joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407740
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x23c
lea eax, [esp + 0x34]
mov esi, dword [esp + 0x254]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x250]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x4078a7
lea ebp, [esp + 0x3c]
lea ecx, [esp + 0x40]
lea ebx, [esp + 0x3a]
mov eax, ebp
sub eax, ecx
add eax, 0x1f4
shr eax, 2
mov dword [esp + 0x28], eax
jmp 0x40782b
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
mov dword [esp], ebx
mov edi, eax
call sub.msvcrt.dll_wcslen
lea edx, [edi + eax + 2]
lea eax, [edx + edx]
cmp edx, 0x3f800000
mov edx, 0xffffffff
cmova eax, edx
mov dword [esp], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov dword [esp + 4], esi
mov edi, eax
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], 0x440588
mov dword [esp], edi
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.msvcrt.dll_wcscat
mov eax, dword [esp + 0x250]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00407740
sub esp, 8
mov dword [esp], edi
call sub.libstdc_6.dll_operator_delete___void_
movzx eax, word [0x44058c]
mov ecx, dword [esp + 0x28]
lea edi, [esp + 0x40]
mov word [esp + 0x3a], ax
xor eax, eax
mov dword [ebp], 0
mov dword [ebp + 0x1f0], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], 0xfb
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
sub esp, 0x10
test eax, eax
je 0x4077b0
mov eax, dword [esp + 0x250]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
sub esp, 8
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x413db0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x4c
mov eax, dword [ecx + 8]
add eax, 0x24
mov dword [esp], eax
call dword [method.QFileInfo.exists_QString_const_]
test al, al
jne 0x413de0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [ebx + 8]
lea esi, [ebp - 0x30]
mov dword [esp + 4], 0
mov dword [esp], 0
lea ebx, [ebp - 0x2c]
mov dword [esp + 8], esi
call fcn.00435ce0
mov dword [esp + 4], 0
mov dword [ebp - 0x2c], eax
mov ecx, ebx
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov dword [esp], eax
call fcn.00435ce8
mov ecx, dword [ebp - 0x2c]
sub esp, 8
mov edx, dword [ecx - 4]
test edx, edx
js 0x413e33
mov ecx, ebx
call fcn.00435cf0
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x24]
mov edx, dword [eax + 4]
add eax, dword [eax + 0xc]
mov dword [esp], ecx
add edx, edx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov dword [esp + 4], 0
mov eax, dword [edi + 0x24]
mov ecx, ebx
mov eax, dword [eax + 4]
mov dword [esp], eax
call fcn.00435ce8
mov eax, dword [ebp - 0x2c]
sub esp, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x4412dc
mov dword [esp + 0xc], 0x4412dc
mov dword [esp + 4], 0x4412de
mov dword [esp + 8], eax
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x2c]
mov edi, eax
sub esp, 0x18
mov eax, 0xffffffff
lock xadd dword [ecx - 4], eax
test eax, eax
jle 0x413fb2
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x4412e8
mov dword [esp], ebx
call dword [method.QMessageLogger.debug___const]
sub esp, 4
mov dword [esp + 8], 0x19
mov dword [esp + 4], str.clean_script_exec_result:
mov dword [esp], esi
call dword [method.QString.fromUtf8_helper_char_const__int_]
mov dword [esp], esi
mov ecx, dword [ebp - 0x34]
call dword [method.QTextStream.operator___QString_const_]
mov eax, dword [ebp - 0x30]
sub esp, 4
mov edx, dword [eax]
test edx, edx
je 0x413f60
cmp edx, 0xffffffff
je 0x413f2a
lock sub dword [eax], 1
setne dl
test dl, dl
je 0x413f59
mov ecx, dword [ebp - 0x34]
cmp byte [ecx + 0x14], 0
jne 0x413f82
mov dword [esp], edi
call dword [method.QTextStream.operator___int_]
mov ecx, dword [ebp - 0x34]
sub esp, 4
cmp byte [ecx + 0x14], 0
jne 0x413fa0
lea ecx, [ebp - 0x34]
call dword [method.QDebug.QDebug__]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x30]
lea esi, [esi]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov ecx, dword [ebp - 0x34]
cmp byte [ecx + 0x14], 0
je 0x413f33
mov dword [esp], 0x20
call dword [method.QTextStream.operator___char_]
sub esp, 4
mov ecx, dword [ebp - 0x34]
jmp 0x413f33
mov dword [esp], 0x20
call dword [method.QTextStream.operator___char_]
sub esp, 4
jmp 0x413f48
sub ecx, 0xc
mov dword [esp], esi
call fcn.00435d00
sub esp, 4
jmp 0x413eb7
Function at 0x416c00
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x23c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416d6c
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x416d6c
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp], eax
mov dword [esp + 4], edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
sub esp, 0xc
test eax, eax
je 0x416d60
mov eax, dword [sym.imp.Qt5Core.dll_QArrayData::shared_null]
mov dword [esp + 4], edi
lea edi, [ebp - 0x228]
mov dword [esp + 8], 0xffffffff
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x224]
mov dword [esp], eax
call dword [method.QString.fromUtf16_unsigned_short_const__int_]
lea eax, [ebp - 0x224]
mov ecx, dword [ebp + 8]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00416550
mov byte [ebp - 0x229], al
mov eax, dword [ebp - 0x224]
sub esp, 8
mov edx, dword [eax]
test edx, edx
je 0x416d95
cmp edx, 0xffffffff
je 0x416cd2
lock sub dword [eax], 1
setne dl
test dl, dl
je 0x416d8f
cmp byte [ebp - 0x229], 0
je 0x416d30
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x228]
sub esp, 4
mov edx, dword [eax]
mov dword [ebx], eax
lea ecx, [edx + 1]
cmp ecx, 1
jbe 0x416d08
lock add dword [eax], 1
setne dl
mov eax, dword [ebp - 0x228]
mov edx, dword [eax]
test edx, edx
jne 0x416db3
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x416d83
mov eax, dword [ebp - 0x228]
mov edx, dword [eax]
test edx, edx
jne 0x416dd0
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
lea esi, [esi]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], 0x441433
call dword [method.QString.fromAscii_helper_char_const__int_]
mov dword [ebx], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebp - 0x224]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x416cd2
cmp edx, 0xffffffff
je 0x416d83
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x416d83
mov eax, dword [ebp - 0x228]
jmp 0x416d10
cmp edx, 0xffffffff
je 0x416d60
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x416d60
mov eax, dword [ebp - 0x228]
jmp 0x416d40
Function at 0x423220
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test eax, eax
js 0x4233e0
mov edx, dword [ebx]
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x4233e0
movzx eax, ax
mov dword [esp + 8], str.BINARY
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x4233e0
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
test eax, eax
mov edi, eax
je 0x4233e0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x4233e0
lea eax, [ebp - 0x1d]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], eax
call fcn.00435ce0
mov dword [esp + 4], 0
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x1c]
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [esp], eax
call fcn.00435ce8
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov edx, dword [ecx - 4]
test edx, edx
js 0x4232f0
lea ecx, [ebp - 0x1c]
call fcn.00435cf0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov edx, dword [eax + 4]
add eax, dword [eax + 0xc]
mov dword [esp], ecx
add edx, edx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov dword [esp + 4], 0
mov eax, dword [ebx]
lea ecx, [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [esp], eax
call fcn.00435ce8
mov eax, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x1c]
mov ebx, eax
sub esp, 0x1c
mov eax, 0xffffffff
lock xadd dword [ecx - 4], eax
test eax, eax
jle 0x4233f0
cmp ebx, 0xffffffff
je 0x4233e0
mov dword [esp + 4], esi
mov dword [esp], 0
lea esi, [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
sub esp, 8
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], esi
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 8
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 8
lea eax, [ebp - 0x1d]
sub ecx, 0xc
mov dword [esp], eax
call fcn.00435d00
sub esp, 4
jmp 0x423377
Function at 0x42af70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.0042afd0
Function at 0x42b970
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x42b9a8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x42b99e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x42b9aa
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x42b990
xor eax, eax
pop ebx
pop esi
ret

Function at 0x42bc70
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
test eax, eax
mov dword [esp + 0x2c], eax
je 0x42bdd1
mov edx, dword [esp + 0x3c]
lea eax, [edx*4]
cmp edx, 0x1fc00000
mov edx, 0xffffffff
cmova eax, edx
xor ebx, ebx
mov dword [esp], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov edx, dword [esp + 0x3c]
mov edi, eax
test edx, edx
jle 0x42bd79
nop
mov eax, dword [esp + 0x2c]
mov ebp, dword [eax + ebx*4]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [esp], eax
mov dword [esp + 0x28], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov ecx, dword [esp + 0x28]
mov esi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [edi + ebx*4], esi
add ebx, 1
cmp dword [esp + 0x3c], ebx
jg 0x42bcd0
mov eax, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00405720
mov esi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
jle 0x42bdbd
mov edx, dword [edi + ebx*4]
test edx, edx
je 0x42bdb4
mov dword [esp], edx
call sub.libstdc_6.dll_operator_delete___void_
add ebx, 1
cmp dword [esp + 0x3c], ebx
jg 0x42bda5
mov dword [esp], edi
call sub.libstdc_6.dll_operator_delete___void_
mov eax, esi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, 0xffffffff
jmp 0x42bdc7
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x35356f77
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x30c77b7e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x426e7f
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
push dword [0x537494]
push dword [0x515004]
call dword [sym.imp.KERNEL32.DLL_GetConsoleScreenBufferInfo]
mov eax, 0
mov dword [ebp - 0xc], 0
mov eax, dword [0x537494]
mov eax, dword [eax]
and eax, 0xffff
mov dword [ebp - 0x18], eax
mov eax, dword [0x537494]
mov eax, dword [eax]
shr eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x426f0e
cmp eax, 1
je 0x426f45
cmp eax, 2
je 0x426f6e
cmp eax, 4
je 0x426f89
cmp eax, 5
je 0x426fbd
cmp eax, 3
je 0x426fe5
call fcn.00426f05
mov eax, dword [0x537494]
mov eax, dword [eax + 4]
shr eax, 0x10
mov edx, eax
mov eax, dword [ebp - 0x18]
imul edx
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], 0
jmp 0x427007
mov eax, dword [ebp - 0x18]
push edx
mov edx, dword [ebp - 0x1c]
imul edx
pop edx
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], 0
jmp 0x427007
mov eax, dword [0x537494]
mov eax, dword [eax]
and eax, 0xffff
push eax
mov eax, dword [0x537494]
mov eax, dword [eax + 4]
and eax, 0xffff
pop edx
xchg edx, eax
sub eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [0x537494]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
jmp 0x427007
mov eax, dword [0x537494]
mov eax, dword [eax + 4]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [0x537494]
mov eax, dword [eax + 4]
and eax, 0xffff0000
mov dword [ebp - 0x14], eax
jmp 0x427007
mov eax, dword [0x537494]
mov eax, dword [eax]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [0x537494]
mov eax, dword [eax + 4]
and eax, 0xffff0000
mov dword [ebp - 0x14], eax

Function at 0x427398
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x4273cf
cmp eax, 2
je 0x4273ff
cmp eax, 4
je 0x42742f
call fcn.004273c6
mov eax, dword [ebp + 8]
mov al, byte [eax + 2]
cmp al, 0x5b
je 0x427416
mov eax, 0
jmp 0x427d69
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp + 8], eax
mov eax, 4
mov dword [ebp - 0x10], 4
jmp 0x42745d
mov eax, dword [ebp + 8]
mov al, byte [eax + 4]
cmp al, 0x5b
je 0x427446
mov eax, 0
jmp 0x427d69
mov eax, dword [ebp + 8]
add eax, 8
mov dword [ebp + 8], eax
mov eax, 8
mov dword [ebp - 0x10], 8
Function at 0x4283ee
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [0x537484]
cmp eax, 0
je 0x42843e
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x428428
and eax, 0xff
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
and eax, 0xff
push eax
call fcn.00427dd6
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0
jne 0x42840c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
sub eax, edx
mov dword [ebp - 0x10], eax
jmp 0x428471
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_strlen]
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
push dword [0x515004]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
xor eax, eax
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0042bb24
mov eax, dword [ebp + 8]
leave
ret 4

Function at 0x4286a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shl eax, 1
push eax
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov eax, dword [ebp - 0xc]
dec eax
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x4315d6
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x28
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and eax, 0x1f
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x10]
pop eax
bsr eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2c]
mov cl, dl
shl eax, cl
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x38
jne 0x43164f
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
cmp eax, 0
jl 0x43164f
jmp 0x431653
xor eax, eax
jmp 0x431656
xor eax, eax
inc eax
cmp eax, 0
je 0x43168e
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x10]
pop eax
bsr eax, eax
mov edx, eax
mov eax, dword [ebp - 0x28]
mov cl, dl
shl eax, cl
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
shl eax, 2
mov dword [ebp - 0x28], eax
jmp 0x4316b6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
sub eax, edx
push eax
push dword [ebp - 0x10]
pop eax
bsr eax, eax
pop edx
xchg edx, eax
mov cl, dl
sar eax, cl
shl eax, 2
mov dword [ebp - 0x28], eax
mov eax, dword [0x53d61c]
mov dword [ebp - 0x20], eax
jmp 0x4317cc
Function at 0x439840
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [0x53d6d0]
cmp eax, edx
jle 0x439867
mov eax, dword [ebp - 0xc]
mov dword [0x53d6d0], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [0x537524]
mov edx, eax
mov eax, dword [ebp - 0xc]
push edx
mov edx, 0xc
mov ecx, edx
imul ecx
pop edx
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.DLL_strlen]
add esp, 4
dec eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov eax, dword [0x5409f8]
cmp eax, 0
je 0x4398e8
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
push eax
call fcn.0044c2fc
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
sub eax, 3
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
cmp eax, 0x3e
je 0x43996e
push 0
push dword [str._n_r_t__e]
push 3
push 0
push 0x3e
push 2
push 0
push 0x549da8
push 6
push 0
push dword [str._n_r_t__e]
push 3
push 0
push dword [ebp + 8]
push 2
push 0
push str._Found:
push 6
push 0
push dword [str._n_r_t__e]
push 3
push 0
push dword [ebp - 0xc]
push 2
push 0
push str._Datatype_Error:_invalid_actions_count_for_type:
push 6
push 0x6c
lea esi, [esp + 4]
push esi
push 9
call fcn.004219a8
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [ebp - 0xc]
shl eax, 8
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x439990
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x439990
jmp 0x439994
xor eax, eax
jmp 0x439997
xor eax, eax
inc eax
cmp eax, 0
je 0x4399c5
mov eax, dword [ebp - 0x14]
shl eax, 8
inc eax
push eax
mov eax, 0x3e
mov edx, dword [ebp + 8]
sub eax, edx
pop edx
xchg edx, eax
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [0x537528]
mov edi, dword [ebp - 0x18]
dec edi
mov eax, dword [eax + edi*4]
jmp 0x4399ca
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, eax
mov eax, dword [0x537528]
mov edi, dword [ebp - 0x10]
dec edi
mov dword [eax + edi*4], edx
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp + 8], eax
mov eax, 0
mov edx, dword [ebp + 8]
cmp eax, edx
jne 0x439978
leave
pop esi
pop ecx
pop ecx
pop ecx
add esp, ecx
push esi
ret