joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
lds esp, [ecx - 0x2d]
ror ebp, 1
sahf
sub al, 0x2e
push cs
sahf
sub al, 0x2e
push cs
sahf
sub al, 0xed
push cs
sahf
sub al, 0x2e
push cs
sahf
sub al, 0x2e
push cs
sahf
sub al, 0x2e
push cs
sahf
sub al, 0xed
push cs
sahf
sub al, 0x2e
push cs
sahf
sub al, 0x2e
push cs
sahf
sub al, 0x2e
push cs
sahf
sub al, 0x8e
jle 0x414a21
insd dword es:[edi], dx
lodsb al, byte cs:[esi]
mov esi, 0x5d0e6f4c
sub al, 0x2e
push cs
sahf
sub al, 0x7b
xchg dword [ebx - 0x59], edi
imul eax, dword [esi], 0x15
imul esp, dword [edx], 0xae3ccb85
xor ebx, dword [esi + 0x7d]
outsd dx, dword [esi]
push cs
sahf
pop ecx
imul ecx, dword [ebp + 0x4c5c2d66], 0x7a2fc41d
xchg edx, eax
scasd eax, dword es:[edi]
invalid
jbe 0x414ac1
jmp 0xeeeaaca5
jnp 0x414a49
xchg dword [ebx - 0x16], edi
jnp 0x414aae
sub ebx, esi
iretd

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x17da7247
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x2fbc67ae
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x402068
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov ecx, 6
lea edx, [0x4032b6]
mov eax, 0
add eax, dword [edx]
add edx, 4
sub ecx, 1
jne 0x40207f
add eax, 5
add eax, 2
mov dword [0x4032fe], eax
push 0x100
push 0x403c98
push dword [0x403b68]
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 4]
push eax
push 0x403a38
push 0x100
push 0x403c98
call sub.kernel32.dll_GetFullPathNameA
mov esi, dword [ebp - 4]
lodsb al, byte [esi]
test al, al
jne 0x4020ce
mov al, 0x2e
mov byte [esi - 1], al
cmp al, 0x2e
jne 0x4020c4
mov dword [esi], 0x696e69
push 0x403a38
push 0x104
push 0x403c98
push str.Position
push str.Position
push str.Position
call sub.kernel32.dll_GetPrivateProfileStringA
cmp byte [0x403c98], 0x50
je 0x402155
mov edi, 0x403b3c
mov edx, 0x403c98
mov ecx, 0xb
call fcn.0040223c
stosd dword es:[edi], eax
loop 0x402113
push 0x403b3c
push dword [0x4038e0]
call sub.user32.dll_SetWindowPlacement
push 0x403c74
push dword [0x4038e0]
call sub.user32.dll_GetClientRect
mov eax, dword [0x4032fe]
mov edx, 0xb0
cmp dword [0x403c7c], eax
jb 0x402155
cmp dword [0x403c80], edx
jae 0x402172
push 2
push 0xdc
push 0x190
push 0
push 0
push 0
push dword [0x4038e0]
call sub.user32.dll_SetWindowPos
clc
popal
mov esp, ebp
pop ebp
ret
Function at 0x4028f0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x70
mov eax, dword [0x43b06c]
xor eax, esp
mov dword [esp + 0x6c], eax
lea eax, [esp]
mov dword [esp], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x40294e
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
shrd ecx, eax, 0x14
shr eax, 0x14
push eax
push ecx
push str._lld_MB
lea eax, [esp + 0x4c]
push 0x14
push eax
call fcn.004012a0
mov eax, dword [esp + 0x64]
add esp, 0x14
movups xmm0, xmmword [esp + 0x40]
mov dword [0x43d324], eax
jmp 0x402969
mov eax, dword [0x437094]
movups xmm0, xmmword [str.Cant_get_memory_info]
mov dword [0x43d324], eax
mov al, byte [0x437098]
mov byte [0x43d328], al
mov ecx, dword [esp + 0x6c]
xor eax, eax
xor ecx, esp
movups xmmword [0x43d314], xmm0
call fcn.0040efde
mov esp, ebp
pop ebp
ret
Function at 0x402990
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d56f
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13c8
call fcn.0040fda0
mov eax, dword [0x43b06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x13d0], esi
mov dword [ebp - 0x13c0], esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x13d8], esi
xorps xmm0, xmm0
mov dword [ebp - 0x13c4], 0
push 0x3e
push str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.0040ab40
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x13c4], 1
call fcn.0040e56f
mov edx, eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x13b4], edx
mov ecx, 1
nop dword [eax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [ebp + ecx*4 - 0x13b4], edx
inc ecx
cmp ecx, 0x270
jb 0x402a70
mov eax, dword [ebp - 0x20]
mov edi, 8
dec eax
mov dword [ebp - 0x13b8], 0x270
mov dword [ebp - 0x13c0], eax
mov dword [ebp - 0x13bc], edi
nop
lea ecx, [ebp - 0x13b8]
cmp eax, 0xffffffff
jne 0x402ac4
call fcn.0040c460
mov ecx, eax
jmp 0x402b13
lea edi, [eax + 1]
call fcn.0040c460
mul edi
mov dword [ebp - 0x13c8], eax
mov ecx, edx
cmp eax, edi
jae 0x402b0d
mov eax, edi
xor edx, edx
neg eax
div edi
mov eax, edx
mov dword [ebp - 0x13cc], eax
cmp dword [ebp - 0x13c8], eax
jae 0x402b0d
mov esi, edx
lea ecx, [ebp - 0x13b8]
call fcn.0040c460
mul edi
mov ecx, edx
cmp eax, esi
jb 0x402af4
mov esi, dword [ebp - 0x13d0]
mov edi, dword [ebp - 0x13bc]
cmp dword [ebp - 0x1c], 0x10
lea eax, [ebp - 0x30]
mov edx, dword [esi + 0x14]
cmovae eax, dword [ebp - 0x30]
mov al, byte [ecx + eax]
mov ecx, dword [esi + 0x10]
mov byte [ebp - 0x18], al
cmp ecx, edx
jae 0x402b4a
lea eax, [ecx + 1]
mov dword [esi + 0x10], eax
mov eax, esi
cmp edx, 0x10
jb 0x402b3d
mov eax, dword [esi]
add eax, ecx
mov cl, byte [ebp - 0x18]
mov byte [eax + 1], 0
mov byte [eax], cl
jmp 0x402b63
push dword [ebp - 0x18]
mov byte [ebp - 0x13d4], 0
mov ecx, esi
push dword [ebp - 0x13d4]
push 1
call fcn.0040add0
mov eax, dword [ebp - 0x13c0]
sub edi, 1
mov dword [ebp - 0x13bc], edi
jne 0x402ab0
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x402baa
mov edx, dword [ebp - 0x30]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x402ba0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402bca
push ecx
push edx
call fcn.0040f21e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040efde
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00417d1f
int3
Function at 0x402c70
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d5b0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x64
mov eax, dword [0x43b06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebx + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0x44
sub esp, 0x18
movlpd qword [ebp - 0x5c], xmm0
mov ecx, esp
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
push eax
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x70], xmm0
call fcn.00407440
call fcn.00402bd0
add esp, 0x18
mov esi, eax
mov edx, esi
call fcn.0040a3e0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x402d59
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov edx, str.CreateProcess_failed__
mov ecx, 0x43c498
call fcn.0040a090
add esp, 4
mov ecx, eax
call fcn.00406c50
mov edx, 0x4370dc
mov ecx, eax
call fcn.0040a090
jmp 0x402d78
mov edx, str.Process_started_successfully._n
mov ecx, 0x43c2f0
call fcn.0040a090
push dword [ebp - 0x70]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x6c]
call esi
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0x10
jb 0x402da8
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402d9e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402dc5
push ecx
push edx
call fcn.0040f21e
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040efde
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00417d1f
int3
Function at 0x403eb0
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x43b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.004028f0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movaps xmm0, xmmword [0x4373c0]
lea edi, [ebp - 0x40]
mov eax, connect
movaps xmmword [ebp - 0x40], xmm0
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov esi, connect
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov dword [0x43d2e0], 0
cmp eax, esi
jb 0x403f85
mov eax, esi
xor ecx, ecx
push ebx
cpuid
mov dword [ebp - 0x2c], ebx
pop ebx
lea edi, [ebp - 0x40]
mov dword [edi], eax
lea eax, [ebp - 0x40]
mov edi, dword [ebp - 0x2c]
mov dword [eax + 4], edi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
cmp esi, 0x80000002
jne 0x403f57
movups xmm0, xmmword [ebp - 0x40]
movups xmmword [0x43d2e0], xmm0
jmp 0x403f7f
cmp esi, reloc.WS2_32.dll_closesocket
jne 0x403f6c
movups xmm0, xmmword [ebp - 0x40]
movups xmmword [0x43d2f0], xmm0
jmp 0x403f7f
cmp esi, reloc.WS2_32.dll_connect
jne 0x403f7f
movups xmm0, xmmword [ebp - 0x40]
movups xmmword [0x43d300], xmm0
inc esi
cmp esi, dword [ebp - 0x30]
jbe 0x403f23
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
pop edi
mov dword [0x43d2dc], eax
pop esi
call fcn.0040efde
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x404670
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x43b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ecx, dword [ebp + 0x18]
lea edx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
mov esi, eax
cmovae edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
push ecx
push edx
push 1
push 0
push 0x437254
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4046e0
test edi, edi
jne 0x4046e0
mov bl, 1
jmp 0x4046e2
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x404718
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40470e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40472b
push ecx
push edx
call fcn.0040f21e
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040efde
mov esp, ebp
pop ebp
ret
call fcn.00417d1f
int3
Function at 0x405c60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x405c92
jl 0x405c85
test ecx, ecx
jne 0x405c92
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x405d52
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00408970
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x405cfe
jg 0x405cbd
test esi, esi
je 0x405cfe
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x405cd5
mov eax, dword [esp + 0x10]
jl 0x405ccf
cmp eax, esi
jae 0x405cd5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.00410450
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x405d1f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x405d3b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x405ca4
jl 0x405d3b
test ecx, ecx
jne 0x405ca4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x405d96
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x405d96
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00410450
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x405e07
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x405dbc
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x405df2
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.00417660
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x405e07
cmp edi, eax
ja 0x405dd0
test edi, edi
je 0x405e07
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.00417660
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x409750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42dcc0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x43b06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push 8
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0040f1ee
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0040cbbb
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00409860
mov eax, dword [ebp - 0x10]
lea ebx, [edi + 4]
mov dword [edi + 0xc], ebx
lea esi, [edi + 8]
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea ecx, [eax + 0x18]
mov byte [edi + 0x48], 0
lea edx, [eax + 0x24]
mov byte [edi + 0x3d], 0
mov dword [edi + 0x10], esi
add edi, 0x14
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x4c], 0
mov ecx, dword [0x43d338]
mov edx, dword [0x43d33c]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c460
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x40c4bd
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x40c480
mov eax, dword [esi]
jmp 0x40c597
cmp eax, 0x4e0
jb 0x40c597
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x40c4d6
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
nop
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x40c520
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40fc33
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40fc72
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40fc72
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40fc72
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40fc72
cmp dword [ecx + 0x74], 0xe
jbe 0x40fc72
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41eb2b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x433298
push 0x433290
push str.FlsAlloc
push 0x1e
call fcn.0041e958
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41eb5f
push dword [ebp + 8]
mov ecx, esi
call dword [0x42f1f4]
call esi
jmp 0x41eb65
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41eba9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4332a8
push 0x4332a0
push str.FlsGetValue
push 0x20
call fcn.0041e958
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ebe0
push dword [ebp + 8]
mov ecx, esi
call dword [0x42f1f4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x420324
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041ffc6

Function at 0x42032f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00420155
Function at 0x4207d4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040fda0
mov eax, dword [0x43b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041c9f7
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x420816
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x420972
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0042ce40
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x43ced0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004221b6
mov ecx, dword [esi*4 + 0x43ced0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x42096b
cmp eax, dword [edi + ecx + 0x24]
jne 0x42096b
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42096b
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004221b6
add esp, 0x14
test edx, edx
jl 0x42096b
jg 0x4208e1
test eax, eax
jb 0x42096b
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x42096b
jl 0x4208fb
cmp dword [ebp - 0x1008], eax
ja 0x42096b
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x420919
test ebx, ebx
je 0x420952
cmp ecx, edi
jae 0x420952
mov al, byte [ecx]
cmp al, 0xd
jne 0x420933
lea eax, [edi - 1]
cmp ecx, eax
jae 0x42093f
cmp byte [ecx + 1], 0xa
jne 0x42093f
inc ecx
jmp 0x42093f
movzx eax, al
movsx eax, byte [eax + 0x43b2f0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x420919
cmp edx, ebx
jne 0x420919
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x420970
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040efde
leave
ret