joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a3e51
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x5a9d00], 0x256
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x5a527c]
mov dh, byte [eax + 0x5a524d]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x5a3e73
lea eax, [ebp - 0x24]
mov dword [0x5a9d00], 0x1b45
mov dword [0x5a9cfc], 0x336
mov dword [ebp - 0x34], eax
call fcn.005a3316
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.005a2f30
mov dword [0x5a9cfc], 0x1dfa
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x5a3f81
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.005a37d6
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x5a9cfc], 0x1cae
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x4c], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0xc], ecx
mov dword [0x5a9d00], 0x3c1
add ecx, 0x26c3
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x5a3f78
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x5a425b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x5a9d04], 0
mov dword [0x5a9d08], 0
mov dword [0x5a9d14], 0
mov dword [0x5a9d00], 0x109b
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x5a43a8
jmp 0x5a42d7
mov eax, dword [0x5a9d08]
mov ecx, dword [0x5a9d04]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add eax, 1
mov edi, edx
add edi, 1
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x5a9d04], edx
mov ebx, dword [ebp - 0x20]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x5a9d08], edx
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x5a9d0c], cl
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x5a9d0c]
mov edx, dword [0x5a9d08]
mov byte [ebx + edx], cl
mov dword [0x5a9d00], 0x122e
mov edx, dword [0x5a9d04]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x5a9d08]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x5a9d14], ecx
mov dword [0x5a9d00], 0x2252
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x5a9d00], 0x100b
mov dword [0x5a9cfc], 0x156a
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x2c], edi
jne 0x5a42c0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5a43b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov dword [0x5a9cfc], 0x928
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.005a3b8e
lea ecx, [0x5a3941]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x40], 0x144a00
mov edx, dword [0x5a9ce8]
mov dword [esp + 0x64], edx
mov edx, dword [0x5a9cec]
mov dword [esp + 0x70], edx
mov edx, dword [0x5a9d00]
add edx, 0xffffdee9
mov dword [0x5a9cfc], edx
mov edx, dword [0x5a9cf0]
mov dword [esp + 0x30], edx
mov edx, dword [0x5a9cf4]
mov dword [esp + 0x50], edx
mov edx, dword [0x5a9cf8]
mov dword [esp + 0x68], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x5a448f
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.005a3e51
mov dword [0x5a9d00], 0x1220
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x5a9cfc]
add ecx, 0xfffff14b
mov dword [0x5a9cfc], ecx
mov dword [esp + 0x10], eax
jmp 0x5a44f0
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
jne 0x5a44b2
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
je 0x5a44c6
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x5a448f
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 8]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x38], edx
call fcn.005a366f
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x5a4444
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x403e59
pop dword [ebp - 0x38]
mov eax, 0x403e59
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xbd7d9c94
sub dword [ebp - 0x48], 0x6f2b5749
mov dword [ebp - 0x44], 0xa6a046b0
sub dword [ebp - 0x44], 0x746cfa6b
mov dword [ebp - 0x40], 0x1a5eefab
add dword [ebp - 0x40], 0x31ed5483
mov dword [ebp - 0x3c], 0xb44fb9e4
add dword [ebp - 0x3c], 0x4bb0461c
lea eax, [ebp - 0x48]
push eax
mov eax, 0xf66c6acc
add eax, 0x9d415c0
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x9c2fc373
add dword [ebp - 0x48], 0xd842a5e3
mov dword [ebp - 0x44], 0x901d2e4e
sub dword [ebp - 0x44], 0x4eb0ccd9
mov dword [ebp - 0x40], 0x877695ac
sub dword [ebp - 0x40], 0x24072940
mov dword [ebp - 0x3c], 0x6e822437
add dword [ebp - 0x3c], 0x917ddbc9
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x664900de
add eax, 0x99f77ff6
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x37b9d
push 0
call eax
mov ecx, 0x322ac8e7
add ecx, 0xcdd58303
mov edi, eax
mov ebx, 0x8860fb05
sub ebx, 0x881feb05
add ebx, dword [ebp - 0x38]
mov esi, 0xbc5dc1a8
add esi, 0xf406aef3
sub dword [ebp - 0x30], ecx
mov edx, dword [ebx]
add dword [ebp - 4], eax
add edx, esi
sub dword [ebp - 0x1c], ebx
mov dword [edi], edx
xor dword [ebp - 0x14], edi
add edi, 4
add ebx, 4
loop 0x403f76
add eax, 0xb4495371
add eax, 0x4bb7cf0a
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xad3afd69
add ecx, 0x53050297
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401877
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018b6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4018b6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4018b6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4018b6
cmp dword [ecx + 0x74], 0xe
jbe 0x4018b6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4024f0
Capabilities:
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x29a0
call fcn.004490c0
mov edi, dword [ebp + 0x4c]
mov ebx, dword [ebp + 0x1c]
xor eax, eax
test ebx, ebx
sete al
xor ecx, ecx
cmp dword [ebp + 0x50], 0
sete cl
lea eax, [eax + ecx*8]
xor ecx, ecx
test edi, edi
sete cl
shl ecx, 9
or eax, ecx
movd xmm0, dword [ebp + 0x48]
movd xmm1, dword [ebp + 0x34]
punpckldq xmm1, xmm0
movq xmm0, qword [ebp + 0x2c]
punpcklqdq xmm0, xmm1
movd xmm1, dword [ebp + 0x20]
movd xmm2, dword [ebp + 0x18]
punpckldq xmm2, xmm1
movq xmm1, qword [ebp + 0x24]
punpcklqdq xmm2, xmm1
pxor xmm1, xmm1
pcmpeqd xmm2, xmm1
pshufd xmm3, xmm2, 0xf6
pcmpeqd xmm0, xmm1
pshufd xmm1, xmm0, 0xf6
pshufd xmm0, xmm0, 0xd4
pshufd xmm2, xmm2, 0x50
movdqa xmm4, xmm2
pandn xmm4, xmmword [0x44d7d0]
pand xmm2, xmmword [0x44d7e0]
por xmm2, xmm4
pand xmm0, xmmword [0x44d7f0]
por xmm0, xmm2
pand xmm1, xmmword [0x44d800]
pand xmm3, xmmword [0x44d810]
por xmm3, xmm1
por xmm3, xmm0
pshufd xmm0, xmm3, 0xee
por xmm0, xmm3
movd ecx, xmm0
or eax, ecx
pshufd xmm0, xmm0, 0x55
movd ecx, xmm0
tzcnt ecx, ecx
add ecx, 0x20
tzcnt esi, eax
test eax, eax
cmovne ecx, esi
cmp ecx, 0xa
call fcn.004025e2

Function at 0x4113f0
Capabilities:
Encode data using base64
Encrypt data using chaskey
Encrypt data using rc4 ksa
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x28e0
call fcn.004490c0
mov esi, esp
xor ecx, ecx
cmp dword [ebp + 0x50], 0
sete cl
xor eax, eax
cmp dword [ebp + 0x68], 0
sete al
shl eax, 0xa
or eax, ecx
movd xmm0, dword [ebp + 0x18]
movd xmm2, dword [ebp + 0x1c]
punpckldq xmm2, xmm0
movq xmm0, qword [ebp + 0x20]
punpcklqdq xmm2, xmm0
movd xmm0, dword [ebp + 0x54]
movd xmm3, dword [ebp + 0x4c]
punpckldq xmm3, xmm0
movq xmm1, qword [ebp + 0x44]
punpcklqdq xmm1, xmm3
movdqu xmm3, xmmword [ebp + 0x58]
movdqu xmm4, xmmword [ebp + 0x28]
pxor xmm5, xmm5
pcmpeqd xmm4, xmm5
pcmpeqd xmm3, xmm5
pcmpeqd xmm1, xmm5
pshufd xmm0, xmm4, 0xf6
pcmpeqd xmm2, xmm5
pshufd xmm5, xmm2, 0xf6
pshufd xmm2, xmm2, 0x50
movdqa xmm6, xmm2
pandn xmm6, xmmword [0x44ee20]
pand xmm2, xmmword [0x44ee30]
por xmm2, xmm6
pshufd xmm6, xmm1, 0xf6
pand xmm6, xmmword [0x44ee40]
pand xmm5, xmmword [0x44ee50]
por xmm5, xmm6
pshufd xmm6, xmm3, 0xf6
pand xmm6, xmmword [0x44ee60]
pand xmm0, xmmword [0x44ee70]
por xmm0, xmm6
por xmm0, xmm5
pshufd xmm4, xmm4, 0xd4
pshufd xmm3, xmm3, 0xd4
pand xmm3, xmmword [0x44ee90]
pand xmm4, xmmword [0x44eea0]
por xmm4, xmm3
pshufd xmm1, xmm1, 0xd4
pand xmm1, xmmword [0x44ee80]
por xmm4, xmm1
por xmm4, xmm2
por xmm4, xmm0
pshufd xmm0, xmm4, 0xee
por xmm0, xmm4
movd ecx, xmm0
or ecx, eax
pshufd xmm0, xmm0, 0x55
movd eax, xmm0
tzcnt eax, eax
add eax, 0x20
tzcnt edx, ecx
test ecx, ecx
cmovne eax, edx
cmp eax, 0x11
call fcn.0041152c
Function at 0x42c880
Capabilities:
Query environment variable

Disassembly:
push str.HL_NUM_THREADS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
jne 0x42c8a6
push str.HL_NUMTHREADS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x42c930
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
add esp, 4
ret
push str.NUMBER_OF_PROCESSORS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x42c94b
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
add esp, 4
ret
mov eax, 8
ret

Function at 0x42c8e0
Capabilities:
Create thread

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push 0xc
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
mov dword [eax], ebx
mov dword [eax + 4], edi
push 0
push 0
push eax
push 0x42c920
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [esi + 8], eax
mov eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x42d700
Capabilities:
Query environment variable
Reference absolute stream path on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
nop dword [eax + eax]
mov al, 1
xchg byte [0x461c5c], al
test al, al
jne 0x42d710
cmp dword [0x45dff8], 0
js 0x42d735
mov eax, dword [0x45dff8]
mov byte [0x461c5c], 0
pop esi
pop edi
pop ebp
ret
push str.HL_TRACE_FILE
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x42d7bc
push 0x4514d1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
add esp, 8
mov esi, eax
test eax, eax
jne 0x42d76d
push str.C:_src_build_botworkerhalide_nightly_release_17_x86_32_windows_cmakehalide_source_src_runtime_tracing.cpp:371_halide_abort_if_false___failed:_file___Failed_to_open_trace_file_n__n
push edi
call fcn.0042b270
add esp, 8
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
add esp, 4
push eax
call fcn.0042d7d0
add esp, 4
mov dword [0x461c60], esi
cmp dword [0x461c58], 0
jne 0x42d725
push 0x10000c
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [0x461c58], eax
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax], 0
mfence
jmp 0x42d725
push 0
call fcn.0042d7d0
add esp, 4
jmp 0x42d725

Function at 0x434ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a59d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45e064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0xd], 0
push str.Calling_get_on_an_empty_PerfectHashMap
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov dword [ebp - 4], 0
call fcn.0042f6a0
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x437650
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x4376ad
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x437670
mov eax, dword [esi]
jmp 0x437787
cmp eax, 0x4e0
jb 0x437787
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x4376c6
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
nop
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x437710
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x437a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x45e064]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x437b1c
cmp byte [esi + 0x3d], 0
je 0x437b1c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x437b0a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x437ad1
sub eax, 1
je 0x437ad5
sub eax, 2
jne 0x437b0a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00448e3b
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x437af3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x437b0a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00448e3b
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00448e3b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00448e3b
mov esp, ebp
pop ebp
ret
Function at 0x438520
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1390
call fcn.004490c0
mov eax, dword [0x45e064]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, 1
push esi
mov esi, ecx
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x1388], edx
nop
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [ebp + eax*4 - 0x1388], edx
inc eax
cmp eax, 0x270
jb 0x438550
lea eax, [ebp - 0x138c]
mov dword [ebp - 0x138c], 0x270
mov dword [ebp - 0x1390], eax
lea ecx, [esi + 8]
lea eax, [ebp - 0x1390]
push eax
call fcn.00436e10
lea eax, [ebp - 0x138c]
mov dword [ebp - 0x1390], eax
lea ecx, [esi + 0x78]
lea eax, [ebp - 0x1390]
push eax
call fcn.00436e10
lea eax, [ebp - 0x138c]
mov dword [ebp - 0x1390], eax
lea ecx, [esi + 0xe8]
lea eax, [ebp - 0x1390]
push eax
call fcn.00436e10
lea eax, [ebp - 0x138c]
mov dword [ebp - 0x1390], eax
lea ecx, [esi + 0x158]
lea eax, [ebp - 0x1390]
push eax
call fcn.00436e10
lea eax, [ebp - 0x138c]
mov dword [ebp - 0x1390], eax
lea ecx, [esi + 0x1c8]
lea eax, [ebp - 0x1390]
push eax
call fcn.00436e10
lea eax, [ebp - 0x138c]
mov dword [ebp - 0x1390], eax
lea ecx, [esi + 0x238]
lea eax, [ebp - 0x1390]
push eax
call fcn.00436e10
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00448e3b
mov esp, ebp
pop ebp
ret 4
Function at 0x439150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x439171
jl 0x439167
test esi, esi
jne 0x439171
pop esi
xor eax, eax
xor edx, edx
pop ebx
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x439188
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
pop ebp
ret 0xc
push edi
mov edi, esi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
test eax, eax
je 0x4391c4
cmp eax, dword [ebp + 0xc]
mov ecx, ebx
cmovb esi, eax
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
mov edi, dword [ebp + 8]
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add edi, esi
add esp, 0xc
mov dword [ebp + 8], edi
mov ecx, ebx
mov edi, dword [ebp + 0xc]
sub edi, esi
push esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x439238
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const]
lea ecx, [ebx + 0x3c]
cmp eax, ecx
jne 0x4391ec
push dword [ebx + 0x54]
mov eax, dword [ebx + 0x50]
mov ecx, ebx
push eax
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char___char___char__]
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, edi
cmp edi, 0xfff
jbe 0x439226
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x439238
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x439200
test ecx, ecx
je 0x439238
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
pop ebp
ret 0xc
Function at 0x439250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x439275
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x4392e0
jg 0x43929b
test esi, esi
je 0x4392e0
test ecx, ecx
jl 0x43931a
jg 0x4392a5
test eax, eax
je 0x43931a
cmp edi, ecx
jg 0x4392b5
jl 0x4392af
cmp esi, eax
jae 0x4392b5
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
mov eax, dword [ebp + 8]
test edi, edi
jl 0x439307
jg 0x4392ed
test esi, esi
je 0x439307
mov ecx, dword [ebx + 0x4c]
test ecx, ecx
je 0x439307
push ecx
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
jmp 0x4392ed

Function at 0x43bab0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x43bad0
pop edi
pop esi
mov dword [ecx], 0x270
mov eax, ecx
pop ebp
ret 4