joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40daa0
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x66c240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
xor esi, esi
inc ebx
push edi
mov dword [ebp - 0x808], ebx
mov edx, ebx
mov edi, 0xff
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movsx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
xor edx, ecx
and edx, edi
inc esi
cmp esi, 0x100
jl 0x40dac8
mov esi, ebx
mov edx, 0x675388
mov eax, esi
mov dword [edx], esi
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
add esi, esi
and ecx, 0x1b
add edx, 4
xor esi, ecx
and esi, edi
cmp edx, 0x6753b0
jl 0x40dafd
mov byte [0x673188], 0x63
mov byte [0x6742eb], 0
mov ecx, dword [ebp + ebx*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
and ecx, edi
mov edx, ecx
xor ebx, ecx
sar edx, 7
lea eax, [ecx + ecx]
or edx, eax
and edx, edi
mov esi, edx
xor ebx, edx
sar esi, 7
lea eax, [edx + edx]
or esi, eax
and esi, edi
mov ecx, esi
sar ecx, 7
lea eax, [esi + esi]
or ecx, eax
mov eax, dword [ebp - 0x808]
xor ecx, 0x63
and ecx, edi
xor ecx, esi
xor ebx, ecx
mov byte [eax + 0x673188], bl
mov byte [ebx + 0x674288], al
mov ebx, eax
inc ebx
mov dword [ebp - 0x808], ebx
cmp ebx, 0x100
jl 0x40db2c
xor esi, esi
movzx edx, byte [esi + 0x673188]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
and ecx, edi
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
movzx ecx, byte [esi + 0x674288]
mov dword [esi*4 + 0x673288], eax
rol eax, 8
mov dword [esi*4 + 0x673688], eax
rol eax, 8
mov dword [esi*4 + 0x673a88], eax
rol eax, 8
mov dword [esi*4 + 0x673e88], eax
test ecx, ecx
je 0x40dc1e
mov eax, dword [ebp + ecx*4 - 0x404]
add eax, dword [ebp - 0x3cc]
cdq
idiv edi
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
jmp 0x40dc25
and dword [ebp - 0x808], 0
test ecx, ecx
je 0x40dc42
mov eax, dword [ebp + ecx*4 - 0x404]
add eax, dword [ebp - 0x3e0]
cdq
idiv edi
mov ebx, dword [ebp + edx*4 - 0x804]
jmp 0x40dc44
xor ebx, ebx
test ecx, ecx
je 0x40dc61
mov eax, dword [ebp + ecx*4 - 0x404]
add eax, dword [ebp - 0x3d0]
cdq
idiv edi
mov edi, dword [ebp + edx*4 - 0x804]
jmp 0x40dc63
xor edi, edi
test ecx, ecx
je 0x40dc85
mov eax, dword [ebp + ecx*4 - 0x404]
mov ecx, 0xff
add eax, dword [ebp - 0x3d8]
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x40dc87
xor eax, eax
shl eax, 8
xor eax, edi
mov edi, 0xff
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, dword [ebp - 0x808]
mov dword [esi*4 + 0x674388], eax
rol eax, 8
mov dword [esi*4 + 0x674788], eax
rol eax, 8
mov dword [esi*4 + 0x674b88], eax
rol eax, 8
mov dword [esi*4 + 0x674f88], eax
inc esi
cmp esi, 0x100
jl 0x40dba0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055dcf4
mov esp, ebp
pop ebp
ret
Function at 0x40dce2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x66c240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
sub eax, 0x80
je 0x40dd24
sub eax, 0x40
je 0x40dd1c
sub eax, 0x40
jne 0x40ddf8
mov dword [edi], 0xe
jmp 0x40dd2a
mov dword [edi], 0xc
jmp 0x40dd2a
mov dword [edi], 0xa
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x11c]
push ecx
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.0040de07
mov edx, dword [ebp - 0x11c]
add esp, 0xc
shl edx, 4
add edx, dword [ebp - 0x118]
push 4
pop ecx
mov eax, dword [edx]
add edx, ecx
mov dword [esi], eax
add esi, ecx
mov eax, dword [edx]
add edx, ecx
mov dword [esi], eax
add esi, ecx
mov eax, dword [edx]
add edx, ecx
mov dword [esi], eax
add esi, ecx
mov eax, dword [edx]
sub edx, 0x1c
mov dword [esi], eax
add esi, ecx
mov edi, dword [edi]
dec edi
test edi, edi
jle 0x40dddd
push ebx
mov ebx, ecx
movzx eax, byte [edx + 3]
push 4
movzx ecx, byte [eax + 0x673188]
movzx eax, byte [edx + 2]
mov ecx, dword [ecx*4 + 0x674f88]
movzx eax, byte [eax + 0x673188]
xor ecx, dword [eax*4 + 0x674b88]
movzx eax, byte [edx + 1]
movzx eax, byte [eax + 0x673188]
xor ecx, dword [eax*4 + 0x674788]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x673188]
xor ecx, dword [eax*4 + 0x674388]
mov dword [esi], ecx
pop ecx
add esi, ecx
add edx, ecx
dec ebx
jne 0x40dd81
dec edi
sub edx, 0x20
test edi, edi
jg 0x40dd7f
pop ebx
mov eax, dword [edx]
mov dword [esi], eax
add esi, ecx
add edx, ecx
mov eax, dword [edx]
mov dword [esi], eax
mov eax, dword [edx + ecx]
mov dword [esi + ecx], eax
mov eax, dword [edx + ecx + 4]
mov dword [esi + ecx + 4], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0055dcf4
mov esp, ebp
pop ebp
ret
Function at 0x40f147
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [0x66c240]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6753b8], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push esi
je 0x40f1a2
push eax
push dword [ebp + 0xc]
mov esi, 0x6753c0
push ecx
push str.ASSERT___file:_s_line:_d___s__do_you_debug_
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40f296
int3
test eax, eax
je 0x40f1c1
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push ecx
push str._s_line:_d__msg:_s_
push eax
call fcn.0055f31c
add esp, 0x14
jmp 0x40f1d9
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push ecx
push str._s_line:_d_
push eax
call fcn.0055f31c
add esp, 0x10
push 0xff
lea eax, [ebp - 0x103]
mov byte [ebp - 0x104], 0
push 0
push eax
call fcn.0055ecc0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x20e]
push eax
movzx eax, word [ebp - 0x212]
push eax
movzx eax, word [ebp - 0x214]
push eax
lea eax, [ebp - 0x104]
push str.._Log_Assert__4d_02d_02d.txt
push eax
call fcn.0055f31c
add esp, 0x14
cmp dword [0x675510], 0
jne 0x40f296
push edi
push 0
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40f25f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40f295
lea eax, [ebp - 0x2a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp - 0x2a0]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x675510]
xor ecx, ecx
inc ecx
cmp esi, 0xf4240
cmova eax, ecx
mov dword [0x675510], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0055dcf4
mov esp, ebp
pop ebp
ret
Function at 0x40f2a5
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a0
mov eax, dword [0x66c240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x303]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push 0x1ff
push ebx
push eax
mov byte [ebp - 0x304], bl
call fcn.0055ecc0
add esp, 0xc
lea eax, [ebp - 0x304]
test edi, edi
je 0x40f2fd
push edi
push dword [ebp + 0xc]
push esi
push str._s_line:_d__msg:_s_
push eax
call fcn.0055f31c
add esp, 0x14
jmp 0x40f30f
push dword [ebp + 0xc]
push esi
push str._s_line:_d_
push eax
call fcn.0055f31c
add esp, 0x10
push 0xff
lea eax, [ebp - 0x103]
mov byte [ebp - 0x104], bl
push ebx
push eax
call fcn.0055ecc0
add esp, 0xc
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x30e]
push eax
movzx eax, word [ebp - 0x312]
push eax
movzx eax, word [ebp - 0x314]
push eax
lea eax, [ebp - 0x104]
push str.._Log_Debug__4d_02d_02d.txt
push eax
call fcn.0055f31c
add esp, 0x14
cmp dword [0x675758], ebx
jne 0x40f402
push ebx
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40f394
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40f3bc
lea eax, [ebp - 0x3a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp - 0x3a0]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
ja 0x40f3f8
lea eax, [ebp - 0x104]
push 0x58b2d8
push eax
call fcn.0055f14b
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40f402
call fcn.0040e9e2
push eax
lea eax, [ebp - 0x304]
push eax
push str._stime:_s_n
push esi
call fcn.0055f1a5
push esi
call fcn.0055f010
add esp, 0x14
jmp 0x40f402
mov dword [0x675758], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055dcf4
mov esp, ebp
pop ebp
ret
Function at 0x422212
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x696830]
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
cmp eax, 1
jne 0x4222a3
mov dword [ebp - 4], 0x58d738
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
mov dword [ebp - 0xc], eax
cmp byte [eax + 0x13], bl
je 0x422289
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, dword [ebp - 0xc]
pop ecx
mov ecx, eax
mov eax, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test esi, esi
je 0x422281
mov ebx, ecx
sub edi, ebx
lea ecx, [eax + ebx]
and eax, 7
mov al, byte [eax + edx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [edx + 0xf]
jb 0x422261
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov eax, dword [edx + 0xf]
mov edi, ecx
mov byte [ecx + eax], bl
push 0x200030
push dword [0x6967ac]
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x422302
mov dword [ebp - 0xc], 0x58d7b8
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
add edi, 0x14
mov dword [ebp - 4], eax
cmp byte [eax + 0x13], bl
je 0x422289
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, dword [ebp - 4]
pop ecx
mov ecx, eax
mov eax, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
test esi, esi
je 0x422281
mov ebx, ecx
sub edi, ebx
lea ecx, [eax + ebx]
and eax, 7
mov al, byte [eax + edx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [edx + 0xf]
jb 0x4222e2
jmp 0x42227c
mov dword [ebp - 0xc], 0x58d738
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
add edi, 0x14
mov dword [ebp - 4], eax
cmp byte [eax + 0x13], bl
je 0x422289
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, dword [ebp - 4]
pop ecx
mov ecx, eax
mov eax, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
test esi, esi
je 0x422281
mov ebx, ecx
sub edi, ebx
lea ecx, [eax + ebx]
and eax, 7
mov al, byte [eax + edx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [edx + 0xf]
jb 0x422344
jmp 0x42227c

Function at 0x422364
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
cmp dword [0x68d7b4], edi
jne 0x42237f
push edi
push edi
push edi
push 0x42419a
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x68d7b0], edi
jne 0x422397
push edi
push edi
push edi
push 0x42239b
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
pop edi
ret
Function at 0x4224b4
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.0042320c
mov eax, dword [0x696830]
xor ebx, ebx
cmp eax, 1
jne 0x42254a
mov dword [ebp - 4], 0x58d600
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
mov dword [ebp - 0xc], eax
cmp byte [eax + 0x13], bl
je 0x422530
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, dword [ebp - 0xc]
pop ecx
mov ecx, eax
mov eax, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test esi, esi
je 0x422528
mov ebx, ecx
sub edi, ebx
lea ecx, [eax + ebx]
and eax, 7
mov al, byte [eax + edx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [edx + 0xf]
jb 0x422508
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov eax, dword [edx + 0xf]
mov edi, ecx
mov byte [ecx + eax], bl
push 0x200030
push dword [0x6967ac]
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x4225a9
mov dword [ebp - 0xc], 0x58d698
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
add edi, 0x14
mov dword [ebp - 4], eax
cmp byte [eax + 0x13], bl
je 0x422530
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, dword [ebp - 4]
pop ecx
mov ecx, eax
mov eax, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
test esi, esi
je 0x422528
mov ebx, ecx
sub edi, ebx
lea ecx, [eax + ebx]
and eax, 7
mov al, byte [eax + edx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [edx + 0xf]
jb 0x422589
jmp 0x422523
mov dword [ebp - 0xc], 0x58d600
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
add edi, 0x14
mov dword [ebp - 4], eax
cmp byte [eax + 0x13], bl
je 0x422530
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, dword [ebp - 4]
pop ecx
mov ecx, eax
mov eax, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
test esi, esi
je 0x422528
mov ebx, ecx
sub edi, ebx
lea ecx, [eax + ebx]
and eax, 7
mov al, byte [eax + edx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [edx + 0xf]
jb 0x4225eb
jmp 0x422523
Function at 0x42266f
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0x58d8e0
push ebx
mov ebx, dword [ebp - 4]
push edi
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x4226d0
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
pop ecx
test esi, esi
mov dword [ebp - 4], eax
pop esi
je 0x4226c4
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebx + 0xf]
jb 0x4226a9
mov eax, dword [ebx + 0xf]
mov edi, edx
xor ebx, ebx
mov byte [edx + eax], bl
jmp 0x4226d2
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42271c
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push str.MoveImages
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x422717
mov dword [0x68d7b4], 1
jmp 0x42271c
call fcn.004227ba
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4227d2
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x66c240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
mov esi, ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x42282a
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x422832
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [ebp - 0x10], ebx
je 0x422843
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], ebx
test esi, esi
jne 0x42285a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
pop esi
pop ebx
call fcn.0055dcf4
mov esp, ebp
pop ebp
ret
push 0x5c0580
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
call fcn.0055dd03
int3

Function at 0x42286c
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x42287f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x422938
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x580174
call fcn.0055ddbc
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x422a2f
cmp byte [ebx + 0x45], 0
je 0x422a2f
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x42296d
xor al, al
jmp 0x422a31
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004230e3
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x40]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4229c7
dec eax
je 0x4229cb
dec eax
dec eax
je 0x422a1d
xor bl, bl
jmp 0x422a1f
mov byte [ebx + 0x45], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x422a03
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0055fa0e
add esp, 0x10
cmp esi, eax
jne 0x4229c3
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x45], 0
je 0x422a1d
test esi, esi
jne 0x422991
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00422fe0
jmp 0x42298b
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004066dd
mov al, bl
jmp 0x422a31
mov al, 1
call fcn.0055dd7a
ret
Function at 0x4239b1
Capabilities:
Create thread
Terminate process

Disassembly:
push esi
xor esi, esi
push esi
push esi
push esi
push 0x42385f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x68d7a8]
inc eax
mov dword [0x68d7a8], eax
cmp eax, 1
je 0x423839
xor eax, eax
ret

Function at 0x423a4f
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x580303
call fcn.0055ddbc
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
or ebx, 0xffffffff
cmp edi, ebx
jne 0x423a71
xor eax, eax
jmp 0x423bcb
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x423a9b
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x423a9b
dec dword [edx]
mov edx, dword [esi + 0x20]
mov eax, dword [ebp + 8]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x423bcb
cmp dword [esi + 0x50], 0
je 0x423bc9
mov ecx, esi
call fcn.00422ea7
xor ecx, ecx
cmp dword [esi + 0x40], ecx
jne 0x423ac8
push dword [esi + 0x50]
push edi
call fcn.00421679
test al, al
pop ecx
pop ecx
cmovne ebx, edi
jmp 0x423bc9
mov eax, dword [ebp + 8]
push ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov byte [ebp - 0x2c], al
mov dword [ebp - 0x14], 0xf
call fcn.004230e3
and dword [ebp - 4], 0
lea eax, [esi + 0x48]
mov dword [ebp - 0x40], eax
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + 0x40]
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp edi, 0x10
lea edx, [ebp - 0x28]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x40]
call dword [edi + 0x1c]
test eax, eax
js 0x423bbd
cmp eax, 1
jg 0x423ba2
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edi, 0x10
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x3c], edx
je 0x423b73
push dword [esi + 0x50]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.0055fa0e
mov edx, dword [ebp - 0x3c]
add esp, 0x10
cmp edx, eax
jne 0x423bbd
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
mov byte [esi + 0x45], 1
cmp dword [ebp - 0x38], eax
jne 0x423b9d
test edx, edx
jne 0x423af3
cmp dword [ebp - 0x18], 0x20
jae 0x423bbd
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.00422fe0
jmp 0x423af0
mov ebx, dword [ebp + 8]
jmp 0x423bbd
cmp eax, 3
jne 0x423bbd
mov eax, dword [ebp - 0x30]
push dword [eax + 0x50]
push dword [ebp - 0x2c]
call fcn.00421679
test al, al
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004066dd
mov eax, ebx
call fcn.0055dd7a
ret 4
Function at 0x4245d6
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x696830]
push esi
cmp eax, 1
je 0x424624
cmp eax, 4
je 0x424624
cmp eax, 2
jne 0x42460f
xor esi, esi
push esi
push esi
push esi
push 0x424972
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x424620
xor esi, esi
push esi
push esi
push esi
push 0x42ddfe
jmp 0x4245f5
push 0
jmp 0x424609
xor esi, esi
push esi
push esi
push esi
push 0x4249ea
jmp 0x4245f5