joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f9af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x48]
mov ecx, ebp
shr ecx, 5
lea edx, [ecx + 1]
cmp ebp, edx
jb 0x4f9d11
mov eax, dword [esp + 0x44]
add eax, ebp
mov ebx, ebp
mov edi, dword [esp + 0x44]
not edi
add edi, edx
sub edi, ecx
lea esi, [esi]
mov esi, ebx
shr esi, 2
mov ecx, ebx
shl ecx, 5
add ecx, esi
mov dword [esp + 0x18], ecx
mov cl, byte [eax - 1]
and ecx, 0xff
mov esi, ecx
mov ecx, dword [esp + 0x18]
add ecx, esi
xor ebx, ecx
sub eax, edx
lea ecx, [edi + eax]
cmp edx, ecx
jbe 0x4f9b20
mov eax, dword [esp + 0x40]
mov esi, dword [eax + 0x10]
mov eax, dword [esi + 8]
dec eax
and eax, ebx
mov edx, dword [esi]
mov edi, dword [edx + eax*4]
test edi, edi
je 0x4f9bc4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x44]
jmp 0x4f9b76
mov edi, dword [edi]
test edi, edi
je 0x4f9bc0
cmp dword [edi + 0xc], ebp
jne 0x4f9b70
mov dword [esp + 8], ebp
lea eax, [edi + 0x10]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.0062b690
test eax, eax
jne 0x4f9b70
mov edx, edi
mov esi, dword [esp + 0x1c]
mov cl, byte [edi + 5]
mov bl, cl
and ebx, 3
mov al, byte [esi + 0x14]
xor eax, 3
test bl, al
je 0x4f9bb0
xor ecx, 3
mov byte [edi + 5], cl
mov eax, edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [esp + 0x18]
lea eax, [ebp + 1]
cmp eax, 0xffffffed
ja 0x4f9d00
lea eax, [ebp + 0x11]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.004fa3a0
mov edx, eax
mov dword [eax + 0xc], ebp
mov dword [eax + 8], ebx
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx + 0x10]
mov al, byte [eax + 0x14]
and eax, 3
mov byte [edx + 5], al
mov byte [edx + 4], 4
mov byte [edx + 6], 0
mov eax, ebp
lea edi, [edx + 0x10]
mov esi, dword [esp + 0x44]
cmp ebp, 4
jae 0x4f9cd0
xor ecx, ecx
test al, 2
jne 0x4f9cb0
test al, 1
jne 0x4f9ca0
mov byte [edx + ebp + 0x10], 0
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + 8]
dec ecx
and ecx, ebx
shl ecx, 2
mov ebx, dword [eax]
mov ebx, dword [ebx + ecx]
mov dword [edx], ebx
mov ebx, dword [eax]
mov dword [ebx + ecx], edx
mov ecx, dword [eax + 4]
inc ecx
mov dword [eax + 4], ecx
mov eax, dword [eax + 8]
cmp ecx, eax
jbe 0x4f9bb0
cmp eax, 0x3ffffffe
jg 0x4f9bb0
add eax, eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 0x14], edx
call fcn.004f99d0
mov edx, dword [esp + 0x14]
mov eax, edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov al, byte [esi + ecx]
mov byte [edi + ecx], al
jmp 0x4f9c33
mov cx, word [esi]
mov word [edi], cx
mov ecx, 2
test al, 1
je 0x4f9c33
jmp 0x4f9ca0
test edi, 1
jne 0x4f9d29
test edi, 2
jne 0x4f9d18
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
test al, 2
je 0x4f9c2f
jmp 0x4f9cb0
mov ecx, dword [esp + 0x40]
mov dword [esp], ecx
call fcn.004fa380
jmp 0x4f9bd0
mov ebx, ebp
jmp 0x4f9b4c
mov cx, word [esi]
mov word [edi], cx
add edi, 2
add esi, 2
sub eax, 2
jmp 0x4f9ce0
mov al, byte [esi]
mov byte [edi], al
lea edi, [edx + 0x11]
inc esi
lea eax, [ebp - 1]
jmp 0x4f9cd8
Function at 0x51acd3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
shr eax, 8
mov dl, al
mov eax, dword [ebp + 8]
xor eax, edx
mov byte [ebp - 9], al
xor eax, eax
mov al, byte [ebp - 9]
shl eax, 3
add eax, 0x7aaec0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x51ad45
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, dword [ebp + 8]
jne 0x51ad3e
mov eax, dword [ebp - 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
lea edx, [eax + 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
lea edx, [eax + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx], eax
jmp 0x51ad74
inc dword [ebp - 4]
add dword [ebp - 8], 0x10
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
and eax, 0xff
cmp eax, dword [ebp - 4]
ja 0x51ad0b
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
add eax, 8
mov dword [eax], 0
leave
ret
Function at 0x523880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
test esi, esi
je 0x523a40
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x1c]
test edx, edx
jne 0x523a30
lea edi, [esi + 4]
mov ebx, dword [esi]
test ebx, ebx
je 0x523a20
lea esi, [esi]
mov eax, dword [ebx]
test eax, eax
je 0x5238be
mov dword [esp], ebx
call fcn.00530b60
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x5238d0
lea eax, [ebx + 0x14]
mov dword [esp], eax
call fcn.00530b60
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x5238e2
lea eax, [ebx + 0x28]
mov dword [esp], eax
call fcn.00530b60
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x5238f4
lea eax, [ebx + 0x3c]
mov dword [esp], eax
call fcn.00530b60
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x523906
lea eax, [ebx + 0x50]
mov dword [esp], eax
call fcn.00530b60
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0x523918
lea eax, [ebx + 0x64]
mov dword [esp], eax
call fcn.00530b60
mov edx, dword [ebx + 0x78]
test edx, edx
je 0x52392a
lea eax, [ebx + 0x78]
mov dword [esp], eax
call fcn.00530b60
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x523942
lea eax, [ebx + 0x8c]
mov dword [esp], eax
call fcn.00530b60
mov eax, dword [ebx + 0xa0]
test eax, eax
je 0x52395a
lea eax, [ebx + 0xa0]
mov dword [esp], eax
call fcn.00530b60
mov eax, dword [ebx + 0xb4]
test eax, eax
je 0x523972
lea eax, [ebx + 0xb4]
mov dword [esp], eax
call fcn.00530b60
mov eax, dword [ebx + 0xc8]
test eax, eax
je 0x52398a
lea eax, [ebx + 0xc8]
mov dword [esp], eax
call fcn.00530b60
mov eax, dword [ebx + 0xdc]
test eax, eax
je 0x5239a2
lea eax, [ebx + 0xdc]
mov dword [esp], eax
call fcn.00530b60
mov eax, dword [ebx + 0xf0]
test eax, eax
je 0x5239ba
lea eax, [ebx + 0xf0]
mov dword [esp], eax
call fcn.00530b60
mov ecx, dword [ebx + 0x104]
test ecx, ecx
je 0x5239d2
lea eax, [ebx + 0x104]
mov dword [esp], eax
call fcn.00530b60
mov edx, dword [ebx + 0x118]
test edx, edx
je 0x5239ea
lea eax, [ebx + 0x118]
mov dword [esp], eax
call fcn.00530b60
mov eax, dword [ebx + 0x12c]
test eax, eax
je 0x523a02
add ebx, 0x12c
mov dword [esp], ebx
call fcn.00530b60
mov eax, dword [esi]
mov edx, dword [eax + 0x144]
mov dword [edi], edx
mov dword [esp], eax
call fcn.0052e370
mov ebx, dword [edi]
mov dword [esi], ebx
test ebx, ebx
jne 0x5238b0
mov dword [esp + 0x20], esi
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.0052e370
mov dword [esp], eax
call fcn.0052e370
jmp 0x5238a0
add esp, 0x10
pop ebx
pop esi
pop edi
ret

Function at 0x529820
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov edi, edx
mov ebx, 0x5c
test dl, 1
jne 0x529880
test edi, 2
jne 0x529890
mov ecx, ebx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
test bl, 2
je 0x529850
mov word [edi], 0
add edi, 2
and ebx, 1
je 0x529858
mov byte [edi], 0
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov eax, 1
pop ebx
pop edi
ret
mov byte [edx], 0
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
je 0x52983a
mov word [edi], 0
add edi, 2
sub ebx, 2
jmp 0x52983a
Function at 0x529e20
Capabilities:
Hash data using sha1

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov edi, edx
mov ebx, 0x60
test dl, 1
jne 0x529e90
test edi, 2
jne 0x529ea0
mov ecx, ebx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
test bl, 2
je 0x529e50
mov word [edi], 0
add edi, 2
and ebx, 1
je 0x529e58
mov byte [edi], 0
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
mov eax, 1
pop ebx
pop edi
ret
mov byte [edx], 0
lea edi, [edx + 1]
mov bl, 0x5f
test edi, 2
je 0x529e3a
mov word [edi], 0
add edi, 2
sub ebx, 2
jmp 0x529e3a

Function at 0x52a280
Capabilities:
Hash data using sha256

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov edi, edx
mov ebx, 0x70
test dl, 1
jne 0x52a300
test edi, 2
jne 0x52a310
mov ecx, ebx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
test bl, 2
je 0x52a2b0
mov word [edi], 0
add edi, 2
and ebx, 1
je 0x52a2b8
mov byte [edi], 0
mov dword [edx], 0x6a09e667
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x6c], 0x20
mov eax, 1
pop ebx
pop edi
ret
mov byte [edx], 0
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
je 0x52a29a
mov word [edi], 0
add edi, 2
sub ebx, 2
jmp 0x52a29a
Function at 0x53ef10
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x53ef60
movsx eax, byte [ebx]
test al, al
je 0x53ef60
xor edx, edx
mov esi, 0x100
nop
lea esi, [esi]
or eax, esi
add esi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
rol edx, cl
imul eax, eax
xor edx, eax
inc ebx
movsx eax, byte [ebx]
test al, al
jne 0x53ef30
mov eax, edx
shr eax, 0x10
xor eax, edx
pop ebx
pop esi
ret
xor eax, eax
pop ebx
pop esi
ret
Function at 0x65fe24
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push ebx
sub esp, 0x10
mov dword [esp], 0x9c4
call fcn.0071ed10
mov ebx, eax
mov dword [eax], 0x1571
mov dword [eax + 0x9c0], 1
mov eax, dword [ebx + 0x9c0]
cmp eax, 0x26f
ja 0x65fe78
mov ecx, dword [ebx + eax*4 - 4]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [ebx + eax*4], edx
inc eax
mov dword [ebx + 0x9c0], eax
jmp 0x65fe4c
mov dword [esi], ebx
mov dword [esi + 4], 0
mov dword [esp], 0x10
call fcn.0071ed10
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], 0x81a7f8
mov dword [eax + 0xc], ebx
mov dword [esi + 4], eax
mov eax, dword [esi]
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 8], eax
mov dword [esp], eax
call fcn.0065ff9c
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x660250
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov edx, ecx
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x168
movzx eax, byte [edx + 0x14]
add edx, 4
movzx esi, byte [edx + 0x11]
shl eax, 0x18
shl esi, 0x10
or eax, esi
movzx esi, byte [edx + 0x13]
or eax, esi
movzx esi, byte [edx + 0x12]
shl esi, 8
or eax, esi
mov dword [ebp + ebx*4 - 0x14c], eax
inc ebx
cmp ebx, 0x10
jne 0x660260
lea edx, [ebp - 0x118]
lea ebx, [ebp - 0x18]
mov eax, dword [edx - 0x14]
add edx, 4
xor eax, dword [edx - 4]
xor eax, dword [edx - 0x30]
xor eax, dword [edx - 0x38]
ror eax, 0x1f
mov dword [edx + 8], eax
cmp edx, ebx
jne 0x660298
mov edi, dword [ecx + 4]
mov eax, dword [ecx]
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x150], 0
mov ebx, edi
mov dword [ebp - 0x168], edi
mov edi, dword [ecx + 8]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x174], esi
mov dword [ebp - 0x15c], esi
mov edx, edi
mov dword [ebp - 0x16c], edi
mov edi, dword [ecx + 0xc]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x170], edi
cmp dword [ebp - 0x150], 0x13
ja 0x660318
mov eax, ebx
mov esi, edx
not eax
and esi, ebx
and eax, edi
or eax, esi
mov dword [ebp - 0x154], 0x5a827999
jmp 0x660364
cmp dword [ebp - 0x150], 0x27
ja 0x660333
mov eax, edx
xor eax, ebx
xor eax, edi
mov dword [ebp - 0x154], 0x6ed9eba1
jmp 0x660364
cmp dword [ebp - 0x150], 0x3b
ja 0x660354
mov eax, edi
mov esi, edi
or eax, edx
and esi, edx
and eax, ebx
or eax, esi
mov dword [ebp - 0x154], 0x8f1bbcdc
jmp 0x660364
mov eax, edx
xor eax, ebx
xor eax, edi
mov dword [ebp - 0x154], 0xca62c1d6
mov esi, dword [ebp - 0x158]
ror ebx, 2
ror esi, 0x1b
mov dword [ebp - 0x160], esi
mov esi, dword [ebp - 0x150]
inc dword [ebp - 0x150]
mov esi, dword [ebp + esi*4 - 0x14c]
add dword [ebp - 0x160], esi
add eax, dword [ebp - 0x160]
add eax, dword [ebp - 0x154]
add eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x150], 0x50
je 0x6603c5
mov dword [ebp - 0x15c], edi
mov edi, edx
mov edx, ebx
mov ebx, dword [ebp - 0x158]
mov dword [ebp - 0x158], eax
jmp 0x6602f7
add eax, dword [ebp - 0x164]
add ebx, dword [ebp - 0x16c]
add edx, dword [ebp - 0x170]
mov dword [ecx], eax
mov eax, dword [ebp - 0x158]
add eax, dword [ebp - 0x168]
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x174]
add eax, edi
mov dword [ecx + 0x10], eax
add esp, 0x168
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x660430
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x76272c
push ebx
mov ebx, ecx
sub esp, 0xac
mov ecx, 5
lea edi, [ebp - 0xa4]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x90]
lea edi, [ebp - 0xa4]
lea ecx, [ebp - 0x78]
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [ebp - 0x78], 0x67452301
mov dword [ebp - 0x74], 0xefcdab89
mov dword [ebp - 0x70], 0x98badcfe
mov dword [ebp - 0x6c], 0x10325476
mov dword [ebp - 0x68], 0xc3d2e1f0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xa8], 0x76272c
call fcn.00660170
lea ecx, [ebp - 0x78]
push eax
push eax
lea eax, [ebp - 0xa8]
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.00660170
push eax
push eax
mov dword [esp], 0
call fcn.0062b620
lea ecx, [ebp - 0x78]
mov dword [esp], esi
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x88]
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], edx
call fcn.00660170
push eax
push eax
call fcn.0062b628
lea ecx, [ebp - 0x78]
mov dword [esp], esi
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x8c]
mov dword [esp + 4], eax
call fcn.00660170
push edx
push edx
call fcn.0062b630
mov dword [ebp - 0x90], eax
call fcn.0062b630
mov dword [ebp - 0x8c], eax
call fcn.0062b630
lea ecx, [ebp - 0x78]
mov dword [esp], esi
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
mov dword [esp + 4], eax
call fcn.00660170
mov eax, dword [ebx + 0x18]
test eax, eax
push ecx
push ecx
je 0x660572
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x14
mov dword [esp + 4], 1
mov dword [esp], esi
call fcn.0062b638
lea eax, [ebp - 0x7c]
lea ecx, [ebp - 0x78]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00660170
push ecx
push ecx
mov dword [esp], 4
call fcn.0071ed10
lea ecx, [ebp - 0x78]
lea edx, [eax + 4]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [ebp - 0x90], eax
call fcn.00660170
lea eax, [ebp - 0x8c]
lea ecx, [ebp - 0x78]
push edi
push edi
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00660170
push eax
push eax
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
call fcn.0071eb20
lea eax, [ebx + 0x14]
mov dword [esp + 4], eax
lea ecx, [ebp - 0x78]
mov dword [esp], ebx
call fcn.00660170
lea ecx, [ebp - 0x78]
push eax
push eax
mov dword [esp], esi
call fcn.00660064
mov edx, dword [ebp - 0xa8]
push eax
xor eax, eax
mov ecx, dword [ebp + eax*4 - 0x90]
xor dword [edx + eax*4], ecx
mov ecx, dword [ebp + eax*4 - 0x90]
xor dword [ebx + eax*4], ecx
inc eax
cmp eax, 5
jne 0x6605f9
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6617b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [ecx + 0x9c0], 0x270
push ebp
mov ebp, esp
push esi
push ebx
jne 0x6618a4
xor eax, eax
mov esi, dword [ecx + eax*4]
inc eax
mov ebx, dword [ecx + eax*4]
and esi, 0x80000000
mov edx, ebx
and ebx, 0x7fffffff
and edx, 1
or ebx, esi
imul edx, edx, 0x9908b0df
xor edx, dword [ecx + eax*4 + 0x630]
shr ebx, 1
xor edx, ebx
cmp eax, 0xde
mov dword [ecx + eax*4 - 4], edx
jne 0x6617c7
mov esi, dword [ecx + eax*4]
inc eax
mov ebx, dword [ecx + eax*4]
and esi, 0x80000000
mov edx, ebx
and ebx, 0x7fffffff
and edx, 1
or ebx, esi
imul edx, edx, 0x9908b0df
xor edx, dword [ecx + eax*4 + 0x630]
shr ebx, 1
xor edx, ebx
cmp eax, 0xe3
mov dword [ecx + eax*4 - 4], edx
jne 0x6617fd
mov esi, dword [ecx + eax*4]
inc eax
mov ebx, dword [ecx + eax*4]
and esi, 0x80000000
mov edx, ebx
and ebx, 0x7fffffff
and edx, 1
or ebx, esi
imul edx, edx, 0x9908b0df
xor edx, dword [ecx + eax*4 - 0x390]
shr ebx, 1
xor edx, ebx
cmp eax, 0x26f
mov dword [ecx + eax*4 - 4], edx
jne 0x661833
mov edx, dword [ecx]
mov ebx, dword [ecx + 0x9bc]
mov dword [ecx + 0x9c0], 0
mov eax, edx
and edx, 0x7fffffff
and eax, 1
and ebx, 0x80000000
imul eax, eax, 0x9908b0df
or edx, ebx
xor eax, dword [ecx + 0x630]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9bc], eax
mov edx, dword [ecx + 0x9c0]
pop ebx
pop esi
pop ebp
mov eax, dword [ecx + edx*4]
inc edx
mov dword [ecx + 0x9c0], edx
mov edx, eax
shr edx, 0xb
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x6aa5e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x2c
mov ecx, dword [ebp + 8]
mov dword [esp], str.mt19937
call fcn.00678470
mov edx, 0x1571
sub esp, 4
test eax, eax
jne 0x6aa661
mov dword [esi], edx
mov eax, edx
mov ebx, 1
mov edi, 0x1a41a41b
jmp 0x6aa61a
mov eax, dword [esi + ebx*4 - 4]
mov ecx, eax
mov edx, ebx
shr edx, 4
shr ecx, 0x1e
xor ecx, eax
mov eax, edx
mul edi
mov eax, ebx
imul ecx, ecx, 0x6c078965
shr edx, 2
imul edx, edx, 0x270
sub eax, edx
add ecx, eax
mov dword [esi + ebx*4], ecx
add ebx, 1
cmp ebx, 0x270
jne 0x6aa616
mov dword [esi + 0x9c0], 0x270
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0062b788
cmp byte [ebx], 0
mov edx, eax
je 0x6aa690
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0
je 0x6aa606
mov dword [esp], str.random_device::_M_strtoul_const_std::string_
call fcn.00704290
nop
nop
nop
nop
Function at 0x6e6880
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
push esi
mov esi, 0x270
push ebx
mov ebx, 1
mov dword [ecx], eax
mov eax, dword [ecx + ebx*4 - 4]
mov edx, eax
shr edx, 0x1e
xor edx, eax
mov eax, ebx
imul edi, edx, 0x6c078965
xor edx, edx
div esi
add edx, edi
mov dword [ecx + ebx*4], edx
inc ebx
cmp ebx, 0x270
jne 0x6e6895
pop ebx
mov dword [ecx + 0x9c0], 0x270
pop esi
pop edi
pop ebp
ret 4

Function at 0x6e6a10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [ecx + 0x9c0], 0x26f
push ebp
mov ebp, esp
push ebx
jbe 0x6e6ad1
xor eax, eax
mov ebx, dword [ecx + eax*4]
inc eax
mov edx, dword [ecx + eax*4]
and ebx, 0x80000000
and edx, 0x7fffffff
or edx, ebx
mov ebx, edx
and edx, 1
shr ebx, 1
neg edx
xor ebx, dword [ecx + eax*4 + 0x630]
and edx, 0x9908b0df
xor ebx, edx
cmp eax, 0xe3
mov dword [ecx + eax*4 - 4], ebx
jne 0x6e6a26
mov ebx, dword [ecx + eax*4]
inc eax
mov edx, dword [ecx + eax*4]
and ebx, 0x80000000
and edx, 0x7fffffff
or edx, ebx
mov ebx, edx
and edx, 1
shr ebx, 1
neg edx
xor ebx, dword [ecx + eax*4 - 0x390]
and edx, 0x9908b0df
xor ebx, edx
cmp eax, 0x26f
mov dword [ecx + eax*4 - 4], ebx
jne 0x6e6a5e
mov edx, dword [ecx + 0x9bc]
mov eax, dword [ecx]
mov dword [ecx + 0x9c0], 0
and edx, 0x80000000
and eax, 0x7fffffff
or eax, edx
mov edx, eax
and eax, 1
shr edx, 1
neg eax
xor edx, dword [ecx + 0x630]
and eax, 0x9908b0df
xor edx, eax
mov dword [ecx + 0x9bc], edx
mov eax, dword [ecx + 0x9c0]
pop ebx
pop ebp
lea edx, [eax + 1]
mov eax, dword [ecx + eax*4]
mov dword [ecx + 0x9c0], edx
mov edx, eax
shr edx, 0xb
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x701ef0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push edi
push esi
push ebx
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
xor eax, edi
cmp edi, 3
jbe 0x701f7f
lea ecx, [edi - 4]
shr ecx, 2
lea esi, [edx + ecx*4 + 4]
imul ebx, dword [edx], 0x5bd1e995
add edx, 4
mov ecx, ebx
shr ecx, 0x18
xor ecx, ebx
imul ebx, eax, 0x5bd1e995
imul eax, ecx, 0x5bd1e995
xor eax, ebx
cmp edx, esi
jne 0x701f10
and edi, 3
cmp edi, 2
je 0x701f69
cmp edi, 3
je 0x701f60
cmp edi, 1
je 0x701f72
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0x5bd1e995
pop ebx
pop esi
pop edi
mov eax, edx
shr eax, 0xf
xor eax, edx
ret
movzx edx, byte [esi + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [esi + 1]
shl edx, 8
xor eax, edx
movzx edx, byte [esi]
xor edx, eax
imul eax, edx, 0x5bd1e995
jmp 0x701f44
mov esi, edx
jmp 0x701f35
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3a1766fd
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x9722714
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
jmp 0x401219