joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425a64
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push esi
push edi
push dword [ebp + 8]
lea esi, [ebp - 0xc]
mov dword [ebp - 0x10], ecx
call fcn.00416696
lea edi, [ebp - 0xc]
lea esi, [ebp - 0x20]
call fcn.004166dc
push 0x45ca44
or eax, 0xffffffff
lea ecx, [ebp - 0xc]
call fcn.00416955
lea eax, [ebp - 0x160]
push eax
push dword [ebp - 0xc]
mov byte [ebp + 0xb], 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x425bc3
mov edi, dword [ebp + 0x10]
push ebx
mov esi, dword [ebp - 0x10]
call fcn.0041f821
cmp eax, 1
je 0x425bbe
cmp eax, 0xb
jne 0x425adc
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x425abc
lea eax, [ebp - 0x134]
push 0x45b204
push eax
call fcn.00448480
test eax, eax
pop ecx
pop ecx
je 0x425ba4
lea eax, [ebp - 0x134]
push 0x45ca40
push eax
call fcn.00448480
test eax, eax
pop ecx
pop ecx
je 0x425ba4
lea ebx, [ebp - 0x20]
lea eax, [ebp - 0xc]
call fcn.004169a4
lea eax, [ebp - 0x134]
push eax
or eax, 0xffffffff
lea ecx, [ebp - 0xc]
call fcn.00416955
test byte [ebp - 0x160], 0x10
je 0x425b7c
mov esi, dword [ebp + 0x14]
xor ebx, ebx
cmp byte [ebp + 0x18], bl
je 0x425b48
add dword [esi], 1
adc dword [esi + 4], ebx
cmp byte [ebp + 0x1c], bl
je 0x425ba4
push 0x45abf8
or eax, 0xffffffff
lea ecx, [ebp - 0xc]
call fcn.00416955
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x10]
push dword [ebp + 0x18]
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call fcn.00425a64
cmp al, bl
mov byte [ebp + 0xb], al
je 0x425bc2
jmp 0x425ba4
mov eax, dword [ebp - 0x140]
mov edx, dword [ebp - 0x144]
xor ecx, ecx
xor esi, esi
or ecx, eax
mov eax, dword [ebp + 0xc]
or edx, esi
add dword [eax], ecx
adc dword [eax + 4], edx
cmp byte [ebp + 0x18], 0
je 0x425ba4
add dword [edi], 1
adc dword [edi + 4], esi
lea eax, [ebp - 0x160]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x425abc
jmp 0x425bc2
mov byte [ebp + 0xb], 0
pop ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x20]
call fcn.00448196
push dword [ebp - 0xc]
call fcn.00448196
mov al, byte [ebp + 0xb]
pop ecx
pop ecx
pop edi
pop esi
leave
ret 0x18
Function at 0x42ebc4
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 0xc]
mov word [esi], 2
call fcn.00415b45
pop ecx
mov ebx, eax
push ebx
call sub.WSOCK32.dll_inet_addr
push ebx
mov edi, eax
call fcn.00448196
cmp edi, 0xffffffff
pop ecx
jne 0x42ebf4
xor ecx, ecx
push 0
inc ecx
jmp 0x42ec1b
cmp dword [ebp + 0x10], 0
mov dword [esi + 4], edi
jle 0x42ec16
cmp dword [ebp + 0x10], 0xffff
jg 0x42ec16
push dword [ebp + 0x10]
call sub.WSOCK32.dll_htons
mov word [esi + 2], ax
mov al, 1
jmp 0x42ec25
push 0
push 2
pop ecx
mov eax, dword [ebp + 8]
call fcn.00420d99
xor al, al
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x42fab7
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
and dword [ebp - 8], 0
push ebx
push esi
mov esi, 0x80004002
push edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], 0x28
call fcn.00416679
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.interface
mov ebx, connect
push ebx
call edi
test eax, eax
jne 0x42fbf1
lea eax, [ebp - 0x28]
push eax
xor esi, esi
push esi
push esi
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x42fbe5
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x50], 0
push str.interface_
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 4], 0xff
call fcn.00416786
lea eax, [ebp - 0x50]
push eax
or eax, 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00416955
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push dword [ebp - 0x20]
push ebx
call edi
test eax, eax
jne 0x42fbd1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x154]
push eax
push esi
push esi
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42fbc8
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov byte [ebp + eax - 0x154], 0
lea eax, [ebp - 0x154]
push eax
call fcn.0044819b
test eax, eax
pop ecx
pop ecx
jne 0x42fbc8
lea eax, [ebp - 0x50]
push esi
push eax
call fcn.00416312
pop ecx
pop ecx
push dword [ebp + 8]
mov esi, eax
push esi
call dword [sym.imp.ole32.dll_IIDFromString]
push esi
mov dword [ebp - 0xc], eax
call fcn.00448196
pop ecx
xor esi, esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], esi
je 0x42fbe5
inc dword [ebp - 8]
mov dword [ebp - 4], 0x28
jmp 0x42fb04
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0xc]
push dword [ebp - 0x20]
call fcn.00448196
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x42fc01
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.00416679
fld1
lea eax, [ebp - 0xc]
fstp qword [ebp - 0x28]
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_StringFromIID]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x42fd9a
push ebx
push dword [ebp - 0xc]
call fcn.0041635f
pop ecx
pop ecx
mov esi, eax
push str.interface_
lea eax, [ebp - 0x20]
push eax
call fcn.00416786
push esi
or eax, 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00416955
push str.TypeLib
or eax, 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00416955
push esi
call fcn.00448196
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push dword [ebp - 0x20]
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x42fd9a
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x140]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], 0xff
call edi
mov esi, eax
cmp esi, ebx
jne 0x42fd91
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x140], bl
lea eax, [ebp - 0x140]
push ebx
push eax
call fcn.00416312
pop ecx
pop ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
push dword [ebp - 0x14]
mov esi, eax
call fcn.00448196
cmp esi, ebx
pop ecx
jl 0x42fd91
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x140]
push eax
push ebx
push ebx
push str.Version
push dword [ebp - 8]
mov dword [ebp - 4], 0xff
call edi
test eax, eax
jne 0x42fd3c
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x140], bl
lea eax, [ebp - 0x140]
push eax
call fcn.004489d0
fstp qword [ebp - 0x28]
pop ecx
lea eax, [ebp - 0x10]
fld1
push eax
push ebx
sub esp, 0x10
fstp qword [esp + 8]
fld qword [ebp - 0x28]
fstp qword [esp]
call fcn.0044ab20
add esp, 0x10
call fcn.00455ea0
fld qword [ebp - 0x28]
push eax
call fcn.00455ea0
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
mov esi, eax
cmp esi, ebx
jl 0x42fd91
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x20]
call fcn.00448196
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x42fdaa
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
xor ebx, ebx
push edi
lea ecx, [ebp - 0x24]
mov esi, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.00416679
lea ecx, [ebp - 0x18]
call fcn.00416679
lea ecx, [ebp - 0x30]
call fcn.00416679
push str.SOFTWAREClasses_
lea eax, [ebp - 0x24]
push eax
call fcn.00416786
push dword [ebp + 8]
or edi, 0xffffffff
mov eax, edi
lea ecx, [ebp - 0x24]
call fcn.00416955
push str.CLSID
mov eax, edi
lea ecx, [ebp - 0x24]
call fcn.00416955
push 0x45a5cc
lea eax, [ebp - 0x18]
push eax
call fcn.00416786
cmp esi, ebx
je 0x42fe3b
cmp byte [esi], 0x5c
je 0x42fe3b
cmp byte [esi + 1], 0x5c
je 0x42fe3b
push 0x45d160
lea eax, [ebp - 0x18]
push eax
call fcn.00416786
push esi
mov eax, edi
lea ecx, [ebp - 0x18]
call fcn.00416955
cmp dword [ebp + 0x10], ebx
je 0x42fe8f
push 0x20
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.00448970
mov dword [ebp - 0x4c], ebx
add esp, 0xc
lea ebx, [ebp - 0x18]
lea eax, [ebp - 0x30]
call fcn.004169a4
push str.IPC_
mov eax, edi
lea ecx, [ebp - 0x30]
call fcn.00416955
mov eax, dword [ebp - 0x30]
push 0
push dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x50]
push eax
call sub.MPR.dll_WNetAddConnection2A
mov esi, eax
test esi, esi
jne 0x42ff25
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push reloc.WSOCK32.dll_bind
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
mov esi, eax
cmp esi, ebx
jne 0x42ff25
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push dword [ebp - 0x24]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
cmp esi, ebx
jne 0x42ff20
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
mov dword [ebp - 0xc], 0xff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, ebx
jne 0x42ff1b
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x154], bl
lea eax, [ebp - 0x154]
push ebx
push eax
call fcn.00416312
pop ecx
pop ecx
push dword [ebp + 0xc]
mov ebx, eax
push ebx
call dword [sym.imp.ole32.dll_CLSIDFromString]
push ebx
mov esi, eax
call fcn.00448196
pop ecx
push dword [ebp - 8]
call edi
push dword [ebp - 4]
call edi
push dword [ebp - 0x30]
call fcn.00448196
push dword [ebp - 0x18]
call fcn.00448196
push dword [ebp - 0x24]
call fcn.00448196
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x438651
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push str.open
lea esi, [ebp - 0x14]
mov edi, eax
call fcn.00416696
xor ebx, ebx
push 0x3c
xor esi, esi
lea eax, [ebp - 0x50]
push ebx
inc esi
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
call fcn.00448970
add esp, 0xc
cmp dword [ebp + 0x10], 2
jb 0x4386c2
cmp dword [edi + 0xc], esi
ja 0x438693
lea esi, [edi + 0x18]
jmp 0x438699
mov eax, dword [edi + 8]
mov esi, dword [eax + 4]
call fcn.00417d7f
cmp byte [eax], 0
je 0x4386c2
cmp dword [edi + 0xc], 1
ja 0x4386ae
lea esi, [edi + 0x18]
jmp 0x4386b4
mov eax, dword [edi + 8]
mov esi, dword [eax + 4]
call fcn.00417d7f
push eax
call fcn.00415b45
pop ecx
mov ebx, eax
cmp dword [ebp + 0x10], 3
jb 0x4386e8
cmp dword [edi + 0xc], 2
ja 0x4386d3
lea esi, [edi + 0x18]
jmp 0x4386d9
mov eax, dword [edi + 8]
mov esi, dword [eax + 8]
call fcn.00417d7f
push eax
call fcn.00415b45
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 4
jb 0x438729
cmp dword [edi + 0xc], 3
ja 0x4386f9
lea esi, [edi + 0x18]
jmp 0x4386ff
mov eax, dword [edi + 8]
mov esi, dword [eax + 0xc]
call fcn.00417d7f
cmp byte [eax], 0
je 0x438729
cmp dword [edi + 0xc], 3
ja 0x438714
lea esi, [edi + 0x18]
jmp 0x43871a
mov eax, dword [edi + 8]
mov esi, dword [eax + 0xc]
call fcn.00417d7f
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00416786
cmp dword [ebp + 0x10], 5
jb 0x43874b
cmp dword [edi + 0xc], 4
ja 0x43873a
lea eax, [edi + 0x18]
jmp 0x438740
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x10]
call fcn.00417e60
movzx eax, ax
mov dword [ebp - 8], eax
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.00448970
and dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x14]
add esp, 0xc
cmp dword [edi + 0xc], 0
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x40
mov dword [ebp - 0x44], eax
ja 0x43877c
lea esi, [edi + 0x18]
jmp 0x438781
mov eax, dword [edi + 8]
mov esi, dword [eax]
call fcn.00417d7f
mov edi, dword [ebp - 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test ebx, ebx
mov esi, eax
je 0x4387af
push ebx
call fcn.00448196
pop ecx
test edi, edi
je 0x4387ba
push edi
call fcn.00448196
pop ecx
test esi, esi
jne 0x438803
mov ebx, dword [ebp + 8]
cmp byte [ebx + 0x194], 1
jne 0x4387df
push 0xffffffffffffffff
call fcn.0041f65a
push eax
push 0x87
call fcn.0041f4c1
inc esi
jmp 0x4387f7
xor ecx, ecx
push 0
inc ecx
mov eax, ebx
call fcn.00420d99
mov esi, dword [ebp + 0x14]
push 0
call fcn.004182da
xor esi, esi
push dword [ebp - 0x14]
call fcn.00448196
mov eax, esi
jmp 0x43883a
cmp byte [ebp + 0xc], 0
je 0x438817
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x710], eax
jmp 0x438830
mov esi, dword [ebp + 0x14]
push 1
call fcn.004182da
cmp dword [ebp - 0x18], 0
je 0x438830
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call fcn.00448196
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x43b5f7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
mov edi, 0x103
jmp 0x43b6ac
xor eax, eax
cmp byte [0x46d9e0], bl
je 0x43b640
mov eax, 0x100
lea ecx, [ebp - 0xc]
push ecx
or eax, 0x20019
push eax
push ebx
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43b6b4
push dword [ebp - 0xc]
call fcn.0043b5f7
pop ecx
push dword [ebp - 0xc]
mov byte [ebp - 1], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
je 0x43b6b4
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x43b6b4
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
cmp eax, edi
jne 0x43b631
mov al, 1
jmp 0x43b6b6
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43c03a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp edi, 0xffffffff
je 0x43c0c2
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x43c0c2
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push eax
xor ebx, ebx
push ebx
push ebx
push edi
call esi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], eax
je 0x43c096
cmp dword [ebp + 0x10], ebx
jbe 0x43c096
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43c08e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
jmp 0x43c0c4
push ebx
push ebx
push dword [ebp - 4]
push edi
call esi
cmp dword [ebp + 0x18], ebx
je 0x43c0b6
push 2
push ebx
push ebx
push edi
call esi
push ebx
push ebx
push dword [ebp - 4]
mov edi, eax
push dword [ebp + 8]
call esi
sub edi, dword [ebp - 4]
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
inc eax
jmp 0x43c0cc
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x440a99
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
inc esi
mov dword [0x46b948], eax
push edi
mov edx, esi
mov eax, 0x46b948
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x46c304
jl 0x440aaa
pop edi
mov dword [0x4632e0], esi
mov dword [0x46c324], esi
pop esi
ret

Function at 0x440ad8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x46c324], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x46b948
jne 0x440af8
push 0
call fcn.0044ab52
pop ecx
call fcn.00440a99
mov dword [0x4632e0], 0x270
mov dword [0x46b940], esi
mov edx, 0xe3
mov ecx, bind
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x440b17
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x440b4d
mov edx, dword [0x46b948]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x440ba7
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4632e0]
jne 0x440bb4
call fcn.00440ad8
mov eax, dword [0x46b940]
mov ecx, dword [eax]
add dword [0x46b940], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x440beb
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4632e0]
jne 0x440bfd
call fcn.00440ad8
mov eax, dword [0x46b940]
mov eax, dword [eax]
add dword [0x46b940], 4
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov ecx, eax
and ecx, 0xff3a58ad
shl ecx, 7
xor eax, ecx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
xor ecx, eax
test ecx, ecx
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
jge 0x440c43
fadd qword [0x45ddf8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x45dde8]
leave
ret

Function at 0x4412bd
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.00448970
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x441c34
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
push edi
xor edi, edi
inc edi
mov dword [eax], ecx
mov esi, edi
mov ecx, eax
mov edx, dword [ecx]
mov ebx, edx
shr ebx, 0x1e
xor ebx, edx
imul ebx, ebx, 0x6c078965
add ebx, esi
mov dword [ecx + 4], ebx
inc esi
add ecx, 4
cmp esi, 0x270
jl 0x441c40
mov dword [eax + 0x9c0], edi
mov dword [eax + 0x9c4], edi
pop edi
pop esi
pop ebx
ret
Function at 0x441c70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebx, eax
cmp dword [ebx + 0x9c4], 0
push esi
push edi
mov esi, ebx
jne 0x441c94
push 0
call fcn.0044ab52
pop ecx
mov ecx, eax
mov eax, ebx
call fcn.00441c34
mov dword [ebx + 0x9c0], 0x270
mov dword [ebx + 0x9c8], ebx
mov dword [esp + 0x10], 0xe3
mov ecx, bind
mov eax, 0x9908b0df
mov edx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor edx, ebp
and edx, ecx
xor edx, dword [esi]
mov dword [esp + 0x14], ecx
mov ecx, ebp
and cl, 1
shr edx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor edx, ecx
xor edx, dword [esi + 0x634]
dec dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi], edx
mov esi, edi
jne 0x441cb6
mov dword [esp + 0x10], 0x18c
mov edx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor edx, ebp
and edx, ecx
xor edx, dword [esi]
mov dword [esp + 0x14], ecx
mov ecx, ebp
and cl, 1
shr edx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor edx, ecx
xor edx, dword [esi - 0x38c]
dec dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi], edx
mov esi, edi
jne 0x441cf2
mov ebx, dword [ebx]
mov edx, dword [esi]
xor edx, ebx
and edx, ecx
xor edx, dword [esi]
and bl, 1
shr edx, 1
neg bl
pop edi
sbb ebx, ebx
and ebx, eax
xor edx, ebx
xor edx, dword [esi - 0x38c]
mov dword [esi], edx
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x441d4c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [esi + 0x9c0]
jne 0x441d5b
mov eax, esi
call fcn.00441c70
lea eax, [esi + 0x9c8]
mov edx, dword [eax]
mov ecx, dword [edx]
add edx, 4
mov dword [eax], edx
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x441f5b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9cc
push ebx
xor ebx, ebx
lea eax, [ebp - 0x9cc]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], ebx
call fcn.00441c34
cmp dword [ebp + 0xc], ebx
jbe 0x441f9e
push esi
push edi
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x9cc]
lea edi, [ebx + eax]
call fcn.00441d4c
xor byte [edi], al
inc ebx
cmp ebx, dword [ebp + 0xc]
jb 0x441f83
pop edi
pop esi
pop ebx
leave
ret 8