joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
jmp 0x409e3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x409e41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x409e30
mov eax, 1
add ebx, ebx
jne 0x409e53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x409e48
jne 0x409e64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409e48
xor ecx, ecx
sub eax, 3
jb 0x409e78
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x409eea
mov ebp, eax
add ebx, ebx
jne 0x409e83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x409e90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x409eb4
inc ecx
add ebx, ebx
jne 0x409ea0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x409e95
jne 0x409eb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409e95
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x409ed4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x409ec5
jmp 0x409e36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x409ed4
add edi, ecx
jmp 0x409e36
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x409ef2
cmp byte [edi], 1
jne 0x409ef2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x409ef7
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x409f66
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x409f24
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x909c]
or eax, eax
je 0x409f60
mov dword [ebx], eax
add ebx, 4
jmp 0x409f41
call dword [esi + 0x9098]
mov ebp, dword [esi + 0x90a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x409f9a
sub esp, 0xffffff80
jmp section.UPX0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405f04
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422254], 0
push esi
jne 0x405f3b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f15
mov dword [ecx*4 + 0x422250], eax
inc ecx
cmp ecx, 0x100
jl 0x405f10
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f6c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422250]
xor eax, esi
inc ecx
dec edx
jne 0x405f4e
pop edi
not eax
pop esi
ret 0xc

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x45d135
Capabilities:
Encode data using xor

Disassembly:
jns 0x45d19a
loop 0x45d141
or cl, dl
hlt
sal esp, 1
call [edx + esi]
sahf
fsub st(7), st(0)
dec esp
fmul dword [eax - 0x5707457b]
xor dword [ebx + edi*2 - 0x7a], esp
inc esp
pop esi
inc esi
popal
clc
daa
xchg ebx, eax
cmp al, byte [edi]
idiv byte [eax - 7]
inc ebx
mov al, 3
push 0xf
push edx
in eax, dx
inc eax
dec ebp
cwde
daa
lodsb al, byte [esi]
mov bl, 0xc
push esi
popal
shr dword [edi + edi*4 - 0x64], 0xa5
sub al, 0x40
jecxz 0x45d1c1
mov word [ebx - 0x11], ss
je 0x45d138
paddw mm0, qword cs:[esi + 0x40289fef]
hlt
mov eax, dword [0x9f06df25]
imul edi, edi, 0x15c889b8
sbb al, 0x77
xor dh, bh
adc eax, 0xfe30771c
xor esp, ebx
cdq
xchg eax, edi
sal byte [eax], 0x38
out 0xf, al
mov esi, 0x11d03df0
sbb al, 0x78
loope 0x45d190
inc eax
dec eax
xor eax, 0xfe9360ac
adc byte [ebx - 0x40407f28], ch
mov edi, 0x7c2ab0fa
xor cl, byte [ebx + 0x2932b060]
mov al, 0x2a
jl 0x45d1f7
mov esp, dword [eax - 0x50]
xor ch, byte [ecx]
xchg ecx, eax
jecxz 0x45d20d
mov dl, 0x5d
popfd
push esp
cdq
popal
cwde
xor ebp, 0xffffff94
sbb bl, byte [ebp + 0x4d]
jmp 0x45d1d4
bound esi, qword [ebx]
into
xor ecx, esi
xlatb
add esp, dword [ecx]
nop
dec edi
out dx, al
pushfd
fdiv st(7), st(0)
jno 0x45d1f8
cmpsd dword ds:[esi], dword es:[edi]
push 0xc95b7147
invalid
mov dl, 0xa3
int3

Function at 0x4c95a1
Capabilities:
Encode data using xor

Disassembly:
sub ah, dl
sar byte [eax - 0x77], 0x96
push edx
xor eax, 0xa66e2fb4
pop eax
cmp al, 0x58
add esi, edx
push esi
insd dword es:[edi], dx
cmp byte [esi - 0x75], bl
sub byte [ebx], dh
arpl si, bp
adc eax, ecx
xor esi, esi
push esp
xchg ebx, eax
jo 0x4c9644
add eax, 0x541a0eea
enter 0x3a3, 0x54
out 0xce, eax
add al, 0xbd
xor ebp, dword [esi + ebx - 0x4eaf589c]
xlatb
lodsb al, byte [esi]
push ds
cmpsd dword fs:[esi], dword es:[edi]
push eax
mov cl, 0xd7
jp 0x4c95f1
pop ss
leave
das
add al, 0x92
stosb byte es:[edi], al
leave
scasb al, byte es:[edi]
je 0x4c9618
invalid
pop eax
cld
invalid
lds edi, [ebp - 0x401a98bb]
scasd eax, dword es:[edi]
lds esi, [ecx + 0x16]
xor eax, 0xa34ccf81
mov bh, 0x50
dec edi
xchg esp, eax
sub eax, 0x50bdd637
mov cl, 9
sbb byte [ebp - 0x4967c89], bh
xchg ebx, eax
pop eax
mov al, 0x97
aad 0xff
fst dword [ecx - 0x730a6cb4]
add dword [esi], ebp
stosb byte es:[edi], al
mov word [ecx], es
stosb byte es:[edi], al
mov bl, 0x9c
aad 0x21
loope 0x4c95d3
mov dword [0x8ab1a2f0], eax
xchg edx, eax
adc al, byte [eax]
xor edx, eax
pop esi
shr byte [edi], 0xd0
invalid

Function at 0x5822c5
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0xa9
ja 0x5822cb
jne 0x5822c3
mov ah, 0x40
ror bl, 1
or al, 0x24
sbb byte [edi], bl
sub esp, eax
sub al, cl
cmp ebx, ecx
call 0x41ea704a
pop ebx
or eax, 0xa54d985d
jl 0x58235f
push esi
xchg edx, eax
push edx
cdq
int3
dec ecx
mov gs, word [edi + 0xb56286]
fsubrp st(5)
invalid
sal byte [esi - 0x169fa70f], 1
cmp al, 8
mov edi, 0x83e9c659
lds edi, [0xeecba2e9]
in eax, dx
std
or dl, ch
cmp ch, byte [ebx + 0x39]
in eax, 0xba
lea ecx, [esi - 0x5c]
pop esi
jbe 0x58233a
in eax, dx
mov byte [ecx + 0x59], ch
jns 0x5823c4
dec byte [ebx]
invalid
pushfd
xchg edx, eax
mov ecx, 0xce3c0c31
call 0xef383ae2
or esp, ecx
push ss
invalid
Function at 0x5e0cb4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x216350ad
sbb eax, 0x7c5e11c0
dec ecx
dec esi
pop dword [esi - 0x24]
jecxz 0x5e0cf9
mov ebx, 0xc80192c0
wait
arpl di, bx
mov cl, byte [ecx + 0x415a60a0]
out 0x79, al
xor esp, dword [edi + 0x6b]
jl 0x5e0d35
int1
xchg ebx, eax
dec ebp
popal
insb byte es:[edi], dx
mov al, byte [0xf7e7dff0]
cmp byte [ebx], bh
sub bl, bh
salc
and dh, byte [ebx]
xchg al, dl
shr esp, 1
shr esi, 0xbb
je 0x5e0d2a
and al, 0xe2
add bl, byte [esi]
push eax
fnsave dword [ebx + edx + 0x30]
and eax, edx
mov ebx, 0x6d907370
cmp eax, 0xfef2c723
int1
invalid
mov byte [0x1840e933], al
xor dword [edx - 0x78], 0xffffffcf
imul esp, eax, 0x77
popal
ja 0x5e0d98
xchg ecx, eax
imul esp, dword [eax + 0x7b], 0xffffffa8
mov byte ds:[ebx - 0x3402ce19], dh
jbe 0x5e0db2
rol dword [edx], 0x1f
aas
sub eax, 0x882d429b
invalid
cwde
sub esi, dword [ebx]
adc dword [ebx + esi*4], edi
movsb byte es:[edi], byte [esi]
shr byte [ecx - 0xd], cl
push edx
rol byte [ebx + 0x7e], 1
or edi, ebx
imul eax, dword [edx + 0x63], 0x60b0783d
frstor dword [esi]
or byte [ebp + edi - 0x2b], ch
leave
dec edi
insb byte es:[edi], dx
cmp eax, 0x4f26c9d5
sbb ecx, dword [eax + 0x4d013493]
sub ecx, eax
mov byte gs:[0x8ee2d483], al
push ebx
mov dword [0xa0668090], eax
das
dec eax
sub byte [edx + 0x1f], ah
mov edx, 0xc1b0d02f
push ebx
mov al, 0xa7
sahf
invalid
Function at 0x7725d1
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
cmp eax, edi
jne 0x772d32
mov eax, dword [esi + 0x30]
cmp eax, edi
jne 0x77303e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, edi
je 0x772616
push dword [eax + 0x64]
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
cmp dword [esi + 0x34], edi
jne 0x7732d7
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
test byte [esi + 0x38], bl
jne 0x7732c4
push ebx
lea ecx, [esi + 0x20]
push ecx
push dword [esi + 0x1c]
push dword [esi + 0x18]
push dword [esi + 0x14]
push eax
call fcn.00772d61
test eax, eax
jne 0x7725ec
jmp 0x7732bd
shl eax, 0xa
push eax
jmp 0x772610
xor eax, eax
jmp 0x77262b
push 4
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x7725ec
jmp 0x7732bd
push ebx
push edi
push ebx
call dword [sym.imp.ntdll.dll_RtlSetProcessIsCritical]
add esp, 0xc
jmp 0x77261f
Function at 0x1422745
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x11c
cmp dword [esp + 0x128], 0
je 0x142290a
push ebp
push esi
mov esi, dword [esp + 0x12c]
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1422908
push ebx
mov edx, esi
push edi
mov eax, dword [edx]
mov ebx, dword [esp + 0x130]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x10]
add eax, ebx
lea edi, [ecx + ebx]
mov dword [esp + 0x20], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x14227b0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [esp + 0x10], eax
push 0x104
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.0141af12
add esp, 0xc
test ebx, ebx
je 0x14228b0
mov eax, dword [esp + 0x18]
and dword [esp + 0x14], 0
mov eax, dword [eax]
test eax, eax
je 0x1422899
mov esi, dword [esp + 0x10]
xor edi, edi
mov ebp, dword [esp + 0x130]
test eax, eax
jns 0x14227f5
movzx ebx, ax
jmp 0x14227fa
lea ebx, [ebp + 2]
add ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x20]
mov dword [edi + ecx], eax
test eax, eax
jne 0x1422871
cmp dword [0x14295f0], 1
jne 0x1422871
push 0x104
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0141af12
lea eax, [esp + 0x34]
push eax
call fcn.014229ee
lea eax, [esp + 0x38]
push 0x1419fa4
push eax
call fcn.0141af40
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.0141af40
add esp, 0x20
lea eax, [esp + 0x24]
push 0
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0141af67
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x1429590]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ecx
mov edi, ecx
mov dword [esp + 0x14], ecx
shl edi, 2
mov eax, dword [edi + eax]
test eax, eax
jne 0x14227ee
mov esi, dword [esp + 0x134]
mov ebp, dword [esp + 0x1c]
inc ebp
imul edx, ebp, 0x14
mov dword [esp + 0x1c], ebp
add edx, esi
mov ecx, dword [edx + 0xc]
test ecx, ecx
jne 0x1422777
jmp 0x1422906
lea eax, [esp + 0x28]
push eax
call fcn.014229ee
lea eax, [esp + 0x2c]
mov dword [esp], 0x1419f88
push eax
call fcn.0141af40
lea eax, [esp + 0x30]
push edi
push eax
call fcn.0141af40
add esp, 0x10
cmp dword [0x14295f0], 1
jne 0x1422906
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0141af67
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x1429590]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop ebx
pop esi
pop ebp
xor eax, eax
add esp, 0x11c
ret
Function at 0x1422940
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push 0x208
lea eax, [ebp - 0x410]
push eax
call fcn.014229bc
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1429460], eax
push 0
push 0
push 0
push 2
push 0
push dword [0x1429460]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x1429464], eax
push 0
push 0
push 0
push 4
push dword [0x1429464]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
add eax, dword [0x14295f8]
leave
ret
Function at 0x1422a44
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 0x14], 0
jne 0x1422a57
xor eax, eax
jmp 0x1422bdb
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x14c
jne 0x1422a95
mov eax, dword [ebp - 8]
add eax, 0xf8
mov dword [ebp - 0xc], eax
jmp 0x1422aae
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x8664
jne 0x1422aae
mov eax, dword [ebp - 8]
add eax, 0x108
mov dword [ebp - 0xc], eax
and dword [ebp - 0x10], 0
jmp 0x1422abb
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x10], eax
je 0x1422af4
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x24]
push eax
push 0x40
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1422ab4
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x2c]
jae 0x1422b94
mov eax, dword [ebp + 0xc]
add eax, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
jmp 0x1422b24
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x30]
je 0x1422b83
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
test eax, eax
jne 0x1422b3c
jmp 0x1422b1d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
and eax, 0xfff
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
add ecx, eax
add ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
sar eax, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
je 0x1422b74
jmp 0x1422b81
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x1422b1d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
jmp 0x1422af4
and dword [ebp - 0x14], 0
jmp 0x1422ba1
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
je 0x1422bd9
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x38], edx
push 0
push dword [ebp - 0x24]
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1422b9a
xor eax, eax
leave
ret
Function at 0x1422d7e
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x6c]
push ebx
push esi
push edi
mov esi, dword [eax]
xor edi, edi
call fcn.01422d41
push esi
call fcn.01422f2c
push dword [esp + 0x80]
mov esi, eax
call fcn.01422f2c
push 0x58
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0141af12
lea eax, [esp + 0x30]
push eax
push 5
push esi
call fcn.01422c5b
mov ebx, eax
add esp, 0x20
cmp ebx, 5
jb 0x1422f13
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
call fcn.01422f61
mov edi, eax
add esp, 0x14
test edi, edi
je 0x1422f13
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [esp + 0x14], 0
mov ebp, eax
and dword [esp + 0x10], 0
lea eax, [esp + 0x14]
push eax
push 0x40
push ebx
push esi
push ebp
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1422ef6
lea eax, [esp + 0x10]
push eax
push 0x40
push 0x6c
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1422edb
lea eax, [edi + 0x2c]
mov ebp, esi
xor ecx, ecx
mov edx, eax
sub ebp, eax
mov al, byte [edx + ebp]
mov byte [edx], al
mov byte [edi + ecx + 0x4c], al
inc ecx
inc edx
cmp ecx, ebx
jb 0x1422e47
lea eax, [ebx + esi]
push eax
lea eax, [ebx + 0x2c]
add eax, edi
push eax
call fcn.01422cfc
mov edx, dword [esp + 0x20]
mov eax, edx
mov ebp, dword [esp + 0x24]
sub eax, esi
pop ecx
pop ecx
mov ecx, esi
sub ecx, edx
cmp edx, esi
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x1422ea5
lea eax, [edi + 0xc]
push edx
push eax
call fcn.01422cfc
pop ecx
sub eax, edi
pop ecx
sub eax, 0xc
push eax
lea eax, [edi + 0xc]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [edi + 0xc]
jmp 0x1422ea7
mov eax, edx
push eax
push esi
call fcn.01422cfc
mov eax, dword [esp + 0x20]
pop ecx
pop ecx
mov dword [edi + 8], eax
lea eax, [edi + 0x2c]
push ebx
push eax
push ebp
mov dword [edi + 4], ebx
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 0x6c
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [edi], 0
pop ebp
je 0x1422f07
mov ecx, dword [esp + 0x78]
lea eax, [edi + 0x2c]
mov dword [ecx], eax
jmp 0x1422f13
push 1
push edi
call fcn.01423055
pop ecx
pop ecx
xor edi, edi
push 0x142946c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
add esp, 0x68
ret
Function at 0x1422f61
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x40
push ebx
xor ebx, ebx
cmp dword [0x1429484], 0x40
jae 0x142304e
mov ecx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [esp + 0x54]
mov ebp, 0xfff80000
add esi, ecx
add ecx, dword [esp + 0x5c]
push edi
cmp ecx, 0x80000000
lea edi, [esp + 0x2c]
push 9
lea eax, [ecx + 0x7ff80000]
cmovb ebp, eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
cmovb edi, eax
cmp edi, ebp
jae 0x142304b
push 0x1c
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1423026
cmp dword [esp + 0x20], 0x10000
jne 0x1423018
mov eax, dword [esp + 0x1c]
cmp eax, 0x6c
jb 0x142301c
mov ecx, dword [esp + 0x48]
cmp eax, ecx
jb 0x142301c
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x142302a
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
add edi, eax
cmp edi, ebp
jb 0x1422fc9
test ebx, ebx
je 0x142304b
xor eax, eax
cmp dword [eax*4 + 0x1429488], 0
je 0x142303e
inc eax
cmp eax, 0x40
jb 0x142302c
jmp 0x142304b
inc dword [0x1429484]
mov dword [eax*4 + 0x1429488], ebx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x40
ret
Function at 0x1424ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
push edi
lea ebx, [eax + ebp]
cmp eax, 8
jbe 0x1424c97
mov edi, dword [esp + 0x120]
lea esi, [ebp + 8]
push 0x800
lea eax, [edi + 0x5410]
push eax
mov eax, ebx
sub eax, esi
push eax
lea eax, [edi + 0x140c]
push esi
push eax
call fcn.01428110
add esp, 0x14
cmp eax, 0xffffff88
ja 0x1424c97
add esi, eax
mov dword [esp + 0x14], 0x1c
mov eax, ebx
sub eax, esi
push eax
push esi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.01424ce0
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffff88
ja 0x1424c97
mov eax, dword [esp + 0x1c]
cmp eax, 8
ja 0x1424c97
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x34]
push eax
lea eax, [edi + 0x804]
push eax
call fcn.01425110
add esp, 0x10
cmp eax, 0xffffff88
ja 0x1424c97
add esi, dword [esp + 0x10]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x18], 0x34
push eax
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.01424ce0
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffff88
ja 0x1424c97
mov eax, dword [esp + 0x20]
cmp eax, 9
ja 0x1424c97
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0xb8]
push eax
lea eax, [edi + 0xc08]
push eax
call fcn.01425110
add esp, 0x10
cmp eax, 0xffffff88
ja 0x1424c97
add esi, dword [esp + 0x10]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x10], 0x23
push eax
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x78]
push eax
call fcn.01424ce0
add esp, 0x14
mov dword [esp + 0x28], eax
cmp eax, 0xffffff88
ja 0x1424c97
mov eax, dword [esp + 0x24]
cmp eax, 9
ja 0x1424c97
push eax
push dword [esp + 0x14]
lea eax, [esp + 0x70]
push eax
push edi
call fcn.01425110
add esp, 0x10
cmp eax, 0xffffff88
ja 0x1424c97
add esi, dword [esp + 0x28]
lea eax, [esi + 0xc]
cmp eax, ebx
ja 0x1424c97
sub ebx, esi
xor edx, edx
sub ebx, 0xc
add edi, 0x5c10
nop
mov ecx, dword [esi]
add esi, 4
test ecx, ecx
je 0x1424c97
cmp ecx, ebx
jae 0x1424c97
mov dword [edi], ecx
inc edx
add edi, 4
cmp edx, 3
jl 0x1424c70
sub esi, ebp
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
mov eax, 0xffffffe2
pop ebx
add esp, 0x10c
ret
Function at 0x1427d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
shr eax, 8
test al, al
je 0x1427d56
mov dword [esp + 0x14], ecx
jmp fcn.01426f60
mov dword [esp + 0x14], ecx
jmp fcn.01426320