joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4087d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test edx, edx
je 0x4087da
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004084ec
xchg ecx, eax
push edi
je 0x408888
lea eax, [ebp - 0x40]
push eax
call fcn.004084fc
push eax
push esi
push dword [ebp + 8]
call fcn.004084b1
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.004084ec
nop
adc eax, dword [esi + edx*8 - 0x73]
inc ebp
call 0x5128e5e2
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda

Function at 0x408890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 9], 0xbf
call fcn.004084fc
push eax
push esi
push dword [ebp + 8]
call fcn.004084b1
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004084fc
push eax
push esi
push dword [ebp + 8]
call fcn.004084b1
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004084fc
push eax
push esi
push dword [ebp + 8]
call fcn.004084b1
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004084ec
add eax, 0x88b5fb83
popfd
jl 0x408971
invalid
invalid
Function at 0x409900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x409942
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x4098ec
call fcn.004084ec
sub byte [ecx + ebx*8 + 0x1f], cl
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d

Function at 0x40ac90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x40acb0
xor eax, eax
jmp 0x40ad66
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ad64
mov dword [ebp - 0x25c], 0
call fcn.00409bd0
test eax, eax
je 0x40ace0
mov eax, 1
jmp 0x40ad66
mov dword [ebp - 0x258], 0
push 0x24c
push 0
lea ecx, [ebp - 0x254]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40ad64
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0xc], 0xffffffff
je 0x40ad3b
mov edx, dword [ebp - 0x238]
cmp edx, dword [ebp + 0xc]
je 0x40ad3b
xor eax, eax
jmp 0x40ad66
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040a3e0
add esp, 8
test eax, eax
je 0x40ad64
cmp dword [ebp + 0xc], 0xffffffff
jne 0x40ad5d
mov eax, dword [ebp - 0x238]
jmp 0x40ad66
mov eax, 1
jmp 0x40ad66
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret
Function at 0x10005480
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10009018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x100054f1
lea eax, [ebp - 0x20]
push eax
push esi
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x100054f1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Thread32Next]
cmp dword [ebp - 0x14], ebx
je 0x100054d6
lea ecx, [ebp - 0x20]
push ecx
push esi
call edi
test eax, eax
jne 0x100054c6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push edx
push 1
push 0x1a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [0x10faa3b8], eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1000565a
mov esp, ebp
pop ebp
ret

Function at 0x1000565a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10009018]
jne 0x10005664
repz ret
jmp fcn.10005b71

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xa182a80
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x136e728c
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x408950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.00411ee0
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
or ecx, 1
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x408988
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0xc]
call fcn.00411c00
cmp dword [ebp - 4], eax
jae 0x4089fe
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00411c40
movzx ecx, word [eax]
cmp ecx, 0x80
jae 0x4089fc
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00411c40
movzx eax, word [eax]
test eax, eax
je 0x4089d3
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00411c40
movzx edx, word [eax]
cmp edx, 0x43
jne 0x4089d5
jmp 0x40897f
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00411c40
movzx esi, word [eax]
movsx ecx, byte [0x477c98]
xor esi, ecx
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
call fcn.00411c40
mov word [eax], si
jmp 0x40897f
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409700
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460570
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x140f4
call fcn.0043e1e0
mov eax, dword [0x4771c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
push 0xb0
lea ecx, [ebp - 0x140c4]
call fcn.00401900
push 1
push 0x40
push 0x20
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x140c4]
call fcn.0040e690
mov dword [ebp - 0x140e4], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x140c4]
mov edx, dword [ecx + 4]
lea ecx, [ebp + edx - 0x140c4]
call fcn.004040b0
movzx eax, al
test eax, eax
je 0x40979d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140c4]
call fcn.004099a0
nop
jmp 0x40997b
cmp dword [ebp + 0x10], 0x14000
jle 0x4097b2
mov dword [ebp - 0x140d0], 0x14000
jmp 0x4097bb
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x140d0], ecx
mov edx, dword [ebp - 0x140d0]
mov dword [ebp - 0x140dc], edx
cmp dword [ebp + 0x10], 0
jle 0x409941
mov byte [ebp - 4], 2
push 0
mov eax, dword [ebp - 0x140dc]
push eax
lea ecx, [ebp - 0x14014]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x140cc], eax
cmp dword [ebp - 0x140cc], 0xffffffff
je 0x409809
cmp dword [ebp - 0x140cc], 0
jne 0x40982a
lea ecx, [ebp - 0x140c4]
call fcn.0040e5f0
nop
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140c4]
call fcn.004099a0
nop
jmp 0x40997b
lea ecx, [ebp - 0x14014]
push ecx
lea ecx, [ebp - 0x140fc]
call fcn.00412290
mov dword [ebp - 0x140e0], eax
push 0
push str.CANCEL2
mov ecx, dword [ebp - 0x140e0]
call fcn.00412010
cmp eax, 0xffffffff
je 0x409865
mov dword [ebp - 0x140d4], 1
jmp 0x40986f
mov dword [ebp - 0x140d4], 0
mov dl, byte [ebp - 0x140d4]
mov byte [ebp - 0x140c5], dl
lea ecx, [ebp - 0x140fc]
call fcn.00412140
movzx eax, byte [ebp - 0x140c5]
test eax, eax
je 0x4098b2
lea ecx, [ebp - 0x140c4]
call fcn.0040e5f0
nop
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140c4]
call fcn.004099a0
nop
jmp 0x40997b
mov eax, dword [ebp - 0x140cc]
cdq
push edx
push eax
lea ecx, [ebp - 0x14014]
push ecx
lea ecx, [ebp - 0x140c4]
call fcn.004106b0
nop
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp - 0x140cc]
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0x14000
jle 0x4098ef
mov dword [ebp - 0x140d8], 0x14000
jmp 0x4098f8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x140d8], eax
mov ecx, dword [ebp - 0x140d8]
mov dword [ebp - 0x140dc], ecx
jmp 0x40991e
mov dword [ebp - 4], 1
jmp 0x40993c
jmp 0x4097c7
lea ecx, [ebp - 0x140c4]
call fcn.0040e5f0
nop
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140c4]
call fcn.004099a0
nop
jmp 0x40997b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043d0e7
mov esp, ebp
pop ebp
ret
Function at 0x40991e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460570
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x140f4
call fcn.0043e1e0
mov eax, dword [0x4771c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
push 0xb0
lea ecx, [ebp - 0x140c4]
call fcn.00401900
push 1
push 0x40
push 0x20
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x140c4]
call fcn.0040e690
mov dword [ebp - 0x140e4], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x140c4]
mov edx, dword [ecx + 4]
lea ecx, [ebp + edx - 0x140c4]
call fcn.004040b0
movzx eax, al
test eax, eax
je 0x40979d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140c4]
call fcn.004099a0
nop
jmp 0x40997b
cmp dword [ebp + 0x10], 0x14000
jle 0x4097b2
mov dword [ebp - 0x140d0], 0x14000
jmp 0x4097bb
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x140d0], ecx
mov edx, dword [ebp - 0x140d0]
mov dword [ebp - 0x140dc], edx
cmp dword [ebp + 0x10], 0
jle 0x409941
mov byte [ebp - 4], 2
push 0
mov eax, dword [ebp - 0x140dc]
push eax
lea ecx, [ebp - 0x14014]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x140cc], eax
cmp dword [ebp - 0x140cc], 0xffffffff
je 0x409809
cmp dword [ebp - 0x140cc], 0
jne 0x40982a
lea ecx, [ebp - 0x140c4]
call fcn.0040e5f0
nop
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140c4]
call fcn.004099a0
nop
jmp 0x40997b
lea ecx, [ebp - 0x14014]
push ecx
lea ecx, [ebp - 0x140fc]
call fcn.00412290
mov dword [ebp - 0x140e0], eax
push 0
push str.CANCEL2
mov ecx, dword [ebp - 0x140e0]
call fcn.00412010
cmp eax, 0xffffffff
je 0x409865
mov dword [ebp - 0x140d4], 1
jmp 0x40986f
mov dword [ebp - 0x140d4], 0
mov dl, byte [ebp - 0x140d4]
mov byte [ebp - 0x140c5], dl
lea ecx, [ebp - 0x140fc]
call fcn.00412140
movzx eax, byte [ebp - 0x140c5]
test eax, eax
je 0x4098b2
lea ecx, [ebp - 0x140c4]
call fcn.0040e5f0
nop
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140c4]
call fcn.004099a0
nop
jmp 0x40997b
mov eax, dword [ebp - 0x140cc]
cdq
push edx
push eax
lea ecx, [ebp - 0x14014]
push ecx
lea ecx, [ebp - 0x140c4]
call fcn.004106b0
nop
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp - 0x140cc]
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0x14000
jle 0x4098ef
mov dword [ebp - 0x140d8], 0x14000
jmp 0x4098f8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x140d8], eax
mov ecx, dword [ebp - 0x140d8]
mov dword [ebp - 0x140dc], ecx
jmp 0x40991e
mov dword [ebp - 4], 1
jmp 0x40993c
jmp 0x4097c7
lea ecx, [ebp - 0x140c4]
call fcn.0040e5f0
nop
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140c4]
call fcn.004099a0
nop
jmp 0x40997b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043d0e7
mov esp, ebp
pop ebp
ret
Function at 0x40eb40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4771c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x40eb6a
jl 0x40eb61
cmp dword [ebp + 0xc], 0
ja 0x40eb6a
xor eax, eax
xor edx, edx
jmp 0x40eca2
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x40eb8c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.0040fe70
jmp 0x40eca2
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.004147a0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x40ebfc
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.0040ecc0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00414900
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00416e30
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00415770
nop
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x40ec93
mov ecx, dword [ebp - 0x10]
call fcn.00414fc0
mov dword [ebp - 0x24], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x40ec6c
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00445d9c
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x40ec6a
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x40eca2
jmp 0x40ec18
cmp dword [ebp - 8], 0
jbe 0x40ec93
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.00445d9c
add esp, 0x10
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d0e7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4215a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461ccd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4771c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push 4
lea ecx, [ebp - 0x14]
call fcn.00401900
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.00423160
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041a730
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.004224b0
nop
mov dword [ebp - 0x24], 0x4231e0
mov edx, dword [ebp - 0x18]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.00401d20
push eax
mov eax, dword [ebp - 0x24]
push eax
push 0
push 0
call fcn.004430f1
add esp, 0x18
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
je 0x42164d
lea ecx, [ebp - 0x14]
call fcn.0041ebd0
nop
jmp 0x42165f
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
push 6
call fcn.00427437
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004224b0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043d0e7
mov esp, ebp
pop ebp
ret 0xc

Function at 0x423d90
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x423daf
mov ecx, dword [ebp - 8]
call fcn.00423e30
nop
jmp 0x423dc3
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x423dc3
mov ecx, dword [ebp - 8]
call fcn.00423ec0
nop
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
shr eax, 0xb
mov ecx, dword [ebp - 8]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
shl edx, 7
and edx, 0x9d2c5680
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0x12
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x423e30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x423e4b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jae 0x423eb7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x423e8f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x423e96
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x423e42
mov esp, ebp
pop ebp
ret
Function at 0x423ec0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], ecx
mov dword [ebp - 0x28], 0x26f
mov dword [ebp - 0x2c], 0xe3
mov dword [ebp - 8], 0
jmp 0x423ee9
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe3
jae 0x423f55
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
and edx, 1
je 0x423f2d
mov dword [ebp - 0x14], 0x9908b0df
jmp 0x423f34
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
shr eax, 1
xor eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [edx + ecx*4 + 4], eax
jmp 0x423ee0
mov dword [ebp - 0xc], 0xe3
jmp 0x423f67
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x26f
jae 0x423fd3
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
and edx, 1
je 0x423fab
mov dword [ebp - 0x1c], 0x9908b0df
jmp 0x423fb2
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
shr eax, 1
xor eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [edx + ecx*4 + 4], eax
jmp 0x423f5e
mov dword [ebp - 0x30], 0x26f
mov eax, 4
imul ecx, eax, 0x4df
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx + 4]
and eax, 0x80000000
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx + 4]
and edx, 0x7fffffff
or eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
and eax, 1
je 0x42401c
mov dword [ebp - 0x24], 0x9908b0df
jmp 0x424023
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
shr ecx, 1
xor ecx, dword [ebp - 0x24]
mov edx, 4
imul eax, edx, 0x18c
mov edx, dword [ebp - 4]
xor ecx, dword [edx + eax + 4]
mov eax, 4
imul edx, eax, 0x26f
mov eax, dword [ebp - 4]
mov dword [eax + edx + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov esp, ebp
pop ebp
ret

Function at 0x42f28a
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x42f2ad
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x42f29b
mov eax, ecx
pop esi
pop ebp
ret