joyce8/EMBER2024-capa huggingface dataset:
Function at 0xdc021e
Capabilities:
Encode data using xor

Disassembly:
add al, ah
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
pushal
call 0xdc0224
pop ebp
sub ebp, 0x10
sub ebp, 0x9c0214
jmp 0xdc023a
mov eax, 0x9c0214
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e0
mov edx, 0xa9294116
xor byte [eax], dl
inc eax
dec ecx
jne 0xdc0251
jmp 0xdc0264
popfd
fistp dword [ebp + 0x16162a9f]
push ss
xchg edi, eax
xlatb
out dx, al
push ss
push ss
push ss
adc eax, 0x1612aedb
scasb al, byte es:[edi]
adc dl, byte [esi]
push ss
push ss
lodsb al, byte [esi]
push ss
push ss
push ss
loope 0xdc0274
adc eax, 0x1a979dde
push ss
push ss
push ss
adc eax, 0x729b46d3
xor ch, dl
lahf
adc dh, byte [edx]
jle 0xdc0216
invalid
Function at 0x409900
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x409931
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x409920
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x41a630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x41a662
jl 0x41a655
test ecx, ecx
jne 0x41a662
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x41a722
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00426c90
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x41a6ce
jg 0x41a68d
test esi, esi
je 0x41a6ce
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x41a6a5
mov eax, dword [esp + 0x10]
jl 0x41a69f
cmp eax, esi
jae 0x41a6a5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.0049f160
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x41a6ef
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x41a70b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x41a674
jl 0x41a70b
test ecx, ecx
jne 0x41a674
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x41a761
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x41a761
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.0049f160
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x41a7d0
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x41a787
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x41a7b9
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.004a3ef0
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x41a7e4
cmp edi, eax
ja 0x41a795
test ecx, ecx
je 0x41a7d0
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.004a3ef0
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41b5a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2d30
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4e84c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push 8
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0049c118
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0049b309
mov dword [esi + 4], eax
lea ebx, [edi + 4]
mov eax, dword [ebp - 0x10]
lea edx, [edi + 8]
mov dword [ebp - 0x18], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
add esp, 8
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x34], esi
add edi, 0x14
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea esi, [eax + 0x24]
mov byte [ebx + 0x48], 0
add eax, 0x28
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x18]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x18]
mov dword [edx], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [eax + 0x4c], 0
mov ecx, dword [0x4ec474]
mov edx, dword [0x4ec478]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b6b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2d5d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4e84c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebx]
push 0
push 0
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.0040fd90
push 8
call fcn.0049c118
mov esi, eax
xorps xmm0, xmm0
add esp, 4
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 1
call fcn.0049b309
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov ecx, dword [esi + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.00410310
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
mov byte [ebp + 0xb], al
test ecx, ecx
je 0x41b7da
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x41b7da
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x41b7f6
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.0040fd90
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41b840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2d80
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4e84c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0049c118
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0049b309
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c830
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2d30
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4e84c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push 0x48
push 0
push esi
call fcn.0049f000
mov eax, dword [edi]
add esp, 0xc
movq xmm0, qword [edi + 4]
mov edx, dword [edi + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0xc]
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
movups xmm0, xmmword [ebp - 0x1c]
push 1
push 0x4d98b4
movups xmmword [esi], xmm0
mov dword [esi + 0x10], edx
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.00405510
mov ecx, edi
mov dword [esi + 0x30], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0xf
call fcn.00424080
inc dword [edi + 0x10]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x42c8f0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c38e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4e84c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
lea eax, [ebp - 0x1c]
push eax
call fcn.00424210
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
movups xmm0, xmmword [ebp - 0x1c]
push 1
push 0x4d98b4
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.00405510
mov dword [esi + 0x30], 0
mov eax, esi
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0xf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42c9a0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c38e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4e84c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
lea eax, [ebp - 0x1c]
push eax
call fcn.00423fc0
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
movups xmm0, xmmword [ebp - 0x1c]
push 1
push 0x4d98b4
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.00405510
mov dword [esi + 0x30], 0
mov eax, esi
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0xf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42ff50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4e84c4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
lea ecx, [ebp - 0x104]
push ecx
push 0x100
mov edx, dword [edi + 4]
push edx
mov eax, dword [edx]
call dword [eax + 0x24]
test eax, eax
js 0x42fffa
push esi
lea eax, [edi + 8]
mov edi, 0x40
lea esi, [ebp - 0x103]
nop
mov dl, byte [esi - 1]
lea esi, [esi + 4]
movzx ecx, byte [eax]
lea eax, [eax + 4]
xor cl, dl
mov byte [eax - 4], dl
and cl, dl
mov dl, byte [esi - 4]
mov byte [eax + 0xfc], cl
movzx ecx, byte [eax - 3]
xor cl, dl
mov byte [eax - 3], dl
and cl, dl
mov dl, byte [esi - 3]
mov byte [eax + 0xfd], cl
movzx ecx, byte [eax - 2]
xor cl, dl
mov byte [eax - 2], dl
and cl, dl
mov dl, byte [esi - 2]
mov byte [eax + 0xfe], cl
movzx ecx, byte [eax - 1]
xor cl, dl
mov byte [eax - 1], dl
and cl, dl
mov byte [eax + 0xff], cl
sub edi, 1
jne 0x42ff90
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049c0fc
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0049c0fc
mov esp, ebp
pop ebp
ret

Function at 0x430230
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 1
mov edi, ecx
call esi
movzx ecx, byte [edi + 8]
shr eax, 7
and al, 1
xor cl, al
mov byte [edi + 8], al
and cl, al
push 2
mov byte [edi + 0xb], cl
call esi
movzx ecx, byte [edi + 9]
shr eax, 7
and al, 1
xor cl, al
mov byte [edi + 9], al
and cl, al
push 4
mov byte [edi + 0xc], cl
call esi
movzx ecx, byte [edi + 0xa]
shr eax, 7
and al, 1
xor cl, al
mov byte [edi + 0xa], al
and cl, al
mov byte [edi + 0xd], cl
pop edi
pop esi
ret
Function at 0x434cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x88
mov eax, dword [0x4e84c4]
xor eax, esp
mov dword [esp + 0x84], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
movss xmm0, dword [0x4da714]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
movss xmm7, dword [edx]
movaps xmm1, xmmword [0x4da840]
push esi
movss xmm4, dword [eax]
xor esi, esi
movss xmm5, dword [eax + 4]
subss xmm7, xmm4
movss xmm6, dword [eax + 8]
addss xmm4, dword [edx]
push edi
mov dword [esp + 0x24], ecx
mulss xmm7, xmm0
mov dword [esp + 0x14], esi
mulss xmm4, xmm0
movss dword [esp + 8], xmm7
movss xmm7, dword [edx + 4]
subss xmm7, xmm5
movss dword [esp + 0x18], xmm4
addss xmm5, dword [edx + 4]
movaps xmmword [esp + 0x50], xmm1
mulss xmm7, xmm0
mulss xmm5, xmm0
movss dword [esp + 0x10], xmm7
movss xmm7, dword [edx + 8]
subss xmm7, xmm6
movss dword [esp + 0x1c], xmm5
addss xmm6, dword [edx + 8]
mulss xmm7, xmm0
mulss xmm6, xmm0
movss dword [esp + 0xc], xmm7
movss xmm7, dword [esp + 8]
movss dword [esp + 0x20], xmm6
nop
movss xmm3, dword [esp + 0x10]
movaps xmm2, xmm1
mov esi, dword [esp + 0x24]
movaps xmm0, xmm1
shufps xmm2, xmm1, 0x55
xor edi, edi
shufps xmm1, xmm1, 0xaa
mulss xmm1, dword [esp + 0xc]
mulss xmm0, xmm7
mulss xmm2, xmm3
addss xmm1, xmm6
addss xmm0, xmm4
addss xmm2, xmm5
nop dword [eax]
nop dword [eax + eax]
mov eax, 0xaaaaaaab
movss dword [esp + 0x70], xmm0
mul edi
movss dword [esp + 0x78], xmm1
movss dword [esp + 0x74], xmm2
mov ecx, edi
mov dword [esp + 0x7c], 0
shr edx, 1
push dword [esp + 0x28]
mov dword [esp + 0x70], 0
lea eax, [edx + edx*2]
sub ecx, eax
mov eax, dword [esi]
movss xmm0, dword [esp + ecx*4 + 0x54]
mulss xmm0, dword [0x4da7c4]
movss dword [esp + ecx*4 + 0x54], xmm0
lea ecx, [esp + 0x64]
movaps xmm1, xmmword [esp + 0x54]
movaps xmm0, xmm1
mulss xmm0, xmm7
push ecx
lea ecx, [esp + 0x78]
push ecx
addss xmm0, xmm4
mov ecx, esi
movss dword [esp + 0x38], xmm0
movss dword [esp + 0x6c], xmm0
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
shufps xmm1, xmm1, 0xaa
mulss xmm1, dword [esp + 0x18]
mulss xmm0, xmm3
addss xmm1, xmm6
addss xmm0, xmm5
movaps xmmword [esp + 0x3c], xmm1
movss dword [esp + 0x74], xmm1
movups xmmword [esp + 0x4c], xmm0
movss dword [esp + 0x70], xmm0
call dword [eax + 0x10]
movaps xmm1, xmmword [esp + 0x30]
inc edi
movss xmm0, dword [esp + 0x2c]
movss xmm4, dword [esp + 0x18]
movss xmm5, dword [esp + 0x1c]
movss xmm6, dword [esp + 0x20]
movss xmm7, dword [esp + 8]
movss xmm3, dword [esp + 0x10]
movups xmm2, xmmword [esp + 0x40]
cmp edi, 3
jl 0x434df0
movaps xmm1, xmmword [0x4da860]
mov esi, dword [esp + 0x14]
movaps xmmword [esp + 0x50], xmm1
cmp esi, 3
jae 0x434f00
movss xmm0, dword [esp + esi*4 + 0x50]
mulss xmm0, dword [0x4da7c4]
movss dword [esp + esi*4 + 0x50], xmm0
movaps xmm1, xmmword [esp + 0x50]
inc esi
mov dword [esp + 0x14], esi
cmp esi, 4
jl 0x434db0
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
xor ecx, esp
call fcn.0049c0fc
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4424d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x4424f0
pop edi
mov dword [ecx], 0x270
mov eax, ecx
pop esi
pop ebp
ret 4

Function at 0x442520
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x44257e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x442540
mov eax, dword [edi]
jmp 0x442669
cmp eax, 0x4e0
jb 0x442669
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4425a0
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4425f0
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4469a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5c18
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4e84c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], 0xffffffff
mov dword [esi], 0x4c8558
mov dword [ebp - 4], 0
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
cmp byte [ebp + 8], 0
mov dword [esi + 0x30], 0x5d5e0b6b
mov dword [esi + 0x34], 0x5d5e0b6b
mov dword [esi + 0x38], 0x5d5e0b6b
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0xdd5e0b6b
mov dword [esi + 0x44], 0xdd5e0b6b
mov dword [esi + 0x48], 0xdd5e0b6b
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x60], 0x3f800000
mov dword [esi + 0x64], 0x3f800000
mov dword [esi + 0x68], 0x3f800000
mov dword [esi + 0x6c], 0
mov byte [ebp - 4], 1
mov dword [esi + 4], 0x1f
je 0x446a97
push 0x10
push 0x28
call fcn.004927e0
add esp, 8
mov ecx, eax
call fcn.004505e0
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0xc]
cmp dword [esi + 0x1c], eax
jge 0x446b46
test eax, eax
je 0x446aba
lea eax, [eax + eax*4]
shl eax, 4
push 0x10
push eax
call fcn.004927e0
add esp, 8
jmp 0x446abc
xor eax, eax
mov edi, dword [esi + 0x18]
mov dword [ebp + 8], eax
test edi, edi
jle 0x446b20
mov ecx, 0xffffffe0
lea edx, [eax + 0x20]
sub ecx, eax
mov dword [ebp - 0x10], ecx
lea eax, [edx - 0x20]
test eax, eax
je 0x446b18
mov ecx, dword [esi + 0x20]
add ecx, dword [ebp - 0x10]
add ecx, edx
movups xmm0, xmmword [ecx]
movups xmmword [edx - 0x20], xmm0
movups xmm0, xmmword [ecx + 0x10]
movups xmmword [edx - 0x10], xmm0
movups xmm0, xmmword [ecx + 0x20]
movups xmmword [edx], xmm0
movups xmm0, xmmword [ecx + 0x30]
movups xmmword [edx + 0x10], xmm0
mov eax, dword [ecx + 0x40]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 0x44]
mov dword [edx + 0x24], eax
mov eax, dword [ecx + 0x48]
mov dword [edx + 0x28], eax
mov eax, dword [ecx + 0x4c]
mov dword [edx + 0x2c], eax
add edx, 0x50
sub edi, 1
jne 0x446ad3
mov eax, dword [esi + 0x20]
test eax, eax
je 0x446b36
cmp byte [esi + 0x24], 0
je 0x446b36
push eax
call fcn.004927f0
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x1c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8