joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b75d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b7fa
push ebx
push esi
call fcn.0040b726
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b6bc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b7a7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b7f9
push edi
push eax
call fcn.00408580
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b7c7
call fcn.00407b30
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b7f8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b6bc
add esp, 0x20
test eax, eax
jne 0x40b7e6
push edi
call fcn.00407b30
jmp 0x40b7ee
push ebx
call fcn.00407b30
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40fddb
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [eax + 0xc]
nop
shr eax, 3
test al, 1
je 0x40fdf5
mov al, 1
leave
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x40fe0c
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x40fe64
mov eax, dword [eax + 0x10]
nop
push eax
call fcn.0040be96
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x40fe64
xor ebx, ebx
lea eax, [ebp - 0x10]
inc ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x40fe64
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40fe64
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x40fe5e
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x40fe60
xor bl, bl
mov al, bl
jmp 0x40fe66
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x413b50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x413b7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x413b7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401e78
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
mov ecx, 0xa
xor edi, edi
pop esi
mov dword [0x4031a8], esi
push edi
dec ecx
jne 0x401e9b
lea eax, [ebp - 0x4c]
push eax
mov edx, dword [0x4031a8]
mov dword [ebp - 0x3c], edx
lea ecx, str.contents
mov dword [ebp - 0x28], ecx
lea eax, section..text
mov dword [ebp - 0x48], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
push eax
push dword [0x4031a8]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x4031b8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4031b8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x401f53
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
lea ecx, [ebp - 0x40]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x401f3a
pop ebp
ret 0x10

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3d3207bf
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7660684a
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4019c8
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov ebp, dword [edi]
test ebp, 0x3fffffff
je 0x4019ff
mov eax, dword [esp + 0x28]
xor edx, edx
nop
movzx ecx, byte [eax + edx]
mov byte [esi + edx], cl
inc edx
mov ebp, dword [edi]
lea ecx, [ebp*4]
cmp edx, ecx
jb 0x4019e8
jmp 0x401a01
xor ecx, ecx
mov eax, dword [edi + 4]
shl eax, 4
add eax, 0x10
cmp ecx, eax
jb 0x401a1a
jmp 0x401b59
mov ebp, dword [edi]
mov bl, byte [esi + ecx - 4]
mov bh, byte [esi + ecx - 3]
mov al, byte [esi + ecx - 2]
mov byte [esp], al
mov al, byte [esi + ecx - 1]
mov byte [esp + 4], al
mov eax, ecx
shr eax, 2
xor edx, edx
div ebp
test edx, edx
je 0x401a78
cmp ebp, 7
jb 0x401af5
cmp edx, 4
jne 0x401af5
movzx eax, bl
mov bl, byte [eax + str.cw]
movzx eax, bh
mov bh, byte [eax + str.cw]
movzx eax, byte [esp]
mov al, byte [eax + str.cw]
mov byte [esp], al
movzx eax, byte [esp + 4]
jmp 0x401aeb
movzx eax, bh
mov al, byte [eax + str.cw]
mov byte [esp + 0xb], al
movzx eax, byte [esp]
mov dword [esp], eax
movzx eax, byte [esp + 4]
mov dword [esp + 4], eax
movzx eax, bl
mov dword [esp + 0xc], eax
lea ebx, [ebp*4]
xor edx, edx
mov eax, ecx
div ebx
dec eax
je 0x401acb
xor edx, edx
mov bl, 1
nop dword [eax + eax]
mov bh, bl
add bh, bh
sar bl, 7
and bl, 0x1b
xor bl, bh
inc edx
cmp edx, eax
jne 0x401ab8
jmp 0x401acd
mov bl, 1
xor bl, byte [esp + 0xb]
mov eax, dword [esp]
mov bh, byte [eax + str.cw]
mov eax, dword [esp + 4]
mov al, byte [eax + str.cw]
mov byte [esp], al
mov eax, dword [esp + 0xc]
mov al, byte [eax + str.cw]
mov byte [esp + 4], al
shl ebp, 2
mov eax, ecx
sub eax, ebp
xor bl, byte [esi + eax]
mov byte [esi + ecx], bl
mov eax, ecx
or eax, 1
mov edx, dword [edi]
shl edx, 2
mov ebp, eax
sub ebp, edx
xor bh, byte [esi + ebp]
mov byte [esi + eax], bh
mov eax, ecx
or eax, 2
mov edx, dword [edi]
shl edx, 2
mov ebx, eax
sub ebx, edx
mov dl, byte [esp]
xor dl, byte [esi + ebx]
mov byte [esi + eax], dl
mov eax, ecx
or eax, 3
mov edx, dword [edi]
shl edx, 2
mov ebx, eax
sub ebx, edx
mov dl, byte [esp + 4]
xor dl, byte [esi + ebx]
mov byte [esi + eax], dl
add ecx, 4
mov eax, dword [edi + 4]
shl eax, 4
add eax, 0x10
cmp ecx, eax
jb 0x401a18
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401f24
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x48]
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x50]
mov dword [esp + 4], edi
call fcn.00401698
mov dword [esp], edi
call fcn.004425c0
mov esi, eax
mov eax, dword [ebp + 4]
shl eax, 4
add eax, 0x10
mov dword [esp], eax
call fcn.004425c0
mov dword [esp + 0x28], eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.004019c8
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test edi, edi
je 0x402081
mov ebp, dword [esp + 0x44]
xor ebx, ebx
nop dword [eax + eax]
lea eax, [ebp + ebx]
lea ecx, [esi + ebx]
mov edx, dword [esp + 0x28]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.00401b64
movzx eax, byte [esp + 0x18]
xor byte [esi + ebx], al
movzx eax, byte [esp + 0x19]
xor byte [esi + ebx + 1], al
movzx eax, byte [esp + 0x1a]
xor byte [esi + ebx + 2], al
movzx eax, byte [esp + 0x1b]
xor byte [esi + ebx + 3], al
movzx eax, byte [esp + 0x1c]
xor byte [esi + ebx + 4], al
movzx eax, byte [esp + 0x1d]
xor byte [esi + ebx + 5], al
movzx eax, byte [esp + 0x1e]
xor byte [esi + ebx + 6], al
movzx eax, byte [esp + 0x1f]
xor byte [esi + ebx + 7], al
movzx eax, byte [esp + 0x20]
xor byte [esi + ebx + 8], al
movzx eax, byte [esp + 0x21]
xor byte [esi + ebx + 9], al
movzx eax, byte [esp + 0x22]
xor byte [esi + ebx + 0xa], al
movzx eax, byte [esp + 0x23]
xor byte [esi + ebx + 0xb], al
movzx eax, byte [esp + 0x24]
xor byte [esi + ebx + 0xc], al
movzx eax, byte [esp + 0x25]
xor byte [esi + ebx + 0xd], al
movzx eax, byte [esp + 0x26]
xor byte [esi + ebx + 0xe], al
movzx eax, byte [esp + 0x27]
xor byte [esi + ebx + 0xf], al
mov eax, dword [ebp + ebx + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + ebx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + ebx]
mov ecx, dword [ebp + ebx + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
add ebx, 0x10
cmp ebx, edi
jb 0x401fa4
mov eax, dword [esp + 0x28]
test eax, eax
je 0x402091
mov dword [esp], eax
call fcn.004406a8
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4020e4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 8]
movzx ecx, byte [eax]
mov cl, byte [ecx + 0x462163]
mov byte [eax], cl
movzx ecx, byte [eax + 1]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 1], cl
movzx ecx, byte [eax + 2]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 2], cl
movzx ecx, byte [eax + 3]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 3], cl
movzx ecx, byte [eax + 4]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 4], cl
movzx ecx, byte [eax + 5]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 5], cl
movzx ecx, byte [eax + 6]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 6], cl
movzx ecx, byte [eax + 7]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 7], cl
movzx ecx, byte [eax + 8]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 8], cl
movzx ecx, byte [eax + 9]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 9], cl
movzx ecx, byte [eax + 0xa]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 0xa], cl
movzx ecx, byte [eax + 0xb]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 0xb], cl
movzx ecx, byte [eax + 0xc]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 0xc], cl
movzx ecx, byte [eax + 0xd]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 0xd], cl
movzx ecx, byte [eax + 0xe]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 0xe], cl
movzx ecx, byte [eax + 0xf]
mov cl, byte [ecx + 0x462163]
mov byte [eax + 0xf], cl
ret

Function at 0x415e78
Capabilities:
Create process on windows
Print debug messages

Disassembly:
sub esp, 0x4c
mov eax, dword [esp + 0x50]
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x1c], str.open
cmp dword [eax + 0x18], 0xf
ja 0x415f02
add eax, 4
jmp 0x415f05
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], 1
sub esp, 0xc
lea eax, [esp + 0x1c]
push eax
call sub.SHELL32.DLL_ShellExecuteExA
add esp, 0xc
test eax, eax
je 0x415f3d
mov eax, dword [esp + 0x48]
test eax, eax
je 0x415f39
sub esp, 0xc
push eax
call sub.KERNEL32.DLL_CloseHandle
add esp, 0xc
mov al, 1
jmp 0x415f90
call sub.KERNEL32.DLL_GetLastError
mov dword [esp + 0xc], 0
sub esp, 4
lea ecx, [esp + 0x10]
push 0
push 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call sub.KERNEL32.DLL_FormatMessageW
add esp, 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x415f8e
sub esp, 0xc
push eax
call sub.KERNEL32.DLL_OutputDebugStringW
add esp, 0xc
sub esp, 0xc
push dword [esp + 0x18]
call sub.KERNEL32.DLL_LocalFree
add esp, 0xc
xor eax, eax
add esp, 0x4c
ret
Function at 0x4198f8
Capabilities:
Get file attributes

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x18], 0xf
ja 0x41990a
add eax, 4
jmp 0x41990d
mov eax, dword [eax + 4]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetFileAttributesA
sub esp, 4
test al, 0x10
sete al
add esp, 0xc
ret
Function at 0x419bb0
Capabilities:
Get file size

Disassembly:
push edi
push esi
push eax
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x18], 0xf
ja 0x419bc2
add eax, 4
jmp 0x419bc5
mov eax, dword [eax + 4]
sub esp, 4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call sub.KERNEL32.DLL_CreateFileA
add esp, 4
mov esi, eax
cmp esi, 0xffffffff
je 0x419c13
sub esp, 8
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
add esp, 8
mov edi, eax
sub esp, 0xc
push esi
call sub.KERNEL32.DLL_CloseHandle
add esp, 0xc
cmp edi, 0xffffffff
je 0x419c13
mov eax, edi
add esp, 4
pop esi
pop edi
ret
add esp, 4
pop esi
pop edi
jmp sub.KERNEL32.DLL_GetLastError

Function at 0x41c850
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x27c
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x274]
mov dword [esp], edi
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0
call fcn.0044c927
mov dword [ebp - 0x20], 0xff
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.KERNEL32.DLL_GetComputerNameW
sub esp, 8
mov esi, eax
mov dword [ebp - 0x58], 0x45d7f8
mov dword [ebp - 0x54], 0x46427c
mov dword [ebp - 0x50], ebp
mov dword [ebp - 0x48], esp
mov dword [ebp - 0x50], 0x41ca0e
lea eax, [ebp - 0x74]
call fcn.0045e461
test esi, esi
je 0x41c8e7
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], 0
cmp word [ebp - 0x274], 0
je 0x41c91d
mov dword [esp], edi
call fcn.0044c630
jmp 0x41c91f
mov dword [ebx + 0x18], 0xf
mov dword [ebx + 0x14], 0
mov byte [ebx + 4], 0
mov dword [ebp - 0x6c], 0xffffffff
mov dword [esp], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x464076
call fcn.004025f8
jmp 0x41c9f6
xor eax, eax
mov dword [ebp - 0x6c], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], edi
lea eax, [ebp - 0x3c]
mov dword [esp], eax
call fcn.0041a23c
cmp dword [ebp - 0x24], 7
mov ecx, dword [ebp - 0x28]
ja 0x41c947
lea edx, [ebp - 0x38]
jmp 0x41c94a
mov edx, dword [ebp - 0x38]
mov dword [ebx + 0x18], 0xf
mov dword [ebx + 0x14], 0
mov byte [ebx + 4], 0
mov eax, ecx
and eax, 0x7fffffff
cmp eax, 0xf
je 0x41c9b0
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
lea eax, [ecx + ecx]
sar eax, 1
mov dword [ebp - 0x6c], 1
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 8], 1
call fcn.00402750
test al, al
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
je 0x41c9b0
lea eax, [ebx + 4]
cmp dword [ebx + 0x18], 0x10
jb 0x41c9a6
mov eax, dword [eax]
mov dword [ebx + 0x14], 0
mov byte [eax], 0
lea eax, [edx + ecx*2]
mov dword [ebp - 0x6c], 2
mov cl, byte [ebp - 0x10]
mov byte [esp + 0xc], cl
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.00412198
mov ecx, dword [ebp - 0x24]
cmp ecx, 8
mov ebx, dword [ebp + 8]
jb 0x41c9f6
mov eax, dword [ebp - 0x38]
lea ecx, [ecx + ecx + 2]
cmp ecx, 0x1000
jb 0x41c9ee
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.004406b8
lea eax, [ebp - 0x74]
mov dword [esp], eax
call fcn.0045e482
mov eax, ebx
add esp, 0x27c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434cc4
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 8
call sub.KERNEL32.DLL_GetCurrentProcessId
sub esp, 4
push eax
push 0
push 0x100001
call sub.KERNEL32.DLL_OpenProcess
add esp, 4
mov esi, eax
sub esp, 8
push 0
push esi
call sub.KERNEL32.DLL_TerminateProcess
add esp, 8
sub esp, 0xc
push esi
call sub.KERNEL32.DLL_CloseHandle
add esp, 0x14
pop esi
ret
Function at 0x43ed04
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x13dc
call fcn.0044a030
sub esp, 0x13dc
mov dword [ebp - 0x13c0], 0xf
mov dword [ebp - 0x13c4], 0
mov byte [ebp - 0x13d4], 0
lea eax, [ebp - 0x13d8]
mov dword [esp], eax
mov dword [esp + 4], 0x4662f8
call fcn.00419c20
mov dword [ebp - 0x34], 0x45d7f8
mov dword [ebp - 0x30], 0x4663e8
mov dword [ebp - 0x2c], ebp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x2c], 0x43ee33
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x50]
call fcn.0045e461
call fcn.00448cdc
mov ecx, dword [ebp - 0x13c0]
cmp ecx, 0x10
jb 0x43ed9f
mov eax, dword [ebp - 0x13d4]
inc ecx
cmp ecx, 0x1000
jb 0x43ed97
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.004406b8
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x48], 0xffffffff
call fcn.00448cdc
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x13d4], eax
mov ecx, 2
nop
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [ecx + eax - 1]
mov dword [ebp + ecx*4 - 0x13d8], eax
inc ecx
cmp ecx, 0x271
jne 0x43edc4
mov dword [ebp - 0x13d8], 0x270
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x48], 0xffffffff
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
lea eax, [ebp - 0x13d8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.0043f4c4
mov esi, eax
lea eax, [ebp - 0x50]
mov dword [esp], eax
call fcn.0045e482
mov eax, esi
add esp, 0x13dc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446b4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov al, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov byte [ebp - 5], al
mov al, byte [edx]
mov bl, al
xor bl, byte [ebp + 0xc]
lock cmpxchg byte [edx], bl
jne 0x446b61
mov byte [ebp + 0xc], al
mov al, byte [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
movzx eax, al
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x4470dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov ax, word [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov word [ebp - 6], ax
mov ax, word [edx]
mov bx, ax
xor bx, word [ebp + 0xc]
lock cmpxchg word [edx], bx
jne 0x4470f4
mov word [ebp + 0xc], ax
mov ax, word [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov word [ebp - 0xe], ax
mov ax, word [ebp - 0xe]
movzx eax, ax
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x44763c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [edx]
mov ebx, eax
xor ebx, dword [ebp + 0xc]
lock cmpxchg dword [edx], ebx
jne 0x447651
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x4488fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
mov edi, dword [ebp - 0x1c]
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov ecx, edx
mov ebx, eax
xor ebx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0x14]
lock cmpxchg8b qword [edi]
jne 0x448925
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x449a14
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
test edi, edi
je 0x449b46
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x449b46
cmp dword [esp + 0x28], 0
je 0x449b46
mov dword [esp], str.borlndmm
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
mov esi, eax
test esi, esi
je 0x449b46
mov ebp, dword [esp + 0x2c]
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysGetMem_qqri
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [edi], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysFreeMem_qqrpv
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [ebx], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysReallocMem_qqrpvi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysAllocMem_qqri
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [ebp], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysRegisterExpectedMemoryLeak_qqrpi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov dword [esp], esi
mov esi, dword [esp + 0x34]
mov dword [esp + 4], str._Borlndmm_SysUnregisterExpectedMemoryLeak_qqrpi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [esi], eax
mov eax, dword [edi]
mov dword [0x47fc48], eax
cmp dword [ebp], 0
jne 0x449afa
mov dword [ebp], 0x4499e4
mov eax, dword [esp + 0x30]
cmp dword [eax], 0
jne 0x449b09
mov dword [eax], 0x4499d4
mov ecx, dword [esi]
test ecx, ecx
je 0x449b36
cmp dword [edi], 0
je 0x449b46
cmp dword [ebx], 0
je 0x449b46
mov esi, dword [esp + 0x28]
cmp dword [esi], 0
je 0x449b46
cmp dword [ebp], 0
je 0x449b46
cmp dword [eax], 0
je 0x449b46
xor eax, eax
test ecx, ecx
setne al
jmp 0x449b48
mov dword [esi], 0x4499d4
mov ecx, 0x4499d4
cmp dword [edi], 0
jne 0x449b14
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret