joyce8/EMBER2024-capa huggingface dataset:
Function at 0x586df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5f8800]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [esi + 0x28], 0
call fcn.0057fbe0
add esp, 4
test al, al
lea eax, [ebp - 0x24]
push edi
je 0x586e26
push str.sprites_s
jmp 0x586e2b
push str.sprites_s.pak
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movups xmmword [esi + 0x10], xmm0
push ebx
push edi
push 0x20
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
add esp, 0xc
lea eax, [ebp - 0x24]
push 0
push 0
push 3
push 0
push 0
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push dword [ebp + 0xc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x38]
push eax
push 0xe
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call fcn.0057fbe0
add esp, 4
test al, al
je 0x586ea3
lea eax, [ebp - 0x34]
push 0xe
push eax
call fcn.0057f910
add esp, 8
mov eax, dword [ebp - 0x32]
add eax, 0xfffffff2
push eax
call fcn.005aa4da
add esp, 4
mov ecx, eax
lea eax, [ebp - 0x38]
mov dword [esi + 0x28], ecx
push 0
push eax
mov eax, dword [ebp - 0x32]
add eax, 0xfffffff2
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call fcn.0057fbe0
add esp, 4
test al, al
je 0x586eeb
mov eax, dword [ebp - 0x32]
add eax, 0xfffffff2
push eax
push dword [esi + 0x28]
call fcn.0057f910
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi + 0x28]
mov dword [esi + 0x2c], edx
pop ebx
movzx eax, word [edx + 4]
mov word [esi + 0x20], ax
movzx eax, word [edx + 8]
mov word [esi + 0x22], ax
mov eax, dword [edx + 0x20]
movzx edi, ax
test eax, eax
jne 0x586f44
movzx eax, word [edx + 0xe]
cmp eax, 0x18
je 0x586f40
cmp eax, 8
jne 0x586f28
mov eax, 0x100
jmp 0x586f46
cmp eax, 1
jne 0x586f34
mov eax, 2
jmp 0x586f46
cmp eax, 4
jne 0x586f40
mov eax, 0x10
jmp 0x586f46
xor eax, eax
jmp 0x586f46
mov eax, edi
mov ecx, dword [ebp - 4]
mov word [esi + 0x24], ax
xor ecx, ebp
pop edi
mov eax, esi
pop esi
call fcn.005aa550
mov esp, ebp
pop ebp
ret 8
Function at 0x587740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [ebp + 8]
cmp dword [ecx + eax*4 + 0x88], 0
push ebx
lea ebx, [ecx + eax*4]
push esi
push edi
je 0x587819
mov eax, dword [ebp + 0x14]
cmp eax, 0xffffffff
je 0x587819
mov edi, dword [ebp + 0xc]
push 0
push eax
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
test eax, eax
jne 0x587819
mov eax, dword [ebx + 0x88]
lea edx, [ebp + 0x14]
push 2
push edx
lea edx, [ebp + 0xc]
mov ecx, dword [eax]
push edx
lea edx, [ebp + 8]
push edx
lea edx, [ebp - 4]
push edx
push dword [ebp + 0x10]
push 0
push eax
call dword [ecx + 0x2c]
test eax, eax
jne 0x587819
mov edx, dword [ebp + 8]
test edx, edx
je 0x5877c4
push edi
push 1
push edx
push dword [ebp - 4]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, 1
jne 0x587819
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x5877e5
push edi
push 1
push esi
push dword [ebp + 0xc]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, 1
jne 0x587819
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x88]
push esi
push dword [ebp + 0xc]
mov ecx, dword [eax]
push edx
push dword [ebp - 4]
push eax
call dword [ecx + 0x4c]
test eax, eax
jne 0x587819
mov eax, dword [ebx + 0x88]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x587930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5f8800]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
push esi
mov byte [ebp - 0x38], al
mov esi, ecx
movsx eax, al
cmp dword [esi + eax*4 + 0x88], 0
jne 0x587992
push 0x5dcce8
lea eax, [esi + 0x68]
push eax
lea eax, [ebp - 0x34]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s
add esp, 0xc
test eax, eax
jne 0x587992
push dword [ebp - 0x34]
lea eax, [ebp - 0x30]
push 1
push 0x2c
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, 1
je 0x5879a5
push dword [ebp - 0x34]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005aa550
mov esp, ebp
pop ebp
ret 4
mov eax, 1
mov ecx, esi
cmp ax, word [ebp - 0x1a]
push edi
mov edi, dword [ebp - 8]
sbb eax, eax
neg eax
push eax
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0xe]
push eax
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x38]
call fcn.00587860
test eax, eax
jne 0x5879f2
push dword [ebp - 0x34]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005aa550
mov esp, ebp
pop ebp
ret 4
push 0x2c
push edi
push dword [ebp - 0x34]
mov ecx, esi
push dword [ebp - 0x38]
call fcn.00587740
push dword [ebp - 0x34]
test eax, eax
je 0x5879d6
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop edi
pop esi
call fcn.005aa550
mov esp, ebp
pop ebp
ret 4
Function at 0x587e90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0890
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5f8800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x30]
mov dword [esi], vtable.CWebContainer.0
mov dword [esi + 4], vtable.CWebContainer.1.0
mov dword [esi + 8], vtable.CWebContainer.2.0
mov dword [esi + 0xc], vtable.CWebContainer.3.0
mov dword [esi + 0x10], vtable.CWebContainer.4.0
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esi + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x588d60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x14]
mov dword [ebx], vtable.XSocket.0
test eax, eax
je 0x588d79
push eax
call fcn.005aa4e3
add esp, 4
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x588d89
push eax
call fcn.005aa4e3
add esp, 4
push esi
push edi
lea esi, [ebx + 0x54]
mov edi, 0x12c
mov eax, dword [esi]
test eax, eax
je 0x588da2
push eax
call fcn.005aa4e3
add esp, 4
add esi, 4
sub edi, 1
jne 0x588d93
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp fcn.00588df0

Function at 0x588eb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x24]
cmp al, 0xb
jne 0x588f20
mov eax, dword [esi + 0x2c]
add eax, dword [esi + 0x14]
push 0
push dword [esi + 0x28]
push eax
push dword [esi + 0x20]
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
je 0x588f3d
test eax, eax
je 0x588f5e
sub dword [esi + 0x28], eax
add dword [esi + 0x2c], eax
cmp dword [esi + 0x28], 0
jne 0x588f8e
mov eax, dword [esi + 0x14]
mov byte [esi + 0x24], 0xc
movzx eax, word [eax + 1]
add eax, 0xfffffffd
mov dword [esi + 0x28], eax
je 0x588f75
cmp eax, dword [esi + 0x1c]
jbe 0x588f8e
mov byte [esi + 0x24], 0xb
mov eax, 0xffffff7c
mov dword [esi + 0x28], 3
mov dword [esi + 0x2c], 0
pop esi
ret
cmp al, 0xc
jne 0x588f87
mov eax, dword [esi + 0x14]
add eax, dword [esi + 0x2c]
push 0
push dword [esi + 0x28]
push eax
push dword [esi + 0x20]
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
jne 0x588f5a
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x588f53
mov dword [esi + 4], eax
mov eax, 0xffffff7f
pop esi
ret
mov eax, 0xffffff80
pop esi
ret
test eax, eax
jne 0x588f69
mov byte [esi + 0x10], 3
mov eax, 0xffffff81
pop esi
ret
sub dword [esi + 0x28], eax
add dword [esi + 0x2c], eax
cmp dword [esi + 0x28], 0
jne 0x588f8e
mov byte [esi + 0x24], 0xb
mov dword [esi + 0x28], 3
mov dword [esi + 0x2c], 0
mov eax, 0xffffff83
pop esi
ret
mov eax, 0xffffff84
pop esi
ret
Function at 0x589040
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
movsx eax, word [ebx + 0x9b4]
cmp dword [ebx + eax*4 + 0x54], 0
je 0x589093
cmp dword [ebp + 0x10], 1
jne 0x589088
push edi
push dword [ebp + 8]
call fcn.00588fa0
cmp eax, 0xffffffff
je 0x589120
test eax, eax
jne 0x58912e
pop edi
pop esi
mov eax, 0xffffff7a
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor esi, esi
test edi, edi
jle 0x5890c6
nop dword [eax]
mov ecx, dword [ebp + 8]
mov eax, edi
push 0
sub eax, esi
add ecx, esi
push eax
push ecx
push dword [ebx + 0x20]
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], ecx
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x5890d1
add esi, eax
cmp esi, edi
jl 0x5890a0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x5890ee
pop edi
mov dword [ebx + 4], eax
mov eax, 0xffffff7f
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp + 0x10], 1
jne 0x58912e
push dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp - 4]
call fcn.00588fa0
mov ecx, eax
cmp ecx, 0xffffffff
je 0x589120
pop edi
test ecx, ecx
mov eax, 0xffffff80
mov edx, 0xffffff7a
pop esi
cmove eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, 0xffffff7e
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, 0xffffff80
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x589250
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x589281
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
push dword [ebx + 0x20]
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x58928a
add esi, eax
cmp esi, edi
jl 0x589261
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x589281
pop edi
mov dword [ebx + 4], eax
mov eax, 0xffffff7f
pop esi
pop ebx
pop ebp
ret 8
Function at 0x5894b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5f8800]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x10], 1
je 0x5895e9
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
je 0x5894df
push eax
call sub.WS2_32.dll_closesocket
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
je 0x5894ed
push eax
call sub.WS2_32.dll_closesocket
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi + 0x20], eax
cmp eax, 0xffffffff
je 0x5895e9
push ebx
xorps xmm0, xmm0
mov eax, 2
push edi
movlpd qword [ebp - 0xc], xmm0
mov word [ebp - 0x14], ax
call sub.WS2_32.dll_inet_addr
mov ebx, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x10], eax
call sub.WS2_32.dll_htons
push 0x33
push dword [ebp + 0x10]
mov word [ebp - 0x12], ax
push dword [esi + 0x9bc]
push dword [esi + 0x20]
call sub.WS2_32.dll_WSAAsyncSelect
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x20]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x58957b
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x58957b
call sub.WS2_32.dll_WSAGetLastError
pop ebx
mov dword [esi + 4], eax
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005aa550
mov esp, ebp
pop ebp
ret 0xc
push 4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0xa000
push eax
push 0x1002
push 0xffff
push dword [esi + 0x20]
call sub.WS2_32.dll_setsockopt
push 4
lea eax, [ebp - 0x18]
push eax
push 0x1001
push 0xffff
push dword [esi + 0x20]
call sub.WS2_32.dll_setsockopt
push edi
lea eax, [esi + 0x30]
push 0x1e
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [esi + 0x50], ebx
mov dword [esi + 0x9b8], eax
mov eax, 1
mov byte [esi + 0x10], 2
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005aa550
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.005aa550
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5898c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
cmp ebx, dword [esi + 0x1c]
jbe 0x5898da
pop esi
mov eax, 0xffffff7c
pop ebx
pop ebp
ret 0xc
cmp byte [esi + 0x10], 2
je 0x5898eb
pop esi
mov eax, 0xffffff87
pop ebx
pop ebp
ret 0xc
mov eax, dword [esi + 0x18]
mov cl, byte [ebp + 0x10]
push ebx
push dword [ebp + 8]
mov byte [eax], cl
lea ecx, [ebx + 3]
mov eax, dword [esi + 0x18]
mov word [eax + 1], cx
mov eax, dword [esi + 0x18]
add eax, 3
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp byte [ebp + 0x10], 0
je 0x589943
xor edx, edx
test ebx, ebx
jle 0x589943
nop dword [eax]
mov ecx, dword [esi + 0x18]
mov al, dl
xor al, byte [ebp + 0x10]
add byte [ecx + edx + 3], al
mov al, bl
mov ecx, dword [esi + 0x18]
sub al, dl
xor al, byte [ecx + edx + 3]
xor al, byte [ebp + 0x10]
mov byte [ecx + edx + 3], al
inc edx
cmp edx, ebx
jl 0x589920
cmp dword [esi + 0xc], 0
lea eax, [ebx + 3]
mov ecx, dword [esi + 0x18]
jne 0x589968
push eax
push ecx
mov ecx, esi
call fcn.00588fa0
mov ecx, eax
test ecx, ecx
pop esi
pop ebx
lea eax, [ecx - 3]
cmovs eax, ecx
pop ebp
ret 0xc
push 1
push eax
push ecx
mov ecx, esi
call fcn.00589040
mov ecx, eax
test ecx, ecx
pop esi
pop ebx
lea eax, [ecx - 3]
cmovs eax, ecx
pop ebp
ret 0xc

Function at 0x589990
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
mov dword [ebp - 4], eax
push esi
mov esi, ebx
push edi
test ebx, ebx
jle 0x5899c5
mov edi, dword [ebp + 8]
push 0
push esi
push edi
push dword [eax + 0x20]
call sub.WS2_32.dll_send
test eax, eax
js 0x5899c9
je 0x5899c5
sub esi, eax
add edi, eax
mov eax, dword [ebp - 4]
test esi, esi
jg 0x5899a8
sub ebx, esi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5899e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x14]
mov dl, byte [eax]
mov eax, dword [ebp + 0xc]
mov byte [ebp - 1], dl
test eax, eax
je 0x5899f9
mov byte [eax], dl
mov edi, dword [esi + 0x14]
mov eax, dword [ebp + 8]
movzx ecx, word [edi + 1]
sub ecx, 3
mov dword [eax], ecx
test dl, dl
je 0x589a44
push ebx
movzx ebx, word [edi + 1]
xor edx, edx
sub ebx, 3
test ebx, ebx
jle 0x589a43
nop word [eax + eax]
mov ecx, dword [esi + 0x14]
mov al, bl
sub al, dl
xor al, byte [ecx + edx + 3]
xor al, byte [ebp - 1]
mov byte [ecx + edx + 3], al
mov al, dl
mov ecx, dword [esi + 0x14]
xor al, byte [ebp - 1]
sub byte [ecx + edx + 3], al
inc edx
cmp edx, ebx
jl 0x589a20
pop ebx
mov eax, dword [esi + 0x14]
pop edi
add eax, 3
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x59a080
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x59a0a3
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x59a091
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x5a9c49
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call sub.api_ms_win_crt_locale_l1_1_0.dll____lc_locale_name_func
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x5a9c88
sub eax, 1
je 0x5a9c83
sub eax, 1
je 0x5a9c7f
xor eax, eax
leave
ret
push 3
jmp 0x5a9c8a
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x5abe81
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5abec0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5abec0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5abec0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5abec0
cmp dword [ecx + 0x74], 0xe
jbe 0x5abec0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x404080
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, dl
xor eax, ecx
imul eax, eax, 0x1000193
ret
Function at 0x40c9c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x44c010]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40caaa
cmp byte [ebx + 0x3e], 0
je 0x40caaa
mov eax, dword [ebx]
push esi
push edi
mov esi, dword [eax + 0xc]
call fcn.0040d900
movzx edi, ax
mov ecx, ebx
push edi
call esi
movzx ecx, ax
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ecx
mov eax, edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
call fcn.0040d940
test al, al
jne 0x40ca96
mov ecx, dword [ebx + 0x38]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [ebx + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x40ca59
sub eax, 1
je 0x40ca5d
sub eax, 2
jne 0x40ca96
pop edi
mov byte [ebx + 0x3e], al
mov al, 1
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0043fc76
add esp, 0x30
ret
mov byte [ebx + 0x3e], 0
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x18]
sub esi, eax
je 0x40ca7d
push dword [ebx + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x40ca96
cmp byte [ebx + 0x3e], 0
pop edi
pop esi
sete al
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0043fc76
add esp, 0x30
ret
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0043fc76
add esp, 0x30
ret
mov ecx, dword [esp + 0x30]
mov al, 1
pop ebx
xor ecx, esp
call fcn.0043fc76
add esp, 0x30
ret
Function at 0x40cc90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x44c010]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40cd74
cmp byte [ebx + 0x3d], 0
je 0x40cd74
mov eax, dword [ebx]
push esi
push edi
mov esi, dword [eax + 0xc]
call fcn.0040d880
mov edi, eax
mov ecx, ebx
push edi
call esi
lea edx, [esp + 0xc]
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], edi
call fcn.0040d8b0
test al, al
jne 0x40cd60
mov ecx, dword [ebx + 0x38]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [ebx + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x40cd23
sub eax, 1
je 0x40cd27
sub eax, 2
jne 0x40cd60
pop edi
mov byte [ebx + 0x3d], al
mov al, 1
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0043fc76
add esp, 0x30
ret
mov byte [ebx + 0x3d], 0
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x18]
sub esi, eax
je 0x40cd47
push dword [ebx + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x40cd60
cmp byte [ebx + 0x3d], 0
pop edi
pop esi
sete al
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0043fc76
add esp, 0x30
ret
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0043fc76
add esp, 0x30
ret
mov ecx, dword [esp + 0x30]
mov al, 1
pop ebx
xor ecx, esp
call fcn.0043fc76
add esp, 0x30
ret

Function at 0x415e70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
mov eax, 1
mov dword [0x44ca44], edx
nop
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x44ca44], edx
inc eax
cmp eax, 0x270
jb 0x415e80
mov dword [0x44ca40], 0x270
ret 8

Function at 0x417ab0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
nop dword [eax]
mov edx, dword [eax]
lea eax, [eax + 4]
xor edx, dword [eax - 8]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x417ac0
pop esi
ret
Function at 0x417b00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebp, 0xe3
mov ebx, dword [edi + 0x9c4]
lea esi, [edi + 0x9c4]
mov eax, ebx
lea esi, [esi + 4]
mov ebx, dword [esi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x630]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub ebp, 1
jne 0x417b17
mov ebx, dword [edi + 0xd50]
lea esi, [edi + 0xd50]
mov ebp, 0x18c
mov eax, ebx
lea esi, [esi + 4]
mov ebx, dword [esi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub ebp, 1
jne 0x417b60
mov eax, dword [edi + 0x1380]
mov ecx, dword [edi + 4]
xor ecx, eax
mov dword [edi], ebp
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4245e0
Capabilities:
Create thread

Disassembly:
sub esp, 8
mov eax, dword [0x44c010]
xor eax, esp
mov dword [esp + 4], eax
push esi
push edi
push ecx
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.0040da00
mov ecx, dword [esp + 0x14]
call fcn.0040c7c0
mov edx, eax
lea ecx, [esp + 8]
call fcn.00424740
lea edi, [esi + 4]
push edi
push 0
lea ecx, [esp + 0x10]
call fcn.00403b10
push eax
push 0x424780
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x42465d
lea ecx, [esp + 8]
call fcn.004131d0
lea ecx, [esp + 8]
call fcn.004246e0
mov ecx, dword [esp + 0xc]
pop edi
pop esi
xor ecx, esp
call fcn.0043fc76
add esp, 8
ret 4
push 6
mov dword [edi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x4406f0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44072f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44072f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44072f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44072f
cmp dword [ecx + 0x74], 0xe
jbe 0x44072f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219