joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4020a2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x250
mov dword [esp + 0x10], 0xab0a
mov dword [esp + 0xc], 0xffff3ca0
mov dword [esp + 8], 0x1684
mov dword [esp + 4], 0xfffe7e88
mov dword [esp], 0xffffe4c2
call fcn.00401ba1
mov dword [ebp - 0x14], eax
mov dword [esp + 0x1c], 0x8aef
mov dword [esp + 0x18], 0xfffe8854
mov dword [esp + 0x14], 0x14aed
mov dword [esp + 0x10], 0xac9d
mov dword [esp + 0xc], 0xfffefce1
mov dword [esp + 8], 0xffff7555
mov dword [esp + 4], 0x8b62
mov dword [esp], 0xae84
call fcn.00401c9c
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword fs:[eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x14
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x236]
mov ecx, 0x1fe
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
jmp 0x40229c
mov dword [esp + 0x1c], 0xffff65d0
mov dword [esp + 0x18], 0xffff62c3
mov dword [esp + 0x14], 0x745e
mov dword [esp + 0x10], 0xffff42ea
mov dword [esp + 0xc], 0xfffe9e11
mov dword [esp + 8], 0x15bd2
mov dword [esp + 4], 0xffffb2a2
mov dword [esp], 0x2959
call fcn.00401dfb
shl eax, 3
neg eax
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add eax, 0x2c
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.00401672
mov dword [ebp - 0x30], eax
mov dword [esp + 0x1c], 0xffff32b5
mov dword [esp + 0x18], 0xfffef187
mov dword [esp + 0x14], 0x9dde
mov dword [esp + 0x10], 0x91cc
mov dword [esp + 0xc], 0x13efa
mov dword [esp + 8], 0xfffec0bc
mov dword [esp + 4], 0x1616f
mov dword [esp], 0xffffaaa6
call fcn.00401fc1
mov dword [ebp - 0x10], eax
jmp 0x402267
mov eax, dword [ebp - 0x10]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x2c]
add eax, edx
movzx eax, word [eax]
movzx eax, ax
mov dword [esp], eax
call fcn.00401b3d
movsx dx, al
mov eax, dword [ebp - 0x10]
mov word [ebp + eax*2 - 0x236], dx
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x30]
jle 0x40223b
lea eax, [ebp - 0x236]
mov dword [esp], eax
call fcn.004019e4
cmp dword [ebp + 8], eax
jne 0x402290
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x4022ab
add dword [ebp - 0xc], 8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x20]
jne 0x402186
mov eax, dword [ebp - 0x14]
add esp, 0x250
pop ebx
pop edi
pop ebp
ret
Function at 0x4026ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [esp + 0x10], 0xffff14e4
mov dword [esp + 0xc], 0xffff1ae5
mov dword [esp + 8], 0xfffef0fc
mov dword [esp + 4], 0xfffe98d4
mov dword [esp], 0xf035
call fcn.004022b5
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x78]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x20], eax
mov dword [esp + 0x1c], 0x275c
mov dword [esp + 0x18], 0xffffee18
mov dword [esp + 0x14], 0xffffdb0d
mov dword [esp + 0x10], 0x768f
mov dword [esp + 0xc], 0x247
mov dword [esp + 8], 0xffff3734
mov dword [esp + 4], 0xffff5adc
mov dword [esp], 0xa816
call fcn.004023a6
mov dword [ebp - 8], eax
jmp 0x402803
mov eax, dword [ebp - 8]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1c]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [esp], eax
call fcn.004017aa
cmp dword [ebp + 0xc], eax
jne 0x4027ff
mov eax, dword [ebp - 8]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x20]
add eax, edx
movzx eax, word [eax]
movzx eax, ax
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x40280e
add dword [ebp - 8], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
cmp dword [ebp - 8], eax
jb 0x4027b8
cmp dword [ebp - 4], 0
je 0x40281e
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
add eax, edx
jmp 0x402862
mov dword [esp + 0x1c], 0xffffb911
mov dword [esp + 0x18], 0xffff327a
mov dword [esp + 0x14], 0xab19
mov dword [esp + 0x10], 0xffff91c3
mov dword [esp + 0xc], 0x4550
mov dword [esp + 8], 0xfffec794
mov dword [esp + 4], 0xffff1903
mov dword [esp], 0xffff82ad
call fcn.00402542
leave
ret

Function at 0x4035d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00404310
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00404310
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x403630
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x408074]
test esi, esi
jle 0x403750
mov eax, dword [0x408078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x403664
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4036e7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x403650
mov dword [esp], ebx
call fcn.00404020
mov edi, eax
test eax, eax
je 0x403777
mov eax, dword [0x408078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00404160
mov edx, dword [0x408078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x403757
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4036e0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4036f0
add dword [0x408074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x408078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4036e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004035d0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40366e
mov eax, dword [0x408078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004035d0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004035d0
lea esi, [esi]
nop

Function at 0x403c90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x408090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x408088]
sub esp, 4
test ebx, ebx
je 0x403ce5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x403cde
test esi, esi
je 0x403cde
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403cc0
mov dword [esp], 0x408090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404020
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x404045
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x404050
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x404045
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x404098
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40408e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40409a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x404080
xor eax, eax
pop ebx
pop esi
ret
Function at 0x402260
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40229a
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x4022a1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x402280
jmp 0x4022a3
mov eax, 0x1505
jmp 0x4022a3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x4029a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x402ab9
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x402ab2
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
nop
nop
nop
xor eax, eax
cmp esi, 8
mov dword [esp], ebx
jb 0x402a74
mov eax, esi
and eax, 0x1ff8
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
movzx ebx, byte [ebp + ebx]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 1]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 2]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 3]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 4]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 5]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 6]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add ecx, edi
lea ebx, [edx + 8]
add edx, 0xf
cmp edx, esi
jb 0x402a00
add ebp, ebx
jmp 0x402a74
movzx edx, byte [ebp]
inc ebp
add edi, edx
add ecx, edi
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, esi
jb 0x402a60
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov ebx, dword [esp]
sub ebx, esi
mov esi, 0x15b0
jne 0x4029e0
shl ecx, 0x10
or ecx, edi
jmp 0x402abe
mov ecx, 1
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402ad0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402b03
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
lea eax, [edx + edx]
not eax
add eax, edx
test ebx, ebx
je 0x402b9a
test bl, 1
jne 0x402b0a
mov edx, ebx
cmp ebx, 1
jne 0x402b3b
jmp 0x402b9a
xor eax, eax
jmp 0x402b9c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x43a80c]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x43a80c]
cmp ebx, 1
je 0x402b9a
xor esi, esi
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43a80c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43a80c]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43a80c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43a80c]
add esi, 2
cmp edx, esi
jne 0x402b40
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x407f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407f7b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x407f83
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x40801b
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x407fc9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x40802a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x407fde
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x407ff0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x407fb0
jmp 0x407ff9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x407fb0
cmp edi, ebx
jge 0x408010
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x407fb4
jmp 0x408014
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x407fbd
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x4080b2
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x4080b2
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x408064
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x408050
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x4080b2
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x408070
dec eax
mov ecx, 1
xor esi, esi
jmp 0x4080cc
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x407f7b
test edx, edx
mov dword [esp], ecx
js 0x408100
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x408110
inc ebp
dec edx
cmp edi, ebp
jne 0x4080e0
mov edx, 0xffffffff
jmp 0x408112
xor edi, edi
jmp 0x408115
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x4080c0
and ebp, 3
je 0x408148
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x408130
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x40814a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x4080c0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x408160
jmp 0x4080c0
Function at 0x408ab0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, dword [esp + 8]
mov dword [0x442298], edx
mov eax, 0xfffffd92
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x6c078965
mov esi, ecx
or ecx, 0x6c078965
imul ecx, edx
xor edx, 0x6c078965
and esi, 0x93f8769a
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x26f
mov dword [eax*4 + 0x442c54], edx
test eax, eax
je 0x408b3f
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x6c078965
mov esi, ecx
or ecx, 0x6c078965
imul ecx, edx
xor edx, 0x6c078965
and esi, 0x93f8769a
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x270
mov dword [eax*4 + 0x442c58], edx
add eax, 2
jmp 0x408ac0
mov dword [0x442294], 0x270
pop esi
ret

Function at 0x408d70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408dd2
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x408d90
mov eax, 0x270
jmp 0x408de4
cmp eax, 0x4e0
jb 0x408de4
mov esi, ecx
call fcn.00408e30
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
mov ecx, eax
and ecx, edx
add ecx, ecx
sub eax, ecx
add eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
mov edx, ecx
and edx, eax
add edx, edx
sub ecx, edx
add ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret
Function at 0x408e30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, dword [ecx + 0x9c4]
mov eax, 0x3fe
jmp 0x408e66
shr esi, 1
xor esi, dword [ecx + eax*4]
xor esi, edi
mov dword [ecx + eax*4 - 0xff4], esi
inc eax
cmp eax, 0x4e1
je 0x408e97
mov esi, edx
and esi, 0x80000000
mov edx, dword [ecx + eax*4 - 0x630]
lea edi, [edx - 0x80000000]
mov ebx, edx
or ebx, 0x7fffffff
and ebx, edi
or esi, ebx
mov edi, esi
xor edi, 0xfffffffe
and edi, ebx
je 0x408e50
mov edi, 0x9908b0df
jmp 0x408e50
mov edi, dword [ecx + 0xd50]
mov eax, 0xe4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [eax - 1]
and edi, 0x80000000
mov ebx, dword [ecx + eax*4 + 0x9c4]
mov esi, ebx
and esi, 0x7ffffffe
or esi, edi
shr esi, 1
mov edi, ebx
and ebx, 1
neg ebx
and ebx, 0x9908b0df
mov ebp, edx
or ebp, 0x3ffffd8f
and edx, 0x18f
add edx, ebp
xor ebx, dword [ecx + edx*4 + 0x63c]
xor ebx, esi
mov dword [ecx + eax*4], ebx
inc eax
cmp eax, 0x270
jne 0x408eb0
mov esi, 0x80000000
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b220
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44364c]
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40b2ce
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x43d988]
xor eax, eax
jmp 0x40b878
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x414020
Capabilities:
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x418
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x414040
mov eax, ebx
sar eax, 1
mov dword [esp + 0xd8], eax
cmp eax, 0xfffffff2
jge 0x414062
mov eax, 0xffffffff
jmp 0x414065
lea eax, [ebx + 0x1c]
push eax
call fcn.00408310
add esp, 4
mov esi, eax
mov dword [esp + 0x290], 0xe3aee1bc
mov dword [esp + 0x294], 0xe795e585
mov dword [esp + 0x298], 0xebcae99c
mov dword [esp + 0x29c], 0xef8bedba
mov dword [esp + 0x2a0], 0xf381f182
mov dword [esp + 0x2a4], 0xf799f59d
mov dword [esp + 0x2a8], 0xfbfaf996
xor eax, eax
nop
movzx ecx, byte [esp + eax + 0x290]
xor cl, al
xor cl, 0xe0
mov byte [esp + eax + 0x290], cl
inc eax
cmp eax, 0x1c
jne 0x4140c0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x414101
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4140f0
mov word [eax], 0
movzx ecx, word [esp + 0x290]
test cx, cx
je 0x414131
lea edx, [esp + 0x292]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414120
mov word [eax], 0
lea eax, [esp + 0x110]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.004390d0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43e6e0]
Function at 0x418380
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov dword [ecx], 0
mov dword [esp], 0x751d73e5
mov dword [esp + 4], 0x791b7718
mov dword [esp + 8], 0x7d2c7b05
mov dword [esp + 0xc], 0x61307f2e
mov dword [esp + 0x10], 0x65646332
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x62
xor cl, byte [esp + eax]
add cl, 0xf0
mov byte [esp + eax], cl
inc eax
cmp eax, 0x14
jne 0x4183c0
lea edi, [esi + 4]
movzx eax, word [esp]
mov ebx, edi
test ax, ax
je 0x418401
lea ecx, [esp + 2]
mov ebx, edi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], ax
add ebx, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4183f0
mov word [ebx], 0
call fcn.00408b50
mov ecx, eax
mov ebp, 0x51eb851f
mul ebp
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, ecx
and eax, 0x7d
mov edx, ecx
and edx, 2
or ecx, 2
imul ecx, edx
xor edx, 2
imul edx, eax
movsx eax, byte [edx + ecx + 0x43b2bc]
mov word [ebx], ax
movsx eax, byte [edx + ecx + 0x43b2bd]
mov word [ebx + 2], ax
call fcn.00408b50
mov ecx, eax
mul ebp
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, ecx
and eax, 0x7d
mov edx, ecx
and edx, 2
or ecx, 2
imul ecx, edx
xor edx, 2
imul edx, eax
movsx eax, byte [edx + ecx + 0x43b2bc]
mov word [ebx + 4], ax
movsx eax, byte [edx + ecx + 0x43b2bd]
mov word [ebx + 6], ax
mov word [ebx + 8], 0x5f
call fcn.00408b50
movzx eax, al
add eax, eax
movsx ecx, byte [eax + 0x43b385]
mov word [ebx + 0xa], cx
movsx eax, byte [eax + 0x43b386]
mov word [ebx + 0xc], ax
call fcn.00408b50
movzx eax, al
add eax, eax
movsx ecx, byte [eax + 0x43b385]
mov word [ebx + 0xe], cx
movsx eax, byte [eax + 0x43b386]
mov word [ebx + 0x10], ax
call fcn.00408b50
movzx eax, al
add eax, eax
movsx ecx, byte [eax + 0x43b385]
mov word [ebx + 0x12], cx
movsx eax, byte [eax + 0x43b386]
mov word [ebx + 0x14], ax
call fcn.00408b50
movzx eax, al
add eax, eax
movsx ecx, byte [eax + 0x43b385]
mov word [ebx + 0x16], cx
movsx eax, byte [eax + 0x43b386]
mov word [ebx + 0x18], ax
call fcn.00408b50
movzx eax, al
add eax, eax
movsx ecx, byte [eax + 0x43b385]
mov word [ebx + 0x1a], cx
movsx eax, byte [eax + 0x43b386]
mov word [ebx + 0x1c], ax
call fcn.00408b50
movzx eax, al
add eax, eax
movsx ecx, byte [eax + 0x43b385]
mov word [ebx + 0x1e], cx
movsx eax, byte [eax + 0x43b386]
mov word [ebx + 0x20], ax
call fcn.00408b50
movzx eax, al
add eax, eax
movsx ecx, byte [eax + 0x43b385]
mov word [ebx + 0x22], cx
movsx eax, byte [eax + 0x43b386]
mov word [ebx + 0x24], ax
call fcn.00408b50
movzx eax, al
add eax, eax
movsx ecx, byte [eax + 0x43b385]
mov word [ebx + 0x26], cx
movsx eax, byte [eax + 0x43b386]
mov word [ebx + 0x28], ax
mov word [ebx + 0x2a], 0
push 0x65ba7050
push dword [0x4449ac]
call fcn.00438950
add esp, 8
push 0
push 0xf00c7
push 0
push 0
push 0
push edi
call eax
mov dword [esi], eax
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret