joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423d95
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x208
push eax
push 0x20019
xor esi, esi
mov edi, edx
push esi
push 0x5eeb44
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x423dc9
xor eax, eax
jmp 0x423dee
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push esi
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423de3
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x423df4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x5eeb44
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x423e24
xor eax, eax
jmp 0x423e63
mov ecx, dword [ebp + 8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x423e2a
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp + 8]
push 1
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x423e58
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423e9e
Capabilities:
Extract resource via kernel32 functions
Print debug messages
Set file attributes

Disassembly:
push 0x30
mov eax, 0x5a2ed1
call fcn.0055d972
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.00406475
push dword [0x627a08]
mov edx, dword [0x627800]
lea ecx, [ebp - 0x2c]
call fcn.00426a8c
pop ecx
mov bl, al
lea ecx, [ebp - 0x2c]
push esi
neg bl
push 1
sbb bl, bl
call fcn.004064a6
add bl, 1
je 0x423fed
lea eax, [ebp - 0x34]
push eax
push fcn.00423e9e
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 2
push 0x5f06d8
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x42400f
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x42400f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x42400f
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x30]
call fcn.004254cd
push dword [ebp - 0x38]
mov byte [ebp - 4], 1
push ebx
push dword [ebp - 0x30]
call fcn.00562dc0
mov ebx, dword [ebp - 0x30]
add esp, 0xc
add ebx, 0x8bfe
test dword [0x627800], 0xfffffffc
jbe 0x423f9b
xor edx, edx
mov eax, esi
push 0x7f
pop ecx
div ecx
mov eax, dword [edx*4 + 0x627804]
sub dword [ebx + esi*4], eax
inc esi
mov eax, dword [0x627800]
shr eax, 2
cmp esi, eax
jl 0x423f7b
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebx + 0x3c]
mov eax, dword [0x627a08]
mov dword [ecx + ebx + 0x58], eax
mov ecx, edi
push dword [0x627800]
push ebx
push 2
pop edx
call fcn.00426ae6
mov ebx, dword [ebp + 0xc]
pop ecx
pop ecx
test bl, bl
jns 0x423fdc
push 0x5f06e4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
call fcn.00426d93
cmp dword [ebp - 0x30], 0
je 0x423ff0
push dword [ebp - 0x30]
call fcn.0042716e
pop ecx
jmp 0x423ff0
mov ebx, dword [ebp + 0xc]
and ebx, 0x20
or ebx, 0x800
shr ebx, 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
inc eax
jmp 0x424011
xor eax, eax
call fcn.0055d8bf
ret
Function at 0x424017
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xc
mov eax, 0x5a2ef6
call fcn.0055d93b
lea eax, [ebp - 0x14]
xor edi, edi
push eax
push fcn.00424017
push 4
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x627e14]
mov edx, dword [ecx]
mov dword [ecx], eax
cmp edx, dword [0x627e14]
jb 0x424108
push 2
push 0x5f0734
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x424108
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [ebp - 0x14]
mov ebx, eax
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x424108
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x424108
push ebx
call fcn.00427165
pop ecx
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp - 0x18]
push ebx
call fcn.00563f10
mov ecx, dword [0x627e14]
lea edx, [ebx + 0x8bfe]
add esp, 0xc
test ecx, 0xfffffffc
jbe 0x4240ed
xor edx, edx
mov eax, edi
push 0x7f
pop ecx
div ecx
mov eax, dword [edx*4 + 0x627804]
lea edx, [ebx + 0x8bfe]
sub dword [edx + edi*4], eax
inc edi
mov ecx, dword [0x627e14]
mov eax, ecx
shr eax, 2
cmp edi, eax
jl 0x4240c4
push ecx
push edx
push dword [ebp + 8]
call fcn.00563f10
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebx
call fcn.0042716e
pop ecx
xor eax, eax
call fcn.0055d899
ret

Function at 0x424116
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push fcn.00424116
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 2
push 0x5f0704
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4241ca
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4241c9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4241c8
push dword [ebp - 8]
call fcn.0056a92a
push dword [ebp - 8]
mov esi, eax
push edi
push esi
call fcn.00563f10
add esi, 0x8bfe
mov ecx, 0x28b
mov edi, 0x6273f8
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
xor edx, edx
mov eax, ecx
push 0x7f
pop esi
div esi
mov eax, dword [edx*4 + 0x6273f8]
sub dword [ecx*4 + 0x6275f8], eax
inc ecx
cmp ecx, 0x20b
jl 0x42419e
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4241cf
Capabilities:
Get hostname

Disassembly:
push 0x224
mov eax, 0x5a2f43
call fcn.0055d904
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x17c], ebx
and dword [ebp - 0x180], 0
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x17c], 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x424239
mov edx, 0x5f0714
mov ecx, 0x624740
call fcn.0040933b
push eax
call fcn.004094e8
mov ecx, ebx
mov dword [esp], 0x5ee5c0
call fcn.004038b8
jmp 0x42438d
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x130]
call fcn.004038b8
and dword [ebp - 4], 0
lea ecx, [ebp - 0x130]
push 0xffffffffffffffff
push 0
push esi
call fcn.00403b8e
cmp dword [ebp - 0x11c], 0x10
lea eax, [ebp - 0x130]
push dword [ebp - 0x120]
cmovae eax, dword [ebp - 0x130]
push eax
call fcn.00415bec
push 7
pop ecx
xor edx, edx
mov esi, eax
div ecx
lea ecx, [ebp - 0x230]
lea edi, [edx + 6]
call fcn.00424a64
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x220]
push esi
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x20c]
and eax, 0xfffff9ff
or eax, 0x800
mov dword [ebp + ecx - 0x20c], eax
lea ecx, [ebp - 0x220]
call fcn.004250f3
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x230]
call fcn.00424a19
push edi
push ecx
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.004249eb
xor esi, esi
mov byte [ebp - 4], 4
push 0
inc esi
lea ecx, [ebp - 0x178]
push esi
call fcn.0040390d
push ecx
lea edx, [ebp - 0x160]
lea ecx, [ebp - 0x148]
call fcn.00425458
and dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
cmp dword [ebx + 0x14], 0x10
pop ecx
jb 0x42432a
mov eax, dword [ebx]
jmp 0x42432c
mov eax, ebx
mov byte [eax], 0
mov ecx, ebx
lea eax, [ebp - 0x148]
push eax
call fcn.00403c2d
push 0
push esi
lea ecx, [ebp - 0x148]
call fcn.0040390d
push 0
push esi
lea ecx, [ebp - 0x160]
call fcn.0040390d
lea ecx, [ebp - 0x1c8]
call fcn.00424a35
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 5
push eax
mov dword [ebp - 0x1c8], 0x5de36c
call fcn.0055f95d
pop ecx
push 0
push esi
lea ecx, [ebp - 0x130]
call fcn.0040390d
mov eax, ebx
call fcn.0055d8ae
ret
Function at 0x42465a
Capabilities:
Check if file exists
Delete file
Delete registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x616fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005639e0
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
mov ebx, 0x5eeb34
push eax
mov edx, ebx
call fcn.00423d95
pop ecx
pop ecx
test eax, eax
je 0x424732
push esi
xor esi, esi
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4246e3
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x1e
jl 0x4246a3
jmp 0x4246f9
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x1005
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea eax, [ebp - 0x210]
push eax
push 2
push 0
push 0x5eeb44
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x424732
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.0055d244
mov esp, ebp
pop ebp
ret

Function at 0x4255cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
push 4
pop edi
mov ecx, dword [esi + 4]
mov eax, dword [esi]
sub ecx, eax
cmp ecx, edi
ja 0x4255ee
xor al, al
jmp 0x42568f
movsx eax, byte [eax + 2]
movzx edx, al
mov eax, dword [esi]
push ebx
xor ebx, ebx
movsx eax, byte [eax + 3]
shl eax, 8
or edx, eax
mov eax, dword [esi]
shl edx, 8
movsx eax, byte [eax + 1]
movzx eax, al
or edx, eax
mov eax, dword [esi]
shl edx, 8
movsx eax, byte [eax]
movzx eax, al
or edx, eax
lea eax, [ecx - 4]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edx
call fcn.004262c7
mov eax, dword [esi + 4]
mov ecx, ebx
sub eax, dword [esi]
cmp eax, edi
jbe 0x425655
mov edx, dword [ebp - 0x10]
mov eax, dword [esi]
mov al, byte [eax + edi]
xor al, 0xb8
mov byte [edx + edi - 4], al
movzx eax, al
xor ecx, eax
mov eax, dword [esi + 4]
sub eax, dword [esi]
inc edi
cmp edi, eax
jb 0x42563b
cmp ecx, dword [ebp - 4]
jne 0x425684
lea eax, [ebp - 0x10]
cmp esi, eax
je 0x425682
mov ecx, esi
call fcn.0040c4d1
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.0040c4d1
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x426807
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x616fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x5f0500
push 0x5f0510
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x426844
lea ecx, [ebp - 0x118]
push ecx
call eax
push 0x3c
lea eax, [ebp - 0x154]
push 0
push eax
call fcn.005639e0
and dword [ebp - 0x140], 0
add esp, 0xc
cmp dword [ebp - 0x114], 5
mov ecx, 0x5f0894
mov eax, 0x5f08a0
mov dword [ebp - 0x154], 0x3c
cmovne eax, ecx
mov dword [ebp - 0x150], 0x40
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x154]
push eax
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x13c], edi
mov dword [ebp - 0x138], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0055d244
mov esp, ebp
pop ebp
ret

Function at 0x4268bf
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x616fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x42692c
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x426924
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00563757
pop ecx
pop ecx
test eax, eax
jne 0x42692a
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x426903
jmp 0x42692c
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055d244
mov esp, ebp
pop ebp
ret

Function at 0x426946
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x616fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4269c6
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4269c2
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00563757
pop ecx
pop ecx
test eax, eax
je 0x4269b4
push dword [ebp - 0x228]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x426988
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0055d244
mov esp, ebp
pop ebp
ret
Function at 0x4269dd
Capabilities:
Read file via mapping

Disassembly:
push 0x18
push 0x601618
call fcn.0055d9e0
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
push edi
push 0x8000000
push 3
push edi
push 1
push SysReAllocStringLen
call fcn.0040aca7
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp ebx, 0xffffffff
je 0x426a54
push edi
push edi
push edi
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x426a54
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 0x24], ecx
test ecx, ecx
je 0x426a54
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x426a54
mov eax, dword [ecx + 0x3c]
mov edi, dword [eax + ecx + 0x58]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.00426a68
jmp fcn.00426a68

Function at 0x426ae6
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, 0x80
mov edi, ecx
push ebx
push edi
mov esi, edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
push eax
push ebx
push esi
push eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x426b36
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x426b38
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426b3f
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x616fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x24c]
mov ebx, ecx
push 0
push eax
call fcn.005639e0
push 5
pop ecx
push 0x2c
lea eax, [ebp - 0x30]
mov esi, 0x5f08c8
lea edi, [ebp - 0x44]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.005639e0
add esp, 0x18
cmp dword [ebx + 0x14], 8
jb 0x426b91
mov eax, dword [ebx]
jmp 0x426b93
mov eax, ebx
push eax
mov edi, 0x104
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056bfe3
push 0x5f066c
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056ac49
push 0x5f07d0
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056ac49
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x24c]
add esp, 0x24
push 0
push eax
call esi
cmp dword [ebx + 0x14], 8
jb 0x426be8
mov eax, dword [ebx]
jmp 0x426bea
mov eax, ebx
push eax
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056bfe3
push 0x5f066c
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056ac49
push 0x5f07d8
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056ac49
add esp, 0x24
lea eax, [ebp - 0x24c]
push 0
push eax
call esi
cmp dword [ebx + 0x14], 8
jb 0x426c34
mov eax, dword [ebx]
jmp 0x426c36
mov eax, ebx
push eax
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056bfe3
push 0x5f066c
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056ac49
push 0x5f07c4
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056ac49
add esp, 0x24
lea eax, [ebp - 0x24c]
push 0
push eax
call esi
cmp dword [ebx + 0x14], 8
jb 0x426c80
mov eax, dword [ebx]
jmp 0x426c82
mov eax, ebx
push eax
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056bfe3
mov esi, 0x5f066c
lea eax, [ebp - 0x24c]
push esi
push edi
push eax
call fcn.0056ac49
push 0x5f07c4
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056ac49
push esi
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056ac49
push 0x5f08f4
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056ac49
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x24c]
add esp, 0x3c
push eax
call esi
test eax, eax
jne 0x426d01
lea eax, [ebp - 0x44]
xor edx, edx
push 0x40
push eax
inc edx
lea ecx, [ebp - 0x24c]
call fcn.00426ae6
pop ecx
pop ecx
cmp dword [ebx + 0x14], 8
jb 0x426d09
mov ebx, dword [ebx]
push ebx
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056bfe3
mov ebx, 0x5f066c
lea eax, [ebp - 0x24c]
push ebx
push edi
push eax
call fcn.0056ac49
push 0x5f07c4
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056ac49
push ebx
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056ac49
push 0x5f08dc
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0056ac49
add esp, 0x3c
lea eax, [ebp - 0x24c]
push eax
call esi
pop edi
pop esi
pop ebx
test eax, eax
jne 0x426d85
lea eax, [ebp - 0x44]
xor edx, edx
push 0x40
push eax
inc edx
lea ecx, [ebp - 0x24c]
call fcn.00426ae6
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d244
mov esp, ebp
pop ebp
ret
Function at 0x426d93
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3220
mov eax, dword fs:[0]
push eax
mov eax, 0x14b0
call fcn.0055d9b0
mov eax, dword [0x616fe8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x100
xor esi, esi
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.005639e0
add esp, 0xc
lea ecx, [ebp - 0x128]
push 0x5ee5c0
call fcn.004038b8
mov dword [ebp - 4], esi
call fcn.0055e680
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x128]
push esi
push 1
call fcn.0040390d
call fcn.0055e680
or dword [ebp - 0x12c], 0xffffffff
mov edx, eax
xor ecx, ecx
mov dword [ebp - 0x14ac], edx
inc ecx
mov edi, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [ebp + ecx*4 - 0x14ac], edx
inc ecx
cmp ecx, edi
jl 0x426e24
mov dword [ebp - 0x14b0], edi
mov edi, 0xff
mov dword [ebp - 0x14b8], esi
mov dword [ebp - 0x14b4], edi
lea eax, [ebp - 0x14b0]
push eax
lea ecx, [ebp - 0x14b8]
call fcn.00426f12
mov byte [ebp + esi - 0x110], al
inc esi
cmp esi, 0x100
jb 0x426e56
lea eax, [ebp - 0x14b0]
mov dword [ebp - 0x14b8], 0x10
push eax
lea ecx, [ebp - 0x14b8]
mov dword [ebp - 0x14b4], edi
call fcn.00426f12
mov esi, 0x80
movzx edi, al
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
push eax
push esi
push 3
push eax
push eax
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x426ef4
push 2
xor ebx, ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea ecx, [ebp - 0x14bc]
push ecx
push edi
lea ecx, [ebp - 0x110]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x426ef6
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055d244
mov esp, ebp
pop ebp
ret

Function at 0x426fda
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x427022
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x426fea
jmp 0x42702f
cmp dword [esi], 0x4e0
jb 0x42702f
call fcn.00427069
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret