joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a0a3
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x490060], 0
je 0x41a0fb
cmp dword [0x49006c], 0
je 0x41a0fb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ecea0]
cmp eax, dword [0x4ed8ba]
jb 0x41a0fb
push dword [0x4eceb8]
call fcn.0041a57e
pop ecx
call fcn.0041a662
mov eax, dword [0x4eceb8]
xor ecx, ecx
inc eax
cmp eax, dword [0x490070]
cmovge eax, ecx
mov dword [0x4eceb8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ecea0], eax
ret

Function at 0x41a190
Capabilities:
Check for time delay via gettickcount

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ece98]
cmp eax, dword [0x4ed8aa]
jb 0x41a222
push ebx
push ebp
push esi
mov ebp, 0x10000
mov esi, ebp
call fcn.004248ac
push 0x2e
cdq
pop ecx
idiv ecx
mov ebx, edx
cmp esi, 0x3eb
ja 0x41a1e6
movzx eax, word [0x490074]
cmp esi, eax
je 0x41a1e6
imul eax, esi, 0x153
cmp dword [eax + 0x490098], 0
je 0x41a1e6
cmp byte [eax + 0x4900c5], 0
je 0x41a207
call fcn.00419ae1
cmp ax, 2
jb 0x41a202
call fcn.004248ac
cdq
mov ecx, 0x3ec
idiv ecx
mov esi, edx
jmp 0x41a1bb
mov esi, 0xffff
cmp esi, ebp
je 0x41a214
push esi
push ebx
call fcn.00417fed
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop esi
pop ebp
mov dword [0x4ece98], eax
pop ebx
ret
Function at 0x41a223
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x436f00
call fcn.0041fd88
sub esp, 0x164
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ece9c]
cmp eax, dword [0x4ed8b2]
jb 0x41a407
push ebx
push ebp
push esi
push 0x10
mov ebp, 0x490078
push ebp
call fcn.00418c20
movzx eax, word [0x490074]
imul eax, eax, 0x153
pop ecx
pop ecx
mov ecx, ebp
lea edx, [eax + 0x4900a4]
sub edx, ebp
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x41a274
mov esi, dword [0x511eb2]
push 0x3f
mov byte [esp + 0x20], al
xor esi, 0xfde
lea eax, [esp + 0x21]
push 0
push eax
call fcn.00420a30
lea eax, [esp + 0x28]
push 0x3e9
push eax
call fcn.00419a04
lea ebx, [esp + 0x30]
add esp, 0x14
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x41a2b5
sub ebx, ecx
mov ecx, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a2c3
sub ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, 0x4ed888
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a2d8
sub ecx, edx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x5c]
call fcn.00401783
and dword [esp + 0x178], 0
lea eax, [esp + 0x10]
push 1
push 0x20
push eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x1c], 0xfde
call fcn.00401c52
push 1
push 8
pop ebp
push ebp
lea eax, [esp + 0x14]
mov byte [esp + 0x14], 1
push eax
lea ecx, [esp + 0x68]
call fcn.00401c52
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x5c]
push 1
mov byte [esp + 0x10], al
lea eax, [esp + 0x10]
push ebp
push eax
call fcn.00401c52
mov ecx, dword [esp + 0x14]
movzx eax, cl
lea ecx, [esp + 0x5c]
push eax
push 0x490078
call fcn.00401be8
mov dword [esp + 0x10], esi
lea eax, [esp + 0x10]
xor esi, esi
lea ecx, [esp + 0x5c]
inc esi
push esi
push 0x20
push eax
call fcn.00401c52
push esi
push ebp
lea eax, [esp + 0x14]
mov byte [esp + 0x14], bl
push eax
lea ecx, [esp + 0x68]
call fcn.00401c52
movzx eax, bl
lea ecx, [esp + 0x5c]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00401be8
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push ebp
push eax
lea ecx, [esp + 0x68]
mov byte [esp + 0x18], bl
call fcn.00401c52
movzx eax, bl
lea ecx, [esp + 0x5c]
push eax
push 0x4ed888
call fcn.00401be8
mov ecx, dword [0x4e321c]
xor edx, edx
push edx
push dword [0x439cac]
push dword [0x439ca8]
mov eax, dword [ecx]
push edx
push edx
push ebp
push esi
lea edx, [esp + 0x78]
push edx
push 0x4493a0
call dword [eax + 0x64]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
or dword [esp + 0x178], 0xffffffff
lea ecx, [esp + 0x5c]
mov dword [0x4ece9c], eax
call fcn.0040179e
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x164]
mov dword fs:[0], ecx
leave
ret
Function at 0x41a417
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x436f00
call fcn.0041fd88
sub esp, 0x118
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ecea4]
cmp eax, dword [0x4ed8ae]
jb 0x41a56e
push ebx
push ebp
push edi
lea ecx, [esp + 0x10]
call fcn.00401783
mov eax, dword [0x4ece90]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], eax
xor ebp, ebp
xor ebx, ebx
inc ebp
inc eax
mov dword [esp + 0x12c], ebx
push ebp
mov dword [0x4ece90], eax
lea eax, [esp + 0x10]
push 0x20
push eax
call fcn.00401c52
mov ecx, dword [0x4e321c]
lea edx, [esp + 0x10]
push ebx
push dword [0x439cac]
push dword [0x439ca8]
mov eax, dword [ecx]
push ebx
push ebx
push 0xa
pop edi
push edi
push ebp
push edx
push 0x44944c
call dword [eax + 0x64]
mov ecx, dword [0x4e321c]
lea edx, [esp + 0x10]
push ebx
push dword [0x439cac]
push dword [0x439ca8]
mov eax, dword [ecx]
push ebx
push ebx
push edi
push ebp
push edx
push 0x4493c0
call dword [eax + 0x64]
mov ecx, dword [0x4e321c]
lea edx, [esp + 0x10]
push ebx
push dword [0x439cac]
push dword [0x439ca8]
mov eax, dword [ecx]
push ebx
push ebx
push edi
push ebp
push edx
push 0x4493c4
call dword [eax + 0x64]
mov ecx, dword [0x4e321c]
lea edx, [esp + 0x10]
push ebx
push dword [0x439cac]
push dword [0x439ca8]
mov eax, dword [ecx]
push ebx
push ebx
push edi
push ebp
push edx
push 0x449434
call dword [eax + 0x64]
mov ecx, dword [0x4e321c]
push ebx
push dword [0x439cac]
push dword [0x439ca8]
mov eax, dword [ecx]
push ebx
push ebx
push edi
push ebp
lea edx, [esp + 0x2c]
push edx
push 0x4493b0
call dword [eax + 0x64]
movzx eax, word [0x4ed0bd]
push 0x4385f8
push ebp
push ebp
push eax
call fcn.0041a896
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
or dword [esp + 0x12c], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [0x4ecea4], eax
call fcn.0040179e
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
leave
ret

Function at 0x41a609
Capabilities:
Check for time delay via gettickcount

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4eceb4]
cmp eax, dword [0x4ed8a6]
jb 0x41a661
call fcn.004248ac
and eax, reloc.WS2_32.dll_ntohs
jns 0x41a62e
dec eax
or eax, 0xfffffff0
inc eax
add eax, 3
push eax
push 0x490078
call fcn.00418c20
push 0
mov byte [0x4eced1], 1
call fcn.0041a15e
push 1
push 1
call fcn.0041c322
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4eceb4], eax
ret

Function at 0x41ac1d
Capabilities:
Create thread
Terminate thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x4ed4e8], esi
je 0x41ac70
push esi
push esi
push 2
push dword [0x4ed4f4]
mov dword [0x4ed4e8], esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x4ed4f4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push str.teleportMenuWndClass
call dword [sym.imp.USER32.dll_UnregisterClassA]
push esi
push dword [0x4ed4f0]
mov dword [0x4ed4ec], esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push esi
push esi
push 0x41eaaf
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4ed4f0], eax
pop esi
ret
Function at 0x41c257
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x436df8
call fcn.0041fd88
sub esp, 0x228
cmp dword [ebp + 8], 0
push esi
je 0x41c2cb
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4ececc]
cmp eax, dword [ebp + 0xc]
jbe 0x41c313
call esi
lea ecx, [ebp - 0x120]
mov dword [0x4ececc], eax
call fcn.00401783
mov ecx, dword [ebp + 0x10]
xor edx, edx
push edx
push dword [0x439d5c]
mov dword [ebp - 4], edx
push dword [0x439d58]
mov eax, dword [ecx]
push edx
push edx
push 8
push 1
lea edx, [ebp - 0x120]
push edx
push 0x449400
call dword [eax + 0x64]
lea ecx, [ebp - 0x120]
jmp 0x41c30a
lea ecx, [ebp - 0x234]
call fcn.00401783
mov ecx, dword [ebp + 0x10]
xor edx, edx
push edx
push dword [0x439d5c]
xor esi, esi
push dword [0x439d58]
mov eax, dword [ecx]
inc esi
push edx
push edx
push 8
push esi
lea edx, [ebp - 0x234]
mov dword [ebp - 4], esi
push edx
push 0x449400
call dword [eax + 0x64]
lea ecx, [ebp - 0x234]
or dword [ebp - 4], 0xffffffff
call fcn.0040179e
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41e667
Capabilities:
Initialize winsock library
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9a4
lea eax, [ebp - 0x9a4]
push edi
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x41e68d
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
xor ebx, ebx
push ebx
push 2
pop esi
push esi
push esi
call sub.WS2_32.dll_socket
mov dword [0x4ed638], eax
cmp eax, 0xffffffff
jne 0x41e6b1
call sub.WS2_32.dll_WSACleanup
pop esi
xor eax, eax
pop ebx
jmp 0x41e688
xor eax, eax
mov edi, 0x4ed63c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx eax, word [0x4ed600]
push eax
mov word [0x4ed63c], si
call sub.WS2_32.dll_htons
mov edi, 0x4ed500
mov word [0x4ed63e], ax
push edi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x41e6fe
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
push 0x4ed640
call fcn.004201a0
add esp, 0xc
jmp 0x41e709
push edi
call sub.WS2_32.dll_inet_addr
mov dword [0x4ed640], eax
push ebx
mov word [0x4ed64c], si
call sub.WS2_32.dll_htons
push dword [0x4ed600]
mov word [0x4ed64e], ax
push edi
push str.RCON_mode_initialized___s:_d_._Type_login__password__to_set_the_password.
call fcn.0040c13e
mov edi, 0x400
mov dword [ebp - 4], 0x10
push edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00420a30
add esp, 0x18
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
lea eax, [ebp - 0x414]
push eax
push dword [0x4ed638]
call sub.WS2_32.dll_recvfrom
test eax, eax
jle 0x41e7e2
cmp byte [ebp - 0x40a], 0x78
jne 0x41e7e2
push edi
lea eax, [ebp - 0x814]
push ebx
push eax
call fcn.00420a30
movsx ax, byte [ebp - 0x409]
add esp, 0xc
movzx edx, ax
lea eax, [ebp - 0x407]
cmp dx, di
ja 0x41e7e2
cmp byte [ebp - 0x407], bl
je 0x41e7b6
mov cl, byte [eax]
cmp cl, 1
jl 0x41e7b1
cmp cl, 0x1f
jg 0x41e7b1
mov byte [eax], 0x20
inc eax
cmp byte [eax], bl
jne 0x41e7a2
mov esi, edx
lea eax, [ebp - 0x407]
push esi
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.00420bf0
lea eax, [ebp - 0x814]
mov byte [ebp + esi - 0x814], bl
push eax
call fcn.0040c13e
add esp, 0x10
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41e74a
Function at 0x41e7ef
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
push edi
mov edi, 0x4ed660
mov ebx, edi
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x41e805
sub ebx, ecx
mov ecx, dword [ebp + 8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e814
push 0x400
lea eax, [ebp - 0x404]
sub ecx, edx
push 0
push eax
mov dword [ebp - 4], ecx
call fcn.00420a30
mov eax, dword [0x4ed640]
mov dword [ebp - 0x400], eax
mov ax, word [0x4ed63e]
push 0x78
mov word [ebp - 0x3fc], ax
pop eax
mov word [ebp - 0x3fa], ax
movzx eax, bl
movzx esi, bl
push esi
mov word [ebp - 0x3f9], ax
lea eax, [ebp - 0x3f7]
push edi
push eax
mov dword [ebp - 0x404], 0x504d4153
call fcn.00420bf0
add esp, 0x18
lea edi, [esi + 0xd]
cmp dword [ebp + 0xc], 0
jne 0x41e8b1
mov ecx, dword [ebp - 4]
movzx eax, cl
mov word [ebp + edi - 0x404], ax
add edi, 2
movzx esi, cl
lea eax, [ebp - 0x404]
push esi
push dword [ebp + 8]
add eax, edi
push eax
call fcn.00420bf0
add esp, 0xc
add edi, esi
push 0x10
push 0x4ed63c
push 0
push edi
lea eax, [ebp - 0x404]
push eax
push dword [0x4ed638]
call sub.WS2_32.dll_sendto
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432ae4
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46cf60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042578b
mov dword [ebp - 0x14], eax
cmp dword [0x5169c0], esi
jne 0x432bd7
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x432b64
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x432cb7
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x432cb7
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x432cb7
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x5169c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x5169c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5169c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5169d0], eax
test eax, eax
je 0x432bd4
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5169cc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x432bfc
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x432bef
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x432c11
push 4
pop eax
jmp 0x432cb9
cmp dword [ebp - 0x14], esi
je 0x432c11
push dword [0x5169c0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x432bf6
mov eax, dword [0x5169cc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x432c6f
cmp dword [0x5169d0], edi
je 0x432c6f
push eax
call ebx
push dword [0x5169d0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x432c6f
test eax, eax
je 0x432c6f
call ecx
test eax, eax
je 0x432c64
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x432c64
test byte [ebp - 8], 1
jne 0x432c6f
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x432c9f
mov eax, dword [0x5169c4]
cmp eax, edi
je 0x432c9c
push eax
call ebx
test eax, eax
je 0x432c9c
call eax
mov esi, eax
test esi, esi
je 0x432c9c
mov eax, dword [0x5169c8]
cmp eax, edi
je 0x432c9c
push eax
call ebx
test eax, eax
je 0x432c9c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5169c0]
call ebx
test eax, eax
je 0x432cb7
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x432cb9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004254f8
mov esp, ebp
pop ebp
ret
Function at 0x4bab90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x78000]
push edi
jmp 0x4babaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4babb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4baba0
mov eax, 1
add ebx, ebx
jne 0x4babc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4babd4
jne 0x4babf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4babf3
dec eax
add ebx, ebx
jne 0x4babe0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4babb8
add ebx, ebx
jne 0x4babef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4bac45
xor ecx, ecx
sub eax, 3
jb 0x4bac0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4bac7a
sar eax, 1
mov ebp, eax
jmp 0x4bac16
add ebx, ebx
jne 0x4bac16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4babe4
inc ecx
add ebx, ebx
jne 0x4bac24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4babe4
add ebx, ebx
jne 0x4bac31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4bac26
jne 0x4bac42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4bac26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4bac64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4bac56
jmp 0x4baba6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4bac64
add edi, ecx
jmp 0x4baba6
pop esi
mov edi, esi
mov ecx, 0x377e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4bac82
cmp byte [edi], 0x11
jne 0x4bac82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4bac87
lea edi, [esi + 0xb6000]
mov eax, dword [edi]
or eax, eax
je 0x4bacff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc301c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc3170]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4bacb4
mov ecx, edi
jns 0x4bace3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc3174]
or eax, eax
je 0x4bacf9
mov dword [ebx], eax
add ebx, 4
jmp 0x4bacd1
call dword [esi + 0xc3184]
mov ebp, dword [esi + 0xc3178]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4bad33
sub esp, 0xffffff80
jmp 0x416310
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x401954
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
xor eax, eax
push esi
push edi
mov esi, str.Error:
lea edi, [ebp - 0x28]
push 6
pop ecx
push 0x14
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00490712
mov edi, eax
mov esi, 0x200
push edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x428]
push esi
push eax
call fcn.004904bd
lea eax, [ebp + 0xc]
sub esi, edi
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x428]
lea eax, [eax + edi*2]
push esi
push eax
call fcn.00401a9a
add esp, 0x28
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop esi
leave
ret

Function at 0x4019c6
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
xor eax, eax
push esi
push edi
mov esi, str.sdf.txt
lea edi, [ebp - 0x28]
push 6
pop ecx
push 0x14
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00490712
mov edi, eax
mov esi, 0x200
push edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x428]
push esi
push eax
call fcn.004904bd
lea eax, [ebp + 0xc]
sub esi, edi
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x428]
lea eax, [eax + edi*2]
push esi
push eax
call fcn.00401a9a
add esp, 0x28
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop esi
leave
ret
Function at 0x4072f5
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, dword [0x4e7388]
inc ebp
push edi
test esi, esi
jne 0x407347
push 4
pop edi
push 8
mov dword [0x4e69c8], 0x4141f00d
mov esi, ebp
mov ebx, ebp
pop edx
mov eax, dword [edi + 0x4e69c4]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, esi
lea esi, [ebx + 1]
mov dword [edi + 0x4e69c8], eax
mov ebx, esi
mov edi, edx
add edx, 4
cmp esi, 0x270
jl 0x40731a
cmp esi, 0x270
jl 0x407401
xor esi, esi
mov edi, 0x4e6ffc
mov edx, esi
mov eax, dword [edx*4 + 0x4e69c8]
mov ecx, dword [edi + edx*4 - 0x630]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, ebp
xor ecx, dword [eax*4 + 0x4e3008]
xor ecx, dword [edi + edx*4]
mov dword [edx*4 + 0x4e69c8], ecx
inc edx
cmp edx, 0xe3
jl 0x40735c
lea edi, [edx*4 + 0x4e69c8]
mov ebx, dword [edi]
mov eax, ebx
mov ebx, dword [edi + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, ebp
mov eax, dword [eax*4 + 0x4e3008]
xor eax, dword [edi - 0x38c]
xor eax, ecx
mov dword [edi], eax
add edi, 4
cmp edi, 0x4e7384
jl 0x40739d
mov ecx, dword [0x4e7384]
mov eax, dword [0x4e69c8]
and ecx, 0x80000000
and eax, 0x7fffffff
or ecx, eax
mov eax, ecx
shr ecx, 1
and eax, ebp
xor ecx, dword [eax*4 + 0x4e3008]
xor ecx, dword [0x4e6ff8]
mov dword [0x4e7384], ecx
mov ecx, dword [esi*4 + 0x4e69c8]
inc esi
mov eax, ecx
mov dword [0x4e7388], esi
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
pop edi
pop esi
mov eax, ecx
shr eax, 0x12
pop ebp
xor eax, ecx
pop ebx
ret

Function at 0x40822c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, 0xffc0
push edi
mov edi, dword [esp + 0x10]
mov ecx, dword [edi]
test ecx, ecx
je 0x40825f
mov edx, dword [ecx + 4]
mov eax, ebx
sub eax, edx
cmp eax, esi
jl 0x40825f
lea eax, [esi + 7]
and eax, 0xfffffff8
add eax, edx
mov dword [ecx + 4], eax
lea eax, [ecx + 8]
add eax, edx
jmp 0x40828d
mov eax, 0xffc8
cmp esi, ebx
jle 0x40826b
lea eax, [esi + 8]
push 0x40
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [esi + 7]
and ecx, 0xfffffff8
mov dword [eax + 4], ecx
mov ecx, dword [edi]
mov dword [eax], ecx
mov dword [edi], eax
add eax, 8
pop edi
pop esi
pop ebx
ret