joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411331
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [0x46ec6c]
push esi
push edi
lea edx, [ebp - 6]
lea ecx, [edx - 1]
test ecx, ecx
js 0x411360
mov esi, dword [esp + 0x38]
lea eax, [esp + 0x14]
sub esi, eax
lea eax, [esi + ecx*4]
mov eax, dword [esp + eax + 0x14]
mov dword [esp + ecx*4 + 0x14], eax
dec ecx
jns 0x411352
xor ebx, ebx
xor esi, esi
xor edi, edi
test edx, edx
jle 0x4113a1
lea eax, [ebp + 1]
cmp ebx, eax
jge 0x4113a1
cmp edi, edx
jge 0x411395
mov ebp, dword [esp + 0x40]
cmp esi, 4
jge 0x41138f
mov eax, dword [esp + edi*4 + 0x14]
lea ecx, [esi + ebx*4]
inc edi
mov dword [ebp + ecx*4], eax
inc esi
cmp edi, edx
jl 0x411379
mov ebp, dword [0x46ec6c]
cmp esi, 4
jne 0x41139d
inc ebx
xor esi, esi
cmp edi, edx
jl 0x41136a
lea eax, [ebp + 1]
cmp ebx, eax
jge 0x4114c0
mov edi, 0x4492f8
movzx eax, byte [esp + edx*4 + 0x11]
mov cl, byte [esp + 0x14]
xor cl, byte [eax + str.cw]
mov byte [esp + 0x14], cl
xor ecx, ecx
movzx eax, byte [esp + edx*4 + 0x12]
inc ecx
mov al, byte [eax + str.cw]
xor byte [esp + 0x15], al
movzx eax, byte [esp + edx*4 + 0x13]
mov al, byte [eax + str.cw]
xor byte [esp + 0x16], al
movzx eax, byte [esp + edx*4 + 0x10]
mov al, byte [eax + str.cw]
xor byte [esp + 0x17], al
mov al, byte [edi]
add edi, 4
xor byte [esp + 0x14], al
mov dword [esp + 0x10], edi
cmp edx, 8
je 0x411419
cmp edx, ecx
jle 0x411474
mov eax, dword [esp + ecx*4 + 0x10]
xor dword [esp + ecx*4 + 0x14], eax
inc ecx
cmp ecx, edx
jl 0x41140a
jmp 0x411474
mov eax, dword [esp + ecx*4 + 0x10]
xor dword [esp + ecx*4 + 0x14], eax
inc ecx
cmp ecx, 4
jl 0x411419
movzx eax, byte [esp + 0x20]
push 5
pop ecx
mov al, byte [eax + str.cw]
xor byte [esp + 0x24], al
movzx eax, byte [esp + 0x21]
mov al, byte [eax + str.cw]
xor byte [esp + 0x25], al
movzx eax, byte [esp + 0x22]
mov al, byte [eax + str.cw]
xor byte [esp + 0x26], al
movzx eax, byte [esp + 0x23]
mov al, byte [eax + str.cw]
xor byte [esp + 0x27], al
mov eax, dword [esp + ecx*4 + 0x10]
xor dword [esp + ecx*4 + 0x14], eax
inc ecx
cmp ecx, 8
jl 0x411466
xor edi, edi
test edx, edx
jle 0x4114b1
lea eax, [ebp + 1]
cmp ebx, eax
jge 0x4114b1
cmp edi, edx
jge 0x4114a5
mov ebp, dword [esp + 0x40]
cmp esi, 4
jge 0x41149f
mov eax, dword [esp + edi*4 + 0x14]
lea ecx, [esi + ebx*4]
inc edi
mov dword [ebp + ecx*4], eax
inc esi
cmp edi, edx
jl 0x411489
mov ebp, dword [0x46ec6c]
cmp esi, 4
jne 0x4114ad
inc ebx
xor esi, esi
cmp edi, edx
jl 0x41147a
mov edi, dword [esp + 0x10]
lea eax, [ebp + 1]
cmp ebx, eax
jl 0x4113b1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x411742
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
mov dl, bl
mov ecx, ebx
push edi
mov edi, dword [esp + 0x10]
test esi, esi
jle 0x411763
mov al, byte [ecx + edi]
and al, 0xaa
xor dl, al
inc ecx
cmp ecx, esi
jl 0x411757
push esi
push edi
push 0x48ec81
mov byte [0x48ec80], dl
call fcn.004201a0
add esp, 0xc
test esi, esi
jle 0x4117ab
mov ecx, dword [esp + 0x1c]
movzx eax, byte [ebx + 0x48ec81]
mov al, byte [eax + 0x4695b0]
mov byte [ebx + 0x48ec81], al
test ecx, ecx
je 0x4117a3
xor al, byte [esp + 0x18]
xor al, 0xcc
mov byte [ebx + 0x48ec81], al
xor ecx, 1
inc ebx
cmp ebx, esi
jl 0x411780
pop edi
pop esi
pop ebx
ret

Function at 0x4117c1
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], vtable.CSHA1.0
jmp fcn.004118bb

Function at 0x4118bb
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 0x18], 0
and dword [ecx + 0x1c], 0
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
mov dword [ecx + 0x14], 0xc3d2e1f0
ret
Function at 0x412c2a
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x18
push ebp
push esi
push 0
push 2
pop eax
push eax
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
or ebp, 0xffffffff
cmp esi, ebp
jne 0x412c4c
mov eax, ebp
jmp 0x412d1f
push ebx
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [esp + 0x10]
push 4
push eax
push 4
xor ebx, ebx
push 0xffff
inc ebx
push esi
mov dword [esp + 0x24], ebx
call edi
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x40000
push eax
push 0x1002
push 0xffff
push esi
call edi
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x4000
push eax
push 0x1001
push 0xffff
push esi
call edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x412cc1
mov eax, ebp
jmp 0x412d1d
push 4
lea eax, [esp + 0x14]
push eax
push 0x20
push 0xffff
push esi
call edi
push dword [esp + 0x2c]
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1a], ax
push 2
pop eax
mov word [esp + 0x18], ax
mov eax, dword [esp + 0x34]
test eax, eax
je 0x412d03
cmp byte [eax], 0
je 0x412d03
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x1c], eax
jmp 0x412d08
and dword [esp + 0x1c], 0
push 0x10
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, ebp
cmove esi, ebp
mov eax, esi
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x18
ret 0xc

Function at 0x412d82
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
lea eax, [ebp - 0x50]
push 0x50
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x412de9
push edi
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x412de8
mov ecx, dword [edi + 0xc]
cmp dword [ecx], 0
je 0x412de8
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp esi, 0x28
jge 0x412de6
mov eax, dword [esi + ecx]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, ebx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x412dcd
mov ecx, dword [edi + 0xc]
add esi, 4
add ebx, 0x10
cmp dword [esi + ecx], 0
jne 0x412db9
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x412def
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5e8
push edi
push 2
or edi, 0xffffffff
mov dword [ebp - 4], 0x10
pop eax
mov word [ebp - 0x14], ax
cmp dword [ebp + 8], edi
jne 0x412e18
mov ecx, dword [ebp + 0x10]
mov eax, edi
mov dword [ecx], edi
jmp 0x412e82
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x5d4
lea eax, [ebp - 0x5e8]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
cmp esi, 1
jge 0x412e43
cmp esi, edi
jne 0x412e74
test esi, esi
jne 0x412e50
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, edi
jmp 0x412e81
cmp esi, edi
je 0x412e79
push dword [ebp - 0x12]
call dword [sym.imp.WS2_32.dll_ntohs]
push dword [ebp + 0xc]
lea ecx, [ebp - 0x5e8]
movzx eax, ax
push esi
push ecx
push eax
push dword [ebp - 0x10]
call fcn.004088d5
xor eax, eax
inc eax
jmp 0x412e81
mov eax, dword [ebp + 0x10]
and dword [eax], 0
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x412e89
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0xffffffff
jne 0x412e9a
or eax, 0xffffffff
jmp 0x412ef7
push esi
mov esi, dword [ebp + 0x18]
push esi
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov eax, dword [ebp + 0x14]
push 2
mov dword [ebp - 0xc], eax
pop eax
mov word [ebp - 0x10], ax
push 0
movzx eax, si
mov esi, dword [ebp + 0x10]
push eax
push esi
push dword [ebp + 0xc]
call fcn.00411742
add esp, 0x10
inc esi
push 0x10
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0x48ec80
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
je 0x412ecc
pop esi
cmp eax, 0xffffffff
je 0x412ef1
xor eax, eax
jmp 0x412ef7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4141cb
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, ecx
test ebp, ebp
jne 0x4141eb
xor ebx, ebx
push ebx
push ebx
push ebx
push 2
call fcn.00415d73
xor al, al
jmp 0x4142a5
push edi
call fcn.00413b9f
or dword [esi + 8], 0xffffffff
xor ebx, ebx
or dword [esi + 4], 0xffffffff
push 2
push ebx
push ebp
call fcn.0042325c
push ebp
call fcn.0042366f
push ebx
mov edi, eax
push ebx
push ebp
mov dword [esp + 0x30], edi
call fcn.0042325c
add esp, 0x1c
test edi, edi
jg 0x414226
push ebx
push ebx
push ebx
push 0xc
jmp 0x414255
lea eax, [edi + 1]
push eax
call fcn.0041f543
push ebp
mov ebp, dword [esp + 0x1c]
mov edi, eax
push 1
push ebp
push edi
mov byte [edi], bl
call fcn.00423121
add esp, 0x14
cmp eax, 1
je 0x414260
push edi
call fcn.0041f594
pop ecx
push ebx
push ebx
push ebx
push 2
mov ecx, esi
call fcn.00415d73
xor al, al
jmp 0x4142a4
mov byte [edi + ebp], bl
mov eax, edi
mov ecx, edi
cmp byte [edi], bl
je 0x414286
mov dl, byte [eax]
cmp dl, 0xd
jne 0x41427e
mov byte [ecx], 0xa
inc ecx
inc eax
cmp byte [eax], 0xa
jne 0x414282
jmp 0x414281
mov byte [ecx], dl
inc ecx
inc eax
cmp byte [eax], bl
jne 0x41426b
push dword [esp + 0x18]
mov byte [ecx], bl
mov ecx, esi
mov eax, dword [esi]
push ebx
push edi
call dword [eax + 8]
push edi
call fcn.0041f594
xor eax, eax
cmp byte [esi + 0x2c], al
pop ecx
sete al
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x4176c6
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x436f00
call fcn.0041fd88
sub esp, 0x138
cmp dword [0x490058], 0
je 0x417840
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [0x4ecfac]
cmp dword [0x490058], eax
jae 0x41783f
push ebp
push esi
push edi
lea ecx, [esp + 0x34]
call fcn.00401783
mov ax, word [esp + 0x164]
xor ebp, ebp
mov ecx, 0xffff
mov dword [esp + 0x150], ebp
cmp ax, cx
je 0x41778a
movzx eax, ax
imul eax, eax, 0x153
cmp dword [eax + 0x490098], ebp
je 0x41782b
push 7
lea esi, [eax + 0x490161]
xorps xmm1, xmm1
pop ecx
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
movss xmm0, dword [esp + 0x21]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x4177e8
movss xmm0, dword [esp + 0x25]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x4177e8
movss xmm0, dword [esp + 0x29]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x4177e8
mov dword [esp + 0x21], 0x3e800000
jmp 0x4177e8
movzx eax, word [0x490074]
imul edx, eax, 0x153
cmp dword [esp + 0x160], ebp
je 0x4177a9
or byte [edx + 0x49017e], 0xc0
jmp 0x4177cf
mov eax, dword [esp + 0x15c]
cmp eax, 1
movzx ecx, al
mov al, byte [edx + 0x49017e]
push 2
pop esi
cmova ecx, esi
and al, 0x3f
shl cl, 6
or cl, al
mov byte [edx + 0x49017e], cl
push 7
mov byte [edx + 0x49017f], 0x55
lea esi, [edx + 0x490161]
pop ecx
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 1
push 8
lea eax, [esp + 0x18]
mov byte [esp + 0x18], 0xcb
push eax
lea ecx, [esp + 0x40]
call fcn.00401c52
push 0x1f
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
call fcn.00401be8
mov ecx, dword [0x4e321c]
lea edx, [esp + 0x34]
push ebp
push 7
push 1
mov eax, dword [ecx]
push edx
call dword [eax + 0x18]
call ebx
mov dword [0x490058], eax
or dword [esp + 0x150], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.0040179e
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
leave
ret
Function at 0x4179f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x436f00
call fcn.0041fd88
sub esp, 0x114
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x417c25
push ebx
lea ecx, [ebp - 0x120]
call fcn.00401783
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [0x490048], ebx
je 0x417c15
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x4ecfa8]
cmp dword [0x490048], eax
jae 0x417c14
mov ax, word [ebp + 0x10]
mov ecx, 0xffff
cmp ax, cx
je 0x417b78
movzx eax, ax
imul ecx, eax, 0x153
cmp dword [ecx + 0x490098], ebx
je 0x417c14
mov ax, word [0x4ed8ef]
mov word [esi], ax
mov ax, word [ecx + 0x49010c]
mov word [esi + 2], ax
mov ax, word [ecx + 0x49010e]
mov word [esi + 4], ax
mov ax, word [ecx + 0x490110]
mov word [esi + 6], ax
mov eax, dword [ecx + 0x490112]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0x490116]
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x49011a]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x49011e]
mov dword [esi + 0x14], eax
movss xmm0, dword [ecx + 0x490122]
addss xmm0, dword [0x4ed8f3]
movss dword [esi + 0x18], xmm0
movss xmm0, dword [ecx + 0x490126]
addss xmm0, dword [0x4ed8f7]
movss dword [esi + 0x1c], xmm0
movss xmm0, dword [ecx + 0x49012a]
addss xmm0, dword [0x4ed8fb]
movss dword [esi + 0x20], xmm0
mov eax, dword [ecx + 0x49012e]
mov dword [esi + 0x24], eax
mov eax, dword [ecx + 0x490132]
mov dword [esi + 0x28], eax
mov eax, dword [ecx + 0x490136]
mov dword [esi + 0x2c], eax
mov eax, dword [ecx + 0x49013a]
mov dword [esi + 0x30], eax
cmp byte [0x4ed913], bl
jne 0x417b3e
mov al, byte [ecx + 0x49013e]
mov byte [esi + 0x34], al
mov al, byte [ecx + 0x49013f]
mov byte [esi + 0x35], al
mov al, byte [0x4ed931]
test al, al
jne 0x417b4d
mov al, byte [ecx + 0x490140]
mov byte [esi + 0x36], al
mov al, byte [ecx + 0x490141]
mov byte [esi + 0x37], al
mov al, byte [ecx + 0x490142]
mov byte [esi + 0x38], al
mov ax, word [ecx + 0x490143]
mov word [esi + 0x39], ax
mov eax, dword [ecx + 0x490145]
mov dword [esi + 0x3b], eax
jmp 0x417baa
movzx eax, word [esi]
imul ecx, eax, 0x14
cmp dword [ecx + 0x4e3220], ebx
je 0x417c14
cmp dword [ebp + 0xc], ebx
je 0x417baa
mov eax, dword [ecx + 0x4e3224]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x4e3228]
mov dword [esi + 0x1c], eax
mov eax, dword [ecx + 0x4e322c]
mov dword [esi + 0x20], eax
movss xmm0, dword [esi + 0x18]
lea eax, [ebp + 8]
movss dword [0x4ed925], xmm0
lea ecx, [ebp - 0x120]
movss xmm0, dword [esi + 0x1c]
push 1
movss dword [0x4ed929], xmm0
movss xmm0, dword [esi + 0x20]
push 8
push eax
movss dword [0x4ed92d], xmm0
mov byte [ebp + 8], 0xc8
call fcn.00401c52
push 0x3f
push esi
lea ecx, [ebp - 0x120]
call fcn.00401be8
mov ecx, dword [0x4e321c]
lea edx, [ebp - 0x120]
push ebx
push 7
push 1
mov eax, dword [ecx]
push edx
call dword [eax + 0x18]
call edi
mov dword [0x490048], eax
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.0040179e
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x417c34
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x436f00
call fcn.0041fd88
sub esp, 0x118
push esi
mov esi, dword [esp + 0x130]
test esi, esi
je 0x417e4d
push ebx
lea ecx, [esp + 0xc]
call fcn.00401783
xor ebx, ebx
mov dword [esp + 0x128], ebx
cmp dword [0x49004c], ebx
je 0x417e3b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x4ecfa4]
cmp dword [0x49004c], eax
jae 0x417e3a
mov ax, word [esp + 0x140]
push ebp
mov ebp, 0xffff
cmp ax, bp
je 0x417db0
movzx eax, ax
imul ecx, eax, 0x153
cmp dword [ecx + 0x490098], ebx
je 0x417e39
cmp dword [0x49003c], ebx
jne 0x417e39
cmp dword [0x490040], ebx
jne 0x417e39
mov ax, word [ecx + 0x4900c6]
mov word [esi], ax
mov ax, word [ecx + 0x4900c8]
mov word [esi + 2], ax
mov ax, word [ecx + 0x4900ca]
mov word [esi + 4], ax
movss xmm0, dword [ecx + 0x4900cc]
addss xmm0, dword [0x4ed8f3]
movss dword [esi + 6], xmm0
movss xmm0, dword [ecx + 0x4900d0]
addss xmm0, dword [0x4ed8f7]
movss dword [esi + 0xa], xmm0
movss xmm0, dword [ecx + 0x4900d4]
addss xmm0, dword [0x4ed8fb]
movss dword [esi + 0xe], xmm0
mov eax, dword [ecx + 0x4900d8]
mov dword [esi + 0x12], eax
mov eax, dword [ecx + 0x4900dc]
mov dword [esi + 0x16], eax
mov eax, dword [ecx + 0x4900e0]
mov dword [esi + 0x1a], eax
mov eax, dword [ecx + 0x4900e4]
mov dword [esi + 0x1e], eax
cmp byte [0x4ed913], bl
jne 0x417d6f
mov al, byte [ecx + 0x4900e8]
mov byte [esi + 0x22], al
mov al, byte [ecx + 0x4900e9]
mov byte [esi + 0x23], al
mov al, byte [0x4ed931]
test al, al
jne 0x417d7e
mov al, byte [ecx + 0x4900ea]
mov byte [esi + 0x24], al
mov al, byte [ecx + 0x4900eb]
mov byte [esi + 0x25], al
mov eax, dword [ecx + 0x4900ec]
mov dword [esi + 0x26], eax
mov eax, dword [ecx + 0x4900f0]
mov dword [esi + 0x2a], eax
mov eax, dword [ecx + 0x4900f4]
mov dword [esi + 0x2e], eax
mov eax, dword [ecx + 0x490106]
mov dword [esi + 0x40], eax
jmp 0x417dbc
mov al, byte [0x4ed931]
test al, al
je 0x417dbc
mov byte [esi + 0x24], al
movss xmm0, dword [esi + 6]
lea eax, [esp + 0x10]
movss dword [0x4ed925], xmm0
lea ecx, [esp + 0x14]
movss xmm0, dword [esi + 0xa]
push 1
movss dword [0x4ed929], xmm0
movss xmm0, dword [esi + 0xe]
push 8
push eax
movss dword [0x4ed92d], xmm0
mov byte [esp + 0x1c], 0xcf
call fcn.00401c52
push 0x44
push esi
lea ecx, [esp + 0x1c]
call fcn.00401be8
mov ecx, dword [0x4e321c]
lea edx, [esp + 0x14]
push ebx
push 7
push 1
mov eax, dword [ecx]
push edx
call dword [eax + 0x18]
cmp dword [esp + 0x140], ebx
je 0x417e32
cmp byte [esi + 0x22], bl
jne 0x417e32
push ebp
push ebx
call fcn.00417fed
pop ecx
pop ecx
call edi
mov dword [0x49004c], eax
pop ebp
pop edi
or dword [esp + 0x128], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.0040179e
pop ebx
mov ecx, dword [esp + 0x11c]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x417e5e
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x436e62
call fcn.0041fd88
sub esp, 0x12c
push ebx
mov bx, word [ebp + 8]
movzx eax, bx
push esi
imul esi, eax, 0x14
cmp dword [esi + 0x4e3220], 0
je 0x417f62
cmp dword [0x490054], 0
je 0x417f62
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ecfa8]
cmp dword [0x490054], eax
jae 0x417f62
push edi
lea ecx, [ebp - 0x138]
call fcn.00401783
movss xmm0, dword [esi + 0x4e3224]
lea edi, [ebp - 0x24]
push 6
and dword [ebp - 4], 0
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
cvttss2si eax, dword [0x4ed91c]
lea ecx, [ebp - 0x138]
mov word [ebp - 0x24], bx
push 1
push 8
mov byte [ebp + 8], 0xd3
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [esi + 0x4e3228]
mov byte [ebp - 0x20], al
cvttss2si eax, dword [0x4ed920]
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [esi + 0x4e322c]
mov byte [ebp - 0x1f], al
lea eax, [ebp + 8]
push eax
movss dword [ebp - 0x10], xmm0
call fcn.00401c52
push 0x18
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x138]
call fcn.00401be8
mov ecx, dword [0x4e321c]
lea edx, [ebp - 0x138]
push 0
push 7
push 1
mov eax, dword [ecx]
push edx
call dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
mov dword [0x490054], eax
call fcn.0040179e
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x419913
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x118
cmp dword [esp + 0x120], 0
je 0x4199fd
push ebx
push ebp
push esi
push edi
push dword [esp + 0x130]
lea eax, [esp + 0x28]
push 0x4383c0
push 0x104
push eax
call fcn.00420d98
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00419589
add esp, 0x18
lea ecx, [esp + 0x10]
push 5
pop edx
mov edi, edx
mov bl, byte [ecx]
mov esi, 0x439c30
push 0x64
pop ebp
xor bl, byte [esi]
xor bl, 0x2f
inc esi
dec ebp
jne 0x41996b
mov byte [ecx], bl
inc ecx
dec edi
jne 0x419961
lea ecx, [esp + 0x15]
mov esi, edx
mov bl, byte [ecx]
mov edi, 0x439c30
push 0x64
pop ebp
xor bl, byte [edi]
xor bl, 0x45
inc edi
dec ebp
jne 0x41998a
mov byte [ecx], bl
inc ecx
dec esi
jne 0x419980
lea ecx, [esp + 0x1a]
mov esi, edx
mov bl, byte [ecx]
mov edi, 0x439c30
push 0x64
pop ebp
xor bl, byte [edi]
xor bl, 0x6f
inc edi
dec ebp
jne 0x4199a9
mov byte [ecx], bl
inc ecx
dec esi
jne 0x41999f
lea ecx, [esp + 0x1f]
mov bl, byte [ecx]
mov esi, 0x439c30
push 0x64
pop edi
xor bl, byte [esi]
xor bl, 0xdb
inc esi
dec edi
jne 0x4199c6
mov byte [ecx], bl
inc ecx
dec edx
jne 0x4199bc
push 0x14
pop edx
pop edi
pop esi
pop ebp
xor ecx, ecx
pop ebx
mov al, byte [ecx + 0x439c94]
xor byte [esp + ecx], al
inc ecx
dec edx
jne 0x4199de
lea eax, [esp]
push eax
push dword [esp + 0x120]
call fcn.004198c8
pop ecx
pop ecx
add esp, 0x118
ret

Function at 0x419b71
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [0x490074]
sub esp, 0x40
imul eax, eax, 0x153
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [eax + 0x4900c0], ebx
je 0x419bbc
push 0x3f
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.00420a30
mov eax, dword [ebp + 0xc]
push esi
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.004179f8
push esi
push ebx
push ebx
call fcn.004176c6
add esp, 0x24
cmp dword [0x4eceac], ebx
je 0x419c3d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0x2710
cmp dword [0x4eceac], eax
jae 0x419c3d
movzx eax, word [0x490074]
imul eax, eax, 0x153
cmp dword [eax + 0x4900c0], ebx
jne 0x419c30
movzx eax, si
mov ecx, 0xffff
imul eax, eax, 0x153
cmp word [eax + 0x49010a], cx
je 0x419c59
movzx eax, word [0x4ed8ef]
push ebx
push eax
call fcn.004178cb
movzx eax, word [0x490074]
imul eax, eax, 0x153
pop ecx
pop ecx
mov dword [0x4eceac], ebx
mov dword [eax + 0x4900c0], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4eceac], eax
jmp 0x419c59
movzx eax, word [0x490074]
imul eax, eax, 0x153
cmp dword [eax + 0x4900c0], ebx
jne 0x419c59
push esi
call fcn.00419d42
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419d76
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
xor ebp, ebp
cmp byte [0x4ed924], 0
push edi
mov edi, 0x3ec
je 0x419f43
cmp byte [0x4eced0], 0
je 0x419f43
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [0x4eceb0]
cmp eax, dword [0x4ed8be]
jb 0x419f43
mov si, word [0x4ecebc]
cmp si, di
jae 0x419f91
cmp si, word [0x490074]
je 0x419f4a
movzx eax, si
imul edi, eax, 0x153
cmp dword [edi + 0x490098], ebp
je 0x419f4a
cmp dword [edi + 0x49009c], ebp
jne 0x419dfe
cmp dword [edi + 0x4900a0], ebp
je 0x419f4a
cmp dword [0x4ed864], 4
jne 0x419e32
push 0x4ed8db
call fcn.00419afd
pop ecx
movzx eax, ax
mov ecx, 0xffff
cmp ax, cx
je 0x419e32
cmp ax, si
jne 0x419e32
inc si
mov word [0x4ecebc], si
jmp 0x419f4a
movss xmm0, dword [0x4ed925]
movss dword [esp + 0x13], xmm0
movss xmm0, dword [0x4ed929]
movss dword [esp + 0x17], xmm0
movss xmm0, dword [0x4ed92d]
movss dword [esp + 0x1b], xmm0
movss xmm0, dword [edi + 0x4900cc]
movss dword [esp + 0x1f], xmm0
movss xmm0, dword [edi + 0x4900d0]
movss dword [esp + 0x23], xmm0
movss xmm0, dword [edi + 0x4900d4]
mov byte [esp + 0x10], 1
mov word [esp + 0x11], si
movss dword [esp + 0x27], xmm0
call fcn.004248ac
push 0xa
cdq
pop esi
idiv esi
movd xmm0, edx
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x439d54]
movss dword [esp + 0x2b], xmm0
call fcn.004248ac
cdq
idiv esi
movd xmm0, edx
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x439d54]
movss dword [esp + 0x2f], xmm0
call fcn.004248ac
cdq
idiv esi
mov al, byte [0x4ed931]
movd xmm0, edx
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x439d54]
movss dword [esp + 0x33], xmm0
test al, al
jne 0x419f26
mov eax, dword [0x4ed864]
cmp eax, 4
je 0x419f02
cmp eax, 5
jne 0x419f2a
push 0x4ed8db
call fcn.00419afd
pop ecx
movzx eax, ax
mov ecx, 0xffff
cmp ax, cx
je 0x419f2a
imul eax, eax, 0x153
mov al, byte [eax + 0x4900ea]
mov byte [esp + 0x37], al
lea eax, [esp + 0x10]
push eax
call fcn.00417850
inc word [0x4ecebc]
pop ecx
call ebx
mov dword [0x4eceb0], eax
mov si, word [0x4ecebc]
mov ebx, 0x3ec
cmp si, bx
jae 0x419f91
cmp si, word [0x490074]
je 0x419f7e
movzx eax, si
imul eax, eax, 0x153
cmp dword [eax + 0x490098], ebp
je 0x419f7e
cmp dword [eax + 0x49009c], ebp
jne 0x419f85
cmp dword [eax + 0x4900a0], ebp
jne 0x419f85
inc si
cmp si, bx
jb 0x419f54
mov word [0x4ecebc], si
cmp si, bx
jb 0x419f99
xor eax, eax
mov word [0x4ecebc], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x41a063
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ecea8]
cmp eax, dword [0x4ed8b6]
jb 0x41a09f
lea eax, [ebp - 0x40]
push 0x3c
push eax
call fcn.00418c20
lea eax, [ebp - 0x40]
push eax
call fcn.0041a7f4
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ecea8], eax
mov esp, ebp
pop ebp
ret