joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458c20
Capabilities:
Set environment variable

Disassembly:
sub esp, 4
cmp dword [esp + 8], 0
push ebx
push esi
push edi
push ebp
je 0x458e5e
mov edx, dword [esp + 0x18]
push 0x3d
push edx
call fcn.0045a570
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x458e5e
cmp ebp, dword [esp + 0x18]
je 0x458e5e
cmp byte [ebp + 1], 1
sbb eax, eax
mov ecx, dword [0x46e7b0]
neg eax
mov dword [esp + 0x10], eax
cmp dword [0x46e7b4], ecx
jne 0x458c7d
push ecx
call fcn.00458ed0
add esp, 4
mov dword [0x46e7b0], eax
cmp dword [0x46e7b0], 0
jne 0x458d2d
cmp dword [esp + 0x1c], 0
je 0x458cb4
cmp dword [0x46e7b8], 0
je 0x458cb4
call fcn.00456090
test eax, eax
je 0x458d2d
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [esp + 0x10], 0
je 0x458cc5
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x46e7b0], 0
jne 0x458cf9
push 4
call fcn.00450550
add esp, 4
mov dword [0x46e7b0], eax
test eax, eax
jne 0x458cee
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [0x46e7b0]
mov dword [eax], 0
cmp dword [0x46e7b8], 0
jne 0x458d2d
push 4
call fcn.00450550
add esp, 4
mov dword [0x46e7b8], eax
test eax, eax
jne 0x458d22
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [0x46e7b8]
mov dword [eax], 0
mov esi, dword [0x46e7b0]
sub ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
push ebp
push edx
call fcn.00458e70
add esp, 8
mov edi, eax
test edi, edi
jl 0x458d95
cmp dword [esi], 0
je 0x458d95
cmp dword [esp + 0x10], 0
je 0x458d8c
lea ebx, [esi + edi*4]
mov eax, dword [ebx]
push eax
call fcn.00450530
add esp, 4
cmp dword [ebx], 0
je 0x458d79
mov eax, dword [ebx + 4]
add ebx, 4
inc edi
mov dword [ebx - 4], eax
cmp dword [ebx], 0
jne 0x458d6a
shl edi, 2
push edi
push esi
call fcn.00451b10
add esp, 8
test eax, eax
je 0x458ddd
jmp 0x458dd8
mov edx, dword [esp + 0x18]
mov dword [esi + edi*4], edx
jmp 0x458ddd
cmp dword [esp + 0x10], 0
jne 0x458e54
test edi, edi
jge 0x458da6
neg edi
lea eax, [edi*4 + 8]
push eax
push esi
call fcn.00451b10
add esp, 8
test eax, eax
jne 0x458dc8
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
lea ecx, [eax + edi*4]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov dword [ecx + 4], 0
mov dword [0x46e7b0], eax
cmp dword [esp + 0x1c], 0
je 0x458e4a
mov edi, dword [esp + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.00450550
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x458e4a
mov edi, dword [esp + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 1
sbb eax, eax
lea ecx, [ebp + ebx]
mov byte [ecx], 0
lea ecx, [ecx + 1]
and eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.00450530
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x45a430
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1008
call fcn.0045aba0
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [esp + 0x1018]
push ebp
push 1
push ebx
push esi
call fcn.00453000
mov dword [esp + 0x1c], eax
add esp, 0xc
cmp eax, 0xffffffff
je 0x45a552
push 2
push ebx
push esi
call fcn.00453000
add esp, 0xc
cmp eax, 0xffffffff
je 0x45a552
mov ecx, dword [esp + 0x1020]
mov ebp, ecx
sub ebp, eax
test ebp, ebp
jle 0x45a4f3
lea edi, [esp + 0x18]
xor eax, eax
mov ecx, 0x400
push 0x8000
rep stosd dword es:[edi], eax
push esi
call fcn.0045ab30
mov dword [esp + 0x1c], eax
add esp, 8
mov eax, 0x1000
cmp ebp, eax
jge 0x45a4ae
mov eax, ebp
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.00453390
add esp, 0xc
mov edi, eax
cmp edi, 0xffffffff
je 0x45a4cc
sub ebp, edi
test ebp, ebp
jg 0x45a4a3
jmp 0x45a4e3
call fcn.00453300
cmp dword [eax], 5
jne 0x45a4e1
call fcn.004532f0
mov dword [eax], 0xd
mov ebx, edi
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.0045ab30
add esp, 8
jmp 0x45a535
jge 0x45a535
push 0
push ecx
push esi
call fcn.00453000
add esp, 0xc
push esi
call fcn.00457280
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sbb ebx, ebx
cmp ebx, 0xffffffff
jne 0x45a535
call fcn.004532f0
mov dword [eax], 0xd
call fcn.00453300
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push esi
call fcn.00453000
add esp, 0xc
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1008
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1008
ret

Function at 0x45ae00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x45ae25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00453270
add esp, 4
mov eax, 0xffffffff
ret
test al, 1
je 0x45ae4c
test byte [esp + 8], 2
je 0x45ae4c
call fcn.004532f0
mov dword [eax], 0xd
call fcn.00453300
mov dword [eax], 5
mov eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x43b645
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
mov edi, dword [esp]
add esp, 4
dec eax
add eax, esi
sub esi, esi
call fcn.0043b67f
sub esi, 0x6fb9b1e6
xor dword [ecx], edi
sub esi, eax
dec eax
dec esi
inc ecx
mov esi, 0xc53096cf
and eax, eax
cmp ecx, ebx
jne fcn.0043b645
and eax, eax
ret
Function at 0x401790
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x401880
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x401880
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4017da
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x4017e1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4017c0
jmp 0x4017e3
mov esi, 0x1505
jmp 0x4017e3
mov esi, ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov dword [esp + 8], edx
sub edx, 1
mov dword [esp + 0xc], edx
jb 0x401880
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
xor edi, edi
mov edx, ebx
mov dword [esp], ebx
jmp 0x401821
mov eax, edi
and eax, 1
xor edi, 1
lea edi, [edi + eax*2]
cmp edi, dword [esp + 8]
jae 0x40187e
lea eax, [edi + edx]
and eax, dword [esp + 0xc]
mov ebx, dword [esp + 4]
mov ebp, dword [ebx + eax*4]
cmp ebp, 0xffffffff
je 0x40187e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x401810
mov eax, dword [ecx + 0xc]
mov ebx, dword [eax + ebp*4]
push ebx
call fcn.00408490
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x401810
push dword [esp + 0x2c]
push ebx
push dword [esp + 0x30]
call fcn.004084b0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401810
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x401880
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402620
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x402747
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x402740
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
nop
xor eax, eax
cmp ebx, 8
mov dword [esp], ebx
jb 0x402704
mov dword [esp + 4], esi
mov eax, ebx
and eax, 0x1ff8
xor ebx, ebx
nop
nop
nop
nop
nop
mov edx, ebx
movzx ebx, byte [ebp + ebx]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 1]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 2]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 3]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 4]
add ebx, edi
mov edi, ecx
and edi, ebx
xor ecx, ebx
movzx esi, byte [ebp + edx + 5]
add esi, ebx
add ecx, esi
movzx ebx, byte [ebp + edx + 6]
add ebx, esi
add ecx, ebx
lea ecx, [ecx + edi*2]
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add ecx, edi
lea ebx, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
jb 0x402680
add ebp, ebx
mov esi, dword [esp + 4]
mov ebx, dword [esp]
jmp 0x402704
mov edx, eax
xor edx, 1
and eax, 1
lea eax, [edx + eax*2]
movzx edx, byte [ebp]
add edi, edx
add ecx, edi
inc ebp
cmp eax, ebx
jb 0x4026f0
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov ebx, 0x15b0
jne 0x402660
shl ecx, 0x10
or ecx, edi
jmp 0x40274c
mov ecx, 1
mov eax, ecx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402760
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4027bd
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x4027bf
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
and eax, 0xf
mov ebp, edi
and ebp, 0xf
add ebp, eax
and eax, edi
add eax, eax
sub ebp, eax
xor ebx, dword [ebp*4 + 0x44280c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44280c]
inc esi
cmp edx, esi
jne 0x402780
not eax
jmp 0x4027bf
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4081e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40824c
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40822e
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x408230
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 2
mov ebp, ebx
or ebx, 2
imul ebx, edx
xor edx, 2
and ebp, 0xfffffffd
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x408210
jmp 0x408230
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40824a
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40824c
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4089e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x44a734], eax
mov ecx, 1
nop
nop
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [ecx*4 + 0x44a734], eax
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x270
jb 0x4089f0
mov dword [0x44a730], 0x270
ret
Function at 0x408a40
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x21c
call fcn.0043d0a0
test al, al
je 0x408c5f
lea eax, [esp + 0x14]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.004366c0
test al, al
je 0x408c5a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 0x33c3c330
mov esi, 0x20ce3d72
mov ecx, ebx
shrd esi, edx, cl
shr edx, cl
mov edi, 0x67878660
mov ebp, 0x419c7ae4
shrd ebp, edi, cl
mov dword [esp + 8], eax
shr edi, cl
test bl, 0x20
je 0x408ab4
mov esi, edx
xor edx, edx
mov ebp, edi
xor edi, edi
and ebp, 0x419c7ae4
and edi, 0x67878660
sub esi, ebp
sbb edx, edi
mov eax, esi
add eax, 0x20ce3d72
mov edi, eax
mov eax, edx
adc eax, 0x33c3c330
mov dword [esp + 0x10], eax
mov ebp, 0xdf31c28d
sub ebp, esi
mov ebx, 0xcc3c3ccf
sbb ebx, edx
and ebp, 0xeaaa7d5a
mov ecx, edi
and ecx, 0x155582a5
mov dword [esp + 0xc], ecx
mov eax, ecx
mul ebp
mov dword [esp + 4], eax
and ebx, 0x8f930ada
imul ecx, ebx
add ecx, edx
mov edx, dword [esp + 0x10]
mov esi, edx
and esi, 0x706cf525
mov eax, esi
imul eax, ebp
add eax, ecx
mov dword [esp], eax
xor ebx, 0x8f930ada
xor ebp, 0xeaaa7d5a
mov ecx, edx
mov eax, edx
xor ecx, 0x8f930ada
mov edx, edi
xor edi, 0xeaaa7d5a
add edi, edx
adc ecx, eax
sub edi, dword [esp + 0xc]
sbb ecx, esi
imul ecx, ebp
mov eax, edi
mul ebp
imul ebx, edi
add edx, ebx
add edx, ecx
add eax, dword [esp + 4]
adc edx, dword [esp]
mov ebx, edx
shld ebx, eax, 0xb
mov ebp, edx
shr ebp, 0x15
mov ecx, ebp
and ecx, edx
mov esi, ebx
and esi, eax
add ebx, eax
adc ebp, edx
shld ecx, esi, 1
add esi, esi
sub ebx, esi
sbb ebp, ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408c0d
mov edi, ebx
or edi, 0x36b904ac
mov ecx, ebp
mov esi, ebx
and esi, 0x36b904ac
mov eax, edi
mul esi
mov dword [esp + 4], eax
and ecx, 0x94977328
mov dword [esp], ecx
imul edi, ecx
add edi, edx
mov ecx, ebp
or ecx, 0x94977328
imul ecx, esi
add ecx, edi
xor esi, 0x36b904ac
and ebx, 0xc946fb53
and ebp, 0x6b688cd7
mov eax, esi
mul ebx
imul ebp, esi
add edx, ebp
mov esi, dword [esp]
xor esi, 0x94977328
imul ebx, esi
add ebx, edx
add eax, dword [esp + 4]
adc ebx, ecx
mov edx, eax
mov ecx, dword [esp + 8]
shrd edx, ebx, cl
mov ebp, ebx
shr ebp, cl
test cl, 0x20
je 0x408c07
mov edx, ebp
xor ebp, ebp
xor ebp, ebx
xor edx, eax
mov ebx, edx
mov eax, ebx
not eax
mov ecx, ebp
not ecx
and ecx, 0xfefefefe
and eax, 0xfefefefe
shld ebp, ebx, 1
not ebp
add ebx, ebx
and ebx, 0xfdfdfdfc
mov edx, 0xfdfdfdfc
or edx, 1
xor edx, ebx
and ebp, 0xfdfdfdfd
sub eax, edx
sbb ecx, ebp
push ecx
push eax
call fcn.00409e30
add esp, 8
test al, al
je 0x408c5a
call fcn.0040cbb0
call fcn.0040b9d0
call fcn.0043e330
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408c70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408ce9
xor eax, eax
mov edx, 0x4e0
mov esi, SysReAllocString
nop
nop
nop
nop
nop
nop
nop
mov ebx, dword [ecx + eax*4 + 4]
and ebx, esi
mov edi, edx
and edi, 2
mov ebp, eax
xor ebp, 1
add ebp, edi
mov edi, dword [ecx + ebp*4 + 4]
mov ebp, edi
and ebp, 0x7ffffffe
or ebp, ebx
shr ebp, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, ebp
mov ebx, dword [ecx + eax*4 + 0x638]
mov ebp, edi
and ebp, ebx
add edi, ebx
add ebp, ebp
sub edi, ebp
mov dword [ecx + eax*4 + 0x9c4], edi
inc eax
add edx, 2
cmp eax, 0x270
jne 0x408c90
mov eax, 0x270
jmp 0x408cfb
cmp eax, 0x4e0
jb 0x408cfb
mov esi, ecx
call fcn.00408d40
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov edx, ecx
shr edx, 0x12
xor eax, ecx
not eax
and eax, edx
xor eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x408d40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
lea esi, [eax + 0x270]
mov edx, ebx
xor edx, 0x7fffffff
or ebx, 0x80000000
and ebx, edx
mov edx, dword [ecx + eax*4 + 0x9c8]
mov edi, edx
and edi, 0x7fffffff
or edi, ebx
mov ebx, edi
shr ebx, 1
and edi, 1
neg edi
and edi, 0x9908b0df
mov ebp, edi
and ebp, ebx
add edi, ebx
add ebp, ebp
sub edi, ebp
mov ebx, esi
and ebx, 0x18d
xor esi, 0x18d
lea esi, [esi + ebx*2]
xor edi, dword [ecx + esi*4 + 4]
mov dword [ecx + eax*4 + 4], edi
inc eax
mov ebx, edx
cmp eax, 0xe3
jne 0x408d50
mov edx, dword [ecx + 0xd50]
xor eax, eax
jmp 0x408dd7
shr esi, 1
xor esi, dword [ecx + eax*4 + 4]
xor esi, edi
mov dword [ecx + eax*4 + 0x390], esi
inc eax
cmp eax, 0x18c
je 0x408e0a
mov edi, edx
and edi, 0x80000000
mov edx, dword [ecx + eax*4 + 0xd54]
mov esi, edx
not esi
or esi, 0x7fffffff
add esi, edx
inc esi
or esi, edi
mov ebx, esi
xor ebx, 0xfffffffe
mov edi, esi
or edi, 1
and edi, ebx
je 0x408dc0
mov edi, 0x9908b0df
jmp 0x408dc0
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409e30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x22c
mov eax, dword [0x44bb10]
mov dword [esp + 0x1ac], 0x696a6364
mov word [esp + 0x1b0], 0
mov byte [esp + 0x1b2], 0
xor ecx, ecx
nop
nop
movzx esi, byte [esp + ecx + 0x1ac]
lea edi, [ecx + 0x67]
mov edx, 0x98
sub edx, ecx
xor edx, edi
and edx, esi
xor edx, edi
add dl, 0xfd
mov byte [esp + ecx + 0x1ac], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 7
jb 0x409e60
mov ecx, dword [esp + 0x1ac]
mov dword [esp + 0x1c], 0x97199913
mov dword [esp + 0x20], 0x933195da
mov dword [esp + 0x24], 0x8fc091df
mov dword [esp + 0x28], 0x8b168dde
mov dword [esp + 0x2c], 0x8712891c
mov word [esp + 0x30], 0x8584
mov dword [esp + 0x32], 0
mov word [esp + 0x36], 0
mov edx, 0x50cb1567
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x50cb154b]
lea edi, [edx - 0x50cb14c1]
and edi, esi
add edi, edi
sub esi, edi
add esi, edx
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
mov byte [esp + edx - 0x50cb154b], bl
inc edx
cmp edx, 0x50cb1583
jne 0x409ee0
lea esi, [esp + 0x1c]
push ecx
push 0
push esi
call eax
mov ecx, 0x44bb14
push eax
call fcn.0043d010
movzx eax, al
mov eax, dword [eax*4 + 0x44596c]
mov ecx, 0xa051f9a
xor ecx, dword [0x445974]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x40aaf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40ad57
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40ab2c
cmp edx, esi
jae 0x40ad57
test edi, edi
je 0x40ad57
movzx ebp, bl
test bl, bl
js 0x40ab60
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40ab20
jmp 0x40ad57
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40ab98
cmp bl, 0xc2
jb 0x40ab50
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40ac02
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40ac61
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40abc2
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40ac0c
cmp ebp, 0xe0
jne 0x40ac15
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40ab4c
jmp 0x40ac15
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40ad32
cmp bl, 0xf4
ja 0x40ab50
movzx ecx, byte [edx + 1]
je 0x40ac6c
cmp ebp, 0xf0
jne 0x40ac75
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40ab4c
jmp 0x40ac75
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40ab52
cmp cl, 0x9f
ja 0x40ab4c
mov esi, ecx
xor esi, 0xffffff3f
mov ebx, ecx
or ebx, 0xc0
and ebx, esi
cmp ebx, 0x80
jne 0x40ad39
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ad3f
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40ab42
cmp cl, 0x8f
ja 0x40ab4c
mov esi, ecx
not esi
or esi, 0xc0
add esi, ecx
cmp esi, 0x7f
jne 0x40ad39
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ad3f
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ad4b
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40ab4c
mov esi, dword [esp]
and esi, 0x3f
or esi, ebp
cmp esi, 0x10000
jb 0x40ab4c
cmp edi, 2
jb 0x40ad32
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x40ab42
mov ecx, eax
jmp 0x40ab42
inc edx
jmp 0x40ab4c
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40ab52
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40ab52
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ba00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [esp + 0x3c], 0x97b0b5f
mov dword [esp + 0x40], 0x571078e
mov dword [esp + 0x44], 0x1760370
mov dword [esp + 0x48], 0x1d2f1f7f
mov dword [esp + 0x4c], 0x19281b57
mov dword [esp + 0x50], 0x15361728
mov dword [esp + 0x54], 0x117b132c
mov dword [esp + 0x58], 0x2d5c2f67
mov dword [esp + 0x5c], 0x295b2b50
mov dword [esp + 0x60], 0x25ab27a1
mov dword [esp + 0x64], 0x21702304
mov dword [esp + 0x68], 0x3d1e3f4c
mov dword [esp + 0x6c], 0x390a3b73
mov dword [esp + 0x70], 0x3506370a
mov dword [esp + 0x74], 0x31123371
mov dword [esp + 0x78], 0x4d394f59
mov dword [esp + 0x7c], 0x49004b3e
mov dword [esp + 0x80], 0x45034704
mov dword [esp + 0x84], 0x41ca4364
mov dword [esp + 0x88], 0x5d125f0a
mov dword [esp + 0x8c], 0x597a5b6b
mov dword [esp + 0x90], 0x55265707
mov dword [esp + 0x94], 0x51265324
mov dword [esp + 0x98], 0x6d076f2b
mov dword [esp + 0x9c], 0x69146b17
mov dword [esp + 0xa0], 0x6511673d
mov dword [esp + 0xa4], 0x615363e8
mov dword [esp + 0xa8], 0x7d337f2b
mov dword [esp + 0xac], 0x79487b35
mov dword [esp + 0xb0], 0x753c7735
mov dword [esp + 0xb4], 0x714a7354
mov dword [esp + 0xb8], 0x8dd68f25
mov dword [esp + 0xbc], 0x89d98be0
mov dword [esp + 0xc0], 0x85b287dc
mov dword [esp + 0xc4], 0x81f683a4
mov dword [esp + 0xc8], 0x9deb9ff7
mov dword [esp + 0xcc], 0x99ba9be7
mov dword [esp + 0xd0], 0x95ed97c1
mov dword [esp + 0xd4], 0x91e793e9
mov dword [esp + 0xd8], 0xad99afe1
mov dword [esp + 0xdc], 0xa9f7ab8c
mov dword [esp + 0xe0], 0xa528a7d0
mov dword [esp + 0xe4], 0xa1d1a3d5
mov dword [esp + 0xe8], 0xbd8fbfdb
mov dword [esp + 0xec], 0xb9f5bbf3
mov dword [esp + 0xf0], 0xb584b7ff
mov dword [esp + 0xf4], 0xb180b384
mov dword [esp + 0xf8], 0xcdfccf80
mov dword [esp + 0xfc], 0xc9eacbfc
mov dword [esp + 0x100], 0xc5b9c7a5
mov dword [esp + 0x104], 0xc1bdc3be
mov dword [esp + 0x108], 0xdda9df4e
mov dword [esp + 0x10c], 0xd991dbed
mov dword [esp + 0x110], 0xd59fd795
mov dword [esp + 0x114], 0xd19fd3e6
mov dword [esp + 0x118], 0xedeeef9a
mov eax, dword [0x44bae0]
mov ecx, 0xb6ce9b53
mov edx, 0x6d9d36a6
nop
nop
movzx edi, byte [esp + ecx + 0x493164e9]
mov ebx, edx
and ebx, 0x601c0806
mov ebp, ecx
xor ebp, 0x782e2403
add ebx, ebp
add ebx, 0x493164ad
xor ebx, edi
mov edi, ebx
xor edi, 0x10
and ebx, 0x6f
add ebx, ebx
sub ebx, edi
inc bl
mov byte [esp + ecx + 0x493164e9], bl
inc ecx
add edx, 2
cmp ecx, 0xb6ce9c33
jne 0x40bc50
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x445cf4]
mov ecx, 0x8b923d8f
xor ecx, dword [0x445cfc]
add ecx, edx
inc ecx
jmp ecx