joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c460
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
mov ebx, eax
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
mov edx, dword [ebx + 0x12c]
sub edi, eax
test edx, edx
mov ecx, edx
jne 0x40c487
mov ecx, 0x20000
cmp edi, ecx
ja 0x40c4b3
lea edx, [ebp - 8]
push 0
push edx
push edi
push eax
push dword [ebx + 0xd4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x40c528
mov ecx, 1
jmp 0x40c528
mov dword [ebp - 0x18], edi
mov ecx, edi
mov dword [ebp - 0x14], esi
test edx, edx
jne 0x40c4c4
mov edx, 0x20000
mov edi, eax
mov esi, ecx
mov dword [ebp - 4], edx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xd4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40c4f2
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 0xffffffff
jmp 0x40c528
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x12c]
add edi, eax
sub esi, eax
test edx, edx
jne 0x40c508
mov edx, 0x20000
cmp esi, edx
jae 0x40c515
mov dword [ebp - 4], esi
test esi, esi
jne 0x40c519
jmp 0x40c51d
test esi, esi
je 0x40c51d
test eax, eax
ja 0x40c4cb
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 1
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xe8]
and byte [ebx + 0x15d], 0xfb
mov dword [ebx + 0x40], edx
add edx, eax
mov dword [ebx + 0x44], edx
xor eax, eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], eax
mov eax, edi
cdq
mov eax, dword [ebx + 0xb8]
add edi, eax
adc edx, dword [ebx + 0xbc]
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xb0], edi
mov dword [ebx + 0xbc], edx
mov dword [ebx + 0xb4], edx
cmp ecx, 0xffffffff
je 0x40c588
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x10]
mov dword [ebx + 0xd8], eax
mov ebx, dword [ebp - 0xc]
mov eax, 0x26
mov esp, ebp
pop ebp
ret
Function at 0x4196b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
mov ebx, eax
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
mov edx, dword [ebx + 0x12c]
sub edi, eax
test edx, edx
mov ecx, edx
jne 0x4196d7
mov ecx, 0x20000
cmp edi, ecx
ja 0x419703
lea edx, [ebp - 8]
push 0
push edx
push edi
push eax
push dword [ebx + 0xd4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x419778
mov ecx, 1
jmp 0x419778
mov dword [ebp - 0x18], edi
mov ecx, edi
mov dword [ebp - 0x14], esi
test edx, edx
jne 0x419714
mov edx, 0x20000
mov edi, eax
mov esi, ecx
mov dword [ebp - 4], edx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xd4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x419742
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 0xffffffff
jmp 0x419778
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x12c]
add edi, eax
sub esi, eax
test edx, edx
jne 0x419758
mov edx, 0x20000
cmp esi, edx
jae 0x419765
mov dword [ebp - 4], esi
test esi, esi
jne 0x419769
jmp 0x41976d
test esi, esi
je 0x41976d
test eax, eax
ja 0x41971b
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 1
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xe8]
and byte [ebx + 0x15d], 0xfb
mov dword [ebx + 0x40], edx
add edx, eax
mov dword [ebx + 0x44], edx
xor eax, eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], eax
mov eax, edi
cdq
mov eax, dword [ebx + 0xb8]
add edi, eax
adc edx, dword [ebx + 0xbc]
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xb0], edi
mov dword [ebx + 0xbc], edx
mov dword [ebx + 0xb4], edx
cmp ecx, 0xffffffff
je 0x4197d8
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x10]
mov dword [ebx + 0xd8], eax
mov ebx, dword [ebp - 0xc]
mov eax, 0x26
mov esp, ebp
pop ebp
ret
Function at 0x41ca70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
mov ebx, eax
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
mov edx, dword [ebx + 0x12c]
sub edi, eax
test edx, edx
mov ecx, edx
jne 0x41ca97
mov ecx, 0x20000
cmp edi, ecx
ja 0x41cac3
lea edx, [ebp - 8]
push 0
push edx
push edi
push eax
push dword [ebx + 0xd4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x41cb38
mov ecx, 1
jmp 0x41cb38
mov dword [ebp - 0x18], edi
mov ecx, edi
mov dword [ebp - 0x14], esi
test edx, edx
jne 0x41cad4
mov edx, 0x20000
mov edi, eax
mov esi, ecx
mov dword [ebp - 4], edx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xd4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41cb02
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 0xffffffff
jmp 0x41cb38
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x12c]
add edi, eax
sub esi, eax
test edx, edx
jne 0x41cb18
mov edx, 0x20000
cmp esi, edx
jae 0x41cb25
mov dword [ebp - 4], esi
test esi, esi
jne 0x41cb29
jmp 0x41cb2d
test esi, esi
je 0x41cb2d
test eax, eax
ja 0x41cadb
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 1
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xe8]
and byte [ebx + 0x15d], 0xfb
mov dword [ebx + 0x40], edx
add edx, eax
mov dword [ebx + 0x44], edx
xor eax, eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], eax
mov eax, edi
cdq
mov eax, dword [ebx + 0xb8]
add edi, eax
adc edx, dword [ebx + 0xbc]
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xb0], edi
mov dword [ebx + 0xbc], edx
mov dword [ebx + 0xb4], edx
cmp ecx, 0xffffffff
je 0x41cb98
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x10]
mov dword [ebx + 0xd8], eax
mov ebx, dword [ebp - 0xc]
mov eax, 0x26
mov esp, ebp
pop ebp
ret
Function at 0x425340
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov ebx, 1
mov dword [ebp - 0xc], 0
push 1
push 0x530830
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4253cc
mov eax, 0x51eb851f
imul ebx
mov ecx, ebx
sar ecx, 0x1f
sar edx, 5
sub edx, ecx
imul esi, edx, 0x64
mov eax, ebx
sub eax, esi
jne 0x4253cc
cmp ebx, 0x15f90
jge 0x425395
xor eax, eax
jmp 0x4253c5
cmp ebx, 0x1d4c0
jge 0x4253a4
mov eax, 0x32
jmp 0x4253c5
cmp ebx, 0x2bf20
jge 0x4253b3
mov eax, 0x64
jmp 0x4253c5
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x4253c5
mov eax, 0xfa
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4253e0
inc ebx
cmp ebx, 0x57e40
jl 0x425358
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4253f8
mov dword [ebp - 0x10], 0x98
lea eax, [ebp - 0x10]
push eax
call fcn.0043d760
pop ecx
mov eax, dword [0x530834]
test eax, eax
jne 0x42542e
cmp dword [0x525800], 1
je 0x4254b2
xor ebx, ebx
xor esi, esi
cmp dword [0x53082c], 0
je 0x425472
cmp dword [0x525800], 1
mov dword [0x530834], 1
je 0x42545d
push dword [0x530828]
mov dword [0x530830], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4254d0
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00463800
push ebx
push 0x16
call fcn.00463800
add esp, 0x10
jmp 0x42542e
mov dword [0x53082c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x530828], eax
cmp eax, 0xffffffff
jne 0x425496
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x42541b
push 0x4252d0
call fcn.00464220
push 0x4252a0
call fcn.00464220
add esp, 8
jmp 0x42541b
push 1
push 2
call fcn.00463800
mov esi, eax
push 1
push 0x16
call fcn.00463800
add esp, 0x10
mov ebx, eax
jmp 0x425412
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x70
call fcn.0042e2b0
add esp, 0xc
test eax, eax
je 0x4254fa
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov edx, 0x70
mov ecx, dword [edx + 0x52575c]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x525758]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x525754]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x525750]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x425502
push dword [ebp - 0xc]
push dword [0x530828]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0xc]
jmp 0x42544c
Function at 0x425550
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov ebx, 1
mov dword [ebp - 0xc], 0
push 1
push 0x530830
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4255dc
mov eax, 0x51eb851f
imul ebx
mov ecx, ebx
sar ecx, 0x1f
sar edx, 5
sub edx, ecx
imul esi, edx, 0x64
mov eax, ebx
sub eax, esi
jne 0x4255dc
cmp ebx, 0x15f90
jge 0x4255a5
xor eax, eax
jmp 0x4255d5
cmp ebx, 0x1d4c0
jge 0x4255b4
mov eax, 0x32
jmp 0x4255d5
cmp ebx, 0x2bf20
jge 0x4255c3
mov eax, 0x64
jmp 0x4255d5
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x4255d5
mov eax, 0xfa
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4255f0
inc ebx
cmp ebx, 0x57e40
jl 0x425568
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x425608
mov dword [ebp - 0x10], 0x98
lea eax, [ebp - 0x10]
push eax
call fcn.0043d760
pop ecx
mov eax, dword [0x530834]
test eax, eax
jne 0x42563e
cmp dword [0x525800], 1
je 0x4256d7
xor ebx, ebx
xor esi, esi
cmp dword [0x53082c], 0
je 0x425694
cmp dword [0x525800], 1
mov dword [0x530834], 1
je 0x42567f
push dword [0x530828]
mov dword [0x530830], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x425715
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp dword [0x525800], 1
je 0x4256f5
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00463800
push ebx
push 0x16
call fcn.00463800
add esp, 0x10
jmp 0x42563e
mov dword [0x53082c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x530828], eax
cmp eax, 0xffffffff
jne 0x4256bb
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x42562b
push 0x4252d0
call fcn.00464220
push 0x4252a0
call fcn.00464220
add esp, 8
jmp 0x42562b
push 1
push 2
call fcn.00463800
mov esi, eax
push 1
push 0x16
call fcn.00463800
add esp, 0x10
mov ebx, eax
jmp 0x425622
push 1
push 2
call fcn.00463800
push 1
push 0x16
mov dword [ebx + 0x64], eax
call fcn.00463800
add esp, 0x10
mov dword [ebx + 0x68], eax
jmp 0x425673
lea eax, [ebp - 0xc]
push eax
push 0
push 0x70
call fcn.0042e2b0
add esp, 0xc
test eax, eax
je 0x42573c
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov edx, 0x70
mov ecx, dword [edx + 0x52575c]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x525758]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x525754]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x525750]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x425744
push dword [ebp - 0xc]
push dword [0x530828]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp - 0xc]
jmp 0x425661
Function at 0x426560
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x428430
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x431550
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x439360
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]

Function at 0x43936c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], esi
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
cmp dword [0x53a7a0], 0
je 0x43943f
mov eax, dword [ebp + 0x20]
cmp eax, 2
je 0x4393a2
cmp eax, 1
jne 0x4393b1
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
mov eax, 0xffffffff
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x4393c0
cmp eax, 0xfffffffa
je 0x4394c3
test eax, eax
je 0x4394cf
xor eax, eax
xor ebx, ebx
cmp dword [ebp + 0x18], 0
je 0x4393f3
cmp dword [ebp + 0x1c], 0
je 0x4393f3
push ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
call fcn.004ba880
push ebx
call fcn.004ba9f0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add esp, 8
test eax, eax
je 0x43943f
push ebx
push ecx
push edi
call fcn.004ba920
add esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
cmp esi, 0xffffffff
je 0x439536
push 0
push ebx
push 2
push 0x5082bc
call fcn.004ba8e0
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov ebx, dword [ebp - 8]
mov byte [esi + edi], 0xa
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
inc dword [edx]
mov eax, 1
mov esp, ebp
pop ebp
ret
push 0
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x24]
mov edx, dword [ebp + 0x14]
test eax, eax
mov dword [edx], 0
je 0x439467
mov edx, dword [eax + 0x12c]
test edx, edx
jne 0x43946c
mov edx, 0x20000
cmp ecx, edx
jbe 0x43949f
test eax, eax
je 0x43947e
mov ebx, dword [eax + 0x12c]
test ebx, ebx
jne 0x439483
mov ebx, 0x20000
lea edx, [ebp - 0x10]
mov dword [ebp - 0x14], ecx
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
je 0x4394f3
jmp 0x4394b6
lea eax, [ebp - 0x10]
push 0
push eax
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
mov ebx, esi
mov eax, 1
jmp 0x4393d2
mov dword [ebp - 0x14], ecx
call fcn.004bab10
mov ecx, dword [ebp - 0x14]
mov ebx, eax
cmp dword [0x53a7a0], 0
je 0x4393f7
mov eax, 1
jmp 0x4393cc
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
sub dword [ebp - 0x14], edx
add dword [ecx], edx
add edi, edx
cmp dword [ebp + 0x24], 0
je 0x439513
mov ecx, dword [ebp + 0x24]
mov ecx, dword [ecx + 0x12c]
test ecx, ecx
jne 0x439518
mov ecx, 0x20000
cmp ecx, dword [ebp - 0x14]
jb 0x439526
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x43952c
jmp 0x4394b6
cmp dword [ebp - 0x14], 0
je 0x4394b6
test edx, edx
jg 0x439489
jmp 0x4394b6
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43d590
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x7c]
test esi, esi
je 0x43d672
mov eax, dword [0x525800]
mov ebx, dword [esi + 0x14]
lea edx, [ebx*4]
shl ebx, 5
sub ebx, edx
cmp eax, 2
lea edx, [ebx + 0x535c08]
jge 0x43d5e3
mov edx, dword [edx]
test edx, edx
jne 0x43d62d
mov eax, dword [0x525800]
mov dword [ebx + 0x535c08], 1
jmp 0x43d62d
push edx
mov dword [ebp - 0x10], edx
call fcn.004257e0
mov edx, dword [ebp - 0x10]
add esp, 4
test eax, eax
jne 0x43d628
cmp dword [ebx + 0x535c04], 0
je 0x43d736
mov dword [ebx + 0x535c08], 0
push 0xffffffffffffffff
push dword [ebx + 0x535c04]
mov dword [ebp - 0x10], edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x10]
push edx
call fcn.004257e0
pop ecx
mov eax, dword [0x525800]
cmp eax, 1
je 0x43d724
mov eax, dword [esi + 0x18]
dec eax
mov dword [esi + 0x18], eax
test eax, eax
jle 0x43d69c
mov eax, dword [0x525800]
cmp eax, 1
je 0x43d681
cmp eax, 2
jge 0x43d65c
mov dword [ebx + 0x535c08], 0
jmp 0x43d672
push dword [ebx + 0x535c04]
mov dword [ebx + 0x535c08], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
xor eax, eax
mov esp, ebp
pop ebp
ret
push dword [ebx + 0x535c18]
push dword [ebx + 0x535c14]
call fcn.004257c0
add esp, 8
mov eax, dword [0x525800]
jmp 0x43d64b
mov edx, dword [esi]
test edx, edx
je 0x43d6aa
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov edx, dword [esi]
mov eax, dword [esi + 4]
test eax, eax
je 0x43d6b5
mov dword [eax], edx
jmp 0x43d6bb
mov dword [ebx + 0x535c00], edx
mov eax, dword [0x525800]
mov dword [edi + 0x7c], 0
cmp eax, 1
je 0x43d709
cmp eax, 2
jge 0x43d6dd
mov dword [ebx + 0x535c08], 0
jmp 0x43d6f3
push dword [ebx + 0x535c04]
mov dword [ebx + 0x535c08], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.0042e370
push esi
call fcn.0042e370
add esp, 8
jmp 0x43d672
push dword [ebx + 0x535c18]
push dword [ebx + 0x535c14]
call fcn.004257c0
add esp, 8
mov eax, dword [0x525800]
jmp 0x43d6cc
lea eax, [ebx + 0x535c14]
push eax
call fcn.00425790
pop ecx
jmp 0x43d636
mov dword [ebp - 0x10], edx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x535c08], 0
mov dword [ebx + 0x535c04], eax
jmp 0x43d60d
Function at 0x44ab50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
mov ebx, eax
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
mov edx, dword [ebx + 0x12c]
sub edi, eax
test edx, edx
mov ecx, edx
jne 0x44ab77
mov ecx, 0x20000
cmp edi, ecx
ja 0x44aba3
lea edx, [ebp - 8]
push 0
push edx
push edi
push eax
push dword [ebx + 0xd4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x44ac18
mov ecx, 1
jmp 0x44ac18
mov dword [ebp - 0x18], edi
mov ecx, edi
mov dword [ebp - 0x14], esi
test edx, edx
jne 0x44abb4
mov edx, 0x20000
mov edi, eax
mov esi, ecx
mov dword [ebp - 4], edx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xd4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44abe2
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 0xffffffff
jmp 0x44ac18
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x12c]
add edi, eax
sub esi, eax
test edx, edx
jne 0x44abf8
mov edx, 0x20000
cmp esi, edx
jae 0x44ac05
mov dword [ebp - 4], esi
test esi, esi
jne 0x44ac09
jmp 0x44ac0d
test esi, esi
je 0x44ac0d
test eax, eax
ja 0x44abbb
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 1
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xe8]
and byte [ebx + 0x15d], 0xfb
mov dword [ebx + 0x40], edx
add edx, eax
mov dword [ebx + 0x44], edx
xor eax, eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], eax
mov eax, edi
cdq
mov eax, dword [ebx + 0xb8]
add edi, eax
adc edx, dword [ebx + 0xbc]
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xb0], edi
mov dword [ebx + 0xbc], edx
mov dword [ebx + 0xb4], edx
cmp ecx, 0xffffffff
je 0x44ac78
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x10]
mov dword [ebx + 0xd8], eax
mov ebx, dword [ebp - 0xc]
mov eax, 0x26
mov esp, ebp
pop ebp
ret
Function at 0x47b1b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x525ccc]
jne 0x47b1ba
repz ret
jmp fcn.00493580
Function at 0x4057ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.00404b0c
fistp qword [ebp + 0x468cc74]
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x4057d5
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x405800
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je 0x4059ca
cmp dword [ebp + 0xc], 1
je 0x4059ca
cmp dword [ebp + 0xc], 8
jne 0x405992
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
invalid
invalid
dec esp
Function at 0x1000c2c7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002b19c]
jne 0x1000c2d1
repz ret
jmp fcn.10011efc
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x403e59
pop dword [ebp - 0x38]
mov eax, 0x403e59
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x31b6921c
add dword [ebp - 0x48], 0x1c9bb32f
mov dword [ebp - 0x44], 0x647ddf08
sub dword [ebp - 0x44], 0x324a92c3
mov dword [ebp - 0x40], 0x93b76c7d
add dword [ebp - 0x40], 0xb894d7b1
mov dword [ebp - 0x3c], 0x1a14e71f
add dword [ebp - 0x3c], 0xe5eb18e1
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xa3afd881
sub dword [ebp - 0x48], 0x2f3d6f2b
mov dword [ebp - 0x44], 0xc35d8f0e
sub dword [ebp - 0x44], 0x81f12d99
mov dword [ebp - 0x40], 0x921ad9b
add dword [ebp - 0x40], 0x5a4dbed1
mov dword [ebp - 0x3c], 0xd93ce57a
sub dword [ebp - 0x3c], 0xd93ce57a
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xe03b4336
sub eax, 0xdffac262
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39e75
push 0
call eax
mov ecx, 0xae8573fb
sub ecx, 0xae851f5b
mov edx, eax
mov edi, 0x411000
add edi, dword [ebp - 0x38]
mov esi, 0x6f4f60cf
add dword [ebp - 0x24], 0x33e17c94
mov ebx, dword [edi]
xor dword [ebp - 0xc], esi
xor ebx, esi
sub dword [ebp - 0x18], ecx
mov dword [edx], ebx
xor dword [ebp - 0x10], esi
add edx, 0x3d32ab52
add edx, 0xc2cd54b2
add edi, 0xed01eba2
add edi, 0x12fe1462
loop 0x403f65
add eax, 0x8eb5c893
sub eax, 0x8eb48340
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xeffda19a
sub ecx, 0xefbda19a
add ecx, dword [ebp - 0x38]
call ebx
leave
ret