joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4034c5
Capabilities:
Encode data using xor

Disassembly:
pushal
movzx eax, ax
lea esi, [0x969558d5]
mov dl, al
and dl, al
adc al, ah
xchg ebx, ebx
test ebp, edi
mov bh, 0x1e
dec edi
mov ebp, eax
test edx, ebx
mov ah, 0x61
mov dl, cl
push 0xcde7ce
push eax
test esi, 0x6825107f
imul edi, ecx, 0x93d6020a
call 0x403595
imul ebx, ebp, 0xe4d4d2ee
mov dh, ah
lea edx, [0x6f7937dc]
sub ebx, ebp
cmp ebx, 0xc68d
jo 0x40351e
mov al, 0xb2
test bh, 0x14
mov dl, 0x11
add ecx, edx
dec edi
sub eax, eax
xchg ebx, ebx
mov bl, dl
mov bh, 0xc7
mov ebp, esi
mov edx, 0xea1b0459
mov ebx, 0x4c1f20b0
mov cl, 0xcf
dec ebx
push 0x10501
inc ecx
xor ebx, edi
imul esi, ebx, 0x6c1b7f16
pop edi
mov esi, 0x4ed3d1a3
xchg ecx, ebx
sub edi, 0x10ac2
mov edx, 0xe0be7386
lea edx, [0x52b38c1f]
add eax, edi
imul esi, eax, 0xc5a1e549
test ebx, esi
mov ebp, 0x117fdc58
add eax, 0x5c2
mov bl, 0xbb
imul ebx, ebp
inc edi
xchg cl, bl
mov bh, ch
test ebx, 0xaff1e88a
cmp eax, 0x24c
jbe 0x403523
imul eax, edi, 0x7296b703
sub edx, 0x5fb5f153
test eax, 0x26ceddc1
movsx esi, bx
mov ecx, edx
cmp edx, 0x574
jae 0x4035b6
inc ebp
add cl, cl
mov eax, 0
sub ecx, 0x154a5ee0
mov eax, 0xdaec6
mov ch, 0x17
mov esi, eax
test esi, ebx
sub eax, 0xd41cd
cmp edi, 0xa90e
jo 0x4035e5
adc esi, 0x9e5c8122
mov edx, ebp
inc ecx
xor edi, eax
test edx, 0x4e82ece
pop edi
adc ch, bl
mov ebx, 0xa1b10820
dec edx
xchg ecx, edx
test ebx, edi
test eax, eax
imul eax, edx, 0xbdf90fa
add edi, 0x4de3d
adc eax, 0xb0f25698
mov al, bh
add edi, 0x112
adc eax, 0xbe4ac86e
dec edx
mov ecx, 0xc841dd48
inc bl
lea ecx, [0xad9d26b2]
mov cl, 0x61
push 0x2ffee3
mov ch, dh
test edx, 0x41683fd9
mov ebx, 0xcc5d1d61
xchg bh, al
add cl, 0x84
add bl, dl
mov eax, 0xc29a9e52
imul esi, edx, 0xd7972727
xor ch, ch
push edi
sbb ebp, eax
mov ah, 0xe
and ebx, ebx
or eax, 0x272cd775
sub esi, ecx
dec dh
mov ah, dh
mov ah, bh
mov dh, dl
add ecx, 0xdf09
imul ebx, ecx, 0x98ef5f2b
add ecx, 0x413
imul esi, edx
dec cl
cmp dl, 0x1c
ret
Function at 0x40a4b0
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x3fff00ae
mov eax, 0x8e02
mov edx, 0x515aac05
add byte [ebx + 0x5d], bl
xor eax, 0x90329090
nop
invalid
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
neg eax
sbb eax, eax
neg eax
dec eax
push eax
mov eax, dword [esi + 0x14]
push eax
call dword [0x40c04e]
test eax, eax
mov dword [ebp + 0x14], eax
jne 0x40a496
mov edx, dword [esi + 0x14]
invalid

Function at 0x40b590
Capabilities:
Encode data using xor

Disassembly:
int3
push edi
push esi
push ebx
xor edi, edi
mov eax, dword [esp + 0x14]
or eax, eax
jge 0x40b5b1
mov esi, 0x1024540b
jo 0x40b5ce
neg edx
sbb eax, 0
mov dword [esp - 0x4c], eax
or eax, 0x8b102454
inc esp
and al, 0x5e
mov eax, dword [esp + 0x5e]
or eax, eax
jge 0x40b58b
inc edi
mov edx, dword [esp + 0x18]
neg eax
neg edx
sub eax, 0xb28900d8
mov dl, 0x24
sbb al, 0x89
pop ss
and al, 0x18
or eax, eax
jne 0x40b5e9
sal byte [ebp + 0x18], 0xc3
dec esp
and al, 0x18
mov eax, dword [eax + ebp*8 + 0x14]
xor edx, edx
div ecx
mov ebx, eax
mov edi, ecx
std
adc bh, dh
int1
mov edx, ebx
jmp 0x40b62a
ret
mov ebx, eax
jl 0x40b639
and al, 0x18
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
ror dword [esi - 0x152e262f], 1
rcr eax, 1
adc bl, bl
jne 0x40b5f7
div ecx
sbb eax, esi
neg dword [eax + 0x24]
sbb al, 0x8b
push cs
mov eax, dword [esp + 0x18]
invalid
dec edi
jne 0x40b634
neg edx
neg eax
ret
pop ebx
pop esi
pop edi
xchg edi, eax
adc ah, al
push ebp
mov ebp, esp
les edx, [ebp - 0x75]
in al, dx
push 0xffffffffffffffff
and byte [eax - 0x39], 0x40
add byte [eax + 0x48], ch
mov ecx, 0xa1643a40
add byte [ebx], dl
add byte [eax + 0x64], dl
jp 0x40b665
add byte [eax], al
cmpsb byte [esi], byte es:[edi]
add byte [ebx - 0x16acdf14], al
push edi
mov dword [ebp - 0x20], esp
adc dword [edx], 0xfffffffc
add byte [edx + 1], ch
invalid
add edi, edi
mov ebp, 0x40ead0
mov bh, 0x83
or eax, 0x414054
into
add dword [esi + 0x4140db], 0xffffffff
call dword [0x48c0d4]
mov ecx, dword [0x416f22]
jo 0x40b691
or byte [ebx + sym.imp.MSVCRT.dll___p__commode], ch
mov ecx, dword [0x410b94]
xchg esp, eax
or eax, dword [ecx]
push 8
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
sub al, 0
mov dword [0x414050], eax
call fcn.0040b947
sub dword [edi + 0x465050], 0xffffffa2
jne 0x40b6bd
push 0x40b944
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call 0x415632
push 0x40d00c
push 0x40d008
call 0xe4b92c
daa
nop
or ebp, dword [eax - 0x27ba7700]
push ebp
inc ebp
fadd dword [edi]
push dword [0x410b8c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [0xbb40c098]
push 0x1f5d3404
invalid
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x526e43
Capabilities:
Encode data using xor

Disassembly:
aaa
sar byte [edx - 0x2518a2aa], cl
xor byte [eax], 0x81
inc edi
and esi, 0x14
daa
out 0x7a, al
or eax, 0x793709e0
jbe 0x526eb2
clc
invalid
invalid

Function at 0x61c2b1
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x87
ljmp 0xd67f
jne 0x61c1de
mul ebp
mov dword [esi], ecx
xchg esp, eax
fisub word [edx - 0x78e13e29]
inc byte [edi + esi*8 + 0x27]
xchg esi, edi
inc esp
mul dword [edi]
xor eax, edx
mov al, 0xa8
invalid
scasd eax, dword es:[edi]
aaa
jb 0x61c23f
jb 0x61c24b
xchg esp, eax
pop eax
pop esi
imul ecx, dword [edi], 0xffffff86
push cs
adc al, 0x7a
push esi
out dx, eax
invalid
hlt
ja 0x61c26e
ror dword [edx + 0x5f], 1
dec esp
std
dec ebp
cdq
je 0x61c2a0
xlatb
leave
test al, 0x9d
Function at 0x4013e1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareAutoIt_v3Aut2Exe
push 0x80000001
call esi
test eax, eax
je 0x40142b
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push str.SoftwareHiddenSoftAutoIt3Aut2Exe
push 0x80000001
call esi
test eax, eax
jne 0x401530
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0xc]
push eax
push ebx
push ebx
push str.LastScriptDir
push dword [ebp - 8]
mov dword [ebp - 4], 0x104
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x111]
push eax
push ebx
push ebx
push str.LastExeDir
push dword [ebp - 8]
mov dword [ebp - 4], 0x104
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x216]
push eax
push ebx
push ebx
push str.LastIconDir
push dword [ebp - 8]
mov dword [ebp - 4], 0x104
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x31b]
push eax
push ebx
push ebx
push str.LastIcon
push dword [ebp - 8]
mov dword [ebp - 4], 0x104
call esi
lea ecx, [ebp - 4]
push ecx
lea eax, [edi + 0x420]
push eax
push ebx
push ebx
push str.LastCompression
push dword [ebp - 8]
mov dword [ebp - 4], 4
call esi
push 4
lea eax, [edi + 0x420]
pop ecx
cmp dword [eax], ecx
jbe 0x4014d7
mov dword [eax], 2
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
lea eax, [edi + 0x424]
push eax
push ebx
push ebx
push str.AllowDecompile
push dword [ebp - 8]
call esi
xor ecx, ecx
lea eax, [edi + 0x424]
inc ecx
cmp dword [eax], ecx
jbe 0x401500
mov dword [eax], ecx
lea eax, [ebp - 4]
push eax
add edi, 0x428
push edi
push ebx
push ebx
push str.UseUPX
push dword [ebp - 8]
mov dword [ebp - 4], 4
call esi
xor eax, eax
inc eax
cmp dword [edi], eax
jbe 0x401527
mov dword [edi], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401535
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, eax
call fcn.004013ad
test al, al
je 0x401649
push ebx
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push 0x2001f
push ebx
push 0x4189d4
push ebx
push str.SoftwareAutoIt_v3Aut2Exe
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea esi, [edi + 0xc]
push esi
call fcn.00408e10
pop ecx
inc eax
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push ebx
push str.LastScriptDir
push dword [ebp - 4]
call esi
lea eax, [edi + 0x111]
push eax
call fcn.00408e10
pop ecx
inc eax
push eax
lea eax, [edi + 0x111]
push eax
push 1
push ebx
push str.LastExeDir
push dword [ebp - 4]
call esi
lea eax, [edi + 0x216]
push eax
call fcn.00408e10
pop ecx
inc eax
push eax
lea eax, [edi + 0x216]
push eax
push 1
push ebx
push str.LastIconDir
push dword [ebp - 4]
call esi
lea eax, [edi + 0x31b]
push eax
call fcn.00408e10
pop ecx
inc eax
push eax
lea eax, [edi + 0x31b]
push eax
push 1
push ebx
push str.LastIcon
push dword [ebp - 4]
call esi
push 4
lea eax, [edi + 0x420]
push eax
push 4
push ebx
push str.LastCompression
push dword [ebp - 4]
call esi
push 4
lea eax, [edi + 0x424]
push eax
push 4
push ebx
push str.AllowDecompile
push dword [ebp - 4]
call esi
push 4
add edi, 0x428
push edi
push 4
push ebx
push str.UseUPX
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop edi
leave
ret
Function at 0x4032a7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 2
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
cmp esi, ebx
jne 0x4032cb
xor al, al
jmp 0x40335b
lea eax, [ebp - 4]
push eax
push 0x403225
push 0xe
push esi
mov dword [0x41c548], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
test eax, eax
jne 0x4032ec
cmp dword [ebp - 4], ebx
je 0x403352
movzx eax, word [ebp + 0xc]
push 0xe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
movzx ecx, word [eax + 4]
xor edx, edx
cmp ecx, ebx
mov dword [0x41c54c], ecx
jbe 0x403330
add eax, 0x12
push edi
movzx edi, word [eax]
mov dword [edx*4 + 0x41c550], edi
inc edx
add eax, 0xe
cmp edx, ecx
jb 0x40331d
pop edi
mov edx, dword [0x41c548]
mov eax, ecx
inc edx
cmp eax, 0x10
jae 0x403350
sub edx, ecx
lea ecx, [edx + eax]
mov dword [eax*4 + 0x41c550], ecx
inc eax
cmp eax, 0x10
jb 0x403340
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, bl
pop esi
pop ebx
leave
ret

Function at 0x403c9e
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
cmp word [edx], 0x5a4d
jne 0x403cc5
mov eax, dword [edx + 0x3c]
add eax, edx
mov dword [esi + 0x10], eax
cmp dword [eax], 0x4550
je 0x403ccc
xor al, al
jmp 0x403d50
push edi
xor edi, edi
cmp dword [eax + 0x58], edi
je 0x403cd8
xor al, al
jmp 0x403d4f
mov eax, dword [eax + 0x88]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x10]
movzx ecx, word [eax + 0x14]
or dword [esi + 0x14], 0xffffffff
cmp word [eax + 6], di
push ebx
lea ecx, [ecx + eax + 0x18]
mov dword [ebp - 4], edi
jbe 0x403d29
mov edi, dword [esi + 0x18]
lea eax, [ecx + 0x14]
cmp edi, dword [eax - 8]
jne 0x403d10
mov ebx, dword [ebp - 4]
mov dword [esi + 0x14], ebx
cmp dword [eax], 0
je 0x403d54
mov ebx, dword [ebp + 8]
cmp dword [eax], ebx
ja 0x403d54
mov ebx, dword [esi + 0x10]
movzx ebx, word [ebx + 6]
inc dword [ebp - 4]
add eax, 0x28
cmp dword [ebp - 4], ebx
jl 0x403d00
mov edi, dword [esi + 0x10]
movzx edi, word [edi + 6]
mov eax, dword [esi + 0x14]
cmp eax, edi
je 0x403d54
lea eax, [eax + eax*4]
mov eax, dword [ecx + eax*8 + 0x14]
add eax, edx
push eax
push eax
mov ecx, esi
call fcn.004042a2
mov dword [esi + 0x1c], eax
mov al, 1
pop ebx
pop edi
leave
ret 4
xor al, al
jmp 0x403d4e
Function at 0x40649d
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0xe4]
sub esp, 0x164
mov eax, dword [0x41b9e4]
xor eax, ebp
push ebx
mov dword [ebp + 0xe0], eax
mov eax, dword [ebp + 0xec]
push esi
push eax
lea eax, [ebp - 0x28]
push eax
mov esi, ecx
call fcn.00408f00
mov ax, word [ebp + 0xf0]
pop ecx
mov word [ebp - 0x50], ax
xor ebx, ebx
cmp byte [esi], bl
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x54], 1
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x28]
jne 0x40650b
push ebx
jmp 0x40650c
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
jne 0x406522
or eax, 0xffffffff
jmp 0x406567
push dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp byte [ebp + 0xf4], 1
jne 0x406560
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x2c], 0x103
jne 0x406556
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406536
push dword [ebp - 0x3c]
call esi
mov eax, dword [ebp - 0x2c]
jmp 0x406567
push dword [ebp - 0x3c]
call esi
xor eax, eax
mov ecx, dword [ebp + 0xe0]
pop esi
xor ecx, ebp
pop ebx
call fcn.00411ba7
add ebp, 0xe4
leave
ret

Function at 0x40657e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x406604
push edi
push esi
call fcn.00409933
pop ecx
mov edi, eax
push edi
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x418ce4
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4065f8
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov esi, ecx
mov edx, 0xffff
and esi, edx
push esi
shr ecx, 0x10
push ecx
mov ecx, eax
and ecx, edx
push ecx
shr eax, 0x10
push eax
push str._u._u._u._u
push dword [ebp + 0xc]
call fcn.00409834
add esp, 0x18
mov bl, 1
push edi
call fcn.00409945
pop ecx
mov al, bl
pop edi
jmp 0x406606
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x40660a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x144
mov eax, dword [0x41b9e4]
xor eax, esp
push 0x2a
push esi
mov dword [esp + 0x148], eax
call fcn.0040a8b0
test eax, eax
pop ecx
pop ecx
jne 0x406649
push 0x3f
push esi
call fcn.0040a8b0
test eax, eax
pop ecx
pop ecx
jne 0x406649
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
jmp 0x406666
lea eax, [esp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x40665d
xor al, al
jmp 0x406666
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.00411ba7
add esp, 0x144
ret
Function at 0x406d0f
Capabilities:
Get file size

Disassembly:
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406d38
xor eax, eax
jmp 0x406d4b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x407965
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.00408ea0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x4082f3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
push edi
xor edi, edi
inc edi
mov dword [eax], ecx
mov esi, edi
mov ecx, eax
mov edx, dword [ecx]
mov ebx, edx
shr ebx, 0x1e
xor ebx, edx
imul ebx, ebx, 0x6c078965
add ebx, esi
mov dword [ecx + 4], ebx
inc esi
add ecx, 4
cmp esi, 0x270
jl 0x4082ff
mov dword [eax + 0x9c0], edi
mov dword [eax + 0x9c4], edi
pop edi
pop esi
pop ebx
ret

Function at 0x40832f
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebx, eax
cmp dword [ebx + 0x9c4], 0
push esi
push edi
mov esi, ebx
jne 0x408353
push 0
call fcn.0040a9d4
pop ecx
mov ecx, eax
mov eax, ebx
call fcn.004082f3
mov dword [ebx + 0x9c0], 0x270
mov dword [ebx + 0x9c8], ebx
mov dword [esp + 0x10], 0xe3
mov ecx, 0x7ffffffe
mov eax, 0x9908b0df
mov edx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor edx, ebp
and edx, ecx
xor edx, dword [esi]
mov dword [esp + 0x14], ecx
mov ecx, ebp
and cl, 1
shr edx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor edx, ecx
xor edx, dword [esi + 0x634]
dec dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi], edx
mov esi, edi
jne 0x408375
mov dword [esp + 0x10], 0x18c
mov edx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor edx, ebp
and edx, ecx
xor edx, dword [esi]
mov dword [esp + 0x14], ecx
mov ecx, ebp
and cl, 1
shr edx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor edx, ecx
xor edx, dword [esi - 0x38c]
dec dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi], edx
mov esi, edi
jne 0x4083b1
mov ebx, dword [ebx]
mov edx, dword [esi]
xor edx, ebx
and edx, ecx
xor edx, dword [esi]
and bl, 1
shr edx, 1
neg bl
pop edi
sbb ebx, ebx
and ebx, eax
xor edx, ebx
xor edx, dword [esi - 0x38c]
mov dword [esi], edx
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x40840b
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [esi + 0x9c0]
jne 0x40841a
mov eax, esi
call fcn.0040832f
lea eax, [esi + 0x9c8]
mov edx, dword [eax]
mov ecx, dword [edx]
add edx, 4
mov dword [eax], edx
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret
Function at 0x4085fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9cc
push ebx
xor ebx, ebx
lea eax, [ebp - 0x9cc]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], ebx
call fcn.004082f3
cmp dword [ebp + 0xc], ebx
jbe 0x40863e
push esi
push edi
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x9cc]
lea edi, [ebx + eax]
call fcn.0040840b
xor byte [edi], al
inc ebx
cmp ebx, dword [ebp + 0xc]
jb 0x408623
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x408643
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov eax, 0x109e0
lea ebp, [esp - 0x10088]
call fcn.00410ca0
mov eax, dword [0x41b9e4]
and dword [ebp + 0x6c], 0
xor eax, ebp
mov dword [ebp + 0x10084], eax
mov eax, dword [ebp + 0x10094]
mov dword [ebp + 0x74], eax
push ebx
xor eax, eax
inc eax
push esi
mov dword [ebp + 0x68], eax
push edi
mov edi, dword [ebp + 0x10090]
mov dword [ebp + 0x7c], eax
lea eax, [ebp - 0x958]
mov esi, edx
call fcn.004082f3
push 0x4188b8
push esi
call fcn.00409405
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x4086bc
push 0x4186ac
push edi
call fcn.00409405
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x78], eax
jne 0x40872e
push ebx
call fcn.00409464
pop ecx
xor al, al
jmp 0x40874e
push 0x10000
lea eax, [ebp + 0x84]
push 1
push eax
call fcn.0040959e
add esp, 0x10
push eax
mov dword [ebp + 0x80], eax
lea eax, [ebp + 0x84]
push eax
lea edi, [ebp + 0x7c]
call fcn.00406cb3
xor edi, edi
cmp dword [ebp + 0x80], edi
jle 0x408714
lea esi, [ebp - 0x958]
call fcn.0040840b
xor byte [ebp + edi + 0x84], al
inc edi
cmp edi, dword [ebp + 0x80]
jl 0x4086f9
push dword [ebp + 0x78]
lea eax, [ebp + 0x84]
push dword [ebp + 0x80]
push 1
push eax
call fcn.004096f1
add esp, 0x10
test byte [ebx + 0xc], 0x10
push ebx
je 0x4086c3
call fcn.00409464
push dword [ebp + 0x78]
call fcn.00409464
mov eax, dword [ebp + 0x7c]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x74]
mov dword [ecx], eax
mov al, 1
mov ecx, dword [ebp + 0x10084]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411ba7
add ebp, 0x10088
leave
ret 8
Function at 0x40931e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x40933b
call fcn.0040c30d
mov dword [eax], 0x16
xor eax, eax
jmp 0x4093a5
push esi
push 0x8c
push 1
call fcn.0040c392
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x409390
push esi
call fcn.0040b576
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x40936e
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x409289
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4093a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00409945
test ebx, ebx
pop ecx
je 0x4093a2
push ebx
call fcn.0040c31f
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret