joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60011770
Capabilities:
Enumerate pe sections

Disassembly:
push edi
push esi
push ebp
push ebx
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
sub esp, 8
mov esi, 0xfffffffc
mov al, byte [ebx]
mov byte [edx], al
mov al, byte [ecx]
mov byte [edx + 1], al
mov al, byte [ebp]
mov byte [edx + 2], al
mov al, byte [ebx + 2]
mov byte [edx + 3], al
mov al, byte [ecx]
mov byte [edx + 4], al
mov al, byte [ebp]
mov byte [edx + 5], al
mov al, byte [ebx + 4]
mov byte [edx + 6], al
mov al, byte [ecx + 2]
mov byte [edx + 7], al
mov al, byte [ebp + 2]
mov byte [edx + 8], al
mov al, byte [ebx + 6]
mov byte [edx + 9], al
mov al, byte [ecx + 2]
mov byte [edx + 0xa], al
mov al, byte [ebp + 2]
mov byte [edx + 0xb], al
mov al, byte [ebx + 8]
mov byte [edx + 0xc], al
mov al, byte [ecx + 4]
mov byte [edx + 0xd], al
mov al, byte [ebp + 4]
mov byte [edx + 0xe], al
mov al, byte [ebx + 0xa]
mov byte [edx + 0xf], al
mov al, byte [ecx + 4]
mov byte [edx + 0x10], al
mov al, byte [ebp + 4]
mov byte [edx + 0x11], al
mov al, byte [ebx + 0xc]
mov byte [edx + 0x12], al
mov al, byte [ecx + 6]
mov byte [edx + 0x13], al
mov al, byte [ebp + 6]
mov byte [edx + 0x14], al
mov al, byte [ebx + 0xe]
mov byte [edx + 0x15], al
mov al, byte [ecx + 6]
mov byte [edx + 0x16], al
mov al, byte [ebp + 6]
mov byte [edx + 0x17], al
mov al, byte [ebx + 0x10]
add edx, edi
mov byte [edx], al
mov al, byte [ecx]
mov byte [edx + 1], al
mov al, byte [ebp]
mov byte [edx + 2], al
mov al, byte [ebx + 0x12]
mov byte [edx + 3], al
mov al, byte [ecx]
mov byte [edx + 4], al
mov al, byte [ebp]
mov byte [edx + 5], al
mov al, byte [ebx + 0x14]
mov byte [edx + 6], al
mov al, byte [ecx + 2]
mov byte [edx + 7], al
mov al, byte [ebp + 2]
mov byte [edx + 8], al
mov al, byte [ebx + 0x16]
mov byte [edx + 9], al
mov al, byte [ecx + 2]
mov byte [edx + 0xa], al
mov al, byte [ebp + 2]
mov byte [edx + 0xb], al
mov al, byte [ebx + 0x18]
mov byte [edx + 0xc], al
mov al, byte [ecx + 4]
mov byte [edx + 0xd], al
mov al, byte [ebp + 4]
mov byte [edx + 0xe], al
mov al, byte [ebx + 0x1a]
mov byte [edx + 0xf], al
mov al, byte [ecx + 4]
mov byte [edx + 0x10], al
mov al, byte [ebp + 4]
mov byte [edx + 0x11], al
mov al, byte [ebx + 0x1c]
mov byte [edx + 0x12], al
mov al, byte [ecx + 6]
mov byte [edx + 0x13], al
mov al, byte [ebp + 6]
mov byte [edx + 0x14], al
mov al, byte [ebx + 0x1e]
add ebx, 0x20
mov byte [edx + 0x15], al
mov al, byte [ecx + 6]
add ecx, 0x10
mov byte [edx + 0x16], al
mov al, byte [ebp + 6]
mov byte [edx + 0x17], al
add edx, edi
add ebp, 0x10
inc esi
jne 0x60011790
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x60011e20
Capabilities:
Enumerate pe sections

Disassembly:
push edi
push esi
push ebp
push ebx
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
sub esp, 8
mov esi, 0xfffffff8
mov al, byte [ebx]
mov byte [edx], al
mov al, byte [ecx]
mov byte [edx + 1], al
mov al, byte [ebp]
mov byte [edx + 2], al
mov al, byte [ebx + 2]
mov byte [edx + 3], al
mov al, byte [ecx]
mov byte [edx + 4], al
mov al, byte [ebp]
mov byte [edx + 5], al
mov al, byte [ebx + 4]
mov byte [edx + 6], al
mov al, byte [ecx + 2]
mov byte [edx + 7], al
mov al, byte [ebp + 2]
mov byte [edx + 8], al
mov al, byte [ebx + 6]
mov byte [edx + 9], al
mov al, byte [ecx + 2]
mov byte [edx + 0xa], al
mov al, byte [ebp + 2]
mov byte [edx + 0xb], al
mov al, byte [ebx + 8]
mov byte [edx + 0xc], al
mov al, byte [ecx + 4]
mov byte [edx + 0xd], al
mov al, byte [ebp + 4]
mov byte [edx + 0xe], al
mov al, byte [ebx + 0xa]
mov byte [edx + 0xf], al
mov al, byte [ecx + 4]
mov byte [edx + 0x10], al
mov al, byte [ebp + 4]
mov byte [edx + 0x11], al
mov al, byte [ebx + 0xc]
mov byte [edx + 0x12], al
mov al, byte [ecx + 6]
mov byte [edx + 0x13], al
mov al, byte [ebp + 6]
mov byte [edx + 0x14], al
mov al, byte [ebx + 0xe]
add ebx, 0x10
mov byte [edx + 0x15], al
mov al, byte [ecx + 6]
add ecx, 0x10
mov byte [edx + 0x16], al
mov al, byte [ebp + 6]
add ebp, 0x10
mov byte [edx + 0x17], al
add edx, edi
inc esi
jne 0x60011e40
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret

Function at 0x60012280
Capabilities:
Enumerate pe sections

Disassembly:
push edi
push esi
push ebp
push ebx
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sub esp, 8
mov esi, 0xfffffff8
mov al, byte [ecx]
mov byte [edx], al
mov al, byte [ebx]
mov byte [edx + 1], al
mov al, byte [ecx + 2]
mov byte [edx + 2], al
mov al, byte [ebp]
mov byte [edx + 3], al
mov al, byte [ecx + 4]
mov byte [edx + 4], al
mov al, byte [ebx + 2]
mov byte [edx + 5], al
mov al, byte [ecx + 6]
mov byte [edx + 6], al
mov al, byte [ebp + 2]
mov byte [edx + 7], al
mov al, byte [ecx + 8]
mov byte [edx + 8], al
mov al, byte [ebx + 4]
mov byte [edx + 9], al
mov al, byte [ecx + 0xa]
mov byte [edx + 0xa], al
mov al, byte [ebp + 4]
mov byte [edx + 0xb], al
mov al, byte [ecx + 0xc]
mov byte [edx + 0xc], al
mov al, byte [ebx + 6]
add ebx, 0x10
mov byte [edx + 0xd], al
mov al, byte [ecx + 0xe]
add ecx, 0x10
mov byte [edx + 0xe], al
mov al, byte [ebp + 6]
add ebp, 0x10
mov byte [edx + 0xf], al
add edx, edi
inc esi
jne 0x600122a0
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x60030da0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
add esp, 0xffffffec
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esp, ebp
pop ebp
ret

Function at 0x60030de0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
add esp, 0xffffffec
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret
Function at 0x10001430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10011f78
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x1001a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x34]
mov word [ebp - 0x33], 0x7265
push eax
mov byte [ebp - 0x34], 0x4b
mov word [ebp - 0x2c], 0x642e
mov word [ebp - 0x29], 0x6c
mov dword [ebp - 0x30], 0x32336c65
mov byte [ebp - 0x31], 0x6e
mov byte [ebp - 0x2a], 0x6c
mov word [ebp - 0x18], 0x74
mov dword [ebp - 0x21], 0x73736563
mov dword [ebp - 0x1d], 0x654e3233
mov word [ebp - 0x24], 0x7250
mov byte [ebp - 0x22], 0x6f
mov byte [ebp - 0x19], 0x78
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 0x180], ebx
test ebx, ebx
je 0x10001624
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x24]
push eax
push ebx
call esi
push 0x10017c04
push ebx
mov dword [ebp - 0x17c], eax
call esi
cmp dword [ebp - 0x17c], 0
je 0x1000161d
test eax, eax
je 0x1000161d
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], 0
mov byte [ebp - 0x4c], 0
push 0
push 2
mov dword [ebp - 4], 0
call eax
mov ebx, eax
mov dword [ebp - 0x184], ebx
cmp ebx, 0xffffffff
je 0x1000154c
lea eax, [ebp - 0x178]
mov dword [ebp - 0x178], 0x128
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x10001560
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x180]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x4c]
call fcn.10003990
jmp 0x10001624
cmp byte [ebp - 0x154], 0
jne 0x1000156d
xor eax, eax
jmp 0x1000157c
lea eax, [ebp - 0x154]
push eax
call fcn.10009aa0
add esp, 4
push eax
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x4c]
call fcn.10003d50
mov ecx, dword [edi + 4]
mov eax, 0x2aaaaaab
sub ecx, dword [edi]
imul ecx
mov ecx, dword [edi + 8]
mov eax, 0x2aaaaaab
sub ecx, dword [edi]
sar edx, 2
mov ebx, edx
inc edx
shr ebx, 0x1f
add ebx, edx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, ebx
jae 0x100015cd
cmp ebx, 0xaaaaaaa
ja 0x10001613
push ebx
mov ecx, edi
call fcn.10003b20
lea eax, [ebp - 0x4c]
mov ecx, edi
push eax
call fcn.100037a0
mov ebx, dword [ebp - 0x184]
lea eax, [ebp - 0x178]
push eax
push ebx
call dword [ebp - 0x17c]
test eax, eax
jne 0x10001560
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x180]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x4c]
call fcn.10003990
mov al, 1
jmp 0x10001626
push str.vector_T__too_long
call fcn.10005a45
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100049be
mov esp, ebp
pop ebp
ret
Function at 0x10003370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x1001a00c]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1001b3a0], eax
mov eax, dword [ebp + 0x14]
mov dword [0x1001b39c], eax
call fcn.100033d0
lea ecx, [esp]
mov dword [esp + 4], 0x65746164
mov dword [esp], 0x70557250
mov dword [esp + 0xa], 0x657865
mov word [esp + 8], 0x2e72
call fcn.10003470
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100049be
mov esp, ebp
pop ebp
ret

Function at 0x100033d0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
mov eax, dword [0x1001a00c]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10003449
lea eax, [esp + 4]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10003449
mov eax, dword [esp + 4]
push 0
push 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
push 0x10
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100049be
add esp, 0x24
ret
Function at 0x100046e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100046f5
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000472d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10004729
cmp esi, edx
jae 0x1000472d
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10004717
cmp esi, edx
jb 0x10004733
pop esi
pop edi
xor eax, eax
pop ebx
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x438ca9
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop ebx
sub eax, eax
or eax, eax
call fcn.00438ce3
sub eax, 0xb57c5618
inc esi
xor dword [edx], ebx
sub esi, esi
and esi, esi
add esi, 0x16c8061c
inc edx
inc esi
cmp edx, ecx
jne fcn.00438ca9
or eax, esi
add eax, esi
ret
Function at 0x10011490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x78
mov eax, dword [0x8a0a2f0]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
mov ebx, dword [esp + 0x80]
mov eax, 1
push esi
push 0x30
mov word [esp + 0x7c], ax
mov esi, 2
lea eax, [esp + 0x1c]
mov dword [esp + 0x70], 0x40000
push 0
push eax
mov dword [esp + 0x7c], 0x20004
mov dword [esp + 0x80], 0x10001
mov dword [esp + 0x20], 0
call fcn.1000d861
push 0x24
lea eax, [esp + 0x58]
push 0
push eax
call fcn.1000d861
push 0x2b
push ebx
call fcn.100269f0
mov edx, eax
add esp, 0x20
test edx, edx
jne 0x10011520
pop esi
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10010f50
add esp, 0x78
ret
mov al, byte [edx + 5]
cmp al, 9
ja 0x10011673
cmp al, 1
jb 0x10011673
movzx eax, al
cmp dword [esp + eax*4 + 0x44], 0
jne 0x100115a0
mov dword [esp + eax*4 + 0x44], edx
movzx eax, byte [edx + 5]
dec eax
cmp eax, 8
ja 0x100115a0
jmp dword [eax*4 + 0x89f0cec]
movzx eax, byte [edx + 5]
movzx ecx, byte [edx + 6]
shl eax, 8
or eax, ecx
cmp eax, 0x200
jg 0x1001161e
je 0x10011614
sub eax, 0x100
cmp eax, 0x46
ja 0x10011673
movzx eax, byte [eax + 0x89f0d2c]
jmp dword [eax*4 + 0x89f0d10]
mov dword [esp + 0x30], 0
jmp 0x10011673
cmp eax, 0x714
jg 0x10011653
je 0x10011649
cmp eax, 0x300
je 0x1001163f
cmp eax, 0x70a
jne 0x10011673
mov dword [esp + 0x38], 0
jmp 0x10011673
mov dword [esp + 0x34], 0
jmp 0x10011673
mov dword [esp + 0x3c], 0
jmp 0x10011673
cmp eax, 0x80a
je 0x1001166b
cmp eax, 0x90a
jne 0x10011673
mov dword [esp + 0x44], 0
jmp 0x10011673
mov dword [esp + 0x40], 0
push edx
push ebx
call fcn.10026a90
mov edx, eax
add esp, 8
test edx, edx
jne 0x10011520
push 0x14
push 1
push ebx
call fcn.10026a50
add esp, 0xc
test eax, eax
je 0x10011731
add eax, 0xf
mov dword [esp + 0x10], 0
push 2
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1000d79d
mov ecx, dword [esp + 0x1c]
add esp, 0xc
cmp dword [esp + 0x38], 0
jne 0x100116d7
cmp dword [esp + 0x3c], 0
jne 0x100116d7
cmp dword [esp + 0x40], 0
jne 0x100116d7
cmp dword [esp + 0x44], 0
je 0x100116f2
test cx, cx
je 0x100116f2
pop esi
mov eax, 0xb
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10010f50
add esp, 0x78
ret
cmp cx, 7
jae 0x10011702
movzx eax, cx
movzx eax, word [esp + eax*2 + 0x6c]
jmp 0x1001172d
cmp cx, 0xb
jne 0x10011712
mov dword [esp + 0x14], 1
jmp 0x10011731
cmp cx, 0x14
jne 0x10011722
mov dword [esp + 0x14], 4
jmp 0x10011731
mov eax, dword [esp + 0x14]
cmp cx, 0x15
cmove eax, esi
mov dword [esp + 0x14], eax
xor esi, esi
push edi
cmp dword [esp + esi*4 + 0x1c], 0
je 0x1001189d
movq xmm0, qword [0x8a0aa74]
mov al, byte [0x8a0aa7c]
movq qword [esp + 0x70], xmm0
mov byte [esp + 0x78], al
mov dword [esp + 0x14], 0
cmp esi, 0xb
ja 0x100118d2
jmp dword [esi*4 + 0x89f0d74]
inc esi
cmp esi, 0xc
jl 0x10011734
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10010f50
add esp, 0x78
ret
mov ecx, dword [esp + 0x80]
mov eax, 0xb
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10010f50
add esp, 0x78
ret
Function at 0x401090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, eax
je 0x4010b1
push dword [ebp + 0x10]
push eax
push ebx
call sub.ucrtbase.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x10]
xor ecx, ecx
shr eax, 3
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], ecx
test eax, eax
je 0x40116c
lea edx, [ebx + 4]
lea eax, [esi + 0x44]
mov dword [ebp - 8], edx
push edi
mov edi, eax
mov dword [ebp - 4], 0x10
nop word [eax + eax]
mov ebx, dword [edi]
lea edi, [edi - 4]
mov eax, dword [ebp + 8]
xor ebx, dword [eax + ecx*8]
mov dword [eax + ecx*8], ebx
mov eax, ebx
shr eax, 0x10
mov ecx, ebx
movzx eax, al
shr ecx, 0x18
mov edx, dword [esi + eax*4 + 0x448]
mov eax, ebx
add edx, dword [esi + ecx*4 + 0x48]
mov ecx, dword [ebp + 0xc]
shr eax, 8
movzx eax, al
xor edx, dword [esi + eax*4 + 0x848]
movzx eax, bl
mov ebx, dword [ebp + 8]
add edx, dword [esi + eax*4 + 0xc48]
mov eax, dword [ebp - 8]
xor dword [eax + ecx*8], edx
sub dword [ebp - 4], 1
mov eax, dword [eax + ecx*8]
mov edx, dword [ebx + ecx*8]
mov dword [ebx + ecx*8], eax
mov dword [ebx + ecx*8 + 4], edx
jne 0x4010e0
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + eax*8], edx
mov dword [ebx + eax*8 + 4], ecx
mov eax, dword [esi + 4]
xor eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebx + ecx*8 + 4], eax
mov eax, dword [esi]
xor dword [ebx + ecx*8], eax
inc ecx
lea eax, [esi + 0x44]
mov dword [ebp + 0xc], ecx
cmp ecx, dword [ebp + 0x10]
jb 0x4010d1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x401180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, dword [edi + ecx*4]
xor ebx, dword [eax]
mov dword [eax], ebx
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
movzx ecx, cl
shr edx, 0x18
mov esi, dword [edi + ecx*4 + 0x448]
mov ecx, ebx
add esi, dword [edi + edx*4 + 0x48]
shr ecx, 8
movzx ecx, cl
xor esi, dword [edi + ecx*4 + 0x848]
movzx ecx, bl
mov ebx, dword [ebp + 0xc]
add esi, dword [edi + ecx*4 + 0xc48]
xor dword [ebx], esi
mov ecx, dword [ebx]
mov esi, dword [eax]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebx], esi
mov dword [ebp - 4], ecx
cmp ecx, 0x10
jl 0x401191
mov edx, dword [eax]
mov dword [eax], esi
mov dword [ebx], edx
mov ecx, dword [edi + 0x40]
xor ecx, edx
mov dword [ebx], ecx
mov ecx, dword [edi + 0x44]
xor dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401200
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movups xmm0, xmmword [0x407190]
push ebx
push esi
mov esi, ecx
push edi
push 0x1000
push 0x4071d8
movups xmmword [esi], xmm0
lea eax, [esi + 0x48]
mov dword [ebp - 0x10], esi
movups xmm0, xmmword [0x4071a0]
push eax
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [0x4071b0]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [0x4071c0]
movups xmmword [esi + 0x30], xmm0
movq xmm0, qword [0x4071d0]
movq qword [esi + 0x40], xmm0
call sub.ucrtbase.dll_memcpy
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov ecx, edi
mov ebx, 4
and ecx, 0x80000003
jns 0x401275
dec ecx
or ecx, 0xfffffffc
add ecx, 1
je 0x401284
mov eax, ebx
mov ebx, ecx
cdq
idiv ecx
mov ecx, edx
test ecx, ecx
jne 0x401277
mov eax, edi
mov ecx, 4
cdq
idiv ebx
mov dword [ebp - 0xc], eax
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.004040e0
mov ebx, eax
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], ebx
test eax, eax
jle 0x401309
mov ebx, dword [ebp + 8]
mov ecx, 2
mov esi, dword [ebp - 8]
mov dword [ebp - 4], eax
nop
lea eax, [ecx - 2]
cdq
idiv edi
movzx eax, byte [edx + ebx]
mov byte [ebp + 0xf], al
lea eax, [ecx - 1]
cdq
idiv edi
movzx eax, byte [edx + ebx]
mov byte [ebp + 0xe], al
mov eax, ecx
cdq
idiv edi
movzx eax, byte [edx + ebx]
mov byte [ebp + 0xd], al
lea eax, [ecx + 1]
cdq
idiv edi
movzx eax, byte [edx + ebx]
mov byte [ebp + 0xc], al
mov eax, dword [ebp + 0xc]
mov dword [ecx + esi - 2], eax
add ecx, 4
sub dword [ebp - 4], 1
jne 0x4012c0
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
lea ecx, [esi + 8]
mov esi, 2
lea eax, [esi - 2]
cdq
lea ecx, [ecx + 0x18]
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x20], eax
lea eax, [esi - 1]
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x1c], eax
mov eax, esi
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x18], eax
lea eax, [esi + 1]
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x14], eax
lea eax, [esi + 2]
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x10], eax
lea eax, [esi + 3]
cdq
add esi, 6
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0xc], eax
lea eax, [esi - 2]
cmp eax, 0x12
jl 0x401314
push ebx
call fcn.00404100
mov esi, dword [ebp - 0x10]
add esp, 4
mov dword [ebp + 0xc], 0
xor edi, edi
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
mov ecx, esi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00401180
mov eax, dword [ebp + 0xc]
mov dword [esi + edi*8], eax
mov eax, dword [ebp + 8]
mov dword [esi + edi*8 + 4], eax
inc edi
cmp edi, 9
jl 0x401385
lea edi, [esi + 0x4c]
mov ebx, 0x200
nop
lea eax, [ebp + 8]
mov ecx, esi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00401180
mov eax, dword [ebp + 0xc]
lea edi, [edi + 8]
mov dword [edi - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [edi - 8], eax
sub ebx, 1
jne 0x4013b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401ea0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x401efd
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x401ec0
mov eax, dword [esi]
jmp 0x401fdb
cmp eax, 0x4e0
jb 0x401fdb
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x401f16
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x401f61
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402050
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x271c
call fcn.00404850
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, 0x1571
mov eax, 1
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [ebp + eax*4 - 0x1388], edx
inc eax
cmp eax, 0x270
jb 0x402071
call fcn.00404000
mov dword [ebp - 0x1398], 0xffffffff
mov edx, 1
mov dword [ebp - 0x2718], eax
nop dword [eax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [ebp + edx*4 - 0x2718], eax
inc edx
cmp edx, 0x270
jb 0x4020b0
push esi
push 0x1388
lea eax, [ebp - 0x271c]
mov dword [ebp - 0x271c], 0x270
push eax
lea eax, [ebp - 0x138c]
push eax
call sub.ucrtbase.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x138c]
call fcn.00401ea0
mov esi, 0x7d1
mul esi
cmp eax, esi
jae 0x402126
cmp eax, 0x376
jae 0x402126
lea ecx, [ebp - 0x138c]
call fcn.00401ea0
mul esi
cmp eax, 0x376
jb 0x402112
lea eax, [edx - 0x7ffff830]
xor eax, 0x80000000
cdq
mov dword [ebp - 0x1394], eax
lea eax, [ebp - 0x1394]
push eax
mov dword [ebp - 0x1390], edx
call fcn.004018a0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
call fcn.00404670
mov esp, ebp
pop ebp
ret

Function at 0x402160
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x402190
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402190
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x400
jg 0x402190
add eax, ecx
xor ecx, ecx
cmp dword [eax], 0x4550
cmovne eax, ecx
pop ebp
ret 4
xor eax, eax
pop ebp
ret 4
Function at 0x4c7207
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4c7236
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, eax
shr edx, 0x18
shl eax, 8
mov edx, dword [edx*4 + 0x1012de0]
xor edx, eax
mov dword [ecx], edx
movzx eax, byte [esi]
xor eax, edx
inc esi
dec edi
mov dword [ecx], eax
jne 0x4c7215
pop esi
pop edi
ret 8