joyce8/EMBER2024-capa huggingface dataset:
Function at 0x501d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502360
push 0x501f80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x5033f4], 0xffffffff
mov dword [0x5033f8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x5033f0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x5033ec]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x5033fc], ecx
call fcn.00501f70
mov eax, dword [0x503128]
test eax, eax
jne 0x501e11
push 0x501f60
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00501f40
push 0x50300c
push 0x503008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x5033e8]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x5033e4]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x503004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x501f1f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e85
cmp al, 0x22
jne 0x501e77
cmp byte [esi], 0x22
jne 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e9e
cmp al, 0x20
ja 0x501e9e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501e8e
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x501ebf
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x501ec4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x501f04
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501f1f

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0xc173c45
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x4907069e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10001380
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3cc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xc0
xor edi, edi
lea eax, [ebp - 0xc8]
push edi
push eax
mov esi, ecx
call sub.ntdll.dll_memset
add esp, 0xc
push dword [esi + 4]
push edi
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x100015a7
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x3b4]
push eax
lea eax, [ebp - 0x3cc]
mov dword [ebp - 0x3b0], ecx
push eax
push 8
lea eax, [ebp - 0x3a4]
mov dword [ebp - 0x3b4], edi
push eax
mov dword [ebp - 0x3cc], 0x18
mov dword [ebp - 0x3c8], edi
mov dword [ebp - 0x3c0], edi
mov dword [ebp - 0x3c4], edi
mov dword [ebp - 0x3bc], edi
mov dword [ebp - 0x3b8], edi
call dword [sym.imp.ntdll.dll_NtOpenThread]
test eax, eax
js 0x100015a0
lea eax, [ebp - 0x398]
mov dword [ebp - 0x398], 0x10001
push eax
push dword [ebp - 0x3a4]
push ebx
call 0x1000ed9e
test eax, eax
jne 0x10001456
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x3a4]
jmp 0x100015a1
push dword [ebp - 0x3a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x3a0]
mov esi, 0xc0
push eax
push esi
lea eax, [ebp - 0xc8]
push eax
push dword [0x10005448]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x100015a0
cmp dword [ebp - 0x3a0], esi
jne 0x100015a0
movzx eax, word [ebp - 0x2e0]
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x3ac], eax
mov dl, byte [ecx - 4]
mov al, dl
and al, 3
cmp al, 3
jne 0x100014ef
movzx esi, word [ecx]
cmp dword [ebp - 0x2dc], esi
jne 0x100014ef
mov eax, dword [ecx + 4]
mov dword [ebp - 0x3a8], eax
inc eax
cmp dword [ebp - 0x3ac], eax
jne 0x100014ef
mov eax, dword [ebp - 0x2d8]
movzx edx, dl
shr edx, 4
shr eax, 0x11
not edx
not eax
and edx, 1
and eax, 1
cmp eax, edx
je 0x100014fd
inc edi
add ecx, 0xc
cmp edi, 0x10
jl 0x100014aa
jmp 0x100015a0
push edx
push dword [ebp - 0x3a8]
mov edx, esi
mov ecx, ebx
call fcn.10002b55
mov dword [ebp - 0x3a8], eax
test eax, eax
je 0x100015a0
lea ecx, [ebp - 0x3a0]
push ecx
push 1
lea ecx, [ebp - 0x399]
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x100015a0
cmp byte [ebp - 0x399], 0xcc
jne 0x100015a0
imul esi, edi, 0xc
lea eax, [ebp - 0x3a0]
push eax
push 1
lea eax, [ebp - 0xc7]
add eax, esi
push eax
push dword [ebp - 0x3a8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov al, byte [ebp + esi - 0xc8]
and al, 0xfb
or al, 8
mov byte [ebp + esi - 0xc8], al
test edi, edi
jne 0x10001580
and al, 0xfe
mov byte [ebp - 0xc8], al
lea eax, [ebp - 0x3a0]
push eax
push 0xc0
lea eax, [ebp - 0xc8]
push eax
push dword [0x10005448]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003b80
leave
ret
Function at 0x50a440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
je 0x50a45b
mov eax, 0x8000ffff
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x34]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x50a46f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp + 8]
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x50a47f
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
push ebx
push edi
push 8
lea ebx, [esi + 0x3c]
push ebx
call dword [0x5165a8]
test eax, eax
jne 0x50a4a4
push dword [ebx]
call dword [0x5165c0]
test eax, eax
jne 0x50a4a4
mov dword [esi + 0x44], 1
push 0
push 0
push 0
push 0
call dword [0x5162f0]
mov edi, dword [0x5162b4]
mov dword [esi + 0x50], eax
test eax, eax
jne 0x50a4de
call edi
mov edi, eax
test edi, edi
jle 0x50a4d2
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x50a565
mov edi, dword [0x5162b4]
push 0
push 0
push 0
push 0
call dword [0x5162f0]
mov dword [esi + 0x54], eax
test eax, eax
jne 0x50a508
call edi
mov edi, eax
test edi, edi
jle 0x50a506
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x50a565
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x509f30
push 0
push 0
call fcn.00438d7e
add esp, 0x18
mov dword [esi + 0x4c], eax
test eax, eax
jne 0x50a540
call dword [0x5162b4]
mov edi, eax
test edi, edi
jle 0x50a53e
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x50a565
mov eax, dword [esi + 0x50]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x4c]
push 0xffffffffffffffff
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push 0
push eax
push 2
call dword [0x5161ec]
test eax, eax
je 0x50a5a6
mov edi, 0x8000ffff
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x50a57a
push eax
call dword [0x5162f4]
mov dword [esi + 0x4c], 0
mov eax, dword [esi + 0x54]
test eax, eax
je 0x50a58f
push eax
call dword [0x5162f4]
mov dword [esi + 0x54], 0
cmp dword [esi + 0x44], 0
je 0x50a5ae
push dword [ebx]
call dword [0x5165a4]
mov dword [esi + 0x44], 0
jmp 0x50a5ae
mov eax, dword [ebp - 4]
xor edi, edi
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x50]
test eax, eax
je 0x50a5c3
push eax
call dword [0x5162f4]
mov dword [esi + 0x50], 0
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x6bc954f2
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x1880903
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x408e40
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x450080]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x408ed6
lea eax, [ebp - 0x10]
push eax
push 0x44adb4
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x408e93
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fe91
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x18]
test eax, eax
jne 0x408e7f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x80000000
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fe91
mov esp, ebp
pop ebp
ret
Function at 0x409f50
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4411fd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x450080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x3c], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x3c], ecx
push 0x208
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
call fcn.004200a4
mov esi, eax
push 0x208
push 0
push esi
lea edi, [esi + 0x208]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x18], edi
call fcn.00421af0
add esp, 0x10
mov dword [ebp - 0x1c], edi
push 0x104
mov dword [ebp - 4], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push esi
call edi
mov dword [ebp - 0x40], eax
test eax, eax
jne 0x40a021
mov edi, dword [ebp - 0x48]
xorps xmm0, xmm0
push eax
push 0x44ad19
mov ecx, edi
movups xmmword [edi], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
call fcn.004193c0
test esi, esi
je 0x40a0fd
push 0x208
jmp 0x40a0f4
cmp eax, 0x104
jbe 0x40a04c
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0041c050
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub eax, esi
mov dword [ebp - 0x44], esi
sar eax, 1
push eax
push esi
call edi
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push eax
push esi
push 0
push 0xfde9
call edi
mov esi, eax
lea ecx, [ebp - 0x38]
push 0
push esi
call fcn.00415c30
cmp dword [ebp - 0x24], 0xf
lea eax, [ebp - 0x38]
push 0
cmova eax, dword [ebp - 0x38]
push 0
push esi
mov esi, dword [ebp - 0x44]
push eax
push dword [ebp - 0x40]
push esi
push 0
push 0xfde9
call edi
mov edi, dword [ebp - 0x48]
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [ebp - 0x38]
mov byte [ebp - 0x38], 0
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0x28]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
test esi, esi
je 0x40a0fd
mov ecx, dword [ebp - 0x3c]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40a0f3
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a11d
push ecx
push esi
call fcn.00420325
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041fe91
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0042be2f
int3

Function at 0x40a1b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 0xf
jbe 0x40a1b8
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40a1ca
shr eax, 4
and al, 1
ret
xor al, al
ret
Function at 0x40a800
Capabilities:
Check mutex on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441335
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x4c
mov eax, dword [0x450080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x50]
call fcn.0040d930
mov dword [ebp - 4], 0
cmp dword [ebp - 0x40], 0
jne 0x40a872
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 7
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 0x2c], ax
jmp 0x40a915
cmp dword [ebp - 0x3c], 0xf
lea eax, [ebp - 0x50]
push 0
cmova eax, dword [ebp - 0x50]
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ecx
mov esi, eax
mov dword [ebp - 0x30], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x38]
push esi
movq qword [ebp - 0x38], xmm0
call fcn.00413050
push esi
mov byte [ebp - 4], 1
lea eax, [ebp - 0x50]
cmp dword [ebp - 0x3c], 0xf
mov esi, dword [ebp - 0x38]
cmova eax, dword [ebp - 0x50]
push esi
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x34]
push ecx
add eax, 0xfffffffe
lea ecx, [ebp - 0x2c]
push eax
push esi
call fcn.00418bc0
test esi, esi
je 0x40a915
mov ecx, dword [ebp - 0x30]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40a90b
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a9e9
push ecx
push esi
call fcn.00420325
add esp, 8
cmp dword [ebp - 0x18], 7
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40a94b
test esi, esi
je 0x40a945
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x51], 0
jmp 0x40a94f
mov byte [ebp - 0x51], 1
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x40a985
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40a97b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a9e9
push ecx
push edx
call fcn.00420325
add esp, 8
mov ecx, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp ecx, 0xf
jbe 0x40a9c9
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40a9bf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a9e9
push ecx
push edx
call fcn.00420325
add esp, 8
mov al, byte [ebp - 0x51]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041fe91
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0042be2f
int3
Function at 0x40d930
Capabilities:
Get hostname

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4418ad
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x44
mov eax, dword [0x450080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x38], edi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], edi
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], 0x10
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x40d9fd
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x50]
call fcn.00415840
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
cmp dword [ebp - 0x3c], 7
mov eax, dword [ebp - 0x40]
cmova ecx, dword [ebp - 0x50]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x50]
cmova ecx, dword [ebp - 0x50]
push ecx
push eax
push ecx
mov ecx, edi
call fcn.00418ab0
mov ecx, dword [ebp - 0x3c]
cmp ecx, 7
jbe 0x40da1f
mov edx, dword [ebp - 0x50]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40d9f1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40da3e
push ecx
push edx
call fcn.00420325
add esp, 8
jmp 0x40da1f
xorps xmm0, xmm0
mov ecx, edi
push 0
movups xmmword [edi], xmm0
push 0x44ad19
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.004193c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041fe91
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0042be2f
int3
Function at 0x412fa0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x412fc0
pop edi
pop esi
mov dword [ecx], 0x270
mov eax, ecx
pop ebp
ret 4
Function at 0x413e40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x413e72
jl 0x413e65
test ecx, ecx
jne 0x413e72
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x413f4f
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x413ea2
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x413ea4
xor eax, eax
cdq
mov dword [esp + 0x1c], edx
mov esi, eax
test edx, edx
jl 0x413ef8
jg 0x413eb5
test esi, esi
je 0x413ef8
mov eax, dword [esp + 0x10]
cmp eax, edx
jg 0x413ec9
jl 0x413ec3
cmp ecx, esi
jae 0x413ec9
mov esi, ecx
mov dword [esp + 0x1c], eax
push esi
push dword [esp + 0x1c]
push edi
call fcn.00421440
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub ecx, esi
mov eax, dword [eax]
sbb edx, dword [esp + 0x1c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x14]
jmp 0x413f1c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x413f38
mov ecx, dword [esp + 0xc]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
lea eax, [ebx + 0x2c]
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
test edx, edx
jg 0x413e87
jl 0x413f38
test ecx, ecx
jne 0x413e87
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x413f93
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x413f93
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00421440
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x413ffc
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x413fb9
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x413fe7
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0042b7e3
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x413ffc
cmp edi, eax
ja 0x413fc5
test edi, edi
je 0x413ffc
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0042b7e3
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc