joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005cfd0
Capabilities:
Encode data using xor

Disassembly:
movsd xmm1, qword [0x100ae028]
sub esp, 0x10
movsd xmm2, qword [0x100ae030]
push ebx
push esi
push edi
xor esi, esi
nop dword [eax + eax]
lea eax, [esi*2 + 0x13]
xor edi, edi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm1
movsd qword [esp + 0x14], xmm0
nop dword [eax + eax]
cmp edi, 2
jne 0x1005d045
mov eax, 0xaaaaaaab
mov ecx, esi
mul esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
cmp ecx, 1
jne 0x1005d153
movd xmm0, esi
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm2
addsd xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll___libm_sse2_sin
jmp 0x1005d0c3
movd xmm0, esi
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm2
addsd xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll___libm_sse2_sin
movsd qword [esp + 0xc], xmm0
cmp edi, 1
jne 0x1005d09d
cmp esi, 0x1e
jb 0x1005d06f
xorps xmm0, xmm0
jmp 0x1005d0c3
cmp esi, 0x18
jb 0x1005d096
lea eax, [esi - 0x12]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x100ae040]
addsd xmm0, qword [0x100ae038]
call sub.api_ms_win_crt_math_l1_1_0.dll___libm_sse2_sin
jmp 0x1005d0c3
cmp esi, 0x12
jb 0x1005d0c9
jmp 0x1005d0bb
cmp edi, 3
jne 0x1005d0c9
cmp esi, 6
jae 0x1005d0ac
xorps xmm0, xmm0
jmp 0x1005d0c3
cmp esi, 0xc
jae 0x1005d0b6
lea eax, [esi - 6]
jmp 0x1005d077
cmp esi, 0x12
jae 0x1005d0c9
movsd xmm0, qword [0x10072248]
movsd qword [esp + 0xc], xmm0
movsd xmm0, qword [esp + 0x14]
call sub.api_ms_win_crt_math_l1_1_0.dll___libm_sse2_cos
movsd xmm1, qword [0x100ae020]
movsd xmm2, qword [0x100ae030]
divsd xmm1, xmm0
mulsd xmm1, qword [esp + 0xc]
cvtpd2ps xmm0, xmm1
mulsd xmm1, qword [0x100ae048]
addsd xmm1, qword [0x100a5950]
cvttsd2si ebx, xmm1
movsd xmm1, qword [0x100ae028]
cmp edi, 2
jne 0x1005d132
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
inc edi
movss dword [edx*4 + 0x10193f70], xmm0
mov dword [edx*4 + 0x10192e60], ebx
jmp 0x1005d010
lea eax, [esi + 2]
cmp esi, 0x12
mov ecx, esi
cmovae ecx, eax
lea eax, [edi + edi*4]
lea eax, [ecx + eax*8]
movss dword [eax*4 + 0x10193e30], xmm0
mov dword [eax*4 + 0x10192d20], ebx
inc edi
cmp edi, 4
jl 0x1005d010
inc esi
cmp esi, 0x24
jl 0x1005cff0
movss xmm1, dword [0x100719a0]
xor ecx, ecx
pop edi
pop esi
pop ebx
mov edx, 0x14
nop dword [eax]
mov eax, dword [ecx + 0x10193e30]
movss xmm0, dword [ecx + 0x10193e34]
mov dword [ecx + 0x101940b0], eax
xorps xmm0, xmm1
mov eax, dword [ecx + 0x10192d20]
mov dword [ecx + 0x10192fa0], eax
mov eax, dword [ecx + 0x10192d24]
neg eax
movss dword [ecx + 0x101940b4], xmm0
mov dword [ecx + 0x10192fa4], eax
add ecx, 8
sub edx, 1
jne 0x1005d180
cmp ecx, 0x280
jl 0x1005d174
add esp, 0x10
jmp 0x1006a420
mov edx, 0x101940b0
mov ecx, 0x101a42f4
push esi
nop dword [eax + eax]
mov esi, 0x101940b0
nop word [eax + eax]
movss xmm1, dword [edx - 0x280]
movss xmm0, dword [edx]
add edx, 4
mov eax, dword [esi - 0x280]
mov dword [ecx + 0x9fc], eax
mov eax, dword [esi]
add esi, 4
movss dword [ecx - 4], xmm1
movss dword [ecx], xmm0
movss dword [ecx + 4], xmm1
movss dword [ecx + 8], xmm0
mov dword [ecx + 0xa00], eax
movss dword [ecx + 0xa04], xmm1
movss dword [ecx + 0xa08], xmm0
add ecx, 0x10
cmp esi, 0x10194150
jl 0x1006a440
cmp ecx, 0x101a4cf4
jl 0x1006a430
pop esi
ret
Function at 0x1005fed0
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
push 0x328
push ebp
mov dword [edi + 0x44], 0
call sub.avutil_fb2k_58.dll_av_memdup
mov esi, eax
add esp, 8
test esi, esi
je 0x10060058
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x18], 0
push 0x88
inc dword [ecx]
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov dword [edi + 0x30], esi
call sub.avutil_fb2k_58.dll_av_mallocz
add esp, 4
mov dword [esi + 0x1c], eax
test eax, eax
je 0x10060058
mov ebx, dword [esp + 0x24]
mov dword [eax + 0x10], edi
mov eax, dword [ebp + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x1005ff70
push eax
call sub.avutil_fb2k_58.dll_av_mallocz
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x10060058
mov ecx, dword [ebx + 0x2c]
test ecx, ecx
je 0x1005ff70
mov dword [eax], ecx
push dword [ebp + 0x18]
push dword [esi + 0x18]
call sub.avutil_fb2k_58.dll_av_opt_copy
add esp, 8
test eax, eax
js 0x1006005d
push 0x100b5cd4
push edi
call fcn.1005f300
add esp, 8
test eax, eax
js 0x1006005d
call sub.avutil_fb2k_58.dll_av_frame_alloc
mov dword [edi + 0x38], eax
test eax, eax
je 0x10060058
call sym.avcodec_fb2k_60.dll_av_packet_alloc
mov dword [edi + 0x34], eax
test eax, eax
je 0x10060058
cmp dword [esp + 0x28], 0
jne 0x1005ffb6
mov eax, dword [esi + 0x1c]
mov dword [eax], 1
call sym.avcodec_fb2k_60.dll_av_packet_alloc
mov ecx, dword [esi + 0x1c]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x1c]
cmp dword [eax + 0x1c], 0
je 0x10060058
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x1005fff1
push esi
call eax
add esp, 4
test eax, eax
jns 0x1005fff1
test byte [ebx + 0x3c], 2
je 0x1006005d
mov dword [edi + 0x14], 1
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dword [esp + 0x28], 0
mov dword [edi + 0x14], 1
je 0x1006000b
push 1
push esi
push ebp
call fcn.100604c0
add esp, 0xc
movzx eax, word [esi + 0x1c6]
lea esi, [edi + 4]
push 0
push 0
push esi
push 0x100606f0
and eax, 1
mov dword [esi + 4], 0x1005fc70
push 0
push 0
mov dword [edi + 0x54], eax
mov dword [esi + 8], edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x1006004a
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov dword [edi + 0x14], 2
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, 0xfffffff4
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4034f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea ecx, [ebp + 8]
push ebx
push esi
push edi
call fcn.00401b40
mov ebx, eax
lea eax, [ebp - 8]
push eax
call fcn.00403670
mov edi, eax
cmp byte [edi + 7], 0
je 0x403652
xor ecx, ecx
cmp dword [0x480bdc], 2
jl 0x403630
movaps xmm2, xmmword [0x47c3d0]
mov eax, 5
movaps xmm3, xmmword [0x47c470]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm1, xmm3
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm4, eax
psrad xmm1, xmm4
mov eax, 0x1f
movaps xmm0, xmm1
movd xmm5, eax
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x47c3f0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x47c3e0]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x47c450]
movd xmm0, dword [edi]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.6666666666666666]
pxor xmm1, xmm0
movaps xmm0, xmm2
movd dword [edi], xmm1
movaps xmm1, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm1, xmm3
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm4
movaps xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x47c3f0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x47c450]
movd xmm0, dword [edi + 4]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.6666666666666666]
pxor xmm1, xmm0
movd dword [edi + 4], xmm1
jmp 0x403652
mov eax, 0xa0a0a0a1
lea esi, [ecx + edi]
mul ecx
shr edx, 5
movsx eax, dl
mov dl, cl
imul eax, eax, 0x33
inc ecx
sub dl, al
add dl, 0x36
xor byte [esi], dl
cmp ecx, 8
jl 0x403630
push ebx
push edi
call fcn.00401e10
add esp, 8
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xfffffffffffffffe
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x403690
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b34d
mov eax, dword fs:[0]
push eax
mov eax, 0x13b4
call fcn.0046a610
mov eax, dword [0x4803a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x13c0], ebx
mov dword [ebp - 0x13b8], ebx
push 0x3e
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
push str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890
mov dword [ebp - 0x13b8], ebx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00401be0
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x13ac], edx
mov ecx, 1
nop
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [ebp + ecx*4 - 0x13ac], edx
inc ecx
cmp ecx, 0x270
jb 0x403720
mov edi, dword [ebp - 0x18]
xorps xmm0, xmm0
mov dword [ebx], 0
dec edi
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
mov dword [ebx + 0x10], 0xa
movq qword [ebx], xmm0
mov word [ebx + 8], 0
mov byte [ebx + 0xa], 0
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 0x13b0], 0x270
jb 0x40378e
mov ecx, dword [ebx]
mov edx, ecx
mov dword [ebp - 0x13b4], ecx
jmp 0x403798
mov dword [ebp - 0x13b4], ebx
mov edx, ebx
mov ecx, ebx
mov eax, dword [ebx + 0x10]
add eax, edx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x13b8], eax
cmp ecx, eax
je 0x403840
nop
cmp edi, 0xffffffff
jne 0x4037c4
lea ecx, [ebp - 0x13b0]
call fcn.00412100
mov edx, eax
jmp 0x40380e
lea ebx, [edi + 1]
mov dword [ebp - 0x13bc], ebx
jmp 0x4037d3
lea ebx, [edi + 1]
xor ecx, ecx
xor eax, eax
test edi, edi
je 0x4037eb
lea ecx, [ebp - 0x13b0]
call fcn.00412100
mov ecx, eax
or eax, 0xffffffff
xor edx, edx
div ebx
mov esi, eax
mov ebx, edx
xor edx, edx
mov eax, ecx
div dword [ebp - 0x13bc]
cmp eax, esi
jb 0x403805
cmp ebx, edi
jne 0x4037d0
mov eax, ecx
xor edx, edx
lea ecx, [edi + 1]
div ecx
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x13b4]
cmovae eax, dword [ebp - 0x28]
mov al, byte [edx + eax]
mov byte [ecx], al
inc ecx
mov dword [ebp - 0x13b4], ecx
cmp ecx, dword [ebp - 0x13b8]
jne 0x4037b0
mov ebx, dword [ebp - 0x13c0]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x403875
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x40386b
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40386b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00469eed
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00469cb2
mov esp, ebp
pop ebp
ret
Function at 0x404a50
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x4803a4]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
mov dword [esp], 0
push eax
xorps xmm0, xmm0
push 0x20
movlpd qword [esp + 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404ae7
lea eax, [esp + 4]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x404ae7
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
push 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00469cb2
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
xor ecx, esp
call fcn.00469cb2
mov esp, ebp
pop ebp
ret
Function at 0x404fb0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x4803a4]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
xor esi, esi
xor ebx, ebx
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404ff8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.00469cb2
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x405045
lea eax, [esp + 0x34]
push str.AndroidEmulatorEx.exe
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x405035
mov eax, dword [esp + 0x24]
cmp eax, esi
jbe 0x405035
mov ebx, dword [esp + 0x18]
mov esi, eax
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x405010
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00469cb2
mov esp, ebp
pop ebp
ret
Function at 0x408080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4080ac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4080ce
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x4080d0
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x408155
jg 0x4080e5
test esi, esi
je 0x408155
test ecx, ecx
jl 0x408138
jg 0x4080ef
test eax, eax
je 0x408138
cmp edi, ecx
jg 0x408103
jl 0x4080f9
cmp esi, eax
jae 0x408103
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [esp + 0x10]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x408155
jg 0x40813b
test esi, esi
je 0x408155
jmp 0x40813b
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x408155
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x40819c
jl 0x408190
test esi, esi
jne 0x40819c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4081b5
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov edx, dword [eax]
test edx, edx
je 0x4081ef
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x4081ef
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
mov edx, edi
je 0x408270
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x408218
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, edi
mov ecx, dword [ebp - 4]
cmp edi, 0xfff
jbe 0x40825c
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x408283
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x408230
test edx, edx
je 0x408270
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, edi
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408600
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4803a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x408630
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00469cb2
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x408660
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x408660
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00469cb2
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x408736
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x408689
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x408695
movsx eax, bl
jmp 0x4086cd
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x4086f7
sub eax, 1
je 0x4086f7
sub eax, 2
jne 0x408736
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00469cb2
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x408715
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x408736
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x408736
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00469cb2
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00469cb2
mov esp, ebp
pop ebp
ret 4
Function at 0x408ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4803a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x408b7c
cmp byte [esi + 0x3d], 0
je 0x408b7c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x408b6a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x408b31
sub eax, 1
je 0x408b35
sub eax, 2
jne 0x408b6a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00469cb2
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x408b53
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x408b6a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00469cb2
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00469cb2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00469cb2
mov esp, ebp
pop ebp
ret
Function at 0x412100
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x41215e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x412120
mov eax, dword [edi]
jmp 0x412249
cmp eax, 0x4e0
jb 0x412249
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x412180
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4121d0
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41e4d0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x41e57f
push esi
call fcn.00432640
add esp, 4
test al, al
jne 0x41e57f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x41e4f7
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0043bee0
add esp, 0xc
test eax, eax
je 0x41e52b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0043bee0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x41e52d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x41e55e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.0042f5d0
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x41e540
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret