joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10abee8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10abef2
pushal
call 0x10abef8
pop ebp
sub ebp, 0x10
sub ebp, 0xcabee8
jmp 0x10abf0e
mov eax, 0xcabee8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bf
mov edx, 0xe44d0fed
xor byte [eax], dl
inc eax
dec ecx
jne 0x10abf25
jmp 0x10abf38
and byte [esi + 0x64], ah
shr ebp, 1
in eax, dx
in eax, dx
insb byte es:[edi], dx
sub al, 0x15
in eax, dx
in eax, dx
in eax, dx
out dx, al
and byte [ebp - 0x16], dl
in eax, dx
in eax, dx
in eax, dx
push edi
vpaddsw ymm5, ymm2, ymm5
sbb cl, byte [edi]
out dx, al
and eax, 0xede16c66
in eax, dx
in eax, dx
out dx, al
sub byte [ebp - 0x78ea7a43], bh
jecxz 0x10abf52
test dword [0xeced51be], ebx
in eax, dx
in al, dx
ror ecx, 0x85
jo 0x10abf5b
jle 0x10abfb2
add eax, 0xededede8
add al, 0xc5
in eax, dx
in eax, dx
in eax, dx
mov eax, 0x68660166
in eax, 0xed
in eax, dx
in eax, dx
js 0x10abf69
in eax, dx
in eax, dx
in eax, dx
pushaw
std
in eax, dx
in eax, dx
in eax, dx
sub al, 4
out dx, eax
fsub st(7), st(0)
outsb dx, byte [esi]
das
jmp 0x1a73a241
mov esi, 0xc1eced51
leave
mov esp, 0xedede805
in eax, dx
add al, 0xac
out dx, eax
in eax, dx
in eax, dx
mov eax, 0xedc98160
adc bl, byte [eax - 0x1a67ed1f]
add eax, 0xededed9f
push ax
in eax, 0xed
in eax, dx
in eax, dx
fisub word [esp + ebp*2]
pop ds
int1
out dx, eax
test al, 0x17
insb byte es:[edi], dx
pop ds
int1
out dx, eax
test al, 0x17
fidivr word [edi]
outsb dx, byte [esi]
add eax, 0x69e2a5e8
mov dword [0xe2ededed], eax
movsd dword es:[edi], dword gs:[esi]
in eax, dx
in eax, dx
in eax, dx
mov esp, dword [esi - 0xf]
aam 0x6d
push ss
add eax, 0xedf769e2
in eax, dx
in eax, dx
insd dword es:[edi], dx
push ss
add al, 0xe2
imul edi, esp, 0x8bededed
insb byte es:[edi], dx
push ss
adc cl, al
loop 0x10ac07f
clc
in eax, dx
in eax, dx
in eax, dx
lodsb al, byte [esi]
add al, 0x21
adc dl, byte [edx]
adc al, ah
mov eax, dword [0x2c6eecd4]
call 0x5f3c599
push eax
adc dl, byte [edx]
adc al, ah
mov ecx, 0x2c6eefd4
jmp 0x10ac0a5
push 0xededede8
sti
stosd dword es:[edi], eax
invalid
aas
loop 0x10ac110
call 0x68f8ae9a
sti
stosd dword es:[edi], eax
invalid
push 0xededede8
sti
stosd dword es:[edi], eax
invalid

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x35ba02ad
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x1864513d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0xa7e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a7e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa7e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa7e06a
add dl, dl
jne 0xa7e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa7e0dc
xor eax, eax
add dl, dl
jne 0xa7e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa7e17d
add dl, dl
jne 0xa7e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa7e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa7e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa7e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa7e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa7e075
mov eax, 1
add dl, dl
jne 0xa7e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa7e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa7e0e1
sub eax, ebx
mov ebx, 1
jne 0xa7e128
mov ecx, 1
add dl, dl
jne 0xa7e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa7e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa7e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa7e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa7e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa7e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa7e136
cmp eax, 0x7d00
jae 0xa7e16d
cmp eax, 0x500
jb 0xa7e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa7e075
cmp eax, 0x7f
ja 0xa7e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa7e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa7e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa7e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x7a4e58
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7a4e62
pushal
call 0x7a4e68
pop ebp
sub ebp, 0x10
sub ebp, 0x3a4e58
jmp 0x7a4e7e
mov eax, 0x3a4e58
add eax, ebp
add eax, 0x4c
mov ecx, 0x611
mov edx, 0xebcaf266
xor byte [eax], dl
inc eax
dec ecx
jne 0x7a4e95
jmp 0x7a4ea8
in eax, dx
stosd dword es:[edi], eax
in eax, dx
out dx, eax
pop edx
out 0xa7, ax
sahf
stosw word es:[edi], ax
fisub word [ebx + 0x66]
fmul qword [esi + 0x66]
xchg cx, ax
test byte [ebp - 0x52], ah
in eax, dx
out 0x6a, eax
mov word gs:[0x4202eb36], ax
lcall 0x1cea, 0xe4262ef
push 0xb5aa0e66
dec ebp
dec dx
inc edx
push cs
cmp esi, dword [ecx + ebx*2 + 0x66638e8d]
invalid
Function at 0x1046e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1046e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1046e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1046e06a
add dl, dl
jne 0x1046e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1046e0dc
xor eax, eax
add dl, dl
jne 0x1046e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1046e17d
add dl, dl
jne 0x1046e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1046e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1046e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1046e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1046e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1046e075
mov eax, 1
add dl, dl
jne 0x1046e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1046e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1046e0e1
sub eax, ebx
mov ebx, 1
jne 0x1046e128
mov ecx, 1
add dl, dl
jne 0x1046e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1046e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1046e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1046e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1046e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1046e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1046e136
cmp eax, 0x7d00
jae 0x1046e16d
cmp eax, 0x500
jb 0x1046e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1046e075
cmp eax, 0x7f
ja 0x1046e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1046e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1046e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1046e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xa04058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a041a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa0407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa0406a
add dl, dl
jne 0xa04089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa040dc
xor eax, eax
add dl, dl
jne 0xa04096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa0417d
add dl, dl
jne 0xa040a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa040b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa040bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa040c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa040d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa04075
mov eax, 1
add dl, dl
jne 0xa040ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa040f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa040e1
sub eax, ebx
mov ebx, 1
jne 0xa04128
mov ecx, 1
add dl, dl
jne 0xa0410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa04119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa04105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa04075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa0413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa0414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa04136
cmp eax, 0x7d00
jae 0xa0416d
cmp eax, 0x500
jb 0xa04168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa04075
cmp eax, 0x7f
ja 0xa04170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa04075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa0419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa04075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x103b1d24
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103b1d2e
pushal
call 0x103b1d34
pop ebp
sub ebp, 0x10
sub ebp, 0x3b1d24
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103b1d58
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103b1d61
mov eax, 0x3b1d24
add eax, ebp
add eax, 0x63
mov ecx, 0x5fb
mov edx, 0x9dd5d6fb
xor byte [eax], dl
inc eax
dec ecx
jne 0x103b1d78
jmp 0x103b1d8b
jo 0x103b1dc3
jo 0x103b1e01
invalid
cli
xlatb
fist word [ebx + 0x76ec83d0]
adc edi, esi
sti
sti
sti
adc dl, ch
sti
sti
sti
scasb al, byte es:[edi]
scasd eax, dword es:[edi]
cmpsb byte [esi], byte es:[edi]
jo 0x103b1e58
sti
sti
sti
jo 0x103b1e4e
idiv ebx
sti
sti
jo 0x103b1e5c
jmp 0x103b1de3
idiv ebx
jo 0x103b1e7c
invalid
cli
xlatb
fbstp tbyte [esi - 0x61]
fild word [edi]
jb 0x103b1e14
fist word [ebx]
invalid
dec ecx
push cs
inc edi
jns 0x103b1e19
sub dword [eax + 0x13], edi
invalid
mov ch, 0xfb
sti
sti
hlt
sti
sti
sti
popfd
jo 0x103b1e4c
ret 0x7b
sti
jnp 0x103b1e71
adc dh, ah
jg 0x103b1e5f
sti
sti
sti
popfd
jp 0x103b1e7b
add al, 0xde
hlt
fdivrp st(4)
jg 0x103b1e6e
sti
sti
sti
mov edx, 0x4043712
add al, 0xd2
mov bh, 0xc2
cli
js 0x103b1ec9
invalid
cli
sti
sti
sti
inc eax
stc
sti
sti
sti
stc
sub esp, esi
jle 0x103b1ed5
sti
sti
sti
jno 0x103b1ec9
mov ebp, 0x78f429e9
and eax, dword [esp + eax]
add al, 0xf9
sub esp, esi
jle 0x103b1ee8
sti
sti
sti
jno 0x103b1edc
mov ebp, 0x78f429e9
xchg ecx, eax
sti
sti
sti
enter 0xfffffffffffff93b, 0x29
hlt
Function at 0x92b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0092b1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x92b07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92b06a
add dl, dl
jne 0x92b089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92b0dc
xor eax, eax
add dl, dl
jne 0x92b096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92b17d
add dl, dl
jne 0x92b0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92b0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92b0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92b0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x92b0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x92b075
mov eax, 1
add dl, dl
jne 0x92b0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92b0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x92b0e1
sub eax, ebx
mov ebx, 1
jne 0x92b128
mov ecx, 1
add dl, dl
jne 0x92b10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x92b119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x92b105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x92b075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x92b13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x92b14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x92b136
cmp eax, 0x7d00
jae 0x92b16d
cmp eax, 0x500
jb 0x92b168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x92b075
cmp eax, 0x7f
ja 0x92b170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x92b075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x92b19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x92b075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10004377
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10004386
pop dword [ebp - 0x44]
mov eax, 0xeec2e89c
sub eax, 0xdec2a516
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xe78efb31
add dword [ebp - 0x54], 0x66c34a1a
mov dword [ebp - 0x50], 0xee7298fd
add dword [ebp - 0x50], 0x43c0b348
mov dword [ebp - 0x4c], 0xa789b165
add dword [ebp - 0x4c], 0xa4c292c9
mov dword [ebp - 0x48], 0xc29496d0
sub dword [ebp - 0x48], 0xc29496d0
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x247ab66
add dword [ebp - 0x54], 0x722abdf0
mov dword [ebp - 0x50], 0x3ad45b38
add dword [ebp - 0x50], 0x698063d
mov dword [ebp - 0x4c], 0x77754087
add dword [ebp - 0x4c], 0xebfa2be5
mov dword [ebp - 0x48], 0x8ba001be
add dword [ebp - 0x48], 0x745ffe42
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xd40cca2
sub eax, 0xfd407c26
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x33400
push 0
call eax
mov ecx, 0x4fc1a240
add ecx, 0xb03e988e
mov esi, eax
mov edi, 0x1000a800
add edi, dword [ebp - 0x44]
mov edx, 0x62212be4
sub edx, 0xc6be9ab9
add dword [ebp - 0x1c], edx
mov ebx, dword [edi]
add dword [ebp - 0x40], eax
add ebx, edx
xor dword [ebp - 0x18], 0xd7b3e4ff
mov dword [esi], ebx
sub dword [ebp - 8], 0x349c4001
add esi, 0x2d5abfd5
add esi, 0xd2a5402f
add edi, 0x4ece6ed8
sub edi, 0x4ece6ed4
loop 0x1000449d
add eax, 0xf1f3aac1
add eax, 0xe0d334a
xor ebx, ebx
add ebx, eax
add eax, 0xcb42062d
add eax, 0x34bdf9d8
mov ecx, 0x9d6e1c5a
sub ecx, 0x8d6e1c5a
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40ee30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x5e1470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x5e146c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5e1470], edx
cmp eax, 0x26f
jl 0x40ee38
mov dword [0x56c020], 0x270
ret

Function at 0x40ee70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x5e1474]
mov ebx, dword [eax*4 + 0x5e1470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5e1aa4]
mov dword [eax*4 + 0x5e1470], edx
cmp eax, 0xe2
jl 0x40ee78
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5e1474]
mov ebx, dword [eax*4 + 0x5e1470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5e10e4]
mov dword [eax*4 + 0x5e1470], edx
cmp eax, 0x26e
jl 0x40eec8
mov edx, dword [0x5e1470]
mov ecx, dword [0x5e1e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x5e1aa0]
mov dword [0x5e1e2c], eax
mov dword [0x56c020], 0
pop ebx
ret

Function at 0x40ef50
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x56c020]
add dword [0x56c020], 1
mov eax, dword [0x5e0020]
cmp eax, dword [0x56b770]
jne 0x40ef73
cmp ebx, 0x271
jb 0x40ef94
mov eax, dword [0x5e0020]
call fcn.0040ee30
not dword [0x5e0020]
mov eax, dword [0x5e0020]
mov dword [0x56b770], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40efb0
call fcn.0040ee70
xor ebx, ebx
mov dword [0x56c020], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x5e1470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x410b00
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x56b4c0]
cmp ax, 0xcb
je 0x410c0c
cmp ax, 0xcc
je 0x410c0c
lea esi, [esi]
mov edx, dword [0x5e2070]
test edx, edx
je 0x410b35
mov eax, dword [0x5e1f20]
call edx
mov ebx, eax
jmp 0x410b3a
mov ebx, 0x5e1f24
cmp word [0x5e1f10], 0
jle 0x410b60
mov eax, 0x5e1ef0
call fcn.00410dc0
mov eax, ebx
call fcn.004106c0
mov eax, ebx
call fcn.00410730
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x410b82
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x410b7d
mov edx, edi
mov eax, ebx
call fcn.0040fb30
jmp 0x410b80
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x410b68
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5e1f10], 0
jle 0x410c0c
mov edx, 0x5e1e30
mov eax, ebx
call fcn.0040fc70
mov edi, eax
test edi, edi
je 0x410bdc
mov eax, dword [0x5e1ec4]
mov dword [edi + 0xc], eax
cmp dword [0x5e1ec4], 0
je 0x410bd0
mov eax, dword [0x5e1ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5e1ec4], eax
nop
sub word [0x5e1f10], 1
cmp word [0x5e1f10], 0
sete bl
mov eax, 0x5e1ef0
call fcn.00410de0
test bl, bl
je 0x410c0c
mov eax, 0x5e1ef0
call fcn.00410db0
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x412cd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00412cb0
push ebp
push 0x414060
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x412dfa
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b700
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x412d5f
mov edx, 0x5e12f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x412db1
call sub.kernel32.dll_GetLastError
call fcn.00404160
lea eax, [ebp - 0x10]
call fcn.0040a2e0
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a780
mov edx, dword [ebp - 0x14]
mov ecx, 0x588324
lea eax, [ebp - 0x10]
call fcn.0040a610
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040afd0
jmp 0x412e48
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x412dca
cmp eax, ecx
je 0x412dd4
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040b700
cmp byte [0x56b740], 0
jne 0x412e48
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bca0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b060
lea esi, [esi]
jmp 0x412e48
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b700
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x412e1e
mov eax, 0x5e12f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x56b740], 0
jne 0x412e48
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bca0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b060
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00412cb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4131e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5e1260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.004133c0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5e1260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.004036d0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x56b540], eax
mov ebx, eax
jmp 0x413383
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x413268
cmp byte [ebx], 0
je 0x41338c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x4132e3
mov al, byte [ebx]
cmp al, 1
jb 0x4132d8
sub al, 0x20
jbe 0x4132a8
sub al, 2
je 0x4132bc
jmp 0x4132d8
mov al, byte [ebp - 0x114]
test al, al
je 0x4132e8
add dword [ebp - 0x110], 1
jmp 0x4132e0
cmp byte [ebx + 1], 0x22
je 0x4132d3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x4132e0
add ebx, 1
jmp 0x4132e0
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413298
test dword [ebp - 0x10c], 0xffffffff
je 0x41337c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.004133c0
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5e1260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413373
mov al, byte [ebx]
cmp al, 1
jb 0x413368
sub al, 0x20
jbe 0x413338
sub al, 2
je 0x41334c
jmp 0x413368
mov al, byte [ebp - 0x114]
test al, al
je 0x413378
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413370
cmp byte [ebx + 1], 0x22
je 0x413363
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413370
add ebx, 1
jmp 0x413370
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413328
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x41326b
mov ebx, dword [ebp - 0x10c]
mov dword [0x5e1250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5e1260
call fcn.00410940
mov eax, dword [0x5e1260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret