joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43df00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7b6e90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, ecx
mov cl, byte [eax]
push edi
mov byte [esi], cl
mov al, byte [edx]
xor ebx, ebx
push 0x34
mov dword [esp + 0x14], esi
mov byte [esi + 1], al
mov byte [esi + 8], bl
call fcn.007a2d8d
mov edi, eax
add esp, 4
lea ecx, [esp + 0x28]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x30], 1
call fcn.007a04d4
mov eax, dword [0x8af2f0]
mov dword [esp + 0x1c], ebx
cmp eax, ebx
jne 0x43df77
mov dword [0x8af2f0], edi
mov dword [edi], ebx
mov ecx, dword [0x8af2f0]
xor ebp, ebp
mov dword [ecx + 8], ebx
mov ecx, dword [0x8af2ec]
inc ecx
mov dword [0x8af2ec], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.007a0570
cmp ebp, ebx
je 0x43dfa2
push ebp
call fcn.007a02e0
add esp, 4
mov edi, dword [0x8af2f0]
push 0x34
call fcn.007a2d8d
mov dword [eax + 4], edi
mov dword [eax + 0x30], ebx
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [eax], eax
mov eax, dword [esi + 4]
add esp, 4
mov dword [eax + 8], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword [esp + 0x14], 0xffffffff
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x441450
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov al, byte [0x8b1a92]
sub esp, 8
test al, al
push esi
mov esi, dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
jne 0x4414a7
push 0x8b1550
call esi
cmp eax, 1
jne 0x441499
push 0x8b1498
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
mov eax, dword [0x8b1550]
mov ecx, dword [0x8b1554]
mov dword [0x8b15a0], eax
mov dword [0x8b15a4], ecx
mov byte [0x8b1a93], 1
jmp 0x4414a0
mov byte [0x8b1a93], 0
mov byte [0x8b1a92], 1
mov al, byte [0x8b1a93]
test al, al
je 0x4414eb
push 0x8b1550
call esi
mov edx, dword [0x8b1550]
mov esi, dword [0x8b15a0]
mov eax, dword [0x8b1554]
mov ecx, dword [0x8b15a4]
sub edx, esi
pop esi
sbb eax, ecx
mov dword [esp], edx
mov dword [esp + 4], eax
fild qword [esp]
fild qword [0x8b1498]
fdivp st(1)
add esp, 8
ret
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
fild qword [esp + 4]
pop esi
add esp, 8
ret
Function at 0x44a660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7b7af0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, ecx
mov al, byte [esi]
push 0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.00404e60
mov ecx, dword [0x7e565c]
push ecx
push 0
push esi
lea ecx, [esp + 0x14]
call fcn.00404c60
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], 0
test eax, eax
je 0x44a6d7
mov eax, dword [esp + 0xc]
test eax, eax
je 0x44a6cb
lea ecx, [esp + 8]
call fcn.0040b450
mov eax, dword [esp + 0xc]
jmp 0x44a6d0
mov eax, 0x7e5658
push eax
call dword [sym.imp.user32.dll_CharLowerA]
mov eax, dword [0x8b1594]
mov ecx, dword [0x8b1598]
test eax, eax
jne 0x44a6eb
mov eax, 0x7e5658
push ecx
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.00428220
test eax, eax
jl 0x44a75a
mov edx, dword [0x7e565c]
mov eax, dword [0x8b1598]
push edx
push eax
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
call fcn.0040b2a0
mov ecx, dword [0x7e565c]
mov byte [esp + 0x30], 1
push ecx
push 0
push eax
lea ecx, [edi + 0x18]
call fcn.00404c60
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x30], 0
test eax, eax
je 0x44a770
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x44a74f
cmp al, 0xff
je 0x44a74f
dec al
mov byte [ecx], al
jmp 0x44a770
push ecx
call fcn.007a02e0
add esp, 4
jmp 0x44a770
mov edx, dword [0x7e565c]
lea eax, [esp + 8]
push edx
push 0
push eax
lea ecx, [edi + 0x18]
call fcn.00404c60
mov ecx, dword [esp + 0xc]
pop edi
test ecx, ecx
mov dword [esp + 0x2c], 0xffffffff
pop esi
je 0x44a7ad
mov al, byte [ecx - 1]
test al, al
je 0x44a7a3
cmp al, 0xff
je 0x44a7a3
dec al
mov byte [ecx - 1], al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
dec ecx
push ecx
call fcn.007a02e0
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x44a7c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x7b7b08
push eax
mov dword fs:[0], esp
sub esp, 0x18
xor eax, eax
push ebx
push ebp
push esi
push edi
lea ebp, [ecx + 8]
mov edi, 0x870c08
or ecx, 0xffffffff
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
mov ecx, ebp
push ebx
call fcn.00401b40
test al, al
je 0x44a821
mov edi, dword [ebp + 4]
mov ecx, ebx
mov eax, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov dword [ebp + 8], ebx
add eax, ebx
mov byte [eax], 0
mov eax, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x14]
push edi
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.kernel32.dll_ReadFile]
mov eax, dword [esp + 0x10]
cmp eax, edi
jle 0x44a8fc
mov cl, byte [esp + 0x38]
lea esi, [eax + 1]
cmp esi, edi
mov byte [esp + 0x18], cl
mov eax, esi
jge 0x44a862
xor eax, eax
push eax
call fcn.007a2d8d
add esp, 4
mov ebx, eax
cmp esi, edi
mov dword [esp + 0x1c], ebx
jbe 0x44a882
mov ecx, esi
cmp eax, edi
je 0x44a87e
mov byte [eax], 0
inc eax
dec ecx
jne 0x44a877
lea eax, [ebx + esi]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x14]
push edi
push edx
push eax
push ebx
push ecx
mov dword [esp + 0x44], edi
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
mov ecx, ebp
push esi
mov dword [esp + 0x40], esi
call fcn.00401b40
test al, al
je 0x44a8eb
mov edi, dword [ebp + 4]
mov ecx, esi
mov edx, ecx
mov esi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov ebp, dword [ebp + 4]
add ebp, eax
mov byte [ebp], 0
push ebx
mov dword [esp + 0x34], 0xffffffff
call fcn.007a02e0
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x44d0b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7b7c72
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0044a3d0
xor ebx, ebx
lea ecx, [esi + 0x94]
mov dword [esp + 0x14], ebx
call fcn.00417580
lea ecx, [esi + 0xbc]
mov byte [esp + 0x14], 1
call fcn.00417580
lea ecx, [esi + 0xe4]
mov byte [esp + 0x14], 2
call fcn.00417580
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0xc]
or al, 8
mov byte [esp + 0x14], 3
mov dword [esi + 4], eax
mov dword [esi], fcn.0044d250
mov eax, 0x3f800000
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x90], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x110], ebx
mov dword [esi + 0x10c], ebx
mov byte [esi + 0x114], bl
mov eax, esi
mov dword [esp + 0x14], 0xffffffff
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4509e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, ecx
push edi
call fcn.0044a7c0
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x1c]
push 0x14
push ecx
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
cmp byte [esp + 0x14], 0x4e
jne 0x450a2c
cmp byte [esp + 0x15], 0x54
jne 0x450a2c
cmp byte [esp + 0x16], 0x46
jne 0x450a2c
cmp byte [esp + 0x17], 3
je 0x450a46
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x450a38
mov esi, 0x7e5658
push esi
push 0x82bbdc
call fcn.0045afa0
add esp, 8
mov ebp, dword [esp + 0x20]
cmp ebp, 0x31545844
je 0x450b3f
cmp ebp, 0x32545844
je 0x450b3f
cmp ebp, 0x33545844
je 0x450b3f
cmp ebp, 0x34545844
je 0x450b3f
cmp ebp, 0x35545844
je 0x450b3f
xor edi, edi
cmp ebp, 0x19
je 0x450aaf
cmp ebp, 0x1a
je 0x450aaf
cmp ebp, 0x14
jne 0x450a9e
mov edi, 3
jmp 0x450ab4
cmp ebp, 0x15
je 0x450aa8
cmp ebp, 0x16
jne 0x450ab4
mov edi, 4
jmp 0x450ab4
mov edi, 2
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
test eax, eax
je 0x450b0d
cmp ecx, 4
jl 0x450b23
cmp esi, 4
jl 0x450b23
mov edx, esi
mov eax, ecx
imul edx, ecx
imul edx, edi
add ebx, edx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp ecx, 4
mov esi, eax
jge 0x450acb
mov eax, dword [esp + 0x2c]
push 1
push 0
push ebx
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret 4
imul edi, esi
imul edi, ecx
cmp ecx, 0x200
mov ebx, edi
jl 0x450b23
add ebx, 0x20000
mov eax, dword [esp + 0x2c]
push 1
push 0
push ebx
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret 4
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
xor edi, edi
test eax, eax
mov ecx, ebx
je 0x450bd0
cmp ebx, 4
jl 0x450b91
cmp esi, 4
jl 0x450b91
cmp ebp, 0x31545844
jne 0x450b73
mov eax, esi
imul eax, ecx
cdq
sub eax, edx
sar eax, 1
add edi, eax
jmp 0x450b7a
mov edx, esi
imul edx, ecx
add edi, edx
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp ecx, 4
mov esi, eax
jge 0x450b58
mov eax, ebx
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x1c]
cdq
sub eax, edx
mov esi, eax
sar ecx, 1
sar esi, 1
cmp ecx, 4
jl 0x450bfd
cmp esi, 4
jl 0x450bfd
mov eax, esi
imul eax, ecx
lea edi, [edi + eax*2]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp ecx, 4
mov esi, eax
jge 0x450baa
jmp 0x450bfd
cmp ebp, 0x31545844
mov ecx, esi
jne 0x450be6
imul ecx, ebx
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
jmp 0x450bec
imul ecx, ebx
lea eax, [ecx + ecx]
cmp ebx, 0x400
lea edi, [eax + ecx*2]
jl 0x450bfd
add edi, 0x20000
mov ecx, dword [esp + 0x2c]
push 1
push 0
push edi
push ecx
call dword [sym.imp.kernel32.dll_SetFilePointer]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret 4
Function at 0x450f10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
push ebx
mov ebx, dword [esp + 0x38]
push ebp
push esi
mov eax, dword [ebx + 8]
push edi
test eax, eax
mov esi, ecx
jbe 0x45109c
mov eax, dword [esi + 0x48]
test eax, eax
je 0x45109c
mov eax, dword [ebx + 4]
mov dword [esp + 0x44], 0
test eax, eax
jne 0x450f47
mov eax, 0x7e5658
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x45109c
mov eax, dword [ebx + 8]
mov ebp, dword [sym.imp.kernel32.dll_WriteFile]
lea ecx, [esp + 0x44]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push edi
mov dword [esp + 0x24], eax
call ebp
mov ecx, dword [esp + 0x10]
test ecx, ecx
jle 0x450fab
mov ebx, dword [ebx + 4]
mov eax, 0x7e5658
test ebx, ebx
je 0x450f9f
mov eax, ebx
lea edx, [esp + 0x44]
push 0
push edx
push ecx
push eax
push edi
call ebp
mov eax, dword [esi + 0x48]
lea edx, [esp + 0x20]
push edx
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38]
mov eax, dword [esp + 0x20]
mov edx, 0x19
cmp eax, edx
jne 0x451095
mov eax, dword [esp + 0x3c]
mov ecx, 0x20
cmp eax, ecx
jne 0x451095
cmp dword [esp + 0x38], ecx
jne 0x451095
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
xor ebx, ebx
lea ecx, [esp + 0x44]
push ebx
lea eax, [esi + 0x2c]
push ecx
push 0x14
push eax
push edi
mov byte [eax], 0x4e
mov byte [esi + 0x2d], 0x54
mov byte [esi + 0x2e], 0x46
mov byte [esi + 0x2f], 4
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], ebx
call ebp
lea edx, [esp + 0x44]
push ebx
push edx
lea eax, [esi + 0x40]
push 8
push eax
push edi
call ebp
mov eax, dword [esi + 0x48]
lea edx, [esp + 0x20]
push edx
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38]
mov eax, dword [esi + 0x48]
push ebx
lea edx, [esp + 0x1c]
push ebx
mov ecx, dword [eax]
push edx
push ebx
push eax
call dword [ecx + 0x40]
mov eax, dword [esp + 0x3c]
test eax, eax
mov dword [esp + 0x14], eax
jle 0x451077
lea eax, [esp + 0x44]
mov ecx, dword [esp + 0x38]
push 0
push eax
mov eax, dword [esp + 0x20]
lea edx, [ecx + ecx]
imul eax, ebx
push edx
mov edx, dword [esp + 0x28]
add eax, edx
push eax
push edi
call ebp
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jl 0x45104e
mov esi, dword [esi + 0x48]
push 0
push esi
mov ecx, dword [esi]
call dword [ecx + 0x44]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x30
ret 4
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x30
ret 4
Function at 0x4537b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7b7fe4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0044a3d0
mov al, byte [esp + 0xf]
xor ebp, ebp
mov dword [esp + 0x2c], ebp
mov byte [esi + 0xe8], al
mov dword [esi + 0xec], ebp
mov dword [esi + 0xf0], ebp
mov dword [esi + 0xf4], ebp
lea ecx, [esi + 0xf8]
mov byte [esp + 0x2c], 1
call fcn.00452900
mov eax, dword [esi + 4]
mov byte [esp + 0x2c], 2
or ah, 8
mov dword [esi], 0x7e6224
mov dword [esi + 4], eax
mov eax, 0x3f800000
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], ebp
lea edx, [esi + 0x7c]
mov dword [esi + 0x74], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x38], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esi + 0x70], ebp
mov dword [esi + 0x6c], ebp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x64], ebp
mov dword [esi + 0x5c], ebp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x54], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x44], ebp
mov dword [esi + 0x40], ebp
mov dword [esi + 0x3c], ebp
mov ecx, 0x17
xor eax, eax
mov edi, edx
mov dword [esi + 0x78], 1
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
mov ecx, edx
mov dword [edx + 0x44], 4
mov dword [edx + 0x48], ebp
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov dword [edx + 0x4c], 2
mov dword [edx + 0x50], ebp
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [edx + 0x54], 5
mov dword [edx + 0x58], 6
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 0xc], eax
mov ecx, dword [edx + 0xc]
fld dword [edx]
fmul dword [0x7e5860]
mov dword [edx + 0x1c], ecx
fstp dword [edx + 0x10]
fld dword [edx + 4]
fmul dword [0x7e5860]
fstp dword [edx + 0x14]
fld dword [edx + 8]
fmul dword [0x7e5860]
fstp dword [edx + 0x18]
mov dword [esi + 0xd8], 0x41200000
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x124], ebp
mov dword [esi + 0xdc], ebp
mov dword [esi + 0xe4], ebp
mov dword [esi + 0xe0], ebp
mov eax, esi
pop edi
mov dword [esp + 0x28], 0xffffffff
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x45ada0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov eax, dword [0x961efc]
sub esp, 0x418
test eax, eax
jne 0x45adb4
mov eax, 0x7e5658
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x45ae06
mov eax, dword [0x961efc]
test eax, eax
jne 0x45ade6
mov eax, 0x7e5658
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x45af8e
test esi, esi
je 0x45af8e
push ebx
push ebp
push 2
push 0
push 0
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov ecx, dword [esp + 0x22]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1e]
and ecx, 0xffff
push ecx
mov ecx, dword [esp + 0x1e]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x38]
push 0x82bd90
push edx
mov dword [esp + 0x2c], 0
call fcn.007a3155
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
xor edi, edi
mov dword [esp + 0x10], eax
test eax, eax
mov ebx, 0x816
jle 0x45aeb3
mov cl, byte [esp + edi + 0x28]
xor edx, edx
mov dl, bh
xor dl, cl
xor cx, cx
mov cl, dl
mov byte [esp + edi + 0x28], dl
add ecx, ebx
lea ebx, [ecx + ecx*2]
shl ebx, 6
add ebx, ecx
shl ebx, 7
inc edi
cmp edi, eax
lea ebx, [ebx + ecx + 0x1608]
jl 0x45ae87
mov ebp, dword [sym.imp.kernel32.dll_WriteFile]
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push esi
call ebp
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0
push eax
lea edx, [esp + 0x30]
push ecx
push edx
push esi
call ebp
mov eax, dword [esp + 0x22]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1e]
and eax, 0xffff
push eax
mov eax, dword [esp + 0x1e]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x38]
push 0x82bd40
push ecx
call fcn.007a3155
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.kernel32.dll_lstrlenA]
xor edi, edi
mov dword [esp + 0x10], eax
test eax, eax
mov ebx, 0x816
jle 0x45af60
mov cl, byte [esp + edi + 0x28]
xor edx, edx
mov dl, bh
xor dl, cl
xor cx, cx
mov cl, dl
mov byte [esp + edi + 0x28], dl
add ecx, ebx
lea ebx, [ecx + ecx*2]
shl ebx, 6
add ebx, ecx
shl ebx, 7
inc edi
cmp edi, eax
lea ebx, [ebx + ecx + 0x1608]
jl 0x45af34
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push esi
call ebp
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
push esi
call ebp
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x418
ret
Function at 0x45afa0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov eax, dword [0x961f00]
sub esp, 8
test eax, eax
push esi
push edi
je 0x45b13a
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45b13a
push 0x962708
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov eax, dword [0x962714]
mov edx, dword [0x962710]
xor ecx, ecx
and eax, 0xffff
mov cx, word [0x962712]
push eax
and edx, 0xffff
push ecx
push edx
push 0x82bdc4
push 0x961f08
mov byte [0x961f08], 0
mov dword [esp + 0x20], 0
call fcn.007a3155
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
push ecx
push 0x962728
mov byte [0x962728], 0
call fcn.007a38f8
mov esi, dword [sym.imp.kernel32.dll_lstrcatA]
add esp, 0x20
push 0x962728
push 0x961f08
call esi
push 0x82bdc0
push 0x961f08
call esi
push 0x961f08
call dword [sym.imp.kernel32.dll_lstrlenA]
mov dword [esp + 8], eax
mov eax, dword [0x961efc]
test eax, eax
jne 0x45b062
mov eax, 0x7e5658
mov edi, dword [sym.imp.kernel32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x45b0b2
mov eax, dword [0x961efc]
test eax, eax
jne 0x45b092
mov eax, 0x7e5658
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x45b13a
test esi, esi
je 0x45b13a
push ebp
push 2
push 0
push 0
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov ebp, dword [esp + 0xc]
xor edi, edi
test ebp, ebp
mov edx, 0x816
jle 0x45b107
mov al, byte [edi + 0x961f08]
xor ecx, ecx
mov cl, dh
xor cl, al
xor ax, ax
mov al, cl
mov byte [edi + 0x961f08], cl
add eax, edx
lea edx, [eax + eax*2]
shl edx, 6
add edx, eax
shl edx, 7
inc edi
cmp edi, ebp
lea edx, [edx + eax + 0x1608]
jl 0x45b0d7
mov edi, dword [sym.imp.kernel32.dll_WriteFile]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x14]
push 4
push ecx
push esi
call edi
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push 0
push edx
push eax
push 0x961f08
push esi
call edi
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop ebp
pop edi
pop esi
add esp, 8
ret
Function at 0x45b140
Capabilities:
Delete file
Get file size
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x41c
mov ecx, dword [eax + 8]
push ebx
xor ebx, ebx
push ebp
push esi
cmp ecx, ebx
push edi
je 0x45b328
mov ecx, dword [0x7e565c]
push ecx
push ebx
push eax
mov ecx, 0x962b30
call fcn.00404c60
mov eax, dword [0x962b34]
cmp eax, ebx
jne 0x45b17c
mov eax, 0x7e5658
mov edi, dword [sym.imp.kernel32.dll_CreateFileA]
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x45b1c6
mov eax, dword [0x962b34]
cmp eax, ebx
jne 0x45b1a9
mov eax, 0x7e5658
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x45b328
lea edx, [esp + 0x28]
mov dword [esp + 0x28], ebx
push edx
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ebp, dword [sym.imp.kernel32.dll_CloseHandle]
cmp eax, 0x3e800
jbe 0x45b226
push esi
call ebp
mov eax, dword [0x962b34]
cmp eax, ebx
jne 0x45b1f4
mov eax, 0x7e5658
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x962b34]
cmp eax, ebx
jne 0x45b209
mov eax, 0x7e5658
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x45b328
push 2
push ebx
push ebx
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov ecx, dword [esp + 0x22]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1e]
and ecx, 0xffff
push ecx
mov ecx, dword [esp + 0x1e]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x3c]
push 0x82bd40
push edx
mov dword [esp + 0x2c], ebx
call fcn.007a3155
mov ebx, dword [sym.imp.kernel32.dll_lstrlenA]
add esp, 0x18
lea eax, [esp + 0x2c]
push eax
call ebx
mov edi, dword [sym.imp.kernel32.dll_WriteFile]
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push esi
mov dword [esp + 0x24], eax
call edi
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0
push eax
lea edx, [esp + 0x34]
push ecx
push edx
push esi
call edi
mov eax, dword [esp + 0x22]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1e]
and eax, 0xffff
push eax
mov eax, dword [esp + 0x1e]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x3c]
push 0x82bd10
push ecx
call fcn.007a3155
add esp, 0x18
lea edx, [esp + 0x2c]
push edx
call ebx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push esi
call edi
lea edx, [esp + 0x14]
push 0
push edx
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x34]
push eax
push ecx
push esi
call edi
push esi
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret