joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5323e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xa8]
mov ebp, dword [0xd41044]
mov dword [esp + 0x4c], ebp
xor ebp, ebp
mov edx, dword [esp + 0xac]
mov ecx, dword [esp + 0xb0]
mov ebx, dword [esp + 0xb4]
mov esi, dword [esp + 0xb8]
mov edi, dword [esp + 0xbc]
mov ebp, dword [esp + 0x4c]
sub ebp, dword [0xd41044]
jne 0x53257f
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xbc], edi
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xb8], esi
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xb4], ebx
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xb0], ecx
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xac], edx
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x70], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00531be0
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x57a9d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov eax, dword [esp + 0x80]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xac]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0xb8]
mov ebp, dword [0xd41044]
mov dword [esp + 0x5c], ebp
xor ebp, ebp
mov edx, dword [esp + 0xc8]
mov ecx, dword [esp + 0xcc]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0xbc]
mov ebx, dword [esp + 0xd0]
mov esi, dword [esp + 0xd4]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0xc0]
mov edi, dword [esp + 0xd8]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0xc4]
mov ebp, dword [esp + 0x5c]
sub ebp, dword [0xd41044]
jne 0x57abc9
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0xd8], edi
mov dword [esp + 0xc0], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0xd4], esi
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc8], edx
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x80], eax
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
jmp 0x579e50
call fcn.00401690
nop
nop
Function at 0x587f60
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov dword [esp], str.zip_entry_open
mov eax, dword [0xd41044]
mov dword [esp + 0x1c], eax
xor eax, eax
mov byte [esp + 0x13], 0
mov esi, dword [esp + 0x48]
call sub.msvcrt.dll_puts
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.005abf60
test eax, eax
js 0x58806f
lea eax, [esp + 0x14]
mov dword [esp], ebx
mov dword [esp + 8], eax
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.005ac140
test eax, eax
js 0x5880a0
mov dword [esp], ebx
call fcn.005aacf0
mov dword [esp], esi
mov dword [esp + 4], 0xd3830a
call sub.msvcrt.dll_fopen
mov ebp, dword [esp + 0x18]
mov esi, eax
test eax, eax
je 0x5880c0
mov ebx, dword [esp + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp + 8], ebx
mov dword [esp], ebp
call sub.msvcrt.dll_fwrite
cmp ebx, eax
jne 0x588082
mov ebx, 0x12c00000
lea edi, [esp + 0x13]
lea esi, [esi]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], edi
call sub.msvcrt.dll_fwrite
sub ebx, 1
jne 0x588028
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp], ebp
call sub.msvcrt.dll_free
xor eax, eax
mov edx, dword [esp + 0x1c]
sub edx, dword [0xd41044]
jne 0x5880b6
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Failed_to_open_zip_entry
call fcn.0040f950
mov eax, 0xffffffff
jmp 0x58805b
mov dword [esp], str.Error_writing_to_file
call fcn.0040f950
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp], ebp
call sub.msvcrt.dll_free
jmp 0x58807b
mov dword [esp], str.Failed_to_read_zip_entry
call fcn.0040f950
mov dword [esp], ebx
call fcn.005aacf0
jmp 0x58807b
call fcn.00401690
lea esi, [esi]
nop
mov dword [esp], str.Error_opening_file
call fcn.0040f950
mov dword [esp], ebp
call sub.msvcrt.dll_free
jmp 0x58807b
Function at 0x58db30
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [0xd41044]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
not eax
cmp esi, 3
jbe 0x58dc10
lea edx, [esi - 4]
shr edx, 2
lea ebx, [ecx + edx*4 + 4]
nop
mov edx, eax
xor al, byte [ecx]
add ecx, 4
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa88040]
mov eax, edx
xor dl, byte [ecx - 3]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0xa88040]
mov edx, eax
xor al, byte [ecx - 2]
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa88040]
mov eax, edx
xor dl, byte [ecx - 1]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0xa88040]
cmp ecx, ebx
jne 0x58db60
and esi, 3
test esi, esi
je 0x58dbf6
mov edx, eax
xor al, byte [ebx]
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa88040]
mov eax, edx
cmp esi, 1
je 0x58dbf6
xor al, byte [ebx + 1]
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0xa88040]
mov eax, edx
cmp esi, 2
je 0x58dbf6
xor al, byte [ebx + 2]
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0xa88040]
mov eax, edx
not eax
mov edx, dword [esp + 0xc]
sub edx, dword [0xd41044]
jne 0x58dc14
add esp, 0x14
pop ebx
pop esi
ret
mov ebx, ecx
jmp 0x58dbb1
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
Function at 0x5abf60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
mov ecx, dword [0xd41044]
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
sub ecx, dword [0xd41044]
jne 0x5abf8d
xor ecx, ecx
add esp, 0x1c
jmp fcn.00580620
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x5ac960
Capabilities:
Create directory

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x22c
movzx ebx, byte [esi]
mov eax, dword [0xd41044]
mov dword [esp + 0x21c], eax
xor eax, eax
lea ebp, [esp + 0x1b]
cmp bl, 0x40
jg 0x5aca30
lea edi, [esp + 0x1c]
mov ecx, ebp
xor eax, eax
mov dword [esp + 0x1b], 0
mov dword [esp + 0x218], 0
sub ecx, edi
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
test bl, bl
je 0x5aca10
xor edi, edi
jmp 0x5ac9ec
cmp bl, 0x5c
je 0x5ac9f1
mov dword [esp], edi
add esi, 1
mov dword [esp + 4], 1
call fcn.00402690
mov byte [esp + eax + 0x1a], bl
mov edi, eax
movzx ebx, byte [esi]
cmp eax, 0x200
je 0x5aca10
test bl, bl
je 0x5aca10
cmp bl, 0x2f
jne 0x5ac9c0
test edi, edi
je 0x5ac9c5
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__mkdir]
cmp eax, 0xffffffff
je 0x5acb30
movzx ebx, byte [esi]
jmp 0x5ac9c5
xor eax, eax
mov edx, dword [esp + 0x21c]
sub edx, dword [0xd41044]
jne 0x5acb5d
add esp, 0x22c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp bl, 0x5a
jg 0x5aca70
cmp byte [esi + 1], 0x3a
lea edi, [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x1b], 0
mov dword [esp + 0x218], 0
je 0x5aca98
sub ecx, edi
xor eax, eax
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
jmp 0x5ac9b6
lea eax, [ebx - 0x61]
cmp al, 0x19
jbe 0x5aca35
mov dword [esp + 0x1b], 0
lea edi, [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x218], 0
jmp 0x5aca54
sub ecx, edi
xor eax, eax
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
lea edi, [esi + 2]
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], 0x3a
movzx esi, byte [esi + 2]
mov eax, esi
test al, al
je 0x5aca10
mov ebx, 2
jmp 0x5acb08
cmp al, 0x5c
je 0x5acb0e
mov dword [esp], ebx
add edi, 1
mov dword [esp + 4], 1
call fcn.00402690
mov ebx, eax
mov eax, esi
movzx esi, byte [edi]
mov byte [esp + ebx + 0x1a], al
mov eax, esi
test al, al
je 0x5aca10
cmp ebx, 0x200
je 0x5aca10
mov eax, esi
cmp al, 0x2f
jne 0x5acad0
cmp ebx, 2
je 0x5acad4
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__mkdir]
cmp eax, 0xffffffff
je 0x5acb50
movzx esi, byte [edi]
jmp 0x5acad4
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x11
je 0x5aca07
mov eax, 0xffffffe9
jmp 0x5aca12
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x11
je 0x5acb21
jmp 0x5acb3f
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x10003cc0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, eax
test esi, esi
jne 0x10003ce1
mov esi, 0x11f48009
call fcn.100026d0
test eax, eax
je 0x10003d5f
push 0x11f
push esi
jmp 0x10003d3b
push 0
push 0x80
push 1
push 0
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x10003d15
mov esi, 0x12648105
call fcn.100026d0
test eax, eax
je 0x10003d5f
push 0x126
push esi
jmp 0x10003d3b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10003d5d
mov esi, 0x12a4810d
call fcn.100026d0
test eax, eax
je 0x10003d5f
push 0x12a
push esi
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push str.TbDataSwap:_Error__0x_x__Line___d
push 0x48
push 1
push eax
call edx
mov eax, esi
and eax, 0xfff
add esp, 0x18
neg eax
sbb eax, eax
inc eax
pop esi
ret
xor esi, esi
mov eax, esi
and eax, 0xfff
neg eax
sbb eax, eax
inc eax
pop esi
ret

Function at 0x1000503f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000a018]
jne 0x10005049
repz ret
jmp fcn.1000552e
Function at 0x401a40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401a59
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x401a6d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401a8e
cmp esi, eax
jae 0x401a67
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401a80
cmp esi, eax
jae 0x401a67
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40f2c0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x118
mov eax, dword [0x455e64]
mov edx, dword [esp + 0x11c]
push ebp
push esi
mov ebp, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
mov dword [esp + 0x128], eax
mov eax, dword [ebp]
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40f3e2
lea ecx, [esp + 8]
call fcn.0040f1a0
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
jne 0x40f3e6
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push esi
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x40f390
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
call fcn.0040f2c0
mov edi, eax
test edi, edi
jne 0x40f40a
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x40f352
mov eax, dword [esp + 0xc]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40f3a9
push eax
call edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x128]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40f3c8
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.004274c1
add esp, 0x118
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x40f3f1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.004274c1
add esp, 0x118
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40f419
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x120]
mov eax, edi
pop edi
pop esi
pop ebp
call fcn.004274c1
add esp, 0x118
ret 4
Function at 0x40f8f0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x40f902
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x412fe0
Capabilities:
Create thread

Disassembly:
mov ecx, dword [0x454e08]
mov eax, 0x9a96bd3d
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
mov ebx, dword [0x454dfc]
mov edx, ebx
imul edx, edx, 0x1628
sub edx, eax
mov eax, dword [0x454df8]
push esi
imul eax, eax, 0x9f1
push edi
mov edi, dword [0x454e14]
imul edi, edi, 0x10a2
add edx, edi
lea edx, [eax + edx + 0x20a4]
cmp dword [esp + 0x10], 0x132b600
mov dword [str._r_____r_____n], edx
je 0x413057
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x413047
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov esi, dword [0x454df4]
mov eax, 0x950d22f9
imul esi
add edx, esi
mov esi, dword [0x454e0c]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x1a7f
push ebp
mov ebp, eax
sub ebp, edx
mov eax, 0xa06e4bd5
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e10]
sub ebp, eax
mov eax, 0x3de9fdd3
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, dword [str._r_____r_____n]
mov eax, dword [0x56748c]
mov edx, eax
inc eax
test edx, edx
mov dword [0x454df4], ebp
mov dword [0x56748c], eax
pop ebp
jle 0x41310b
mov ecx, dword [0x454e00]
imul esi, esi, 0x9f1
mov eax, 0x1f5f3801
imul ecx, ecx, 0x16c0
imul ebx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
add eax, esi
sub eax, edi
pop edi
add eax, 0x1697
pop esi
mov dword [0x454df8], eax
mov eax, 1
pop ebx
ret
mov eax, 0x2d5481cb
imul ebx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x5c6f35cd
imul dword [0x454e14]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x5c6f35cd
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x3de9fdd3
imul esi
sub ebx, edi
sub ebx, ecx
sar edx, 0xa
lea ecx, [esp + 0x10]
push ecx
push 0
mov eax, edx
push 0
shr eax, 0x1f
add eax, edx
push 0x412b30
sub ebx, eax
push 0
sub ebx, 0x1b7b
push 0
mov dword [0x567198], 0
mov dword [0x454dfc], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x454e08]
mov esi, dword [0x454e10]
mov eax, 0xb40b40b5
imul esi, esi, 0x1b7b
imul ecx
add edx, ecx
mov ecx, dword [0x454e04]
sar edx, 0xc
imul ecx, ecx, 0x108a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454df8]
imul edx, edx, 0x9f1
sub esi, eax
add esi, ecx
lea eax, [esi + edx + 0x20a4]
pop edi
pop esi
mov dword [0x454e00], eax
mov eax, 1
pop ebx
ret
Function at 0x4174f0
Capabilities:
Create thread

Disassembly:
mov ecx, dword [0x454e00]
mov eax, 0x1f5f3801
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
push esi
mov esi, dword [0x454e14]
push edi
mov edi, eax
mov eax, 0x1f5f3801
imul esi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x1b7b
mov ebx, eax
sub ebx, edi
sub ebx, edx
mov edx, dword [0x454e04]
mov eax, 0x7b214ec3
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add ebx, edx
lea edx, [eax + ebx + 0x16c0]
cmp dword [esp + 0x10], 0x132b600
mov dword [0x454e04], edx
je 0x4175c1
mov ecx, dword [0x454e08]
imul esi, esi, 0x10a2
mov eax, 0x9a96bd3d
imul ecx
add edx, ecx
mov ecx, dword [0x454dfc]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
imul ecx, ecx, 0x1628
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454df8]
sub ecx, eax
add ecx, esi
imul edx, edx, 0x9f1
lea eax, [ecx + edx + 0x20a4]
mov dword [str._r_____r_____n], eax
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x4175b1
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov esi, dword [0x454df8]
imul ecx, ecx, 0x1b7c
mov edx, dword [0x454dfc]
imul edx, edx, 0x1a7f
mov eax, esi
imul eax, eax, 0x1988
add ecx, edx
sub ecx, eax
mov eax, 0x3de9fdd3
imul esi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [0x56718c]
test eax, eax
mov dword [0x454e08], ecx
jne 0x4176ba
mov edx, dword [0x454df4]
imul ecx, ecx, 0x20a4
imul edx, edx, 0x16c0
add ecx, edx
mov edx, dword [0x454e10]
mov eax, 0x5c6f35cd
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, esi
add ecx, 0x625
mov dword [0x454e10], ecx
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x416130
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x454e08]
mov esi, dword [0x454e10]
mov dword [0x56717c], eax
imul esi, esi, 0x1b7b
mov eax, 0xb40b40b5
imul ecx
add edx, ecx
mov ecx, dword [0x454e04]
sar edx, 0xc
imul ecx, ecx, 0x108a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454df8]
sub esi, eax
add esi, ecx
imul edx, edx, 0x9f1
lea eax, [esi + edx + 0x20a4]
mov dword [0x56718c], 1
mov dword [0x454e00], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x419dd0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x442348
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [0x454e08]
mov eax, 0x9a96bd3d
imul ecx
add edx, ecx
mov ecx, dword [0x454dfc]
imul ecx, ecx, 0x1628
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e14]
sub ecx, eax
imul edx, edx, 0x10a2
mov eax, dword [0x454df8]
imul eax, eax, 0x9f1
add ecx, edx
mov edx, dword [0x56ab74]
lea ecx, [ecx + eax + 0x20a4]
push esi
mov dword [str._r_____r_____n], ecx
push edi
mov ecx, 0x56ab74
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [0x454dfc]
mov eax, 0x2d5481cb
imul ecx
mov ecx, dword [0x454e14]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x5c6f35cd
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x454e08]
mov eax, 0x5c6f35cd
imul ecx
mov ecx, dword [0x454e0c]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, esi
sub edi, eax
mov eax, 0x3de9fdd3
imul ecx
mov eax, dword [esp + 0x1c]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
lea edx, [esp + 0x20]
push edx
sub edi, 0x1b7b
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [0x454dfc], edi
call fcn.00419b40
mov esi, dword [0x454e00]
mov ecx, dword [0x454dfc]
imul esi, esi, 0x1b7c
imul ecx, ecx, 0x1a7f
add esi, ecx
mov ecx, dword [0x454df8]
mov edx, ecx
imul edx, edx, 0x1988
sub esi, edx
mov eax, 0x3de9fdd3
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x454e08], esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
jg 0x419f49
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret