joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438492
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x4384a1
pop dword [ebp - 0x40]
mov eax, 0xe3fd2382
add eax, 0x1c46611f
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x6b0a8597
sub dword [ebp - 0x50], 0x1cb8404c
mov dword [ebp - 0x4c], 0x34bab518
add dword [ebp - 0x4c], 0xfd78972d
mov dword [ebp - 0x48], 0xf96362d6
sub dword [ebp - 0x48], 0xad171ea8
mov dword [ebp - 0x44], 0xade3442d
sub dword [ebp - 0x44], 0xade3442d
lea eax, [ebp - 0x50]
push eax
mov eax, 0xb9bb007a
sub eax, 0xb97aeeca
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xcac89520
sub dword [ebp - 0x50], 0x56562bca
mov dword [ebp - 0x4c], 0xa6c94366
sub dword [ebp - 0x4c], 0x655ce1f1
mov dword [ebp - 0x48], 0x810d5d0
add dword [ebp - 0x48], 0x5b5e969c
mov dword [ebp - 0x44], 0xf83b7969
sub dword [ebp - 0x44], 0xf83b7969
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xa436ff84
add eax, 0x5c091230
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x4e370
push 0
call eax
mov ecx, 0x43f5
mov esi, eax
mov edi, 0x4ce800
add edi, dword [ebp - 0x40]
mov ebx, 0xf28d9e37
add ebx, 0x52158b2c
xor dword [ebp - 8], 0x928bf63b
mov edx, dword [edi]
xor dword [ebp - 0x34], eax
sub edx, ebx
xor dword [ebp - 0x3c], edx
mov dword [esi], edx
add dword [ebp - 0x2c], 0xe2de4e73
add esi, 0x8f2eee3f
add esi, 0x70d111c5
add edi, 4
loop 0x4385b7
add eax, 0xc26e80bf
sub eax, 0xc26d7e18
mov ebx, eax
add eax, 0xa25d503f
sub eax, 0xa25d503a
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x45cba8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a95cc]
jne 0x45d3a3
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4c1f28], eax
mov dword [0x4c1f24], ecx
mov dword [0x4c1f20], edx
mov dword [0x4c1f1c], ebx
mov dword [0x4c1f18], esi
mov dword [0x4c1f14], edi
mov word [0x4c1f40], ss
mov word [0x4c1f34], cs
mov word [0x4c1f10], ds
mov word [0x4c1f0c], es
mov word [0x4c1f08], fs
mov word [0x4c1f04], gs
pushfd
pop dword [0x4c1f38]
mov eax, dword [ebp]
mov dword [0x4c1f2c], eax
mov eax, dword [ebp + 4]
mov dword [0x4c1f30], eax
lea eax, [ebp + 8]
mov dword [0x4c1f3c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4c1e78], 0x10001
mov eax, dword [0x4c1f30]
mov dword [0x4c1e2c], eax
mov dword [0x4c1e20], 0xc0000409
mov dword [0x4c1e24], 1
mov eax, dword [0x4a95cc]
mov dword [ebp - 0x328], eax
mov eax, dword [0x4a95d0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x4c1e70], eax
push 1
call fcn.00461c79
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x41c788
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x4c1e70], 0
jne 0x45d48f
push 1
call fcn.00461c79
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x4013d1
Capabilities:
Packed with generic packer

Disassembly:
pushal
pushfd
push esp
push dword [esp + 0x2c]
call fcn.00425c60
add esp, 8
or eax, eax
je 0x4013e6
jmp 0x4013b6
popfd
popal
ret 4
Function at 0x412050
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x412085
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x412390
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push edi
push eax
push 0x1000
mov dword [esp + 0x1c], 0x1000
call fcn.00412eb0
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x450910]
push ecx
mov edi, eax
push edx
mov ebp, edi
call fcn.004129be
mov ebx, eax
test ebx, ebx
je 0x4124ae
push esi
lea ecx, [ecx]
mov byte [esp + 0x13], 0
cmp dword [ebx + 4], 0
je 0x4123ee
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00412740
mov dword [esp + 0x14], eax
jmp 0x412405
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [esp + 0x13]
test al, al
je 0x412417
mov byte [ebp], al
mov al, byte [esp + 0x13]
add ebp, 1
mov ecx, dword [esp + 0x18]
mov esi, ebp
sub esi, edi
cmp esi, ecx
jl 0x412441
mov edx, dword [esp + 0x24]
add ecx, 0x1000
push edx
push ecx
mov dword [esp + 0x20], ecx
call fcn.00412eb0
mov edi, eax
mov al, byte [esp + 0x13]
lea ebp, [esi + edi]
test al, al
je 0x4124ad
cmp dword [esp + 0x14], 0
je 0x412458
cmp al, 0xd
je 0x412458
cmp al, 0xa
jne 0x4123d0
sub ebp, 1
cmp al, 0xd
jne 0x4124ad
cmp dword [ebx + 4], 0
je 0x412474
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00412740
jmp 0x41248b
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x4124ad
cmp dword [ebx + 4], 0
je 0x41249e
add dword [ebx + 0xc], 1
jmp 0x4124ad
mov ecx, dword [ebx]
push 1
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop esi
sub edi, ebp
add edi, dword [esp + 0x14]
mov byte [ebp], 0
push edi
call fcn.00412f30
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x4124d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [0x450910]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0
call fcn.004129be
mov esi, eax
test esi, esi
je 0x412554
cmp dword [esi + 4], 0
je 0x412523
push 1
lea edx, [esp + 8]
push edx
push esi
call fcn.00412740
test eax, eax
je 0x412517
add dword [esi + 0xc], 1
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
mov edx, dword [esi]
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41255f
cmp dword [esp + 8], 0
je 0x41255f
mov eax, dword [esi]
push 1
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x412570
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x450910]
push ebx
push esi
push edi
push eax
or edi, 0xffffffff
push ecx
or ebx, edi
call fcn.004129be
mov esi, eax
test esi, esi
je 0x4125ca
mov eax, dword [esi]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov eax, dword [esp + 0x10]
xor edi, edi
xor edx, edx
or ecx, edx
or edi, eax
cmp dword [esi + 4], edx
je 0x4125c0
cmp dword [esi + 0x14], edx
jne 0x4125c0
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
cdq
add ecx, eax
adc edi, edx
mov edx, edi
pop edi
pop esi
mov eax, ecx
pop ebx
ret 4
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
ret 4

Function at 0x412630
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x412689
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x412688
mov eax, dword [esp + 0x10]
mov ecx, dword [0x450910]
push eax
push ecx
call fcn.004129be
test eax, eax
je 0x412684
cmp dword [eax + 4], 0
je 0x412672
push esi
push edi
push eax
call fcn.00412870
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc
Function at 0x412740
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 0
push edi
jne 0x412761
push esi
call fcn.00412050
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ebx, edi
jl 0x4127da
mov eax, dword [esi + 0x10]
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
sub ecx, 1
je 0x4127c7
sub ecx, 1
je 0x4127b2
sub ecx, 2
je 0x41279f
push edi
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
mov dword [edx], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ax, word [eax]
mov ecx, dword [esp + 0x14]
mov word [ecx], ax
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov dl, byte [eax]
mov eax, dword [esp + 0x14]
mov byte [eax], dl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esi + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
sub ecx, ebx
add ecx, dword [esi + 4]
push ebx
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
cmp edi, eax
push 0
jl 0x412823
mov eax, dword [esi]
lea edx, [esp + 0x18]
push edx
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
pop esi
add eax, ebx
pop ebx
ret 0xc
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp edi, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
jle 0x412846
mov edi, eax
mov ecx, dword [esi + 4]
push edi
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
add esp, 0xc
pop ebp
lea eax, [ebx + edi]
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x412870
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x412892
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x41290b
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
sub ecx, 1
je 0x4128f8
sub ecx, 1
je 0x4128e3
sub ecx, 2
je 0x4128d0
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.00412050
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x412938
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc

Function at 0x413030
Capabilities:
Set console window title

Disassembly:
sub esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push str.PureBasic_Console_Debugger__press_CtrlC_to_stop_program_
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea eax, [esp + 4]
push eax
push 0xfffffffffffffff5
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov word [esp + 6], 0x1f4
mov ecx, dword [esp + 4]
push ecx
push 0xfffffffffffffff5
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0x433498
push 0x4000
push 0xfffffffffffffff6
call esi
push eax
call sub.MSVCRT.dll__open_osfhandle
add esp, 8
push eax
call sub.MSVCRT.dll__fdopen
push 0
push 4
push 0
push eax
mov dword [0x450870], eax
call sub.MSVCRT.dll_setvbuf
add esp, 0x18
push 0x433494
push 0x4000
push 0xfffffffffffffff5
call esi
push eax
call sub.MSVCRT.dll__open_osfhandle
add esp, 8
push eax
call sub.MSVCRT.dll__fdopen
push 0
push 4
push 0
push eax
mov dword [0x45086c], eax
call sub.MSVCRT.dll_setvbuf
add esp, 0x18
push 0x433494
push 0x4000
push 0xfffffffffffffff4
call esi
push eax
call sub.MSVCRT.dll__open_osfhandle
add esp, 8
push eax
call sub.MSVCRT.dll__fdopen
push 0
push 4
push 0
push eax
mov dword [0x4390bc], eax
call sub.MSVCRT.dll_setvbuf
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x444cd0], eax
pop esi
add esp, 0x18
ret
Function at 0x4131f0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x18]
xor esi, esi
push 0
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
sub ecx, esi
push ecx
lea edx, [esi + ebp]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esi, dword [esp + 0x18]
cmp esi, edi
jge 0x413225
test eax, eax
jne 0x413202
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x413b00
Capabilities:
Suspend thread

Disassembly:
push ecx
mov eax, dword [0x43f954]
push edi
push eax
call fcn.00412aa7
cmp dword [0x437018], 0
mov edi, dword [eax]
mov dword [esp + 4], edi
je 0x413c0c
cmp dword [0x4508f4], 0
jne 0x413c0c
mov ecx, dword [0x438f20]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ecx
call esi
cmp dword [0x4508b4], 0
je 0x413b60
mov edx, dword [0x439bcc]
push edx
call esi
mov eax, dword [0x444788]
push eax
call esi
mov ecx, dword [0x43f95c]
push ecx
call esi
mov edx, dword [0x444cd0]
push ebp
push 0
push 0
push 0
push edx
mov dword [0x43f358], edi
mov dword [0x4508f4], 1
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov esi, dword [0x4508ec]
mov edi, eax
add edi, 0xc8
test esi, esi
je 0x413bd8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, dword [esp + 0x10]
je 0x413bd1
cmp dword [esi + 0x28], 0
jne 0x413bd1
call ebp
cmp eax, edi
jae 0x413bc1
push 1
call ebx
cmp dword [esi + 0x28], 0
je 0x413bb1
cmp dword [esi + 0x28], 0
jne 0x413bd1
mov eax, dword [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esi, dword [esi]
test esi, esi
jne 0x413ba5
pop ebx
cmp dword [0x4508b4], 0
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
je 0x413c02
mov ecx, dword [0x43f95c]
push ecx
call esi
mov edx, dword [0x444788]
push edx
call esi
mov eax, dword [0x439bcc]
push eax
call esi
mov ecx, dword [0x438f20]
push ecx
call esi
pop esi
pop edi
pop ecx
ret
Function at 0x4184b0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push esi
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4185ff
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
je 0x418511
test ebx, ebx
jle 0x418511
mov edx, dword [0x450868]
push edi
lea ecx, [esp + 0x10]
push ecx
push ebx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418511
cmp dword [esp + 0xc], ebx
jne 0x418511
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4185fe
mov edx, dword [0x450868]
cmp dword [edx], 0x50555245
jne 0x4185fe
mov ecx, dword [edx + 8]
lea eax, [edx + 8]
push ebp
lea ebp, [ecx - 0x52455331]
add eax, 4
cmp ebp, 4
ja 0x4185fd
lea ecx, [edx + ebx - 8]
cmp eax, ecx
jae 0x4185fd
mov ecx, dword [eax]
mov edi, dword [eax + 4]
add eax, 4
cmp ecx, 0x434e5354
lea ebx, [eax + 4]
jne 0x4185e4
test edi, edi
jle 0x4185e4
mov eax, dword [0x438ec8]
lea edx, [edi + 0x18]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4185e4
mov ecx, dword [esp + 0x1c]
push edi
lea eax, [esi + 0x18]
push ebx
push eax
mov dword [esi + 4], eax
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp dword [ebp*4 + 0x418608]
mov ecx, dword [esp + 0x14]
mov edx, dword [0x450868]
lea eax, [ebx + edi]
lea ecx, [edx + ecx - 8]
cmp eax, ecx
jb 0x418557
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret
Function at 0x41c440
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x14]
movzx edx, word [esp + 0x12]
movzx eax, word [esp + 0x10]
movzx ebx, word [esp + 0xe]
push ecx
movzx ecx, word [esp + 0xe]
push edx
push eax
movzx eax, word [esp + 0x14]
push ecx
call fcn.00413240
mov edx, dword [0x444788]
add esp, 0x10
push edx
mov dword [esi + 0x10], eax
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x444790]
push 0
lea eax, [esp + 8]
push eax
push 0x14
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x444788]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
add esp, 0x14
ret

Function at 0x41c4c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x1c]
movzx edx, word [esp + 0x1a]
movzx eax, word [esp + 0x18]
movzx ebx, word [esp + 0x16]
push ecx
movzx ecx, word [esp + 0x16]
push edx
push eax
movzx eax, word [esp + 0x1c]
push ecx
call fcn.00413240
mov edx, dword [0x444788]
add esp, 0x10
push edx
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x444790]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0xc]
push eax
push 0x14
push esi
push ecx
call edi
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x24]
push 0
lea edx, [esp + 0x10]
push edx
mov edx, dword [0x444790]
push eax
push ecx
push edx
call edi
mov eax, dword [0x444788]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
add esp, 0x18
ret

Function at 0x41c880
Capabilities:
Hash data with crc32

Disassembly:
xor ecx, ecx
mov eax, ecx
shr eax, 1
test cl, 1
je 0x41c890
xor eax, 0xedb88320
test al, 1
je 0x41c89d
shr eax, 1
xor eax, 0xedb88320
jmp 0x41c89f
shr eax, 1
test al, 1
je 0x41c8ac
shr eax, 1
xor eax, 0xedb88320
jmp 0x41c8ae
shr eax, 1
test al, 1
je 0x41c8bb
shr eax, 1
xor eax, 0xedb88320
jmp 0x41c8bd
shr eax, 1
test al, 1
je 0x41c8ca
shr eax, 1
xor eax, 0xedb88320
jmp 0x41c8cc
shr eax, 1
test al, 1
je 0x41c8d9
shr eax, 1
xor eax, 0xedb88320
jmp 0x41c8db
shr eax, 1
test al, 1
je 0x41c8e8
shr eax, 1
xor eax, 0xedb88320
jmp 0x41c8ea
shr eax, 1
test al, 1
je 0x41c8f7
shr eax, 1
xor eax, 0xedb88320
jmp 0x41c8f9
shr eax, 1
mov dword [ecx*4 + 0x43f360], eax
add ecx, 1
cmp ecx, 0x100
jl 0x41c882
ret
Function at 0x420dc0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x444cd0], eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x420c00
push 0
push 0
call esi
test eax, eax
mov dword [0x450864], eax
je 0x420e32
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x41cec0
push 0
push 0
call esi
test eax, eax
mov dword [0x4508ac], eax
je 0x420e32
lea edx, [esp + 4]
push edx
push 0
push 0
push 0x413120
push 0
push 0
call esi
test eax, eax
mov dword [0x4390c0], eax
je 0x420e32
mov eax, 1
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x422e90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc44
mov eax, dword [0x43f954]
push ebx
push esi
push edi
push eax
call fcn.00412aa7
mov edi, dword [eax]
mov ecx, dword [0x43f95c]
xor eax, eax
push ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x50], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x439bdc]
mov edx, dword [0x439bd8]
mov esi, dword [0x439be4]
mov ecx, dword [0x439be8]
mov ebx, dword [0x439be0]
mov dword [esp + 0x88], eax
mov eax, dword [0x4508bc]
sub eax, 1
mov dword [0x4508bc], eax
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
add eax, eax
push eax
mov dword [esp + 0x88], edx
mov edx, dword [0x439bec]
push 0x439bf0
push 0x439bd8
mov dword [esp + 0x9c], esi
mov dword [esp + 0xa0], ecx
mov dword [esp + 0x54], edx
call sub.MSVCRT.dll_memmove
mov ecx, dword [0x43f95c]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x21
cmp dword [esp + 0x84], ecx
ja case.default.0x422f55
mov eax, dword [esp + 0x84]
jmp dword [eax*4 + 0x4250c8]
mov dword [edi + 0x20], 8
jmp case.default.0x422f55
cmp ebx, 0xffffffff
jne 0x422f8c
mov edx, dword [edi + 0x30]
mov eax, dword [edi + 0x14]
mov dword [edi + 4], 4
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], eax
mov dword [edi + 0x20], 0
jmp case.default.0x422f55
cmp ebx, 0xfffffffe
jne 0x422fb8
mov eax, dword [edi + 0x30]
test eax, eax
jle 0x422fb1
add eax, 0xffffffff
mov dword [edi + 4], 5
mov dword [edi + 0xc], eax
mov dword [edi + 0x20], 0
jmp case.default.0x422f55
mov ebx, 1
jmp 0x422fbc
test ebx, ebx
jle 0x422fc6
mov dword [edi + 4], 1
mov dword [edi + 8], ebx
mov dword [edi + 0x20], 0
jmp case.default.0x422f55
xor eax, eax
cmp ebx, eax
mov dword [edi + 4], eax
mov dword [edi + 0x20], eax
je case.default.0x422f55
mov dword [esp + 0x1c], 3
lea esi, [esp + 0x1c]
call fcn.0041c440
jmp case.default.0x422f55
push esi
mov eax, ebx
call fcn.0041c550
add esp, 4
jmp case.default.0x422f55
cmp dword [ebp + 8], 0
mov dword [esp + 0x1c], 8
lea esi, [esp + 0x1c]
jne 0x423024
call fcn.0041c440
jmp case.default.0x422f55
mov ecx, dword [ebp + 8]
push ecx
mov dword [esp + 0x24], 0x24
call fcn.0041c4c0
add esp, 4
jmp case.default.0x422f55
cmp dword [esp + 0x48], 0
je 0x424dea
mov ecx, dword [esp + 0x48]
mov edx, dword [0x438ec8]
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret