joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x401a2b
mov esi, dword [esp + 0x30]
test esi, esi
je 0x401a2b
push esi
call fcn.00408730
add esp, 4
test eax, eax
je 0x401a0a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x401a11
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x4019f0
jmp 0x401a13
mov ebp, 0x1505
jmp 0x401a13
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x401a37
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x401a54
inc ebx
dec edi
je 0x401a2b
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x401a2b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x401a50
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.00408730
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x401a50
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.00408750
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x401a50
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x401a2b
cmp dword [eax + 4], 3
jne 0x401a2b
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x401a2b

Function at 0x401af0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x401bf1
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x401bf1
push ebx
call fcn.00408730
add esp, 4
test eax, eax
je 0x401b4a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x401b51
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x401b30
jmp 0x401b53
mov esi, 0x1505
jmp 0x401b53
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x401bf1
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x401b84
inc ebp
dec ebx
je 0x401bef
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x401bef
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x401b80
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.00408730
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401b80
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00408750
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401b80
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x401bef
cmp dword [eax + 4], 5
mov edi, 0
jne 0x401bf1
mov edi, dword [eax + 8]
jmp 0x401bf1
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401c20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x401d24
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x401d24
push ebx
call fcn.00408730
add esp, 4
test eax, eax
je 0x401c7a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x401c81
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x401c60
jmp 0x401c83
mov esi, 0x1505
jmp 0x401c83
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x401d24
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x401cb4
inc ebp
dec ebx
je 0x401d1f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x401d1f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x401cb0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.00408730
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401cb0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00408750
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401cb0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x401d1f
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x401d24
mov edi, dword [eax + 8]
jmp 0x401d24
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401d30
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
push 0x2e
push ebp
call fcn.004087a0
add esp, 8
test eax, eax
je 0x401d94
mov esi, eax
jmp 0x401d74
mov ebp, esi
inc ebp
push 0x2e
push ebp
call fcn.004087a0
add esp, 8
mov esi, eax
test eax, eax
je 0x401d94
mov eax, esi
sub eax, ebp
push eax
push ebp
push edi
call fcn.004017a0
add esp, 0xc
xor edi, edi
test eax, eax
je 0x401d60
cmp dword [eax + 4], 4
jne 0x401d60
mov edi, dword [eax + 8]
jmp 0x401d60
xor eax, eax
test edi, edi
je 0x401dfb
test ebp, ebp
je 0x401dfb
push ebp
call fcn.00408730
add esp, 4
test eax, eax
je 0x401ddb
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ebx]
test edx, edx
je 0x401de2
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x401dc0
jmp 0x401de4
mov esi, 0x1505
jmp 0x401de4
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [edi + 0x20]
lea ebx, [ecx - 1]
mov eax, ecx
sub eax, 1
mov dword [esp + 0x14], eax
jae 0x401e03
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov dword [esp], edi
mov eax, dword [edi + 4]
mov dword [esp + 0x10], eax
jmp 0x401e24
inc ebx
dec ecx
je 0x401df9
mov eax, ebx
and eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x401df9
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + edi*4], esi
jne 0x401e20
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], ecx
call fcn.00408730
mov ecx, dword [esp + 0xc]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x401e20
push dword [esp + 4]
push dword [esp + 0x10]
push ebp
call fcn.00408750
mov ecx, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0x401e20
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x401dfb
Function at 0x401f20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x401f8d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x401f8d
push esi
call fcn.00408730
add esp, 4
test eax, eax
je 0x401f6a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x401f71
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x401f50
jmp 0x401f73
mov ebx, 0x1505
jmp 0x401f73
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x401f95
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x401fa4
inc ebp
dec edi
je 0x401f8b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x401f8b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x401fa0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.00408730
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401fa0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00408750
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401fa0
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x401f8d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x401f8d
Function at 0x4021b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x4022c2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4022c2
cmp dword [esp + 0x2c], 0
je 0x4022c2
push esi
call fcn.00408730
add esp, 4
test eax, eax
je 0x40221a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x402221
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x402200
jmp 0x402223
mov ebx, 0x1505
jmp 0x402223
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x4022ca
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x402287
call fcn.004023c0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x4022c2
push ecx
call fcn.00408730
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x40233d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4022e8
inc edi
dec esi
je 0x40223c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x402241
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4022e0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.00408730
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4022e0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.00408750
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4022e0
mov eax, 0xffffffff
jmp 0x4022c2
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x402358
inc edi
dec esi
je 0x402282
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x402287
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x402350
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408730
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x402350
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.00408750
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402350
jmp 0x402287
Function at 0x402ac0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402c66
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x402c5f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x402b55
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x402c5f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x402bce
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x402b70
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x402b1d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x402c10
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x402bf0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402b10
jmp 0x402c1f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402b10
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402c30
jmp 0x402b10
shl ecx, 0x10
or ecx, edi
jmp 0x402c6b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x402d01
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
lea eax, [esi + esi]
not eax
add eax, esi
test edx, edx
je 0x402cfd
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
and eax, 0xf
mov ebp, edi
and ebp, 0xf
add ebp, eax
and eax, edi
add eax, eax
sub ebp, eax
mov ebp, dword [ebp*4 + 0x44080c]
mov eax, ebp
and eax, ebx
add eax, eax
sub ebp, eax
add ebp, ebx
mov eax, ebp
shr eax, 4
mov ebx, ebp
xor ebx, 0x3ffffff0
or ebp, 0xf
and ebp, ebx
shr edi, 4
xor edi, ebp
xor eax, dword [edi*4 + 0x44080c]
inc esi
cmp edx, esi
jne 0x402cb0
not eax
jmp 0x402d03
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40828b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x408293
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x40832b
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x4082d9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x40833a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x4082ee
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x408300
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x4082c0
jmp 0x408309
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x4082c0
cmp edi, ebx
jge 0x408320
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x4082c4
jmp 0x408324
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x4082cd
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x4083c2
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x4083c2
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x408374
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x408360
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x4083c2
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x408380
dec eax
mov ecx, 1
xor esi, esi
jmp 0x4083dc
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x40828b
test edx, edx
mov dword [esp], ecx
js 0x408410
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x408420
inc ebp
dec edx
cmp edi, ebp
jne 0x4083f0
mov edx, 0xffffffff
jmp 0x408422
xor edi, edi
jmp 0x408425
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x4083d0
and ebp, 3
je 0x408458
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x408440
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x40845a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x4083d0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x408470
jmp 0x4083d0
Function at 0x408cc0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x44879c], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x449158], ecx
test eax, eax
je 0x408d11
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x44915c], ecx
add eax, 2
jmp 0x408cd0
mov dword [0x448798], 0x270
ret

Function at 0x408d30
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x214
call fcn.0043b380
test al, al
je 0x408e76
lea eax, [esp + 0xc]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.004342a0
test al, al
je 0x408e71
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, 0xaee9336f
mov esi, 0x57e47d4f
mov ecx, ebx
shrd esi, ebp, cl
mov dword [esp + 4], eax
shr ebp, cl
test bl, 0x20
je 0x408d91
mov esi, ebp
xor ebp, ebp
xor esi, 0x57e47d4f
xor ebp, 0xaee9336f
mov eax, esi
and eax, 0xae57c0fd
mov dword [esp], eax
mov ecx, ebp
and ecx, 0x5ddfa42c
mov ebx, esi
and ebx, 0x51a83f02
mov edi, ebx
xor edi, 0x51a83f02
mov eax, edi
imul edi, ecx
mul dword [esp]
mov dword [esp + 8], eax
mov ecx, ebp
and ecx, 0xa2205bd3
or esi, 0x51a83f02
mov eax, esi
imul esi, ecx
xor ecx, 0xa2205bd3
imul ecx, dword [esp]
add ecx, edx
add ecx, edi
mul ebx
add esi, edx
or ebp, 0xa2205bd3
imul ebp, ebx
add ebp, esi
add eax, dword [esp + 8]
adc ebp, ecx
mov edi, ebp
shr edi, 0x15
xor edi, ebp
mov esi, ebp
shld esi, eax, 0xb
xor esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408e4d
mov ecx, 0xe9c43adc
mov eax, esi
mul ecx
imul ecx, esi, 0xea427398
imul ebx, edi, 0xe9c43adc
add ebx, edx
add ebx, ecx
mov esi, eax
mov ecx, dword [esp + 4]
shrd esi, ebx, cl
mov edi, ebx
shr edi, cl
test cl, 0x20
je 0x408e49
mov esi, edi
xor edi, edi
xor edi, ebx
xor esi, eax
or edi, 0x1010101
or esi, 0x1010101
push edi
push esi
call fcn.0040a1e0
add esp, 8
test al, al
je 0x408e71
call fcn.0040ce00
call fcn.0040bce0
call fcn.0043b920
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408e80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408ee5
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x408ea0
mov eax, 0x270
jmp 0x408fc7
cmp eax, 0x4e0
jb 0x408fc7
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x408f00
mov esi, dword [ecx + 0xd50]
xor eax, eax
jmp 0x408f71
and esi, 0x80000000
or edi, esi
shr edi, 1
xor edi, dword [ecx + eax*4 + 4]
xor edi, ebx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
mov esi, edx
cmp eax, 0x18c
je 0x408f93
mov edx, dword [ecx + eax*4 + 0xd54]
mov edi, edx
and edi, 0x7fffffff
mov ebx, edx
xor ebx, 0x7ffffffe
and ebx, edi
je 0x408f50
mov ebx, 0x9908b0df
jmp 0x408f50
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
mov esi, edx
not esi
or esi, dword [ecx + 0x1384]
add edx, esi
inc edx
xor edx, eax
mov ecx, edx
shl ecx, 7
and ecx, 0x9d2c5680
xor ecx, edx
mov edx, ecx
shl edx, 0xf
and edx, 0xefc60000
xor edx, ecx
mov eax, edx
shr eax, 0x12
and ecx, eax
or eax, edx
xor eax, ecx
pop esi
pop edi
pop ebx
ret
Function at 0x40a1e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x21c
mov eax, dword [0x449b78]
mov dword [esp + 0x19c], 0x404f564d
mov ecx, 0x64
mov edx, 0x69d45c9b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x138]
lea edi, [ecx - 0x69d45cff]
mov ebx, edi
and ebx, esi
add ebx, ebx
sub ebx, esi
add ebx, edx
dec ebx
and ebx, edi
lea edi, [edx + ebx*2]
add ebx, ebx
xor edi, esi
mov ebp, ecx
sub ebp, ebx
and ebp, esi
add ebp, ebp
sub ebp, edi
mov esi, ebp
and esi, 0x57
xor ebp, 0xd7
lea ebx, [esi*2]
add ebx, ebp
inc bl
mov byte [esp + ecx + 0x138], bl
inc ecx
dec edx
cmp ecx, 0x68
jne 0x40a210
mov ecx, dword [esp + 0x19c]
mov dword [esp + 0xc], 0xeb19e91f
mov dword [esp + 0x10], 0xef31edde
mov dword [esp + 0x14], 0xf3c0f1c3
mov dword [esp + 0x18], 0xf712f5da
mov dword [esp + 0x1c], 0xfb16f914
mov dword [esp + 0x20], 0xfdfc
mov edx, 0xa8
mov esi, 0x57
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx - 0x9c]
mov ebx, esi
xor ebx, edx
and ebx, edi
xor ebx, edx
add bl, 0xc0
mov byte [esp + edx - 0x9c], bl
inc edx
dec esi
cmp edx, 0xc0
jne 0x40a2b0
lea esi, [esp + 0xc]
push ecx
push 0
push esi
call eax
mov ecx, 0x449b7c
push eax
call fcn.0043b340
movzx eax, al
mov eax, dword [eax*4 + 0x443a94]
mov ecx, 0x86e761fa
xor ecx, dword [0x443a9c]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx

Function at 0x40b530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x449b54]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40b5de
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x443da4]
xor eax, eax
jmp 0x40bcd8
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret