joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406609
Capabilities:
Hide graphical window

Disassembly:
push 0x13c
mov eax, 0x415f62
call fcn.00414c14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebx + 0x24], 7
mov dword [ebp - 0x148], 1
call fcn.00407a43
and dword [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::LongToString_long_int__class_GCStackStrBase___long_int_]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x11c], 1
call fcn.0040337b
lea esi, [ebp - 0x128]
call fcn.00407981
mov byte [ebp - 4], 1
lea edi, [ebx + 8]
push 0
xor eax, eax
call fcn.00407741
test eax, eax
jne 0x4066a8
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4066cd
push ebx
push edi
call fcn.00407729
push 0
push 0x4076dc
push dword [ebp - 0x12c]
push 0x51c
push dword [0x424edc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov byte [ebp - 4], 0
lea esi, [ebp - 0x128]
call fcn.0040796b
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x124]
push eax
call fcn.00408436
call fcn.00414c5e
ret 8

Function at 0x4066ff
Capabilities:
Hide graphical window

Disassembly:
push 0x13c
mov eax, 0x415f62
call fcn.00414c14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebx + 0x24], 8
mov dword [ebp - 0x148], 1
call fcn.00407a43
and dword [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::LongToString_long_int__class_GCStackStrBase___long_int_]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x11c], 1
call fcn.0040337b
lea esi, [ebp - 0x128]
call fcn.00407981
mov byte [ebp - 4], 1
lea edi, [ebx + 8]
push 0
xor eax, eax
call fcn.00407741
test eax, eax
jne 0x40679e
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4067c3
push ebx
push edi
call fcn.00407729
push 0
push 0x4076dc
push dword [ebp - 0x12c]
push 0x51d
push dword [0x424edc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov byte [ebp - 4], 0
lea esi, [ebp - 0x128]
call fcn.0040796b
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x124]
push eax
call fcn.00408436
call fcn.00414c5e
ret 8
Function at 0x4067f5
Capabilities:
Hide graphical window

Disassembly:
push 0x13c
mov eax, 0x415f62
call fcn.00414c14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebx + 0x24], 9
mov dword [ebp - 0x148], 1
call fcn.00407a43
and dword [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::LongToString_long_int__class_GCStackStrBase___long_int_]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x11c], 1
call fcn.0040337b
lea esi, [ebp - 0x128]
call fcn.00407981
mov byte [ebp - 4], 1
lea edi, [ebx + 8]
push 0
xor eax, eax
call fcn.00407741
test eax, eax
jne 0x406894
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4068b9
push ebx
push edi
call fcn.00407729
push 0
push 0x4076dc
push dword [ebp - 0x12c]
push 0x51e
push dword [0x424edc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov byte [ebp - 4], 0
lea esi, [ebp - 0x128]
call fcn.0040796b
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x124]
push eax
call fcn.00408436
call fcn.00414c5e
ret 8

Function at 0x4095d4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4164b3
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x419448]
xor eax, esp
mov dword [esp + 0x418], eax
push esi
mov eax, dword [0x419448]
xor eax, esp
push eax
lea eax, [esp + 0x428]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
mov esi, ecx
call fcn.00408d41
and dword [esp + 0x430], 0
lea eax, [esp + 0xc]
push eax
movzx eax, word [ebp + 8]
push eax
mov eax, esi
call fcn.0040a710
push dword [esp + 0xc]
add esi, 0x30
push esi
call fcn.00407829
or dword [esp + 0x430], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.00408436
xor eax, eax
inc eax
mov ecx, dword [esp + 0x428]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.0040c4c6
mov esp, ebp
pop ebp
ret 4
Function at 0x40a18f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x416bca
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x419448]
xor eax, esp
mov dword [esp + 0x414], eax
mov eax, dword [0x419448]
xor eax, esp
push eax
lea eax, [esp + 0x420]
mov dword fs:[0], eax
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_SetFocus]
lea eax, [esp + 4]
push eax
call fcn.00408d41
and dword [esp + 0x428], 0
lea eax, [esp + 4]
push eax
push 0x1bd
mov eax, esi
call fcn.0040a710
cmp byte [esp + 0xc], 0
je 0x40a221
push dword [esp + 4]
call fcn.0040769e
mov ecx, dword [esp + 4]
add eax, eax
mov dword [ecx - 4], eax
mov byte [esp + 0xc], 0
mov eax, dword [esp + 4]
test dword [eax - 4], 0xfffffffe
jbe 0x40a236
mov eax, dword [esi + 0x28]
call fcn.00405eec
or dword [esp + 0x428], 0xffffffff
lea eax, [esp + 4]
push eax
call fcn.00408436
mov ecx, dword [esp + 0x420]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0040c4c6
mov esp, ebp
pop ebp
ret
Function at 0x40c412
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push str.HeapSetInformation
push 0x41944c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40c447
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ebx, 0x419448
push ebx
call edi
test esi, esi
mov dword [0x419448], esi
jne 0x40c4ab
mov dword [0x419448], 0xbb40e64e
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
call edi
pop edi
pop esi
mov dword [section..data], 0x44bf19b1
pop ebx
leave
ret

Function at 0x40c4c6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419448]
jne 0x40c4cf
ret
jmp fcn.0040d579

Function at 0x40c83f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x419448]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0040c7d4
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0040d2b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x40c88e
cmp dword [ebp - 0x1c], 5
jb 0x40c8a6
jmp 0x40c8a2
cmp dword [ebp - 0x10], 1
jne 0x40c8a6
cmp dword [ebp - 0x1c], 4
ja 0x40c8a2
jne 0x40c8a6
cmp dword [ebp - 0x18], 0
jbe 0x40c8a6
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4194ac
call fcn.0040c2ac
test eax, eax
jge 0x40c8c7
mov byte [0x425b14], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040c4c6
add ebp, 0x78
leave
ret
Function at 0x40ca79
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x424f3c], 0
push esi
jne 0x40c9ec
call fcn.0040c917
test eax, eax
je 0x40ca2f
mov eax, dword [0x424f3c]
cmp eax, 1
jne 0x40ca0d
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40ca2f
pop esi
ret
push eax
call dword [0x424f44]
test eax, eax
jne 0x40ca77
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40ca33
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x424f3c]
call dword [0x424f44]
mov edi, eax
test edi, edi
je 0x40ca5a
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x40ca76
lea edi, [esi + 0xff0]
push esi
push dword [0x424f3c]
call dword [0x424f40]
add esi, 0x10
cmp esi, edi
jb 0x40ca60
mov eax, esi
pop edi
pop esi
ret
jmp 0x40c9d9
Function at 0x40d56f
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x60
push 0x41dae0
call fcn.0040d680
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov edi, 0x94
push edi
push 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40d3da
push 0x12
call fcn.0040d32a
pop ecx
jmp 0x40d564
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
push 0
test eax, eax
jne 0x40d3f8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40d564
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0xc]
and edi, 0x7fff
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x20]
cmp esi, 2
je 0x40d42a
or edi, 0x8000
mov ecx, dword [ebp - 0x24]
mov eax, ecx
shl eax, 8
mov edx, dword [ebp - 0x28]
add eax, edx
mov dword [0x42542c], esi
mov dword [0x425434], eax
mov dword [0x425438], ecx
mov dword [0x42543c], edx
mov dword [0x425430], edi
call fcn.0040d34e
mov dword [ebp - 0x20], eax
xor ebx, ebx
inc ebx
push ebx
call fcn.0040e0b6
pop ecx
test eax, eax
jne 0x40d472
push 0x1c
call fcn.0040d32a
pop ecx
call fcn.0040f594
test eax, eax
jne 0x40d483
push 0x10
call fcn.0040d32a
pop ecx
call fcn.004106d6
mov dword [ebp - 4], ebx
call fcn.00410496
test eax, eax
jge 0x40d49c
push 0x1b
call fcn.0040f88e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x426c9c], eax
call fcn.00410361
mov dword [0x424f70], eax
call fcn.004102a8
test eax, eax
jge 0x40d4c2
push 8
call fcn.0040f88e
pop ecx
call fcn.00410035
test eax, eax
jge 0x40d4d3
push 9
call fcn.0040f88e
pop ecx
push ebx
call fcn.0040f9aa
pop ecx
test eax, eax
je 0x40d4e5
push eax
call fcn.0040f88e
pop ecx
call fcn.0040ffd8
test byte [ebp - 0x44], bl
je 0x40d4f5
movzx ecx, word [ebp - 0x40]
jmp 0x40d4f8
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x400000
call main
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x40d515
push eax
call fcn.0040fb0a
call fcn.0040fb2c
jmp 0x40d54a
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
jmp 0x40d569
mov eax, 0xff
call fcn.0040d6c5
ret
call fcn.0040c412
jmp 0x40d38f
Function at 0x4129c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040f248
xor ebx, ebx
cmp dword [0x425940], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x412a95
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x412a00
xor eax, eax
jmp 0x412b59
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4129f9
push eax
call fcn.0040f1e5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x425940], eax
call esi
push eax
call fcn.0040f1e5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x425944], eax
call esi
push eax
call fcn.0040f1e5
mov dword [0x425948], eax
lea eax, [ebp - 8]
push eax
call fcn.0040f937
test eax, eax
pop ecx
pop ecx
je 0x412a63
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040dbef
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x412a95
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040f1e5
cmp eax, ebx
pop ecx
mov dword [0x425950], eax
je 0x412a95
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040f1e5
pop ecx
mov dword [0x42594c], eax
mov eax, dword [0x42594c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x412b0e
cmp dword [0x425950], esi
je 0x412b0e
push eax
call fcn.0040f251
pop ecx
call eax
cmp eax, ebx
je 0x412adb
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x425950]
call fcn.0040f251
pop ecx
call eax
test eax, eax
je 0x412adb
test byte [ebp - 0x18], 1
jne 0x412b0e
lea eax, [ebp - 0xc]
push eax
call fcn.0040f96e
test eax, eax
pop ecx
je 0x412af6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040dbef
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x412b05
or dword [ebp + 0x10], 0x200000
jmp 0x412b3f
or dword [ebp + 0x10], 0x40000
jmp 0x412b3f
mov eax, dword [0x425944]
cmp eax, esi
je 0x412b3f
push eax
call fcn.0040f251
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x412b3f
mov eax, dword [0x425948]
cmp eax, esi
je 0x412b3f
push dword [ebp - 4]
push eax
call fcn.0040f251
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x425940]
call fcn.0040f251
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4085b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x445bdc], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x446598], ecx
test eax, eax
je 0x408601
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x44659c], ecx
add eax, 2
jmp 0x4085c0
mov dword [0x445bd8], 0x270
ret

Function at 0x408610
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov eax, dword [0x445bd8]
cmp eax, 0x270
jne 0x40866f
mov eax, 0xfffff640
mov edx, dword [0x445bdc]
nop
nop
nop
nop
nop
nop
nop
nop
and edx, 0x80000000
mov esi, dword [eax + 0x4465a0]
mov ecx, esi
and ecx, 0x7ffffffe
or ecx, edx
mov edx, esi
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x446bd0]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x446f5c], esi
add eax, 4
jne 0x408630
mov eax, 0x270
jmp 0x408685
cmp eax, 0x4e0
jb 0x408685
mov ecx, 0x445bd8
call fcn.00408910
mov eax, dword [0x445bd8]
lea ecx, [eax + 1]
mov dword [0x445bd8], ecx
mov eax, dword [eax*4 + 0x445bdc]
mov edx, eax
shr edx, 0xb
and edx, dword [0x446f5c]
xor edx, eax
mov ecx, edx
shl ecx, 7
and ecx, 0x9d2c5680
xor ecx, edx
mov edx, ecx
shl edx, 0xf
and edx, 0xefc40000
xor edx, ecx
shr edx, 0x12
lea eax, [edx + ecx]
and edx, ecx
add edx, edx
sub eax, edx
and eax, 0x7fff
pop esi
ret
Function at 0x4086f0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
call fcn.00439270
test al, al
je 0x408906
call fcn.00432ef0
test al, al
je 0x408901
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov ebp, 0x20f30b1c
mov esi, 0x8f8b279f
shrd esi, ebp, cl
shr ebp, cl
mov edx, 0xdf0cf4e3
mov eax, 0x7074d860
shrd eax, edx, cl
sar edx, cl
mov ebx, ecx
and bl, 0x20
xor ecx, ecx
test bl, bl
je 0x408752
mov esi, ebp
xor ebp, ebp
mov eax, edx
neg bl
sbb ecx, ecx
or ecx, edx
and ecx, 0x20f30b1c
and eax, 0x8f8b279f
and esi, 0x7074d860
or esi, eax
and ebp, 0x1f0cf4e3
or ebp, ecx
mov eax, esi
and eax, 0xb8418629
mov dword [esp], eax
mov ecx, ebp
and ecx, 0x36daa301
mov ebx, esi
and ebx, 0x47be79d6
mov edi, ebx
xor edi, 0x47be79d6
mov eax, edi
imul edi, ecx
mul dword [esp]
mov dword [esp + 8], eax
add edi, edx
mov ecx, ebp
and ecx, 0x9255cfe
or esi, 0x47be79d6
mov eax, esi
imul esi, ecx
xor ecx, 0x49255cfe
imul ecx, dword [esp]
add ecx, edi
mul ebx
add esi, edx
or ebp, 0x49255cfe
imul ebp, ebx
add ebp, esi
add eax, dword [esp + 8]
adc ebp, ecx
mov esi, ebp
shr esi, 0x11
xor esi, ebp
mov edi, ebp
shld edi, eax, 0xf
xor edi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x4088dd
mov ecx, dword [esp + 4]
and cl, 0xf
mov eax, edi
shrd eax, esi, cl
mov dword [esp], eax
mov edx, esi
shr edx, cl
mov dword [esp + 8], edx
mov ecx, eax
and ecx, edi
and edx, esi
mov ebp, edx
mov eax, ecx
or eax, 2
mov ebx, ecx
and ebx, 2
mul ebx
mov dword [esp + 4], eax
mov eax, edx
mov edx, ebp
imul ebp, ebx
or ebp, eax
xor ebx, 2
mov eax, ebx
imul ebx, edx
and ecx, 0xfffffffd
mul ecx
or ebx, edx
mov edx, dword [esp + 4]
sub edx, dword [esp]
sbb ebp, dword [esp + 8]
add edx, eax
adc ebp, ebx
mov ebx, ebp
not ebx
mov ecx, edx
not ecx
and ebx, esi
and ecx, edi
shld ebx, ecx, 1
add ecx, ecx
xor ebp, esi
xor edx, edi
sub ecx, edx
sbb ebx, ebp
mov esi, ebx
or esi, 0x4dcb1f77
mov edx, ecx
or edx, 0xe7ac4c8a
mov edi, ebx
not edi
mov eax, ecx
not eax
or edi, 0x4dcb1f77
or eax, 0xe7ac4c8a
add eax, ecx
adc edi, ebx
add eax, 1
adc edi, 0
imul edi, edx
imul esi, eax
mul edx
mov dword [esp], eax
mov ebp, edx
add ebp, esi
add ebp, edi
mov edi, ebx
and edi, 0xb234e088
mov edx, ecx
and edx, 0x1853b375
mov esi, edx
sub esi, ecx
mov ecx, edi
sbb ecx, ebx
add esi, 0xe7ac4c8a
adc ecx, 0x4dcb1f77
imul ecx, edx
mov eax, esi
mul edx
imul edi, esi
mov esi, edx
add esi, edi
add esi, ecx
mov edi, eax
add edi, dword [esp]
adc esi, ebp
or esi, 0x1010101
or edi, 0x1010101
push esi
push edi
call fcn.00409950
add esp, 8
test al, al
je 0x408901
call fcn.0040c550
call fcn.0040b3d0
call fcn.00439a40
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408910
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
and edi, 0x80000000
mov edx, dword [ecx + eax*4 - 0x630]
mov ebx, edx
and ebx, 0x7ffffffe
or ebx, edi
shr ebx, 1
mov esi, edx
and esi, 1
neg esi
and esi, 0x9908b0df
mov edi, ebx
and edi, esi
add esi, ebx
add edi, edi
sub esi, edi
xor esi, dword [ecx + eax*4]
mov edi, edx
mov dword [ecx + eax*4 - 0xff4], esi
inc eax
cmp eax, 0x4e1
jne 0x408920
mov esi, dword [ecx + 0xd50]
mov eax, 0xe4
mov edx, 0x1c6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ebx, [eax - 1]
mov edi, dword [ecx + eax*4 + 0x9c4]
xor ebx, 0x270
mov ebp, edx
and ebp, 0x31e
sub ebp, ebx
mov ebx, ebp
and ebx, 0x18d
xor ebp, 0x18d
lea ebx, [ebx*2]
add ebx, ebp
mov ebp, edi
and ebp, 1
neg ebp
and ebp, 0x9908b0df
xor ebp, dword [ecx + ebx*4 + 4]
mov ebx, edi
and esi, 0x80000000
and ebx, 0x7ffffffe
or ebx, esi
shr ebx, 1
xor ebp, ebx
mov dword [ecx + eax*4], ebp
mov esi, edi
inc eax
add edx, 2
cmp eax, 0x270
jne 0x408980
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41a020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x18], 0x18e31827
mov dword [esp + 0x1c], 0x18e418f9
mov dword [esp + 0x20], 0x180d18e2
mov eax, 0x4a48
mov ecx, 0xab1cb5b7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + eax*2 - 0x9478]
mov edx, eax
xor edx, ecx
and edx, esi
xor edx, ecx
lea esi, [edx + edx]
not esi
add esi, edx
add esi, 0x58e5adbf
mov edi, esi
and edi, 1
and esi, 0xfffe
and edx, 1
or edx, esi
xor edx, 1
lea edx, [edx + edi*2]
mov word [esp + eax*2 - 0x9478], dx
inc eax
dec ecx
cmp eax, 0x4a4e
jne 0x41a060
mov dword [esp + 0x30], 0xf8cdf8d0
mov dword [esp + 0x34], 0xf8cbf8ce
mov dword [esp + 0x38], 0xf712f706
mov dword [esp + 0x3c], 0xf8d3f711
mov dword [esp + 0x40], 0xf922f92f
mov dword [esp + 0x44], 0xf92ff923
mov dword [esp + 0x48], 0xf92af92c
mov dword [esp + 0x4c], 0xf933f935
mov dword [esp + 0x50], 0xf6c9f6f2
xor eax, eax
nop
nop
lea ecx, [eax + 0x70f8]
xor cx, word [esp + eax*2 + 0x30]
add ecx, 0x7840
mov word [esp + eax*2 + 0x30], cx
inc eax
cmp eax, 0x12
jne 0x41a0f0
movzx ecx, word [esp + 0x30]
lea eax, [esp + 0x15c]
test cx, cx
je 0x41a143
lea edx, [esp + 0x32]
mov esi, dword [ebp + 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a130
jmp 0x41a146
mov esi, dword [ebp + 0x10]
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x41a171
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a160
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x41a1a1
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a190
mov word [eax], 0
mov edi, dword [ebx]
mov dword [esp + 0x30], 0x5cd0520
mov word [esp + 0x34], 0x7e2c
mov eax, 0xf1fa
mov ecx, 0xe05
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + eax*2 - 0x1e3c4]
mov esi, edx
not esi
or esi, ecx
or edx, eax
and edx, esi
add edx, 0x7030
mov word [esp + eax*2 - 0x1e3c4], dx
inc eax
dec ecx
cmp eax, 0xf1fd
jne 0x41a1d0
movzx eax, byte [esp + 0x30]
test al, al
je 0x41a21b
lea ecx, [esp + 0x31]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41a210
mov dword [esp + 0x10], edi
mov byte [edi], 0
lea eax, [esp + 0x140]
lea ecx, [esp + 0x150]
lea edx, [esp + 0x2c]
lea esi, [esp + 0x15c]
push eax
push ecx
push edx
push esi
call fcn.0040ad10
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x442580]
mov ecx, 0xf7d41967
xor ecx, dword [0x442588]
add eax, ecx
inc eax
jmp eax