joyce8/EMBER2024-capa huggingface dataset:
Function at 0xde513c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xde5146
pushal
call 0xde514c
pop ebp
sub ebp, 0x10
sub ebp, 0x9e513c
jmp 0xde5162
xchg edi, eax
xchg ebx, eax
mov eax, 0x9e513c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5be
mov edx, 0x42535d84
xor byte [eax], dl
inc eax
dec ecx
jne 0xde5179
jmp 0xde518c
cmovns ecx, dword [edi]
or eax, 0x848484b8
add eax, 0x84847c45
test byte [edi - 0x7b7dc3b7], al
test byte [esi + edi - 0x7b7b7b54], al
jae 0xde520e
xchg dword [edi + ecx + 5], ecx
mov byte [esp + eax*4 - 0x2bbe787c], al
aam 0xec
pop esp
mov ah, 0xa6
test ah, ch
loopne 0xde5160
clc
test byte [ebp + 0x67eca0a8], al
jmp 0x824a775c
test byte [ebp + 0x6cd5a0a8], al
add dword [esp + eax*4 - 0x792c927c], 0xe0098484
rol dword [esi - 0x1ff67b7c], cl
mov al, byte [0xa0a80d78]
rcr cl, 1
jnp 0xde5219
mov byte [ebx - 0xf], bh
mov word [eax + eax - 0x7c], gs
test byte [edi + ecx - 0x7b7b73c7], al
test byte [0x993b0575], al
push esi
add eax, 0x993b0575
push esi
mov bh, 0x4d
jne 0xde523f
cmp ebx, dword [ecx + 0x5750556]
cmp ebx, dword [ecx + 0x54db756]
jbe 0xde527b
add eax, 0xb756993b
dec ebp
add eax, 0xa2033376
in eax, dx
add eax, 0xa2033376
in eax, dx
mov bh, 0x56
pop es
xor eax, dword [ebx]
mov byte [0x337605ed], al
add esp, dword [edx + 0x337605ed]
add esp, dword [edx + 0x756b7ed]
insb byte es:[edi], dx
or esp, 0x84ca008b
test byte [ebx + ecx*4 - 0x7b7b33f4], al
test dl, ah
sets byte [ebp - 0x749380fc]
add byte [esi + 0x4848484], bl
jg 0xde52e0
mov eax, dword [eax]
xchg ebp, eax
test byte [esp + eax*4 + 0x7b7f05e2], al
jg 0xde52f8
mov eax, dword [0x8491008b]
test byte [ebp + eax*8 + 0x7b7b486d], al
jnp 0xde5238
enter 0xffffffffffff85bd, 7
inc ebp
add dword [edi], 0x396d806c
jnp 0xde5313
jnp 0xde5247
sar byte [ebp - 0x7dbaf87a], 1
pop es
outsb dx, byte [esi]
add byte [edi], 0x6c
sub dword [ebp + 0x2f], 0xf7b7b7b
test al, 0xa0
or eax, esp
mov al, byte [0x84884680]
ror dword [edi], 1
push 0xfd1d3d2
int1
mov byte [edi], cl
stc
invalid
test byte [esi], cl
xchg edx, eax
ret 0x5696
push esi
mov eax, dword [edi]
out dx, al
test byte [esp + eax*4 + 0x568644b7], al
mov eax, dword [ecx]
add dword [esp + eax*4 - 0x3d6df17c], 0x78b5696
scasb al, byte es:[edi]
test dword [esp + eax*4 + 0x18b5686], eax
add dword [esp + eax*4 - 0x3d6df17c], 0x44975696
test byte [esi - 0x7efe74aa], al
test byte [esp + eax*4 - 0x693d6df2], al
push esi
xchg edi, eax
inc esp
xchg byte [esi - 0x75], dl
add dword [ecx + 0xe848484], eax
xchg edx, eax
ret 0x5696
Function at 0x401640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x481195
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push edi
push 0x48
call fcn.00459f99
add esp, 4
mov dword [esp + 8], eax
xor esi, esi
mov dword [esp + 0x3c], esi
cmp eax, esi
je 0x40167a
push eax
call fcn.00415730
mov esi, eax
mov dword [esp + 0x3c], 0xffffffff
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x10]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
call fcn.00414950
mov dword [esp + 0x3c], 2
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x1c], ecx
lea edi, [esi + 0x30]
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], edx
mov dword [esp + 0xc], 4
call fcn.004094c0
mov eax, esi
call fcn.004156c0
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.004149b0
mov ecx, dword [esp + 0x34]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x38
ret
Function at 0x4063a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47e547
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 0x20]
call fcn.00414950
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov byte [esp + 0x14], 1
call fcn.0040a2f0
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edi
mov byte [esp + 0x14], 2
call fcn.0040a2f0
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], edi
mov byte [esp + 0x14], 3
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4
Function at 0x407b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x481870
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
mov eax, dword [esp + 0xa4]
push ebx

Function at 0x40e4e0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47fa3b
push eax
mov dword fs:[0], esp
mov eax, dword [edi]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0x14]
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x18]
lea ecx, [edi + 0x1c]
push ecx
lea edx, [esi + 0x1c]
push edx
mov dword [esi + 0x18], eax
call fcn.0042cf20
mov dword [esp + 0x14], 0
mov ecx, esi
lea eax, [edi + 0x30]
lea edx, [esi + 0x30]
sub ecx, edi
mov ebx, 0x11
sub edx, eax
lea ebx, [ebx]
mov ebp, dword [eax]
mov dword [edx + eax], ebp
mov ebp, dword [eax + 8]
mov dword [ecx + eax + 8], ebp
mov ebp, dword [eax + 0xc]
mov dword [ecx + eax + 0xc], ebp
add eax, 0x10
sub ebx, 1
jns 0x40e550
mov eax, dword [edi + 0x150]
mov dword [esi + 0x150], eax
mov ecx, dword [edi + 0x154]
mov dword [esi + 0x154], ecx
mov edx, dword [edi + 0x158]
mov dword [esi + 0x158], edx
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4

Function at 0x40f980
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47f4ab
push eax
mov dword fs:[0], esp
mov eax, dword [edi]
push esi
mov esi, dword [esp + 0x14]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
fld dword [edi + 0x10]
fstp dword [esi + 0x10]
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0x18]
mov dword [esi + 0x18], edx
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x24], edx
fld dword [edi + 0x28]
fstp dword [esi + 0x28]
lea ecx, [edi + 0x3c]
fld dword [edi + 0x2c]
push ecx
fstp dword [esi + 0x2c]
lea edx, [esi + 0x3c]
fld dword [edi + 0x30]
push edx
fstp dword [esi + 0x30]
fld dword [edi + 0x34]
fstp dword [esi + 0x34]
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
call fcn.0040fcd0
mov dword [esp + 0xc], 0
mov al, byte [edi + 0x4c]
mov byte [esi + 0x4c], al
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x414a20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x414a39
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x414a74
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x414a70
lea ebx, [ebx]
cmp esi, eax
jae 0x414a74
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x414a60
cmp esi, eax
jb 0x414a7a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x41e330
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x480828
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x1bc0]
lea ecx, [ebp + 8]
mov eax, edi
call fcn.00412f00
mov eax, dword [eax]
test eax, eax
jne 0x41e3e1
push str.temp.bmp
add esi, 0x2010
lea eax, [esp + 0x10]
push esi
push eax
call fcn.00408a20
add esp, 0xc
mov dword [esp + 0x1c], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x30]
mov ecx, dword [esp + 0xc]
push 0
push eax
push 0
push ecx
call sub.d3dx9_39.dll_D3DXSaveTextureToFileA
mov edx, dword [esp + 0xc]
push 0x10
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, eax
lea ecx, [ebp + 8]
mov eax, edi
call fcn.00412f00
mov dword [eax], esi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.004149b0
mov eax, esi
mov ecx, dword [esp + 0x14]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x426b40
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4801ec
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
mov ebx, dword [esp + 0x228]
push ebp
push esi
push edi
lea eax, [esp + 0x11c]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x105
lea ecx, [esp + 0x120]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [esp + 0x14]
push eax
push 0
push 0x488594
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 0x14]
lea esi, [ebx + 0x2010]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x426bb6
sub eax, edi
push eax
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.00414de0
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edi, [ebx + 0x2014]
push esi
mov ecx, edi
call fcn.00413d90
push 1
push 0x488598
mov ecx, esi
call fcn.00424050
push str.Python
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00408a20
add esp, 0xc
mov dword [esp + 0x22c], 0
push eax
mov ecx, edi
call fcn.00413d90
or ebp, 0xffffffff
mov dword [esp + 0x22c], ebp
lea ecx, [esp + 0x10]
call fcn.004149b0
push str.PythonLibs.zip
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.00408a20
add esp, 0xc
mov dword [esp + 0x22c], 1
lea ecx, [ebx + 0x2018]
push eax
call fcn.00413d90
mov dword [esp + 0x22c], ebp
lea ecx, [esp + 0x10]
call fcn.004149b0
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea edx, [esp + 0x18]
push edx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x426ccf
lea ecx, [esp + 0x10]
call fcn.00414950
mov dword [esp + 0x22c], 2
call ebx
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push str.Error_creating_temporary_folder_at__s___d__
push ecx
call fcn.004141b0
mov edx, dword [esp + 0x20]
add esp, 0x10
push 0x10
push str.Construct_Runtime
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [esp + 0x22c], ebp
lea ecx, [esp + 0x10]
call fcn.004149b0
mov eax, dword [edi]
push 0
push eax
call esi
test eax, eax
jne 0x426d2a
lea ecx, [esp + 0x10]
call fcn.00414950
mov dword [esp + 0x22c], 3
call ebx
push eax
mov eax, dword [edi]
push eax
lea ecx, [esp + 0x18]
push str.Error_creating_temporary_folder_at__s___d__
push ecx
call fcn.004141b0
mov edx, dword [esp + 0x20]
add esp, 0x10
push 0x10
push str.Construct_Runtime
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [esp + 0x22c], ebp
lea ecx, [esp + 0x10]
call fcn.004149b0
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x220
ret 4
Function at 0x426d50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47f870
push eax
mov dword fs:[0], esp
movzx eax, word [esp + 0x10]
sub esp, 0x48
push ebp
push esi
push edi
mov edi, ecx
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test esi, esi
jne 0x426dfc
lea ecx, [esp + 0x64]
call fcn.00414950
mov dword [esp + 0x5c], esi
push ebp
push edi
lea ecx, [esp + 0x6c]
push str.Error_loading___s____d_
push ecx
call fcn.004141b0
mov edx, dword [esp + 0x74]
mov eax, edx
mov dword [esp + 0x30], esi
add esp, 0x10
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x426dc5
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.00415040
mov byte [esp + 0x5c], 1
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.00415650
push 0x49aa24
lea ecx, [esp + 0x2c]
push ecx
call fcn.00466bcb
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [esp + 0x68]
push esi
push 0
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x6c]
mov dword [ecx], eax
mov ecx, dword [esp + 0x54]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x54
ret
Function at 0x428e20
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47f828
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.00414950
xor ebx, ebx
mov dword [esp + 0x6c], ebx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
push eax
add edi, 0x2010
lea ecx, [esp + 0x18]
push edi
push ecx
call fcn.00408a20
mov byte [esp + 0x78], 1
mov eax, dword [eax]
push 0x488d40
push eax
call fcn.004650d6
add esp, 0x14
mov esi, eax
mov byte [esp + 0x6c], bl
lea ecx, [esp + 0x14]
call fcn.004149b0
mov edx, dword [ebp + 0x10]
cmp esi, ebx
jne 0x428f27
push edx
lea eax, [esp + 0x18]
push edi
push eax
call fcn.00408a20
mov esi, eax
mov byte [esp + 0x78], 2
call fcn.0046512f
mov ecx, dword [eax]
mov edx, dword [esi]
push ecx
push edx
lea eax, [esp + 0x24]
push str.Error_unpacking_dependencies__1_:_could_not_create_file__s___d_
push eax
call fcn.004141b0
add esp, 0x1c
mov byte [esp + 0x6c], bl
lea ecx, [esp + 0x14]
call fcn.004149b0
mov edx, dword [esp + 0x10]
mov eax, edx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x428ef0
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.00415040
mov byte [esp + 0x6c], 3
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.00415650
push 0x49aa24
lea eax, [esp + 0x3c]
push eax
call fcn.00466bcb
mov ecx, dword [ebp + 0xc]
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
jne 0x428fa7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x14]
push str.Error_unpacking_dependencies__2_:__d
push eax
call fcn.004141b0
mov edx, dword [esp + 0x1c]
mov eax, edx
add esp, 0xc
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
lea esi, [eax + 1]
jmp 0x428f70
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x428f70
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.00415040
mov byte [esp + 0x6c], 4
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.00415650
push 0x49aa24
lea eax, [esp + 0x3c]
push eax
call fcn.00466bcb
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push ebx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
push esi
push eax
push 1
push ecx
call fcn.004652da
push esi
call fcn.004653d3
add esp, 0x14
mov dword [esp + 0x6c], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.004149b0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x429540
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47f7ec
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
lea ecx, [esi + 0x20]
call fcn.00414950
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov byte [esp + 0xc], 1
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov byte [esp + 0xc], 2
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4

Function at 0x4295b0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47f7ec
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov dword [esp + 0x14], 2
mov eax, dword [esi + 0x4c]
xor ebx, ebx
cmp eax, ebx
je 0x4295f7
mov ecx, dword [esp + 0x1c]
mov edi, dword [esi + 0x50]
push ecx
push eax
call fcn.004105a0
mov eax, dword [esi + 0x4c]
push eax
call fcn.00459fc8
add esp, 0xc
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov byte [esp + 0x14], 1
mov eax, dword [esi + 0x3c]
cmp eax, ebx
je 0x429626
mov edx, dword [esp + 0x1c]
mov edi, dword [esi + 0x40]
push edx
push eax
call fcn.004105a0
mov eax, dword [esi + 0x3c]
push eax
call fcn.00459fc8
add esp, 0xc
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov byte [esp + 0x14], bl
mov eax, dword [esi + 0x2c]
cmp eax, ebx
je 0x429654
mov ecx, dword [esp + 0x1c]
mov edi, dword [esi + 0x30]
push ecx
push eax
call fcn.004105a0
mov eax, dword [esi + 0x2c]
push eax
call fcn.00459fc8
add esp, 0xc
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esi + 0x20]
call fcn.004149b0
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x42cde0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47fe09
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
push edi
push esi
call fcn.0042ce60
mov dword [esp + 0x14], 0
lea eax, [edi + 0x10]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0042ce60
mov byte [esp + 0x14], 1
lea edx, [edi + 0x20]
push edx
lea eax, [esi + 0x20]
push eax
call fcn.0042cf20
mov byte [esp + 0x14], 2
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
push ecx
call fcn.0040fcd0
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4

Function at 0x431240
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [esi + 4], eax
mov ecx, 1
lea edx, [esi + 8]
push edi
lea esp, [esp]
mov edi, eax
shr edi, 0x1e
xor edi, eax
imul edi, edi, 0x6c078965
lea eax, [edi + ecx]
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 0x270
jl 0x431250
mov dword [esi], 0x270
pop edi
ret
Function at 0x435120
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x481a69
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [esp + 0x18]
lea ecx, [esi + 0x88]
call fcn.00414950
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov byte [esp + 0x10], 1
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x108], ebx
mov byte [esp + 0x10], 2
call fcn.00438c50
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], ebx
mov byte [esp + 0x10], 3
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
mov byte [esp + 0x10], 4
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ebx
mov dword [esi + 0x134], ebx
mov byte [esp + 0x10], 5
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov byte [esp + 0x10], 6
mov dword [esi + 0x14c], ebx
mov dword [esi + 0x150], ebx
mov dword [esi + 0x154], ebx
mov byte [esp + 0x10], 7
lea eax, [esi + 0x158]
push eax
call fcn.004298b0
mov byte [esp + 0x10], 8
lea ecx, [esi + 0x164]
push ecx
call fcn.00429910
mov byte [esp + 0x10], 9
mov dword [esi + 0x170], ebx
mov dword [esi + 0x194], ebx
mov dword [esi + 0x198], ebx
mov dword [esi + 0x19c], ebx
mov byte [esp + 0x10], 0xa
mov dword [esi + 0x1a4], ebx
mov dword [esi + 0x1a8], ebx
mov dword [esi + 0x1ac], ebx
mov byte [esp + 0x10], 0xb
mov edx, dword [esp + 0x1c]
mov dword [esi], edx
mov eax, dword [0x4a79c8]
mov dword [esi + 0xc8], eax
mov ecx, dword [0x4a79cc]
mov dword [esi + 0xcc], ecx
mov edx, dword [0x4a79d0]
mov dword [esi + 0xd0], edx
mov eax, dword [0x4a79d4]
mov dword [esi + 0xd4], eax
mov dword [esi + 8], 0x280
mov dword [esi + 0xc], 0x1e0
fldz
mov dword [esi + 0x90], ebx
fst qword [esi + 0x30]
mov dword [esi + 0x94], ebx
fst qword [esi + 0x38]
mov dword [esi + 0x74], ebx
fst qword [esi + 0x50]
mov byte [esi + 0x70], bl
fld1
mov dword [esi + 0xd8], ebx
fst qword [esi + 0x40]
mov byte [esi + 0x98], bl
fstp qword [esi + 0x48]
mov byte [esi + 0x99], bl
mov byte [esi + 0x1b4], bl
fstp qword [esi + 0x68]
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x439680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47ec50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov byte [esp + 4], bl
mov eax, dword [esp + 4]
push eax
push ecx
push edx
sub esp, 0x14
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x24], esp
mov dword [eax + 0x10], ecx
mov byte [esp + 0x30], 1
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
push eax
mov byte [esp + 0x38], bl
mov ecx, dword [esp + 0x5c]
call fcn.004399f0
add esp, 0x28
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x4396fb
push eax
call fcn.00459fc8
add esp, 4
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret