joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ff90
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100160d8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x1001e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x1000ffd3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.1000cda0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x1000fffc
lea eax, [esi + 8]
jmp 0x1000fffe
xor eax, eax
cmp dword [ebx + 0x10], 0
je 0x1001000e
cmp dword [ebx + 0x14], 8
jb 0x10010010
mov ebx, dword [ebx]
jmp 0x10010010
xor ebx, ebx
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x10010031
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10010031
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x1001005a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001006f
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.10013402
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100133c1
mov esp, ebp
pop ebp
ret 4

Function at 0x10010490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10016215
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1001e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x1050
call fcn.100133d2
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 0x1050
push 0
push esi
call sub.VCRUNTIME140.dll_memset
lea ecx, [esi + 0x44]
mov dword [esi], 0
mov eax, ecx
mov dword [esi + 4], 0
neg eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
lea edx, [esi + 0x1044]
mov dword [esi + 0x10], 0
and eax, 3
mov dword [esi + 0x14], 0
add esp, 0x10
mov dword [esi + 0x18], 0
add eax, ecx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [edx], 0
mov dword [esi + 0x1048], 0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edx
mov byte [ebp - 4], 2
mov dword [esi + 0x104c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov dword [edi], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012a50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x1001e008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x10012ad2
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x10012ad2
test ecx, ecx
je 0x10012ace
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x10012a90
xor eax, eax
jmp 0x10012ad7
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10012ae1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100133c1
add esp, 0xc
ret 0xc

Function at 0x10013270
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x1001e008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x100132d5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100132b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100132d5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.100133c1
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.100133c1
add esp, 8
ret 4
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..idata
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5b9444b9
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x297f57a4
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x416213
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00416292
jae 0x41621f
xor ecx, ecx
call fcn.00416292
jae 0x416249
xor eax, eax
call fcn.00416292
jae 0x41625a
mov al, 0x10
call fcn.00416292
adc al, al
jae 0x41623b
jne 0x416287
stosb byte es:[edi], al
jmp 0x416220
call fcn.0041629e
dec ecx
loop 0x416266
mov eax, ebp
call fcn.0041629c
jmp 0x416288
lodsb al, byte [esi]
shr eax, 1
je 0x4162ae
adc ecx, 2
mov ebp, eax
jmp 0x416288
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0041629c
cmp eax, 0x7d00
jae 0x416286
cmp eax, 0x500
jae 0x416287
cmp eax, 0x7f
ja 0x416288
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416220
pop ebp
ret 8
Function at 0x401790
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x401880
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x401880
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4017da
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x4017e1
inc edi
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
mov ecx, esi
cmp ebp, edi
jne 0x4017c0
jmp 0x4017e3
mov esi, 0x1505
jmp 0x4017e3
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x401880
mov eax, edi
not eax
and eax, 1
mov ebx, edi
and ebx, 0xfffffffe
sub ebx, eax
and ebx, esi
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401824
inc ebx
dec edi
je 0x40187e
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40187e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x401820
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.00408710
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x401820
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.00408730
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x401820
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x401880
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401ce0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x401e43
mov esi, dword [esp + 0x28]
test esi, esi
je 0x401e43
cmp dword [esp + 0x2c], 0
je 0x401e43
push esi
call fcn.00408710
add esp, 4
test eax, eax
je 0x401d4a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x401d51
inc edi
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
mov ecx, ebx
cmp eax, edi
jne 0x401d30
jmp 0x401d53
mov ebx, 0x1505
jmp 0x401d53
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x401de5
mov dword [esp], eax
mov eax, edi
not eax
and eax, 1
mov esi, edi
and esi, 0xfffffffe
sub esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401d94
inc esi
dec edi
je 0x401de5
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x401dea
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x401d90
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.00408710
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401d90
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.00408730
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401d90
mov eax, 0xffffffff
jmp 0x401e43
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jae 0x401e2f
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
jmp 0x401e43
call fcn.00401f00
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
je 0x401e4b
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push ecx
call fcn.00408710
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x401eee
mov eax, edi
not eax
and eax, 1
mov esi, edi
and esi, 0xfffffffe
sub esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401e94
inc esi
dec edi
je 0x401eee
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x401df2
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x401e90
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408710
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401e90
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.00408730
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401e90
jmp 0x401df2
mov ebp, 0xffffffff
jmp 0x401df2
Function at 0x4025f0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402796
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40278f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x402685
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x40278f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x4026fe
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x4026a0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x40264d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x402740
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x402720
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402640
jmp 0x40274f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402640
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402760
jmp 0x402640
shl ecx, 0x10
or ecx, edi
jmp 0x40279b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4027b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x402808
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x40280a
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
mov ebp, eax
and ebp, edi
or eax, edi
xor eax, ebp
and eax, 0xf
xor ebx, dword [eax*4 + 0x44380c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44380c]
inc esi
cmp edx, esi
jne 0x4027d0
not eax
jmp 0x40280a
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x4085bc
lea ecx, [esi + ebx]
cmp ecx, eax
jbe 0x4085bc
test ebx, ebx
je 0x40866d
lea ecx, [esi + ebx]
dec ecx
lea edx, [eax + ebx]
dec edx
mov edi, ebx
and edi, 7
je 0x408607
neg edi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ecx + esi]
mov byte [edx + esi], al
dec esi
cmp edi, esi
jne 0x4085a0
add ecx, esi
add edx, esi
add esi, ebx
cmp ebx, 8
jae 0x40860e
jmp 0x40866d
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebx
not ecx
or ecx, 0xfffffffc
add ecx, ebx
add eax, ecx
inc eax
lea edx, [esi + ecx]
inc edx
mov ecx, ebx
xor ecx, 0xfffffffc
mov ebp, ebx
or ebp, 3
and ebp, ecx
mov ecx, ebp
shr ecx, 1
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
je 0x40866d
and ebp, 0xfffffffe
movzx ecx, byte [edx + ebp]
mov byte [eax + ebp], cl
jmp 0x40866d
mov esi, ebx
cmp ebx, 8
jb 0x40866d
neg esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ecx + edi]
mov byte [edx + edi], al
movzx eax, byte [ecx + edi - 1]
mov byte [edx + edi - 1], al
movzx eax, byte [ecx + edi - 2]
mov byte [edx + edi - 2], al
movzx eax, byte [ecx + edi - 3]
mov byte [edx + edi - 3], al
movzx eax, byte [ecx + edi - 4]
mov byte [edx + edi - 4], al
movzx eax, byte [ecx + edi - 5]
mov byte [edx + edi - 5], al
movzx eax, byte [ecx + edi - 6]
mov byte [edx + edi - 6], al
movzx eax, byte [ecx + edi - 7]
mov byte [edx + edi - 7], al
add edi, 0xfffffff8
cmp esi, edi
jne 0x408620
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x408c40
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, dword [esp + 8]
mov dword [0x44bac4], edx
mov eax, 0xfffffd92
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x6c078965
mov esi, ecx
or ecx, 0x6c078965
imul ecx, edx
xor edx, 0x6c078965
and esi, 0x93f8769a
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x26f
mov dword [eax*4 + 0x44c480], edx
test eax, eax
je 0x408ccf
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x6c078965
mov esi, ecx
or ecx, 0x6c078965
imul ecx, edx
xor edx, 0x6c078965
and esi, 0x93f8769a
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x270
mov dword [eax*4 + 0x44c484], edx
add eax, 2
jmp 0x408c50
mov dword [0x44bac0], 0x270
pop esi
ret
Function at 0x408cf0
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x210
call fcn.0043ce90
test al, al
je 0x408ef2
lea eax, [esp + 8]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00435ad0
test al, al
je 0x408eed
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 0xd87f0e8a
mov esi, 0x26ea8ebc
mov ecx, ebx
shrd esi, edx, cl
mov dword [esp + 4], eax
shr edx, cl
test bl, 0x20
je 0x408d51
mov esi, edx
xor edx, edx
lea ecx, [esi + esi]
lea ebp, [edx + edx]
and ecx, 0x4dd51d78
and ebp, 0xb0fe1d14
mov ebx, esi
add ebx, 0x26ea8ebc
mov eax, edx
adc eax, 0xd87f0e8a
mov edi, 0xd9157143
sub edi, esi
mov esi, 0x2780f175
sbb esi, edx
and edi, ecx
and esi, ebp
not ecx
and ecx, ebx
not ebp
and ebp, eax
sub ecx, edi
sbb ebp, esi
mov edi, ecx
and edi, 0x84485e20
mov ebx, edi
xor ebx, 0x84485e20
mov esi, ecx
and esi, 0x7bb7a1df
mov eax, ebx
mul esi
mov dword [esp], eax
mov eax, ebp
and eax, 0x9d50eda0
imul eax, ebx
add edx, eax
mov ebx, edx
mov edx, ebp
and edx, 0x62af125f
or ecx, 0x84485e20
mov eax, ecx
imul ecx, edx
xor edx, 0x62af125f
imul esi, edx
mul edi
add esi, ebx
add ecx, edx
or ebp, 0x62af125f
imul ebp, edi
add ebp, ecx
add eax, dword [esp]
adc ebp, esi
mov ecx, ebp
shr ecx, 0x15
mov edi, ecx
or edi, ebp
and ecx, ebp
shld ebp, eax, 0xb
mov esi, ebp
or esi, eax
and ebp, eax
add esi, 0x18c2884c
adc edi, 0xdc1f856e
sub esi, ebp
sbb edi, ecx
mov ebx, esi
add ebx, 1
mov ebp, edi
adc ebp, 0
add esi, 0xe73d77b4
adc edi, 0x23e07a91
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408ec9
mov eax, 0x18c2884c
mov edx, 0x18c2884c
sub edx, ebx
mov ecx, 0x1c1f856e
sbb ecx, ebp
and edx, 0x7a518c12
and ecx, 0x1948b455
sub eax, ebx
mov ebx, 0xdc1f856e
not eax
sbb ebx, ebp
and eax, 0x85ae73ed
imul ecx, eax
mov ebp, edx
mul edx
mov dword [esp], eax
not ebx
and ebx, 0xe6b74baa
add edx, ecx
imul ebx, ebp
add ebx, edx
mov ebp, edi
and ebp, 0x1948b455
mov ecx, esi
and ecx, 0x7a518c12
or esi, 0x7a518c12
mov eax, esi
mul ecx
imul esi, ebp
add esi, edx
or edi, 0x1948b455
imul edi, ecx
add edi, esi
add eax, dword [esp]
adc edi, ebx
mov esi, eax
mov ecx, dword [esp + 4]
shrd esi, edi, cl
mov edx, edi
shr edx, cl
test cl, 0x20
je 0x408ec5
mov esi, edx
xor edx, edx
xor edi, edx
xor esi, eax
or edi, 0x1010101
or esi, 0x1010101
push edi
push esi
call fcn.0040a140
add esp, 8
test al, al
je 0x408eed
call fcn.0040ccf0
call fcn.0040bb20
call fcn.0043e4b0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408f00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408f62
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x408f20
mov eax, 0x270
jmp 0x408f74
cmp eax, 0x4e0
jb 0x408f74
mov esi, ecx
call fcn.00408fc0
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
mov ecx, eax
not ecx
or ecx, 0x9d2c5680
add ecx, eax
inc ecx
xor ecx, edx
mov edx, ecx
shl edx, 0xf
and edx, 0xefc60000
xor edx, ecx
mov eax, edx
shr eax, 0x12
and ecx, eax
add eax, edx
add ecx, ecx
sub eax, ecx
pop esi
pop edi
ret

Function at 0x408fc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
xor eax, eax
mov edx, SysReAllocString
jmp 0x408fef
mov ebp, dword [ecx + esi*4 + 4]
and ebp, edx
or ebp, ebx
shr ebp, 1
xor edi, dword [ecx + esi*4 + 0x638]
xor edi, ebp
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
je 0x409027
mov edi, eax
and edi, 1
mov ebx, eax
and ebx, 0x70
mov esi, eax
or esi, 0x270
add esi, ebx
mov ebx, esi
or ebx, 1
add ebx, edi
mov ebx, dword [ecx + ebx*4 + 4]
mov edi, ebx
xor edi, 0x7ffffffe
and ebx, 0x7fffffff
and edi, ebx
je 0x408fd0
mov edi, 0x9908b0df
jmp 0x408fd0
mov edi, dword [ecx + 0xd50]
mov eax, 0xe4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [eax - 1]
and edi, 0x80000000
mov ebx, dword [ecx + eax*4 + 0x9c4]
mov ebp, ebx
or ebp, 0x7ffffffe
lea esi, [ebx - 0x80000000]
and esi, ebp
or esi, edi
mov edi, ebx
and ebx, 1
neg ebx
shr esi, 1
and ebx, 0x9908b0df
mov ebp, edx
or ebp, 0x3ffffd8f
and edx, 0x18f
add edx, ebp
xor ebx, dword [ecx + edx*4 + 0x63c]
xor ebx, esi
mov dword [ecx + eax*4], ebx
inc eax
cmp eax, 0x270
jne 0x409040
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov edx, dword [ecx + 4]
mov eax, edx
and eax, 0x7ffffffe
or eax, esi
shr eax, 1
and edx, 1
neg edx
xor eax, dword [ecx + 0x634]
and edx, 0x9908b0df
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
movzx ecx, word [esi]
test cx, cx
je 0x40946c
mov edx, dword [esp + 0x1c]
dec edx
je 0x40946c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x409360
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x409410
cmp ebx, 0x7ff
ja 0x409390
cmp edx, 2
jb 0x409390
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
mov ecx, ebx
not ecx
or ecx, 0x3f
add ecx, ebx
add cl, 0x81
lea eax, [ebp + 2]
mov byte [ebp + 1], cl
jmp 0x409410
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x40942a
cmp edx, 4
jb 0x40942a
movzx eax, word [esi + 2]
mov dword [esp], eax
add esi, 4
shl ebx, 0xa
and ebx, 0x9ffc00
add ebx, eax
add ebx, 0xffff2400
mov eax, ebx
and eax, 0x10000
mov edi, ebx
xor edi, 0x10000
lea ecx, [edi + eax*2]
mov eax, ecx
shr eax, 0x12
add al, 0xf0
mov byte [ebp], al
shr ecx, 0xc
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 1], cl
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 2], bl
mov eax, dword [esp]
and al, 0x3f
or al, 0x80
mov ecx, eax
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
je 0x40946c
test edx, edx
jne 0x409340
jmp 0x40946c
movzx eax, ax
cmp eax, 0xdc00
jne 0x409438
mov esi, edi
jmp 0x409418
cmp edx, 3
jb 0x409468
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov ecx, ebx
shr ecx, 6
mov eax, ecx
not eax
or eax, 0x3f
add eax, ecx
add al, 0x81
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x409410
mov eax, ebp
jmp 0x409410
mov byte [ebp], 0
sub ebp, dword [esp + 0x18]
mov eax, ebp
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret