joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4045f0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x52dc10
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x40467c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x40467c
cmp ebx, 0x15f90
jl 0x404673
cmp ebx, 0x1d4c0
jge 0x404650
mov eax, 0x32
jmp 0x404675
cmp ebx, 0x2bf20
jge 0x40465f
mov eax, 0x64
jmp 0x404675
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x404675
mov eax, 0xfa
jmp 0x404675
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x404690
inc ebx
cmp ebx, 0x57e40
jl 0x404608
mov eax, dword [ebp - 4]
test eax, eax
je 0x4046aa
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.0041fde0
add esp, 4
mov eax, dword [0x52dc14]
test eax, eax
jne 0x4046e0
cmp dword [0x4e10a0], 1
je 0x404764
xor ebx, ebx
xor esi, esi
cmp dword [0x52dc0c], 0
je 0x404724
mov dword [0x52dc14], 1
cmp dword [0x4e10a0], 1
je 0x40470f
mov dword [0x52dc10], 0
push dword [0x52dc08]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x404782
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.0045b7a0
push ebx
push 0x16
call fcn.0045b7a0
add esp, 0x10
jmp 0x4046e0
mov dword [0x52dc0c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x52dc08], eax
cmp eax, 0xffffffff
jne 0x404748
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4046cd
push 0x404580
call fcn.0045c1d0
push 0x404540
call fcn.0045c1d0
add esp, 8
jmp 0x4046cd
push 1
push 2
call fcn.0045b7a0
mov esi, eax
push 1
push 0x16
call fcn.0045b7a0
add esp, 0x10
mov ebx, eax
jmp 0x4046c4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.0041fe20
add esp, 0xc
test eax, eax
je 0x4047ac
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x4e0ffc]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x4e0ff8]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x4e0ff4]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x4e0ff0]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x4047b4
push dword [ebp - 0x10]
push dword [0x52dc08]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x10]
jmp 0x4046fe
Function at 0x404800
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x52dc10
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x40488c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x40488c
cmp ebx, 0x15f90
jl 0x404883
cmp ebx, 0x1d4c0
jge 0x404860
mov eax, 0x32
jmp 0x404885
cmp ebx, 0x2bf20
jge 0x40486f
mov eax, 0x64
jmp 0x404885
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x404885
mov eax, 0xfa
jmp 0x404885
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4048a0
inc ebx
cmp ebx, 0x57e40
jl 0x404818
mov eax, dword [ebp - 4]
test eax, eax
je 0x4048ba
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.0041fde0
add esp, 4
mov eax, dword [0x52dc14]
test eax, eax
jne 0x4048f0
cmp dword [0x4e10a0], 1
je 0x404989
xor ebx, ebx
xor esi, esi
cmp dword [0x52dc0c], 0
je 0x404946
mov dword [0x52dc14], 1
cmp dword [0x4e10a0], 1
je 0x404931
mov dword [0x52dc10], 0
push dword [0x52dc08]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x4049c7
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp dword [0x4e10a0], 1
je 0x4049a7
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.0045b7a0
push ebx
push 0x16
call fcn.0045b7a0
add esp, 0x10
jmp 0x4048f0
mov dword [0x52dc0c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x52dc08], eax
cmp eax, 0xffffffff
jne 0x40496d
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4048dd
push 0x404580
call fcn.0045c1d0
push 0x404540
call fcn.0045c1d0
add esp, 8
jmp 0x4048dd
push 1
push 2
call fcn.0045b7a0
mov esi, eax
push 1
push 0x16
call fcn.0045b7a0
add esp, 0x10
mov ebx, eax
jmp 0x4048d4
push 1
push 2
call fcn.0045b7a0
push 1
push 0x16
mov dword [ebx + 0x64], eax
call fcn.0045b7a0
add esp, 0x10
mov dword [ebx + 0x68], eax
jmp 0x404925
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.0041fe20
add esp, 0xc
test eax, eax
je 0x4049ee
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x4e0ffc]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x4e0ff8]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x4e0ff4]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x4e0ff0]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x4049f6
push dword [ebp - 0x10]
push dword [0x52dc08]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp - 0x10]
jmp 0x404913
Function at 0x40be20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x40be45
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x40be73
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x40bee8
mov ecx, 1
jmp 0x40bee8
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x40be83
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40beb2
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x40bee8
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x40bec4
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x40bed5
mov dword [ebp - 4], esi
test esi, esi
jne 0x40bed9
jmp 0x40bedd
test esi, esi
je 0x40bedd
test eax, eax
ja 0x40be8b
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x40bf48
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x412400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x412425
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x412453
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x4124c8
mov ecx, 1
jmp 0x4124c8
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x412463
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x412492
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x4124c8
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x4124a4
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x4124b5
mov dword [ebp - 4], esi
test esi, esi
jne 0x4124b9
jmp 0x4124bd
test esi, esi
je 0x4124bd
test eax, eax
ja 0x41246b
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x412528
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x418260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x418285
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x4182b3
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x418328
mov ecx, 1
jmp 0x418328
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x4182c3
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4182f2
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x418328
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x418304
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x418315
mov dword [ebp - 4], esi
test esi, esi
jne 0x418319
jmp 0x41831d
test esi, esi
je 0x41831d
test eax, eax
ja 0x4182cb
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x418388
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x41cc10
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x41fc10
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x7c]
test esi, esi
mov dword [ebp - 0xc], edi
je 0x41fdcc
mov edx, dword [0x4e10a0]
mov edi, dword [esi + 0x14]
lea eax, [edi*4]
shl edi, 5
sub edi, eax
cmp edx, 2
lea ebx, [edi + 0x532768]
jge 0x41fc5f
mov eax, dword [ebx]
test eax, eax
jne 0x41fca0
mov dword [edi + 0x532768], 1
jmp 0x41fca0
push ebx
call fcn.00404a90
add esp, 4
test eax, eax
jne 0x41fc9a
cmp dword [edi + 0x532764], 0
je 0x41fdac
mov dword [edi + 0x532768], 0
push 0xffffffffffffffff
push dword [edi + 0x532764]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.00404a90
add esp, 4
mov edx, dword [0x4e10a0]
cmp edx, 1
je 0x41fd98
mov eax, dword [esi + 0x18]
dec eax
mov dword [esi + 0x18], eax
test eax, eax
jle 0x41fd0f
mov eax, dword [0x4e10a0]
cmp eax, 1
je 0x41fcf4
cmp eax, 2
jge 0x41fccf
mov dword [edi + 0x532768], 0
jmp 0x41fce5
mov dword [edi + 0x532768], 0
push dword [edi + 0x532764]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push dword [edi + 0x532778]
push dword [edi + 0x532774]
call fcn.00404a70
add esp, 8
mov eax, dword [0x4e10a0]
jmp 0x41fcbe
mov edx, dword [esi]
test edx, edx
je 0x41fd1b
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x41fd26
mov dword [eax], edx
jmp 0x41fd2c
mov dword [edi + 0x532760], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x7c], 0
mov eax, dword [0x4e10a0]
cmp eax, 1
je 0x41fd7d
cmp eax, 2
jge 0x41fd51
mov dword [edi + 0x532768], 0
jmp 0x41fd67
mov dword [edi + 0x532768], 0
push dword [edi + 0x532764]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.0041fee0
push esi
call fcn.0041fee0
add esp, 8
jmp 0x41fce5
push dword [edi + 0x532778]
push dword [edi + 0x532774]
call fcn.00404a70
add esp, 8
mov eax, dword [0x4e10a0]
jmp 0x41fd40
lea eax, [edi + 0x532774]
push eax
call fcn.00404a40
add esp, 4
jmp 0x41fca9
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0x532764], eax
mov dword [edi + 0x532768], 0
jmp 0x41fc83
xor eax, eax
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x41fde0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.0042f240
mov ebx, dword [ebp + 8]
cmp dword [0x538460], 0
jne 0x41fe07
test ebx, ebx
je 0x41fdfc
mov eax, dword [ebx]
jmp 0x41fdfe
xor eax, eax
push eax
call fcn.0045ef60
add esp, 4
test ebx, ebx
je 0x41fe0f
mov eax, dword [ebx]
jmp 0x41fe11
xor eax, eax
push eax
call fcn.004b2400
add esp, 4
jmp 0x41fdf4
Function at 0x429e60
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]

Function at 0x429e6c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], edi
mov edx, eax
mov dword [ecx], 0
cmp dword [0x538460], 0
je 0x429f43
cmp dword [ebp + 0x20], 2
je 0x429ea3
cmp dword [ebp + 0x20], 1
jne 0x429eb2
mov eax, 0xffffffff
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x429ec2
cmp dword [ebp + 0x20], 0xfffffffa
je 0x42a008
cmp dword [ebp + 0x20], 0
je 0x42a014
xor ecx, ecx
xor edi, edi
cmp dword [ebp + 0x18], 0
je 0x429ef7
cmp dword [ebp + 0x1c], 0
je 0x429ef7
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
call fcn.004b21b0
push edi
call fcn.004b2320
mov edx, dword [ebp - 0x10]
add esp, 8
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x429f43
push edi
push esi
push ebx
call fcn.004b2250
add esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [eax], esi
je 0x42a038
push 0
push edi
push 2
push 0x4c91c4
call fcn.004b2210
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov eax, 1
mov byte [esi + ebx], 0xa
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
inc dword [edx]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x24]
test ecx, ecx
mov edx, dword [ebp - 0x10]
mov dword [edi], 0
je 0x429f6b
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x429f70
mov edi, 0x20000
cmp esi, edi
jbe 0x429fe4
cmp dword [ebp + 0x20], 0
je 0x429fe4
test ecx, ecx
je 0x429f88
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x429f8d
mov edi, 0x20000
mov dword [ebp - 0x10], edx
push 0
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x429fd2
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
add ebx, edx
sub esi, edx
add dword [ecx], edx
cmp dword [ebp + 0x24], 0
je 0x429fc7
mov edx, dword [ebp + 0x24]
mov edx, dword [edx + 0x13c]
test edx, edx
jne 0x429fcc
mov edx, 0x20000
cmp esi, edx
ja 0x429fd2
mov edi, esi
test esi, esi
je 0x429ffb
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
jne 0x429ffb
test eax, eax
jne 0x429f90
jmp 0x429ffb
push 0
lea ecx, [ebp - 0x18]
push ecx
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edi, edx
mov ecx, 1
jmp 0x429ed6
mov dword [ebp - 0x10], edx
call fcn.004b2440
mov edx, dword [ebp - 0x10]
mov edi, eax
cmp dword [0x538460], 0
je 0x429efb
mov ecx, 1
jmp 0x429ed0
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x42a960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
movzx ecx, byte [edx + 0x16d]
and ecx, 0x20
shr ecx, 5
mov ebx, dword [eax]
test ecx, ecx
mov eax, dword [eax + 8]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
je 0x42a9d9
cmp eax, 5
jl 0x42a9d9
cmp eax, 0x11
jg 0x42a9d9
mov edx, dword [ebp + 0x10]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
test eax, eax
jle 0x42a9ca
mov edx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x1c], eax
xor ecx, ecx
lea edi, [edx + ebx]
movzx eax, byte [ebx]
inc esi
movzx edx, byte [ecx + edi - 1]
xor eax, edx
mov byte [ebx], dl
inc ebx
xor byte [ecx + edi - 1], al
dec ecx
cmp esi, dword [ebp - 0x1c]
jl 0x42a9b2
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
movsx edi, byte [edx + 0x158]
cmp eax, 0x19
jl 0x42a9ca
cmp eax, 0x1f
jle 0x42aa00
cmp eax, 0x32
jl 0x42a9f6
cmp eax, 0x34
jle 0x42aa00
jmp 0x42a9ca
cmp eax, 0x28
jl 0x42a9ca
cmp eax, 0x30
jg 0x42a9ca
test ecx, ecx
je 0x42aa63
test edi, edi
je 0x42aa12
cmp eax, 0x34
je 0x42aa12
cmp eax, 0x32
jne 0x42aa63
mov edx, dword [ebp + 0x10]
mov esi, edx
shr esi, 0x1f
add esi, edx
sar esi, 1
test esi, esi
jle 0x42aa63
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
lea ecx, [eax + ebx]
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov esi, dword [ebp - 0x14]
mov eax, ebx
movzx edi, byte [eax]
inc edx
movzx ebx, byte [ecx + esi - 1]
xor edi, ebx
mov byte [eax], bl
inc eax
mov ebx, edi
xor byte [ecx + esi - 1], bl
dec ecx
cmp edx, dword [ebp - 0x10]
jl 0x42aa3d
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov edx, dword [eax*4 + 0x4c917c]
cmp edx, 0xffffffff
je 0x42aaf8
lea eax, [edx*4]
shl edx, 5
sub edx, eax
mov edx, dword [edx + edi*4 + 0x4c9260]
test edx, edx
je 0x42a9ca
lea eax, [ebp - 0x1c]
push eax
push 0
push ebx
call edx
add esp, 0xc
cmp eax, 1
jne 0x42aaf8
cmp dword [ebp + 0x10], 4
jne 0x42aab4
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ecx], edx
jmp 0x42a9ca
cmp dword [ebp + 0x10], 8
jne 0x42aad1
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov dword [edx], eax
mov esi, dword [ecx]
mov ebx, dword [ebp - 0x18]
mov dword [esi + 4], ebx
jmp 0x42a9ca
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ecx], edx
mov esi, dword [eax]
mov ebx, dword [ebp - 0x18]
mov dword [esi + 4], ebx
mov edx, dword [eax]
mov edi, dword [ebp - 0x14]
mov dword [edx + 8], edi
mov ecx, dword [eax]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
jmp 0x42a9ca
mov eax, 0x5f
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x42b630
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x430bf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x430c15
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x430c43
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x430cb8
mov ecx, 1
jmp 0x430cb8
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x430c53
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x430c82
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x430cb8
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x430c94
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x430ca5
mov dword [ebp - 4], esi
test esi, esi
jne 0x430ca9
jmp 0x430cad
test esi, esi
je 0x430cad
test eax, eax
ja 0x430c5b
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x430d18
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret