joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003518
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop eax
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], pe_nt_image_headers32
mov byte [ebp - 0x47], 0xa7
call fcn.010032b5
loopne 0x10035b5
mov ch, 0xe3
lea eax, [ebp - 0x58]
push eax
call fcn.010032c5
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0100327a
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10035a3
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
ret 0x88ec

Function at 0x10035e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.010032b5
xchg edi, eax
add byte [esi + 0x50c0458d], bh
call fcn.010032c5
push eax
push esi
push dword [ebp + 8]
call fcn.0100327a
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.010032b5
scasb al, byte es:[edi]
xchg ebp, eax
invalid
Function at 0x10036ba
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmpsb byte [esi], byte es:[edi]
inc ecx
call fcn.010032c5
push eax
push esi
push dword [ebp + 8]
call fcn.0100327a
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.010032c5
push eax
push esi
push dword [ebp + 8]
call fcn.0100327a
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.010032b5
push edx
insb byte es:[edi], dx
adc eax, ecx
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.010032b5
xchg ebx, eax
jne 0x10037ce
pop ecx
lea eax, [ebp - 0x84]
push eax
call fcn.010032c5
push eax
push esi
push dword [ebp + 8]
call fcn.0100327a
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x1003aae
invalid
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.01003226
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x1003825
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.01003226
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x10037f2
call fcn.010032b5
xor byte [edi + 0x7e8b44a0], 0x3c
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x1003aa4
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x100385a
cmp dword [eax + 0xc], ebx
je 0x10038fd
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.010032b5
pop ds
aad 0xcf
pop edi
cmp dword [ebp + 0xc], ebx
jne 0x1003889
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x1003aa4
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x100389d
mov dword [ebp + 0x10], edi
jmp 0x10038a2
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.010032b5
invalid
call fcn.010032b5
fld xword [0x878b38fa]
mov al, byte [0x3b000000]
cmp eax, ebx
Function at 0x100392a
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1003969
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1003964
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
or dword [ebx + 0xe281d1], ecx
lock add byte [eax], al
or dword [ebx + 0xe281d1], ecx
lock add byte [eax], al
cmp edx, 0x3000
jne 0x100394e
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1003956
cmp edx, ebx
jne 0x1003aa4
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1003925
add eax, dword [eax + 4]
jmp 0x1003912
mov dword [ebp + 0xc], ebx
jmp 0x1003974
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100398c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10039aa
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1003a08
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10039ef
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10039f8
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1003a02
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10039e4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100396e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1003a55
dec eax
je 0x1003a4c
sub eax, 3
je 0x1003a43
mov dword [ebp - 4], 0x40
jmp 0x1003a72
mov dword [ebp - 4], 4
jmp 0x1003a58
mov dword [ebp - 4], 0x20
jmp 0x1003a58
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1003aa4
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1003a24
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.010032b5
add esi, dword [ebx - 0x15]
inc esp
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x1003ab0
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x57ba40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x78000]
push edi
jmp 0x57ba5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x57ba61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57ba50
mov eax, 1
add ebx, ebx
jne 0x57ba73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x57ba84
jne 0x57baa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57baa3
dec eax
add ebx, ebx
jne 0x57ba90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x57ba68
add ebx, ebx
jne 0x57ba9f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x57baf5
xor ecx, ecx
sub eax, 3
jb 0x57babb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x57bb2a
sar eax, 1
mov ebp, eax
jmp 0x57bac6
add ebx, ebx
jne 0x57bac6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57ba94
inc ecx
add ebx, ebx
jne 0x57bad4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57ba94
add ebx, ebx
jne 0x57bae1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x57bad6
jne 0x57baf2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x57bad6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x57bb14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x57bb06
jmp 0x57ba56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x57bb14
add edi, ecx
jmp 0x57ba56
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x57bb32
cmp byte [edi], 0x11
jne 0x57bb32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x57bb37
lea edi, [esi + 0x16e000]
mov eax, dword [edi]
or eax, eax
je 0x57bbaf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17c5d4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17c778]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x57bb64
mov ecx, edi
jns 0x57bb93
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x17c780]
or eax, eax
je 0x57bba9
mov dword [ebx], eax
add ebx, 4
jmp 0x57bb81
call dword [esi + 0x17c77c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x57bbe0
cmp al, 0xef
ja 0x57bbd3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x57bbb5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x57bbc2
mov ebp, dword [esi + 0x17c784]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x57bc14
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x401320
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
test eax, eax
jne 0x40136c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push dword [ebp + 8]
push str.Cant_open_file__s:__s_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401b20
add esp, 0x10
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop ebp
ret

Function at 0x401600
Capabilities:
Delete file
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x41905c], 0
je 0x401612
pop ebp
jmp fcn.004013a0
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
add esp, 0xc
pop ebp
ret
Function at 0x401630
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.0040e5f0
mov eax, dword [0x419014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x410230
push ebx
mov dword [ebp - 0x2010], ebx
mov dword [ebp - 0x200c], esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x401811
push 0x410230
push esi
call fcn.00401320
mov esi, eax
push edi
mov dword [ebp - 0x2008], esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
add esp, 0xc
test eax, eax
jne 0x4017c1
nop word [eax + eax]
mov si, word [0x410234]
lea eax, [ebp - 0x1001]
mov bl, byte [0x410236]
push 0xffd
push 0
push eax
mov word [ebp - 0x1004], si
mov byte [ebp - 0x1002], bl
call sub.VCRUNTIME140.dll_memset
push 0xffd
lea eax, [ebp - 0x2001]
mov word [ebp - 0x2004], si
push 0
push eax
mov byte [ebp - 0x2002], bl
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
add esp, 0x18
cmp byte [ebp - 0x2004], 0x23
jne 0x401737
mov ebx, dword [ebp - 0x2008]
cmp byte [ebp - 0x2003], 0x6c
jne 0x401737
push ebx
call esi
add esp, 4
test eax, eax
jne 0x401737
push ebx
lea eax, [ebp - 0x2004]
push 0xfff
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
add esp, 0xc
cmp byte [ebp - 0x2004], 0x23
je 0x401705
cmp byte [ebp - 0x1004], 0x23
jne 0x401772
cmp byte [ebp - 0x1003], 0x6c
jne 0x401772
push edi
call esi
add esp, 4
test eax, eax
jne 0x401772
push edi
lea eax, [ebp - 0x1004]
push 0xfff
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
add esp, 0xc
cmp byte [ebp - 0x1004], 0x23
je 0x401740
lea eax, [ebp - 0x1004]
lea ecx, [ebp - 0x2004]
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4017a0
test dl, dl
je 0x40179c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4017a0
add ecx, 2
add eax, 2
test dl, dl
jne 0x401780
xor eax, eax
jmp 0x4017a5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4017f0
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
add esp, 4
test eax, eax
je 0x4016a0
mov esi, dword [ebp - 0x2008]
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call esi
push edi
call esi
add esp, 8
push dword [ebp - 0x200c]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e5d6
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x2008]
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call esi
push edi
call esi
mov ebx, dword [ebp - 0x2010]
add esp, 8
mov esi, dword [ebp - 0x200c]
push ebx
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040e5d6
mov esp, ebp
pop ebp
ret
Function at 0x40e1d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x41497c
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401b20
add esp, 0xc
push 2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x40ef60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov dword [0x5d7470], eax
xor eax, eax
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5d746c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5d7470], edx
cmp eax, 0x26f
jl 0x40ef70
mov dword [0x569fa0], 0x270
mov esp, ebp
pop ebp
ret

Function at 0x40efb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0xffffffff
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5d7474]
mov ebx, dword [eax*4 + 0x5d7470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5d7aa4]
mov dword [eax*4 + 0x5d7470], edx
cmp eax, 0xe2
jl 0x40efc0
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5d7474]
mov ebx, dword [eax*4 + 0x5d7470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5d70e4]
mov dword [eax*4 + 0x5d7470], edx
cmp eax, 0x26e
jl 0x40f010
mov edx, dword [0x5d7470]
mov ecx, dword [0x5d7e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x5d7aa0]
mov dword [0x5d7e2c], eax
mov dword [0x569fa0], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f0a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [0x569fa0]
add dword [0x569fa0], 1
mov eax, dword [0x5d6020]
cmp eax, dword [0x5696f0]
jne 0x40f0c6
cmp ebx, 0x271
jb 0x40f0e8
mov eax, dword [0x5d6020]
call fcn.0040ef60
not dword [0x5d6020]
mov eax, dword [0x5d6020]
mov dword [0x5696f0], eax
mov ebx, 0x270
lea esi, [esi]
cmp ebx, 0x270
jne 0x40f104
call fcn.0040efb0
xor ebx, ebx
mov dword [0x569fa0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x5d7470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410d30
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ax, word [0x569450]
cmp ax, 0xcb
je 0x410e3c
cmp ax, 0xcc
je 0x410e3c
mov edx, dword [0x5d8070]
test edx, edx
je 0x410d65
mov eax, dword [0x5d7f20]
call edx
mov ebx, eax
jmp 0x410d6a
mov ebx, 0x5d7f24
cmp word [0x5d7f10], 0
jle 0x410d90
mov eax, 0x5d7ef0
call fcn.00410fb0
mov eax, ebx
call fcn.004108b0
mov eax, ebx
call fcn.00410930
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x410db2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x410dad
mov edx, edi
mov eax, ebx
call fcn.0040fd00
jmp 0x410db0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x410d98
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5d7f10], 0
jle 0x410e3c
mov edx, 0x5d7e30
mov eax, ebx
call fcn.0040fe50
mov edi, eax
test edi, edi
je 0x410e0c
mov eax, dword [0x5d7ec4]
mov dword [edi + 0xc], eax
cmp dword [0x5d7ec4], 0
je 0x410e00
mov eax, dword [0x5d7ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5d7ec4], eax
nop
sub word [0x5d7f10], 1
cmp word [0x5d7f10], 0
sete bl
mov eax, 0x5d7ef0
call fcn.00410fd0
test bl, bl
je 0x410e3c
mov eax, 0x5d7ef0
call fcn.00410fa0
lea esi, [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00413730
push ebp
push 0x414bb0
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x41387a
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b450
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x4137df
mov edx, 0x5d72f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x413831
call sub.kernel32.dll_GetLastError
call fcn.00403f70
lea eax, [ebp - 0x10]
call fcn.0040a060
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a4f0
mov edx, dword [ebp - 0x14]
mov ecx, 0x58531c
lea eax, [ebp - 0x10]
call fcn.0040a390
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040ad80
jmp 0x4138c8
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x41384a
cmp eax, ecx
je 0x413854
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040b450
cmp byte [0x5696c0], 0
jne 0x4138c8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040b990
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040adc0
lea esi, [esi]
jmp 0x4138c8
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b450
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x41389e
mov eax, 0x5d72f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x5696c0], 0
jne 0x4138c8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040b990
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040adc0
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00413730
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413d00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5d7260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413ee0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5d7260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.004034f0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x5694c0], eax
mov ebx, eax
jmp 0x413ea3
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x413d88
cmp byte [ebx], 0
je 0x413eac
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x413e03
mov al, byte [ebx]
cmp al, 1
jb 0x413df8
sub al, 0x20
jbe 0x413dc8
sub al, 2
je 0x413ddc
jmp 0x413df8
mov al, byte [ebp - 0x114]
test al, al
je 0x413e08
add dword [ebp - 0x110], 1
jmp 0x413e00
cmp byte [ebx + 1], 0x22
je 0x413df3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413e00
add ebx, 1
jmp 0x413e00
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413db8
test dword [ebp - 0x10c], 0xffffffff
je 0x413e9c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413ee0
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5d7260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413e93
mov al, byte [ebx]
cmp al, 1
jb 0x413e88
sub al, 0x20
jbe 0x413e58
sub al, 2
je 0x413e6c
jmp 0x413e88
mov al, byte [ebp - 0x114]
test al, al
je 0x413e98
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413e90
cmp byte [ebx + 1], 0x22
je 0x413e83
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413e90
add ebx, 1
jmp 0x413e90
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413e48
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x413d8b
mov ebx, dword [ebp - 0x10c]
mov dword [0x5d7250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5d7260
call fcn.00410b60
mov eax, dword [0x5d7260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4175c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov dx, 0xffff
add dx, 1
movsx eax, dx
mov ecx, eax
xor bx, bx
lea esi, [esi]
add bx, 1
mov eax, ecx
and eax, 1
je 0x4175f1
mov eax, ecx
shr eax, 1
xor eax, 0xedb88320
mov ecx, eax
jmp 0x4175f3
shr ecx, 1
cmp bx, 8
jl 0x4175d8
movzx eax, dx
mov dword [eax*4 + 0x5f9d00], ecx
cmp dx, 0xff
jl 0x4175c8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov esi, ecx
cmp dword [0x5f9d04], 0
jne 0x41762c
call fcn.004175c0
mov esi, esi
mov ecx, edi
not ebx
mov eax, ebx
cmp esi, 1
jl 0x417664
xor ebx, ebx
lea esi, [esi]
add ebx, 1
mov dl, al
xor dl, byte [ecx]
and edx, 0xff
mov edi, eax
shr edi, 8
xor edi, dword [edx*4 + 0x5f9d00]
mov eax, edi
add ecx, 1
cmp esi, ebx
jg 0x417640
mov esi, esi
not eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret