joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42eba0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov al, byte [0x6e29fa]
sub esp, 8
test al, al
push esi
mov esi, dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
jne 0x42ebf7
push 0x6e25b0
call esi
cmp eax, 1
jne 0x42ebe9
push 0x6e2528
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
mov eax, dword [0x6e25b0]
mov ecx, dword [0x6e25b4]
mov dword [0x6e25e8], eax
mov dword [0x6e25ec], ecx
mov byte [0x6e29fb], 1
jmp 0x42ebf0
mov byte [0x6e29fb], 0
mov byte [0x6e29fa], 1
mov al, byte [0x6e29fb]
test al, al
je 0x42ec3b
push 0x6e25b0
call esi
mov edx, dword [0x6e25b0]
mov esi, dword [0x6e25e8]
mov eax, dword [0x6e25b4]
mov ecx, dword [0x6e25ec]
sub edx, esi
pop esi
sbb eax, ecx
mov dword [esp], edx
mov dword [esp + 4], eax
fild qword [esp]
fild qword [0x6e2528]
fdivp st(1)
add esp, 8
ret
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
fild qword [esp + 4]
pop esi
add esp, 8
ret

Function at 0x438980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x685400
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, ecx
mov al, byte [esi]
push 0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.004031c0
mov ecx, dword [0x6a3564]
push ecx
push 0
push esi
lea ecx, [esp + 0x14]
call fcn.00402fc0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], 0
test eax, eax
je 0x4389f7
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4389eb
lea ecx, [esp + 8]
call fcn.00408320
mov eax, dword [esp + 0xc]
jmp 0x4389f0
mov eax, 0x6a3560
push eax
call dword [sym.imp.user32.dll_CharLowerA]
mov eax, dword [0x6e25dc]
mov ecx, dword [0x6e25e0]
test eax, eax
jne 0x438a0b
mov eax, 0x6a3560
push ecx
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.004391c0
test eax, eax
jl 0x438a7a
mov edx, dword [0x6a3564]
mov eax, dword [0x6e25e0]
push edx
push eax
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
call fcn.00408170
mov ecx, dword [0x6a3564]
mov byte [esp + 0x30], 1
push ecx
push 0
push eax
lea ecx, [edi + 0x18]
call fcn.00402fc0
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x30], 0
test eax, eax
je 0x438a90
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x438a6f
cmp al, 0xff
je 0x438a6f
dec al
mov byte [ecx], al
jmp 0x438a90
push ecx
call fcn.006713a0
add esp, 4
jmp 0x438a90
mov edx, dword [0x6a3564]
lea eax, [esp + 8]
push edx
push 0
push eax
lea ecx, [edi + 0x18]
call fcn.00402fc0
mov ecx, dword [esp + 0xc]
pop edi
test ecx, ecx
mov dword [esp + 0x2c], 0xffffffff
pop esi
je 0x438acd
mov al, byte [ecx - 1]
test al, al
je 0x438ac3
cmp al, 0xff
je 0x438ac3
dec al
mov byte [ecx - 1], al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
dec ecx
push ecx
call fcn.006713a0
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x438ae0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x685418
push eax
mov dword fs:[0], esp
sub esp, 0x18
xor eax, eax
push ebx
push ebp
push esi
push edi
lea ebp, [ecx + 8]
mov edi, 0x6dfe28
or ecx, 0xffffffff
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
mov ecx, ebp
push ebx
call fcn.00403350
test al, al
je 0x438b41
mov edi, dword [ebp + 4]
mov ecx, ebx
mov eax, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov dword [ebp + 8], ebx
add eax, ebx
mov byte [eax], 0
mov eax, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x14]
push edi
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.kernel32.dll_ReadFile]
mov eax, dword [esp + 0x10]
cmp eax, edi
jle 0x438c1c
mov cl, byte [esp + 0x38]
lea esi, [eax + 1]
cmp esi, edi
mov byte [esp + 0x18], cl
mov eax, esi
jge 0x438b82
xor eax, eax
push eax
call fcn.00673b05
add esp, 4
mov ebx, eax
cmp esi, edi
mov dword [esp + 0x1c], ebx
jbe 0x438ba2
mov ecx, esi
cmp eax, edi
je 0x438b9e
mov byte [eax], 0
inc eax
dec ecx
jne 0x438b97
lea eax, [ebx + esi]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x14]
push edi
push edx
push eax
push ebx
push ecx
mov dword [esp + 0x44], edi
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
mov ecx, ebp
push esi
mov dword [esp + 0x40], esi
call fcn.00403350
test al, al
je 0x438c0b
mov edi, dword [ebp + 4]
mov ecx, esi
mov edx, ecx
mov esi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov ebp, dword [ebp + 4]
add ebp, eax
mov byte [ebp], 0
push ebx
mov dword [esp + 0x34], 0xffffffff
call fcn.006713a0
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x43b230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x685582
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004386f0
xor ebx, ebx
lea ecx, [esi + 0x94]
mov dword [esp + 0x14], ebx
call fcn.00411720
lea ecx, [esi + 0xbc]
mov byte [esp + 0x14], 1
call fcn.00411720
lea ecx, [esi + 0xe4]
mov byte [esp + 0x14], 2
call fcn.00411720
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0xc]
or al, 8
mov byte [esp + 0x14], 3
mov dword [esi + 4], eax
mov dword [esi], fcn.0043b3d0
mov eax, 0x3f800000
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x90], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x110], ebx
mov dword [esi + 0x10c], ebx
mov byte [esi + 0x114], bl
mov eax, esi
mov dword [esp + 0x14], 0xffffffff
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x43f7e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, ecx
push edi
call fcn.00438ae0
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x1c]
push 0x14
push ecx
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
cmp byte [esp + 0x14], 0x4e
jne 0x43f82c
cmp byte [esp + 0x15], 0x54
jne 0x43f82c
cmp byte [esp + 0x16], 0x46
jne 0x43f82c
cmp byte [esp + 0x17], 3
je 0x43f846
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x43f838
mov esi, 0x6a3560
push esi
push 0x6d3e84
call fcn.0044a330
add esp, 8
mov ebp, dword [esp + 0x20]
cmp ebp, 0x31545844
je 0x43f93f
cmp ebp, 0x32545844
je 0x43f93f
cmp ebp, 0x33545844
je 0x43f93f
cmp ebp, 0x34545844
je 0x43f93f
cmp ebp, 0x35545844
je 0x43f93f
xor edi, edi
cmp ebp, 0x19
je 0x43f8af
cmp ebp, 0x1a
je 0x43f8af
cmp ebp, 0x14
jne 0x43f89e
mov edi, 3
jmp 0x43f8b4
cmp ebp, 0x15
je 0x43f8a8
cmp ebp, 0x16
jne 0x43f8b4
mov edi, 4
jmp 0x43f8b4
mov edi, 2
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
test eax, eax
je 0x43f90d
cmp ecx, 4
jl 0x43f923
cmp esi, 4
jl 0x43f923
mov edx, esi
mov eax, ecx
imul edx, ecx
imul edx, edi
add ebx, edx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp ecx, 4
mov esi, eax
jge 0x43f8cb
mov eax, dword [esp + 0x2c]
push 1
push 0
push ebx
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret 4
imul edi, esi
imul edi, ecx
cmp ecx, 0x200
mov ebx, edi
jl 0x43f923
add ebx, 0x20000
mov eax, dword [esp + 0x2c]
push 1
push 0
push ebx
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret 4
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
xor edi, edi
test eax, eax
mov ecx, ebx
je 0x43f9d0
cmp ebx, 4
jl 0x43f991
cmp esi, 4
jl 0x43f991
cmp ebp, 0x31545844
jne 0x43f973
mov eax, esi
imul eax, ecx
cdq
sub eax, edx
sar eax, 1
add edi, eax
jmp 0x43f97a
mov edx, esi
imul edx, ecx
add edi, edx
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp ecx, 4
mov esi, eax
jge 0x43f958
mov eax, ebx
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x1c]
cdq
sub eax, edx
mov esi, eax
sar ecx, 1
sar esi, 1
cmp ecx, 4
jl 0x43f9fd
cmp esi, 4
jl 0x43f9fd
mov eax, esi
imul eax, ecx
lea edi, [edi + eax*2]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp ecx, 4
mov esi, eax
jge 0x43f9aa
jmp 0x43f9fd
cmp ebp, 0x31545844
mov ecx, esi
jne 0x43f9e6
imul ecx, ebx
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
jmp 0x43f9ec
imul ecx, ebx
lea eax, [ecx + ecx]
cmp ebx, 0x400
lea edi, [eax + ecx*2]
jl 0x43f9fd
add edi, 0x20000
mov ecx, dword [esp + 0x2c]
push 1
push 0
push edi
push ecx
call dword [sym.imp.kernel32.dll_SetFilePointer]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret 4
Function at 0x43fd00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
push ebx
mov ebx, dword [esp + 0x38]
push ebp
push esi
mov eax, dword [ebx + 8]
push edi
test eax, eax
mov esi, ecx
jbe 0x43fe8c
mov eax, dword [esi + 0x48]
test eax, eax
je 0x43fe8c
mov eax, dword [ebx + 4]
mov dword [esp + 0x44], 0
test eax, eax
jne 0x43fd37
mov eax, 0x6a3560
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x43fe8c
mov eax, dword [ebx + 8]
mov ebp, dword [sym.imp.kernel32.dll_WriteFile]
lea ecx, [esp + 0x44]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push edi
mov dword [esp + 0x24], eax
call ebp
mov ecx, dword [esp + 0x10]
test ecx, ecx
jle 0x43fd9b
mov ebx, dword [ebx + 4]
mov eax, 0x6a3560
test ebx, ebx
je 0x43fd8f
mov eax, ebx
lea edx, [esp + 0x44]
push 0
push edx
push ecx
push eax
push edi
call ebp
mov eax, dword [esi + 0x48]
lea edx, [esp + 0x20]
push edx
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38]
mov eax, dword [esp + 0x20]
mov edx, 0x19
cmp eax, edx
jne 0x43fe85
mov eax, dword [esp + 0x3c]
mov ecx, 0x20
cmp eax, ecx
jne 0x43fe85
cmp dword [esp + 0x38], ecx
jne 0x43fe85
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
xor ebx, ebx
lea ecx, [esp + 0x44]
push ebx
lea eax, [esi + 0x2c]
push ecx
push 0x14
push eax
push edi
mov byte [eax], 0x4e
mov byte [esi + 0x2d], 0x54
mov byte [esi + 0x2e], 0x46
mov byte [esi + 0x2f], 4
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], ebx
call ebp
lea edx, [esp + 0x44]
push ebx
push edx
lea eax, [esi + 0x40]
push 8
push eax
push edi
call ebp
mov eax, dword [esi + 0x48]
lea edx, [esp + 0x20]
push edx
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38]
mov eax, dword [esi + 0x48]
push ebx
lea edx, [esp + 0x1c]
push ebx
mov ecx, dword [eax]
push edx
push ebx
push eax
call dword [ecx + 0x40]
mov eax, dword [esp + 0x3c]
test eax, eax
mov dword [esp + 0x14], eax
jle 0x43fe67
lea eax, [esp + 0x44]
mov ecx, dword [esp + 0x38]
push 0
push eax
mov eax, dword [esp + 0x20]
lea edx, [ecx + ecx]
imul eax, ebx
push edx
mov edx, dword [esp + 0x28]
add eax, edx
push eax
push edi
call ebp
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jl 0x43fe3e
mov esi, dword [esi + 0x48]
push 0
push esi
mov ecx, dword [esi]
call dword [ecx + 0x44]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x30
ret 4
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x30
ret 4
Function at 0x442490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x685954
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004386f0
mov al, byte [esp + 0xf]
xor ebp, ebp
mov dword [esp + 0x2c], ebp
mov byte [esi + 0xe8], al
mov dword [esi + 0xec], ebp
mov dword [esi + 0xf0], ebp
mov dword [esi + 0xf4], ebp
lea ecx, [esi + 0xf8]
mov byte [esp + 0x2c], 1
call fcn.004415d0
mov eax, dword [esi + 4]
mov byte [esp + 0x2c], 2
or ah, 8
mov dword [esi], 0x6a3e80
mov dword [esi + 4], eax
mov eax, 0x3f800000
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], ebp
lea edx, [esi + 0x7c]
mov dword [esi + 0x74], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x38], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esi + 0x70], ebp
mov dword [esi + 0x6c], ebp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x64], ebp
mov dword [esi + 0x5c], ebp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x54], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x44], ebp
mov dword [esi + 0x40], ebp
mov dword [esi + 0x3c], ebp
mov ecx, 0x17
xor eax, eax
mov edi, edx
mov dword [esi + 0x78], 1
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
mov ecx, edx
mov dword [edx + 0x44], 4
mov dword [edx + 0x48], ebp
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov dword [edx + 0x4c], 2
mov dword [edx + 0x50], ebp
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [edx + 0x54], 5
mov dword [edx + 0x58], 6
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 0xc], eax
mov ecx, dword [edx + 0xc]
fld dword [edx]
fmul dword [0x6a36f0]
mov dword [edx + 0x1c], ecx
fstp dword [edx + 0x10]
fld dword [edx + 4]
fmul dword [0x6a36f0]
fstp dword [edx + 0x14]
fld dword [edx + 8]
fmul dword [0x6a36f0]
fstp dword [edx + 0x18]
mov dword [esi + 0xd8], 0x41200000
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x124], ebp
mov dword [esi + 0xdc], ebp
mov dword [esi + 0xe4], ebp
mov dword [esi + 0xe0], ebp
mov eax, esi
pop edi
mov dword [esp + 0x28], 0xffffffff
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x44a130
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov eax, dword [0x792a24]
sub esp, 0x418
test eax, eax
jne 0x44a144
mov eax, 0x6a3560
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x44a196
mov eax, dword [0x792a24]
test eax, eax
jne 0x44a176
mov eax, 0x6a3560
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x44a31e
test esi, esi
je 0x44a31e
push ebx
push ebp
push 2
push 0
push 0
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov ecx, dword [esp + 0x22]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1e]
and ecx, 0xffff
push ecx
mov ecx, dword [esp + 0x1e]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x38]
push 0x6d4038
push edx
mov dword [esp + 0x2c], 0
call fcn.0067429f
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
xor edi, edi
mov dword [esp + 0x10], eax
test eax, eax
mov ebx, 0x816
jle 0x44a243
mov cl, byte [esp + edi + 0x28]
xor edx, edx
mov dl, bh
xor dl, cl
xor cx, cx
mov cl, dl
mov byte [esp + edi + 0x28], dl
add ecx, ebx
lea ebx, [ecx + ecx*2]
shl ebx, 6
add ebx, ecx
shl ebx, 7
inc edi
cmp edi, eax
lea ebx, [ebx + ecx + 0x1608]
jl 0x44a217
mov ebp, dword [sym.imp.kernel32.dll_WriteFile]
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push esi
call ebp
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0
push eax
lea edx, [esp + 0x30]
push ecx
push edx
push esi
call ebp
mov eax, dword [esp + 0x22]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1e]
and eax, 0xffff
push eax
mov eax, dword [esp + 0x1e]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x38]
push 0x6d3fe8
push ecx
call fcn.0067429f
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.kernel32.dll_lstrlenA]
xor edi, edi
mov dword [esp + 0x10], eax
test eax, eax
mov ebx, 0x816
jle 0x44a2f0
mov cl, byte [esp + edi + 0x28]
xor edx, edx
mov dl, bh
xor dl, cl
xor cx, cx
mov cl, dl
mov byte [esp + edi + 0x28], dl
add ecx, ebx
lea ebx, [ecx + ecx*2]
shl ebx, 6
add ebx, ecx
shl ebx, 7
inc edi
cmp edi, eax
lea ebx, [ebx + ecx + 0x1608]
jl 0x44a2c4
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push esi
call ebp
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
push esi
call ebp
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x418
ret
Function at 0x44a330
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov eax, dword [0x792a28]
sub esp, 8
test eax, eax
push esi
push edi
je 0x44a4ca
mov eax, dword [esp + 0x14]
test eax, eax
je 0x44a4ca
push 0x792e30
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov eax, dword [0x792e3c]
mov edx, dword [0x792e38]
xor ecx, ecx
and eax, 0xffff
mov cx, word [0x792e3a]
push eax
and edx, 0xffff
push ecx
push edx
push 0x6d406c
push 0x792a30
mov byte [0x792a30], 0
mov dword [esp + 0x20], 0
call fcn.0067429f
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
push ecx
push 0x792e40
mov byte [0x792e40], 0
call fcn.00674a68
mov esi, dword [sym.imp.kernel32.dll_lstrcatA]
add esp, 0x20
push 0x792e40
push 0x792a30
call esi
push 0x6d4068
push 0x792a30
call esi
push 0x792a30
call dword [sym.imp.kernel32.dll_lstrlenA]
mov dword [esp + 8], eax
mov eax, dword [0x792a24]
test eax, eax
jne 0x44a3f2
mov eax, 0x6a3560
mov edi, dword [sym.imp.kernel32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x44a442
mov eax, dword [0x792a24]
test eax, eax
jne 0x44a422
mov eax, 0x6a3560
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x44a4ca
test esi, esi
je 0x44a4ca
push ebp
push 2
push 0
push 0
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov ebp, dword [esp + 0xc]
xor edi, edi
test ebp, ebp
mov edx, 0x816
jle 0x44a497
mov al, byte [edi + 0x792a30]
xor ecx, ecx
mov cl, dh
xor cl, al
xor ax, ax
mov al, cl
mov byte [edi + 0x792a30], cl
add eax, edx
lea edx, [eax + eax*2]
shl edx, 6
add edx, eax
shl edx, 7
inc edi
cmp edi, ebp
lea edx, [edx + eax + 0x1608]
jl 0x44a467
mov edi, dword [sym.imp.kernel32.dll_WriteFile]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x14]
push 4
push ecx
push esi
call edi
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push 0
push edx
push eax
push 0x792a30
push esi
call edi
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop ebp
pop edi
pop esi
add esp, 8
ret
Function at 0x44c7a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x685be3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004386f0
mov cl, byte [esp + 7]
xor eax, eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x2c], cl
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0xc]
or eax, 0x20000
mov byte [esp + 0x14], 1
mov dword [esi], 0x6a3f98
mov dword [esi + 4], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x44ccc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x685c6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea edi, [esi + 4]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov byte [edi + 4], al
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dl, byte [esp + 0xf]
mov al, byte [esp + 0xf]
lea ecx, [edi + 0x14]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ecx
mov byte [ecx], dl
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.0044e1e0
mov byte [esp + 0x24], 2
mov dword [edi], 0x6a3fb8
mov cl, byte [esp + 0xf]
mov dword [esp + 0x24], 3
push 0xc
mov byte [esi + 0x2c], cl
call fcn.00673b05
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
mov dl, byte [esp + 0x13]
mov byte [esp + 0x28], 4
push 0xc
mov byte [esi + 0x38], dl
call fcn.00673b05
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 8
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
mov ecx, dword [esp + 0x1c]
mov al, 1
mov byte [esp + 0x24], 5
mov byte [esi + 0x2a], al
mov byte [esi + 0x29], al
mov dword [esi], 0x6a3fb4
mov byte [esi + 0x28], bl
mov byte [esi + 0x2b], bl
mov eax, esi
pop edi
mov dword [esp + 0x20], 0xffffffff
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret