joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dfde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40dfed
pop dword [ebp - 0x40]
mov eax, 0x40dfed
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x37f9c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x44809620
sub ecx, 0x448048f0
xor esi, esi
add esi, eax
mov edi, 0xa16b0ef6
add edi, 0x5ed9270a
add edi, dword [ebp - 0x40]
mov edx, 0x256d2280
mov dword [ebp - 0x24], 0xf735a9d
mov ebx, dword [edi]
xor dword [ebp - 4], 0x81fe120b
add ebx, edx
sub dword [ebp - 0x34], esi
mov dword [esi], ebx
sub dword [ebp - 0x38], 0xa3450a78
add esi, 0x9eb97b52
sub esi, 0x9eb97b4e
add edi, 0xe17f75d8
sub edi, 0xe17f75d4
loop 0x40e03e
add eax, 0x880d1d43
add eax, 0x77f40a50
mov ebx, eax
add eax, 0xa035ffe4
add eax, 0x5fca0021
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b030]
jne 0x401116
repz ret
jmp fcn.00401b11

Function at 0x408edc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004047d5
and dword [ebp - 4], 0
cmp dword [0x42d78c], 0
mov ebx, eax
jne 0x408f8d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40903e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40903e
push eax
call fcn.00404763
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42d78c], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42d790], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42d794], eax
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x42d79c], eax
test eax, eax
je 0x408f8d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x42d798], eax
mov eax, dword [0x42d798]
cmp eax, ebx
je 0x408fe5
cmp dword [0x42d79c], ebx
je 0x408fe5
push eax
call fcn.004047de
push dword [0x42d79c]
mov esi, eax
call fcn.004047de
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408fe5
test edi, edi
je 0x408fe5
call esi
test eax, eax
je 0x408fdc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408fdc
test byte [ebp - 0xc], 1
jne 0x408fe5
or dword [ebp + 0x10], 0x200000
jmp 0x40901e
mov eax, dword [0x42d790]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40901e
mov eax, dword [0x42d794]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42d78c]
call fcn.004047de
pop ecx
test eax, eax
je 0x40903e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409040
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b0e0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x42b030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2ae61cc]
push ebx
mov ebx, dword [0x2ae5eec]
push esi
mov esi, dword [0x42bf60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b121
push str.lefovuweceh
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2ae61cc]
mov dword [0x2ae5ee8], esi
cmp eax, 0x114e
jne 0x40b14b
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.durinarusunavabaxomoyowev
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2ae61cc]
cmp eax, 0x2f
jne 0x40b16d
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040b050
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret
Function at 0x40c9dd
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b558]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a033
mov dword [ebp - 0x14], eax
cmp dword [0x4b4058], esi
jne 0x40cad0
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40ca5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40cbb0
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40cbb0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cbb0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4b4058], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4b405c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4b4060], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b4068], eax
test eax, eax
je 0x40cacd
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b4064], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40caf5
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40cae8
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40cb0a
push 4
pop eax
jmp 0x40cbb2
cmp dword [ebp - 0x14], esi
je 0x40cb0a
push dword [0x4b4058]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40caef
mov eax, dword [0x4b4064]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40cb68
cmp dword [0x4b4068], edi
je 0x40cb68
push eax
call ebx
push dword [0x4b4068]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40cb68
test eax, eax
je 0x40cb68
call ecx
test eax, eax
je 0x40cb5d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40cb5d
test byte [ebp - 8], 1
jne 0x40cb68
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40cb98
mov eax, dword [0x4b405c]
cmp eax, edi
je 0x40cb95
push eax
call ebx
test eax, eax
je 0x40cb95
call eax
mov esi, eax
test esi, esi
je 0x40cb95
mov eax, dword [0x4b4060]
cmp eax, edi
je 0x40cb95
push eax
call ebx
test eax, eax
je 0x40cb95
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4b4058]
call ebx
test eax, eax
je 0x40cbb0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40cbb2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004044c0
mov esp, ebp
pop ebp
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x4263004d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data_1
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x5059017b
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x414838
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44ec90]
jne 0x414842
repz ret
jmp fcn.0041a6eb

Function at 0x41c76c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x41c77b
pop dword [ebp - 8]
mov eax, 0x94aa20aa
add eax, 0x6b97a6d1
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x49594
push 0
mov eax, 0x1b9fa09c
add eax, 0xe4a421bc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xb5ce6621
add ecx, 0x4a31d15b
xor edx, edx
add edx, eax
mov ebx, 0x98fbe4cb
sub ebx, 0x98b532cb
add ebx, dword [ebp - 8]
mov edi, 0xaf927dbc
xor dword [ebp - 4], ebx
mov esi, dword [ebx]
xor dword [ebp - 4], edx
xor esi, edi
mov dword [edx], esi
xor dword [ebp - 4], 0x4106008d
add edx, 0xe1994767
sub edx, 0xe1994763
add ebx, 0xee25e6b8
add ebx, 0x11da194c
loop 0x41c7d6
add eax, 0xd683c9d2
sub eax, 0xd682f90f
mov ebx, eax
add eax, 0xf7f76173
add eax, 0x8089e92
mov ecx, 0xe8b2a31e
sub ecx, 0xe872a31e
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406ac2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x406ad1
pop dword [ebp - 0xc]
mov eax, 0x406ad1
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x34177b45
add dword [ebp - 0x1c], 0x1a3aca06
mov dword [ebp - 0x18], 0xe1bf89a7
sub dword [ebp - 0x18], 0xaf8c3d62
mov dword [ebp - 0x14], 0xd009f8a2
add dword [ebp - 0x14], 0x7c424b8c
mov dword [ebp - 0x10], 0x60630d95
add dword [ebp - 0x10], 0x9f9cf26b
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x5e4edf94
add dword [ebp - 0x1c], 0x162389c2
mov dword [ebp - 0x18], 0x462b35bb
sub dword [ebp - 0x18], 0x4bed446
mov dword [ebp - 0x14], 0x674d350b
sub dword [ebp - 0x14], 0x3ddc89f
mov dword [ebp - 0x10], 0x958558f4
add dword [ebp - 0x10], 0x6a7aa70c
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xca169e4f
sub eax, 0xc9d5ce03
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3be5a
push 0
call eax
mov ecx, 0x1a73201
add ecx, 0xfe591e6e
xor edx, edx
add edx, eax
mov edi, 0xeac92e48
sub edi, 0xea877e48
add edi, dword [ebp - 0xc]
mov esi, 0x6d0dc861
add esi, 0x695809b8
add dword [ebp - 8], esi
mov ebx, dword [edi]
sub dword [ebp - 4], 0x6901bbed
add ebx, esi
add dword [ebp - 4], 0xb0ce3b54
mov dword [edx], ebx
xor dword [ebp - 4], ecx
add edx, 4
add edi, 0x3fa31fef
add edi, 0xc05ce015
loop 0x406beb
add eax, 0x1348f
mov ebx, eax
add eax, 0x841c14b4
sub eax, 0x841c14af
mov ecx, 0x69e6cb36
sub ecx, 0x69a6cb36
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x3001e5e1
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
cmp ecx, edx
jb 0x3001e602
mov eax, dword [eax + 8]
cmp ecx, eax
jb 0x3001e602
cmp edx, eax
jb 0x3001e602
add eax, 0x10000
cmp eax, ecx
jae 0x3001e62d
mov eax, dword [0x30036514]
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push 0x35636561
call fcn.30025a12
push 0
push 0
push 1
push 0xe0000001
call dword [sym.imp.kernel32.dll_RaiseException]
ret

Function at 0x30025a12
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x30025a21
pop dword [ebp - 0x28]
mov eax, 0xe4f71939
add eax, 0x4b0b40e8
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x39b6d
push 0
mov eax, 0x82657c3c
sub eax, 0x52656b38
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x4115
mov edx, eax
mov ebx, 0x532ca1b
add ebx, 0x2ad445e5
add ebx, dword [ebp - 0x28]
mov esi, 0x3b7522bd
sub esi, 0xac2be8d5
sub dword [ebp - 0xc], 0x29d86ec2
mov edi, dword [ebx]
xor dword [ebp - 0x20], 0x14ee6de0
xor edi, esi
xor dword [ebp - 0x24], 0x70bc5afd
mov dword [edx], edi
xor dword [ebp - 0x20], 0xb53c2155
add edx, 0x5eb7b338
sub edx, 0x5eb7b334
add ebx, 0x3b514b4e
add ebx, 0xc4aeb4b6
loop 0x30025a7a
add eax, 0x43bd5bdb
add eax, 0xbc439b4c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x30000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x300320dd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3001c404]
jne 0x30032809
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x3006bc60], eax
mov dword [0x3006bc5c], ecx
mov dword [0x3006bc58], edx
mov dword [0x3006bc54], ebx
mov dword [0x3006bc50], esi
mov dword [0x3006bc4c], edi
mov word [0x3006bc78], ss
mov word [0x3006bc6c], cs
mov word [0x3006bc48], ds
mov word [0x3006bc44], es
mov word [0x3006bc40], fs
mov word [0x3006bc3c], gs
pushfd
pop dword [0x3006bc70]
mov eax, dword [ebp]
mov dword [0x3006bc64], eax
mov eax, dword [ebp + 4]
mov dword [0x3006bc68], eax
lea eax, [ebp + 8]
mov dword [0x3006bc74], eax
mov eax, dword [ebp - 0x320]
mov dword [0x3006bbb0], 0x10001
mov eax, dword [0x3006bc68]
mov dword [0x3006bb64], eax
mov dword [0x3006bb58], 0xc0000409
mov dword [0x3006bb5c], 1
mov eax, dword [0x3001c404]
mov dword [ebp - 0x328], eax
mov eax, dword [0x30067144]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x3006bba8], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x3001c424
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x3006bba8], 0
jne 0x300328f9
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x30032398
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x30033f10
call fcn.3003260e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x3006be98
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x30032188
cmp eax, esi
jne 0x3003217b
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x3003218b
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x30032162
xor esi, esi
inc esi
mov eax, dword [0x3006be94]
cmp eax, esi
jne 0x3003219e
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x300321d9
mov eax, dword [0x3006be94]
test eax, eax
jne 0x300321d3
mov dword [0x3006be94], esi
push 0x3000130c
push 0x30001300
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x300321d9
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x300322b0
mov dword [0x3006bb50], esi
mov eax, dword [0x3006be94]
cmp eax, esi
jne 0x300321fd
push 0x300012fc
push 0x300012e4
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x3006be94], 2
cmp dword [ebp - 0x1c], ebx
jne 0x3003220a
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x3006bea4], ebx
je 0x3003222b
push 0x3006bea4
call fcn.300329cc
pop ecx
test eax, eax
je 0x3003222b
push ebx
push 2
push ebx
call dword [0x3006bea4]
mov eax, dword [0x3006bb38]
mov ecx, dword [sym.imp.MSVCR80.dll___winitenv]
mov dword [ecx], eax
push dword [0x3006bb38]
push dword [0x3006bb3c]
push dword [0x3006bb34]
call fcn.30025a12
add esp, 0xc
mov dword [0x3006bb4c], eax
cmp dword [0x3006bb40], ebx
jne 0x30032296
push eax
call dword [sym.imp.MSVCR80.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR80.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x3006bb50], ebx
jne 0x300322a4
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3006bb4c]
call fcn.30032653
ret
call fcn.30025a12
jmp 0x30032140
Function at 0x40506c
Capabilities:
Read file on windows

Disassembly:
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x43ddf6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425812
add esp, 0x10
invalid
Function at 0x415e58
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x415e80
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x415e72
pop edi
pop esi
pop ebp
ret 4

Function at 0x45b15d
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x7ebf700
push ds
je 0x45b174
xchg ebp, eax
rcr byte [ebp - 0x3e], 0x10
add byte [ebp - 0x75], dl
in al, dx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor ecx, 0x3b
aas
int1
cmp esi, ebx
aas
and ax, cx
mov ecx, 0xf8e85700
scasd eax, dword es:[edi]
sti
dec dword [ebx + 0x46a0843]
pop ecx
cmp dword [esi + 0xc], eax
jae 0x45b1c8
push 8
pop edx
cmp eax, edx
jb 0x45b197
mov edx, eax
mov dword [esi + 0xc], edx
xor ecx, ecx
mov eax, edx
push 4
pop edx
dec dword [ebx - 0x720003e9]
mov ecx, eax
mov dword [ebp - 0x20], ecx
insd dword es:[edi], dx
pop esi
xor esi, esi
movd dword [eax + eax], mm0
mov edi, eax
pop ecx
je 0x45b1c2
add al, 0xf
add al, 0xe8
rcr byte [esi + 0x74], cl
or al, 0xff
push 4
mov dword [esi + 4], edi
pop ecx
mov eax, dword [ebx + 8]
xor ecx, ecx
invalid

Function at 0x45da2f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x14
mov edi, ecx
call 0x33db101d
and al, 0x59
or dh, dh
je 0x45da58
and dword [esi + 4], 0x47
and dword [esi + 8], 0
and dword [esi + 0xc], 0
mov dword [esi], 0x48fb84
pop es
xor eax, 0xbdc0f6fc
cld
test al, 0xbd
or byte [ebx + 0x1e81066], al
jno 0x45da4c
inc ebx
hlt

Function at 0x45fcb1
Capabilities:
Encode data using xor

Disassembly:
adc edi, esp
push es
add dword [ebx], esi
xor eax, eax
inc ebp
sub byte [eax], cl
les ebx, ss:[eax + 0x3e048966]
test ecx, ecx
jle 0x45fccf
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x45fcc6
jmp 0x5ba45c9b

Function at 0x46000d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sbb byte [ebp - 0x5eeb8737], al
lodsb al, byte [esi]
jb 0x460062
je 0x460017
push dword [eax + ecx*4]
xor al, 0x88
mov ecx, dword [ebp + 0xc]
call 0x364081ce
mov al, 1
jmp 0x460030
pop ebp
ret 8
mov bh, 0x34
inc edx
push 0x22
pop ecx
cmp si, cx
je 0x460075
push 0x27
pop ecx
cmp si, cx
jne 0x46007b
mov byte [ebp + 0xb], 1
jmp 0x46008a
cmp esi, 0x3c
jne 0x53c0c8c
push 0x3e
pop ecx
mov byte [ebp + 0xb], bl
sub eax, 0xffffffa4
inc eax
mov dword [ebp - 4], ebx
movzx edi, word [edx + eax*2]
cmp di, cx
je 0x4600b3
test di, di
je 0x4600ae
mov word [esi + ebx*2], di
inc ebx
inc eax
movzx edi, word [edx + eax*2]
cmp di, cx
jne 0x46009a
mov dword [ebp - 4], ebx
sub al, 0xdb
cmp word [edx + eax*2], cx
jne 0xd9ea8c
push 0x20
pop edi
inc eax
movzx ecx, word [edx + eax*2]
cmp cx, di
je 0x4600c0
cmp cx, word [ebp - 0xc]
je 0x4600c0
movzx eax, word [edx + eax*2]
push 0x1b
pop ebx
jmp 0x3c3e83e5
Function at 0x4617fe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
test byte [ecx + 0xc], 4
je 0x461841
inc eax
inc ebp
or byte [ebx], dh
leave
and dword [ebp - 0x10], 0
inc ecx
and dword [ebp - 0xc], 0
movzx eax, al
mov word [0x66c08be8], bx
movzx eax, al
mov word [0x10458bea], bx
cmovne ebp, esp
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push ecx
mov dword [ebp - 0x1c], ecx
call dword [0x7ebf5ec]
jmp 0x461852
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
sar byte [ebp - 0x17ea3ff8], 0xf5
jmp 0x461859
mov esp, ebp
pop ebp
ret 0x10
mov ebp, esp
push esi
mov esi, ecx
xor ebx, dword [eax - 0x77]
inc esi
add al, 0x88
inc esi
or cl, byte [ebx + 0x6c70845]
dec esp
add al, byte ss:[eax]
mov word [esi + 8], ax
or al, al
dec ebp
add al, 0x32
shr bl, 0x45
push eax
sal byte [eax], 0
adc bl, ch
pop es
movzx eax, ax
jge 0x461881
xor al, al
jmp 0x4618c1
jmp 0x46188a
push dword [esp + ebp*8 + 0x53]
je 0x461878
push ebx
mov ebx, eax
mov byte [esi], al
push 0
movzx eax, al
push eax
sar ebx, 8
rcl byte [0x7eb108c], 0x88
inc esi
pop es
test bl, 1
je 0x4618ac
mov byte [esi + 1], 1
test bl, 2
je 0x4618b5
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x4618bf
mov byte [esi + 4], 1
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x462593
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov ebx, ecx
push 8
mov dword [ebp - 4], ebx
call fcn.00461bac
cmp byte [ebp + 0x10], 0
jne 0x4625c8
lea eax, [ebx + 0x68]
mov ecx, ebx
call 0x86561e87
test eax, eax
add eax, 0xcbdc00f
lea edi, [eax + 0x20]
mov ecx, dword [edi]
call fcn.00409ec3
jmp 0x462623
push esi
push 0x28
call 0x3442101d
and al, 0x59
or dh, dh
je 0x4625e1
lea ecx, [esi + 4]
call fcn.004077ee
pop es
dec esi
add al, 0xe8
rsqrtps xmm7, xmm2
inc dword [edi]
xor eax, 0xbdc0f6fc
cld
test al, 0xbd
or byte [ebp + 0x6c7044e], cl
cmp dword [esi + 2], edx
jne 0x4625d8
ficomp dword [ebx - 6]
jmp [edx + 0x10]
mov eax, dword [edi]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x468a98
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4c4190]
jne 0x468aaa
call 0x10e7d3a
mov eax, dword [0x4c7ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c7ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0x8508df8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x468aed
fadd qword [0x4bbac8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4bbaa0]
mov esp, ebp
pop ebp
ret
Function at 0x4693ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x374dc
lea ecx, [ebp - 0x79f000dc]
push esi
push edi
call 0x36079210
mov dword [ebp + 0x10], ecx
lea ecx, [ebp - 0x79f000dc]
call 0x8a379256
jne 0x4693d6
dec dword [edi]
xchg al, ch
js 0x4693da
invalid
cmp dword [ebp + 0xc], esi
jbe 0x4693fe
mov edi, dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0x79f000dc]
call 0x8656938e
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x4693e8
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4089fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x408a0a
pop dword [ebp - 0x3c]
mov eax, 0x71ee0779
sub eax, 0x71ad7d6f
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x39f28
push 0
mov eax, 0x8bb01f6a
sub eax, 0x8b700e4a
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0xa4056666
sub ecx, 0xa40521ba
mov esi, eax
mov edi, 0x427600
add edi, dword [ebp - 0x3c]
mov edx, 0xe30976ef
add dword [ebp - 4], eax
mov ebx, dword [edi]
add dword [ebp - 0x30], 0xcb78c81c
sub ebx, edx
mov dword [ebp - 0x30], 0x78bdffdd
mov dword [esi], ebx
xor dword [ebp - 0x34], ebx
add esi, 0x934553a
sub esi, 0x9345536
add edi, 0xc52914fd
sub edi, 0xc52914f9
loop 0x408a5d
add eax, 0xcb8def58
add eax, 0x3473162b
mov ebx, eax
add eax, 0xd11d335c
sub eax, 0xd11d3357
mov ecx, 0x4615ce5c
add ecx, 0xba2a31a4
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x410f5c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42104c]
jne 0x413fe3
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x422720], eax
mov dword [0x42271c], ecx
mov dword [0x422718], edx
mov dword [0x422714], ebx
mov dword [0x422710], esi
mov dword [0x42270c], edi
mov word [0x422738], ss
mov word [0x42272c], cs
mov word [0x422708], ds
mov word [0x422704], es
mov word [0x422700], fs
mov word [0x4226fc], gs
pushfd
pop dword [0x422730]
mov eax, dword [ebp]
mov dword [0x422724], eax
mov eax, dword [ebp + 4]
mov dword [0x422728], eax
lea eax, [ebp + 8]
mov dword [0x422734], eax
mov eax, dword [ebp - 0x320]
mov dword [0x422670], 0x10001
mov eax, dword [0x422728]
mov dword [0x422624], eax
mov dword [0x422618], 0xc0000409
mov dword [0x42261c], 1
mov eax, dword [0x42104c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x421050]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x422668], eax
push 1
call fcn.00415efd
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x402cf0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x422668], 0
jne 0x4140cf
push 1
call fcn.00415efd
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret