0x42253b
xor ecx, ecx
push ecx
lea eax, [ebp + 0x35c]
push eax
mov ecx, dword [ebp + 0x3f6]
push ecx
lea eax, [ebp + 0x3fa]
sub eax, ecx
add eax, 0x800
push eax
push edx
call dword [ebp + 0x308]
call dword [ebp + 0x30c]
xor edx, edx
lea eax, [ebp + 0x33a]
push eax
lea eax, [ebp + 0x33b]
push eax
mov cl, 0x43
inc eax
mov byte [eax], dl
dec cl
jne 0x422583
mov byte [eax - 0x14], 0x80
push edx
push edx
push 0x20
push edx
push edx
push edx
push edx
lea eax, [ebp + 0x380]
push eax
call dword [ebp + 0x310]
popal
ret
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4225a5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
mov edx, dword [esp + 0x10]
sub eax, eax
mov edx, dword [edx + 0x3c]
add edx, dword [esp + 0x10]
mov edx, dword [edx + 0x78]
add edx, dword [esp + 0x10]
mov ecx, dword [edx + 0x18]
jecxz 0x422603
mov edi, dword [edx + 0x20]
add edi, dword [esp + 0x10]
mov ebx, dword [edi]
add edi, 4
add ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov al, byte [ebx]
mov ah, byte [esi]
or ah, al
je 0x4225eb
cmp al, byte [esi]
jne 0x4225e5
inc esi
inc ebx
jmp 0x4225d5
loop 0x4225c8
sub eax, eax
jmp 0x422603
mov eax, dword [edx + 0x18]
sub eax, ecx
mov ecx, dword [edx + 0x24]
add ecx, dword [esp + 0x10]
movzx eax, word [ecx + eax*2]
mov eax, dword [edx + eax*4 + 0x28]
add eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
ret 8
Function at 0x42539a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
mov edx, dword [esp + 0x10]
sub eax, eax
mov edx, dword [edx + 0x3c]
add edx, dword [esp + 0x10]
mov edx, dword [edx + 0x78]
add edx, dword [esp + 0x10]
mov ecx, dword [edx + 0x18]
jecxz 0x4253f8
mov edi, dword [edx + 0x20]
add edi, dword [esp + 0x10]
mov ebx, dword [edi]
add edi, 4
add ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov al, byte [ebx]
mov ah, byte [esi]
or ah, al
je 0x4253e0
cmp al, byte [esi]
jne 0x4253da
inc esi
inc ebx
jmp 0x4253ca
loop 0x4253bd
sub eax, eax
jmp 0x4253f8
mov eax, dword [edx + 0x18]
sub eax, ecx
mov ecx, dword [edx + 0x24]
add ecx, dword [esp + 0x10]
movzx eax, word [ecx + eax*2]
mov eax, dword [edx + eax*4 + 0x28]
add eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
ret 8
Function at 0x4122b0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x53acb0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x41233c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x41233c
cmp ebx, 0x15f90
jl 0x412333
cmp ebx, 0x1d4c0
jge 0x412310
mov eax, 0x32
jmp 0x412335
cmp ebx, 0x2bf20
jge 0x41231f
mov eax, 0x64
jmp 0x412335
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x412335
mov eax, 0xfa
jmp 0x412335
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x412350
inc ebx
cmp ebx, 0x57e40
jl 0x4122c8
mov eax, dword [ebp - 4]
test eax, eax
je 0x41236a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.004319a0
add esp, 4
mov eax, dword [0x53acb4]
test eax, eax
jne 0x4123a0
cmp dword [0x4f7260], 1
je 0x412424
xor ebx, ebx
xor esi, esi
cmp dword [0x53acac], 0
je 0x4123e4
mov dword [0x53acb4], 1
cmp dword [0x4f7260], 1
je 0x4123cf
mov dword [0x53acb0], 0
push dword [0x53aca8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x412442
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00470680
push ebx
push 0x16
call fcn.00470680
add esp, 0x10
jmp 0x4123a0
mov dword [0x53acac], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x53aca8], eax
cmp eax, 0xffffffff
jne 0x412408
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x41238d
push 0x412240
call fcn.004710a0
push 0x412200
call fcn.004710a0
add esp, 8
jmp 0x41238d
push 1
push 2
call fcn.00470680
mov esi, eax
push 1
push 0x16
call fcn.00470680
add esp, 0x10
mov ebx, eax
jmp 0x412384
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.004319e0
add esp, 0xc
test eax, eax
je 0x41246c
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x4f71bc]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x4f71b8]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x4f71b4]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x4f71b0]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x412474
push dword [ebp - 0x10]
push dword [0x53aca8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x10]
jmp 0x4123be
Function at 0x4124c0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x53acb0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x41254c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x41254c
cmp ebx, 0x15f90
jl 0x412543
cmp ebx, 0x1d4c0
jge 0x412520
mov eax, 0x32
jmp 0x412545
cmp ebx, 0x2bf20
jge 0x41252f
mov eax, 0x64
jmp 0x412545
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x412545
mov eax, 0xfa
jmp 0x412545
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x412560
inc ebx
cmp ebx, 0x57e40
jl 0x4124d8
mov eax, dword [ebp - 4]
test eax, eax
je 0x41257a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.004319a0
add esp, 4
mov eax, dword [0x53acb4]
test eax, eax
jne 0x4125b0
cmp dword [0x4f7260], 1
je 0x412649
xor ebx, ebx
xor esi, esi
cmp dword [0x53acac], 0
je 0x412606
mov dword [0x53acb4], 1
cmp dword [0x4f7260], 1
je 0x4125f1
mov dword [0x53acb0], 0
push dword [0x53aca8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x412687
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp dword [0x4f7260], 1
je 0x412667
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00470680
push ebx
push 0x16
call fcn.00470680
add esp, 0x10
jmp 0x4125b0
mov dword [0x53acac], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x53aca8], eax
cmp eax, 0xffffffff
jne 0x41262d
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x41259d
push 0x412240
call fcn.004710a0
push 0x412200
call fcn.004710a0
add esp, 8
jmp 0x41259d
push 1
push 2
call fcn.00470680
mov esi, eax
push 1
push 0x16
call fcn.00470680
add esp, 0x10
mov ebx, eax
jmp 0x412594
push 1
push 2
call fcn.00470680
push 1
push 0x16
mov dword [ebx + 0x64], eax
call fcn.00470680
add esp, 0x10
mov dword [ebx + 0x68], eax
jmp 0x4125e5
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.004319e0
add esp, 0xc
test eax, eax
je 0x4126ae
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x4f71bc]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x4f71b8]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x4f71b4]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x4f71b0]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x4126b6
push dword [ebp - 0x10]
push dword [0x53aca8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp - 0x10]
jmp 0x4125d3
Function at 0x418d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x418d25
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x418d53
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x418dc8
mov ecx, 1
jmp 0x418dc8
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x418d63
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x418d92
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x418dc8
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x418da4
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x418db5
mov dword [ebp - 4], esi
test esi, esi
jne 0x418db9
jmp 0x418dbd
test esi, esi
je 0x418dbd
test eax, eax
ja 0x418d6b
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x418e28
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x41c4c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x41c4e5
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x41c513
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x41c588
mov ecx, 1
jmp 0x41c588
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x41c523
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41c552
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x41c588
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x41c564
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x41c575
mov dword [ebp - 4], esi
test esi, esi
jne 0x41c579
jmp 0x41c57d
test esi, esi
je 0x41c57d
test eax, eax
ja 0x41c52b
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x41c5e8
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x427360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x427385
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x4273b3
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x427428
mov ecx, 1
jmp 0x427428
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x4273c3
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4273f2
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x427428
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x427404
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x427415
mov dword [ebp - 4], esi
test esi, esi
jne 0x427419
jmp 0x42741d
test esi, esi
je 0x42741d
test eax, eax
ja 0x4273cb
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x427488
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x42c670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x42c695
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x42c6c3
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x42c738
mov ecx, 1
jmp 0x42c738
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x42c6d3
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42c702
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x42c738
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x42c714
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x42c725
mov dword [ebp - 4], esi
test esi, esi
jne 0x42c729
jmp 0x42c72d
test esi, esi
je 0x42c72d
test eax, eax
ja 0x42c6db
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x42c798
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x42e7e0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x4317d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x7c]
test esi, esi
mov dword [ebp - 0xc], edi
je 0x43198c
mov edx, dword [0x4f7260]
mov edi, dword [esi + 0x14]
lea eax, [edi*4]
shl edi, 5
sub edi, eax
cmp edx, 2
lea ebx, [edi + 0x53f7e8]
jge 0x43181f
mov eax, dword [ebx]
test eax, eax
jne 0x431860
mov dword [edi + 0x53f7e8], 1
jmp 0x431860
push ebx
call fcn.00412750
add esp, 4
test eax, eax
jne 0x43185a
cmp dword [edi + 0x53f7e4], 0
je 0x43196c
mov dword [edi + 0x53f7e8], 0
push 0xffffffffffffffff
push dword [edi + 0x53f7e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.00412750
add esp, 4
mov edx, dword [0x4f7260]
cmp edx, 1
je 0x431958
mov eax, dword [esi + 0x18]
dec eax
mov dword [esi + 0x18], eax
test eax, eax
jle 0x4318cf
mov eax, dword [0x4f7260]
cmp eax, 1
je 0x4318b4
cmp eax, 2
jge 0x43188f
mov dword [edi + 0x53f7e8], 0
jmp 0x4318a5
mov dword [edi + 0x53f7e8], 0
push dword [edi + 0x53f7e4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push dword [edi + 0x53f7f8]
push dword [edi + 0x53f7f4]
call fcn.00412730
add esp, 8
mov eax, dword [0x4f7260]
jmp 0x43187e
mov edx, dword [esi]
test edx, edx
je 0x4318db
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4318e6
mov dword [eax], edx
jmp 0x4318ec
mov dword [edi + 0x53f7e0], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x7c], 0
mov eax, dword [0x4f7260]
cmp eax, 1
je 0x43193d
cmp eax, 2
jge 0x431911
mov dword [edi + 0x53f7e8], 0
jmp 0x431927
mov dword [edi + 0x53f7e8], 0
push dword [edi + 0x53f7e4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.00431aa0
push esi
call fcn.00431aa0
add esp, 8
jmp 0x4318a5
push dword [edi + 0x53f7f8]
push dword [edi + 0x53f7f4]
call fcn.00412730
add esp, 8
mov eax, dword [0x4f7260]
jmp 0x431900
lea eax, [edi + 0x53f7f4]
push eax
call fcn.00412700
add esp, 4
jmp 0x431869
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0x53f7e4], eax
mov dword [edi + 0x53f7e8], 0
jmp 0x431843
xor eax, eax
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4319a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.00445d10
mov ebx, dword [ebp + 8]
cmp dword [0x5454e0], 0
jne 0x4319c7
test ebx, ebx
je 0x4319bc
mov eax, dword [ebx]
jmp 0x4319be
xor eax, eax
push eax
call fcn.00474250
add esp, 4
test ebx, ebx
je 0x4319cf
mov eax, dword [ebx]
jmp 0x4319d1
xor eax, eax
push eax
call fcn.004c5610
add esp, 4
jmp 0x4319b4
Function at 0x43ba20
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]

Function at 0x43ba2c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], edi
mov edx, eax
mov dword [ecx], 0
cmp dword [0x5454e0], 0
je 0x43bb03
cmp dword [ebp + 0x20], 2
je 0x43ba63
cmp dword [ebp + 0x20], 1
jne 0x43ba72
mov eax, 0xffffffff
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x43ba82
cmp dword [ebp + 0x20], 0xfffffffa
je 0x43bbc8
cmp dword [ebp + 0x20], 0
je 0x43bbd4
xor ecx, ecx
xor edi, edi
cmp dword [ebp + 0x18], 0
je 0x43bab7
cmp dword [ebp + 0x1c], 0
je 0x43bab7
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
call fcn.004c53c0
push edi
call fcn.004c5530
mov edx, dword [ebp - 0x10]
add esp, 8
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x43bb03
push edi
push esi
push ebx
call fcn.004c5460
add esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [eax], esi
je 0x43bbf8
push 0
push edi
push 2
push 0x4ddfa4
call fcn.004c5420
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov eax, 1
mov byte [esi + ebx], 0xa
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
inc dword [edx]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x24]
test ecx, ecx
mov edx, dword [ebp - 0x10]
mov dword [edi], 0
je 0x43bb2b
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x43bb30
mov edi, 0x20000
cmp esi, edi
jbe 0x43bba4
cmp dword [ebp + 0x20], 0
je 0x43bba4
test ecx, ecx
je 0x43bb48
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x43bb4d
mov edi, 0x20000
mov dword [ebp - 0x10], edx
push 0
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43bb92
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
add ebx, edx
sub esi, edx
add dword [ecx], edx
cmp dword [ebp + 0x24], 0
je 0x43bb87
mov edx, dword [ebp + 0x24]
mov edx, dword [edx + 0x13c]
test edx, edx
jne 0x43bb8c
mov edx, 0x20000
cmp esi, edx
ja 0x43bb92
mov edi, esi
test esi, esi
je 0x43bbbb
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
jne 0x43bbbb
test eax, eax
jne 0x43bb50
jmp 0x43bbbb
push 0
lea ecx, [ebp - 0x18]
push ecx
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edi, edx
mov ecx, 1
jmp 0x43ba96
mov dword [ebp - 0x10], edx
call fcn.004c5650
mov edx, dword [ebp - 0x10]
mov edi, eax
cmp dword [0x5454e0], 0
je 0x43babb
mov ecx, 1
jmp 0x43ba90
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4420f0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]