joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a1916
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d5b20]
jne 0x4a1920
repz ret
jmp fcn.004a7ba3

Function at 0x4a5100
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4d5b20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0049de72
and dword [ebp - 0x14], 0
cmp dword [0x4d8e5c], 0
mov dword [ebp - 0x18], eax
jne 0x4a51b3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4a525b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4b00f0
push ebx
call edi
test eax, eax
je 0x4a525b
mov esi, dword [fcn.00499a00]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4d8e5c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4d8e60], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4d8e64], eax
call edi
push eax
call esi
mov dword [0x4d8e6c], eax
test eax, eax
je 0x4a51b3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4d8e68], eax
mov eax, dword [0x4d8e68]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00499a04]
cmp eax, ecx
je 0x4a520c
cmp dword [0x4d8e6c], ecx
je 0x4a520c
push eax
call esi
push dword [0x4d8e6c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4a520c
test ebx, ebx
je 0x4a520c
call edi
test eax, eax
je 0x4a5203
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4a5203
test byte [ebp - 8], 1
jne 0x4a520c
or dword [ebp + 0x10], 0x200000
jmp 0x4a523f
mov eax, dword [0x4d8e60]
cmp eax, dword [ebp - 0x18]
je 0x4a523f
push eax
call esi
test eax, eax
je 0x4a523f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4a523f
mov eax, dword [0x4d8e64]
cmp eax, dword [ebp - 0x18]
je 0x4a523f
push eax
call esi
test eax, eax
je 0x4a523f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4d8e5c]
call esi
test eax, eax
je 0x4a525b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4a525d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a1916
leave
ret
Function at 0x4011b3
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov al, byte [0x44bd96]
movzx ax, al
push ax
push 0x44bd97
push dword [ebp + 8]
push dword [0x44c8b8]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44cb94]
push 0
mov al, byte [0x44bd96]
movzx ax, al
push ax
push 0x44bd92
push dword [ebp + 8]
push dword [0x44c8b8]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44c8bc]
call sub.kernel32.dll_ResumeThread
mov dword [0x44c8c8], 0x10007
push 0xa
call sub.kernel32.dll_Sleep
push 0x44c8c8
push dword [0x44c8bc]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [ebp + 8]
cmp dword [0x44c980], eax
jne 0x401237
jmp 0x401239
jmp 0x401213
push dword [0x44c8bc]
call sub.kernel32.dll_SuspendThread
push dword [0x44cb94]
push 0
mov al, byte [0x44bd96]
movzx ax, al
push ax
push 0x44bd97
push dword [ebp + 8]
push dword [0x44c8b8]
call sub.kernel32.dll_WriteProcessMemory
leave
ret 4

Function at 0x40126e
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov al, byte [0x44bd96]
movzx ax, al
push ax
push 0x44bd97
push dword [ebp + 8]
push dword [0x44c8b8]
call sub.kernel32.dll_ReadProcessMemory
push 0
push 0
mov al, byte [0x44bd96]
movzx ax, al
push ax
push 0x44bda7
push dword [0x44bee7]
push dword [0x44c8b8]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44cb94]
push 0
mov al, byte [0x44bd96]
movzx ax, al
push ax
push 0x44bd92
push dword [ebp + 8]
push dword [0x44c8b8]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44cb94]
push 0
mov al, byte [0x44bd96]
movzx ax, al
push ax
push 0x44bd92
push dword [0x44bee7]
push dword [0x44c8b8]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44c8bc]
call sub.kernel32.dll_ResumeThread
push 0xa
call sub.kernel32.dll_Sleep
mov dword [0x44c8c8], 0x10007
push 0x44c8c8
push dword [0x44c8bc]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [ebp + 8]
cmp dword [0x44c980], eax
jne 0x401340
jmp 0x401351
mov eax, dword [0x44bee7]
mov ebx, dword [0x44c980]
cmp eax, ebx
je 0x4013b4
jmp 0x401323
push dword [0x44c8bc]
call sub.kernel32.dll_SuspendThread
push dword [0x44cb94]
push 0
mov al, byte [0x44bd96]
movzx ax, al
push ax
push 0x44bd97
push dword [ebp + 8]
push dword [0x44c8b8]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44cb94]
push 0
mov al, byte [0x44bd96]
movzx ax, al
push ax
push 0x44bda7
push dword [0x44bee7]
push dword [0x44c8b8]
call sub.kernel32.dll_WriteProcessMemory
mov eax, 0
leave
ret 4
push dword [0x44c8bc]
call sub.kernel32.dll_SuspendThread
push dword [0x44cb94]
push 0
mov al, byte [0x44bd96]
movzx ax, al
push ax
push 0x44bd97
push dword [ebp + 8]
push dword [0x44c8b8]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44cb94]
push 0
mov al, byte [0x44bd96]
movzx ax, al
push ax
push 0x44bda7
push dword [0x44bee7]
push dword [0x44c8b8]
call sub.kernel32.dll_WriteProcessMemory
mov eax, 1
leave
ret 4
Function at 0x401ef0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401f1c
xor eax, eax
leave
ret 0xc
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
add dword [ebp - 8], 0x20
push dword [ebp - 8]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, 1
leave
ret 0xc

Function at 0x401ff0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push 0
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_IsClipboardFormatAvailable
or eax, eax
je 0x402032
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
push eax
call fcn.00402250
mov esi, eax
push esi
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
push edi
push ebx
call fcn.004022d0
call sub.user32.dll_CloseClipboard
mov eax, edi
jmp 0x40203b
xor eax, eax
call sub.user32.dll_CloseClipboard
jmp 0x40203b
pop edi
pop esi
pop ebx
ret

Function at 0x40206c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x402097
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x40258a
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x44d500]
push edi
test esi, esi
jne 0x4025e7
push 0x400
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
mov dword [0x44d500], esi
xor edi, edi
push edi
push 8
pop ecx
call fcn.0040256b
pop ecx
push 8
shl eax, 0x18
pop ecx
test eax, eax
jns 0x4025cc
add eax, eax
xor eax, 0x4c11db7
jmp 0x4025ce
add eax, eax
dec ecx
jne 0x4025bf
push eax
push 0x20
pop ecx
call fcn.0040256b
mov dword [esi + edi*4], eax
inc edi
cmp edi, 0x100
pop ecx
jl 0x4025af
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, eax
jmp 0x40260a
movsx edx, byte [eax]
xor edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x10]
and edx, 0xff
shr edi, 8
xor edi, dword [esi + edx*4]
inc eax
mov dword [ebp + 0x10], edi
cmp eax, ecx
jb 0x4025f1
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret
Function at 0x402cbb
Capabilities:
Hash data with md5

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x88
push ebx
push esi
mov esi, ecx
mov dword [ebp + 0x74], eax
mov ebx, esi
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
cmp esi, 0x40
jbe 0x402d0f
lea eax, [esi - 0x41]
shr eax, 6
inc eax
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x74]
push edi
call fcn.00402615
add dword [ebp + 0x74], 0x40
sub ebx, 0x40
dec dword [ebp + 0x70]
pop ecx
jne 0x402cf9
push pe_nt_image_headers32
lea eax, [ebp - 0x10]
push 0
push eax
call sub.msvcrt.dll_memset
push ebx
push dword [ebp + 0x74]
lea eax, [ebp - 0x10]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x18
mov eax, esi
mov byte [ebp + ebx - 0x10], pe_nt_image_headers32
inc ebx
shl eax, 3
shr esi, 0x1d
push edi
cmp ebx, 0x38
ja 0x402d79
mov byte [ebp + 0x28], al
shr eax, 8
mov byte [ebp + 0x29], al
shr eax, 8
mov byte [ebp + 0x2a], al
shr eax, 8
mov byte [ebp + 0x2b], al
mov eax, esi
mov byte [ebp + 0x2c], al
shr eax, 8
mov byte [ebp + 0x2d], al
shr eax, 8
mov byte [ebp + 0x2e], al
shr eax, 8
mov byte [ebp + 0x2f], al
lea eax, [ebp - 0x10]
call fcn.00402615
jmp 0x402db7
mov byte [ebp + 0x68], al
shr eax, 8
mov byte [ebp + 0x69], al
shr eax, 8
mov byte [ebp + 0x6a], al
shr eax, 8
mov byte [ebp + 0x6b], al
mov eax, esi
mov byte [ebp + 0x6c], al
shr eax, 8
mov byte [ebp + 0x6d], al
shr eax, 8
mov byte [ebp + 0x6e], al
shr eax, 8
mov byte [ebp + 0x6f], al
lea eax, [ebp - 0x10]
call fcn.00402615
push edi
lea eax, [ebp + 0x30]
call fcn.00402615
pop ecx
pop ecx
pop esi
pop ebx
add ebp, 0x78
leave
ret

Function at 0x402fd1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push esi
push edi
mov edi, dword [ebx]
lea esi, [edx + 0x1000]
mov dword [ebp - 4], 0x10
xor ecx, dword [esi]
mov dword [ebp - 8], ecx
call fcn.00402f9a
xor eax, edi
mov edi, dword [ebp - 8]
add esi, 4
dec dword [ebp - 4]
mov ecx, eax
jne 0x402fec
mov eax, dword [edx + 0x1040]
xor eax, ecx
mov ecx, dword [edx + 0x1044]
mov edx, dword [ebp + 8]
xor ecx, edi
pop edi
mov dword [edx], ecx
mov dword [ebx], eax
pop esi
leave
ret
Function at 0x4038fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
push ebx
push esi
push edi
push dword [ebp + 0x10]
call fcn.004038aa
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.004038bf
lea eax, [ebp - 0x72c]
push eax
push dword [ebp + 8]
call fcn.004038bf
add esp, 0x14
push 0x70
pop ebx
lea esi, [ebp - 0x71c]
mov edi, ebx
lea eax, [esi - 0x10]
push esi
push eax
call fcn.004038bf
push esi
call fcn.00403872
add esp, 0xc
add esi, 0x10
dec edi
jne 0x403937
movsx edx, word [0x44d170]
xor esi, esi
shl edx, 2
mov edi, dword [ebp + 0x10]
movsx eax, si
mov ecx, eax
add eax, edx
mov eax, dword [ebp + eax*4 - 0x72c]
shl ecx, 2
and eax, dword [ebp + ecx - 0x1c]
inc esi
mov dword [ecx + edi], eax
cmp si, 4
jb 0x40395c
mov dword [ebp - 8], 0x44d338
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.00403872
and dword [ebp - 4], 0
pop ecx
mov ecx, dword [ebp - 8]
movzx eax, word [ecx - 0x1c6]
movzx ecx, word [ecx]
movsx esi, cx
movsx edi, ax
shl esi, 2
shl edi, 2
movsx eax, word [ebp - 4]
mov edx, dword [ebp + 0x10]
lea ebx, [esi + eax]
mov ebx, dword [ebp + ebx*4 - 0x72c]
mov ecx, eax
add eax, edi
xor ebx, dword [ebp + eax*4 - 0x72c]
shl ecx, 2
and ebx, dword [ebp + ecx - 0x1c]
add edx, ecx
xor dword [edx], ebx
inc dword [ebp - 4]
cmp word [ebp - 4], 4
jb 0x4039af
add dword [ebp - 8], 2
dec dword [ebp - 0xc]
jne 0x403988
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403af4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.004038aa
lea eax, [ebp - 0x10]
push eax
call fcn.004038aa
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
pop ecx
pop ecx
xor edx, edx
movsx ecx, dx
mov eax, ecx
shl eax, 2
mov edi, dword [eax + esi]
xor edi, dword [eax + ebx]
lea ecx, [ecx*4 + 0x10]
mov dword [ebp + eax - 0x30], edi
mov edi, dword [ecx + esi]
xor edi, dword [ecx + ebx]
inc edx
mov dword [ebp + eax - 0x10], edi
cmp dx, 4
jb 0x403b19
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004039ee
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004038fa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004038bf
lea eax, [ebp - 0x10]
push eax
call fcn.0040383c
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
add esp, 0x20
cmp word [ecx], 0
je 0x403bb2
and dword [ebp + 0x14], 0
movsx eax, word [ebp + 0x14]
shl eax, 2
mov edx, dword [eax + esi]
xor edx, dword [eax + ebx]
xor edx, dword [eax + ecx + 4]
xor edx, dword [ebp + eax - 0x10]
xor edx, dword [ebp + eax - 0x20]
inc dword [ebp + 0x14]
cmp word [ebp + 0x14], 4
mov dword [eax + edi], edx
jb 0x403b8a
jmp 0x403bd2
xor ecx, ecx
movsx eax, cx
shl eax, 2
mov edx, dword [eax + esi]
xor edx, dword [eax + ebx]
xor edx, dword [ebp + eax - 0x10]
xor edx, dword [ebp + eax - 0x20]
inc ecx
mov dword [eax + edi], edx
cmp cx, 4
jb 0x403bb4
xor ecx, ecx
movsx eax, cx
shl eax, 2
mov edx, dword [eax + esi]
xor edx, dword [eax + edi]
inc ecx
mov dword [ebp + eax - 0x30], edx
cmp cx, 4
jb 0x403bd4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004038fa
add esp, 0xc
xor edx, edx
movsx eax, dx
lea ecx, [eax*4 + 0x10]
mov ebx, dword [ecx + esi]
shl eax, 2
xor ebx, dword [eax + edi]
xor ebx, dword [ebp + eax - 0x10]
inc edx
mov dword [ecx + edi], ebx
cmp dx, 4
jb 0x403c01
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403c27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.004038bf
lea eax, [ebp - 0x10]
push eax
call fcn.004038aa
add esp, 0xc
xor edx, edx
movsx eax, dx
mov ecx, eax
mov eax, dword [esi + eax*4 + 0x10]
shl ecx, 2
xor eax, dword [ecx + esi]
inc edx
mov dword [ebp + ecx - 0x10], eax
cmp dx, 4
jb 0x403c49
push dword [ebp + 0x14]
lea eax, [ebp - 0x20]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00403af4
add esp, 0x10
pop esi
leave
ret
Function at 0x403c7b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x30]
push eax
push ebx
call fcn.004039ee
lea eax, [ebp - 0x20]
push eax
lea eax, [ebx + 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004038fa
add esp, 0x14
xor ecx, ecx
movsx eax, cx
shl eax, 2
mov edx, dword [eax + ebx]
xor edx, dword [ebp + eax - 0x20]
inc ecx
mov dword [ebp + eax - 0x10], edx
cmp cx, 4
jb 0x403ca6
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004038bf
lea eax, [ebp - 0x40]
push eax
call fcn.0040383c
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
add esp, 0xc
cmp word [ecx], 0
je 0x403d06
xor edx, edx
movsx eax, dx
shl eax, 2
mov ebx, dword [eax + ecx + 4]
xor ebx, dword [ebp + eax - 0x40]
xor ebx, dword [ebp + eax - 0x10]
inc edx
mov dword [eax + esi], ebx
cmp dx, 4
jb 0x403ce5
mov ebx, dword [ebp + 8]
jmp 0x403d20
xor ecx, ecx
movsx eax, cx
shl eax, 2
mov edx, dword [ebp + eax - 0x40]
xor edx, dword [ebp + eax - 0x10]
inc ecx
mov dword [eax + esi], edx
cmp cx, 4
jb 0x403d08
lea eax, [ebp - 0x20]
push eax
call fcn.004038df
pop ecx
xor edx, edx
movsx eax, dx
shl eax, 2
lea ecx, [ebp + eax - 0x20]
mov eax, dword [ebp + eax - 0x10]
xor dword [ecx], eax
inc edx
cmp dx, 4
jb 0x403d2c
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.004038fa
lea eax, [ebp - 0x30]
push eax
push ebx
call fcn.004038bf
lea eax, [ebp - 0x30]
push eax
call fcn.0040383c
add esp, 0x18
xor ecx, ecx
movsx eax, cx
mov edx, dword [ebp + eax*4 - 0x40]
xor edx, dword [ebp + eax*4 - 0x30]
inc ecx
mov dword [esi + eax*4 + 0x10], edx
cmp cx, 4
jb 0x403d69
pop esi
pop ebx
leave
ret
Function at 0x403ea7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
push ebx
xor ecx, ecx
push esi
inc ecx
push edi
mov eax, ecx
xor edi, edi
mov esi, 0xe3
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
cmp di, 0x71
movzx eax, dx
jl 0x403ebf
cmp ax, cx
jne 0x403f01
mov eax, 0xe2
xor edi, edi
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
cmp di, 0x71
movzx eax, dx
jl 0x403ee5
jmp 0x403f22
push 0x71
pop edi
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
movzx eax, dx
mov edx, 0xe2
cmp di, dx
jl 0x403f04
mov eax, ecx
mov word [0x44d170], ax
or eax, 0xffffffff
mov word [0x44d336], ax
mov edi, ecx
mov dword [ebp - 8], 0x70
lea eax, [ecx + ecx]
cdq
mov ecx, esi
idiv ecx
movzx eax, dx
movsx ecx, ax
lea eax, [ecx + ecx]
mov edx, eax
neg edx
mov bx, word [ebp + edx - 0x10]
mov dx, word [ebp + edx - 0x14]
mov word [ebp - 0xe], dx
mov dx, word [ebp + eax - 0x1da]
mov ax, word [ebp + eax - 0x1d6]
mov word [ebp - 0xc], dx
xor edx, edx
mov word [ebp - 0x10], bx
mov word [ebp - 0xa], ax
mov dword [ebp - 4], edx
movsx eax, word [ebp - 4]
movzx eax, word [ebp + eax*2 - 0x10]
cmp ax, 0x71
jge 0x403fa3
movsx ebx, dx
imul ebx, ebx, 0xe3
add ebx, edi
mov word [ebx*2 + 0x44d170], ax
inc edx
inc dword [ebp - 4]
cmp dx, 2
jl 0x403f80
inc edi
dec dword [ebp - 8]
jne 0x403f3c
push 0x70
pop ebx
xor eax, eax
push 0x10
mov word [0x44d150], ax
pop eax
mov edx, eax
mov edi, 0xffff0000
mov esi, edi
and esi, ebx
je 0x403fd6
add word [0x44d150], dx
mov ebx, esi
cdq
sub eax, edx
sar eax, 1
movzx edx, ax
movsx eax, dx
mov esi, edi
mov ecx, eax
shr esi, cl
xor edi, esi
test dx, dx
jne 0x403fc7
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403ff3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.004038bf
lea eax, [ebp - 0x10]
push eax
call fcn.0040383c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.004038fa
mov esi, dword [ebp + 0xc]
add esp, 0x18
push dword [ebp + 0x10]
xor edi, edi
cmp word [esi], di
je 0x404042
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004038fa
add esp, 0xc
jmp 0x404048
call fcn.004038aa
pop ecx
mov edx, dword [ebp + 0x10]
movsx eax, di
mov ecx, eax
mov eax, dword [esi + eax*4 + 0x14]
shl ecx, 2
xor eax, dword [ebp + ecx - 0x20]
add edx, ecx
xor dword [edx], eax
inc edi
cmp di, 4
jb 0x404048
pop edi
pop esi
leave
ret
Function at 0x40406a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
movsx edx, cx
or eax, dword [esi + edx*4]
inc ecx
cmp cx, 4
jb 0x404075
test eax, eax
jne 0x4040af
mov esi, dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
call fcn.004038bf
push esi
call fcn.00403872
lea eax, [esi + 0x10]
push eax
push esi
call fcn.004038bf
add esp, 0x14
xor eax, eax
jmp 0x4041f3
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.004039ee
lea eax, [ebp - 0x14]
push eax
call fcn.0040383c
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call fcn.004038fa
lea eax, [ebp - 0x24]
push eax
call fcn.00403872
add esp, 0x1c
xor eax, eax
xor ecx, ecx
movsx edx, cx
xor eax, dword [ebp + edx*4 - 0x24]
inc ecx
cmp cx, 4
jb 0x4040e2
or edx, 0xffffffff
mov dword [ebp - 4], 0x10
movsx ecx, word [ebp - 4]
sar word [ebp - 4], 1
shr edx, cl
mov esi, eax
shr esi, cl
mov ecx, edx
and ecx, eax
xor esi, ecx
cmp word [ebp - 4], 0
mov eax, esi
jg 0x4040fa
push edi
test eax, eax
je 0x40413a
xor edi, edi
inc edi
mov esi, dword [ebp + 0x10]
push esi
call fcn.004038aa
add esi, 0x10
push esi
call fcn.004038aa
pop ecx
pop ecx
mov eax, edi
jmp 0x4041f2
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.004038aa
xor ebx, ebx
inc ebx
pop ecx
xor eax, eax
mov dword [ebp - 4], 0x71
mov ecx, eax
shr ecx, 5
push 3
lea edi, [eax + 1]
pop edx
sub edx, ecx
mov eax, edi
shr eax, 5
push 3
movzx edx, dx
pop ecx
sub ecx, eax
movzx esi, cx
movsx ecx, dx
shl ecx, 2
mov eax, dword [ebp + ecx - 0x14]
xor eax, dword [ebp + ecx - 0x24]
and eax, ebx
cmp si, dx
jne 0x404192
movsx ecx, si
add eax, eax
lea ecx, [ebp + ecx*4 - 0x14]
or dword [ecx], eax
add ebx, ebx
jmp 0x4041a0
xor ebx, ebx
inc ebx
test eax, eax
je 0x4041a0
movsx eax, si
mov dword [ebp + eax*4 - 0x14], ebx
dec dword [ebp - 4]
mov eax, edi
jne 0x404151
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x24]
pop ebx
test eax, 0x10000
je 0x4041bd
push 2
pop edi
jmp 0x40411f
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
push esi
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.004038fa
lea eax, [esi + 0x10]
push eax
call fcn.004038aa
add esp, 0x10
xor ecx, ecx
movsx eax, cx
mov edx, dword [edi + eax*4]
xor edx, dword [esi + eax*4]
inc ecx
mov dword [esi + eax*4 + 0x10], edx
cmp cx, 4
jb 0x4041dc
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x405976
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.004033e6
xor edi, edi
cmp dword [ebp + 0x14], 2
mov esi, eax
jne 0x405a28
lea eax, [edi + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.00404404
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp + eax - 0x28]
xor dword [ebp + eax - 0x18], ecx
add eax, 4
cmp eax, 0x10
jl 0x4059b5
inc edi
cmp edi, 4
jl 0x4059a0
call fcn.004033e6
mov ebx, eax
call fcn.004033e6
mov dword [ebp + 0x14], eax
xor edi, edi
push ebx
push 0x20
push esi
call fcn.0040363e
push dword [ebp + edi*4 - 0x18]
push dword [ebp + 0x14]
call fcn.00403448
push esi
push dword [ebp + 0x14]
push ebx
call fcn.004045a3
add esp, 0x20
inc edi
cmp edi, 4
jl 0x4059dc
mov eax, dword [ebp + 0x10]
push dword [eax]
push dword [ebp + 0xc]
push esi
call fcn.00404944
push dword [ebp + 0x14]
call fcn.004033fd
push ebx
call fcn.004033fd
add esp, 0x14
jmp 0x405aea
inc edi
cmp dword [ebp + 0x14], edi
jne 0x405ac9
call fcn.004033e6
mov dword [ebp - 8], eax
call fcn.004033e6
mov dword [ebp + 0x14], eax
call fcn.004033e6
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.004042ff
push eax
push esi
call fcn.00403448
push esi
push dword [ebp - 4]
call fcn.0040341b
add esp, 0x14
cmp dword [ebp + 0x18], ebx
jle 0x405a9e
push dword [ebp - 8]
push 0x20
push esi
call fcn.0040363e
push dword [ebp + 8]
lea edi, [ebx + 2]
call fcn.004042ff
push eax
push dword [ebp + 0x14]
call fcn.00403448
push esi
push dword [ebp + 0x14]
push dword [ebp - 8]
call fcn.004045a3
add esp, 0x24
inc ebx
cmp ebx, dword [ebp + 0x18]
jl 0x405a6a
mov eax, dword [ebp + 0x10]
push dword [eax]
push dword [ebp + 0xc]
push dword [ebp - 4]
push esi
call fcn.00405864
push dword [ebp - 4]
call fcn.004033fd
push dword [ebp + 0x14]
call fcn.004033fd
push dword [ebp - 8]
call fcn.004033fd
jmp 0x405ae7
push dword [ebp + 8]
call fcn.004042ff
push eax
push esi
call fcn.00403448
mov eax, dword [ebp + 0x10]
push dword [eax]
push dword [ebp + 0xc]
push esi
push esi
call fcn.00405864
add esp, 0x1c
push esi
call fcn.004033fd
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406560
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ecx
push edx
push ebx
push 4
lea eax, [ebp - 4]
push eax
call sub.advapi32.dll_SystemFunction036
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, dword [ebp + 0xc]
inc ecx
sub ecx, dword [ebp + 8]
div ecx
add edx, dword [ebp + 8]
mov eax, edx
pop ebx
pop edx
pop ecx
mov esp, ebp
pop ebp
ret 8