joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418d50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x420b80], ecx
inc edx
cmp edx, 0x100
jb 0x418d52
cmp edx, 0x800
jae 0x418e29
lea esp, [esp]
mov eax, dword [edx*4 + 0x420780]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x420b80]
inc edx
mov dword [edx*4 + 0x420b7c], eax
cmp edx, 0x800
jb 0x418e00
mov eax, 0x419630
mov dword [0x420b74], eax
mov dword [0x422b80], eax
mov dword [0x420b70], 0x419550
call fcn.00419060
test eax, eax
jne 0x418e55
mov dword [0x422b80], 0x419550
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x7073348c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x2f9a0ffb
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x76c4cd
Capabilities:
Encode data using xor

Disassembly:
mov edi, eax
mov esi, edx
mov eax, 0x41363233
xor al, byte [esi]
call fcn.0076c504
mov ebx, eax
xor ah, byte [esi]
call fcn.0076c504
shr ecx, 2
mov edx, ecx
xor dword [edi], eax
mov cl, al
add edi, 4
rol ebx, cl
xor eax, ebx
mov cl, bh
ror eax, cl
add ebx, eax
dec edx
jne 0x76c4eb
ret

Function at 0x76c504
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edx
xor edx, edx
dec esi
inc esi
xor ah, byte [esi]
xor al, dl
add eax, 0x6e203cc5
add eax, 0x21424a6
mov cl, al
ror eax, cl
xor eax, 0x8372a5a7
dec dx
jne 0x76c50d
cmp byte [esi], 0
jne 0x76c50a
pop edx
pop esi
pop ecx
ret

Function at 0x76c555
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
add edx, 0x89421025
bswap edx
mov eax, dword [esi]
sub eax, edx
xor eax, ebx
mov ebx, dword [esi]
mov dword [edi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x76c569
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x76e79b
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
pushal
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
imul eax, dword [ebp + 0x10], 0x9e3779b9
cmp dword [ebp + 0x10], 0
jbe 0x76e7fb
mov edx, ebx
shl edx, 4
sub ecx, edx
mov edx, dword [esi + 8]
xor edx, ebx
sub ecx, edx
mov edx, ebx
shr edx, 5
xor edx, eax
sub ecx, edx
sub ecx, dword [esi + 0xc]
mov edx, ecx
shl edx, 4
sub ebx, edx
mov edx, dword [esi]
xor edx, ecx
sub ebx, edx
mov edx, ecx
shr edx, 5
xor edx, eax
sub ebx, edx
sub ebx, dword [esi + 4]
sub eax, 0x9e3779b9
dec dword [ebp + 0x10]
jmp 0x76e7b1
mov dword [edi], ebx
mov dword [edi + 4], ecx
popal
leave
ret 0xc

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x10065c9
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
push edi
push edi
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
push eax
push 0x1005d92
push edi
push edi
mov dword [ebp - 4], edi
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, edi
jne 0x1006636
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, edi
jle 0x1006615
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
jl 0x100661c
mov ebx, 0x80004005
push 0x10068f4
push 1
push ebx
push 0x4000000
call fcn.01007e2b
add esp, 0x10
jmp 0x10067c2
mov eax, dword [0x102e00c]
push esi
push 0xffffffffffffffff
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x10]
push eax
push 2
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, eax
sub eax, edi
je 0x10066a8
dec eax
je 0x100668e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, edi
jle 0x1006674
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
jl 0x100667b
mov ebx, 0x80004005
push esi
push 0x10068b4
push 1
push ebx
push 0x4000000
jmp 0x10067b0
push 0x1006888
push edi
push edi
mov esi, 0x4000000
push esi
call fcn.01007e2b
add esp, 0x10
jmp 0x100673b
push 0x1006838
push edi
push edi
mov esi, 0x4000000
push esi
call fcn.01007e2b
mov eax, dword [0x102e008]
add esp, 0x10
cmp eax, edi
je 0x10066f2
push 0x102e038
push eax
mov dword [0x102e03c], 3
mov dword [str.9_b], edi
mov dword [0x102e044], edi
mov dword [0x102e050], 0x7530
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push edi
call fcn.01006aea
cmp eax, edi
jge 0x100670d
push 0x1005770
push 1
push eax
push esi
call fcn.01007e2b
add esp, 0x10
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp + 0xc], eax
cmp eax, edi
jne 0x1006783
push 0x10067fc
push edi
push edi
push esi
call fcn.01007e2b
add esp, 0x10
call fcn.01006b6a
mov eax, dword [ebp + 8]
mov dword [eax], 1
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x100674f
mov ebx, dword [ebp - 4]
jmp 0x10067b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, edi
jle 0x1006769
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
jl 0x1006770
mov ebx, 0x80004005
push 0x10067cc
push 1
push ebx
push esi
call fcn.01007e2b
add esp, 0x10
jmp 0x10067b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, edi
jle 0x100679d
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
jl 0x10067a4
mov ebx, 0x80004005
push dword [ebp + 0xc]
push 0x10068b4
push 1
push ebx
push esi
call fcn.01007e2b
add esp, 0x14
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x417e40
Capabilities:
Query or enumerate registry value

Disassembly:
xor al, 0x10
dec esp
add byte [ebp - 0x767af040], al
mov dword [eax], eax
add byte [eax], al
push ebx
push ebp

Function at 0x417e48
Capabilities:
Query or enumerate registry value

Disassembly:
xor al, 0x10
dec esp
add byte [ebp - 0x767af040], al
mov dword [eax], eax
add byte [eax], al
push ebx
push ebp

Function at 0x417e78
Capabilities:
Query or enumerate registry value

Disassembly:
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
sbb al, 0x8d
dec esp
and al, 0x18
push eax
push ecx
push 0
push str.Browse_For_Folder_Width
push edx
call ebx
invalid
test eax, eax
jne 0x417e93
mov edi, dword [esp + 0x1c]
xor esi, esi
push 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
dec esp
and al, 0x20
push eax
mov eax, dword [esp + 0x1c]

Function at 0x417e88
Capabilities:
Query or enumerate registry value

Disassembly:
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
sbb al, 0x8d
dec esp
and al, 0x18
push eax
push ecx
push 0
push str.Browse_For_Folder_Width
push edx
call ebx
invalid
test eax, eax
jne 0x417e93
mov edi, dword [esp + 0x1c]
xor esi, esi
push 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
dec esp
and al, 0x20
push eax
mov eax, dword [esp + 0x1c]

Function at 0x417ea8
Capabilities:
Query or enumerate registry value

Disassembly:
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
sbb al, 0x8d
dec esp
and al, 0x18
push eax
push ecx
push 0
push str.Browse_For_Folder_Width
push edx
call ebx
invalid
test eax, eax
jne 0x417e93
mov edi, dword [esp + 0x1c]
xor esi, esi
push 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
dec esp
and al, 0x20
push eax
mov eax, dword [esp + 0x1c]

Function at 0x417f18
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
call ebx
add byte [eax], al
inc ebx
push esi
and byte [eax], ah
dec ecx
dec esi
dec esi
dec ebp
jnp fcn.00417eb8
jbe 0x417ebd
add dword [eax], edi

Function at 0x417f20
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
call ebx
add byte [eax], al
inc ebx
push esi
and byte [eax], ah
dec ecx
dec esi
dec esi
dec ebp
jnp fcn.00417eb8
jbe 0x417ebd
add dword [eax], edi
Function at 0x420b7c
Capabilities:
Encode data using xor

Disassembly:
loopne 0x420ad7
fcom qword [edx]
lodsb al, byte [esi]
int 0xa3
das
cmc
or eax, 0xdcf9bad
call edi
pop ss
pop ecx
xlatb
mov eax, 0x50d36ec3
mov ah, 0x82
in al, dx
in eax, 0xd4
int3
inc ebx
inc ebx
sbb al, 0x37
push esp
pop esi
push ecx
cmp bh, byte [ebx + 6]
stc
or al, 0x3b
rcr bl, cl
int3
or ecx, edi
sub al, 0xc3
fnsave dword [edx - 0x32ca5c0a]
fld dword [ebp - 2]
rcl ebp, 0x9b
sahf
dec esi
xor byte [edi], al
add byte [ecx], bl
xchg byte [edi + 0x599f874], al
and al, 0x32
invalid
invalid
inc ebx
jecxz 0x420a72
fnstenv [edx]
retf 0x857c
jg 0x420a96
add byte [ebp + eax*4 - 0x6f], dh
movsd dword es:[edi], dword [esi]
sub dword [eax - 0x227c3365], ebp
sub ecx, dword [ebx]
push cs
jnp 0x420b0f
sti
adc dword [ebx - 0x5c], eax
popfd
jne 0x420ae2
sub eax, 0xf9cfc3cd
jbe 0x420ab7
cmpsd dword [esi], dword es:[edi]
mov al, byte [edi]
push ds
outsd dx, dword [esi]
push edx
jno 0x420b48
inc ecx
mov ah, 0x33
shr edx, 1
mov edi, 0xa103dd46
cmpsb byte [esi], byte es:[edi]
std
jecxz 0x420aee
sbb byte [ebp + 0x5df3eda3], dh
scasd eax, dword es:[edi]
mov eax, dword [0x8d637df3]
jg 0x420ba3
and byte [edx - 0x7b8028e], bl
std
inc edi
clc
imul edi, dword [edx - 0x18dd67b3], 0x17f0cee2
jecxz 0x420b79
and ah, bh
loop 0x420b0f
invalid
and bl, byte [edi + 0x11]
rol dl, cl
pop ebp
mov dword [0xa629a512], eax
cmp al, 0x50
lodsd eax, dword [esi]
das
lodsd eax, dword [esi]
adc al, bl
imul ebp, ebp, 0x396a8e84
and eax, 0x9b6403dd
sub dl, byte [0xc454253d]
xchg ecx, eax
sub byte [ebp + 0x6a], ah
add eax, 0x74e25e09
in eax, 6
cmp ebx, esi
push cs
jmp 0x420b3d
ret
or eax, edx
mov al, al
arpl word [edi + 0x52848c2d], ax
dec edi
xchg byte [esi - 0x46], al
cmp al, 0xd5
sub esp, ebx
sbb ch, ch
xor dword [edx], 0xd4adbbaf
mov ebp, 0x23f651a7
and eax, 0xfcbd0347
inc esi
jl 0x420b86
loop 0x420c16
jno 0x420b36
nop
cmp eax, 0x398d4d85
jecxz 0x420b6a
shr byte [ecx + 0x55], 1
out 0x10, al
int3
stosb byte es:[edi], al
ret

Function at 0x48c180
Capabilities:
Encode data using xor

Disassembly:
push ebp
dec ebx
lds ecx, [ebx]
push es
clc
clc
out dx, eax
xor esp, dword [ebp + edi + 0x6a]
jg 0x48c187
nop
sahf
out 0x9f, eax
pop ss
jp 0x48c159
push es
adc eax, esp
pushfd
pop edi
pop ebx
sal dword ss:[si], 0x61
popal
add eax, 0xa84e67a7
jno 0x48c13a
Function at 0x4a34f4
Capabilities:
Encode data using xor

Disassembly:
nop
nop
nop
nop
nop
nop
nop
invalid
out 0x98, eax
movsd dword es:[edi], dword [esi]
cmp al, byte [eax - 0x7bcb6675]
cdq
xor al, 0x84
enter 0xffffffffffffd4e8, 0x1b
jge 0x4a3553
wait
fisubr word [ebp + 0x68]
push ebp
and dword [edi + 0x147bdaa7], edi
shl ch, 1
adc eax, 0x9eb90b84
lodsd eax, dword [esi]
out dx, al
mov dword [0x243646a0], eax
shr dword [ebx], 1
shl edx, 1
or al, byte [edx]
sub dword [ecx - 0x12656726], esi
push edi
js 0x4a34fa
aaa
pop dword [edi + 9]
mov ch, 0xd0
mov esi, dword [edi - 8]
je 0x4a35a7
jae 0x4a34ed
xor al, 0x88
sub al, 0x4d
sub cl, dl
daa
les eax, [ecx]
inc eax
jo 0x4a3594
jecxz 0x4a34d9
mov dword [esi - 0x5d], 0xe1928e20
dec esp
dec esi
fisttp word [edi]
jecxz 0x4a35cb
pavgw mm6, qword [ebp + 0x61]
popal
in al, 0x5e
jmp 0xc6ed841a
mov esi, 0xc6edbd3
out dx, eax
loop 0x4a3601
fbld tbyte [edi - 0x36]
mov bh, 0xea
jns 0x4a361b
wait
lds esp, [edx + esi*8 - 0xb]
cmc
sbb bh, dh
popal
invalid
js 0x4a3623
lahf
cmp al, 0x50
cli
pop esi
sub eax, 0x4b5838a2
invalid
jmp 0x4a359d
aas
invalid

Function at 0x4bbd0d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c6480
cmp edx, dword [eax]
je 0x4bbd2f
add eax, 8
inc ecx
cmp eax, 0x4c6510
jl 0x4bbd20
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c6480]
jne 0x4bbe5d
mov eax, dword [0x4cae0c]
cmp eax, 1
je 0x4bbe37
test eax, eax
jne 0x4bbd60
cmp dword [0x4c63a8], 1
je 0x4bbe37
cmp edx, 0xfc
je 0x4bbe5d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bbd97
lea eax, [ebp - 0x1a4]
push 0x4c1d30
push eax
call fcn.004bc6f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bcb80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bbdda
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bcb80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c1d2c
push edi
call fcn.004bea50
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c1d10
push eax
call fcn.004bc6f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc700
lea eax, [ebp - 0xa0]
push 0x4c1d0c
push eax
call fcn.004bc700
push dword [esi + 0x4c6484]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc700
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c1ce4
push eax
call fcn.004be9c4
add esp, 0x2c
pop edi
jmp 0x4bbe5d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c6484]
push 0
push eax
push dword [esi]
call fcn.004bcb80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x6a882596
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x37d73141
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x404c60
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4cf644
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.CThread.0
call fcn.004048f0
lea ecx, [esi + 0x18]
mov byte [esp + 0x18], 1
call fcn.004048f0
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 2
call fcn.004048f0
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 3
call fcn.004048f0
lea ecx, [esi + 0x3c]
mov byte [esp + 0x18], 4
call fcn.004037a0
mov dword [esi + 0x60], vtable.yaneuraoGameSDK3rd::YTL::smart_ptr_class_yaneuraoGameSDK3rd::YTL::function_callback_.0
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xffffffff
mov byte [esi + 0x74], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x404d10
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4cf6aa
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CThread.0
mov dword [esp + 0x14], 6
call fcn.004049f0
lea ecx, [esi + 0x60]
mov byte [esp + 0x14], 5
call fcn.00404ba0
lea ecx, [esi + 0x3c]
mov byte [esp + 0x14], 4
call fcn.00403900
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 3
call fcn.004047f0
lea ecx, [esi + 0x24]
mov byte [esp + 0x14], 2
call fcn.004047f0
lea ecx, [esi + 0x18]
mov byte [esp + 0x14], 1
call fcn.004047f0
lea ecx, [esi + 0xc]
mov byte [esp + 0x14], 0
call fcn.004047f0
mov dword [esi], vtable.IThread.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4054b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
push 0
mov dword [esi + 0x9c0], 0x271
call fcn.004b9a4e
mov edx, 1
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x9c0], edx
jmp 0x4054e0
mov eax, dword [esi + 0x9c0]
mov ecx, dword [esi + eax*4 - 4]
mov ebx, ecx
shr ebx, 0x1e
xor ebx, ecx
imul ebx, ebx, 0x6c078965
add ebx, eax
mov dword [esi + eax*4], ebx
add dword [esi + 0x9c0], edx
cmp dword [esi + 0x9c0], 0x270
jl 0x4054e0
pop esi
pop ebx
ret
Function at 0x405630
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
test edi, edi
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x9908b0df
jne 0x405659
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, dword [esi + 0x9c0]
cmp eax, 0x270
jl 0x405737
cmp eax, 0x271
jne 0x405686
mov ecx, 0x5553c8
call fcn.00405520
mov ecx, dword [0x5553c4]
call fcn.004054b0
xor eax, eax
jmp 0x405690
mov ecx, dword [esi + eax*4 + 4]
xor ecx, dword [esi + eax*4]
add eax, 1
and ecx, 0x7fffffff
xor ecx, dword [esi + eax*4 - 4]
mov edx, ecx
shr ecx, 1
and edx, 1
xor ecx, dword [esp + edx*4 + 8]
xor ecx, dword [esi + eax*4 + 0x630]
cmp eax, 0xe3
mov dword [esi + eax*4 - 4], ecx
jl 0x405690
cmp eax, 0x26f
jge 0x405701
jmp 0x4056d0
mov ecx, dword [esi + eax*4 + 4]
xor ecx, dword [esi + eax*4]
add eax, 1
and ecx, 0x7fffffff
xor ecx, dword [esi + eax*4 - 4]
mov edx, ecx
shr ecx, 1
and edx, 1
xor ecx, dword [esp + edx*4 + 8]
xor ecx, dword [esi + eax*4 - 0x390]
cmp eax, 0x26f
mov dword [esi + eax*4 - 4], ecx
jl 0x4056d0
mov eax, dword [esi]
xor eax, dword [esi + 0x9bc]
mov dword [esi + 0x9c0], 0
and eax, 0x7fffffff
xor eax, dword [esi + 0x9bc]
mov ecx, eax
and ecx, 1
mov edx, dword [esp + ecx*4 + 8]
xor edx, dword [esi + 0x630]
shr eax, 1
xor edx, eax
mov dword [esi + 0x9bc], edx
mov ecx, dword [esi + 0x9c0]
mov eax, dword [esi + ecx*4]
add ecx, 1
mov dword [esi + 0x9c0], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor eax, edx
xor edx, edx
test edi, edi
jge 0x405787
neg edi
div edi
pop edi
pop esi
mov eax, edx
neg eax
add esp, 8
ret 4
div edi
pop edi
pop esi
mov eax, edx
add esp, 8
ret 4
Function at 0x40e320
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d06a0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov ebp, ecx
lea ecx, [esp + 0x1c]
call fcn.00403df0
mov eax, dword [esp + 0x4c]
xor esi, esi
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], esi
call fcn.00403f20
cmp eax, 1
jne 0x40e37c
lea ecx, [esp + 0x1c]
call fcn.00403b90
lea eax, [esi + 1]
jmp 0x40e4c5
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004b93c1
mov edx, dword [esp + 0x24]
push 2
push esi
push edx
mov ebx, eax
call fcn.004b91a4
mov eax, dword [esp + 0x30]
push eax
call fcn.004b93c1
mov ecx, dword [esp + 0x34]
push esi
push ebx
push ecx
mov edi, eax
call fcn.004b91a4
add esp, 0x20
mov dword [esp + 0x28], vtable.yaneuraoGameSDK3rd::YTL::smart_ptr_unsigned_char_.0
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
push edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 1
call fcn.00407200
mov edx, dword [ebp]
mov eax, dword [edx + 0x14]
mov ecx, ebp
call eax
push esi
lea ecx, [edi - 1]
push ecx
mov ecx, eax
call fcn.0040d170
push esi
lea ecx, [esp + 0x2c]
call fcn.004438c0
mov edx, dword [esp + 0x20]
push edx
push 1
push edi
push eax
call fcn.004b9102
add esp, 0x10
push esi
lea ecx, [esp + 0x2c]
call fcn.004438c0
mov al, byte [eax]
add edi, 0xffffffff
cmp edi, esi
mov byte [esp + 0x4c], al
mov dword [esp + 0x18], edi
jle 0x40e46f
lea ebx, [esi + 1]
push ebx
lea ecx, [esp + 0x2c]
call fcn.004438c0
mov edx, dword [ebp]
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x14]
mov ecx, ebp
call eax
mov edi, eax
mov eax, dword [edi + 4]
test eax, eax
je 0x40e450
mov ecx, dword [edi + 8]
sub ecx, eax
cmp esi, ecx
jb 0x40e455
call fcn.004b899b
mov ecx, dword [esp + 0x14]
mov dl, byte [ecx]
xor dl, byte [esp + 0x4c]
mov eax, dword [edi + 4]
mov byte [esi + eax], dl
mov esi, ebx
cmp esi, dword [esp + 0x18]
jl 0x40e423
xor esi, esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 0
call fcn.00405d60
mov eax, dword [esp + 0x20]
cmp eax, esi
mov dword [esp + 0x1c], vtable.CFileStream.0
je 0x40e496
push eax
call fcn.004b8dea
add esp, 4
mov eax, dword [esp + 0x24]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x531020]
je 0x40e4c3
add eax, 0xfffffff4
push eax
call dword [0x4ed26c]
test eax, eax
jg 0x40e4c3
mov edx, dword [esp + 0x24]
add edx, 0xfffffff4
push edx
call fcn.004b7e1e
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
Function at 0x412bb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4d0d98
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push esi
mov dword [esp + 0x14], 0
call fcn.0040f790
mov eax, dword [esp + 0x38]
push eax
sub esp, 0x14
mov eax, esp
mov dword [eax], vtable.yaneuraoGameSDK3rd::YTL::smart_ptr_base.0
mov dword [eax], vtable.yaneuraoGameSDK3rd::YTL::smart_ptr_class_CSpriteObj_.0
mov ecx, dword [esp + 0x40]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x44]
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x48]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x48]
test ecx, ecx
mov dword [esp + 0x30], esp
je 0x412c22
add dword [ecx + 4], 1
mov ecx, dword [esp + 0x34]
mov dword [eax + 0x10], 0
sub ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push 0
push esi
call fcn.00412a30
add esp, 0x24
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], 0xffffffff
call fcn.0040fd60
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret