joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50f7b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
arpl word [eax + 4], bp
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x50f7c8
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x50f7f3
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je 0x50f9bd
cmp dword [ebp + 0xc], 1
je 0x50f9bd
cmp dword [ebp + 0xc], 8
jne 0x50f985
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.0050eb0f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0050eac4
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
push ebp
call fcn.0050eaff
fild word [edi - 0x5a7f9037]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosd dword es:[edi], eax
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
invalid
inc ebp
Function at 0x50f9e7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
arpl word [eax + 4], bp
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x50f7c8
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x50f7f3
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je 0x50f9bd
cmp dword [ebp + 0xc], 1
je 0x50f9bd
cmp dword [ebp + 0xc], 8
jne 0x50f985
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.0050eb0f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0050eac4
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
push ebp
call fcn.0050eaff
fild word [edi - 0x5a7f9037]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosd dword es:[edi], eax
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
invalid
inc ebp

Function at 0x50fa75
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
invalid
invalid
stosd dword es:[edi], eax
cld
Function at 0x50ffa3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop esp
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
invalid
test eax, esp
clc

Function at 0x5104b1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ecx - 0x39f7b]
inc dword [ebx - 0x6fb43]
inc dword [eax]
jne 0x51067a
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
invalid
invalid
nop

Function at 0x51bd63
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x5916c8]
je 0x51bd7e
inc edi
cmp edi, 0x17
jb 0x51bd6f
cmp edi, 0x17
jae 0x51befe
push ebp
push 3
call fcn.005290cf
cmp eax, 1
pop ecx
je 0x51beca
push 3
call fcn.005290cf
test eax, eax
pop ecx
jne 0x51bdb2
cmp dword [0x590998], 1
je 0x51beca
cmp ebx, 0xfc
je 0x51befd
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x5c9ed8
push ebp
call fcn.00516d39
add esp, 0xc
test eax, eax
je 0x51bde8
push esi
push esi
push esi
push esi
push esi
call fcn.0050ba91
add esp, 0x14
push 0x104
mov esi, 0x5c9ef1
push esi
push 0
mov byte [0x5c9ff5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x51be2c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00516d39
add esp, 0xc
test eax, eax
je 0x51be2c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0050ba91
add esp, 0x14
push esi
call fcn.0050b770
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x51be71
push esi
call fcn.0050b770
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x5ca1ec
push 0x5598b4
sub ecx, eax
push ecx
push eax
call fcn.005267f5
add esp, 0x14
test eax, eax
je 0x51be71
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0050ba91
add esp, 0x14
jmp 0x51be73
xor esi, esi
push 0x5598b0
push ebx
push ebp
call fcn.005215dc
add esp, 0xc
test eax, eax
je 0x51be93
push esi
push esi
push esi
push esi
push esi
call fcn.0050ba91
add esp, 0x14
push dword [edi*8 + 0x5916cc]
push ebx
push ebp
call fcn.005215dc
add esp, 0xc
test eax, eax
je 0x51beb5
push esi
push esi
push esi
push esi
push esi
call fcn.0050ba91
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00528f12
add esp, 0xc
jmp 0x51befd
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x51befd
cmp ebp, 0xffffffff
je 0x51befd
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x5916cc]
push dword [esi]
call fcn.0050b770
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x51fa06
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x51fa33
call fcn.0050fb89
mov dword [eax], esi
call fcn.0050fb76
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0050bb8d
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x51fa0f
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x51fa62
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0050fb9c
pop ecx
call fcn.0050fb76
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x51fa89
test al, 1
je 0x51fa89
test byte [esp + 0xc], 2
je 0x51fa89
call fcn.0050fb89
mov dword [eax], 5
call fcn.0050fb76
mov dword [eax], 0xd
jmp 0x51fa59
xor eax, eax
pop esi
ret
Function at 0x401037
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
mov eax, dword [0x44f368]
push ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [0x44f36c]
push esi
mov esi, dword [edx + 4]
xor ebx, ebx
mov dword [ebp - 0x24], eax
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
call fcn.00401030
mov eax, dword [0x44f370]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [0x44f374]
add edi, 0x23f
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, dword [ebp - 0xc]
shl eax, 4
cmp dword [0x1a3ff24], 0xc
mov dword [ebp - 4], eax
jne 0x4010c2
push ebx
lea eax, [ebp - 0x34]
push eax
push ebx
lea eax, [ebp - 0x438]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [0x1a3ff24]
cmp eax, 0xfa9
jne 0x4010de
mov dword [0x1a3ff20], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010f9
push ebx
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov edx, dword [ebp + 8]
mov dword [0x1a3fe74], ebx
mov eax, dword [ebp - 0xc]
add eax, edi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [0x1a3ff1c], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x14]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
lea eax, [edi + esi]
mov dword [ebp - 0x18], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
add edi, 0x61c88647
dec dword [ebp - 0x20]
jne 0x40108b
mov eax, dword [ebp - 0xc]
pop edi
mov dword [edx + 4], esi
pop esi
mov dword [edx], eax
pop ebx
leave
ret 4
Function at 0x4057ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e788]
jne 0x4057c4
repz ret
jmp fcn.0040938f

Function at 0x408c7a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004058bc
and dword [ebp - 4], 0
cmp dword [0x4583bc], 0
mov ebx, eax
jne 0x408d2b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408ddc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408ddc
push eax
call fcn.0040584a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4583bc], eax
call esi
push eax
call fcn.0040584a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4583c0], eax
call esi
push eax
call fcn.0040584a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4583c4], eax
call esi
push eax
call fcn.0040584a
pop ecx
mov dword [0x4583cc], eax
test eax, eax
je 0x408d2b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040584a
pop ecx
mov dword [0x4583c8], eax
mov eax, dword [0x4583c8]
cmp eax, ebx
je 0x408d83
cmp dword [0x4583cc], ebx
je 0x408d83
push eax
call fcn.004058c5
push dword [0x4583cc]
mov esi, eax
call fcn.004058c5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408d83
test edi, edi
je 0x408d83
call esi
test eax, eax
je 0x408d7a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408d7a
test byte [ebp - 0xc], 1
jne 0x408d83
or dword [ebp + 0x10], 0x200000
jmp 0x408dbc
mov eax, dword [0x4583c0]
cmp eax, ebx
je 0x408dbc
push eax
call fcn.004058c5
pop ecx
test eax, eax
je 0x408dbc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408dbc
mov eax, dword [0x4583c4]
cmp eax, ebx
je 0x408dbc
push eax
call fcn.004058c5
pop ecx
test eax, eax
je 0x408dbc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4583bc]
call fcn.004058c5
pop ecx
test eax, eax
je 0x408ddc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408dde
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401160
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x4011be
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x401180
mov eax, dword [edi]
jmp 0x4012a9
cmp eax, 0x4e0
jb 0x4012a9
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4011e0
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x401230
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401320
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x13a8
call fcn.004365d0
mov eax, dword [0x44000c]
xor eax, esp
mov dword [esp + 0x13a4], eax
push esi
push edi
lea ecx, [esp + 0x10]
movss dword [esp + 0x1c], xmm0
call fcn.00401000
mov dword [esp + 0x13a4], 0xffffffff
mov ecx, 1
mov edx, dword [eax]
mov dword [esp + 0x24], edx
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [esp + ecx*4 + 0x24], edx
inc ecx
cmp ecx, 0x270
jb 0x401365
mov dword [esp + 0x20], 0x270
nop dword [eax]
lea ecx, [esp + 0x20]
call fcn.00401ef0
mulss xmm0, dword [0x43cd50]
lea ecx, [esp + 0x20]
subss xmm0, dword [0x43cd24]
movss dword [esp + 8], xmm0
call fcn.00401ef0
movss xmm4, dword [0x43cd24]
movaps xmm2, xmm0
mulss xmm2, dword [0x43cd50]
movss xmm0, dword [esp + 8]
movaps xmm3, xmm0
subss xmm2, xmm4
mulss xmm3, xmm0
movaps xmm1, xmm2
movss dword [esp + 0x10], xmm2
mulss xmm1, xmm2
addss xmm3, xmm1
comiss xmm4, xmm3
movss dword [esp + 0xc], xmm3
jbe 0x401390
xorps xmm1, xmm1
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jnp 0x401390
ucomiss xmm2, xmm1
lahf
test ah, 0x44
jnp 0x401390
comiss xmm3, dword [0x43ccb0]
jbe 0x40142a
cvtps2pd xmm0, xmm3
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_log_precise
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
jmp 0x4014ce
andps xmm2, xmmword [0x43d200]
andps xmm0, xmmword [0x43d200]
maxss xmm2, xmm0
push ecx
movss dword [esp], xmm2
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ilogbf]
movss xmm1, dword [esp + 0xc]
mov edi, eax
add esp, 4
mov esi, edi
neg esi
push esi
push ecx
movss dword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_scalbnf]
movss xmm0, dword [esp + 0x18]
add esp, 8
fstp dword [esp + 0xc]
push esi
push ecx
movss dword [esp], xmm0
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_scalbnf]
movss xmm0, dword [esp + 0x14]
add esp, 8
movaps xmm1, xmm0
movss dword [esp + 8], xmm0
mulss xmm1, xmm0
fstp dword [esp + 0x10]
movss xmm0, dword [esp + 0x10]
mulss xmm0, xmm0
addss xmm1, xmm0
cvtps2pd xmm0, xmm1
movss dword [esp + 0xc], xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_log_precise
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movd xmm0, edi
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x43cd38]
addss xmm1, xmm0
mulss xmm1, dword [0x43cdf0]
divss xmm1, dword [esp + 0xc]
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm1, xmm0
ja 0x4014ee
sqrtsd xmm0, xmm0
jmp 0x4014f3
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
mov ecx, dword [esp + 0x13ac]
cvtsd2ss xmm0, xmm0
pop edi
pop esi
xor ecx, esp
mulss xmm0, dword [esp]
mulss xmm0, dword [0x43cd94]
addss xmm0, dword [esp + 0x14]
call fcn.00435571
mov esp, ebp
pop ebp
ret
Function at 0x402e30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436910
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push 0x2c
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
push 0
push edi
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call sub.VCRUNTIME140.dll_memset
lea esi, [edi + 0x3c]
add esp, 0xc
mov dword [ebp - 0x18], esi
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [esi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
jns 0x402f5b
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
mov dword [ebp - 0x14], ecx
cmp ecx, dword [esi + 0x14]
jle 0x402f5b
shl ecx, 2
call fcn.00408750
mov edx, dword [esi + 0x18]
mov dword [ebp - 0x10], eax
test edx, edx
je 0x402f52
mov ecx, dword [esi + 0x10]
shl ecx, 2
push ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x18]
add esp, 0xc
call fcn.004087f0
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], 0
xorps xmm0, xmm0
mov dword [esi + 0x2c], 0
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x30], 0
mov ecx, dword [esi + 0x30]
mov dword [esi + 0x24], eax
mov dword [esi + 0x1c], eax
mov eax, edi
mov dword [esi + 0x28], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x34], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x84], 0
movups xmmword [edi + 0x74], xmm0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0x30], 0xffffffff
mov dword [edi + 0x2c], 0xffffffff
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4053c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x40540c
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x4053ef
cmp edi, 2
jb 0x4053ef
cmp byte [esi], cl
jne 0x4053ef
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x438600]
test edi, edi
jne 0x4053d5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x40543b
cmp cl, 0x23
jne 0x405422
cmp byte [esi], cl
jne 0x405422
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x438600]
test cl, cl
jne 0x405413
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x405580
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x405593
mov dword [edi], 0
mov edx, 0x4381fc
call fcn.00405450
mov esi, eax
test esi, esi
je 0x40564b
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x405641
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x405641
push esi
call ebx
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x405641
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x405641
mov ecx, ebx
call fcn.00408750
mov dword [ebp + 8], eax
test eax, eax
je 0x405641
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x40562a
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [ebp + 8]
add esp, 4
call fcn.004087f0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x405639
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret