joyce8/EMBER2024-capa huggingface dataset:
Function at 0x341f512c
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x343a4a44
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 8], ecx
push 0x20
xor edx, edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 4
call fcn.341f258b
test dword [esp + 0x10], 0xfffffffe
mov dword [esp + 0x30], 0xffffffff
jne 0x342ac6e5
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
add esp, 0x30
ret
lea ecx, [esp + 0x10]
call fcn.341ffba8
jmp 0x341f5199

Function at 0x341f51e8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x343a49f4
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x2c], eax
xor edx, edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], eax
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 4
mov dword [esp + 0x14], eax
call fcn.341f5065
mov esi, eax
cmp esi, 0x20
jae 0x3421b1f5
cmp esi, 0xffffffff
je 0x3421b1f5
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.341f4405
imul esi, esi, 0x7c
test dword [esp + 0x18], 0xfffffffe
lea esi, [esi + edi + 8]
mov dword [esp + 0x38], 0xffffffff
jne 0x342ac6f3
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
test dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x38], 0xffffffff
jne 0x342ac701
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
lea ecx, [esp + 0x18]
call fcn.341ffba8
jmp 0x341f527c
lea ecx, [esp + 0x18]
call fcn.341ffba8
jmp 0x3421b20b

Function at 0x341f5f95
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x343a6de4
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, 1
mov dword [esp + 0x30], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], 0
lea edi, [esi + 0x58]
mov ecx, edi
mov byte [esp + 0x30], al
call fcn.341f603c
test eax, eax
jne 0x342b4541
lea edi, [esi + 0x1c]
mov ecx, edi
call fcn.341f6079
add esi, 0x38
mov ecx, esi
call fcn.341f6079
test dword [esp + 0x10], 0xfffffffe
mov byte [esp + 0x30], 0
jne 0x342b4557
mov esi, dword [esi]
test esi, esi
jne 0x342b4565
mov eax, dword [edi]
test eax, eax
jne 0x342b4574
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
mov ecx, dword [esi]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
lea edx, [esp + 0x10]
push edx
push 0
push edi
call eax
jmp 0x341f5fef
lea ecx, [esp + 0x10]
call fcn.341ffba8
jmp 0x341f6016
add esi, 0x6c
or ecx, 0xffffffff
lock xadd dword [esi], ecx
jmp 0x341f6020
add eax, 0x6c
or edx, 0xffffffff
lock xadd dword [eax], edx
jmp 0x341f602a
Function at 0x341f654b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x190
mov eax, dword [0x34234fcc]
xor eax, esp
mov dword [esp + 0x18c], eax
cmp dword [esp + 0x194], 0
mov ecx, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
lea esi, [ecx + 0x18]
mov ecx, 0x20
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
jne 0x341f666b
mov ebx, dword [esp + 0x6a]
xor esi, esi
movzx ebp, byte [esp + esi*2 + 0x42]
lea edi, [esi + 3]
lea ecx, [edi + 1]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 4
lea edx, [edx + edx*2]
add edx, edx
add edx, edx
add edx, edx
mov ecx, esi
sub ecx, edx
add ecx, 4
shl ebp, cl
lea ecx, [edi - 2]
mov eax, 0xaaaaaaab
mul ecx
movzx eax, byte [esp + esi*2 + 0x3c]
shr edx, 4
lea edx, [edx + edx*2]
add edx, edx
add edx, edx
add edx, edx
mov ecx, esi
sub ecx, edx
inc ecx
shl eax, cl
lea ecx, [edi - 1]
xor ebp, eax
mov eax, 0xaaaaaaab
mul ecx
movzx eax, byte [esp + esi*2 + 0x3e]
shr edx, 4
lea edx, [edx + edx*2]
add edx, edx
add edx, edx
