joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..retplne
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x276202cf
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5e2a496f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x62740e09
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3b6516da
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x403e90
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x403edc
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x403ebf
cmp edi, 2
jb 0x403ebf
cmp byte [esi], cl
jne 0x403ebf
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4b8c18]
test edi, edi
jne 0x403ea5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x403f0b
cmp cl, 0x23
jne 0x403ef2
cmp byte [esi], cl
jne 0x403ef2
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4b8c18]
test cl, cl
jne 0x403ee3
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x404070
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x404093
push 0x7d8
push str.C:UsersmilonDocumentsOtherVisualStudioProjectsm_a_ns_clickerimguiimgui.cpp
push str.filename__mode
call fcn.004867ba
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x4040a0
mov dword [edi], 0
mov edx, 0x4b5e08
mov ecx, esi
call fcn.00403f30
mov esi, eax
test esi, esi
je 0x40417f
push esi
call fcn.0047c866
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x404176
push 2
push 0
push esi
call fcn.0047d11d
add esp, 0xc
test eax, eax
jne 0x404176
push esi
call fcn.0047c866
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x404176
push 0
push dword [ebp + 8]
push esi
call fcn.0047d11d
add esp, 0xc
test eax, eax
jne 0x404176
mov eax, dword [0x4cf0c0]
test eax, eax
je 0x404115
inc dword [eax + 0xb8]
push ebx
call fcn.0048683b
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x404176
push esi
push ebx
push 1
push eax
call fcn.004816c3
add esp, 0x10
push esi
cmp eax, ebx
je 0x404160
call fcn.0047cdc2
mov eax, dword [0x4cf0c0]
add esp, 4
test eax, eax
je 0x40414e
dec dword [eax + 0xb8]
push dword [ebp + 8]
call fcn.004814c2
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.0047cdc2
add esp, 4
test edi, edi
je 0x40416e
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.0047cdc2
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4080e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx + 0x118]
test eax, eax
jg 0x40810e
push 0x752
push str.C:UsersmilonDocumentsOtherVisualStudioProjectsm_a_ns_clickerimguiimgui.h
push str.Size___0
call fcn.004867ba
mov eax, dword [ebx + 0x118]
add esp, 0xc
mov ebx, dword [ebx + 0x120]
lea edx, [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4b8c18]
sub esi, 1
jne 0x408122
mov eax, dword [0x4cf0c0]
not ebx
cmp dword [eax + 0x3f40], ebx
jne 0x40815c
push ecx
push dword [ebp + 8]
lea edx, [esi + 0xc]
mov ecx, ebx
call fcn.0042dd30
add esp, 8
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x408170
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx + 0x118]
test eax, eax
jg 0x40819e
push 0x752
push str.C:UsersmilonDocumentsOtherVisualStudioProjectsm_a_ns_clickerimguiimgui.h
push str.Size___0
call fcn.004867ba
mov eax, dword [ebx + 0x118]
add esp, 0xc
mov ebx, dword [ebx + 0x120]
lea edx, [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4b8c18]
sub esi, 1
jne 0x4081b2
mov eax, dword [0x4cf0c0]
not ebx
cmp dword [eax + 0x3f40], ebx
jne 0x4081ec
push ecx
push dword [ebp + 8]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.0042dd30
add esp, 8
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x408200
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0x118]
test edx, edx
jg 0x408231
push 0x752
push str.C:UsersmilonDocumentsOtherVisualStudioProjectsm_a_ns_clickerimguiimgui.h
push str.Size___0
call fcn.004867ba
mov edx, dword [esi + 0x118]
add esp, 0xc
mov eax, dword [ebp + 8]
mov edi, 0x10
movss xmm1, dword [esi + 0x134]
movss xmm2, dword [esi + 0x138]
movss xmm0, dword [eax]
subss xmm0, xmm1
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [esi + 0x120]
subss xmm0, xmm2
lea esi, [ebp - 0x14]
mov edx, dword [eax + edx*4 - 4]
movss dword [ebp - 8], xmm0
not edx
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4b8c18]
sub edi, 1
jne 0x408290
not edx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41e200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5be4], 0
lea esi, [edi + 0x5be8]
je 0x41e281
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x41e23c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.0042ebb0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00404e20
mov edx, dword [esi]
mov ecx, 0x4cf0bc
push dword [edi + 0x5be4]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5bf0]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call fcn.00481387
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00404e20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41e670
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [ecx]
lea edx, [ecx + 1]
push ebx
push esi
push edi
mov edi, dword [0x4cf0c0]
or ebx, 0xffffffff
mov dword [ebp - 4], edi
test al, al
je 0x41e6b7
or esi, 0xffffffff
nop
cmp al, 0x23
jne 0x41e69e
cmp byte [edx], al
jne 0x41e69e
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x4b8c18]
test al, al
jne 0x41e690
mov eax, dword [edi + 0x5b88]
xor esi, esi
not ebx
test eax, eax
jle 0x41e703
xor edi, edi
test esi, esi
js 0x41e6cf
cmp esi, eax
jl 0x41e6e6
push 0x749
push str.C:UsersmilonDocumentsOtherVisualStudioProjectsm_a_ns_clickerimguiimgui.h
push str.i___0__i___Size
call fcn.004867ba
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x5b90]
cmp dword [edi + ecx + 4], ebx
je 0x41e70c
mov eax, dword [eax + 0x5b88]
inc esi
add edi, 0x24
cmp esi, eax
jl 0x41e6c7
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x41e718
cmp esi, dword [eax + 0x5b88]
jl 0x41e738
push 0x749
push str.C:UsersmilonDocumentsOtherVisualStudioProjectsm_a_ns_clickerimguiimgui.h
push str.i___0__i___Size
call fcn.004867ba
mov edi, dword [ebp - 4]
add esp, 0xc
mov ecx, dword [edi + 0x5b90]
pop edi
lea eax, [esi + esi*8]
pop esi
lea eax, [ecx + eax*4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ead0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x4cf0c0]
sub esp, 8
push esi
mov esi, ecx
mov dword [eax + 0x5b78], 0
push edi
test esi, esi
je 0x41eb2b
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
call fcn.0041eb40
mov edx, 0x4b5e0c
mov ecx, esi
mov edi, eax
call fcn.00403f30
mov esi, eax
test esi, esi
je 0x41eb2b
push esi
push dword [esp + 0x10]
push 1
push edi
call fcn.00481387
push esi
call fcn.0047cdc2
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42acf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [ebp - 4], ebx
push dword [ebx + 0x3b8]
lea ecx, [esi + 0x5b4c]
call fcn.00404830
cmp dword [ebx + 0x3b0], 0
mov edi, eax
je 0x42ad31
push 0x45c9
push str.C:UsersmilonDocumentsOtherVisualStudioProjectsm_a_ns_clickerimguiimgui.cpp
push str.window__DockNode__0
call fcn.004867ba
add esp, 0xc
test edi, edi
je 0x42ad52
cmp dword [edi + 0x1c], 0
je 0x42ad83
push 1
mov edx, ebx
mov ecx, esi
call fcn.00423440
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x3b8]
mov ecx, esi
call fcn.00422340
mov edi, eax
mov eax, dword [edi + 0x9c]
and eax, 0xfffffe92
or eax, 0x92
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0x3ea8]
mov dword [edi + 0x84], eax
mov bl, byte [edi + 0xa0]
test bl, 1
jne 0x42ae4c
mov esi, edi
mov eax, dword [esi + 0x18]
test eax, eax
je 0x42ada6
mov esi, eax
test byte [esi + 0xa0], 1
je 0x42ad94
movss xmm0, dword [esi + 0x3c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x42adbd
movss xmm0, dword [esi + 0x40]
comiss xmm0, xmm1
ja 0x42add4
push 0x45e3
push str.C:UsersmilonDocumentsOtherVisualStudioProjectsm_a_ns_clickerimguiimgui.cpp
push str.ancestor_node__Size.x___0.0f__ancestor_node__Size.y___0.0f
call fcn.004867ba
add esp, 0xc
mov eax, dword [esi + 0x18]
mov edx, esi
test eax, eax
je 0x42ade9
nop dword [eax]
mov edx, eax
mov eax, dword [edx + 0x18]
test eax, eax
jne 0x42ade0
and byte [edx + 0xa0], 0xdf
mov ecx, dword [edx + 0x1c]
test ecx, ecx
je 0x42adfc
call fcn.00424490
mov ecx, dword [edx + 0x20]
test ecx, ecx
je 0x42ae08
call fcn.00424490
cmp dword [edx + 0x18], 0
jne 0x42ae2e
mov eax, dword [edx + 0x78]
test eax, eax
je 0x42ae2e
nop word [eax + eax]
or byte [eax + 0xa0], 0x20
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x42ae20
push dword [esi + 0x40]
mov edx, edi
mov ecx, esi
push dword [esi + 0x3c]
push dword [esi + 0x38]
push dword [esi + 0x34]
call fcn.00428a40
mov bl, byte [edi + 0xa0]
add esp, 0x10
mov esi, dword [ebp - 4]
mov ecx, edi
push 1
mov edx, esi
call fcn.00423ac0
mov al, byte [edi + 0xa0]
add esp, 4
xor al, bl
and al, 1
xor byte [edi + 0xa0], al
cmp edi, dword [esi + 0x3b0]
je 0x42ae8c
push 0x45ec
push str.C:UsersmilonDocumentsOtherVisualStudioProjectsm_a_ns_clickerimguiimgui.cpp
push str.node__window__DockNode
call fcn.004867ba
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x467160
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
push edi
mov ecx, 0x210
call fcn.00414090
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
cmp byte [eax], 0
je 0x4671ec
xor edx, edx
mov ecx, 0x210
call fcn.00416570
test al, al
je 0x4671ec
push 0xa0
call edi
shr eax, 0xf
test al, 1
jne 0x4671ec
mov esi, dword [0x4cf0c0]
test esi, esi
jne 0x4671bd
push 0x103d
push str.C:UsersmilonDocumentsOtherVisualStudioProjectsm_a_ns_clickerimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.004867ba
mov esi, dword [0x4cf0c0]
add esp, 0xc
cmp byte [esi + 0x3799], 0
je 0x4671d8
push 0
push 0x210
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.004033b0
mov dword [esi + 0x344], 0x210
mov dword [esi + 0x904], 0xa0
mov ecx, 0x214
call fcn.00414090
cmp byte [eax], 0
je 0x46726f
xor edx, edx
mov ecx, 0x214
call fcn.00416570
test al, al
je 0x46726f
push 0xa1
call edi
shr eax, 0xf
test al, 1
jne 0x46726f
mov esi, dword [0x4cf0c0]
test esi, esi
jne 0x467240
push 0x103d
push str.C:UsersmilonDocumentsOtherVisualStudioProjectsm_a_ns_clickerimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.004867ba
mov esi, dword [0x4cf0c0]
add esp, 0xc
cmp byte [esi + 0x3799], 0
je 0x46725b
push 0
push 0x214
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.004033b0
mov dword [esi + 0x348], 0x214
mov dword [esi + 0x914], 0xa1
mov ecx, 0x212
call fcn.00414090
cmp byte [eax], 0
je 0x4672ef
xor edx, edx
mov ecx, 0x212
call fcn.00416570
test al, al
je 0x4672ef
push 0x5b
call edi
shr eax, 0xf
test al, 1
jne 0x4672ef
mov esi, dword [0x4cf0c0]
test esi, esi
jne 0x4672c0
push 0x103d
push str.C:UsersmilonDocumentsOtherVisualStudioProjectsm_a_ns_clickerimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.004867ba
mov esi, dword [0x4cf0c0]
add esp, 0xc
cmp byte [esi + 0x3799], 0
je 0x4672db
push 0
push 0x212
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.004033b0
mov dword [esi + 0x230], 0x212
mov dword [esi + 0x90c], 0x5b
mov ecx, 0x216
call fcn.00414090
cmp byte [eax], 0
je 0x46736f
xor edx, edx
mov ecx, 0x216
call fcn.00416570
test al, al
je 0x46736f
push 0x5c
call edi
shr eax, 0xf
test al, 1
jne 0x46736f
mov esi, dword [0x4cf0c0]
test esi, esi
jne 0x467340
push 0x103d
push str.C:UsersmilonDocumentsOtherVisualStudioProjectsm_a_ns_clickerimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.004867ba
mov esi, dword [0x4cf0c0]
add esp, 0xc
cmp byte [esi + 0x3799], 0
je 0x46735b
push 0
push 0x216
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.004033b0
mov dword [esi + 0x234], 0x216
mov dword [esi + 0x91c], 0x5c
pop edi
pop esi
pop ecx
ret
Function at 0x46a9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 0x50]
mov dword [esp + 4], esi
push 0xb
push str.New_Clicker
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], 0
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.0046c370
mov ecx, dword [ebp + 0x14]
xorps xmm0, xmm0
mov dword [esi + 0x68], 0x41400000
mov dword [esi + 0x6c], 0x41900000
mov dword [esi + 0x70], 0x41700000
mov dword [esi + 0x74], 0x41700000
mov dword [esi + 0x78], 0x41700000
mov dword [esi + 0x7c], 0x3fc00000
mov dword [esi + 0x80], 0x3fc00000
mov dword [esi + 0x84], 0x10001
mov byte [esi + 0x88], 0
mov dword [esi + 0x8c], 1
mov byte [esi + 0x90], 1
mov dword [esi + 0x94], 0x64
mov byte [esi + 0x98], 0
mov dword [esi + 0x9c], 0x3f4ccccd
mov dword [esi + 0xa0], 0x40133333
mov dword [esi + 0xa4], 0x3f800000
mov dword [esi + 0xa8], 0x3f800000
mov dword [esi + 0xac], 0
mov byte [esi + 0xb0], 0
mov dword [esi + 0xb4], 0x42700000
mov dword [esi + 0xb8], 0x3e6147ae
mov word [esi + 0xbc], 1
mov byte [esi + 0xbe], 1
mov dword [esi + 0xc0], 0
mov byte [esi + 0xc4], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xcc], 0
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x18], 0
movups xmmword [esi + 0x1c], xmm0
movq qword [esi + 0x2c], xmm0
mov dword [esi + 0x34], 0
test ecx, ecx
jne 0x46ab67
mov eax, dword [ebp + 0x18]
test eax, eax
jle 0x46ab4c
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x2c], eax
jmp 0x46ab8b
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x24], eax
movzx eax, cx
mov dword [esi], 1
mov dword [esi + 0x1c], 1
mov word [esi + 4], ax
mov word [esi + 0x20], ax
mov eax, dword [ebp + 8]
mov dword [esi + 0x44], eax
call fcn.00478199
push 0
push 0x2710
push edx
push eax
call fcn.0049d120
mov dword [esi + 0x48], eax
mov eax, esi
mov dword [esi + 0x4c], edx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x46eac0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push ecx
mov dword [esp], 0x4f800000
call fcn.00487621
fdivr dword [0x4c3a90]
push ecx
fstp qword [esp]
call fcn.0049c3a0
movss xmm1, dword [0x4c39bc]
mov eax, 1
fstp dword [ebp - 4]
fld dword [ebp - 4]
add esp, 8
fstp dword [ebp - 4]
cvttss2si edi, dword [ebp - 4]
xorps xmm3, xmm3
xorps xmm2, xmm2
cmp edi, eax
cmovl edi, eax
test edi, edi
jle 0x46ecd5
mov edx, dword [0x4cf0d8]
movss xmm4, dword [0x4c3af8]
push esi
cmp edx, 0x270
jne 0x46eb75
mov edx, 0x4cf0e0
mov esi, 0x270
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x46eb33
mov edx, dword [0x4cf0d8]
jmp 0x46ec69
cmp edx, 0x4e0
jb 0x46ec69
xor edx, edx
nop dword [eax]
nop word [eax + eax]
mov ecx, dword [edx*4 + 0x4cfa9c]
xor ecx, dword [edx*4 + 0x4cfaa0]
and ecx, 0x7fffffff
xor ecx, dword [edx*4 + 0x4cfa9c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx*4 + 0x4d00d0]
xor eax, ecx
mov dword [edx*4 + 0x4cf0dc], eax
inc edx
cmp edx, 0xe3
jb 0x46eb90
cmp edx, 0x26f
jae 0x46ec26
nop
mov ecx, dword [edx*4 + 0x4cfaa0]
xor ecx, dword [edx*4 + 0x4cfa9c]
and ecx, 0x7fffffff
xor ecx, dword [edx*4 + 0x4cfa9c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx*4 + 0x4ced50]
xor eax, ecx
mov dword [edx*4 + 0x4cf0dc], eax
inc edx
cmp edx, 0x26f
jb 0x46ebe0
mov ecx, dword [edx*4 + 0x4cfa9c]
xor ecx, dword [0x4cf0dc]
and ecx, 0x7fffffff
xor ecx, dword [edx*4 + 0x4cfa9c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, ecx
xor eax, dword [0x4cf70c]
mov dword [edx*4 + 0x4cf0dc], eax
xor edx, edx
mov dword [0x4cf0d8], edx
mov ecx, dword [edx*4 + 0x4cf0dc]
mov eax, ecx
shr eax, 0xb
inc edx
and eax, dword [0x4d045c]
xor ecx, eax
mov dword [0x4cf0d8], edx
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4c42d0]
cvtpd2ps xmm0, xmm0
subss xmm0, xmm3
mulss xmm0, xmm1
mulss xmm1, xmm4
addss xmm2, xmm0
sub edi, 1
jne 0x46eb21
pop esi
divss xmm2, xmm1
pop edi
movaps xmm0, xmm2
mov esp, ebp
pop ebp
ret
Function at 0x473100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x4731e6
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4731d5
jg 0x473140
test edx, edx
je 0x4731d5
nop dword [eax]
call fcn.0046d350
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x473194
jg 0x473157
test esi, esi
je 0x473194
cmp ebx, eax
jg 0x473167
jl 0x473161
cmp edi, esi
jae 0x473167
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00479920
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4731b9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x4731cf
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x473140
jl 0x4731cf
test edi, edi
jne 0x473140
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x473208
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x47320a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x473288
jg 0x47321d
test esi, esi
je 0x473288
test eax, eax
jl 0x47326c
jg 0x473227
test ebx, ebx
je 0x47326c
cmp edi, eax
jg 0x473237
jl 0x473231
cmp esi, ebx
jae 0x473237
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00479920
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x473288
jg 0x47326f
test esi, esi
je 0x473288
jmp 0x47326f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x473288
push eax
push esi
push 1
push edx
call fcn.00481387
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc