joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404000
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4b8344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x38]
push eax
call edi
test eax, eax
je 0x404074
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x34], 0x12
jne 0x404052
mov esi, dword [0x4b944c]
test esi, esi
je 0x404062
push esi
call fcn.00401ad0
mov esi, dword [esi]
add esp, 4
test esi, esi
jne 0x404041
jmp 0x404062
lea ecx, [ebp - 0x38]
push ecx
call ebx
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x38]
push eax
call edi
test eax, eax
jne 0x404031
mov edi, dword [0x4b9450]
test edi, edi
je 0x40414e
call fcn.004026b0
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
mov dword [ebp - 0x18], eax
call ebx
movzx esi, ax
push 0xa1
shr esi, 0xf
call ebx
movzx ebx, ax
shr ebx, 0xf
test esi, esi
jne 0x4040cb
cmp byte [edi + 0x1d0], 1
jne 0x4040cb
mov ecx, dword [ebp - 0x18]
push ecx
push esi
push esi
push 0x154
push edi
call fcn.004010e0
add esp, 0x14
test ebx, ebx
jne 0x4040ec
cmp byte [edi + 0x1d4], 1
jne 0x4040ec
mov edx, dword [ebp - 0x18]
push edx
push ebx
push ebx
push 0x158
push edi
call fcn.004010e0
add esp, 0x14
cmp dword [edi + 0x70], 0x34003
jne 0x40414e
mov ecx, dword [edi + 0x258]
lea eax, [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [edi + 0x26c], eax
jne 0x40412b
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
cmp dword [edi + 0x270], eax
je 0x40414e
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x18], eax
sub esp, 0x10
fild dword [ebp - 0x18]
fstp qword [esp + 8]
fild dword [ebp - 0x1c]
fstp qword [esp]
push edi
call fcn.00402ff0
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d915
mov esp, ebp
pop ebp
ret

Function at 0x404c90
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x4b88a0], 0
jne 0x404cf4
push 0xc38
push 0
push 0x4b93a0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call fcn.00408360
test eax, eax
jne 0x404cbe
call fcn.004083f0
xor eax, eax
ret
call fcn.00408620
push 0x4b9458
call fcn.00407320
add esp, 4
mov dword [0x4b9454], eax
mov dword [0x4b88a0], 1
call fcn.00405f00
mov dword [0x4b9460], eax
mov dword [0x4b9464], edx
call fcn.00401b00
mov eax, 1
ret
Function at 0x4063c0
Capabilities:
Link many functions at runtime

Disassembly:
push 0x481158
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4b9be8], eax
test eax, eax
jne 0x4063e9
push str.WGL:_Failed_to_load_opengl32.dll
push 0x10008
call fcn.00404c10
add esp, 8
xor eax, eax
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.wglCreateContext
push eax
call esi
mov dword [0x4b9bec], eax
mov eax, dword [0x4b9be8]
push str.wglDeleteContext
push eax
call esi
mov ecx, dword [0x4b9be8]
push 0x4810f8
push ecx
mov dword [0x4b9bf0], eax
call esi
mov edx, dword [0x4b9be8]
push str.wglMakeCurrent
push edx
mov dword [0x4b9bf4], eax
call esi
mov dword [0x4b9bf8], eax
mov eax, dword [0x4b9be8]
push str.wglShareLists
push eax
call esi
mov dword [0x4b9bfc], eax
mov eax, 1
pop esi
ret

Function at 0x406be0
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b9fd4], eax
cmp eax, 0xffffffff
jne 0x406c05
push str.Win32:_Failed_to_allocate_TLS_index
push 0x10008
call fcn.00404c10
add esp, 8
xor eax, eax
ret
mov eax, 1
mov dword [0x4b9fd0], eax
ret
Function at 0x407be0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.winmm.dll
call esi
xor edi, edi
mov dword [0x4b9ba8], eax
cmp eax, edi
jne 0x407c1a
push str.Win32:_Failed_to_load_winmm.dll
push 0x10008
call fcn.00404c10
add esp, 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.timeGetTime
push eax
call ebx
push str.user32.dll
mov dword [0x4b9bac], eax
call esi
mov dword [0x4b9bc8], eax
cmp eax, edi
jne 0x407c59
push str.Win32:_Failed_to_load_user32.dll
push 0x10008
call fcn.00404c10
add esp, 8
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push str.SetProcessDPIAware
push eax
call ebx
mov dword [0x4b9bcc], eax
mov eax, dword [0x4b9bc8]
push str.ChangeWindowMessageFilterEx
push eax
call ebx
push str.dinput8.dll
mov dword [0x4b9bd0], eax
call esi
mov dword [0x4b9bb0], eax
cmp eax, edi
je 0x407c95
push str.DirectInput8Create
push eax
call ebx
mov dword [0x4b9bb4], eax
mov eax, str.xinput1_4.dll
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], str.xinput1_3.dll
mov dword [ebp - 0x10], str.xinput9_1_0.dll
mov dword [ebp - 0xc], str.xinput1_2.dll
mov dword [ebp - 8], str.xinput1_1.dll
mov dword [ebp - 4], edi
lea esp, [esp]
push eax
call esi
mov dword [0x4b9bbc], eax
test eax, eax
jne 0x407cd7
mov eax, dword [ebp + edi*4 - 0x14]
inc edi
test eax, eax
jne 0x407cc0
jmp 0x407cf7
push str.XInputGetCapabilities
push eax
call ebx
mov ecx, dword [0x4b9bbc]
push str.XInputGetState
push ecx
mov dword [0x4b9bc0], eax
call ebx
mov dword [0x4b9bc4], eax
push str.dwmapi.dll
call esi
mov dword [0x4b9bd4], eax
test eax, eax
je 0x407d27
push str.DwmIsCompositionEnabled
push eax
call ebx
mov edx, dword [0x4b9bd4]
push str.DwmFlush
push edx
mov dword [0x4b9bd8], eax
call ebx
mov dword [0x4b9bdc], eax
push str.shcore.dll
call esi
mov dword [0x4b9be0], eax
test eax, eax
je 0x407d44
push 0x4815fc
push eax
call ebx
mov dword [0x4b9be4], eax
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408360
Capabilities:
Allocate thread local storage

Disassembly:
call fcn.00406be0
test eax, eax
jne 0x40836c
xor eax, eax
ret
push esi
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0x4b94a4
push 0
push 0x2000
call esi
push 2
push 0
push 0
push 0x2001
call esi
call fcn.00407be0
pop esi
test eax, eax
je 0x408369
call fcn.00407d60
mov eax, dword [0x4b9be4]
test eax, eax
je 0x4083ae
push 2
call eax
jmp 0x4083b9
mov eax, dword [0x4b9bcc]
test eax, eax
je 0x4083b9
call eax
call fcn.00403e60
test eax, eax
je 0x408369
call fcn.004081a0
mov dword [0x4b94a0], eax
test eax, eax
je 0x408369
call fcn.00404000
call fcn.004063c0
test eax, eax
je 0x408369
call fcn.00405eb0
call fcn.00405e60
mov eax, 1
ret
Function at 0x409f90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4b8e94], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x40a04a
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x4b8e90], eax
inc ebx
cmp ebx, 0x100
jb 0x409fb0
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x40a076
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4b8e90]
sub edi, 1
jne 0x40a055
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x40a0a8
nop dword [eax]
cmp cl, 0x23
jne 0x40a08f
cmp byte [esi], cl
jne 0x40a08f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4b8e90]
test cl, cl
jne 0x40a080
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x40a2a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x40a2c3
push 0x57a
push str.H:_repoCminecraft_clickersuserskirxoimgui.cpp
push str.filename__file_open_mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x40a2d0
mov dword [edi], 0
mov ecx, esi
call fcn.0040a0b0
mov esi, eax
test esi, esi
jne 0x40a2e1
pop edi
pop esi
pop ebp
ret
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x40a399
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x40a399
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x40a399
mov eax, dword [0x4b9298]
test eax, eax
je 0x40a331
inc dword [eax + 0x3a0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40a399
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x40a380
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x4b9298]
add esp, 4
test eax, eax
je 0x40a36f
dec dword [eax + 0x3a0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x40a392
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x420e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
xor eax, eax
mov dword [ebp - 8], edx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
cmp dword [ebx + 0xc], eax
jle 0x421015
mov esi, dword [ebx + 8]
xorps xmm0, xmm0
add esi, 0x14
mov dword [ebp - 0x14], esi
nop dword [eax + eax]
movss xmm1, dword [esi - 0x14]
mov eax, 0x100
comiss xmm1, xmm0
jbe 0x420eca
mov esi, dword [edx + 4]
mov edi, dword [edx + 0x1c]
cwde
movzx ecx, byte [edi + esi + 6]
movsx ecx, cx
imul ecx, eax
movzx eax, byte [edi + esi + 7]
add cx, ax
mov eax, 0x100
movsx edx, cx
movzx ecx, byte [edi + esi + 4]
cwde
movsx ecx, cx
imul ecx, eax
movzx eax, byte [edi + esi + 5]
mov esi, dword [ebp - 0x14]
add cx, ax
movsx eax, cx
sub eax, edx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
jmp 0x420ef4
mov eax, dword [ebp - 8]
mov edx, dword [edx + 0x14]
mov eax, dword [eax + 4]
movzx ecx, byte [edx + eax + 0x12]
movzx eax, byte [edx + eax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
xorps xmm1, xmmword [0x4b31e0]
mov ecx, dword [ebp - 0xc]
xor edi, edi
movss dword [ebp - 0x18], xmm1
movzx eax, byte [ecx + 0x18]
mov byte [esi], al
movzx eax, byte [ecx + 0x1c]
mov byte [esi + 1], al
mov eax, dword [ebp - 4]
cmp dword [esi - 8], edi
jle 0x420fff
mov ecx, dword [ebx + 0x10]
shl eax, 4
add ecx, 6
add eax, ecx
mov dword [ebp - 0x10], eax
mov edx, dword [esi - 0xc]
test edx, edx
jne 0x420f33
mov edx, dword [esi - 0x10]
add edx, edi
jmp 0x420f36
mov edx, dword [edx + edi*4]
mov ecx, dword [ebp - 8]
call fcn.0041c220
mov ecx, dword [ebp - 0xc]
mov edx, eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x1c]
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mov dword [esp + 4], 0
mov dword [esp], 0
addsd xmm0, qword [eax*8 + 0x4b3190]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 8]
cvtpd2ps xmm3, xmm0
movd xmm0, eax
mulss xmm3, dword [ebp - 0x18]
shr eax, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x4b3190]
cvtpd2ps xmm2, xmm0
mulss xmm2, dword [ebp - 0x18]
call fcn.0041e830
mov edx, dword [ebp - 0xc]
inc edi
mov esi, dword [ebp - 0x10]
add esp, 0x18
movzx eax, word [edx + 0x18]
sub ax, word [ebp - 0x1c]
movzx ecx, word [edx + 0x14]
dec ax
add ax, cx
dec cx
add ax, word [ebp - 0x20]
mov word [esi - 2], ax
movzx eax, word [edx + 0x1c]
sub ax, word [ebp - 0x24]
add ax, cx
mov ecx, esi
add ax, word [ebp - 0x28]
mov esi, dword [ebp - 0x14]
mov word [ecx], ax
add ecx, 0x10
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
cmp edi, dword [esi - 8]
jl 0x420f25
mov edx, dword [ebp - 8]
add esi, 0x18
sub dword [ebx + 0xc], 1
xorps xmm0, xmm0
mov dword [ebp - 0x14], esi
jne 0x420e70
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x428c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [0x4b9298]
mov eax, dword [esi + 0x19ac]
mov byte [eax + 0x78], 1
mov eax, dword [esi + 0x19ac]
cmp byte [eax + 0x7b], 0
jne 0x428ceb
push edi
lea eax, [ebp + 0xc]
push eax
push 0
push ecx
lea edi, [esi + 0x2e74]
push 0xc01
push edi
call fcn.00408ca0
add esp, 0x14
test edi, edi
je 0x428cd8
cmp eax, 0xffffffff
je 0x428ccf
cmp eax, 0xc01
jl 0x428cd4
mov eax, 0xc00
mov byte [eax + edi], 0
lea edx, [esi + 0x2e74]
mov ecx, edi
pop edi
lea edx, [edx + eax]
pop esi
pop ebp
jmp fcn.004285e0
pop esi
pop ebp
ret
Function at 0x43a670
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x13bc
call fcn.0047d930
push ebx
push esi
mov esi, dword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
push edi
call esi
mov dword [esp + 0x13c4], 0xffffffff
mov edx, 1
mov dword [esp + 0x44], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [esp + edx*4 + 0x44], eax
inc edx
cmp edx, 0x270
jl 0x43a6a0
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0x270
push 6
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x20
mov dword [esp + 0x1c], 0xffffffff
call fcn.0043ab40
add eax, reloc.WS2_32.dll_getpeername
cmp eax, 0x80000000
lea ecx, [eax - 0x80000000]
lea ebx, [eax - 0x80000000]
cmovae ebx, ecx
call esi
mov dword [esp + 0x13c4], 0xffffffff
mov edx, 1
mov dword [esp + 0x44], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [esp + edx*4 + 0x44], eax
inc edx
cmp edx, 0x270
jl 0x43a716
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0x270
push 6
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x20
mov dword [esp + 0x1c], 0xffffffff
call fcn.0043ab40
add eax, reloc.WS2_32.dll_getpeername
mov dword [esp + 0x30], 0
cmp eax, 0x80000000
mov dword [esp + 0x24], 0
push 0x1c
xorps xmm0, xmm0
lea ecx, [eax - 0x80000000]
movlpd qword [esp + 0x2c], xmm0
lea edi, [eax - 0x80000000]
movlpd qword [esp + 0x3c], xmm0
lea eax, [esp + 0x28]
cmovae edi, ecx
cmp byte [0x4b859f], 0
push eax
push 1
je 0x43a7d3
mov dword [esp + 0x40], 0x10
call dword [sym.imp.USER32.dll_SendInput]
lea eax, [edi + ebx]
cdq
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
call fcn.00439e00
mov byte [0x4b859f], 0
jmp 0x43a83d
mov esi, dword [sym.imp.USER32.dll_SendInput]
mov dword [esp + 0x40], 8
call esi
mov eax, ebx
lea ecx, [esp + 0x10]
cdq
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
call fcn.00439e00
push 0x1c
lea eax, [esp + 0x28]
mov dword [esp + 0x34], 0
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
push eax
push 1
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x44], xmm0
mov dword [esp + 0x40], 0x10
call esi
mov eax, edi
lea ecx, [esp + 0x10]
cdq
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
call fcn.00439e00
cvttss2si edx, dword [0x4b8550]
cvttss2si ecx, dword [0x4b854c]
call fcn.0043aa60
mov ecx, eax
mov eax, 0x3e8
cdq
idiv ecx
lea ecx, [esp + 0x10]
sub eax, edi
sub eax, ebx
cdq
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
call fcn.00439e00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43aa60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1394
call fcn.0047d930
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
call dword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [esp + 0x139c], 0xffffffff
mov esi, 1
mov dword [esp + 0x1c], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, esi
mov dword [esp + esi*4 + 0x1c], eax
inc esi
cmp esi, 0x270
jl 0x43aa91
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x270
cmp ebx, 0x80000000
mov dword [esp + 0xc], eax
lea eax, [ebx - 0x80000000]
mov dword [esp + 0x10], 0x20
lea esi, [ebx - 0x80000000]
mov dword [esp + 0x14], 0xffffffff
cmovae esi, eax
lea ecx, [edi - 0x80000000]
cmp edi, 0x80000000
lea eax, [edi - 0x80000000]
cmovae ecx, eax
sub ecx, esi
cmp ecx, 0xffffffff
jne 0x43ab09
lea ecx, [esp + 0x18]
call fcn.0043abc0
jmp 0x43ab16
lea eax, [ecx + 1]
push eax
lea ecx, [esp + 0x10]
call fcn.0043ab40
lea ecx, [eax + esi]
pop edi
cmp ecx, 0x80000000
lea edx, [ecx - 0x80000000]
lea eax, [ecx - 0x80000000]
pop esi
cmovae eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43abc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x43ac1e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x43abe0
mov eax, dword [edi]
jmp 0x43ad09
cmp eax, 0x4e0
jb 0x43ad09
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x43ac40
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x43ac90
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43b2d0
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x370
push 0x44
lea eax, [ebp - 0x58]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x160]
xorps xmm0, xmm0
movaps xmmword [ebp - 0x10], xmm0
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x160]
push eax
push str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
lea eax, [ebp - 0x368]
push 0x208
push eax
call fcn.0043b060
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x368]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x440810
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4b8344]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x440863
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x44085d
shr eax, 8
cmp al, 2
jne 0x44085d
call fcn.0044a820
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d915
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.0047d915
mov esp, ebp
pop ebp
ret
Function at 0x448370
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x44838e
cmp dword [esi + 0x6c], 0
je 0x44838e
push 2
push 3
push esi
call fcn.00453b20
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00453e50
add esp, 4
test esi, esi
je 0x4483ae
cmp dword [esi + 0x6c], 0
je 0x4483ae
push 3
push esi
call fcn.00453b60
add esp, 8
pop esi
pop ebp
ret