joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e0258ea
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push edi
call fcn.1e0257c3
xor esi, esi
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x1e025913
mov ecx, dword [ebp + 8]
lea edi, [edi + ecx*2]
cmp word [edi], si
jne 0x1e02591f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1e025983
push ebx
push edi
push eax
call fcn.1e0256ae
mov ebx, eax
cmp ebx, esi
jne 0x1e025932
xor eax, eax
inc eax
jmp 0x1e025982
push esi
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push ebx
mov dword [ebp + 8], eax
call fcn.1e0258d3
cmp dword [ebp + 8], esi
je 0x1e02595d
push dword [ebp + 8]
jmp 0x1e02597a
cmp dword [ebp - 4], esi
jne 0x1e025978
cmp dword [ebp - 8], esi
jne 0x1e025978
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, esi
je 0x1e02592d
push eax
jmp 0x1e02597a
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x1e02605f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebx, ebx
jmp 0x1e026094
push edi
call fcn.1e02577b
push edi
mov dword [esi], eax
call fcn.1e025799
push ebx
inc dword [esi + 8]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
mov dword [esi + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1e0260aa
mov eax, dword [esi + 8]
mov edi, dword [eax*4 + 0x1e02a308]
cmp edi, ebx
jge 0x1e02606a
xor eax, eax
pop edi
pop esi
pop ebx
ret 4
xor eax, eax
inc eax
jmp 0x1e0260a4

Function at 0x1e026323
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x1e026334
push eax
jmp 0x1e02638b
mov ecx, dword [esi + 0x10]
dec eax
cmp dword [ebp + 0xc], 0
mov dword [esi + 0x34], eax
mov dword [ebp + 8], ecx
je 0x1e02634f
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esi + 0x18]
jmp 0x1e026351
xor ecx, ecx
mov edx, dword [ebp + 0xc]
push ebx
neg edx
sbb edx, edx
lea ebx, [esi + 0x1c]
and edx, ebx
push edx
push ecx
lea ecx, [esi + 0x14]
push ecx
push 0
lea ecx, [ebp + 8]
push ecx
push dword [esi + 0xc]
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
pop ebx
je 0x1e026395
mov ecx, eax
sub ecx, 0x103
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1e0263ab
and dword [esi + 0x3c], 0xfffffffb
cmp dword [ebp + 0xc], 0
mov eax, dword [esi + 0x3c]
je 0x1e0263a8
and eax, 0xfffffff7
mov dword [esi + 0x3c], eax
xor eax, eax
inc eax
pop esi
pop ebp
ret 8
Function at 0x1e0263c7
Capabilities:
Query or enumerate registry key

Disassembly:
push esi
mov esi, dword [esp + 8]
inc dword [esi + 0x30]
push dword [esi + 0x2c]
mov eax, dword [esi + 0x30]
push dword [esi + 0x28]
dec eax
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x1e026421
cmp eax, 0xea
jne 0x1e02642d
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1e026404
push eax
push dword [0x1e02f464]
call fcn.1e01b736
mov eax, dword [esi + 0x2c]
shl eax, 1
mov dword [esi + 0x2c], eax
push 0
add eax, eax
push eax
push dword [0x1e02f464]
call fcn.1e01b681
mov dword [esi + 0x28], eax
jmp 0x1e0263cf
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1e026436
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
pop esi
ret 4
Function at 0x42f580
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1d000]
push edi
or ebp, 0xffffffff
jmp 0x42f5a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42f5a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42f598
mov eax, 1
add ebx, ebx
jne 0x42f5bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42f5b0
jne 0x42f5cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42f5b0
xor ecx, ecx
sub eax, 3
jb 0x42f5e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42f652
mov ebp, eax
add ebx, ebx
jne 0x42f5eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42f5f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42f61c
inc ecx
add ebx, ebx
jne 0x42f608
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42f5fd
jne 0x42f619
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42f5fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42f63c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42f62d
jmp 0x42f59e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42f63c
add edi, ecx
jmp 0x42f59e
pop esi
mov edi, esi
mov ecx, 0x867
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42f65a
cmp byte [edi], 9
jne 0x42f65a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42f65f
lea edi, [esi + 0x2d000]
mov eax, dword [edi]
or eax, eax
je 0x42f6ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2f068]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2f0b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42f68c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2f0bc]
or eax, eax
je 0x42f6c8
mov dword [ebx], eax
add ebx, 4
jmp 0x42f6a9
call dword [esi + 0x2f0c0]
popal
jmp section.UPX0
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..data]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x4260f8
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0042617b
jae 0x426106
xor ecx, ecx
call fcn.0042617b
jae 0x426135
xor eax, eax
call fcn.0042617b
jae 0x426145
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0042617b
adc al, al
jae 0x426127
jne 0x426171
stosb byte es:[edi], al
jmp 0x426109
call fcn.00426187
sub ecx, ebx
jne 0x42614e
call fcn.00426185
jmp 0x42616d
lodsb al, byte [esi]
shr eax, 1
je 0x426197
adc ecx, ecx
jmp 0x42616a
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00426185
cmp eax, 0x7d00
jae 0x42616a
cmp ah, 5
jae 0x42616b
cmp eax, 0x7f
ja 0x42616c
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x426109
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x401790
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x401880
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x401880
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4017da
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x4017e1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4017c0
jmp 0x4017e3
mov esi, 0x1505
jmp 0x4017e3
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x401880
mov eax, edi
xor eax, 1
mov ebx, edi
and ebx, 0xfffffffe
add ebx, ebx
sub ebx, eax
and ebx, esi
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401824
inc ebx
dec edi
je 0x40187e
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40187e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x401820
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.004084c0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x401820
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.004084e0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x401820
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x401880
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401cf0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x401e53
mov esi, dword [esp + 0x28]
test esi, esi
je 0x401e53
cmp dword [esp + 0x2c], 0
je 0x401e53
push esi
call fcn.004084c0
add esp, 4
test eax, eax
je 0x401d5a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x401d61
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x401d40
jmp 0x401d63
mov ebx, 0x1505
jmp 0x401d63
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x401df5
mov dword [esp], eax
mov eax, edi
xor eax, 1
mov esi, edi
and esi, 0xfffffffe
add esi, esi
sub esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401da4
inc esi
dec edi
je 0x401df5
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x401dfa
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x401da0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.004084c0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401da0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.004084e0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401da0
mov eax, 0xffffffff
jmp 0x401e53
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jae 0x401e3f
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
jmp 0x401e53
call fcn.00401f10
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
je 0x401e5b
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push ecx
call fcn.004084c0
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x401efe
mov eax, edi
xor eax, 1
mov esi, edi
and esi, 0xfffffffe
add esi, esi
sub esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401ea4
inc esi
dec edi
je 0x401efe
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x401e02
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x401ea0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.004084c0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401ea0
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.004084e0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401ea0
jmp 0x401e02
mov ebp, 0xffffffff
jmp 0x401e02
Function at 0x402650
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402806
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4027ff
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x4026e5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x4027ff
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x402765
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
mov esi, edi
and esi, eax
xor edi, eax
lea eax, [edi + esi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x402700
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x4026ad
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x4027b0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x402790
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4026a0
jmp 0x4027bf
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4026a0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x4027d0
jmp 0x4026a0
shl ecx, 0x10
or ecx, edi
jmp 0x40280b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402820
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x402878
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x40287a
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44280c]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
or ebp, edi
and edi, ebx
sub ebp, edi
xor eax, dword [ebp*4 + 0x44280c]
inc esi
cmp edx, esi
jne 0x402840
not eax
jmp 0x40287a
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, ecx
not edx
mov edi, edx
or edi, 0xfffffffc
lea ebp, [edi + ecx]
inc ebp
or edx, 3
lea ebx, [edx + ecx]
inc ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, eax
add edx, ebp
add esi, ebp
mov ecx, ebx
shr ecx, 1
mov ebp, esi
mov edi, edx
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
mov edi, ebx
xor edi, 0xfffffffe
mov ebp, ebx
or ebp, 1
and ebp, edi
je 0x40833d
and ebx, 0xfffffffe
add esi, ebx
add edx, ebx
mov edi, ebp
and edi, 7
je 0x4082db
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + ebx]
mov byte [edx + ebx], cl
inc ebx
cmp edi, ebx
jne 0x4082c0
add esi, ebx
add edx, ebx
mov edi, ebp
sub edi, ebx
cmp ebp, 8
jae 0x4082e2
jmp 0x40833d
mov edi, ebp
cmp ebp, 8
jb 0x40833d
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi + ecx]
mov byte [edx + ecx], bl
movzx ebx, byte [esi + ecx + 1]
mov byte [edx + ecx + 1], bl
movzx ebx, byte [esi + ecx + 2]
mov byte [edx + ecx + 2], bl
movzx ebx, byte [esi + ecx + 3]
mov byte [edx + ecx + 3], bl
movzx ebx, byte [esi + ecx + 4]
mov byte [edx + ecx + 4], bl
movzx ebx, byte [esi + ecx + 5]
mov byte [edx + ecx + 5], bl
movzx ebx, byte [esi + ecx + 6]
mov byte [edx + ecx + 6], bl
movzx ebx, byte [esi + ecx + 7]
mov byte [edx + ecx + 7], bl
add ecx, 8
cmp edi, ecx
jne 0x4082f0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408a40
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, dword [esp + 8]
mov dword [0x44a74c], edx
mov eax, 0xfffffd92
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x93f8769a
mov esi, ecx
and esi, 0x6c078965
or ecx, 0x6c078965
imul ecx, esi
xor esi, 0x6c078965
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x26f
mov dword [eax*4 + 0x44b108], edx
test eax, eax
je 0x408acf
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x93f8769a
mov esi, ecx
and esi, 0x6c078965
or ecx, 0x6c078965
imul ecx, esi
xor esi, 0x6c078965
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x270
mov dword [eax*4 + 0x44b10c], edx
add eax, 2
jmp 0x408a50
mov dword [0x44a748], 0x270
pop esi
ret

Function at 0x408ae0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov eax, dword [0x44a748]
cmp eax, 0x270
jne 0x408b3f
mov eax, 0xfffff640
mov esi, dword [0x44a74c]
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edx, dword [eax + 0x44b110]
mov ecx, edx
and ecx, 0x7ffffffe
or ecx, esi
shr ecx, 1
mov esi, edx
and edx, 1
neg edx
xor ecx, dword [eax + 0x44b740]
and edx, 0x9908b0df
xor ecx, edx
mov dword [eax + 0x44bacc], ecx
add eax, 4
jne 0x408b00
mov eax, 0x270
jmp 0x408b55
cmp eax, 0x4e0
jb 0x408b55
mov ecx, 0x44a748
call fcn.00408df0
mov eax, dword [0x44a748]
lea ecx, [eax + 1]
mov dword [0x44a748], ecx
mov eax, dword [eax*4 + 0x44a74c]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [0x44bacc]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc40000
xor ecx, eax
shr ecx, 0x12
and eax, 0x7fff
xor eax, ecx
pop esi
ret
Function at 0x408df0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 - 0x630]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4]
xor edi, edx
mov dword [ecx + eax*4 - 0xff4], edi
inc eax
cmp eax, 0x4e1
jne 0x408e00
mov ebx, dword [ecx + 0xd50]
mov eax, 0xe4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea esi, [eax - 1]
and ebx, 0x80000000
mov edx, dword [ecx + eax*4 + 0x9c4]
mov ebp, edx
and ebp, 0x7ffffffe
or ebp, ebx
shr ebp, 1
mov edi, edx
and edi, 1
neg edi
and edi, 0x9908b0df
mov ebx, edi
and ebx, ebp
add edi, ebp
add ebx, ebx
sub edi, ebx
mov ebx, esi
or ebx, 0x3ffffd8f
and esi, 0x18f
add esi, ebx
xor edi, dword [ecx + esi*4 + 0x63c]
mov ebx, edx
mov dword [ecx + eax*4], edi
inc eax
cmp eax, 0x270
jne 0x408e50
mov edx, SysReAllocString
and edx, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov esi, eax
and esi, 0x7ffffffe
or esi, edx
shr esi, 1
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, esi
mov edx, dword [ecx + 0x634]
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x228
mov ebp, dword [0x44bb28]
mov dword [esp + 0x1a8], 0x61669f64
mov byte [esp + 0x1ac], 0
lea ecx, [esp + 0x1a8]
mov edx, 0x2cb91e66
nop
movzx edi, byte [ecx]
mov esi, edx
or esi, edi
lea ebx, [edx - 0x2cb91e00]
and ebx, edi
not esi
or esi, ebx
mov edi, esi
and edi, 2
mov ebx, esi
xor ebx, 2
lea ebx, [ebx + edi*2]
and esi, 1
or ebx, 1
add ebx, esi
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x2cb91e61
jne 0x409fa0
mov ecx, dword [esp + 0x1a8]
mov dword [esp + 0x18], 0xf19b0f95
mov dword [esp + 0x1c], 0xf553f322
mov dword [esp + 0x20], 0xf924f721
mov dword [esp + 0x24], 0xfd5efb16
mov dword [esp + 0x28], 0xe152ff50
mov word [esp + 0x2c], 0xe3e0
mov dword [esp + 0x2e], 0
mov byte [esp + 0x32], 0
mov edx, 0x9c2348fd
nop
nop
nop
nop
movzx eax, byte [esp + edx + 0x63dcb71b]
mov ebx, eax
and ebx, edx
add bl, bl
sub al, bl
movzx eax, al
add eax, edx
add al, 0xf
mov byte [esp + edx + 0x63dcb71b], al
inc edx
cmp edx, 0x9c234918
jne 0x40a020
lea esi, [esp + 0x18]
push ecx
push 0
push esi
call ebp
mov ecx, 0x44bb2c
push eax
call fcn.0043c1b0
movzx eax, al
mov eax, dword [eax*4 + 0x44588c]
mov ecx, 0x735765aa
xor ecx, dword [0x445894]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx

Function at 0x40b0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
xor edx, edx
mov ecx, dword [0x44bb04]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx], 0
lea edx, [edx + 2]
jne case.default.0x40b176
lea edi, [eax + edx]
add edi, 0xfffffffe
add edx, eax
mov ebx, 1
sub ebx, edx
and ebx, eax
mov edx, eax
not edx
and edx, edi
sub edx, ebx
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x445acc]
xor eax, eax
jmp 0x40b601
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret