joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4133bc
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
sub esp, 0x38
mov dword [esp], 0x3003
mov dword [esp + 4], 0x419e1c
mov ecx, dword [0x7de4c8]
mov dword [esp + 0x10], ecx
xor edx, edx
mov dword [esp + 0x20], edx
mov eax, dword [0x594784]
mov dword [esp + 0x24], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], edx
push 0x2711
push ecx
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
push 4
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x1c], eax
lea eax, [esp]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x41342f
mov eax, 1
add esp, 0x38
pop ebp
ret
lea eax, [esp + 0x28]
push eax
push dword [0x7dea84]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x30]
sub edx, dword [esp + 0x28]
movsx eax, dx
mov ecx, dword [esp + 0x34]
sub ecx, dword [esp + 0x2c]
movsx ebp, cx
mov edx, dword [0x594784]
xor ecx, ecx
push ecx
push dword [0x7de4c8]
push ecx
push dword [0x7dea84]
push ebp
push eax
push ecx
push ecx
push 0x56000000
push edx
push edx
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x7dea80], eax
test eax, eax
je 0x413425
xor eax, eax
add esp, 0x38
pop ebp
ret

Function at 0x418ed0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x5946d8]
cmp eax, 0x270
jl 0x418f9e
xor edx, edx
mov eax, dword [edx*4 + 0x5c3040]
and eax, 0x80000000
mov ecx, dword [edx*4 + 0x5c3044]
and ecx, 0x7fffffff
or eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
xor ecx, dword [edx*4 + 0x5c3674]
xor ecx, dword [eax*4 + 0x56d5e0]
mov dword [edx*4 + 0x5c3040], ecx
inc edx
cmp edx, 0xe3
jl 0x418ee2
cmp edx, 0x26f
jge 0x418f6a
mov eax, dword [edx*4 + 0x5c3040]
and eax, 0x80000000
mov ecx, dword [edx*4 + 0x5c3044]
and ecx, 0x7fffffff
or eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
xor ecx, dword [edx*4 + 0x5c2cb4]
xor ecx, dword [eax*4 + 0x56d5e0]
mov dword [edx*4 + 0x5c3040], ecx
inc edx
cmp edx, 0x26f
jl 0x418f2a
mov edx, dword [0x5c39fc]
and edx, 0x80000000
mov eax, dword [0x5c3040]
and eax, 0x7fffffff
or edx, eax
mov ecx, edx
shr ecx, 1
xor ecx, dword [0x5c3670]
and edx, 1
xor ecx, dword [edx*4 + 0x56d5e0]
mov dword [0x5c39fc], ecx
xor eax, eax
lea edx, [eax + 1]
mov dword [0x5946d8], edx
mov eax, dword [eax*4 + 0x5c3040]
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
ret
Function at 0x419ca4
Capabilities:
Get file version info

Disassembly:
push edi
push ebp
push ebx
sub esp, 0xc
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x419d45
test edi, edi
je 0x419d45
lea ecx, [esp + 8]
push ecx
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
jbe 0x419d39
mov dword [esp + 4], eax
push eax
call fcn.0045fea0
pop ecx
mov ebx, eax
test ebx, ebx
je 0x419d51
push ebx
push dword [esp + 8]
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x419d32
mov dword [esp], 0
lea ebp, [esp]
lea ecx, [esp + 4]
push ecx
push ebp
push 0x7e42bc
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x419d32
mov ecx, dword [esp]
test ecx, ecx
je 0x419d32
mov ecx, dword [ecx + 8]
mov dword [edi + 4], ecx
mov ebp, dword [esp]
mov ecx, dword [ebp + 0xc]
mov dword [edi], ecx
push ebx
call fcn.0045feae
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
pop edi
ret
push ebx
call fcn.0045feae
pop ecx
mov eax, 0x80004005
add esp, 0xc
pop ebx
pop ebp
pop edi
ret
mov eax, 0x80070057
add esp, 0xc
pop ebx
pop ebp
pop edi
ret
mov eax, 0x8007000e
add esp, 0xc
pop ebx
pop ebp
pop edi
ret
Function at 0x4339e1
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x18
mov dword [esp + 0x14], ecx
mov ebx, edx
mov edx, eax
test ebx, ebx
je 0x433b6d
mov eax, ebx
call fcn.00457eb0
mov dword [esp + 0x10], eax
mov ecx, eax
test ecx, ecx
je 0x433b46
movsx ecx, byte [ebx]
test ecx, ecx
je 0x433b66
xor ebp, ebp
mov ecx, ebx
movsx edx, byte [ecx]
cmp edx, 0x2f
je 0x433a36
movzx edx, dl
movzx ecx, byte [edx + 0x5940a0]
inc ecx
movsx esi, cl
add ebp, esi
jmp 0x433a3b
lea ebx, [ecx + 1]
xor ebp, ebp
lea ecx, [ebp + ebx]
movsx edx, byte [ecx]
test edx, edx
jne 0x433a1f
push 0x38
call fcn.004032d4
pop ecx
mov esi, eax
test esi, esi
je 0x433b50
lea ecx, [ebp + 1]
push ecx
call fcn.0045ec4c
pop ecx
mov dword [esi + 0x14], eax
test eax, eax
je 0x433b37
push ebp
push ebx
push eax
call dword [0x5b148c]
add esp, 0xc
mov ecx, dword [esi + 0x14]
xor edx, edx
mov byte [ecx + ebp], dl
mov ecx, ebp
xor edx, ebp
cmp ebp, 4
jl 0x433ab0
imul eax, dword [ebx], 0x5bd1e995
mov edi, eax
shr edi, 0x18
xor eax, edi
imul edi, eax, 0x5bd1e995
imul edx, edx, 0x5bd1e995
xor edx, edi
add ebx, 4
add ecx, 0xfffffffc
cmp ecx, 4
jge 0x433a8a
cmp ecx, 3
je 0x433ac1
cmp ecx, 2
je 0x433aca
cmp ecx, 1
je 0x433ad3
jmp 0x433ade
movzx ecx, byte [ebx + 2]
shl ecx, 0x10
xor edx, ecx
movzx ecx, byte [ebx + 1]
shl ecx, 8
xor edx, ecx
movzx ecx, byte [ebx]
xor edx, ecx
imul edx, edx, 0x5bd1e995
mov ebx, edx
shr ebx, 0xd
xor edx, ebx
imul edx, edx, 0x5bd1e995
mov edi, edx
shr edi, 0xf
xor edx, edi
and edx, 0x7fffffff
mov ecx, dword [esp + 0x14]
mov ebx, ecx
shl ebx, 0x1f
add ebx, edx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ebp
mov byte [esi + 0x30], cl
mov ebp, dword [esp + 0x34]
mov dword [esi + 0x28], ebp
mov edx, dword [esp + 0x38]
mov dword [esi + 0x2c], edx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x10]
mov edx, esi
call fcn.00457f48
mov eax, esi
add esp, 0x18
pop ebx
pop ebp
pop esi
pop edi
ret
push 1
push 0x186aa
call fcn.0045c674
add esp, 8
xor eax, eax
add esp, 0x18
pop ebx
pop ebp
pop esi
pop edi
ret
push 1
push 0x186aa
call fcn.0045c674
xor eax, eax
add esp, 0x20
pop ebx
pop ebp
pop esi
pop edi
ret
xor ebp, ebp
jmp 0x433a46
push 1
push 0xdbbb4
call fcn.0045c674
xor eax, eax
add esp, 0x20
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x4399b8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push ebx
push esi
mov ecx, edx
mov edx, eax
mov esi, ecx
shr esi, 2
and ecx, 3
test esi, esi
je 0x439a3f
je 0x439a6e
mov eax, 0xffffffff
xor ebx, ebx
mov dword [esp], edi
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5941a0]
movzx edi, byte [edx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5941a0]
movzx edi, byte [edx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5941a0]
movzx edi, byte [edx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5941a0]
add edx, 4
inc ebx
cmp ebx, esi
jb 0x4399db
mov edi, dword [esp]
jmp 0x439a44
mov eax, 0xffffffff
test ecx, ecx
je 0x439a68
je 0x439a68
xor ebx, ebx
inc edx
movzx esi, byte [edx - 1]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5941a0]
inc ebx
cmp ebx, ecx
jb 0x439a4c
not eax
pop ecx
pop ebx
pop esi
ret
mov eax, 0xffffffff
jmp 0x439a44
Function at 0x43b7b0
Capabilities:
Create directory

Disassembly:
sub esp, 0x110
mov edx, eax
movsx ecx, byte [edx]
test ecx, ecx
je 0x43b7f6
xor ecx, ecx
movsx eax, byte [edx]
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x108], esi
mov esi, edx
mov ebx, ecx
cmp eax, 0x5c
je 0x43b7ff
mov byte [esp + ebx], al
movsx eax, byte [ebx + esi + 1]
inc ebx
test eax, eax
jne 0x43b7d6
mov ebx, dword [esp + 0x10c]
mov esi, dword [esp + 0x108]
xor eax, eax
add esp, 0x110
ret
push ebx
push esi
call fcn.00460c31
add esp, 8
test eax, eax
je 0x43b813
movsx eax, byte [ebx + esi]
jmp 0x43b7db
xor eax, eax
mov byte [esp + ebx], al
lea edx, [esp]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movsx eax, byte [ebx + esi]
jmp 0x43b7db

Function at 0x43c860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
sub esp, 8
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
xor edx, edx
mov dword [esp], edx
mov dword [esp + 4], 1
mov byte [ebx], dl
lea eax, [esp]
push eax
push 0xf003f
push edx
push dword [esp + 0x24]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43c8a3
mov eax, 0xffffffff
add esp, 8
pop ebx
pop ebp
ret
lea edx, [esp + 4]
lea eax, [esp + 0x24]
push eax
push ebx
push edx
push 0
push ebp
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x43c8ca
mov eax, 0xffffffff
add esp, 8
pop ebx
pop ebp
ret
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
pop ebx
pop ebp
ret
Function at 0x446e58
Capabilities:
Create directory

Disassembly:
push edi
push esi
sub esp, 0x108
mov ecx, eax
lea esi, [esp]
mov edi, 0x65d8a0
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x446e6a
lea edi, [esp]
mov edx, ecx
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x446e83
lea eax, [esp]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0x108
pop esi
pop edi
ret
Function at 0x44a6d8
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 8
mov dword [esp], eax
xor ecx, ecx
xor ecx, edx
cmp edx, 4
jl 0x44a711
imul ebp, dword [eax], 0x5bd1e995
mov ebx, ebp
shr ebx, 0x18
xor ebp, ebx
imul esi, ebp, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 4
jge 0x44a6eb
cmp edx, 3
je 0x44a722
cmp edx, 2
je 0x44a72b
cmp edx, 1
je 0x44a734
jmp 0x44a73f
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov edx, ecx
shr edx, 0xd
xor ecx, edx
imul edx, ecx, 0x5bd1e995
mov eax, edx
shr eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x18
mov eax, dword [ecx*4 + 0x7874e0]
mov ecx, dword [0x7de8ec]
mov dword [esp + 4], ecx
cmp eax, ecx
jge 0x44a7b6
mov ecx, dword [0x7de8f0]
mov ebx, eax
mov ebp, edx
mov esi, dword [ecx + ebx*4]
cmp ebp, dword [esi + 4]
jne 0x44a7ad
mov edi, dword [esi]
mov esi, dword [esp]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x44a7a4
or dl, dl
je 0x44a7a0
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x44a7a4
add edi, 2
add esi, 2
or dl, dl
jne 0x44a784
xor eax, eax
jmp 0x44a7a9
sbb eax, eax
or eax, 1
test eax, eax
je 0x44a7c3
inc ebx
mov esi, dword [esp + 4]
cmp ebx, esi
jl 0x44a777
mov eax, 0xffffffff
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, ebx
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x45109c
Capabilities:
Encode data using xor

Disassembly:
push ebp
sub esp, 0x3c
mov ebp, eax
call fcn.004511e8
mov byte [esp + 0xc], 1
lea eax, [esp + 0x10]
mov edx, ebp
mov ecx, 1
call fcn.00438f65
test eax, eax
jne 0x4511cf
mov edx, dword [esp + 0x14]
mov dword [0x7dec88], edx
mov eax, dword [edx + 8]
mov dword [0x7dec74], eax
mov ebp, dword [edx + 0xc]
mov dword [0x7dec78], ebp
mov ecx, dword [edx + 0x10]
mov dword [0x7dec7c], ecx
mov ecx, dword [edx + 0x14]
mov dword [0x7dec80], ecx
mov ecx, dword [edx + 0x18]
mov dword [0x7dec84], ecx
lea ecx, [edx + 0x20]
mov dword [0x7dec8c], ecx
lea ecx, [eax + eax]
add ecx, ecx
lea ebp, [edx + ecx + 0x20]
mov dword [0x7dec90], ebp
lea ecx, [eax + eax]
add ecx, ecx
add ecx, ecx
lea edx, [edx + ecx + 0x20]
mov dword [0x7dec94], edx
test eax, eax
jle 0x4511c8
xor eax, eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], edi
jmp 0x45113d
mov ebp, dword [0x7dec90]
lea ecx, [eax + eax]
mov edi, dword [ebp + eax*4]
test edi, edi
jle 0x451178
xor ebp, ebp
mov esi, dword [0x7dec88]
mov edi, dword [0x7dec8c]
add esi, dword [edi + ecx*2]
mov edx, ebp
and edx, 0xf
add edx, 0x10
xor byte [esi + ebp], dl
mov edx, dword [0x7dec90]
mov edi, dword [edx + ecx*2]
inc ebp
cmp ebp, edi
jl 0x45114a
mov edx, dword [0x7dec94]
cmp dword [edx + ecx*2], 0
jle 0x4511b3
xor ebp, ebp
jmp 0x45118b
mov edx, dword [0x7dec90]
mov edi, dword [edx + ecx*2]
mov esi, dword [0x7dec88]
mov edx, dword [0x7dec8c]
add esi, dword [edx + ecx*2]
add esi, edi
mov edx, ebp
and edx, 0xf
add edx, 0x10
xor byte [esi + ebp], dl
mov edx, dword [0x7dec94]
inc ebp
cmp ebp, dword [edx + ecx*2]
jl 0x451182
inc eax
cmp eax, dword [0x7dec74]
jl 0x451137
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
xor eax, eax
add esp, 0x3c
pop ebp
ret
push ebp
push 1
push 0x1964a
call fcn.0045c5e8
mov eax, 0xffffffff
add esp, 0x48
pop ebp
ret
Function at 0x4566b8
Capabilities:
Delete file

Disassembly:
push 0x7e4af8
push 0x7e4aec
call fcn.0045f6c2
add esp, 8
test eax, eax
je 0x4566e3
push eax
call fcn.0045fa28
pop ecx
push 0x7e4aec
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
ret
mov byte [0x7de4f4], 1
xor eax, eax
ret

Function at 0x4566f0
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push 0x41a044
call fcn.0045ff68
add esp, 0xc
movsx edx, byte [0x5946f8]
dec edx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
ret
Function at 0x459474
Capabilities:
Get system information on windows

Disassembly:
push edi
sub esp, 0x24
call fcn.004547f4
mov byte [0x7de53c], al
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, byte [esp + 0x14]
mov byte [0x5946f8], al
movsx edi, byte [0x5946f0]
cmp edi, eax
jg 0x4594a3
mov edi, eax
movsx edx, byte [0x5946ec]
cmp edx, edi
jl 0x4594b0
mov edx, edi
mov byte [0x5946f4], dl
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 8
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [0x7de5dc], eax
push 0xa
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [0x7de5e0], eax
push 0xc
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [0x7de5e4], eax
push 0x74
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [0x7de5e8], eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x7de5e8]
cmp eax, 0x3c
jae 0x459515
mov dword [0x7de5e8], 0xffffffff
call fcn.00414084
xor eax, eax
add esp, 0x24
pop edi
ret

Function at 0x45ad08
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 8
movsx edx, byte [0x5946f4]
test edx, edx
jle 0x45ad61
xor eax, eax
mov ebx, eax
xor edx, edx
push edx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx*4 + 0x791000], eax
xor edx, edx
push edx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx*4 + 0x791100], eax
xor edx, edx
push edx
push 1
push edx
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx*4 + 0x791200], eax
inc ebx
movsx edx, byte [0x5946f4]
cmp ebx, edx
jl 0x45ad1b
test edx, edx
jle 0x45adb5
xor edx, edx
xor eax, eax
mov dword [esp], esi
mov ebx, eax
mov esi, edx
mov dword [ebx + 0x78f600], esi
xor edx, edx
lea eax, [ebx + 0x78f600]
lea ecx, [esp + 4]
push ecx
push edx
push eax
push 0x41cf6c
push edx
push edx
call fcn.004616a5
add esp, 0x18
mov dword [esi*4 + 0x78f500], eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
add ebx, 0x68
inc esi
movsx ecx, byte [0x5946f4]
cmp esi, ecx
jl 0x45ad70
mov esi, dword [esp]
add esp, 8
pop ebx
ret

Function at 0x45adbc
Capabilities:
Create thread

Disassembly:
movsx eax, byte [0x7de524]
test eax, eax
je 0x45add8
xor eax, eax
push eax
push eax
push 0x41cf10
call fcn.0045ff68
add esp, 0xc
ret
Function at 0x45c3b4
Capabilities:
Inspect section memory permissions

Disassembly:
push esi
call dword [sym.imp.WINMM.dll_joyGetNumDevs]
test eax, eax
jg 0x45c3c8
mov dword [0x7de340], eax
xor eax, eax
pop ecx
ret
mov edx, 0x10
cmp eax, 0x10
jl 0x45c3d4
mov eax, edx
mov dword [0x7de340], eax
xor eax, eax
mov dword [esp], ebx
mov ebx, eax
lea edx, [ebx + 0x786980]
push 0x34
push edx
call dword [0x5b1480]
add esp, 8
mov dword [ebx + 0x786980], 0x34
mov dword [ebx + 0x786984], 0x83
add ebx, 0x34
cmp ebx, 0x340
jl 0x45c3e0
mov ebx, dword [esp]
mov dword [0x786cc0], 1
mov dword [0x786cc4], 2
mov dword [0x786cc8], 4
mov dword [0x786ccc], 8
mov dword [0x786cd0], 0x10
mov dword [0x786cd4], 0x20
mov dword [0x786cd8], 0x40
mov dword [0x786cdc], 0x80
mov dword [0x786ce0], 0x100
mov dword [0x786ce4], 0x200
mov dword [0x786ce8], 0x400
mov dword [0x786cec], 0x800
mov dword [0x786cf0], 0x1000
mov dword [0x786cf4], 0x2000
mov dword [0x786cf8], 0x4000
mov dword [0x786cfc], 0x8000
mov dword [0x786d00], 0x10000
mov dword [0x786d04], 0x20000
mov dword [0x786d08], 0x40000
mov dword [0x786d0c], 0x80000
mov dword [0x786d10], 0x100000
mov dword [0x786d14], 0x200000
mov dword [0x786d18], 0x400000
mov dword [0x786d1c], 0x800000
mov dword [0x786d20], 0x1000000
mov dword [0x786d24], 0x2000000
mov dword [0x786d28], 0x4000000
mov dword [0x786d2c], 0x8000000
mov dword [0x786d30], 0x10000000
mov dword [0x786d34], 0x20000000
mov dword [0x786d38], 0x40000000
mov dword [0x786d3c], 0x80000000
mov eax, 1
pop ecx
ret

Function at 0x45c8d4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x5c3040], eax
mov eax, 1
mov ecx, dword [eax*4 + 0x5c303c]
mov edx, ecx
shr edx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5c3040], edx
inc eax
cmp eax, 0x270
jl 0x45c8e2
mov dword [0x5946d8], eax
ret
Function at 0x4677b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x597d40
cmp edx, dword [eax]
je 0x4677d3
add eax, 8
inc ecx
cmp eax, 0x597dd0
jl 0x4677c4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x597d40]
jne 0x467901
mov eax, dword [0x7deeb8]
cmp eax, 1
je 0x4678db
test eax, eax
jne 0x467804
cmp dword [0x595314], 1
je 0x4678db
cmp edx, 0xfc
je 0x467901
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x46783b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00468db0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00464c00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x46787e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00464c00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x56fc48
push edi
call fcn.00468c30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00468db0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00468dc0
lea eax, [ebp - 0xa0]
push 0x56fc28
push eax
call fcn.00468dc0
push dword [esi + 0x597d44]
lea eax, [ebp - 0xa0]
push eax
call fcn.00468dc0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0046c00b
add esp, 0x2c
pop edi
jmp 0x467901
lea eax, [ebp + 8]
lea esi, [esi + 0x597d44]
push 0
push eax
push dword [esi]
call fcn.00464c00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x486188
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push ebx
not eax
test ecx, ecx
je 0x4861af
test dl, 3
je 0x4861af
movzx ebx, byte [edx]
xor ebx, eax
movzx ebx, bl
shr eax, 8
add edx, 1
xor eax, dword [ebx*4 + 0x571f40]
add ecx, 0xffffffff
jne 0x486190
cmp ecx, 0x20
jb 0x486396
xor eax, dword [edx]
movzx ebx, al
mov ebx, dword [ebx*4 + 0x572b40]
mov esi, eax
shr esi, 8
and esi, 0xff
xor ebx, dword [esi*4 + 0x572740]
mov esi, eax
shr esi, 0x10
and esi, 0xff
xor ebx, dword [esi*4 + 0x572340]
shr eax, 0x18
add ecx, 0xffffffe0
xor ebx, dword [eax*4 + 0x571f40]
xor ebx, dword [edx + 4]
movzx eax, bl
mov eax, dword [eax*4 + 0x572b40]
mov esi, ebx
shr esi, 8
and esi, 0xff
xor eax, dword [esi*4 + 0x572740]
mov esi, ebx
shr esi, 0x10
and esi, 0xff
shr ebx, 0x18
xor eax, dword [esi*4 + 0x572340]
xor eax, dword [ebx*4 + 0x571f40]
xor eax, dword [edx + 8]
movzx ebx, al
mov esi, eax
shr esi, 8
mov ebx, dword [ebx*4 + 0x572b40]
and esi, 0xff
xor ebx, dword [esi*4 + 0x572740]
mov esi, eax
shr esi, 0x10
and esi, 0xff
xor ebx, dword [esi*4 + 0x572340]
shr eax, 0x18
xor ebx, dword [eax*4 + 0x571f40]
xor ebx, dword [edx + 0xc]
movzx eax, bl
mov eax, dword [eax*4 + 0x572b40]
mov esi, ebx
shr esi, 8
and esi, 0xff
xor eax, dword [esi*4 + 0x572740]
mov esi, ebx
shr esi, 0x10
and esi, 0xff
shr ebx, 0x18
xor eax, dword [esi*4 + 0x572340]
xor eax, dword [ebx*4 + 0x571f40]
xor eax, dword [edx + 0x10]
movzx ebx, al
mov esi, dword [ebx*4 + 0x572b40]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor esi, dword [ebx*4 + 0x572740]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
shr eax, 0x18
xor esi, dword [ebx*4 + 0x572340]
xor esi, dword [eax*4 + 0x571f40]
xor esi, dword [edx + 0x14]
mov eax, esi
and eax, 0xff
mov ebx, esi
shr ebx, 8
mov eax, dword [eax*4 + 0x572b40]
movzx ebx, bl
xor eax, dword [ebx*4 + 0x572740]
mov ebx, esi
shr ebx, 0x10
movzx ebx, bl
xor eax, dword [ebx*4 + 0x572340]
shr esi, 0x18
xor eax, dword [esi*4 + 0x571f40]
xor eax, dword [edx + 0x18]
movzx ebx, al
mov ebx, dword [ebx*4 + 0x572b40]
mov esi, eax
shr esi, 8
and esi, 0xff
xor ebx, dword [esi*4 + 0x572740]
mov esi, eax
shr esi, 0x10
and esi, 0xff
shr eax, 0x18
xor ebx, dword [esi*4 + 0x572340]
xor ebx, dword [eax*4 + 0x571f40]
xor ebx, dword [edx + 0x1c]
movzx eax, bl
mov esi, ebx
shr esi, 8
mov eax, dword [eax*4 + 0x572b40]
and esi, 0xff
xor eax, dword [esi*4 + 0x572740]
mov esi, ebx
shr esi, 0x10
and esi, 0xff
xor eax, dword [esi*4 + 0x572340]
shr ebx, 0x18
add edx, 0x20
xor eax, dword [ebx*4 + 0x571f40]
cmp ecx, 0x20
jae 0x4861b8
cmp ecx, 4
jb 0x4863e4
xor eax, dword [edx]
movzx esi, al
mov ebx, dword [esi*4 + 0x572b40]
mov esi, eax
shr esi, 8
and esi, 0xff
xor ebx, dword [esi*4 + 0x572740]
mov esi, eax
shr esi, 0x10
and esi, 0xff
xor ebx, dword [esi*4 + 0x572340]
shr eax, 0x18
mov esi, eax
mov eax, ebx
xor eax, dword [esi*4 + 0x571f40]
add ecx, 0xfffffffc
add edx, 4
cmp ecx, 4
jae 0x48639b
test ecx, ecx
je 0x486402
movzx ebx, byte [edx]
xor ebx, eax
movzx ebx, bl
shr eax, 8
add edx, 1
xor eax, dword [ebx*4 + 0x571f40]
add ecx, 0xffffffff
jne 0x4863e8
not eax
pop ebx
pop esi
ret