joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f9f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044e5f
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], edx
mov edi, ecx
mov eax, dword [ebp + 8]
movq xmm0, qword [0x10050c70]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov ax, word [0x10050c78]
push 0x18
mov byte [ebp - 0x1d], 0
movq qword [0x1005bb10], xmm0
mov word [0x1005bb18], ax
mov dword [0x1005bb44], 0x10050c7c
mov dword [0x1005bb48], 0x10050c88
call fcn.10013718
add esp, 4
mov dword [ebp - 0x24], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movups xmmword [eax], xmm0
mov ecx, eax
movq qword [eax + 0x10], xmm0
call fcn.1000ad10
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ecx
push 0
push eax
push 0x1000aeb0
push 0
push 0
mov dword [ebp - 0x24], eax
call esi
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x24]
push 0x1000aea0
push 0
push 0
call esi
call fcn.1000b060
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x1000fad7
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x18]
push eax
push 0xf01ff
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1000fb0b
push 0x10050cd8
push edi
call fcn.10007760
add esp, 8
jmp 0x1000fbdc
mov ecx, dword [ebp - 0x18]
mov edx, 0x10050cf8
call fcn.1000b7a0
mov ecx, dword [ebp - 0x18]
mov edx, 0x10050d28
call fcn.1000b7a0
lea eax, [ebp - 0x1c]
push eax
push 0xf01ff
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [ebp - 0x24]
push 0x1005bb38
mov eax, dword [eax + 8]
push dword [eax]
call dword [sym.imp.Secur32.dll_QuerySecurityContextToken]
push 0x1005bb34
push 1
push 2
push 0
push 0xf01ff
push dword [0x1005bb38]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1000fb7a
push 0x10050d64
push edi
call fcn.10007760
add esp, 8
jmp 0x1000fbdc
push dword [0x1005bb38]
push 0
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x1000fb9c
push 0x10050d80
push edi
call fcn.10007760
add esp, 8
jmp 0x1000fbdc
mov esi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
push esi
call fcn.100074f0
add esp, 4
mov byte [ebp - 0x1d], al
test al, al
je 0x1000fbc6
push esi
push 0x10050d98
push edi
call fcn.10007760
add esp, 0xc
jmp 0x1000fbdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x10050db4
push edi
call fcn.10007760
add esp, 0x10
mov eax, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000fbec
push eax
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1000fbf6
push eax
call esi
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
Function at 0x1000fcf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044e9f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], edx
mov edi, ecx
movq xmm0, qword [0x10050e48]
xor al, al
mov byte [ebp - 0x1d], al
mov ax, word [0x10050e50]
movq qword [0x1005bb10], xmm0
mov word [0x1005bb18], ax
mov dword [0x1005bb44], 0x10050e54
mov dword [0x1005bb48], 0x10050e60
test edx, edx
jne 0x1000fd5f
xor al, al
jmp 0x1000feb5
push 0x18
call fcn.10013718
add esp, 4
mov dword [ebp - 0x24], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movups xmmword [eax], xmm0
mov ecx, eax
movq qword [eax + 0x10], xmm0
call fcn.1000ad10
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ecx
push 0
push eax
push 0x1000aeb0
push 0
push 0
mov dword [ebp - 0x24], eax
call esi
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x24]
push 0x1000aea0
push 0
push 0
call esi
call fcn.1000b060
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0xffffffff
je 0x1000fdd1
lea eax, [ebp - 0x18]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000fe8a
mov ecx, dword [ebp - 0x18]
mov edx, 0x10050ed0
call fcn.1000b7a0
mov ecx, dword [ebp - 0x18]
mov edx, 0x10050f00
call fcn.1000b7a0
lea eax, [ebp - 0x1c]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [esi + 8]
push 0x1005bb38
push dword [eax]
call dword [sym.imp.Secur32.dll_QuerySecurityContextToken]
push 0x1005bb34
push 1
push 2
push 0
push 0xf01ff
push dword [0x1005bb38]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1000fe83
push dword [0x1005bb38]
push 0
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x1000fe7c
mov edx, dword [ebp - 0x28]
mov ecx, edi
call fcn.1000c8c0
mov byte [ebp - 0x1d], al
jmp 0x1000fdd1
push 0x10050f58
jmp 0x1000fe8f
push 0x10050f3c
jmp 0x1000fe8f
push 0x10050eb0
push edi
call fcn.10007760
mov eax, dword [ebp - 0x18]
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000fea8
push eax
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1000feb2
push eax
call esi
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
Function at 0x10010690
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044f5f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], edx
mov edi, ecx
movq xmm0, qword [str.127.0.0.1]
mov ax, word [0x10051350]
movq qword [0x1005bb10], xmm0
mov word [0x1005bb18], ax
mov dword [0x1005bb44], 0x10051354
mov dword [0x1005bb48], 0x10051360
test edx, edx
jne 0x10010706
push str.Parameter_Invalid
push edi
call fcn.10007760
add esp, 8
jmp 0x10010869
push 0x18
call fcn.10013718
add esp, 4
mov dword [ebp - 0x20], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movups xmmword [eax], xmm0
mov ecx, eax
movq qword [eax + 0x10], xmm0
call fcn.1000ad10
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ecx
push 0
push eax
push 0x1000aeb0
push 0
push 0
mov dword [ebp - 0x20], eax
call esi
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x20]
push 0x1000aea0
push 0
push 0
call esi
call fcn.1000b060
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
nop
cmp eax, 0xffffffff
je 0x10010780
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x18]
push eax
push 0xf01ff
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100107b4
push str.OpenProcessTokenToken_Failure
push edi
call fcn.10007760
add esp, 8
jmp 0x1001084f
mov ecx, dword [ebp - 0x18]
mov edx, str.SeImpersonatePrivilege
call fcn.1000b7a0
mov ecx, dword [ebp - 0x18]
mov edx, str.SeAssignPrimaryTokenPrivilege
call fcn.1000b7a0
lea eax, [ebp - 0x1c]
push eax
push 0xf01ff
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [ebp - 0x20]
push 0x1005bb38
mov eax, dword [eax + 8]
push dword [eax]
call dword [sym.imp.Secur32.dll_QuerySecurityContextToken]
push 0x1005bb34
push 1
push 2
push 0
push 0xf01ff
push dword [0x1005bb38]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x10010823
push str.DuplicateTokenEx_Failure
push edi
call fcn.10007760
add esp, 8
jmp 0x1001084f
push dword [0x1005bb38]
push 0
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x10010845
push str.SetThreadToken_Failure
push edi
call fcn.10007760
add esp, 8
jmp 0x1001084f
mov edx, dword [ebp - 0x24]
mov ecx, edi
call fcn.1000d6e0
mov eax, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1001085f
push eax
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10010869
push eax
call esi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
Function at 0x10010d00
Capabilities:
Shutdown system

Disassembly:
push esi
mov esi, ecx
call fcn.10010c30
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x10010d26
push str.Reboot_Successfully
push esi
call fcn.10007760
add esp, 8
pop esi
ret
push str.Reboot_Failure
push esi
call fcn.10007760
add esp, 8
pop esi
ret

Function at 0x100117b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
test edx, edx
je 0x10011843
test esi, esi
je 0x10011843
test edi, edi
je 0x10011843
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0x20019
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10011830
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push edi
push eax
push 0
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.100136f9
mov esp, ebp
pop ebp
ret

Function at 0x100118f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
rdtsc
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
rdtsc
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
xor eax, eax
sub ecx, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
push 0
sbb ecx, 0
add eax, dword [ebp - 0x10]
push 0xf4240
adc ecx, 0
push ecx
push eax
call fcn.10044cb0
mov esp, ebp
pop ebp
ret
Function at 0x10012070
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.10043430
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x1000
lea eax, [ebp - 0x100c]
push 0
push eax
call fcn.10017bc0
add esp, 0xc
lea eax, [ebp + 0xc]
mov edx, 0xfff
push eax
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x100c]
call fcn.10007660
add esp, 0xc
lea eax, [ebp - 0x100c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret

Function at 0x10012290
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 1
push 2
mov dword [ebp - 0x14], 0xb5367df1
mov dword [ebp - 0x10], 0x11cfcbac
mov dword [ebp - 0xc], 0x8000ca95
mov dword [ebp - 8], 0x92a1485f
mov dword [ebp - 0x18], 0
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100122e1
push str.Create_Socket_Failure
jmp 0x100123c5
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 4
push 0x1005bb5c
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0xc8000006
push esi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
jne 0x1001232c
push str.WSAIoctl_Failure
call fcn.10012070
add esp, 4
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call fcn.10005120
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10005950
push 0x100129b0
push 0x1005bb5c
call fcn.10005a10
call fcn.10005390
test eax, eax
jne 0x100123c0
push str.Detour_Hook_AcceptEx_OK_
call fcn.10012070
imul ecx, dword [0x1005bb70], 0x4c
mov eax, dword [0x1005bb5c]
push 0x3e
push str.AcceptEx
mov dword [ecx + 0x1005bb78], eax
lea eax, [ecx + 0x1005bb80]
push eax
mov dword [ecx + 0x1005bb7c], 0x100129b0
call fcn.1001aec0
mov ecx, dword [0x1005bb70]
add esp, 0x10
imul eax, ecx, 0x4c
inc ecx
mov dword [0x1005bb70], ecx
pop esi
mov byte [eax + 0x1005bbc0], 1
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
push str.Detour_Hook_AcceptEx_Failure
call fcn.10012070
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor al, al
pop esi
call fcn.100136f9
mov esp, ebp
pop ebp
ret

Function at 0x10029063
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10028ee2

Function at 0x1002eb5e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4010e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, eax
je 0x401101
push dword [ebp + 0x10]
push eax
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x10]
xor ecx, ecx
shr eax, 3
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], ecx
test eax, eax
je 0x4011bc
lea edx, [ebx + 4]
lea eax, [esi + 0x44]
mov dword [ebp - 8], edx
push edi
mov edi, eax
mov dword [ebp - 4], 0x10
nop word [eax + eax]
mov ebx, dword [edi]
lea edi, [edi - 4]
mov eax, dword [ebp + 8]
xor ebx, dword [eax + ecx*8]
mov dword [eax + ecx*8], ebx
mov eax, ebx
shr eax, 0x10
mov ecx, ebx
movzx eax, al
shr ecx, 0x18
mov edx, dword [esi + eax*4 + 0x448]
mov eax, ebx
add edx, dword [esi + ecx*4 + 0x48]
mov ecx, dword [ebp + 0xc]
shr eax, 8
movzx eax, al
xor edx, dword [esi + eax*4 + 0x848]
movzx eax, bl
mov ebx, dword [ebp + 8]
add edx, dword [esi + eax*4 + 0xc48]
mov eax, dword [ebp - 8]
xor dword [eax + ecx*8], edx
sub dword [ebp - 4], 1
mov eax, dword [eax + ecx*8]
mov edx, dword [ebx + ecx*8]
mov dword [ebx + ecx*8], eax
mov dword [ebx + ecx*8 + 4], edx
jne 0x401130
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + eax*8], edx
mov dword [ebx + eax*8 + 4], ecx
mov eax, dword [esi + 4]
xor eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebx + ecx*8 + 4], eax
mov eax, dword [esi]
xor dword [ebx + ecx*8], eax
inc ecx
lea eax, [esi + 0x44]
mov dword [ebp + 0xc], ecx
cmp ecx, dword [ebp + 0x10]
jb 0x401121
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4011d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, dword [edi + ecx*4]
xor ebx, dword [eax]
mov dword [eax], ebx
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
movzx ecx, cl
shr edx, 0x18
mov esi, dword [edi + ecx*4 + 0x448]
mov ecx, ebx
add esi, dword [edi + edx*4 + 0x48]
shr ecx, 8
movzx ecx, cl
xor esi, dword [edi + ecx*4 + 0x848]
movzx ecx, bl
mov ebx, dword [ebp + 0xc]
add esi, dword [edi + ecx*4 + 0xc48]
xor dword [ebx], esi
mov ecx, dword [ebx]
mov esi, dword [eax]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebx], esi
mov dword [ebp - 4], ecx
cmp ecx, 0x10
jl 0x4011e1
mov edx, dword [eax]
mov dword [eax], esi
mov dword [ebx], edx
mov ecx, dword [edi + 0x40]
xor ecx, edx
mov dword [ebx], ecx
mov ecx, dword [edi + 0x44]
xor dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401250
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movups xmm0, xmmword [0x413220]
push ebx
push esi
mov esi, ecx
push edi
push 0x1000
push 0x413268
movups xmmword [esi], xmm0
lea eax, [esi + 0x48]
mov dword [ebp - 0x10], esi
movups xmm0, xmmword [0x413230]
push eax
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [0x413240]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [0x413250]
movups xmmword [esi + 0x30], xmm0
movq xmm0, qword [0x413260]
movq qword [esi + 0x40], xmm0
call sub.msvcrt.dll_memcpy
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov ecx, edi
mov ebx, 4
and ecx, 0x80000003
jns 0x4012c5
dec ecx
or ecx, 0xfffffffc
add ecx, 1
je 0x4012d4
mov eax, ebx
mov ebx, ecx
cdq
idiv ecx
mov ecx, edx
test ecx, ecx
jne 0x4012c7
mov eax, edi
mov ecx, 4
cdq
idiv ebx
mov dword [ebp - 0xc], eax
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.00409c91
mov ebx, eax
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], ebx
test eax, eax
jle 0x401359
mov ebx, dword [ebp + 8]
mov ecx, 2
mov esi, dword [ebp - 8]
mov dword [ebp - 4], eax
nop
lea eax, [ecx - 2]
cdq
idiv edi
movzx eax, byte [edx + ebx]
mov byte [ebp + 0xf], al
lea eax, [ecx - 1]
cdq
idiv edi
movzx eax, byte [edx + ebx]
mov byte [ebp + 0xe], al
mov eax, ecx
cdq
idiv edi
movzx eax, byte [edx + ebx]
mov byte [ebp + 0xd], al
lea eax, [ecx + 1]
cdq
idiv edi
movzx eax, byte [edx + ebx]
mov byte [ebp + 0xc], al
mov eax, dword [ebp + 0xc]
mov dword [ecx + esi - 2], eax
add ecx, 4
sub dword [ebp - 4], 1
jne 0x401310
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
lea ecx, [esi + 8]
mov esi, 2
lea eax, [esi - 2]
cdq
lea ecx, [ecx + 0x18]
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x20], eax
lea eax, [esi - 1]
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x1c], eax
mov eax, esi
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x18], eax
lea eax, [esi + 1]
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x14], eax
lea eax, [esi + 2]
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x10], eax
lea eax, [esi + 3]
cdq
add esi, 6
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0xc], eax
lea eax, [esi - 2]
cmp eax, 0x12
jl 0x401364
push ebx
call fcn.00409c9a
mov esi, dword [ebp - 0x10]
add esp, 4
mov dword [ebp + 0xc], 0
xor edi, edi
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
mov ecx, esi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004011d0
mov eax, dword [ebp + 0xc]
mov dword [esi + edi*8], eax
mov eax, dword [ebp + 8]
mov dword [esi + edi*8 + 4], eax
inc edi
cmp edi, 9
jl 0x4013d5
lea edi, [esi + 0x4c]
mov ebx, 0x200
nop
lea eax, [ebp + 8]
mov ecx, esi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004011d0
mov eax, dword [ebp + 0xc]
lea edi, [edi + 8]
mov dword [edi - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [edi - 8], eax
sub ebx, 1
jne 0x401400
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x403b40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x403b9d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x403b60
mov eax, dword [esi]
jmp 0x403c77
cmp eax, 0x4e0
jb 0x403c77
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x403bb6
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
nop
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x403c00
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403e50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x271c
call fcn.0040a110
mov eax, dword [0x41a080]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, 0x1571
mov eax, 1
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [ebp + eax*4 - 0x1388], edx
inc eax
cmp eax, 0x270
jb 0x403e71
call fcn.0040839c
mov dword [ebp - 0x1398], 0xffffffff
mov edx, 1
mov dword [ebp - 0x2718], eax
nop dword [eax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [ebp + edx*4 - 0x2718], eax
inc edx
cmp edx, 0x270
jb 0x403eb0
push esi
push 0x1388
lea eax, [ebp - 0x271c]
mov dword [ebp - 0x271c], 0x270
push eax
lea eax, [ebp - 0x138c]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x138c]
call fcn.00403b40
mov esi, 0x7d1
mul esi
cmp eax, esi
jae 0x403f26
cmp eax, 0x376
jae 0x403f26
lea ecx, [ebp - 0x138c]
call fcn.00403b40
mul esi
cmp eax, 0x376
jb 0x403f12
lea eax, [edx - 0x7ffff830]
xor eax, 0x80000000
cdq
mov dword [ebp - 0x1394], eax
lea eax, [ebp - 0x1394]
push eax
mov dword [ebp - 0x1390], edx
call fcn.00402680
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
call fcn.00409f2d
mov esp, ebp
pop ebp
ret

Function at 0x403f60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x403f90
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403f90
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x400
jg 0x403f90
add eax, ecx
xor ecx, ecx
cmp dword [eax], 0x4550
cmovne eax, ecx
pop ebp
ret 4
xor eax, eax
pop ebp
ret 4