joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x407ef8
mov ecx, 0xb3e7cdf
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section._RDATA
mov ebx, 0x42cd70
nop
mov ecx, 0x6e8c2dda
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4010f3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c20c1]
push ebx
push esi
push edi
mov esi, ecx
push 0x8000
push esi
mov edi, edx
mov byte [ebp - 1], al
call fcn.00424013
pop ecx
push eax
call fcn.00423e45
pop ecx
pop ecx
push 0xb
mov ecx, edi
mov ebx, eax
call fcn.0040d31c
test al, al
jne 0x475723
lea ecx, [ebp - 0x18]
call fcn.0040a76e
mov ecx, edi
call fcn.004085d8
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.0040121a
push dword [ebp - 0x18]
push 0x4afc3c
push esi
call fcn.0042420c
add esp, 0xc
cmp byte [ebp - 1], 0
mov dword [ebp - 8], eax
jne 0x475743
lea ecx, [ebp - 0x18]
call fcn.00407dce
mov edi, dword [ebp - 8]
push esi
call fcn.004243d1
pop ecx
cmp ebx, 0xffffffff
je 0x47575a
push ebx
push esi
call fcn.00424013
pop ecx
push eax
call fcn.00423e45
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
push esi
mov ecx, edi
call fcn.0044c9cf
push eax
push 1
call fcn.0044c986
push eax
call fcn.0042418e
add esp, 0x10
mov edi, eax
jmp 0x401173
mov ecx, edi
call fcn.004085d8
mov eax, dword [edi + 8]
push dword [eax]
call dword [0x48e22c]
jmp 0x401168
push 0x4000
jmp 0x401184
Function at 0x403c7d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x476431
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00424efe
add esp, 0x10
leave
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
mov edx, dword [ecx]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x403ca3
Function at 0x443afc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov ecx, dword [ebx]
push edi
mov edi, dword [ebp + 8]
lea eax, [ecx + 4]
mov esi, dword [ecx + edi]
mov dword [ebx], eax
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
mov dword [ebp + 8], esi
neg ecx
or ecx, eax
push ecx
call fcn.00420b6a
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
push esi
push ecx
mov edi, eax
push edi
call fcn.00420500
mov ecx, dword [ebp + 8]
add dword [ebx], esi
xor eax, eax
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x443b57
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x443b4e
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4486d3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, ecx
xor esi, esi
mov ebx, edx
mov dword [ebp - 4], eax
mov byte [0x4c44d9], 0
test edi, edi
je 0x448725
mov byte [0x4c44da], 1
call dword [0x48e178]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
push eax
xor ecx, ecx
push ecx
lea eax, [ebp - 0xc]
push eax
push 0x448b1b
push ecx
push ecx
mov dword [ebp - 8], edi
call fcn.004238aa
mov esi, eax
mov eax, dword [ebp - 4]
add esp, 0x18
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push eax
call dword [0x48e6d8]
or ebx, 0xffffffff
mov edi, eax
test esi, esi
je 0x448752
push ebx
push esi
mov byte [0x4c44da], 0
call dword [0x48e164]
push esi
call dword [0x48e1fc]
cmp byte [0x4c44d9], 1
cmove edi, ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44ca19
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4c07e0]
jne 0x44ca26
call fcn.0044caf9
mov eax, dword [0x4c44f0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c44f0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x44ca5e
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4c07e0]
jne 0x44ca6b
call fcn.0044caf9
mov eax, dword [0x4c44f0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c44f0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4b7590]
mulsd xmm0, qword [0x4b7540]
ret

Function at 0x44cabd
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
inc esi
mov dword [0x4c44f8], ecx
mov edx, esi
mov ecx, 0x4c44f8
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
add ecx, 4
imul eax, eax, 0x6c078965
add eax, edx
mov dword [ecx], eax
inc edx
cmp ecx, 0x4c4eb4
jl 0x44cace
mov dword [0x4c07e0], esi
mov dword [0x4c44e4], esi
pop esi
ret
Function at 0x44caf9
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c44e4], 0
push ebx
push esi
push edi
mov esi, 0x4c44f8
jne 0x44cb19
push 0
call fcn.00424b2a
pop ecx
mov ecx, eax
call fcn.0044cabd
mov dword [0x4c07e0], 0x270
mov dword [0x4c44f0], esi
mov edi, 0xe3
mov ebx, 0x9908b0df
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and ecx, ebx
and eax, 0x7ffffffe
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi], eax
mov esi, edx
dec edi
jne 0x44cb33
mov edi, 0x18c
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and ecx, ebx
and eax, 0x7ffffffe
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, ecx
mov dword [esi], eax
lea esi, [edx]
dec edi
jne 0x44cb64
mov ecx, dword [0x4c44f8]
mov al, cl
and al, 1
movzx edx, al
mov eax, dword [esi]
neg edx
sbb edx, edx
xor eax, ecx
and eax, 0x7ffffffe
xor eax, dword [esi]
and edx, ebx
shr eax, 1
xor eax, dword [esi - 0x38c]
pop edi
xor eax, edx
mov dword [esi], eax
pop esi
pop ebx
ret

Function at 0x44d015
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x44d03a
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
push 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.00420500
add esp, 0xc
jmp 0x44d04d
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.00424efe
add esp, 0x10
movzx ecx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
add dword [esi + 0xc], 8
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 1]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 8]
push str.509f
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
mov byte [ebp - 4], 0
call fcn.00424fb0
pop ecx
neg eax
pop ecx
sbb eax, eax
neg eax
pop esi
leave
ret 4

Function at 0x44d121
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x10000
mov eax, dword [esi + 0x464]
test eax, eax
je 0x44d137
cmp eax, ecx
jne 0x44d152
push dword [esi + 0x1c]
push ecx
push 1
push dword [esi + 0x45c]
call fcn.00424efe
add esp, 0x10
and dword [esi + 0x464], 0
mov ecx, dword [esi + 0x464]
mov eax, dword [esi + 0x45c]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 0x464], ecx
pop esi
ret

Function at 0x44d16a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x460]
mov esi, dword [edi + 0x458]
mov byte [esi + edx], al
inc dword [edi + 0x460]
mov eax, 0x10000
cmp dword [edi + 0x460], eax
jne 0x44d1b1
push dword [edi + 0x20]
push eax
push 1
push dword [edi + 0x458]
call fcn.0042418e
add esp, 0x10
and dword [edi + 0x460], 0
pop edi
pop esi
pop ebp
ret 4
Function at 0x44d1b7
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x460]
test eax, eax
je 0x44d1df
push dword [esi + 0x20]
push eax
push 1
push dword [esi + 0x458]
call fcn.0042418e
add esp, 0x10
and dword [esi + 0x460], 0
pop esi
ret

Function at 0x44d397
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
lea ecx, [ebp - 0xdc]
push esi
push edi
call fcn.0044d1e1
push dword [ebp + 0x10]
lea ecx, [ebp - 0xdc]
call fcn.0044d22d
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x44d3db
mov edi, dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.0044d36b
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x44d3c5
pop edi
pop esi
leave
ret 0xc
Function at 0x4560ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0x30], 0
je 0x4560bc
pop ebp
jmp fcn.0045617b
pop ebp
jmp fcn.004560c2

Function at 0x456485
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0xd0], 0
je 0x4564c2
cmp byte [ebp + 8], 0
je 0x4564c2
sub esp, 0x10
lea ecx, [esi + 0xd4]
call fcn.004554f0
push esi
push 0
push 0x456553
call fcn.004255ad
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], eax
sete al
jmp 0x4564ca
push dword [ebp + 8]
call fcn.004556c2
pop esi
pop ebp
ret 4

Function at 0x45adf1
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
add eax, esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov ebx, eax
imul ebx, dword [ebp + 0x14]
lea eax, [esi + eax*4]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x14]
or edx, 0xffffffff
shl ebx, 2
shl eax, 2
push edi
mov dword [ebp + 0xc], eax
mov edi, esi
movzx eax, byte [esi + 2]
movzx ecx, dl
xor ecx, eax
movzx eax, byte [esi + 1]
shr edx, 8
xor edx, dword [ecx*4 + 0x4c0b70]
movzx ecx, dl
xor ecx, eax
movzx eax, byte [esi]
shr edx, 8
xor edx, dword [ecx*4 + 0x4c0b70]
add esi, ebx
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4c0b70]
cmp esi, dword [ebp + 8]
jb 0x45ae66
add edi, dword [ebp + 0xc]
mov esi, edi
cmp edi, dword [ebp + 0x10]
jb 0x45ae22
not edx
movd xmm0, edx
cvtdq2pd xmm0, xmm0
pop edi
shr edx, 0x1f
pop esi
addsd xmm0, qword [edx*8 + 0x4b7590]
pop ebx
pop ebp
ret 0x10
Function at 0x4032fa
Capabilities:
Packed with generic packer

Disassembly:
pop esi
mov esp, ebp
pop ebp
ret 4
ror dword [edi], 1
mov dh, 0xc1
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x78]
test ecx, ecx
jne 0x40335e
mov eax, dword [esi + 0x7c]
cmp eax, 0xb
jg 0x43d1ff
je 0x43d1e5
sub eax, 5
je 0x40336a
sub eax, 3
je 0x43d1c8
dec eax
dec eax
je 0x43d1ae
and dword [esi + 0x70], 0
lea ecx, [esi + 0x54]
mov dword [esi + 0x7c], 1
call fcn.00405a64
lea ecx, [esi + 0x24]
call fcn.00405a64
push ecx
call fcn.00407b3d
and dword [esi + 0x78], 0
jmp 0x403305
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x40332d
push ecx
call fcn.00408e34
jmp 0x40332d
xor edi, edi
mov dword [esi], 0x48f914
cmp dword [esi + 8], edi
jbe 0x4034b2
mov eax, dword [esi + 4]
push dword [eax + edi*4]
call fcn.0042106c
mov eax, dword [esi + 4]
pop ecx
and dword [eax + edi*4], 0
inc edi
cmp edi, dword [esi + 8]
jb 0x403499
push dword [esi + 4]
and dword [esi + 8], 0
call fcn.0042106c
pop ecx
pop edi
pop esi
ret
cmp ax, word [0x4c6274]
jne 0x403239
jmp 0x403217
popal
cld
dec dword [ebp + 0x2eb084f]
mov ecx, edi
call int.00405a76
push edi
jmp 0x43d1f0
jbe 0x43d257
call dword [0x48f45c]
push dword [esi + 0x70]
call fcn.0042107e
jmp 0x43d20b
invalid
pop ecx
jmp 0x40333f
call dword [ecx - 0x18]
movsb byte es:[edi], byte [esi]
mov eax, dword [0xdce90001]
pushal
cld
dec dword [ebx - 0x3c74f7ba]
je 0x40348c
shl eax, 2
push eax
push dword [esi + 4]
push edi
call fcn.00421092
push dword [esi + 4]
call fcn.0042107e
call 0x22ce34c
invalid

Function at 0x409dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
sbb al, 0x8b
sar byte [ecx + 0xc], 0xa
je 0x409dcf
add byte cs:[eax], al
xor ecx, dword [eax + eax - 0x56]
stosb byte es:[edi], al
add dword [ebx + 0x8453b00], ecx
jne 0x409dc9
je 0x409e59
push esi
mov ebp, esi
or dh, byte [edi - 0x18]
Function at 0x4149d2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
add al, ch
sub esp, 0x61740150
push ebx
mov ebx, edx
adc eax, 0xd05d89c1
clc
cmp dword [ebp + 0x56], 0x57
test ebx, ebx
je 0x8d448211
mov eax, dword [ebx - 0x3bba38f0]
popal
je 0x414a5b
mov dword [ebp - 0x38], 0x61746164
mov eax, dword [esi]
mov ecx, dword [esi + 0x50]
mov dword [ebp - 0x24], ecx
cmp eax, dword [esi + 4]
jae 0x6145016a
mov edx, dword [ebp - 8]
inc eax
mov dword [esi], eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 8]
jae 0x44ca5405
cmp dword [esi + 0x7461649c], 2
je 0x61448242
push esp
inc ecx
popal
movzx eax, word [ebx + 2]
mov edi, ebx
add eax, eax
mov ecx, 0x390c4688
sub edi, eax
mov dword [ebp - 0x20], edi
movzx eax, word [edi]
cmp ax, cx
jae 0x448ed6
mov ecx, 0x10100081
cmp ax, cx
je 0x448ed6
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
cmp eax, 0x7d
jb 0x414aa5
mov dword [ebp - 0x14], 0x89180080
cmp ax, word [ebp - 0x14]
jbe 0x6144e4b1
mov dword [ebp - 0x14], 0x89180082
cmp ax, word [ebp - 0x14]
je 0x6144e4b1
mov dword [ebp - 0x14], 0x89180085
cmp ax, word [ebp - 0x14]
je 0x61b54e22
mov dword [ebp - 0x14], 0x8918008a
cmp ax, word [ebp - 0x14]
je 0x61b54e22
mov dword [ebp - 0x14], 0x89180086
cmp ax, word [ebp - 0x14]
je 0x61b54e22
mov dword [ebp - 0x14], 0x8918008b
cmp ax, word [ebp - 0x14]
je 0x617a4e22
movzx eax, word [ebx]
cmp eax, 0x78
jne 0x448f48
mov eax, 0x10100081
cmp word [edi], ax
je 0x6144e457
add ebx, 4
mov dword [ebp - 0x30], ebx
jmp 0x386331
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x14]
mov edx, dword [edx]
mov ecx, dword [ecx + 4]
mov dword [ebp + 0x14], edx
mov edx, dword [ebp - 8]
jmp 0x414a8c
cmp eax, 0x7b
je 0x44e48c
cmp dword [ebp - 8], ecx
jne 0x44e121
mov edx, dword [ebp - 8]
jmp 0x414b06
mov eax, dword [ebp + 0x18]
inc eax
cmp word [ebx], 0x7a
push eax
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
add byte [ebp + 8], dh
jne 0x44e190
mov edi, dword [ebp - 8]
lea edx, [ebx + 4]
mov ecx, edi
call fcn.004149d2
call 0xc3cff60c
jne 0x414b4f
mov ebx, dword [ebp - 0x20]
mov ecx, 0x81
movzx eax, word [ebx]
cmp ax, cx
je 0x44e3ed
mov ecx, 0x88
cmp ax, cx
jb 0x414b94
mov eax, dword [ebp + 0x18]
mov edx, ebx
inc eax
mov ecx, edi
push eax
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
add byte [ebp + 8], dh
call fcn.004149d2
call 0xc02df651
imul edi, esp, 0x8bd78bff
jge 0x44e18d
mov edx, edi
mov edi, dword [ebp - 8]
mov ecx, edi
call fcn.004149d2
call 0x1b81f665
cld
invalid
mov eax, dword [ebp + 0x18]
mov edx, ebx
inc eax
mov ecx, edi
push eax
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
add byte [ebp + 8], dh
call fcn.004149d2
call 0xc3cff8ce
jne 0x414b4f
mov dword [esi + 0xb8], ebx
mov eax, 0xfffffc1b
jmp 0x414b4f
mov eax, dword [ebp + 8]
mov dword [esi + 0x80], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x84], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x90], eax
mov eax, 0xfffffc1a
jmp 0x414b4f
Function at 0x45fc5f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00421008
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00421092
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
call 0x89ac0d6f
add al, 0x3e
test ecx, ecx
jle 0x45fcba
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x45fcb1
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x468a83
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4c4190]
jne 0x468a95
call fcn.00468b25
mov eax, dword [0x4c7ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c7ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x468ad8
fadd qword [0x4bbac8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4bbaa0]
mov esp, ebp
pop ebp
ret

Function at 0x468ae8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4c7530], ecx
inc esi
mov ecx, 0x4c7530
mov edx, esi
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x4c7eec
jl 0x468af9
mov dword [0x4c4190], esi
mov dword [0x4c7518], esi
pop esi
ret

Function at 0x468b25
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c7518], 0
push esi
push edi
mov esi, 0x4c7530
jne 0x468b44
push 0
call fcn.0042544c
pop ecx
mov ecx, eax
call fcn.00468ae8
mov dword [0x4c4190], 0x270
mov edi, 0xe3
mov dword [0x4c7ef0], esi
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi], eax
mov esi, edx
dec edi
jne 0x468b59
mov edi, 0x18c
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, ecx
mov dword [esi], eax
lea esi, [edx]
dec edi
jne 0x468b8e
mov ecx, dword [0x4c7530]
mov al, cl
and al, 1
movzx edx, al
mov eax, dword [esi]
neg edx
pop edi
sbb edx, edx
xor eax, ecx
and eax, 0x7ffffffe
and edx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, edx
mov dword [esi], eax
pop esi
ret
Function at 0x4693a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
lea ecx, [ebp - 0xdc]
push esi
push edi
call fcn.004691fb
push dword [ebp + 0x10]
lea ecx, [ebp - 0xdc]
call fcn.00469241
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x4693e9
mov edi, dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.00469379
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x4693d3
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48e96a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add ah, byte [esi - 0x75]
push es
inc esi
add ah, byte [esi + 0x3b]
enter 0xffffffffffff850f, 0xffffffffffffff9a
dec byte [eax]
call 0xe2c8bc03
sub esi, dword [ebp - 8]
sar esi, 1
mov eax, esi
insd dword es:[edi], dx
dec edi
invalid
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40633c
pop dword [ebp - 0x10]
mov eax, 0x40633c
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x82a2dc83
add dword [ebp - 0x20], 0xcbaf68c8
mov dword [ebp - 0x1c], 0x6e8a46d6
sub dword [ebp - 0x1c], 0x3c56fa91
mov dword [ebp - 0x18], 0x3e8cf83e
sub dword [ebp - 0x18], 0xf240b410
mov dword [ebp - 0x14], 0x44eff981
add dword [ebp - 0x14], 0xbb10067f
lea eax, [ebp - 0x20]
push eax
mov eax, 0xf127704
add eax, 0xf12df95c
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x24e41304
add dword [ebp - 0x20], 0x4f8e5652
mov dword [ebp - 0x1c], 0xa73c0195
sub dword [ebp - 0x1c], 0x65cfa020
mov dword [ebp - 0x18], 0x6fe3db0a
sub dword [ebp - 0x18], 0xc746e9e
mov dword [ebp - 0x14], 0xd53641c1
sub dword [ebp - 0x14], 0xd53641c1
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x73e2aae8
sub eax, 0x73a239e8
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x398c9
push 0
call eax
mov ecx, 0x106c5a5b
sub ecx, 0x106c06a2
xor edi, edi
add edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x10]
mov edx, 0xa886e49d
sub edx, 0x55069769
xor dword [ebp - 0xc], edi
mov esi, dword [ebx]
sub dword [ebp - 0xc], 0x759805c7
sub esi, edx
add dword [ebp - 4], edi
mov dword [edi], esi
add dword [ebp - 0xc], esi
add edi, 0xca7c55ec
add edi, 0x3583aa18
add ebx, 0x42e34ba8
sub ebx, 0x42e34ba4
loop 0x406455
add eax, 0x2fbcdfe1
add eax, 0xd04461d6
xor ebx, ebx
add ebx, eax
add eax, 0xd9ed73c1
add eax, 0x26128c44
mov ecx, 0xa20a2e56
add ecx, 0x5e35d1aa
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x43fd94
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x43fe33
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_8762
call fcn.00406190
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push 0x4aa99a
call fcn.00406410
add esp, 0xc
test eax, eax
jne 0x43fe33
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x43fe30
mov ecx, dword [ebp + 0x10]
mov esi, str.__
mov edi, ecx
lea edx, [ebp - 0x110]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004060b4
add esp, 8
mov eax, 1
jmp 0x43fe3e
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x43fdb3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret