joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422d4f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x208
push eax
push 0x20019
xor esi, esi
mov edi, edx
push esi
push 0x6066dc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x422d83
xor eax, eax
jmp 0x422da8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push esi
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x422d9d
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x422dae
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x6066dc
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x422dde
xor eax, eax
jmp 0x422e1d
mov ecx, dword [ebp + 8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x422de4
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp + 8]
push 1
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x422e12
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x422eea
Capabilities:
Extract resource via kernel32 functions
Print debug messages
Set file attributes

Disassembly:
push 0x30
mov eax, 0x5b961b
call fcn.0055bf41
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.00406548
push dword [0x642078]
mov edx, dword [0x641e70]
lea ecx, [ebp - 0x2c]
call fcn.00424fe5
pop ecx
mov bl, al
lea ecx, [ebp - 0x2c]
push esi
neg bl
push 1
sbb bl, bl
call fcn.00406584
add bl, 1
je 0x423039
lea eax, [ebp - 0x34]
push eax
push fcn.00422eea
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 2
push 0x608030
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x42305b
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x42305b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x42305b
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x30]
call fcn.00423a3e
push dword [ebp - 0x38]
mov byte [ebp - 4], 1
push ebx
push dword [ebp - 0x30]
call fcn.00576a10
mov ebx, dword [ebp - 0x30]
add esp, 0xc
add ebx, 0x8bfe
test dword [0x641e70], 0xfffffffc
jbe 0x422fe7
xor edx, edx
mov eax, esi
push 0x7f
pop ecx
div ecx
mov eax, dword [edx*4 + 0x641e74]
sub dword [ebx + esi*4], eax
inc esi
mov eax, dword [0x641e70]
shr eax, 2
cmp esi, eax
jl 0x422fc7
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebx + 0x3c]
mov eax, dword [0x642078]
mov dword [ecx + ebx + 0x58], eax
mov ecx, edi
push dword [0x641e70]
push ebx
push 2
pop edx
call fcn.0042503f
mov ebx, dword [ebp + 0xc]
pop ecx
pop ecx
test bl, bl
jns 0x423028
push 0x608054
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
call fcn.004252ec
cmp dword [ebp - 0x30], 0
je 0x42303c
push dword [ebp - 0x30]
call fcn.00425742
pop ecx
jmp 0x42303c
mov ebx, dword [ebp + 0xc]
and ebx, 0x20
or ebx, 0x800
shr ebx, 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
inc eax
jmp 0x42305d
xor eax, eax
call fcn.0055be8e
ret
Function at 0x423063
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xc
mov eax, 0x5b9640
call fcn.0055bf0a
lea eax, [ebp - 0x14]
xor edi, edi
push eax
push fcn.00423063
push 4
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x642484]
mov edx, dword [ecx]
mov dword [ecx], eax
cmp edx, dword [0x642484]
jb 0x423154
push 2
push 0x608074
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x423154
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [ebp - 0x14]
mov ebx, eax
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x423154
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x423154
push ebx
call fcn.00425747
pop ecx
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp - 0x18]
push ebx
call fcn.00577b60
mov ecx, dword [0x642484]
lea edx, [ebx + 0x8bfe]
add esp, 0xc
test ecx, 0xfffffffc
jbe 0x423139
xor edx, edx
mov eax, edi
push 0x7f
pop ecx
div ecx
mov eax, dword [edx*4 + 0x641e74]
lea edx, [ebx + 0x8bfe]
sub dword [edx + edi*4], eax
inc edi
mov ecx, dword [0x642484]
mov eax, ecx
shr eax, 2
cmp edi, eax
jl 0x423110
push ecx
push edx
push dword [ebp + 8]
call fcn.00577b60
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebx
call fcn.00425742
pop ecx
xor eax, eax
call fcn.0055be68
ret

Function at 0x423162
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push fcn.00423162
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 2
push 0x608044
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x423216
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x423215
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x423214
push dword [ebp - 8]
call fcn.0057e591
push dword [ebp - 8]
mov esi, eax
push edi
push esi
call fcn.00577b60
add esi, 0x8bfe
mov ecx, 0x28b
mov edi, 0x641a68
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
xor edx, edx
mov eax, ecx
push 0x7f
pop esi
div esi
mov eax, dword [edx*4 + 0x641a68]
sub dword [ecx*4 + 0x641c68], eax
inc ecx
cmp ecx, 0x20b
jl 0x4231ea
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4234c9
Capabilities:
Check if file exists
Delete file
Delete registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x630fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00577630
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
mov ebx, 0x6066cc
push eax
mov edx, ebx
call fcn.00422d4f
pop ecx
pop ecx
test eax, eax
je 0x4235a1
push esi
xor esi, esi
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x423552
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x1e
jl 0x423512
jmp 0x423568
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x1005
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea eax, [ebp - 0x210]
push eax
push 2
push 0
push 0x6066dc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x4235a1
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.0055b830
mov esp, ebp
pop ebp
ret
Function at 0x423b28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
push 4
pop edi
mov ecx, dword [esi + 4]
mov eax, dword [esi]
sub ecx, eax
cmp ecx, edi
ja 0x423b47
xor al, al
jmp 0x423be8
movsx eax, byte [eax + 2]
movzx edx, al
mov eax, dword [esi]
push ebx
xor ebx, ebx
movsx eax, byte [eax + 3]
shl eax, 8
or edx, eax
mov eax, dword [esi]
shl edx, 8
movsx eax, byte [eax + 1]
movzx eax, al
or edx, eax
mov eax, dword [esi]
shl edx, 8
movsx eax, byte [eax]
movzx eax, al
or edx, eax
lea eax, [ecx - 4]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edx
call fcn.00424820
mov eax, dword [esi + 4]
mov ecx, ebx
sub eax, dword [esi]
cmp eax, edi
jbe 0x423bae
mov edx, dword [ebp - 0x10]
mov eax, dword [esi]
mov al, byte [eax + edi]
xor al, 0xb8
mov byte [edx + edi - 4], al
movzx eax, al
xor ecx, eax
mov eax, dword [esi + 4]
sub eax, dword [esi]
inc edi
cmp edi, eax
jb 0x423b94
cmp ecx, dword [ebp - 4]
jne 0x423bdd
lea eax, [ebp - 0x10]
cmp esi, eax
je 0x423bdb
mov ecx, esi
call fcn.0040c635
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.0040c635
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x424d60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x630fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x607e74
push 0x607ebc
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x424d9d
lea ecx, [ebp - 0x118]
push ecx
call eax
push 0x3c
lea eax, [ebp - 0x154]
push 0
push eax
call fcn.00577630
and dword [ebp - 0x140], 0
add esp, 0xc
cmp dword [ebp - 0x114], 5
mov ecx, 0x6081e4
mov eax, 0x6081d8
mov dword [ebp - 0x154], 0x3c
cmovne eax, ecx
mov dword [ebp - 0x150], 0x40
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x154]
push eax
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x13c], edi
mov dword [ebp - 0x138], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0055b830
mov esp, ebp
pop ebp
ret

Function at 0x424e18
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x630fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x424e85
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x424e7d
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.005773a7
pop ecx
pop ecx
test eax, eax
jne 0x424e83
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x424e5c
jmp 0x424e85
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055b830
mov esp, ebp
pop ebp
ret

Function at 0x424e9f
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x630fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x424f1f
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x424f1b
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.005773a7
pop ecx
pop ecx
test eax, eax
je 0x424f0d
push dword [ebp - 0x228]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x424ee1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0055b830
mov esp, ebp
pop ebp
ret
Function at 0x424f36
Capabilities:
Read file via mapping

Disassembly:
push 0x18
push 0x61a758
call fcn.0055bfb0
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
push edi
push 0x8000000
push 3
push edi
push 1
push SysReAllocStringLen
call fcn.00406579
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp ebx, 0xffffffff
je 0x424fad
push edi
push edi
push edi
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x424fad
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 0x24], ecx
test ecx, ecx
je 0x424fad
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x424fad
mov eax, dword [ecx + 0x3c]
mov edi, dword [eax + ecx + 0x58]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.00424fc1
jmp fcn.00424fc1

Function at 0x42503f
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, 0x80
mov edi, ecx
push ebx
push edi
mov esi, edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
push eax
push ebx
push esi
push eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x42508f
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x425091
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425098
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x630fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x24c]
mov ebx, ecx
push 0
push eax
call fcn.00577630
push 5
pop ecx
push 0x2c
lea eax, [ebp - 0x30]
mov esi, 0x60823c
lea edi, [ebp - 0x44]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00577630
add esp, 0x18
cmp dword [ebx + 0x14], 8
jb 0x4250ea
mov eax, dword [ebx]
jmp 0x4250ec
mov eax, ebx
push eax
mov edi, 0x104
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057fc53
push 0x607fe0
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057e8b0
push 0x6080f4
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057e8b0
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x24c]
add esp, 0x24
push 0
push eax
call esi
cmp dword [ebx + 0x14], 8
jb 0x425141
mov eax, dword [ebx]
jmp 0x425143
mov eax, ebx
push eax
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057fc53
push 0x607fe0
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057e8b0
push 0x608140
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057e8b0
add esp, 0x24
lea eax, [ebp - 0x24c]
push 0
push eax
call esi
cmp dword [ebx + 0x14], 8
jb 0x42518d
mov eax, dword [ebx]
jmp 0x42518f
mov eax, ebx
push eax
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057fc53
push 0x607fe0
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057e8b0
push 0x6080fc
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057e8b0
add esp, 0x24
lea eax, [ebp - 0x24c]
push 0
push eax
call esi
cmp dword [ebx + 0x14], 8
jb 0x4251d9
mov eax, dword [ebx]
jmp 0x4251db
mov eax, ebx
push eax
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057fc53
mov esi, 0x607fe0
lea eax, [ebp - 0x24c]
push esi
push edi
push eax
call fcn.0057e8b0
push 0x6080fc
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057e8b0
push esi
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057e8b0
push 0x60820c
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057e8b0
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x24c]
add esp, 0x3c
push eax
call esi
test eax, eax
jne 0x42525a
lea eax, [ebp - 0x44]
xor edx, edx
push 0x40
push eax
inc edx
lea ecx, [ebp - 0x24c]
call fcn.0042503f
pop ecx
pop ecx
cmp dword [ebx + 0x14], 8
jb 0x425262
mov ebx, dword [ebx]
push ebx
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057fc53
mov ebx, 0x607fe0
lea eax, [ebp - 0x24c]
push ebx
push edi
push eax
call fcn.0057e8b0
push 0x6080fc
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057e8b0
push ebx
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057e8b0
push 0x608224
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0057e8b0
add esp, 0x3c
lea eax, [ebp - 0x24c]
push eax
call esi
pop edi
pop esi
pop ebx
test eax, eax
jne 0x4252de
lea eax, [ebp - 0x44]
xor edx, edx
push 0x40
push eax
inc edx
lea ecx, [ebp - 0x24c]
call fcn.0042503f
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055b830
mov esp, ebp
pop ebp
ret
Function at 0x4252ec
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b9891
mov eax, dword fs:[0]
push eax
mov eax, 0x14b0
call fcn.0055bf80
mov eax, dword [0x630fe8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x100
xor esi, esi
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.00577630
add esp, 0xc
lea ecx, [ebp - 0x128]
push 0x607668
call fcn.0040395e
mov dword [ebp - 4], esi
call fcn.0055cc83
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x128]
push esi
push 1
call fcn.004039b3
call fcn.0055cc83
or dword [ebp - 0x12c], 0xffffffff
mov edx, eax
xor ecx, ecx
mov dword [ebp - 0x14ac], edx
inc ecx
mov edi, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [ebp + ecx*4 - 0x14ac], edx
inc ecx
cmp ecx, edi
jl 0x42537d
mov dword [ebp - 0x14b0], edi
mov edi, 0xff
mov dword [ebp - 0x14b8], esi
mov dword [ebp - 0x14b4], edi
lea eax, [ebp - 0x14b0]
push eax
lea ecx, [ebp - 0x14b8]
call fcn.004254b4
mov byte [ebp + esi - 0x110], al
inc esi
cmp esi, 0x100
jb 0x4253af
lea eax, [ebp - 0x14b0]
mov dword [ebp - 0x14b8], 0x10
push eax
lea ecx, [ebp - 0x14b8]
mov dword [ebp - 0x14b4], edi
call fcn.004254b4
mov esi, 0x80
movzx edi, al
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
push eax
push esi
push 3
push eax
push eax
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x42544d
push 2
xor ebx, ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea ecx, [ebp - 0x14bc]
push ecx
push edi
lea ecx, [ebp - 0x110]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x42544f
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055b830
mov esp, ebp
pop ebp
ret

Function at 0x4255b7
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x4255ff
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x4255c7
jmp 0x42560c
cmp dword [esi], 0x4e0
jb 0x42560c
call fcn.00425646
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret
Function at 0x425646
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x425656
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x425696
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], ebx
pop esi
pop ebx
ret

Function at 0x428db1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x428ddc
cmp dword [ebx + 0x80], 0
jne 0x428ddc
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.00435765
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.0042906f
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x428e16
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00435765
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x428e4d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00428e6e
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8