joyce8/EMBER2024-capa huggingface dataset:
Function at 0x597590
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
sub edx, 2
push ebx
push edi
je 0x597636
dec edx
je 0x5975f4
dec edx
jne 0x5976db
movzx edi, byte [ebp - 4]
mov dl, byte [ecx + eax*4 + 0x18]
xor dl, byte [edi + 0x6507c8]
movzx edi, byte [ebp - 2]
mov bl, byte [edi + 0x6506c8]
xor bl, byte [ecx + eax*4 + 0x1a]
movzx edi, byte [ebp - 1]
mov byte [ebp - 4], dl
movzx edx, byte [ebp - 3]
mov dl, byte [edx + 0x6506c8]
xor dl, byte [ecx + eax*4 + 0x19]
mov byte [ebp - 2], bl
mov bl, byte [edi + 0x6507c8]
xor bl, byte [ecx + eax*4 + 0x1b]
mov byte [ebp - 1], bl
jmp 0x5975f7
mov dl, byte [ebp - 3]
movzx edi, byte [ebp - 4]
mov bl, byte [ecx + eax*4 + 0x10]
xor bl, byte [edi + 0x6507c8]
movzx edx, dl
mov dl, byte [edx + 0x6507c8]
xor dl, byte [ecx + eax*4 + 0x11]
mov byte [ebp - 3], dl
movzx edx, byte [ebp - 2]
mov dl, byte [edx + 0x6506c8]
xor dl, byte [ecx + eax*4 + 0x12]
mov byte [ebp - 2], dl
movzx edx, byte [ebp - 1]
mov dl, byte [edx + 0x6506c8]
xor dl, byte [ecx + eax*4 + 0x13]
jmp 0x59763c
mov dl, byte [ebp - 1]
mov bl, byte [ebp - 4]
movzx edi, byte [ecx + eax*4 + 8]
movzx ebx, bl
movzx ebx, byte [ebx + 0x6506c8]
xor edi, ebx
movzx edi, byte [edi + 0x6506c8]
movzx ebx, byte [ecx + eax*4]
xor edi, ebx
movzx ebx, byte [edi + 0x6507c8]
movzx edi, byte [ebp - 3]
movzx edi, byte [edi + 0x6507c8]
mov byte [ebp - 4], bl
movzx ebx, byte [ecx + eax*4 + 9]
xor edi, ebx
movzx edi, byte [edi + 0x6506c8]
movzx ebx, byte [ecx + eax*4 + 1]
xor edi, ebx
movzx ebx, byte [edi + 0x6506c8]
movzx edi, byte [ebp - 2]
movzx edi, byte [edi + 0x6506c8]
mov byte [ebp - 3], bl
movzx ebx, byte [ecx + eax*4 + 0xa]
xor edi, ebx
movzx ebx, byte [ecx + eax*4 + 2]
movzx edi, byte [edi + 0x6507c8]
movzx edx, dl
movzx edx, byte [edx + 0x6507c8]
xor edi, ebx
mov bl, byte [edi + 0x6507c8]
movzx edi, byte [ecx + eax*4 + 0xb]
movzx eax, byte [ecx + eax*4 + 3]
xor edx, edi
movzx edx, byte [edx + 0x6507c8]
xor edx, eax
mov al, byte [edx + 0x6506c8]
jmp 0x5976e1
mov al, byte [ebp - 1]
mov bl, byte [ebp - 2]
movzx ecx, al
mov eax, dword [ecx*4 + 0x6514c8]
movzx ecx, byte [ebp - 3]
movzx edx, bl
xor eax, dword [edx*4 + 0x6510c8]
movzx edx, byte [ebp - 4]
xor eax, dword [ecx*4 + 0x650cc8]
pop edi
xor eax, dword [edx*4 + 0x6508c8]
pop ebx
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 3], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
shr ecx, 8
mov byte [esi + 2], dl
mov byte [esi + 1], cl
mov byte [esi], al
mov esp, ebp
pop ebp
ret
Function at 0x59c760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
call fcn.0041b6d0
mov edi, eax
lea ecx, [esi + 0x20]
mov dword [ebp - 4], edi
call fcn.0041b6d0
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ecx + esi*4 + 4]
mov ecx, dword [ecx + esi*4]
xor ecx, dword [edi]
mov dword [ebp - 0xc], edx
mov edx, dword [edx]
xor esi, esi
jmp 0x59c7a0
mov edi, ecx
and edi, 0xff0000
or edi, 0x1000000
shr edi, 0x10
mov edi, dword [eax + edi*4]
mov ebx, ecx
shr ebx, 0x18
add edi, dword [eax + ebx*4]
mov ebx, ecx
and ebx, 0xff00
or ebx, 0x20000
shr ebx, 8
xor edi, dword [eax + ebx*4]
mov ebx, ecx
and ebx, 0xff
or ebx, 0x300
add edi, dword [eax + ebx*4]
mov ebx, dword [ebp - 4]
xor edi, dword [ebx + esi*4 + 4]
add esi, 2
xor edx, edi
mov edi, edx
and edi, 0xff0000
or edi, 0x1000000
shr edi, 0x10
mov edi, dword [eax + edi*4]
mov ebx, edx
shr ebx, 0x18
add edi, dword [eax + ebx*4]
mov ebx, edx
and ebx, 0xff00
or ebx, 0x20000
shr ebx, 8
xor edi, dword [eax + ebx*4]
mov ebx, edx
and ebx, 0xff
or ebx, 0x300
add edi, dword [eax + ebx*4]
mov ebx, edi
mov edi, dword [ebp - 4]
xor ebx, dword [edi + esi*4]
xor ecx, ebx
cmp esi, 0xe
jbe 0x59c7a0
mov eax, dword [edi + 0x44]
mov esi, dword [ebp + 0xc]
xor eax, edx
mov edx, dword [ebp + 8]
pop edi
mov dword [edx + esi*4], eax
mov eax, dword [ebp - 0xc]
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x59c860
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
xor eax, eax
push esi
push edi
lea ecx, [ebx + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
call fcn.004078c0
cdq
and edx, 3
lea esi, [edx + eax]
sar esi, 2
lea ecx, [ebx + 0x20]
mov dword [ebp - 8], esi
call fcn.004078c0
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [ebx + 4]
mov dword [ebp - 0x14], eax
call fcn.0041b6d0
lea ecx, [ebx + 0x20]
mov dword [ebp - 0xc], eax
call fcn.0041b6d0
xor edi, edi
mov dword [ebp - 0x18], eax
test esi, esi
jle 0x59c918
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
movzx esi, byte [eax + ecx]
inc eax
cdq
idiv ebx
shl esi, 8
inc edi
movzx ecx, byte [edx + ecx]
lea eax, [edx + 1]
cdq
idiv ebx
mov eax, dword [ebp + 8]
or ecx, esi
shl ecx, 8
movzx esi, byte [edx + eax]
lea eax, [edx + 1]
cdq
idiv ebx
or esi, ecx
mov ecx, dword [ebp + 8]
shl esi, 8
movzx ecx, byte [edx + ecx]
lea eax, [edx + 1]
cdq
idiv ebx
mov eax, dword [ebp - 0xc]
or ecx, esi
xor dword [eax + edi*4 - 4], ecx
mov dword [ebp - 4], edx
cmp edi, dword [ebp - 8]
jl 0x59c8c1
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
xor edi, edi
test esi, esi
jle 0x59c944
mov edi, edi
push 0
lea edx, [ebp - 0x20]
push edx
mov ecx, ebx
call fcn.0059c760
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov dword [eax + edi*4], ecx
mov dword [eax + edi*4 + 4], edx
add edi, 2
cmp edi, esi
jl 0x59c920
mov edi, dword [ebp - 0x14]
xor esi, esi
test edi, edi
jle 0x59c974
lea ecx, [ecx]
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.0059c760
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov dword [eax + esi*4], ecx
mov dword [eax + esi*4 + 4], edx
add esi, 2
cmp esi, edi
jl 0x59c950
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x59cbd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ax, word [ebp + 0xc]
xor edx, edx
sub esp, 0x18
cmp dx, ax
jae 0x59ccfe
push ebx
push esi
mov esi, dword [ebp + 8]
lea edx, [ecx + 4]
movzx eax, ax
add ecx, 0x20
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
call fcn.0041b6d0
mov ecx, dword [ebp - 0x14]
mov edi, eax
mov dword [ebp + 0xc], edi
call fcn.0041b6d0
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor ecx, dword [edi]
xor esi, esi
jmp 0x59cc30
mov edi, ecx
and edi, 0xff0000
or edi, 0x1000000
shr edi, 0x10
mov edi, dword [eax + edi*4]
mov ebx, ecx
shr ebx, 0x18
add edi, dword [eax + ebx*4]
mov ebx, ecx
and ebx, 0xff00
or ebx, 0x20000
shr ebx, 8
xor edi, dword [eax + ebx*4]
mov ebx, ecx
and ebx, 0xff
or ebx, 0x300
add edi, dword [eax + ebx*4]
mov ebx, dword [ebp + 0xc]
xor edi, dword [ebx + esi*4 + 4]
add esi, 2
xor edx, edi
mov edi, edx
and edi, 0xff0000
or edi, 0x1000000
shr edi, 0x10
mov edi, dword [eax + edi*4]
mov ebx, edx
shr ebx, 0x18
add edi, dword [eax + ebx*4]
mov ebx, edx
and ebx, 0xff00
or ebx, 0x20000
shr ebx, 8
xor edi, dword [eax + ebx*4]
mov ebx, edx
and ebx, 0xff
or ebx, 0x300
add edi, dword [eax + ebx*4]
mov ebx, edi
mov edi, dword [ebp + 0xc]
xor ebx, dword [edi + esi*4]
xor ecx, ebx
cmp esi, 0xe
jbe 0x59cc30
mov esi, dword [edi + 0x44]
mov eax, dword [ebp - 4]
xor esi, edx
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], esi
mov esi, dword [ebp - 8]
mov dword [edx + eax*4 + 4], ecx
add eax, 2
add esi, 8
dec dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
jne 0x59cc07
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x59d720
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x68683c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea ecx, [esi + 0x28]
call fcn.0044da90
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x59d79a
mov ecx, dword [eax + 0xc]
cmp dword [ecx], 0
je 0x59d75a
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov dword [esi + 0x118], edx
jmp 0x59d764
mov dword [esi + 0x118], 0
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
lea ecx, [eax + 3]
push ecx
lea edx, [eax + 2]
push edx
lea ecx, [eax + 1]
push ecx
push eax
push str._b._b._b._b
lea edx, [ebp - 0x2c]
push 0x28
push edx
call fcn.0044d4b0
add esp, 0x1c
lea eax, [ebp - 0x2c]
push eax
lea ecx, [esi + 0xa0]
call fcn.00451510
jmp 0x59d7a5
lea ecx, [esi + 0xa0]
call fcn.0044eee0
mov ecx, dword [ebp - 4]
mov byte [esi + 0x114], 0
xor ecx, ebp
pop esi
call fcn.005a6cf8
mov esp, ebp
pop ebp
ret
Function at 0x5a2200
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c2a4b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x68683c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [esi], vtable.BufferedSource.0
mov dword [esi + 8], 0xfa0
mov dword [esi + 0xc], ebx
call fcn.0041b9a0
push 0x1388
lea ecx, [esi + 0x10]
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x40], bl
call fcn.00420200
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a6cf8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x68683c]
jne 0x5a6d02
repz ret
jmp fcn.005a7699
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x7ff0caa
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x32485d21
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x41c230
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x41c252
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41c259
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41c248
mov eax, 1
add ebx, ebx
jne 0x41c26b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41c260
jne 0x41c27c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c260
xor ecx, ecx
sub eax, 3
jb 0x41c290
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41c302
mov ebp, eax
add ebx, ebx
jne 0x41c29b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41c2a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41c2cc
inc ecx
add ebx, ebx
jne 0x41c2b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41c2ad
jne 0x41c2c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c2ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41c2ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41c2dd
jmp 0x41c24e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41c2ec
add edi, ecx
jmp 0x41c24e
pop esi
mov edi, esi
mov ecx, 2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41c30a
cmp byte [edi], 5
jne 0x41c30a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41c30f
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41c387
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x21bac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x21be8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41c33c
mov ecx, edi
jns 0x41c36b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21bec]
or eax, eax
je 0x41c381
mov dword [ebx], eax
add ebx, 4
jmp 0x41c359
call dword [esi + 0x21bf0]
popal
jmp 0x401150
Function at 0x41fa44
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x47aff5
call fcn.0047abb4
sub esp, 0x60
push ebx
push esi
xor esi, esi
cmp byte [0x5eb67a], 0
push edi
jne 0x41fb62
push 0x2220
call dword [sym.imp.SDL2.dll_SDL_Init]
pop ecx
test eax, eax
je 0x41fad4
call dword [sym.imp.SDL2.dll_SDL_GetError]
push dword [ebp - 0x18]
mov ebx, eax
push ecx
lea ecx, [ebp - 0x50]
call fcn.00429736
push ecx
push 0x1a
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00428f39
mov edx, esi
mov cl, byte [edi + edx + 1]
lea eax, [ebp - 0x34]
xor cl, byte [edi]
cmp dword [ebp - 0x20], 0xf
cmova eax, dword [ebp - 0x34]
mov byte [eax + edx], cl
inc edx
cmp edx, 0x1a
jb 0x41fa96
mov dword [ebp - 4], esi
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 0xf
push ebx
cmova eax, dword [ebp - 0x34]
push eax
call fcn.00466ad4
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call fcn.00428ee0
jmp 0x41fb62
push esi
call dword [sym.imp.SDL2.dll_SDL_GameControllerOpen]
mov dword [0x5eb0a8], eax
pop ecx
test eax, eax
jne 0x41fb43
call dword [sym.imp.SDL2.dll_SDL_GetError]
push dword [ebp - 0x18]
mov ebx, eax
push ecx
lea ecx, [ebp - 0x69]
call fcn.004297e2
push ecx
push 0x33
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00428f39
mov cl, byte [edi + esi + 1]
lea eax, [ebp - 0x34]
xor cl, byte [edi]
cmp dword [ebp - 0x20], 0xf
cmova eax, dword [ebp - 0x34]
mov byte [eax + esi], cl
inc esi
cmp esi, 0x33
jb 0x41fb06
mov dword [ebp - 4], 1
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 0xf
push ebx
cmova eax, dword [ebp - 0x34]
push eax
call fcn.00466ad4
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call fcn.00428ee0
lea ecx, [ebp - 0x1c]
call fcn.0041a49c
mov byte [0x5eb67a], 1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [0x5eb040], ecx
mov dword [0x5eb044], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x420305
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov al, byte [0x5eb322]
sub esp, 0x10
push esi
push edi
mov edi, ecx
test al, al
jne 0x420335
mov eax, dword [edi]
push ecx
mov ecx, dword [eax*4 + 0x480ca8]
call fcn.0046719c
pop ecx
test al, al
je 0x42038a
mov byte [0x5eb322], 1
jmp 0x42038a
cmp al, 1
jne 0x42038a
push ecx
mov ecx, 0x47ff78
call fcn.0046719c
and dword [ebp - 4], 0
lea edx, [ebp - 8]
pop ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], 0x46
call fcn.0042998b
mov ecx, eax
call fcn.0042c9a4
mov esi, 0x4809d0
push dword [esi]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x42037f
mov eax, dword [esi]
mov dword [edi], eax
mov byte [0x5eb322], 0
add esi, 4
cmp esi, 0x480ca8
jne 0x420367
pop edi
pop esi
leave
ret
Function at 0x42173f
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
push esi
call fcn.0042131f
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
xor esi, esi
push esi
push esi
push 0x47ff98
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x42176c
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push edi
push 0
push 2
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x22c], 0x22c
lea eax, [ebp - 0x22c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x42180d
push esi
mov ecx, ebx
lea eax, [ebp - 0x208]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4217d0
test dx, dx
je 0x4217cc
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4217d0
add eax, 4
add ecx, 4
test dx, dx
jne 0x4217aa
xor eax, eax
jmp 0x4217d5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4217fa
push dword [ebp - 0x224]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x22c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4217a2
pop esi
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
leave
ret
Function at 0x4285c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4285e3
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x4286b6
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x2c]
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x24], edi
test ecx, ecx
je 0x428610
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x428616
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x42867e
jg 0x42862d
test esi, esi
je 0x42867e
test ecx, ecx
jl 0x428678
jg 0x428637
test eax, eax
je 0x428678
cmp edi, ecx
jg 0x42864b
jl 0x428641
cmp esi, eax
jae 0x42864b
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov ebp, dword [esp + 0x2c]
push eax
push ebp
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov ecx, dword [esp + 0x10]
add ebp, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x428682
mov ebp, dword [esp + 0x2c]
jmp 0x42868c
mov ebp, dword [esp + 0x2c]
test edi, edi
jl 0x4286a7
jg 0x42868c
test esi, esi
je 0x4286a7
cmp dword [ebx + 0x4c], 0
je 0x4286a7
push dword [ebx + 0x4c]
push esi
push 1
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x4286c0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebp, ecx
test esi, esi
jg 0x4286e1
jl 0x4286d8
test ebx, ebx
jne 0x4286e1
xor eax, eax
xor edx, edx
jmp 0x4287a8
cmp dword [ebp + 0x38], 0
je 0x4286f8
push esi
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x4287a8
mov eax, dword [ebp + 0x1c]
push edi
mov edi, ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x42873d
mov eax, dword [ebp + 0x2c]
cmp dword [eax], 0
jbe 0x42873d
cmp dword [eax], ebx
mov esi, ebx
cmovb esi, dword [eax]
push esi
push ecx
push dword [esp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
sub edi, esi
add eax, esi
add esp, 0xc
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x2c]
sub dword [eax], esi
mov eax, dword [ebp + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x20]
jmp 0x428745
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
cmp dword [ebp + 0x4c], 0
je 0x42879e
mov ecx, ebp
call fcn.004291ee
mov ecx, dword [esp + 0x10]
mov edx, edi
mov eax, 0xfff
cmp edi, eax
jbe 0x428788
push dword [ebp + 0x4c]
push eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, dword [esp + 0x20]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [esp + 0x10], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x42879e
jmp 0x428758
test edx, edx
je 0x42879e
push dword [ebp + 0x4c]
push edi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x428a50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [esp + 0x34]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x428a6a
xor eax, eax
jmp 0x428b38
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x428a93
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x428a93
lea ecx, [ebp - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x428b02
cmp dword [esi + 0x4c], 0
je 0x428b35
mov ecx, esi
call fcn.004291ee
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x428ab0
movsx eax, bl
jmp 0x428af1
lea eax, [esp + 0x14]
mov byte [esp + 0x13], bl
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x27]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x428b06
sub eax, 1
je 0x428b06
dec eax
sub eax, 1
jne 0x428b35
movsx eax, byte [esp + 0x13]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
pop ecx
pop ecx
cmove ebx, edi
mov eax, ebx
jmp 0x428b37
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x1c]
sub ebp, eax
je 0x428b26
push dword [esi + 0x4c]
push ebp
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebp, eax
jne 0x428b35
lea eax, [esp + 0x13]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x18], eax
cmovne edi, ebx
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 4

Function at 0x428df8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
or dword [ecx + 0x1384], 0xffffffff
mov edx, dword [esp + 4]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jb 0x428e14
pop edi
pop esi
mov dword [ecx], ebx
mov eax, ecx
pop ebx
ret 4