joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404d00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
cmp byte [ebx], 0
jne 0x404d32
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.004054e0
pop ecx
mov esi, eax
test esi, esi
jne 0x404d65
push 1
call fcn.00404530
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*4]
push eax
push esi
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x407288], eax
mov dword [0x40728c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404da0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test eax, eax
jne 0x404dbb
mov ebx, dword [0x407358]
mov esi, ebx
xor ecx, ecx
jmp 0x404dde
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404dc6
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404dd9
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404dc1
lea eax, [ecx + 1]
push eax
call fcn.004054e0
pop ecx
mov edi, eax
mov dword [0x407294], eax
cmp dword [0x407294], 0
jne 0x404e05
push 1
call fcn.00404530
pop ecx
mov esi, ebx
jmp 0x404e3a
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404e0e
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404e35
mov ecx, edi
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x404e25
pop eax
mov eax, dword [ebp - 4]
add edi, eax
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404e09
mov byte [edi], 0
cmp ebx, dword [0x407358]
je 0x404e51
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x67a1016e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x40bd5e56
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x377373b5
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x186478f7
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40ef80
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x40ef9e
mov ecx, dword [ebp - 8]
call fcn.00417380
jmp 0x40efb1
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x40efb1
mov ecx, dword [ebp - 8]
call fcn.00417200
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0xb
mov edx, dword [ebp - 8]
and ecx, dword [edx + 0x1384]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4145c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4dd114]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x4145e7
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x4145ee
mov al, 1
jmp 0x4146e1
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x48], edx
call fcn.0041aba0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
call dword [0x4af234]
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
call fcn.0041aba0
mov dword [ebp - 0x50], eax
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x50]
push eax
call fcn.0041ac20
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x414643
xor al, al
jmp 0x4146e1
mov dword [ebp - 0x58], 0x20
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x40
push ecx
mov ecx, dword [ebp - 0x54]
call fcn.00421f10
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x414685
cmp dword [ebp - 0x34], 1
je 0x41468c
cmp dword [ebp - 0x34], 3
je 0x4146db
jmp 0x4146df
mov edx, dword [ebp - 0x30]
mov byte [edx + 0x3d], 0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x38], eax
je 0x4146bb
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
push 1
lea edx, [ebp - 0x28]
push edx
call fcn.0048b678
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x4146bb
xor al, al
jmp 0x4146e1
mov eax, dword [ebp - 0x30]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x4146cf
mov dword [ebp - 0x40], 1
jmp 0x4146d6
mov dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
jmp 0x4146e1
mov al, 1
jmp 0x4146e1
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046913e
mov esp, ebp
pop ebp
ret
Function at 0x4146f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x4dd114]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x414717
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3e]
test edx, edx
jne 0x41471e
mov al, 1
jmp 0x414815
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x4c], edx
call fcn.0041ab90
mov word [ebp - 0x32], ax
movzx eax, word [ebp - 0x32]
push eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
call dword [0x4af234]
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x44]
mov word [ebp - 0x34], ax
call fcn.0041ab90
mov word [ebp - 0x36], ax
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x36]
push eax
call fcn.0041abf0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x414777
xor al, al
jmp 0x414815
mov dword [ebp - 0x54], 0x20
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x40
push ecx
mov ecx, dword [ebp - 0x50]
call fcn.00421f10
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4147b9
cmp dword [ebp - 0x3c], 1
je 0x4147c0
cmp dword [ebp - 0x3c], 3
je 0x41480f
jmp 0x414813
mov edx, dword [ebp - 0x30]
mov byte [edx + 0x3e], 0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x40], eax
je 0x4147ef
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
push 1
lea edx, [ebp - 0x28]
push edx
call fcn.0048b678
add esp, 0x10
cmp dword [ebp - 0x40], eax
je 0x4147ef
xor al, al
jmp 0x414815
mov eax, dword [ebp - 0x30]
movzx ecx, byte [eax + 0x3e]
test ecx, ecx
jne 0x414803
mov dword [ebp - 0x48], 1
jmp 0x41480a
mov dword [ebp - 0x48], 0
mov al, byte [ebp - 0x48]
jmp 0x414815
mov al, 1
jmp 0x414815
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046913e
mov esp, ebp
pop ebp
ret
Function at 0x417200
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x41721b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe3
jge 0x417287
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x41725f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x417266
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x417212
jmp 0x417292
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x26f
jge 0x4172fe
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 1
je 0x4172d6
mov dword [ebp - 0x18], 0x9908b0df
jmp 0x4172dd
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
shr eax, 1
xor eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x417289
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ecx + 4]
and ecx, 0x7fffffff
or edx, ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x41733c
mov dword [ebp - 0x20], 0x9908b0df
jmp 0x417343
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
shr eax, 1
xor eax, dword [ebp - 0x20]
mov ecx, 4
imul edx, ecx, 0x18c
mov ecx, dword [ebp - 8]
xor eax, dword [ecx + edx + 4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 4], eax
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
Function at 0x417380
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x41739b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jge 0x417407
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x4173df
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x4173e6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x417392
mov esp, ebp
pop ebp
ret
Function at 0x41fb50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4dd114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x38], ecx
call fcn.0041aba0
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.0041ac20
add esp, 8
movzx edx, al
test edx, edx
je 0x41fb94
lea eax, [ebp + 8]
push eax
call fcn.0041f930
add esp, 4
jmp 0x41fd29
mov ecx, dword [ebp - 0x38]
call fcn.004202e0
test eax, eax
je 0x41fbda
mov ecx, dword [ebp - 0x38]
call fcn.004202e0
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.0041abb0
cmp esi, eax
jae 0x41fbda
lea ecx, [ebp + 8]
push ecx
call fcn.004216b0
add esp, 4
mov byte [ebp - 0x39], al
mov ecx, dword [ebp - 0x38]
call fcn.00416f80
mov dl, byte [ebp - 0x39]
mov byte [eax], dl
mov eax, dword [ebp + 8]
jmp 0x41fd29
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x4c], 0
jne 0x41fbed
call fcn.0041aba0
jmp 0x41fd29
mov ecx, dword [ebp - 0x38]
call fcn.004175f0
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x38], 0
jne 0x41fc46
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x54], eax
lea ecx, [ebp + 8]
push ecx
call fcn.004216b0
add esp, 4
mov byte [ebp - 0x3a], al
mov edx, dword [ebp - 0x54]
push edx
movzx eax, byte [ebp - 0x3a]
push eax
call fcn.004045d0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x41fc36
mov edx, dword [ebp + 8]
mov dword [ebp - 0x48], edx
jmp 0x41fc3e
call fcn.0041aba0
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x41fd29
mov dword [ebp - 0x5c], 0x20
lea eax, [ebp + 8]
push eax
call fcn.004216b0
add esp, 4
mov byte [ebp - 0x2a], al
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x58], edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x29]
push ecx
lea edx, [ebp - 0x2a]
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x58]
call fcn.0041fb00
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x41fd24
cmp dword [ebp - 0x40], 1
jle 0x41fca7
cmp dword [ebp - 0x40], 3
je 0x41fcf4
jmp 0x41fd24
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x44], ecx
je 0x41fcd9
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x44]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0048b678
add esp, 0x10
cmp dword [ebp - 0x44], eax
je 0x41fcd9
call fcn.0041aba0
jmp 0x41fd29
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2a]
cmp dword [ebp - 0x34], edx
je 0x41fced
mov eax, dword [ebp + 8]
jmp 0x41fd29
call fcn.0041aba0
jmp 0x41fd29
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2a]
push edx
call fcn.004045d0
add esp, 8
movzx eax, al
test eax, eax
je 0x41fd17
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x4c], ecx
jmp 0x41fd1f
call fcn.0041aba0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
jmp 0x41fd29
call fcn.0041aba0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046913e
mov esp, ebp
pop ebp
ret 4
Function at 0x41fd40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4dd114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x38], ecx
call fcn.0041ab90
mov word [ebp - 0x3e], ax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x3e]
push ecx
call fcn.0041abf0
add esp, 8
movzx edx, al
test edx, edx
je 0x41fd85
lea eax, [ebp + 8]
push eax
call fcn.0041f8d0
add esp, 4
jmp 0x41ff2c
mov ecx, dword [ebp - 0x38]
call fcn.004202e0
test eax, eax
je 0x41fdcf
mov ecx, dword [ebp - 0x38]
call fcn.004202e0
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.0041abd0
cmp esi, eax
jae 0x41fdcf
lea ecx, [ebp + 8]
push ecx
call fcn.004216a0
add esp, 4
mov word [ebp - 0x40], ax
mov ecx, dword [ebp - 0x38]
call fcn.00416fd0
mov dx, word [ebp - 0x40]
mov word [eax], dx
mov ax, word [ebp + 8]
jmp 0x41ff2c
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x4c], 0
jne 0x41fde2
call fcn.0041ab90
jmp 0x41ff2c
mov ecx, dword [ebp - 0x38]
call fcn.00417630
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x38], 0
jne 0x41fe40
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x50], eax
lea ecx, [ebp + 8]
push ecx
call fcn.004216a0
add esp, 4
mov word [ebp - 0x42], ax
mov edx, dword [ebp - 0x50]
push edx
movzx eax, word [ebp - 0x42]
push eax
call fcn.00404610
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x41fe2e
mov dx, word [ebp + 8]
mov word [ebp - 0x3a], dx
jmp 0x41fe37
call fcn.0041ab90
mov word [ebp - 0x3a], ax
mov ax, word [ebp - 0x3a]
jmp 0x41ff2c
mov dword [ebp - 0x58], 0x20
lea eax, [ebp + 8]
push eax
call fcn.004216a0
add esp, 4
mov word [ebp - 0x2c], ax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x54], edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2a]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x54]
call fcn.0041fb00
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x41ff27
cmp dword [ebp - 0x48], 1
jle 0x41fea5
cmp dword [ebp - 0x48], 3
je 0x41fef3
jmp 0x41ff27
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x4c], ecx
je 0x41fed7
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0048b678
add esp, 0x10
cmp dword [ebp - 0x4c], eax
je 0x41fed7
call fcn.0041ab90
jmp 0x41ff2c
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3e], 1
lea edx, [ebp - 0x2c]
cmp dword [ebp - 0x34], edx
je 0x41feec
mov ax, word [ebp + 8]
jmp 0x41ff2c
call fcn.0041ab90
jmp 0x41ff2c
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, word [ebp - 0x2c]
push edx
call fcn.00404610
add esp, 8
movzx eax, al
test eax, eax
je 0x41ff18
mov cx, word [ebp + 8]
mov word [ebp - 0x3c], cx
jmp 0x41ff21
call fcn.0041ab90
mov word [ebp - 0x3c], ax
mov ax, word [ebp - 0x3c]
jmp 0x41ff2c
call fcn.0041ab90
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046913e
mov esp, ebp
pop ebp
ret 4
Function at 0x432ac0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x432bf1
test al, 3
jne 0x432bf1
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x432bac
cmp edi, 8
jb 0x432b75
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x432b24
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x432bb0
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x432b92
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x432bb4
xor edi, edi
jmp 0x432bb4
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x432bc8
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x432cb0
cmp ecx, 0x20
jb 0x432c8a
mov esi, ecx
xorps xmm3, xmm3
and esi, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x1c], esi
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x432c25
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x432cb0
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
nop dword [eax]
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x432ca0
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x450870
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x4e5204], 0
jne 0x45087e
call fcn.00464340
cmp byte [0x4e520d], 0
je 0x45089c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00465160
add esp, 0x10
ret
jmp fcn.0044ebb0

Function at 0x4508b0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9e78
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4dd114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0xf0000000
push 1
push 0
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x450926
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x450926
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
je 0x450944
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046913e
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.CryptAcquireContext
lea ecx, [ebp - 0x28]
call fcn.004092c0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x50]
call fcn.00450a10
push 0x4d7508
lea eax, [ebp - 0x50]
push eax
call fcn.00480578
int3

Function at 0x46be91
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x49591b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004955de

Function at 0x495926
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049575f

Function at 0x49dbfc
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049d8bc

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x29925a33
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x6a1e1eee
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219