add edx, edx
mov ecx, esi
sub ecx, edx
add ecx, 2
shl eax, cl
xor ebp, eax
mov eax, 0xaaaaaaab
mul edi
movzx eax, byte [esp + esi*2 + 0x40]
shr edx, 4
lea ecx, [edx + edx*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ecx
mov ecx, esi
sub ecx, edx
add ecx, 3
shl eax, cl
xor ebp, eax
mov eax, 0xaaaaaaab
mul esi
movzx eax, byte [esp + esi*2 + 0x3a]
shr edx, 4
lea ecx, [edx + edx*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ecx
mov ecx, esi
sub ecx, edx
shl eax, cl
add esi, 5
xor ebp, eax
xor ebx, ebp
cmp esi, 0x28
jb 0x341f6588
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.341f1dd1
add esp, 0x190
ret 4
push 0
push 0x6b39dac7
lea ecx, [esp + 0x98]
call fcn.341f6350
push 0x80
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x98]
call fcn.341f64e1
fld qword [esp + 0x6a]
call fcn.341f64c1
mov edx, 4
lea ecx, [esp + 0x3a]
mov edi, edi
xor dword [ecx], eax
add edx, 4
add ecx, 4
cmp edx, 0x28
jle 0x341f66a8
jmp 0x341f6582
Function at 0x341f6e0d
Capabilities:
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x343a722c
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x28]
xor ebx, ebx
cmp dword [esi + 0x1c], ebx
je 0x341f6e7d
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 8]
cmp eax, ebx
je 0x341f6e5d
push eax
lea ecx, [esi + 0xa8]
call fcn.341f70a5
test eax, eax
je 0x342b6456
push ebp
push edi
lea ecx, [esi + 0x20]
call fcn.341f7192
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.341f21e0
add esp, 4
mov dword [esi + 0x1c], eax
cmp eax, ebx
je 0x342b6430
xor edi, edi
cmp dword [esi + 0x18], ebx
ja 0x341f6eb1
jmp 0x341f6e3e
xor eax, eax
jmp 0x341f6ed5
push 4
call fcn.341f21e0
add esp, 4
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], ebx
cmp eax, ebx
je 0x341f6ead
push ebp
push esi
push 0x341f6f59
mov ecx, eax
call fcn.341f6f22
mov ecx, dword [esi + 0x1c]
mov dword [ecx + edi*4], eax
mov edx, dword [esi + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
cmp dword [edx + edi*4], ebx
je 0x342b6443
test byte [ebp], 8
jne 0x342b6469
lea eax, [esi + 0xd8]
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [esi + 0x1c]
mov eax, dword [edx + edi*4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc edi
cmp edi, dword [esi + 0x18]
jb 0x341f6eb1
jmp 0x341f6e3e
push 1
push 0xfffffc0d
mov ecx, ebp
call fcn.341f8dac
jmp 0x341f6e67
push 1
push 0xfffffc0d
mov ecx, ebp
call fcn.341f8dac
jmp 0x341f6eef
push 1
push 0xfffffc0e
mov ecx, ebp
call fcn.341f8dac
jmp 0x341f6e67
mov edx, dword [esi + 0x1c]
mov ebx, dword [edx + edi*4]
test ebx, ebx
je 0x342b6483
mov ecx, ebx
call fcn.34268a7f
push ebx
call fcn.341f5892
add esp, 4
mov eax, dword [esi + 0x1c]
mov dword [eax + edi*4], 0
test edi, edi
jne 0x341f6e67
mov ecx, dword [esi + 0x1c]
push ecx
call fcn.341f5892
add esp, 4
mov dword [esi + 0x1c], edi
jmp 0x341f6e67

Function at 0x341f6f22
Capabilities:
Create thread

Disassembly:
mov edx, dword [esp + 4]
push esi
lea eax, [esp + 0xc]
push eax
push 4
mov esi, ecx
mov ecx, dword [esp + 0x14]
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x342b9837
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, esi
pop esi
ret 0xc
push edi
mov edi, dword [esp + 0x14]
push edi
call fcn.341f37b8
mov ecx, eax
call fcn.341f8c56
test byte [edi], 1
jne 0x342b986b
mov eax, dword [edi + 4]
cmp eax, 0xffffea84
jne 0x342b986b
push 1
push 0
push 0
push 0xffffdf30
push eax
mov ecx, edi
call fcn.34214687
pop edi
mov eax, esi
pop esi
ret 0xc
Function at 0x341f7ad7
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x34234fcc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x214], 1
call sub.MSVCR90.dll_memset
mov eax, 0x343e4ea4
add esp, 0xc
mov dword [ebp - 0x210], 0x208
mov ecx, eax
cmp dword [ecx], 0
jne 0x342d7b50
imul esi, esi, 0x14
add esi, eax
je 0x341f7c58
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x3429a7df
cmp dword [ebp - 0x214], 1
jne 0x3429a7df
xor ebx, ebx
cmp word [ebp - 0x20c], bx
je 0x341f7c3f
cmp dword [ebp - 0x210], ebx
je 0x341f7c3f
shr dword [ebp - 0x210], 1
cmp dword [ebp - 0x210], 0x104
jae 0x3429a7e6
mov ecx, dword [ebp - 0x210]
mov word [ebp + ecx*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
cmp eax, ebx
je 0x341f7c3f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x341f7ca8
push eax
call edi
cmp eax, ebx
je 0x342d7b65
call eax
mov dword [esi + 4], eax
cmp eax, 1
je 0x342d7b6d
cmp eax, 2
je 0x342d7b8c
cmp eax, 3
jne 0x341f7c1e
push 0x341f7c98
push dword [esi]
call edi
push 0x341f7c80
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x341f7c6c
push dword [esi]
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0xc], eax
cmp dword [esi + 8], ebx
je 0x341f7c3f
cmp dword [esi + 0x10], ebx
je 0x341f7c3f
cmp dword [esi + 0xc], ebx
je 0x341f7c3f
push dword [0x343e4ecc]
push esi
call fcn.341f8c04
test eax, eax
jl 0x341f7c3f
xor esi, esi
cmp esi, ebx
je 0x341f7c58
mov eax, dword [esi]
cmp eax, ebx
jne 0x342d7b9c
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.341f1dd1
leave
ret 0xc
xor ebx, ebx
jmp 0x341f7c3f
mov word [ebp - 6], ax
jmp 0x341f7bb5
add ecx, 0x14
inc esi
cmp ecx, 0x343e4ecc
jge 0x341f7c58
jmp 0x341f7b2e
mov eax, dword [ebp + 0x10]
jmp 0x341f7be0
push 0x342d7be0
push dword [esi]
call edi
push 0x342d7bcc
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x342d7bbc
jmp 0x341f7c14
push 0x342d7be0
push dword [esi]
call edi
push 0x342d7ba8
jmp 0x342d7b7b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x341f7c4d
Function at 0x341fae96
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x343a5db0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x34]
push edi
push 0x32
call fcn.341f3c4e
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
xor eax, eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], 1
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
test byte [edi], 8
mov dword [esp + 0x20], eax
jne 0x341faf3b
push edi
lea ebp, [ebx + 0x9c]
push esi
mov ecx, ebp
call fcn.341f4341
test byte [edi], 8
jne 0x341faf3b
mov edx, dword [esp + 0x2c]
push edi
push edx
mov ecx, ebx
call fcn.341f93ea
mov dword [esi + 0x40], eax
test byte [edi], 8
jne 0x342b10cc
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
push esi
mov ecx, ebp
call fcn.341f5f46
jmp 0x341faf3b
Function at 0x34201eaf
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x343a4a44
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
lea eax, [esi + 0x48]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [esi + 8], 0xfdc
lea ecx, [esi + 0xc]
mov dword [ecx + 8], edi
mov dword [esi + 0x20], edi
mov dword [esp + 0x10], 1
mov dword [esp + 0x24], edi
mov dword [ecx + 4], 0x20
lea edx, [esi + 0x28]
mov dword [ecx], edx
lea eax, [esp + 0x10]
push eax
lea ebx, [esi + 0x24]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 4
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
add eax, eax
add eax, eax
add eax, eax
push eax
mov dword [esp + 0x38], edi
call fcn.341f2518
test dword [esp + 0x10], 0xfffffffe
mov dword [ebx], edi
mov dword [esp + 0x30], 0xffffffff
jne 0x342aabb0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret
lea ecx, [esp + 0x10]
call fcn.341ffba8
jmp 0x34201f49
Function at 0x3420588f
Capabilities:
Check for peb ntglobalflag flag
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x343a597b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov ebp, dword [esp + 0x28]
push ebp
call fcn.341ff599
mov dword [esi], 0x342280d4
lea eax, [esi + 0x70]
xor edi, edi
mov dword [esi + 0x64], eax
mov eax, 0x40
mov dword [esp + 0x20], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], eax
lea ecx, [esi + 0xd0]
mov dword [esi + 0xc4], ecx
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], eax
lea edx, [esi + 0x120]
mov dword [esi + 0x114], edx
mov dword [esi + 0x110], edi
mov dword [esi + 0x118], edi
mov dword [esi + 0x11c], eax
lea ecx, [esi + 0x170]
mov dword [esi + 0x164], ecx
mov dword [esi + 0x160], edi
mov dword [esi + 0x168], edi
mov dword [esi + 0x16c], eax
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebx + 8]
push eax
push ebp
lea ecx, [esi + 0x1b4]
mov byte [esp + 0x28], 4
call fcn.34203aaf
mov edx, dword [esp + 0x30]
mov eax, dword [esi + 4]
push edx
push eax
lea ecx, [ebx + 0x18]
mov byte [esp + 0x28], 5
mov dword [esi + 0x58], ebx
mov dword [esi + 8], 3
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0xb0], edi
mov dword [esi + 0x1b0], edi
call fcn.341f4341
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x34206f03
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x343a65dd
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x34], 8
xor edi, edi
mov dword [esi + 0x3c], edi
mov eax, 0xff
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x24]
mov ebx, 1
push 0x1040
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x1c], ebx
call fcn.341f21e0
add esp, 4
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x3420707e
push esi
mov ecx, eax
call fcn.34207090
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi], eax
cmp eax, edi
je 0x342b321a
test byte [ebp], 8
jne 0x34207066
push 0x68
call fcn.341f21e0
mov ebx, eax
add esp, 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 1
cmp ebx, edi
je 0x34207085
mov ecx, ebx
call fcn.341f423e
mov ecx, ebx
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x10], ecx
cmp ecx, edi
je 0x342b322c
mov edx, dword [esi + 0xc]
mov eax, dword [edx + 0xc4]
mov edx, dword [esp + 0x24]
mov edx, dword [edx + 0x28]
push eax
push edx
call fcn.341f6a54
test byte [ebp], 8
jne 0x34207066
mov eax, dword [esi + 0xc]
cmp dword [eax + 0xc8], edi
je 0x34207066
push 0x68
call fcn.341f21e0
mov ebx, eax
add esp, 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 2
cmp ebx, edi
je 0x3420708c
mov ecx, ebx
call fcn.341f423e
mov ecx, ebx
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x14], ecx
cmp ecx, edi
je 0x342b322c
mov edx, dword [esi + 0xc]
mov eax, dword [edx + 0xc8]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [edx + 0x28]
push eax
call fcn.341f6a54
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
xor eax, eax
jmp 0x34206f93
xor ecx, ecx
jmp 0x34206fdc
xor ecx, ecx
jmp 0x3420703c
push ebx
push 0xfffffc0d
mov ecx, ebp
call fcn.341f8dac
jmp 0x34206fa9
push 1
push 0xfffffc0d
mov ecx, ebp
call fcn.341f8dac
jmp 0x34207066
Function at 0x34207efa
Capabilities:
Encrypt data using des

Disassembly:
push ecx
xor eax, eax
movzx edx, byte [eax + 0x342080f0]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x343e4cd4], dl
movzx edx, byte [eax + 0x3420810c]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x343e4cb8], dl
movzx edx, byte [eax + 0x342080f1]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x343e4cd5], dl
movzx edx, byte [eax + 0x3420810d]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x343e4cb9], dl
movzx edx, byte [eax + 0x342080f2]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x343e4cd6], dl
movzx edx, byte [eax + 0x3420810e]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x343e4cba], dl
movzx edx, byte [eax + 0x342080f3]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x343e4cd7], dl
movzx edx, byte [eax + 0x3420810f]
movzx edx, byte [edx + ecx]
mov byte [eax + 0x343e4cbb], dl
add eax, 4
cmp eax, 0x1c
jb 0x34207efd
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edx, 0x343e49d0
mov dword [esp + 0x10], 0x10
lea ebx, [ebx]
movzx ebx, byte [ebp + 0x34208128]
test ebx, ebx
jbe 0x34207ff0
sub ebx, 1
movzx eax, byte [0x343e4cd4]
mov ecx, 0x1b
mov esi, 0x343e4cd5
mov edi, 0x343e4cd4
rep movsb byte es:[edi], byte [esi]
mov byte [0x343e4cef], al
movzx eax, byte [0x343e4cb8]
mov ecx, 0x1b
mov esi, 0x343e4cb9
mov edi, 0x343e4cb8
rep movsb byte es:[edi], byte [esi]
mov byte [0x343e4cd3], al
jne 0x34207fb1
xor eax, eax
movzx ecx, byte [eax + 0x34208138]
movzx ecx, byte [ecx + 0x343e4cd4]
mov byte [edx + eax - 0x18], cl
movzx ecx, byte [eax + 0x34208150]
movzx ecx, byte [ecx + 0x343e4cb8]
mov byte [edx + eax], cl
movzx ecx, byte [eax + 0x34208139]
movzx ecx, byte [ecx + 0x343e4cd4]
mov byte [edx + eax - 0x17], cl
movzx ecx, byte [eax + 0x34208151]
movzx ecx, byte [ecx + 0x343e4cb8]
mov byte [edx + eax + 1], cl
movzx ecx, byte [eax + 0x3420813a]
movzx ecx, byte [ecx + 0x343e4cd4]
mov byte [edx + eax - 0x16], cl
movzx ecx, byte [eax + 0x34208152]
movzx ecx, byte [ecx + 0x343e4cb8]
mov byte [edx + eax + 2], cl
movzx ecx, byte [eax + 0x3420813b]
movzx ecx, byte [ecx + 0x343e4cd4]
mov byte [edx + eax - 0x15], cl
movzx ecx, byte [eax + 0x34208153]
movzx ecx, byte [ecx + 0x343e4cb8]
mov byte [edx + eax + 3], cl
movzx ecx, byte [eax + 0x3420813c]
movzx ecx, byte [ecx + 0x343e4cd4]
mov byte [edx + eax - 0x14], cl
movzx ecx, byte [eax + 0x34208154]
movzx ecx, byte [ecx + 0x343e4cb8]
mov byte [edx + eax + 4], cl
movzx ecx, byte [eax + 0x3420813d]
movzx ecx, byte [ecx + 0x343e4cd4]
mov byte [edx + eax - 0x13], cl
movzx ecx, byte [eax + 0x34208155]
movzx ecx, byte [ecx + 0x343e4cb8]
mov byte [edx + eax + 5], cl
add eax, 6
cmp eax, 0x18
jb 0x34207ff2
inc ebp
add edx, 0x30
sub dword [esp + 0x10], 1
jne 0x34207fa6
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x3420a2c3
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x1c]
add eax, 7
push esi
shr eax, 3
push edi
mov edi, ecx
lea ecx, [eax + eax*8 + 1]
mov eax, dword [edi]
lea edx, [ecx + eax]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ecx
cmp edx, dword [edi + 0xc]
ja 0x3420a35d
mov esi, dword [edi + 4]
add esi, eax
test byte [ebx], 8
jne 0x3420a354
cmp dword [esp + 0x18], 0
jne 0x3420a373
mov byte [esi], 0x7f
inc esi
xor bl, bl
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
cmp ebp, 8
ja 0x3420a36a
test ebp, ebp
jbe 0x3420a34d
mov edi, ebp
mov cl, byte [eax]
xor cl, bl
mov byte [esi], cl
inc esi
inc eax
sub edi, 1
jne 0x3420a31a
mov edi, dword [esp + 0x10]
mov edx, 8
sub edx, ebp
movzx eax, bl
push edx
push eax
push esi
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x30]
mov cl, al
xor cl, bl
add esp, 0xc
sub esi, eax
mov byte [esi + 8], cl
mov edx, dword [esp + 0x14]
add dword [edi], edx
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 0x10
push ebx
push ecx
mov ecx, edi
call fcn.342046bc
mov esi, eax
jmp 0x3420a2f4
lea edi, [ebp - 9]
shr edi, 3
inc edi
jmp 0x3420a37c
mov byte [esi], 0x80
inc esi
or bl, 0xff
jmp 0x3420a306
movzx ecx, byte [eax]
xor cl, bl
mov byte [esi], cl
movzx edx, byte [eax + 1]
xor dl, bl
mov byte [esi + 1], dl
movzx ecx, byte [eax + 2]
xor cl, bl
mov byte [esi + 2], cl
movzx edx, byte [eax + 3]
xor dl, bl
mov byte [esi + 3], dl
movzx ecx, byte [eax + 4]
xor cl, bl
mov byte [esi + 4], cl
movzx edx, byte [eax + 5]
xor dl, bl
mov byte [esi + 5], dl
movzx ecx, byte [eax + 6]
xor cl, bl
mov byte [esi + 6], cl
movzx edx, byte [eax + 7]
xor dl, bl
mov byte [esi + 7], dl
add esi, 8
mov byte [esi], 9
add eax, 8
sub ebp, 8
inc esi
sub edi, 1
jne 0x3420a37c
mov edi, dword [esp + 0x10]
mov dword [esp + 0x24], ebp
jmp 0x3420a314
Function at 0x3420c9cd
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x343a58f0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x34234fcc]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
test byte [esi + 0x18], 0x80
mov ebp, dword [esp + 0x58]
mov ebx, dword [esp + 0x50]
jne 0x3420ca7b
mov edx, dword [esp + 0x54]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi + 4]
lea ecx, [esp + 0x5c]
push ecx
push ebp
push edx
xor edi, edi
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x342b01f5
cmp dword [esp + 0x58], ebp
jne 0x342b0268
test byte [esi + 0x18], 0x80
jne 0x342b027d
call fcn.341f37b8
inc dword [eax + 0xe0]
add eax, 0xdc
mov eax, dword [esp + 0x5c]
test byte [eax], 8
jne 0x342b0300
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x10
xor edi, edi
jmp 0x3420ca3e
mov dword [esp + 0x28], 1
mov dword [esp + 0x3c], edi
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x4c], edi
call fcn.341f37b8
mov ecx, eax
call fcn.341f8c56
mov eax, dword [esp + 0x28]
test al, 1
jne 0x342b0231
cmp dword [esp + 0x2c], 0xfffffc15
jne 0x342b0231
or dword [esi + 0x18], 0x80
jmp 0x342b0247
test al, 8
je 0x342b0247
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x28]
push edx
call fcn.341f3803
mov eax, dword [esp + 0x28]
mov dword [esp + 0x48], 0xffffffff
test eax, 0xfffffffe
je 0x3420ca3e
lea ecx, [esp + 0x28]
call fcn.341ffba8
jmp 0x3420ca3e
mov ecx, dword [esp + 0x5c]
push 1
push 0xfffff8f0
call fcn.341f8dac
jmp 0x3420ca3e
lea edi, [esi + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
push 0
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x342b02ae
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.341f37b8
mov ecx, eax
call fcn.341f8c56
jmp 0x342b02f2
mov eax, dword [esp + 0x54]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x5c]
push edx
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x342b02dc
mov edx, dword [esp + 0x5c]
push edx
call fcn.341f37b8
mov ecx, eax
call fcn.341f8c56
jmp 0x342b02f2
cmp dword [esp + 0x58], ebp
je 0x342b02f2
mov ecx, dword [esp + 0x5c]
push 1
push 0xfffff8f0
call fcn.341f8dac
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
jmp 0x3420ca48
push edi
push eax
mov ecx, esi
call fcn.3429a78b
jmp 0x3420ca65