joyce8/EMBER2024-capa huggingface dataset:
Function at 0x522230
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor dl, dl
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x52244f
push ebx
mov eax, ecx
push edi
cmp eax, 0x7c
je 0x52244d
cmp eax, 0x29
jne 0x522273
cmp dword [esi + 0x10], 0
jne 0x52244d
cmp eax, eax
jne 0x522273
test dword [esi + 0x50], 0x10000000
je 0x52245c
jmp 0x522404
cmp eax, 0x2e
jne 0x5222d4
push 5
lea ecx, [esi + 0x24]
call main
mov ecx, dword [esi]
mov edx, dword [esi + 8]
cmp ecx, edx
je 0x5222c8
cmp word [ecx], 0x5c
jne 0x5222c3
lea eax, [ecx + 2]
cmp eax, edx
je 0x5222c3
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x5222ad
movzx edi, word [eax]
cmp edi, 0x28
je 0x5222bf
cmp edi, 0x29
je 0x5222bf
test dl, 0x10
jne 0x5222c3
movzx edx, word [eax]
cmp edx, 0x7b
je 0x5222bf
cmp edx, 0x7d
jne 0x5222c3
mov dword [esi], eax
mov ecx, eax
lea eax, [ecx + 2]
mov dword [esi], eax
mov ecx, esi
call fcn.00524460
jmp 0x522436
cmp eax, 0x5c
jne 0x522333
mov ecx, esi
call fcn.005242c0
test byte [esi + 0x50], 0x80
je 0x522327
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x522305
push 4
lea ecx, [esi + 0x24]
call main
mov ecx, esi
call fcn.005242c0
jmp 0x52243d
cmp eax, 0x42
jne 0x522327
push 4
lea ecx, [esi + 0x24]
call main
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.005242c0
jmp 0x52243d
mov ecx, esi
call main
jmp 0x522436
cmp eax, 0x5b
jne 0x522394
mov ecx, esi
call fcn.005242c0
lea ecx, [esi + 0x24]
call main
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x522360
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.005242c0
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x52237e
cmp eax, 0x5d
jne 0x52237e
push eax
lea ecx, [esi + 0x24]
call main
mov ecx, esi
call fcn.005242c0
mov ecx, esi
call fcn.00522b80
cmp dword [esi + 0x4c], 0x5d
jne 0x522465
jmp 0x52242f
cmp eax, 0x28
jne 0x5223c0
mov ecx, esi
call fcn.005242c0
mov ecx, esi
call fcn.00524610
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x52245c
mov ecx, esi
call fcn.005242c0
test bl, bl
je 0x52243d
jmp 0x522436
cmp eax, 0x5e
jne 0x5223d8
push 2
lea ecx, [esi + 0x24]
call main
mov ecx, esi
call fcn.005242c0
jmp 0x52243d
cmp eax, 0x24
jne 0x5223f0
push 3
lea ecx, [esi + 0x24]
call main
mov ecx, esi
call fcn.005242c0
jmp 0x52243d
cmp eax, 0x2a
je 0x522453
cmp eax, 0x2b
je 0x522453
cmp eax, 0x3f
je 0x522453
cmp eax, 0x7b
je 0x522453
cmp ecx, 0x7d
jne 0x522414
test dword [esi + 0x50], 0x10000000
je 0x52246e
jmp 0x522422
cmp ecx, 0x5d
jne 0x522422
test dword [esi + 0x50], 0x10000000
je 0x522465
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call main
mov ecx, esi
call fcn.005242c0
mov ecx, esi
call main
mov ecx, dword [esi + 0x4c]
mov dl, 1
mov eax, ecx
cmp ecx, 0xffffffff
jne 0x522245
pop edi
pop ebx
mov al, dl
pop esi
ret
push 0xa
mov ecx, esi
call main
push 5
mov ecx, esi
call main
push 4
mov ecx, esi
call main
push 6
mov ecx, esi
call main
int3
Function at 0x524760
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x811c9dc5
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
sub edi, ecx
xor esi, esi
and edi, 0xfffffffe
lea edx, [edi + ecx]
cmp ecx, edx
cmova edi, ebx
test edi, edi
je 0x524799
movzx edx, byte [ecx]
lea ecx, [ecx + 1]
xor edx, eax
inc esi
imul eax, edx, 0x1000193
cmp esi, edi
jne 0x524786
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x407180
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4071bf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4071bf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4071bf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4071bf
cmp dword [ecx + 0x74], 0xe
jbe 0x4071bf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40cd13
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40cdb0
push ebx
push esi
call fcn.0040ccdc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040cc70
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40cd5d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40cdaf
push edi
push eax
call fcn.0040d930
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40cd7d
call fcn.0040b7d1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40cdae
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040cc70
add esp, 0x20
test eax, eax
jne 0x40cd9c
push edi
call fcn.0040b7d1
jmp 0x40cda4
push ebx
call fcn.0040b7d1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40e0b0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x468c28
push 0x468c20
push str.FlsAlloc
push 0x1f
call fcn.0040df6c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40e0e4
push dword [ebp + 8]
mov ecx, esi
call dword [0x417174]
call esi
jmp 0x40e0ea
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40e12e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x468c38
push 0x468c30
push str.FlsGetValue
push 0x21
call fcn.0040df6c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40e165
push dword [ebp + 8]
mov ecx, esi
call dword [0x417174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40e16d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x468c40
push 0x468c38
push str.FlsSetValue
push 0x22
call fcn.0040df6c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40e1a7
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x417174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x413600
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41362d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41362d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401782
Capabilities:
Shutdown system
Terminate process

Disassembly:
mov eax, ecx
push esi
push edi
xor ecx, ecx
mov dx, word [eax]
xor edi, edi
test dx, dx
je 0x4017ca
mov esi, 0x40a020
cmp dx, 0x20
jne 0x4017a1
test edi, edi
je 0x4017ca
cmp dx, 0x22
jne 0x4017b2
xor edx, edx
test edi, edi
sete dl
mov edi, edx
jmp 0x4017c0
cmp esi, 0x40a22e
jae 0x4017d6
mov word [esi], dx
inc ecx
inc esi
inc esi
inc eax
inc eax
mov dx, word [eax]
test dx, dx
jne 0x401797
and word [ecx*2 + 0x40a020], 0
pop edi
pop esi
ret
push 1
call dword [sym.imp.MSVCRT.dll_exit]
Function at 0x4023a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [0xa345c635], al
and al, 0xc6
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.00401fc2
push eax
push esi
push dword [ebp + 8]
call fcn.00401f77
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x40244d
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00401fc2
push eax
push esi
push dword [ebp + 8]
call fcn.00401f77
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00401fb2
invalid

Function at 0x4023f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [0xa345c635], al
and al, 0xc6
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.00401fc2
push eax
push esi
push dword [ebp + 8]
call fcn.00401f77
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x40244d
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00401fc2
push eax
push esi
push dword [ebp + 8]
call fcn.00401f77
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00401fb2
invalid

Function at 0x402a1b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00401fb2
cmp ebx, dword [ecx]
stosd dword es:[edi], eax
add byte [eax - 0x5335b], al
inc dword [eax]
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
invalid
test esi, edx
cli

Function at 0x402ad9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.00401fc2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00401f77
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
invalid
movsd dword es:[edi], dword [esi]
Function at 0x403c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x3a0], eax
jmp 0x403f2a

Function at 0x404c57
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
xor esi, esi
mov edx, 0x40a8e0
mov ecx, 0x40ace0
push 8
mov eax, esi
pop edi
mov ebx, eax
and ebx, 1
neg ebx
and ebx, 0xedb88320
shr eax, 1
xor eax, ebx
dec edi
jne 0x404c6b
mov dword [edx], eax
add edx, 4
inc esi
cmp edx, ecx
jb 0x404c66
pop edi
pop esi
pop ebx
mov eax, dword [ecx - 0x400]
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x40a8e0]
xor edx, eax
mov dword [ecx], edx
add ecx, 4
cmp ecx, 0x40c8e0
jb 0x404c8c
mov eax, 0x404cc3
mov dword [0x40c8e0], eax
mov dword [0x40a8d4], eax
ret

Function at 0x404e2e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, dword [esi]
and dword [esi], 0
test edi, edi
je 0x404e87
mov eax, 0x400000
cmp edi, eax
ja 0x404e51
mov eax, edi
lea ecx, [ebp + 8]
push 0
and dword [ebp + 8], 0
push ecx
push eax
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add dword [ebp - 4], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x404e7f
test ecx, ecx
je 0x404e87
test edi, edi
jbe 0x404e87
jmp 0x404e46
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x404e89
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x404e90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, dword [esi]
and dword [esi], 0
test edi, edi
je 0x404ee9
mov eax, 0x400000
cmp edi, eax
ja 0x404eb3
mov eax, edi
lea ecx, [ebp + 8]
push 0
and dword [ebp + 8], 0
push ecx
push eax
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
add dword [ebp - 4], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x404ee1
test ecx, ecx
je 0x404ee9
test edi, edi
jbe 0x404ee9
jmp 0x404ea8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x404eeb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x405b75
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
push esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x405bb5
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405bb5
push 0xc00
call eax
test eax, eax
jne 0x405c42
lea eax, [ebp - 0x2d0]
push 0x106
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x405c42
cmp eax, 0x104
ja 0x405c42
cmp word [ebp + eax*2 - 0x2d2], 0x5c
je 0x405be8
mov word [ebp + eax*2 - 0x2d0], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x405c42
push edi
lea edi, [ebp + eax*2 - 0x2d0]
mov eax, edi
mov cl, byte [esi]
inc esi
test cl, cl
je 0x405c0f
movzx cx, cl
mov word [eax], cx
inc eax
inc eax
jmp 0x405bfd
and word [eax + 8], 0
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], 0x6c
mov word [eax + 6], 0x6c
push 8
lea eax, [ebp - 0x2d0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x405bfb
pop edi
pop esi
leave
ret
Function at 0x4103fc
Capabilities:
Create thread
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov ebx, eax
mov eax, 0x4a61f0
mov dword [ebp - 0x10], 0
call fcn.004101b0
test eax, eax
jne 0x410587
mov edx, dword [0x4a61f4]
test edx, edx
jne 0x410469
mov edx, dword [0x4a1100]
test edx, edx
jle 0x410442
lea eax, [ebp - 0x18]
call fcn.0041027c
call fcn.004105a0
mov edx, dword [0x4a1100]
mov dword [0x4a61f4], 1
test edx, edx
jle 0x410469
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.004103a8
add esp, 8
push dword [0x4a61ec]
mov dword [0x4a61f0], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x410494
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov dword [ebx], eax
mov ebx, dword [ebp - 4]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push edx
push 0
push 0x30
call fcn.00421dfc
add esp, 0xc
test eax, eax
je 0x4104b8
mov dword [ebx], 0
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [0x4a10d0]
mov dword [eax], edx
mov ecx, dword [0x4a10d4]
mov dword [eax + 4], ecx
mov esi, dword [0x4a10d8]
mov dword [eax + 8], esi
mov edi, dword [0x4a10dc]
mov dword [eax + 0xc], edi
mov edx, dword [0x4a10e0]
mov dword [eax + 0x10], edx
mov edx, dword [0x4a10e4]
mov dword [eax + 0x14], edx
mov edx, dword [0x4a10e8]
mov dword [eax + 0x18], edx
mov edx, dword [0x4a10ec]
mov dword [eax + 0x1c], edx
mov edx, dword [0x4a10f0]
mov dword [eax + 0x20], edx
mov edx, dword [0x4a10f4]
mov dword [eax + 0x24], edx
mov edx, dword [0x4a10f8]
mov dword [eax + 0x28], edx
mov edx, dword [0x4a10fc]
mov dword [eax + 0x2c], edx
push dword [ebp - 0x10]
push dword [0x4a61ec]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0x10]
push 2
add ecx, 0x2c
xor edx, edx
push edx
push edx
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x41056d
mov eax, dword [ebp - 0x10]
jmp 0x410483
push dword [ebp - 0x10]
push 0
push 0x4105b4
call fcn.0046d4d2
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x410483
mov dword [ebp - 0x1c], 0x98
lea edx, [ebp - 0x1c]
push edx
call fcn.0041fc64
pop ecx
jmp 0x410426
Function at 0x41fcd8
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x420520
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea ecx, [eax + 5]
mov eax, 0x3ee4f99d
imul ecx
mov eax, ecx
sar eax, 0x1f
sar edx, 7
sub edx, eax
imul eax, edx, 0x209
sub ecx, eax
lea eax, [ecx + 0x69]
mov dword [edi], eax
mov eax, dword [0x4a1100]
cmp eax, 2
jge 0x420598
lea eax, [ecx*4 + 0x1a4]
mov edx, eax
shl edx, 3
sub edx, eax
mov eax, dword [edx + 0x4a6d04]
test eax, eax
jne 0x42060e
mov edx, dword [edi]
mov eax, edx
shl eax, 2
shl edx, 5
sub edx, eax
mov dword [edx + 0x4a6d04], 1
jmp 0x42060e
lea eax, [ecx*4 + 0x1a4]
mov edx, eax
shl edx, 3
sub edx, eax
lea eax, [edx + 0x4a6d04]
push eax
call fcn.004101ac
pop ecx
test eax, eax
jne 0x42060e
mov edx, dword [edi]
mov eax, edx
shl eax, 2
shl edx, 5
sub edx, eax
mov eax, dword [edx + 0x4a6d00]
test eax, eax
je 0x420677
mov dword [edx + 0x4a6d04], 0
push 0xffffffffffffffff
mov edx, dword [edi]
mov eax, edx
shl eax, 2
shl edx, 5
sub edx, eax
push dword [edx + 0x4a6d00]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [edi]
mov eax, edx
shl eax, 2
shl edx, 5
sub edx, eax
lea eax, [edx + 0x4a6d04]
push eax
call fcn.004101ac
pop ecx
mov eax, dword [0x4a1100]
test eax, eax
jle 0x420630
mov edx, dword [edi]
mov eax, edx
shl eax, 2
shl edx, 5
sub edx, eax
lea eax, [edx + 0x4a6d10]
push eax
call fcn.00410278
pop ecx
mov edx, dword [edi]
mov eax, edx
shl eax, 2
shl edx, 5
sub edx, eax
mov edi, dword [edx + 0x4a6d18]
mov dword [esi], edi
mov dword [ebx], 0
mov eax, dword [esi]
test eax, eax
je 0x420668
mov edx, dword [ebp - 4]
cmp edx, dword [eax + 0xb8]
jle 0x420668
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x18]
mov dword [esi], eax
test eax, eax
jne 0x420653
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
xor eax, eax
mov esp, ebp
pop ebp
ret
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, eax
mov ecx, dword [edi]
mov eax, ecx
shl eax, 2
shl ecx, 5
sub ecx, eax
mov dword [ecx + 0x4a6d00], edx
mov edx, dword [edi]
mov eax, edx
shl eax, 2
shl edx, 5
sub edx, eax
mov dword [edx + 0x4a6d04], 0
jmp 0x4205db
Function at 0x421c44
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x6c]
test esi, esi
je 0x421d48
mov eax, dword [0x4a1100]
mov ebx, dword [esi + 0x14]
cmp eax, 2
jge 0x421c8e
mov eax, ebx
shl eax, 2
shl ebx, 5
sub ebx, eax
mov edx, dword [ebx + 0x4ab188]
test edx, edx
jne 0x421cdc
mov dword [ebx + 0x4ab188], 1
jmp 0x421cdc
mov eax, ebx
shl eax, 2
shl ebx, 5
sub ebx, eax
lea edx, [ebx + 0x4ab188]
mov dword [ebp - 0x10], edx
push edx
call fcn.004101ac
pop ecx
test eax, eax
jne 0x421cdc
mov eax, dword [ebx + 0x4ab184]
test eax, eax
je 0x421ddc
mov dword [ebx + 0x4ab188], 0
push 0xffffffffffffffff
push dword [ebx + 0x4ab184]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
push eax
call fcn.004101ac
pop ecx
mov eax, dword [0x4a1100]
test eax, eax
jle 0x421cf2
lea eax, [ebx + 0x4ab194]
push eax
call fcn.00410278
pop ecx
mov eax, dword [esi + 0x18]
add eax, 0xffffffff
mov dword [esi + 0x18], eax
test eax, eax
jle 0x421d57
mov eax, dword [0x4a1100]
test eax, eax
jle 0x421d26
push dword [ebx + 0x4ab198]
push dword [ebx + 0x4ab194]
call fcn.004103a8
add esp, 8
mov eax, dword [0x4a1100]
cmp eax, 2
jge 0x421d32
mov dword [ebx + 0x4ab188], 0
jmp 0x421d48
push dword [ebx + 0x4ab184]
mov dword [ebx + 0x4ab188], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [esi]
test edx, edx
je 0x421d65
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov edx, dword [esi]
mov eax, dword [esi + 4]
test eax, eax
je 0x421dd4
mov dword [eax], edx
mov eax, dword [0x4a1100]
mov dword [edi + 0x6c], 0
test eax, eax
jle 0x421d9c
push dword [ebx + 0x4ab198]
push dword [ebx + 0x4ab194]
call fcn.004103a8
add esp, 8
mov eax, dword [0x4a1100]
cmp eax, 2
jge 0x421da8
mov dword [ebx + 0x4ab188], 0
jmp 0x421dbe
push dword [ebx + 0x4ab184]
mov dword [ebx + 0x4ab188], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.00421eac
push esi
call fcn.00421eac
add esp, 8
jmp 0x421d48
mov dword [ebx + 0x4ab180], edx
jmp 0x421d6e
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebx + 0x4ab188], 0
mov dword [ebx + 0x4ab184], eax
jmp 0x421cc4
Function at 0x424fd4
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x429cfc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
mov edx, dword [ebp + 0x20]
mov eax, dword [0x4a2400]
test eax, eax
je 0x429dd7
cmp edx, 1
je 0x429e33
cmp edx, 2
je 0x429e33
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x429d43
cmp edx, 0xfffffffa
je 0x429e09
test edx, edx
je 0x429e15
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x429d84
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x429d84
push edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
call fcn.0044dd6c
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
push edx
mov dword [ebp - 0x10], edx
call fcn.004508f0
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
add esp, 8
test ecx, ecx
je 0x429dd7
push edx
mov dword [ebp - 0x10], edx
push edi
push esi
call fcn.004529d0
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [ecx], ebx
cmp ebx, 0xffffffff
je 0x429e45
push 0
push edx
push 2
push 0x4b6824
call fcn.00453514
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp - 4]
mov byte [ebx + esi], 0xa
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
add dword [edx], 1
mov eax, 1
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0x14]
xor edx, edx
push edx
mov dword [eax], edx
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret
mov edx, ebx
mov ecx, 1
jmp 0x429d56
call fcn.0044df84
mov edx, eax
mov eax, dword [0x4a2400]
mov ecx, 1
test eax, eax
jne 0x429d4f
jmp 0x429d84
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
xor eax, eax
mov esp, ebp
pop ebp
ret