joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031373
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100313af
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100313af
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100313af
xor eax, eax
cmp dword [ecx + 0x74], 0xe
jbe 0x100313ae
cmp dword [ecx + 0xe8], eax
setne al
ret
xor eax, eax
ret

Function at 0x10068350
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x24
mov eax, 0x100da940
call fcn.10021e72
mov ebx, ecx
mov dword [ebp - 0x30], ebx
mov edx, dword [ebx + 0x30]
lea eax, [edx + 1]
mov dword [ebx + 0x30], eax
test edx, edx
jne 0x1006846c
cmp dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x14]
setne al
mov byte [ebp - 0x29], al
cmp dword [ebx + 0x18], edx
jne 0x1006843c
test al, al
sete al
movzx eax, al
push eax
push dword [ebx + 0x28]
push dword [ebx + 0x24]
call fcn.100779be
cmp byte [ebp - 0x29], 0
jne 0x10068448
call dword [sym.imp.kernel32.dll_GetCurrentThread]
mov ebx, eax
lea ecx, [ebp - 0x28]
push ebx
call fcn.100779be
mov edx, dword [ebp - 0x30]
lea edi, [ebp - 0x1c]
push ebx
mov cx, word [eax + 4]
mov word [edx + 0xc], cx
mov ecx, dword [eax]
mov dword [edx + 8], ecx
mov ecx, dword [edx + 0x14]
imul edx, dword [edx + 0x24], 0x34
mov eax, dword [ecx + 0x10]
movzx ecx, word [edx + eax + 0xc]
mov esi, dword [edx + eax]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov word [ebp - 0x18], cx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
call fcn.100779be
mov ebx, dword [ebp - 0x30]
push ebx
mov ecx, dword [ebx + 0x14]
call fcn.100779be
mov edi, dword [ebx + 0x14]
lea esi, [edi + 0x20]
push esi
mov dword [ebp - 0x30], esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
mov ecx, ebx
mov eax, dword [ebx]
call dword [eax]
imul ecx, dword [ebx + 0x28], 0x34
imul edx, eax, 0x34
mov eax, dword [edi + 0x10]
push ebx
add ecx, 0xc
mov eax, dword [edx + eax + 0x30]
add ecx, eax
call fcn.100779be
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10068448
push ebx
add ecx, 0xc4
call fcn.100779be
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x70]
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
push ebx
push esi
mov dword [ebx + 0x20], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test eax, eax
jne 0x1006846c
call fcn.100779be
call fcn.10021eea
ret
Function at 0x10070f7c
Capabilities:
Get thread local storage value

Disassembly:
push 4
mov eax, 0x100da5f0
call fcn.100157c2
mov ebx, ecx
mov eax, dword [ebx + 0xc]
push dword [eax + 0x70]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1007103b
push 0
pop edi
and eax, 3
je 0x10070fc4
cmp eax, 1
jne 0x10070fcd
and esi, 0xfffffffe
mov esi, dword [esi + 0x10]
add esi, 8
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10070fc4
mov al, byte [eax + 0x44]
test al, al
jne 0x1007103b
mov ecx, esi
call fcn.10068350
jmp 0x10071002
and esi, 0xfffffffd
lea ecx, [esi + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x10], ecx
call dword [eax + 0x10]
mov esi, dword [esi + 0x20]
mov eax, dword [esi + 0x2c]
add esi, 0x10
test eax, eax
je 0x10070ff3
mov al, byte [eax + 0x44]
test al, al
je 0x10070ff3
mov esi, edi
jmp 0x10070ffa
mov ecx, esi
call fcn.10068350
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x14]
test esi, esi
je 0x1007103b
cmp dword [esi + 0x14], ebx
je 0x10071035
push 0x3c
call fcn.100779be
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x10071028
push esi
push ebx
mov ecx, eax
call fcn.100779be
mov edi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.10068350
jmp 0x10071037
mov edi, esi
mov eax, edi
jmp 0x1007103d
xor eax, eax
call fcn.100157f5
ret

Function at 0x10073f6d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x100db7e8
call fcn.100157c2
mov edi, ecx
mov dword [ebp - 0x10], edi
or dword [edi + 4], 0xfffffff
lea ecx, [edi + 0x3c]
xor esi, esi
mov dword [edi + 8], esi
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], 0x80000000
mov dword [edi + 0x18], esi
mov dword [edi + 0x38], esi
call sym.MSVCR120.dll_public:_void___thiscall_Concurrency::event::constructor_void_
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
call fcn.100779be
mov dword [edi + 0xc], eax
mov eax, dword [eax + 0x34]
mov dword [edi], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
test eax, eax
je 0x10073fe8
cmp eax, 2
je 0x10073fe8
xor edx, edx
add eax, 4
inc edx
lock xadd dword [eax], edx
mov ecx, edi
call fcn.10074d68
lea ecx, [edi + 0x3c]
call sym.MSVCR120.dll_public:_void___thiscall_Concurrency::event::set_void_
cmp byte [ebp + 0xc], 0
je 0x10074029
mov edx, dword [edi + 0x64]
mov ecx, edi
add edx, 0x68
mov esi, dword [edx]
mov eax, esi
mov dword [edi + 0x68], esi
lock cmpxchg dword [edx], ecx
jmp 0x10074023
mov dword [edi + 0x68], eax
mov esi, eax
mov ecx, dword [edi + 0x64]
mov edx, edi
add ecx, 0x68
lock cmpxchg dword [ecx], edx
cmp eax, esi
je 0x10074031
jmp 0x10074012
or dword [edi + 0x78], 1
and dword [edi + 0x68], 0
call fcn.1001ffa7
mov esi, eax
cmp dword [esi + 0x20], 0
jne 0x10074045
mov ecx, esi
call fcn.10065b8a
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x40]
and dword [edi + 4], 0xfffffff
mov dword [edi + 0x80], eax
mov eax, edi
call fcn.100157f5
ret 8
Function at 0x10075d62
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100de7b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100e3510]
test dword [ebp + 8], eax
je 0x10075dfc
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x808]
call fcn.100779be
xor eax, eax
mov word [ebp - 8], ax
mov eax, dword [0x100dfd60]
pop ecx
test eax, eax
je 0x10075def
push esi
push edi
lea ecx, [ebp - 0x808]
push ecx
push eax
call sym.MSVCR120.dll_fwprintf
mov edi, dword [0x100e3524]
mov esi, dword [0x100e3520]
pop ecx
pop ecx
push 0
push 0x32
push edi
push esi
call fcn.10032225
add esi, 1
mov dword [0x100e3520], esi
adc edi, 0
or eax, edx
mov dword [0x100e3524], edi
pop edi
pop esi
jne 0x10075dfc
push dword [0x100dfd60]
call sym.MSVCR120.dll_fflush
pop ecx
jmp 0x10075dfc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010cbc
mov esp, ebp
pop ebp
ret

Function at 0x100779be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x100779cd
pop dword [ebp - 0xc]
mov eax, 0x100779cd
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x5c809
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x84d725ac
sub ecx, 0x84d6e0f0
mov esi, eax
mov edi, 0xaeb5d42e
add edi, 0x6158f9d2
add edi, dword [ebp - 0xc]
mov edx, 0x7d327b3e
mov dword [ebp - 8], 0x9743a557
mov ebx, dword [edi]
xor dword [ebp - 4], 0x5783f430
sub ebx, edx
mov dword [ebp - 4], 0xc49cabfb
mov dword [esi], ebx
sub dword [ebp - 8], 0xbf7a3103
add esi, 0xe7147d6
sub esi, 0xe7147d2
add edi, 0xa958348f
sub edi, 0xa958348b
loop 0x10077a1c
add eax, 0x105c3
mov ebx, eax
add eax, 0xb8f0f4a1
sub eax, 0xb8f0f49c
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x401c66
pop dword [ebp - 0x28]
mov eax, 0x413c266
sub eax, 0x3d3a600
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x2ad11408
add dword [ebp - 0x38], 0x23813143
mov dword [ebp - 0x34], 0xcca3a9c2
sub dword [ebp - 0x34], 0x9a705d7d
mov dword [ebp - 0x30], 0x3f0328d
add dword [ebp - 0x30], 0x485c11a1
mov dword [ebp - 0x2c], 0x501f918
add dword [ebp - 0x2c], 0xfafe06e8
lea eax, [ebp - 0x38]
push eax
mov eax, 0x8d117f50
add eax, 0x732eb104
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xc900fc70
add dword [ebp - 0x38], 0xab716ce6
mov dword [ebp - 0x34], 0x79bd9d9
sub dword [ebp - 0x34], 0xc62f7864
mov dword [ebp - 0x30], 0x48e8feed
sub dword [ebp - 0x30], 0xe5799281
mov dword [ebp - 0x2c], 0x7d6be101
add dword [ebp - 0x2c], 0x82941eff
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x26b5ca7b
add eax, 0xd98a65b1
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x39042
push 0
call eax
mov ecx, 0x5224
mov edi, eax
mov edx, 0x454767e6
add edx, 0xbaf9081a
add edx, dword [ebp - 0x28]
mov esi, 0x51669017
add esi, 0x96bb63c0
xor dword [ebp - 8], esi
mov ebx, dword [edx]
add dword [ebp - 0x20], 0x2d210451
xor ebx, esi
xor dword [ebp - 0x1c], ecx
mov dword [edi], ebx
add dword [ebp - 0x24], esi
add edi, 0x2d1b95b7
sub edi, 0x2d1b95b3
add edx, 0x7e3818bd
add edx, 0x81c7e747
loop 0x401d82
add eax, 0x37aedb27
sub eax, 0x37ad9fc4
mov ebx, eax
add eax, 0xee9562b3
sub eax, 0xee9562ae
mov ecx, 0xecfc9f12
add ecx, 0x134360ee
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x4557f0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x562d74
mov dword [ebx], 0
call esi
cmp eax, 0xfffffffe
jne 0x45587d
push edi
push 0
push 1
push 0x565da4
call esi
cmp eax, 1
jne 0x45583a
mov edi, dword [sym.imp.kernel32.dll_Sleep]
push 1
call edi
push 0
push 1
push 0x565da4
call esi
cmp eax, 1
je 0x455826
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x562d74
call esi
mov edi, dword [sym.imp.kernel32.dll_InterlockedExchange]
mov esi, eax
cmp esi, 0xfffffffe
jne 0x455867
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x455867
push esi
push 0x562d74
call edi
push 0
push 0x565da4
call edi
pop edi
cmp esi, 0xffffffff
jne 0x45587d
mov eax, 0x8007000e
pop esi
ret
mov eax, dword [0x562d74]
test eax, eax
jl 0x4558a1
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4558a1
inc dword [eax + 0x128]
mov dword [ebx], 1
xor eax, eax
pop esi
ret
push 0x12c
call sub.msvcrt.dll_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x455876
push 0x12c
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x128], 1
mov dword [ebx], 1
mov eax, dword [0x562d74]
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor eax, eax
pop esi
ret

Function at 0x455920
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x565da0], 0
jne 0x4559b0
cmp dword [0x565da8], 0
je 0x4559a9
push esi
mov esi, 0x565db4
lea esp, [esp]
mov eax, dword [esi - 0xc]
push eax
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
je 0x45599f
mov ecx, dword [esi - 4]
sub ecx, 0
je 0x455988
sub ecx, 1
je 0x455968
sub ecx, 1
jne 0x45599f
mov ecx, dword [esi]
mov dword [ecx], eax
jmp 0x45599f
mov edx, dword [esi]
push edx
push 0x43909c
push eax
call sub.msvcrt.dll_sscanf
add esp, 0xc
cmp eax, 1
je 0x45599f
mov eax, dword [esi]
mov dword [eax], 0
jmp 0x45599f
cmp byte [eax], 0x30
jne 0x45599a
cmp byte [eax + 1], 0
jne 0x45599a
mov ecx, dword [esi]
mov byte [ecx], 0
jmp 0x45599f
mov edx, dword [esi]
mov byte [edx], 1
add esi, 0x10
cmp dword [esi - 0xc], 0
jne 0x455940
pop esi
mov byte [0x565da0], 1
ret

Function at 0x455a00
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x562d74]
test eax, eax
jge 0x455a0d
xor eax, eax
jmp 0x455a14
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor ecx, ecx
lea edx, [eax + 0x20]
lea esp, [esp]
cmp dword [ecx*4 + 0x429d54], edi
jne 0x455a2e
cmp dword [edx], 0
jne 0x455a43
inc ecx
add edx, 8
cmp ecx, 0xf
jb 0x455a20
mov ecx, dword [eax + 0x1c]
push 0x10
push edi
call fcn.0049b1f0
ret
mov edx, dword [eax + ecx*8 + 0x20]
test edx, edx
je 0x455a65
push esi
mov esi, dword [edx]
mov dword [eax + ecx*8 + 0x20], esi
test esi, esi
pop esi
jne 0x455a5f
mov dword [eax + ecx*8 + 0x24], 0
mov dword [edx], 0xfefefefe
cmp ecx, 0xf
jb 0x455a76
mov ecx, dword [eax + 0x1c]
push 0x10
push edi
call fcn.0049b1f0
ret
mov eax, edx
ret
Function at 0x45adb0
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x45ae04
mov eax, dword [0x562d74]
push ebx
push edi
test eax, eax
jge 0x45adc3
xor ebx, ebx
jmp 0x45adcc
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [esi + 4]
mov eax, dword [edi*4 + 0x429d54]
push eax
push 0xfe
push esi
call sub.msvcrt.dll_memset
lea ecx, [ebx + edi*8 + 0x24]
mov dword [esi], 0
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x45adfc
pop edi
mov dword [eax], esi
mov dword [ecx], esi
pop ebx
ret
mov dword [ebx + edi*8 + 0x20], esi
pop edi
mov dword [ecx], esi
pop ebx
ret

Function at 0x49b1f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x49b1ff
pop dword [ebp - 4]
mov eax, 0xe8d4a829
add eax, 0x177509d6
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x5eb39
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x48fa
xor esi, esi
add esi, eax
mov edi, 0x21ae4bac
sub edi, 0x21574fac
add edi, dword [ebp - 4]
mov edx, 0x762847b1
add edx, 0xf4c47c74
mov ebx, dword [edi]
xor ebx, edx
mov dword [esi], ebx
add esi, 0xd6ef9427
sub esi, 0xd6ef9423
add edi, 4
loop 0x49b255
add eax, 0x6b7c1b06
add eax, 0x9484fbb5
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x513d80
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x562d74]
test eax, eax
jge 0x513d8d
xor eax, eax
jmp 0x513d94
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp dword [eax + 8], 0
je 0x513db9
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x513da4
xor eax, eax
ret
mov edx, dword [ecx]
mov dword [eax + 8], edx
test edx, edx
jne 0x513db0
mov dword [eax + 0xc], edx
mov dword [ecx], 0xfefefefe
mov eax, ecx
ret
mov ecx, dword [eax + 4]
push 0x10
push 0xf0
call fcn.0049b1f0
ret

Function at 0x513dd0
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x513e19
mov eax, dword [0x562d74]
push edi
test eax, eax
jge 0x513de2
xor edi, edi
jmp 0x513deb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
push 0xf0
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0xc]
add esp, 0xc
test eax, eax
je 0x513e12
mov dword [eax], esi
mov dword [edi + 0xc], esi
pop edi
ret
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
pop edi
ret
Function at 0x5167c0
Capabilities:
Get thread local storage value

Disassembly:
cmp word [esi + 0x40], 0
push edi
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
je 0x51680f
mov eax, dword [0x562d74]
test eax, eax
jge 0x5167db
xor eax, eax
jmp 0x5167de
push eax
call edi
movzx ecx, word [esi + 0x40]
cmp ecx, dword [eax + 0x124]
ja 0x516806
mov edx, dword [esi + 4]
mov eax, dword [eax + 0x120]
shl ecx, 4
lea eax, [ecx + eax - 0x10]
test edx, edx
je 0x516806
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
xor edx, edx
mov word [esi + 0x40], dx
mov dword [esi + 4], edx
cmp word [esi + 0x42], 0
je 0x516857
mov eax, dword [0x562d74]
test eax, eax
jge 0x516823
xor eax, eax
jmp 0x516826
push eax
call edi
movzx ecx, word [esi + 0x42]
cmp ecx, dword [eax + 0x124]
ja 0x51684e
mov edx, dword [esi + 0xc]
mov eax, dword [eax + 0x120]
shl ecx, 4
lea eax, [ecx + eax - 0x10]
test edx, edx
je 0x51684e
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
xor edx, edx
mov word [esi + 0x42], dx
mov dword [esi + 0xc], edx
pop edi
ret

Function at 0x518af0
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x518b36
mov eax, dword [0x562d74]
test eax, eax
jl 0x518b36
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x518b35
push 0x44
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x18]
add esp, 0xc
test eax, eax
je 0x518b2f
mov dword [eax], esi
mov dword [edi + 0x18], esi
pop edi
ret
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], esi
pop edi
ret
Function at 0x55a512
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov ecx, dword [esi]
push edi
mov dword [ebp - 4], ebx
cmp ecx, 0x35
jne 0x55a578
push ecx
mov ecx, ebx
call fcn.0049b1f0
mov eax, dword [esi + 0x508]
shr eax, 2
inc eax
inc eax
push eax
mov ecx, ebx
call fcn.0049b1f0
xor edi, edi
test dword [esi + 0x508], 0xfffffffc
jbe 0x55a571
mov eax, dword [esi + 0x50c]
push dword [eax + edi*4]
mov ecx, ebx
call fcn.0049b1f0
mov eax, dword [esi + 0x508]
inc edi
shr eax, 2
cmp edi, eax
jb 0x55a553
mov ecx, ebx
jmp 0x55a681
mov eax, dword [esi + 0x4ec]
neg eax
sbb eax, eax
mov edx, ecx
and eax, 0x80000000
and edx, 0x7ff
or eax, edx
cmp ecx, 0x1f
jg 0x55a5b9
je 0x55a5ab
sub ecx, 3
je 0x55a5ab
dec ecx
dec ecx
je 0x55a5ab
sub ecx, 3
je 0x55a5ab
sub ecx, 5
jne 0x55a5d5
mov ecx, dword [esi + 0x504]
and ecx, 1
shl ecx, 0x12
jmp 0x55a5d3
sub ecx, 0x3d
je 0x55a5c7
dec ecx
dec ecx
je 0x55a5ab
sub ecx, 0x30
jne 0x55a5d5
mov ecx, dword [esi + 0x504]
and ecx, 3
shl ecx, 0xb
or eax, ecx
mov ecx, dword [esi + 0x500]
neg ecx
sbb ecx, ecx
and ecx, 0x2000
or ecx, eax
push ecx
mov ecx, ebx
call fcn.0049b1f0
xor ebx, ebx
cmp dword [esi + 0x4ec], ebx
je 0x55a65d
mov eax, dword [esi]
cmp eax, 0x2d
jl 0x55a65d
cmp eax, 0x2e
jle 0x55a61e
cmp eax, 0x44
jle 0x55a65d
cmp eax, 0x4a
jle 0x55a61e
cmp eax, 0x6b
jle 0x55a65d
cmp eax, 0x6d
jle 0x55a61e
cmp eax, 0x7e
jne 0x55a65d
movsx eax, byte [esi + 0x4f6]
movsx ecx, byte [esi + 0x4f5]
and eax, 0xf
and ecx, 0xf
shl eax, 4
or eax, ecx
movsx ecx, byte [esi + 0x4f4]
and ecx, 0xf
shl eax, 4
or eax, ecx
mov ecx, dword [esi + 0x4f0]
and ecx, 0x3f
shl eax, 9
or eax, ecx
mov ecx, dword [ebp - 4]
push eax
call fcn.0049b1f0
lea edi, [esi + 0x4e8]
cmp dword [edi], ebx
jbe 0x55a67e
add esi, 8
mov ecx, dword [ebp - 4]
push esi
call fcn.0049b1f0
inc ebx
add esi, 0xd0
cmp ebx, dword [edi]
jb 0x55a66a
mov ecx, dword [ebp - 4]
call fcn.00495b00
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x405340
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, dword [esp + 4]
push 3
call fcn.004218a0
add esp, 4
push str.6ojlDCjfteCozqTBJdTa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40537a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00404c20
cmp esi, 0x10
jb 0x4053af
mov eax, dword [esp + 4]
lea ecx, [esi + 1]
cmp ecx, 0x1000
jb 0x4053a5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4053b8
mov eax, edx
push ecx
push eax
call fcn.00476f46
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
call fcn.00483ee1
int3

Function at 0x405420
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x405440
pop edi
mov dword [ecx], 0x270
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x420870
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x4208ce
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x420890
mov eax, dword [edi]
jmp 0x4209b9
cmp eax, 0x4e0
jb 0x4209b9
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4208f0
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x420940
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x429b00
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x429baf
push esi
call fcn.0043e000
add esp, 4
test al, al
jne 0x429baf
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x429b27
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.00448b30
add esp, 0xc
test eax, eax
je 0x429b5b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.00448b30
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x429b5d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x429b8e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.00439ba0
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x429b70
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret