joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430235
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.00416a7d
fld1
lea eax, [ebp - 0xc]
fstp qword [ebp - 0x28]
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_StringFromIID]
mov esi, eax
xor edi, edi
cmp esi, edi
jl 0x4303d3
push dword [ebp - 0xc]
call fcn.00415ecf
mov esi, eax
lea eax, [ebp - 0x20]
mov dword [esp], str.interface_
push eax
call fcn.00416b9f
push esi
or eax, 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00416d89
push str.TypeLib
or eax, 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00416d89
push esi
call fcn.00448a22
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 8]
push eax
push 0x20019
push edi
push dword [ebp - 0x20]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x4303d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x240]
push eax
push edi
push edi
push edi
push dword [ebp - 8]
mov dword [ebp - 4], 0x1fe
call ebx
mov esi, eax
cmp esi, edi
jne 0x4303ca
shr dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x240], di
lea eax, [ebp - 0x240]
push eax
call fcn.00415ecf
pop ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
push dword [ebp - 0x14]
mov esi, eax
call fcn.00448a22
cmp esi, edi
pop ecx
jl 0x4303ca
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x240]
push eax
push edi
push edi
push str.Version
push dword [ebp - 8]
mov dword [ebp - 4], 0x1fe
call ebx
test eax, eax
jne 0x430375
shr dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x240], di
lea eax, [ebp - 0x240]
push eax
call fcn.00449070
fstp qword [ebp - 0x28]
pop ecx
lea eax, [ebp - 0x10]
fld1
push eax
push edi
sub esp, 0x10
fstp qword [esp + 8]
fld qword [ebp - 0x28]
fstp qword [esp]
call fcn.0044b330
add esp, 0x10
call fcn.00457c24
fld qword [ebp - 0x28]
push eax
call fcn.00457c24
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
mov esi, eax
cmp esi, edi
jl 0x4303ca
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x20]
call fcn.00448a22
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4303e3
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
xor esi, esi
push edi
lea ecx, [ebp - 0x24]
mov ebx, eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.00416a7d
lea ecx, [ebp - 0x18]
call fcn.00416a7d
lea ecx, [ebp - 0x30]
call fcn.00416a7d
push str.SOFTWAREClasses_
lea eax, [ebp - 0x24]
push eax
call fcn.00416b9f
push dword [ebp + 8]
or edi, 0xffffffff
mov eax, edi
lea ecx, [ebp - 0x24]
call fcn.00416d89
push str.CLSID
mov eax, edi
lea ecx, [ebp - 0x24]
call fcn.00416d89
push 0x45b6e0
lea eax, [ebp - 0x18]
push eax
call fcn.00416b9f
cmp ebx, esi
je 0x430476
cmp word [ebx], 0x5c
je 0x430476
cmp word [ebx + 2], 0x5c
je 0x430476
push 0x460090
lea eax, [ebp - 0x18]
push eax
call fcn.00416b9f
push ebx
mov eax, edi
lea ecx, [ebp - 0x18]
call fcn.00416d89
cmp dword [ebp + 0x10], esi
je 0x4304c7
push 0x20
lea eax, [ebp - 0x50]
push esi
push eax
call fcn.00449010
add esp, 0xc
lea ebx, [ebp - 0x18]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], esi
call fcn.00416ddf
push str.IPC_
mov eax, edi
lea ecx, [ebp - 0x30]
call fcn.00416d89
mov eax, dword [ebp - 0x30]
push esi
push dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x50]
push eax
call sub.MPR.dll_WNetAddConnection2W
mov edi, eax
cmp edi, esi
jne 0x430563
lea eax, [ebp - 0xc]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov edi, eax
cmp edi, esi
jne 0x430563
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push dword [ebp - 0x24]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
cmp edi, esi
jne 0x43055e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x254]
push eax
push esi
push esi
push esi
push dword [ebp - 8]
mov dword [ebp - 4], 0x1fe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, esi
jne 0x430559
shr dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x254], si
lea eax, [ebp - 0x254]
push eax
call fcn.00415ecf
pop ecx
push dword [ebp + 0xc]
mov esi, eax
push esi
call dword [sym.imp.ole32.dll_CLSIDFromString]
push esi
mov edi, eax
call fcn.00448a22
pop ecx
push dword [ebp - 8]
call ebx
push dword [ebp - 0xc]
call ebx
push dword [ebp - 0x30]
call fcn.00448a22
push dword [ebp - 0x18]
call fcn.00448a22
push dword [ebp - 0x24]
call fcn.00448a22
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x435fe7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x201c
call fcn.0044ba00
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.00416a7d
lea ecx, [ebp - 0x1c]
call fcn.00416a7d
mov esi, dword [ebp + 8]
xor edi, edi
call fcn.004181fe
mov esi, eax
mov ax, word [esi]
test ax, ax
mov byte [ebp - 1], 0
je 0x436126
push ebx
mov ebx, 0x460760
inc edi
cmp ax, 0x25
jne 0x4360e0
cmp word [esi + edi*2], ax
jne 0x43604d
push 0x25
lea eax, [ebp - 0x10]
mov byte [ebp - 1], 1
call fcn.00416c1d
inc edi
jmp 0x4360e9
push 0x45b6e0
lea eax, [ebp - 0x1c]
push eax
call fcn.00416b9f
jmp 0x43606c
test ax, ax
je 0x436078
push eax
lea eax, [ebp - 0x1c]
call fcn.00416c1d
inc edi
xor eax, eax
mov ax, word [esi + edi*2]
cmp ax, 0x25
jne 0x43605d
cmp word [esi + edi*2], 0
je 0x4360f8
and word [ebp - 0x201c], 0
push 0xfff
lea eax, [ebp - 0x201c]
push eax
push dword [ebp - 0x1c]
inc edi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
test eax, eax
lea ecx, [ebp - 0x10]
je 0x4360b9
lea eax, [ebp - 0x201c]
push eax
or eax, 0xffffffff
call fcn.00416d89
mov byte [ebp - 1], 1
jmp 0x4360e9
push ebx
or eax, 0xffffffff
mov byte [ebp - 1], 1
call fcn.00416d89
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
call fcn.00416bda
push ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00416d89
jmp 0x4360e9
push eax
lea eax, [ebp - 0x10]
call fcn.00416c1d
mov ax, word [esi + edi*2]
test ax, ax
jne 0x436028
jmp 0x436114
push ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x10]
mov byte [ebp - 1], 1
call fcn.00416d89
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
call fcn.00416bda
cmp byte [ebp - 1], 0
je 0x436125
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x10]
call fcn.00418861
pop ebx
push dword [ebp - 0x1c]
call fcn.00448a22
push dword [ebp - 0x10]
call fcn.00448a22
pop ecx
pop ecx
pop edi
pop esi
leave
ret 4
Function at 0x438cb2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push str.open
lea esi, [ebp - 0x14]
mov edi, eax
call fcn.00416a9d
xor ebx, ebx
push 0x3c
xor esi, esi
lea eax, [ebp - 0x50]
push ebx
inc esi
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
call fcn.00449010
add esp, 0xc
cmp dword [ebp + 0x10], 2
jb 0x438d24
cmp dword [edi + 0xc], esi
ja 0x438cf4
lea esi, [edi + 0x18]
jmp 0x438cfa
mov eax, dword [edi + 8]
mov esi, dword [eax + 4]
call fcn.004181fe
cmp word [eax], 0
je 0x438d24
cmp dword [edi + 0xc], 1
ja 0x438d10
lea esi, [edi + 0x18]
jmp 0x438d16
mov eax, dword [edi + 8]
mov esi, dword [eax + 4]
call fcn.004181fe
push eax
call fcn.00415ecf
pop ecx
mov ebx, eax
cmp dword [ebp + 0x10], 3
jb 0x438d4a
cmp dword [edi + 0xc], 2
ja 0x438d35
lea esi, [edi + 0x18]
jmp 0x438d3b
mov eax, dword [edi + 8]
mov esi, dword [eax + 8]
call fcn.004181fe
push eax
call fcn.00415ecf
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 4
jb 0x438d8c
cmp dword [edi + 0xc], 3
ja 0x438d5b
lea esi, [edi + 0x18]
jmp 0x438d61
mov eax, dword [edi + 8]
mov esi, dword [eax + 0xc]
call fcn.004181fe
cmp word [eax], 0
je 0x438d8c
cmp dword [edi + 0xc], 3
ja 0x438d77
lea esi, [edi + 0x18]
jmp 0x438d7d
mov eax, dword [edi + 8]
mov esi, dword [eax + 0xc]
call fcn.004181fe
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00416b9f
cmp dword [ebp + 0x10], 5
jb 0x438dae
cmp dword [edi + 0xc], 4
ja 0x438d9d
lea eax, [edi + 0x18]
jmp 0x438da3
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x10]
call fcn.004182e3
movzx eax, ax
mov dword [ebp - 8], eax
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.00449010
and dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x14]
add esp, 0xc
cmp dword [edi + 0xc], 0
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x40
mov dword [ebp - 0x44], eax
ja 0x438ddf
lea esi, [edi + 0x18]
jmp 0x438de4
mov eax, dword [edi + 8]
mov esi, dword [eax]
call fcn.004181fe
mov edi, dword [ebp - 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test ebx, ebx
mov esi, eax
je 0x438e12
push ebx
call fcn.00448a22
pop ecx
test edi, edi
je 0x438e1d
push edi
call fcn.00448a22
pop ecx
test esi, esi
jne 0x438e66
mov ebx, dword [ebp + 8]
cmp byte [ebx + 0x294], 1
jne 0x438e42
push 0xffffffffffffffff
call fcn.0041fb16
push eax
push 0x87
call fcn.0041f97d
inc esi
jmp 0x438e5a
xor ecx, ecx
push 0
inc ecx
mov eax, ebx
call fcn.0042124a
mov esi, dword [ebp + 0x14]
push 0
call fcn.00418769
xor esi, esi
push dword [ebp - 0x14]
call fcn.00448a22
mov eax, esi
jmp 0x438e9d
cmp byte [ebp + 0xc], 0
je 0x438e7a
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x810], eax
jmp 0x438e93
mov esi, dword [ebp + 0x14]
push 1
call fcn.00418769
cmp dword [ebp - 0x18], 0
je 0x438e93
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x14]
call fcn.00448a22
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x43bd99
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
mov edi, 0x103
jmp 0x43be4e
xor eax, eax
cmp byte [0x478bc8], bl
je 0x43bde2
mov eax, 0x100
lea ecx, [ebp - 0xc]
push ecx
or eax, 0x20019
push eax
push ebx
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43be56
push dword [ebp - 0xc]
call fcn.0043bd99
pop ecx
push dword [ebp - 0xc]
mov byte [ebp - 1], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
je 0x43be56
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x43be56
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
cmp eax, edi
jne 0x43bdd3
mov al, 1
jmp 0x43be58
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43c7eb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp edi, 0xffffffff
je 0x43c873
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 1
jne 0x43c873
mov esi, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push eax
xor ebx, ebx
push ebx
push ebx
push edi
call esi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], eax
je 0x43c847
cmp dword [ebp + 0x10], ebx
jbe 0x43c847
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x43c83f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
jmp 0x43c875
push ebx
push ebx
push dword [ebp - 4]
push edi
call esi
cmp dword [ebp + 0x18], ebx
je 0x43c867
push 2
push ebx
push ebx
push edi
call esi
push ebx
push ebx
push dword [ebp - 4]
mov edi, eax
push dword [ebp + 8]
call esi
sub edi, dword [ebp - 4]
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
inc eax
jmp 0x43c87d
push 6
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4412cf
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
inc esi
mov dword [0x476a30], eax
push edi
mov edx, esi
mov eax, 0x476a30
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4773ec
jl 0x4412e0
pop edi
mov dword [0x4662d8], esi
mov dword [0x47740c], esi
pop esi
ret

Function at 0x44130e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x47740c], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x476a30
jne 0x44132e
push 0
call fcn.0044b362
pop ecx
call fcn.004412cf
mov dword [0x4662d8], 0x270
mov dword [0x476a28], esi
mov edx, 0xe3
mov ecx, SysReAllocString
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x44134d
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x441383
mov edx, dword [0x476a30]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4413dd
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4662d8]
jne 0x4413ea
call fcn.0044130e
mov eax, dword [0x476a28]
mov ecx, dword [eax]
add dword [0x476a28], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x441421
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4662d8]
jne 0x441433
call fcn.0044130e
mov eax, dword [0x476a28]
mov eax, dword [eax]
add dword [0x476a28], 4
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov ecx, eax
and ecx, 0xff3a58ad
shl ecx, 7
xor eax, ecx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
xor ecx, eax
test ecx, ecx
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
jge 0x441479
fadd qword [0x461728]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x461718]
leave
ret

Function at 0x441af3
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.00449010
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x44246a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
push edi
xor edi, edi
inc edi
mov dword [eax], ecx
mov esi, edi
mov ecx, eax
mov edx, dword [ecx]
mov ebx, edx
shr ebx, 0x1e
xor ebx, edx
imul ebx, ebx, 0x6c078965
add ebx, esi
mov dword [ecx + 4], ebx
inc esi
add ecx, 4
cmp esi, 0x270
jl 0x442476
mov dword [eax + 0x9c0], edi
mov dword [eax + 0x9c4], edi
pop edi
pop esi
pop ebx
ret
Function at 0x4424a6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebx, eax
cmp dword [ebx + 0x9c4], 0
push esi
push edi
mov esi, ebx
jne 0x4424ca
push 0
call fcn.0044b362
pop ecx
mov ecx, eax
mov eax, ebx
call fcn.0044246a
mov dword [ebx + 0x9c0], 0x270
mov dword [ebx + 0x9c8], ebx
mov dword [esp + 0x10], 0xe3
mov ecx, SysReAllocString
mov eax, 0x9908b0df
mov edx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor edx, ebp
and edx, ecx
xor edx, dword [esi]
mov dword [esp + 0x14], ecx
mov ecx, ebp
and cl, 1
shr edx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor edx, ecx
xor edx, dword [esi + 0x634]
dec dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi], edx
mov esi, edi
jne 0x4424ec
mov dword [esp + 0x10], 0x18c
mov edx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor edx, ebp
and edx, ecx
xor edx, dword [esi]
mov dword [esp + 0x14], ecx
mov ecx, ebp
and cl, 1
shr edx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor edx, ecx
xor edx, dword [esi - 0x38c]
dec dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi], edx
mov esi, edi
jne 0x442528
mov ebx, dword [ebx]
mov edx, dword [esi]
xor edx, ebx
and edx, ecx
xor edx, dword [esi]
and bl, 1
shr edx, 1
neg bl
pop edi
sbb ebx, ebx
and ebx, eax
xor edx, ebx
xor edx, dword [esi - 0x38c]
mov dword [esi], edx
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x442582
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [esi + 0x9c0]
jne 0x442591
mov eax, esi
call fcn.004424a6
lea eax, [esi + 0x9c8]
mov edx, dword [eax]
mov ecx, dword [edx]
add edx, 4
mov dword [eax], edx
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x4427b6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9cc
push ebx
xor ebx, ebx
lea eax, [ebp - 0x9cc]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], ebx
call fcn.0044246a
cmp dword [ebp + 0xc], ebx
jbe 0x4427f9
push esi
push edi
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x9cc]
lea edi, [ebx + eax]
call fcn.00442582
xor byte [edi], al
inc ebx
cmp ebx, dword [ebp + 0xc]
jb 0x4427de
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x44a871
Capabilities:
Terminate process

Disassembly:
push 8
push 0x45a120
call fcn.0044d178
push 8
call fcn.0044c0cc
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x46640c], esi
jne 0x44a8a5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov dword [0x466408], esi
mov al, byte [ebp + 0x10]
mov byte [0x466404], al
cmp dword [ebp + 0xc], edi
jne 0x44a8ef
cmp dword [0x480bac], edi
je 0x44a8df
mov eax, dword [0x480ba8]
sub eax, 4
mov dword [0x480ba8], eax
cmp eax, dword [0x480bac]
jb 0x44a8df
mov eax, dword [eax]
cmp eax, edi
je 0x44a8c0
call eax
jmp 0x44a8c0
push 0x464050
mov eax, 0x464048
call fcn.0044a7ef
pop ecx
push 0x464058
mov eax, 0x464054
call fcn.0044a7ef
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x44a920
cmp dword [ebp + 0x10], edi
jne 0x44a92e
mov dword [0x46640c], esi
push dword [ebp + 8]
call fcn.0044a7ad
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x44a92d
push 8
call fcn.0044c017
pop ecx
ret
call fcn.0044d1b3
ret

Function at 0x44aa3a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x44aa57
call fcn.0044d305
mov dword [eax], 0x16
xor eax, eax
jmp 0x44aac1
push esi
push 0x8c
push 1
call fcn.0044febf
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x44aaac
push esi
call fcn.0044bc90
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x44aa8a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x44a9a5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x44aac0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
push esi
call fcn.00449638
test ebx, ebx
pop ecx
je 0x44aabe
push ebx
call fcn.0044d317
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44b0c1
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x44b0dd
call fcn.0044d305
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x44b14f
push esi
push 0x8c
push 1
call fcn.0044febf
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x44b135
push esi
call fcn.0044bc90
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x44b02f
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x44b12d
push edi
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
cmp eax, 0xffffffff
jne 0x44b14c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
push esi
call fcn.00449638
test ebx, ebx
pop ecx
je 0x44b147
push ebx
call fcn.0044d317
pop ecx
or eax, 0xffffffff
jmp 0x44b14e
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x44b828
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x45a1b8
call fcn.0044d178
mov edi, 0x94
mov eax, edi
call fcn.0044ba00
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4663cc], ecx
mov eax, dword [esi + 4]
mov dword [0x4663d8], eax
mov edx, dword [esi + 8]
mov dword [0x4663dc], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4663d0], esi
cmp ecx, 2
je 0x44b888
or esi, 0x8000
mov dword [0x4663d0], esi
shl eax, 8
add eax, edx
mov dword [0x4663d4], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x44b8c3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44b8c3
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x44b8db
cmp eax, 0x20b
je 0x44b8c8
mov dword [ebp - 0x1c], esi
jmp 0x44b8ef
cmp dword [ecx + 0x84], 0xe
jbe 0x44b8c3
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x44b8e9
cmp dword [ecx + 0x74], 0xe
jbe 0x44b8c3
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0044da6d
pop ecx
test eax, eax
jne 0x44b903
push 0x1c
call fcn.0044b804
pop ecx
call fcn.0044be8a
test eax, eax
jne 0x44b914
push 0x10
call fcn.0044b804
pop ecx
call fcn.0044fcd3
mov dword [ebp - 4], esi
call fcn.0044ff96
test eax, eax
jge 0x44b92d
push 0x1b
call fcn.0044b7df
pop ecx
call fcn.00452fe2
mov dword [0x47fb84], eax
call fcn.00452e78
mov dword [0x466418], eax
call fcn.00452de2
test eax, eax
jge 0x44b952
push 8
call fcn.0044b7df
pop ecx
call fcn.00452baf
test eax, eax
jge 0x44b963
push 9
call fcn.0044b7df
pop ecx
push 1
call fcn.0044a807
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x44b979
push eax
call fcn.0044b7df
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoW]
call fcn.00452b69
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x44b99a
movzx eax, word [ebp - 0x40]
jmp 0x44b99d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401825
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x44b9bb
push edi
call fcn.0044a934
call fcn.0044a956
jmp 0x44b9ed
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0044d1b3
ret