joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409514
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x409ae8
call fcn.004097d8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x409574
cmp eax, 0xffffffff
je 0x409574
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40956d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40956d
cmp edx, 0x10000000
jae 0x40956d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40956a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4095e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40961e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x409616
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x409620
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x409606
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4096f0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x409721
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x409721
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x409721
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40d000
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x40
lea eax, [esp + 0x44]
lea ecx, [esp]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
push 0
push eax
push 0x40
push ecx
push esi
call ebx
test eax, eax
je 0x40d175
cmp dword [esp + 0x54], 0x40
jne 0x40d175
cmp word [esp + 0x10], 0x5a4d
jne 0x40d175
mov edx, dword [esp + 0x4c]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push edx
push esi
call ebp
cmp eax, 0xffffffff
je 0x40d175
lea eax, [esp + 0x54]
push 0
push eax
push 0xf8
push 0x413960
push esi
call ebx
test eax, eax
je 0x40d175
cmp dword [esp + 0x54], 0xf8
jne 0x40d175
cmp dword [0x413960], 0x4550
jne 0x40d175
mov eax, dword [0x413976]
test ah, 0x20
jne 0x40d175
mov edx, dword [0x413a80]
xor eax, eax
mov ax, word [0x413966]
add eax, edx
lea eax, [eax + eax*4]
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [0x413a58], eax
je 0x40d175
push 1
push 0
push 0
push esi
call ebp
mov dword [0x413a6c], eax
xor eax, eax
mov ax, word [0x413966]
mov edx, dword [0x413a58]
lea ecx, [esp + 0x54]
push 0
lea edi, [eax + eax*4]
push ecx
shl edi, 3
push edi
push edx
push esi
call ebx
test eax, eax
je 0x40d175
cmp dword [esp + 0x54], edi
jne 0x40d175
push 1
push 0
push 0
push esi
call ebp
mov ecx, dword [0x413a80]
lea ecx, [ecx + ecx*4]
lea edx, [eax + ecx*8]
mov eax, dword [0x4139b4]
cmp edx, eax
ja 0x40d175
mov edi, dword [0x413a58]
mov ecx, dword [0x413988]
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 0xc]
add eax, edx
cmp ecx, eax
jae 0x40d175
xor eax, eax
push 2
mov ax, word [0x413966]
push 0
push 0
push esi
lea ecx, [eax + eax*4]
mov ebx, dword [edi + ecx*8 - 0x18]
lea edi, [edi + ecx*8]
call ebp
mov edx, dword [edi - 0x14]
add edx, ebx
cmp eax, edx
jne 0x40d175
cmp dword [edi - 0x20], ebx
ja 0x40d175
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x40
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
Function at 0x40b230
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b6b0]
jne 0x40b23a
repz ret
jmp fcn.00412ffc

Function at 0x41b32c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b6b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040fee2
and dword [ebp - 0x14], 0
cmp dword [0x462bd8], 0
mov dword [ebp - 0x18], eax
jne 0x41b3df
push 0x403880
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41b487
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403874
push ebx
call edi
test eax, eax
je 0x41b487
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403864
push ebx
mov dword [0x462bd8], eax
call edi
push eax
call esi
push 0x403850
push ebx
mov dword [0x462bdc], eax
call edi
push eax
call esi
push 0x403834
push ebx
mov dword [0x462be0], eax
call edi
push eax
call esi
mov dword [0x462be8], eax
test eax, eax
je 0x41b3df
push 0x40381c
push ebx
call edi
push eax
call esi
mov dword [0x462be4], eax
mov eax, dword [0x462be4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41b438
cmp dword [0x462be8], ecx
je 0x41b438
push eax
call esi
push dword [0x462be8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41b438
test ebx, ebx
je 0x41b438
call edi
test eax, eax
je 0x41b42f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41b42f
test byte [ebp - 8], 1
jne 0x41b438
or dword [ebp + 0x10], 0x200000
jmp 0x41b46b
mov eax, dword [0x462bdc]
cmp eax, dword [ebp - 0x18]
je 0x41b46b
push eax
call esi
test eax, eax
je 0x41b46b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41b46b
mov eax, dword [0x462be0]
cmp eax, dword [ebp - 0x18]
je 0x41b46b
push eax
call esi
test eax, eax
je 0x41b46b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x462bd8]
call esi
test eax, eax
je 0x41b487
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41b489
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b230
leave
ret
Function at 0x422fe0
Capabilities:
Access the windows event log
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1404
call fcn.00422270
cmp dword [0x803960], 0x37
jne 0x42309f
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x4044a8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [esp + 0x408]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4044c8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x404500
push 0
lea ecx, [esp + 0xc0c]
push ecx
push 0x404518
push 0x404540
push 0x404578
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push 0
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
mov ecx, dword [0x803964]
mov eax, dword [0x7ffdd0]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0x1404
ret
Function at 0x414db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x414dd4
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00414ae6
cmp esp, dword [ebx + 0x458d0fcc]
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x414ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, 0x349c45c6
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
inc ecx
call fcn.00414af6
push eax
push esi
push dword [ebp + 8]
call fcn.00414aab
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00414af6
push eax
push esi
push dword [ebp + 8]
call fcn.00414aab
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00414ae6
jp 0x414eec
mov ecx, 0x7c9d88a3
invalid
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43b004]
jne 0x40100a
repz ret
jmp fcn.004018f4

Function at 0x4067a8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040261d
and dword [ebp - 4], 0
cmp dword [0x43ccdc], 0
mov ebx, eax
jne 0x406859
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40690a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40690a
push eax
call fcn.004025ab
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43ccdc], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43cce0], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43cce4], eax
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x43ccec], eax
test eax, eax
je 0x406859
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x43cce8], eax
mov eax, dword [0x43cce8]
cmp eax, ebx
je 0x4068b1
cmp dword [0x43ccec], ebx
je 0x4068b1
push eax
call fcn.00402626
push dword [0x43ccec]
mov esi, eax
call fcn.00402626
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4068b1
test edi, edi
je 0x4068b1
call esi
test eax, eax
je 0x4068a8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4068a8
test byte [ebp - 0xc], 1
jne 0x4068b1
or dword [ebp + 0x10], 0x200000
jmp 0x4068ea
mov eax, dword [0x43cce0]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4068ea
mov eax, dword [0x43cce4]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43ccdc]
call fcn.00402626
pop ecx
test eax, eax
je 0x40690a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40690c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x437970
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push edi
cmp ebp, 0x19f
jne 0x437991
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edi, edi
test ebp, ebp
jle 0x4379e6
push esi
jmp 0x4379a0
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 5
mov dword [esp + 0x10], 0
call fcn.00437960
mov eax, dword [esp + 0x10]
add eax, 0x46
mov dword [esp + 0xc], eax
sub dword [esp + 0xc], 0x46
movsx eax, byte [edi + ebx]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
xor dword [esp + 0x18], eax
mov cl, byte [esp + 0x18]
mov byte [edi + ebx], cl
inc edi
cmp edi, ebp
jl 0x4379a0
pop esi
pop edi
cmp ebp, 0x2d
pop ebp
jne 0x437a01
mov dword [0x2b3aef8], 0xa62e7790
mov dword [0x2b3aefc], 0xffffffff
add esp, 8
ret
Function at 0x40a000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x4c7480]
mov dword [esp + 4], ecx
push esi
push edi
test al, 1
je 0x40b536
mov edi, dword [ebp + 0x10]
xor eax, eax
push 8
mov word [esp + 0x5c], 1
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], 1
call fcn.00420ff6
mov edx, eax
mov dword [esp + 0x20], eax
add esp, 4
test edx, edx
je 0x40b68a
mov dword [edx], 0x14
mov esi, dword [ebp + 0xc]
mov dword [edx + 4], 0
mov dword [esp + 0x54], edx
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [esp + 0x50], 1
mov dword [esp + 0x10], 0x17
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
movsx eax, word [eax + 0xa]
mov dword [esp + 0x5c], eax
jmp 0x40a10a
or eax, 1
mov dword [0x4c7488], 0
push 0x43b83c
mov dword [0x4c7480], eax
mov dword [0x4c7490], 0
mov dword [0x4c7494], 1
call fcn.00422f80
add esp, 4
jmp 0x40a01f
xor edx, edx
mov dword [esp + 0x1c], edx
jmp 0x40a064
Function at 0x4149c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], eax
push esi
push edi
test ebx, ebx
je 0x4481ff
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov eax, dword [esi]
mov ecx, dword [esi + 0x50]
mov dword [ebp - 0x24], ecx
cmp eax, dword [esi + 4]
jae 0x450158
mov edx, dword [ebp - 8]
cmp dword [ebp + 0x18], 0
lea ecx, [ebp + 0x18]
jne 0x448221
push 1
push 0
push 0
push 0
push 0
xor edx, edx
call fcn.004149c0
add esp, 0x14
jmp 0x414b3d
sub ecx, eax
test ecx, ecx
jle 0x448229
neg ecx

Function at 0x415e58
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x415e80
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x415e72
pop edi
pop esi
pop ebp
ret 4

Function at 0x41710e
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, edx
mov dword [ebp - 0x120], ecx
mov ecx, dword [ecx]
mov dword [ebp - 0x140], eax
push ebx
mov edx, dword [eax]
mov eax, ecx
shr eax, 0xb
and eax, 1
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x3c], eax
mov eax, ecx
shr eax, 9
push esi
mov esi, dword [ebp + 8]
and eax, 1
mov dword [ebp - 0xdc], eax
xor eax, 1
push edi
xor edi, edi
mov dword [ebp - 0xe8], eax
mov esi, dword [esi]
mov ebx, edi
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x2c], eax
movsx eax, cl
and eax, dword [ebp - 0xc]
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x84], edi
mov dword [ebp - 8], edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x98], edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xb4], 0xff
mov dword [ebp - 0x12c], 0xfc00
mov dword [ebp - 0x148], 0xdc00
mov dword [ebp - 0x158], 0x2b
mov dword [ebp - 0x128], 0x7b
mov dword [ebp - 0xe4], 0x30
mov dword [ebp - 0x118], 0x29
mov dword [ebp - 0x90], 0x39
mov dword [ebp - 0x110], 0x3c
mov dword [ebp - 0x144], 0x52
mov dword [ebp - 0xe0], 0x27
mov dword [ebp - 0x154], 0x2d
mov dword [ebp - 0x100], 0x10
mov dword [ebp - 0x114], 0x17
mov dword [ebp - 0x14c], 0x20
mov dword [ebp - 0x104], 0x1d
mov dword [ebp - 0x134], 0x1e
mov dword [ebp - 0x10c], 0x1f
mov dword [ebp - 0x13c], 0x6e
mov dword [ebp - 0x11c], 0x6f
mov dword [ebp - 0x150], 0x70
mov dword [ebp - 0x124], 0x71
mov dword [ebp - 0xfc], 0x73
mov dword [ebp - 0x108], 0xf
Function at 0x420bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c6283]
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], al
push 0x8000
push esi
mov edi, edx
call fcn.00424916
pop ecx
push eax
call fcn.00424744
cmp dword [edi + 0xc], 0xb
mov ebx, eax
pop ecx
pop ecx
je 0x456305
lea ecx, [ebp - 0x18]
call fcn.00405c18
mov ecx, edi
call fcn.00409997
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.00405b75
push dword [ebp - 0x18]
push 0x491d28
push esi
call fcn.00424b15
add esp, 0xc
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
jne 0x456325
lea ecx, [ebp - 0x18]
call fcn.00405a64
mov edi, dword [ebp - 8]
push esi
call fcn.00424cda
pop ecx
cmp ebx, 0xffffffff
je 0x420c6e
push ebx
push esi
call fcn.00424916
pop ecx
push eax
call fcn.00424744
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4000
jmp 0x420c56
push esi
mov ecx, edi
call fcn.004689e2
push eax
push 1
call fcn.0046899f
push eax
call fcn.00424a93
add esp, 0x10
mov edi, eax
jmp 0x420c49
mov ecx, edi
call fcn.00409997
mov eax, dword [edi + 8]
push dword [eax]
call dword [0x48f248]
jmp 0x420c3e
Function at 0x45fc4d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420ff6
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00421080
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x45fca8
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x45fc9f
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x464d35
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, ecx
xor esi, esi
mov dword [ebp - 4], eax
mov byte [0x4c62b7], 0
mov ebx, edx
test edi, edi
je 0x464d87
mov byte [0x4c62b8], 1
call dword [0x48f180]
mov dword [ebp - 0xc], eax
xor ecx, ecx
lea eax, [ebp + 0x10]
mov dword [ebp - 8], edi
push eax
push ecx
lea eax, [ebp - 0xc]
push eax
push 0x465217
push ecx
push ecx
call fcn.004240c1
mov esi, eax
add esp, 0x18
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push eax
call dword [0x48f6b8]
mov edi, eax
test esi, esi
je 0x464db2
push 0xffffffffffffffff
push esi
mov byte [0x4c62b8], 0
call dword [0x48f16c]
push esi
call dword [0x48f35c]
cmp byte [0x4c62b7], 1
jne 0x464dc0
or eax, 0xffffffff
jmp 0x464dc2
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x468a2c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4c4190]
jne 0x468a39
call fcn.00468b13
mov eax, dword [0x4c7ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c7ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x468a71
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4c4190]
jne 0x468a83
call fcn.00468b13
mov eax, dword [0x4c7ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c7ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x468ac6
fadd qword [0x4bbac8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4bbaa0]
mov esp, ebp
pop ebp
ret

Function at 0x468ad6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4c7530], ecx
inc esi
mov ecx, 0x4c7530
mov edx, esi
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x4c7eec
jl 0x468ae7
mov dword [0x4c4190], esi
mov dword [0x4c7518], esi
pop esi
ret
Function at 0x468b13
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c7518], 0
push esi
push edi
mov esi, 0x4c7530
jne 0x468b32
push 0
call fcn.0042543a
pop ecx
mov ecx, eax
call fcn.00468ad6
mov dword [0x4c4190], 0x270
mov edi, 0xe3
mov dword [0x4c7ef0], esi
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi], eax
mov esi, edx
dec edi
jne 0x468b47
mov edi, 0x18c
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, ecx
mov dword [esi], eax
lea esi, [edx]
dec edi
jne 0x468b7c
mov ecx, dword [0x4c7530]
mov al, cl
and al, 1
movzx edx, al
mov eax, dword [esi]
neg edx
pop edi
sbb edx, edx
xor eax, ecx
and eax, 0x7ffffffe
and edx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, edx
mov dword [esi], eax
pop esi
ret

Function at 0x46901b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x469040
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
push 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.00421080
add esp, 0xc
jmp 0x469053
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.00425812
add esp, 0x10
movzx ecx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
add dword [esi + 0xc], 8
shl ecx, 8
or ecx, eax
mov byte [ebp - 4], 0
movzx eax, byte [ebp - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 1]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 8]
push 0x4ba4ec
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
call fcn.004258c0
neg eax
pop ecx
pop ecx
sbb eax, eax
neg eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x469129
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x10000
mov eax, dword [esi + 0x460]
test eax, eax
je 0x46913f
cmp eax, ecx
jne 0x46915a
push dword [esi + 0x1c]
push ecx
push 1
push dword [esi + 0x458]
call fcn.00425812
add esp, 0x10
and dword [esi + 0x460], 0
mov ecx, dword [esi + 0x460]
mov eax, dword [esi + 0x458]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 0x460], ecx
pop esi
ret

Function at 0x469172
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x45c]
mov esi, dword [edi + 0x454]
mov byte [esi + edx], al
mov eax, 0x10000
inc dword [edi + 0x45c]
cmp dword [edi + 0x45c], eax
jne 0x4691b9
push dword [edi + 0x20]
push eax
push 1
push dword [edi + 0x454]
call fcn.00424a93
add esp, 0x10
and dword [edi + 0x45c], 0
pop edi
pop esi
pop ebp
ret 4