joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a9e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4350d0]
jne 0x401aa8
repz ret
jmp fcn.00402bd6

Function at 0x40f8a5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403626
and dword [ebp - 4], 0
cmp dword [0x4376fc], 0
mov ebx, eax
jne 0x40f956
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40fa07
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40fa07
push eax
call fcn.004035b4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4376fc], eax
call esi
push eax
call fcn.004035b4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x437700], eax
call esi
push eax
call fcn.004035b4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x437704], eax
call esi
push eax
call fcn.004035b4
pop ecx
mov dword [0x43770c], eax
test eax, eax
je 0x40f956
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004035b4
pop ecx
mov dword [0x437708], eax
mov eax, dword [0x437708]
cmp eax, ebx
je 0x40f9ae
cmp dword [0x43770c], ebx
je 0x40f9ae
push eax
call fcn.0040362f
push dword [0x43770c]
mov esi, eax
call fcn.0040362f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f9ae
test edi, edi
je 0x40f9ae
call esi
test eax, eax
je 0x40f9a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f9a5
test byte [ebp - 0xc], 1
jne 0x40f9ae
or dword [ebp + 0x10], 0x200000
jmp 0x40f9e7
mov eax, dword [0x437700]
cmp eax, ebx
je 0x40f9e7
push eax
call fcn.0040362f
pop ecx
test eax, eax
je 0x40f9e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f9e7
mov eax, dword [0x437704]
cmp eax, ebx
je 0x40f9e7
push eax
call fcn.0040362f
pop ecx
test eax, eax
je 0x40f9e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4376fc]
call fcn.0040362f
pop ecx
test eax, eax
je 0x40fa07
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40fa09
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42f092
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp esi, 0x5026c
jne 0x42f12f
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
push 0x4377e0
mov byte [0x4377e0], 0x6b
mov byte [0x4377e1], 0x65
mov byte [0x4377e2], 0x72
mov byte [0x4377e3], 0x6e
mov byte [0x4377e4], 0x65
mov byte [0x4377e5], 0x6c
mov byte [0x4377e6], 0x33
mov byte [0x4377e7], 0x32
mov byte [0x4377e8], 0x2e
mov byte [0x4377e9], 0x64
mov byte [0x4377ea], 0x6c
mov byte [0x4377eb], 0x6c
mov byte [0x4377ec], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 8]
push eax
push 0x40
push dword [0x437ba4]
push dword [0x437aec]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, 0x36edcb
jl 0x42f09a
pop esi
leave
ret
Function at 0x42f309
Capabilities:
Clear file content
Create pipe
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x437ba4]
push ebx
mov ebx, dword [0x437aec]
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
cmp eax, 0x5dd
jne 0x42f32f
push esi
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.0042f233
cmp dword [0x437ba4], 0x2f
pop ecx
jne 0x42f394
push edi
xor eax, eax
mov word [ebp - 0xc], ax
lea edi, [ebp - 0xa]
stosw word es:[edi], ax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push dword [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
push ebx
mov ebx, dword [ebp - 0x10]
call fcn.0042f27d
cmp dword [0x437ba4], 0x568
pop ecx
jne 0x42f3b1
push esi
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
pop esi
pop ebx
leave
ret
Function at 0x42f784
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x804
mov eax, dword [0x4350d0]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
mov edi, 0x13ba1f
xor esi, esi
cmp dword [0x437ba4], 0xbf9
jne 0x42f7b4
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
cmp dword [0x437ba4], 0x3dc
mov dword [0x437b98], 0x8e55ceaa
jne 0x42f7df
push esi
push 0x432a84
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
dec edi
jne 0x42f7a1
cmp esi, 0x8465cd
jne 0x42f7f9
mov eax, dword [0x436b68]
add eax, 0xa231
mov dword [0x437ba4], eax
cmp dword [0x437ba4], 0x141
jne 0x42f826
push str.Debiluluyi_domuni_catuca_goherajoxaneh_tobo
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
or dword [0x43786c], 0xffffffff
mov dword [0x437868], 0xec58acac
inc esi
cmp esi, 0x125483c
jl 0x42f7e2
call fcn.0042f3b5
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00401a9e
add esp, 0x804
ret 0x10
Function at 0x4012c7
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x148
push edi
mov edi, dword [ebp + 0x78]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [eax - 1]
cmp ecx, 0x100
mov dword [ebp + 0x64], eax
ja 0x40143e
cmp byte [eax + edi - 1], 0x5c
je 0x4012fe
mov byte [eax + edi], 0x5c
inc eax
mov dword [ebp + 0x64], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push esi
lea esi, [eax + edi]
lea eax, [ebp - 0xdc]
push eax
push edi
mov byte [esi], 0x2a
mov byte [esi + 1], 0
call ebx
cmp eax, 0xffffffff
mov dword [ebp + 0x68], eax
je 0x40139a
test byte [ebp - 0xdc], 0x10
je 0x40137d
push 0x40b274
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40137d
push 0x40b270
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40137d
mov eax, 0x104
sub eax, dword [ebp + 0x64]
push eax
lea eax, [ebp - 0xb0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push dword [ebp + 0x7c]
push edi
push dword [ebp + 0x74]
call fcn.004012c7
add esp, 0xc
lea eax, [ebp - 0xdc]
push eax
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401322
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0xdc]
push eax
push edi
mov byte [esi], 0x2a
mov byte [esi + 1], 0
call ebx
cmp eax, 0xffffffff
mov dword [ebp + 0x68], eax
je 0x401421
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test byte [ebp - 0xdc], 0x10
jne 0x401404
mov eax, 0x104
sub eax, dword [ebp + 0x64]
push eax
lea eax, [ebp - 0xb0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
call ebx
test eax, eax
jne 0x4013f3
cmp dword [ebp + 0x74], eax
jne 0x4013f3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call ebx
cmp dword [ebp + 0x7c], 0
je 0x401404
test eax, eax
jne 0x401404
push 4
push eax
push edi
call dword [ebp + 0x7c]
lea eax, [ebp - 0xdc]
push eax
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4013b9
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
mov byte [esi - 1], 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
pop esi
pop ebx
jne 0x40143e
cmp dword [ebp + 0x7c], eax
je 0x40143e
push 4
push eax
push edi
call dword [ebp + 0x7c]
pop edi
add ebp, 0x6c
leave
ret
Function at 0x401750
Capabilities:
Create directory
Delete file
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
je 0x401793
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x401819
cmp eax, 0x103
ja 0x401819
add eax, ebx
cmp byte [eax - 1], 0x5c
je 0x4017b0
mov byte [eax], 0x5c
mov byte [eax + 1], 0
jmp 0x4017b0
push ebx
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40185d
cmp eax, esi
ja 0x40185d
push edi
mov edi, dword [ebp + 0x10]
push edi
push 0
push str.LMIR
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4017df
cmp dword [ebp + 8], eax
jne 0x401818
push str.Failed_to_create_temporary_folder.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004014a3
jmp 0x401850
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401820
cmp dword [ebp + 8], eax
jne 0x401815
push str.Failed_to_create_temporary_folder.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004014a3
pop ecx
pop ecx
push edi
call esi
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push edi
call esi
test eax, eax
jne 0x401854
cmp dword [ebp + 8], eax
jne 0x401845
push str.Failed_to_use_temporary_folder.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004014a3
pop ecx
pop ecx
push ebx
call esi
push edi
push 0
call fcn.00401444
pop ecx
pop ecx
jmp 0x401818
mov dword [ebp - 4], 1
jmp 0x401818
push str.Failed_to_resolve_temporary_folder_path.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004014a3
pop ecx
pop ecx
jmp 0x401819
Function at 0x4018f6
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
je 0x401987
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401952
push esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40194b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401a7f
mov dword [ebp - 8], 1
push 0x104
push dword [ebp + 0x10]
lea eax, [ebp - 0x114]
push eax
call edi
lea eax, [ebp - 0x114]
push eax
call ebx
mov esi, eax
cmp esi, 0x102
jae 0x401987
mov byte [ebp + esi - 0x114], 0x5c
inc esi
mov byte [ebp + esi - 0x114], 0
mov eax, dword [ebp + 0xc]
cmp eax, 0xffff
jbe 0x4019b1
mov ecx, 0x104
sub ecx, esi
push ecx
push eax
lea eax, [ebp + esi - 0x114]
push eax
call edi
lea eax, [ebp - 0x114]
push eax
call ebx
xor ebx, ebx
jmp 0x4019ff
call fcn.00401872
test eax, eax
je 0x401a7f
mov eax, dword [0x40efac]
mov ecx, 0x103
sub ecx, esi
cmp ecx, eax
jae 0x4019d5
mov eax, ecx
mov dword [0x40efac], eax
xor ebx, ebx
xor ecx, ecx
cmp eax, ebx
jbe 0x4019f3
mov edx, dword [0x40efa8]
mov dl, byte [edx + ecx]
mov byte [ebp + esi - 0x114], dl
inc esi
inc ecx
cmp ecx, eax
jb 0x4019dd
mov byte [ebp + esi - 0x114], bl
call fcn.004018c9
cmp word [ebp + 8], bx
je 0x401a11
mov eax, dword [ebp + 8]
call fcn.00401872
test eax, eax
jne 0x401a24
cmp dword [0x40efa8], ebx
je 0x401a7f
cmp dword [0x40efac], 0
je 0x401a7f
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
xor edi, edi
inc edi
push edi
push 0x40000000
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401a6f
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [0x40efac]
mov dword [ebp - 0xc], edi
push dword [0x40efa8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp + 8], bx
je 0x401a7a
call fcn.004018c9
cmp dword [ebp - 4], ebx
jne 0x401ab0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0xc], 0
mov esi, eax
je 0x401a9a
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 8], 0
je 0x401aa9
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ab8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 4
push edi
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401b0b
push 2
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp + 0xc]
call fcn.00402900
pop ecx
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret
Function at 0x4053cd
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x40ea68]
je 0x4053e8
inc edi
cmp edi, 0x17
jb 0x4053d9
cmp edi, 0x17
jae 0x405568
push ebp
push 3
call fcn.00408161
cmp eax, 1
pop ecx
je 0x405534
push 3
call fcn.00408161
test eax, eax
pop ecx
jne 0x40541c
cmp dword [0x40e030], 1
je 0x405534
cmp ebx, 0xfc
je 0x405567
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x40f068
push ebp
call fcn.00406d29
add esp, 0xc
test eax, eax
je 0x405452
push esi
push esi
push esi
push esi
push esi
call fcn.00404cd3
add esp, 0x14
push 0x104
mov esi, 0x40f081
push esi
push 0
mov byte [0x40f185], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405496
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00406d29
add esp, 0xc
test eax, eax
je 0x405496
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00404cd3
add esp, 0x14
push esi
call fcn.00402900
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4054db
push esi
call fcn.00402900
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x40f37c
push 0x40bb54
sub ecx, eax
push ecx
push eax
call fcn.00406c76
add esp, 0x14
test eax, eax
je 0x4054db
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00404cd3
add esp, 0x14
jmp 0x4054dd
xor esi, esi
push 0x40bb50
push ebx
push ebp
call fcn.00406bb9
add esp, 0xc
test eax, eax
je 0x4054fd
push esi
push esi
push esi
push esi
push esi
call fcn.00404cd3
add esp, 0x14
push dword [edi*8 + 0x40ea6c]
push ebx
push ebp
call fcn.00406bb9
add esp, 0xc
test eax, eax
je 0x40551f
push esi
push esi
push esi
push esi
push esi
call fcn.00404cd3
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00407fa4
add esp, 0xc
jmp 0x405567
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x405567
cmp ebp, 0xffffffff
je 0x405567
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x40ea6c]
push dword [esi]
call fcn.00402900
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x406649
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40ea58]
jne 0x406653
repz ret
jmp fcn.0040904c
Function at 0x407fa4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004039c1
xor ebx, ebx
cmp dword [0x40f620], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x40807a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40815a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40c5a4
push edi
call esi
cmp eax, ebx
je 0x40815a
push eax
call fcn.00403953
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40f620], eax
call esi
push eax
call fcn.00403953
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40f624], eax
call esi
push eax
call fcn.00403953
mov dword [0x40f628], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040515a
test eax, eax
pop ecx
pop ecx
je 0x408048
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404cd3
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x40807a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00403953
cmp eax, ebx
pop ecx
mov dword [0x40f630], eax
je 0x40807a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403953
pop ecx
mov dword [0x40f62c], eax
mov eax, dword [0x40f62c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4080ff
cmp dword [0x40f630], ecx
je 0x4080ff
push eax
call fcn.004039ca
push dword [0x40f630]
mov esi, eax
call fcn.004039ca
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4080ff
cmp edi, ebx
je 0x4080ff
call esi
cmp eax, ebx
je 0x4080cc
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4080cc
test byte [ebp - 0x18], 1
jne 0x4080ff
lea eax, [ebp - 0x10]
push eax
call fcn.00405191
test eax, eax
pop ecx
je 0x4080e7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404cd3
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4080f6
or dword [ebp + 0x10], 0x200000
jmp 0x40813a
or dword [ebp + 0x10], 0x40000
jmp 0x40813a
mov eax, dword [0x40f624]
cmp eax, dword [ebp - 8]
je 0x40813a
push eax
call fcn.004039ca
cmp eax, ebx
pop ecx
je 0x40813a
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40813a
mov eax, dword [0x40f628]
cmp eax, dword [ebp - 8]
je 0x40813a
push eax
call fcn.004039ca
cmp eax, ebx
pop ecx
je 0x40813a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40f620]
call fcn.004039ca
cmp eax, ebx
pop ecx
je 0x40815a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40815c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4195c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0x811c9dc5
mov dword [ebp - 8], 0
jmp 0x4195df
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jae 0x419602
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
imul ecx, dword [ebp - 4], 0x1000193
mov dword [ebp - 4], ecx
jmp 0x4195d6
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x41e680
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f1e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x47f0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0
push 8
call fcn.00451fa9
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41e762
mov dword [ebp - 4], 0
push 1
call fcn.004511d2
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
jmp 0x41e769
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x34], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00429060
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x422640
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x42265e
mov ecx, dword [ebp - 8]
call fcn.0042c3f0
jmp 0x422671
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x422671
mov ecx, dword [ebp - 8]
call fcn.0042c250
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0xb
mov edx, dword [ebp - 8]
and ecx, dword [edx + 0x1384]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret