joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4989f0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4c86e0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00498985
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00483d60
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x498a3f
cmp dword [ebp - 0x1c], 5
jb 0x498a57
jmp 0x498a53
cmp dword [ebp - 0x10], 1
jne 0x498a57
cmp dword [ebp - 0x1c], 4
ja 0x498a53
jne 0x498a57
cmp dword [ebp - 0x18], 0
jbe 0x498a57
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4ac00c
call fcn.00498859
test eax, eax
jge 0x498a78
mov byte [0x4d07f0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0047e440
add ebp, 0x78
leave
ret

Function at 0x403cac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x466008], 0x8088405
inc edx
mov dword [ebx + 0x466008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x401230
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401249
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40125d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40127e
cmp esi, eax
jae 0x401257
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401270
cmp esi, eax
jae 0x401257
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401ef0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x444ed8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
xor eax, eax
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], vtable.CPen.0
mov ecx, dword [esp + 0x3c]
push ecx
push eax
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call fcn.004351db
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.004352b7
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
lea eax, [edi + 2]
push eax
push ebx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00434c76
lea eax, [edi + 5]
push eax
push ebx
mov ecx, esi
call fcn.00434911
lea ebp, [edi + 3]
push ebp
lea eax, [ebx + 1]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00434c76
lea eax, [edi + 6]
push eax
lea eax, [ebx + 1]
push eax
mov ecx, esi
call fcn.00434911
lea eax, [edi + 4]
push eax
lea ecx, [ebx + 2]
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.00434c76
lea eax, [edi + 7]
push eax
lea eax, [ebx + 2]
push eax
mov ecx, esi
call fcn.00434911
push ebp
lea eax, [ebx + 3]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00434c76
lea eax, [edi + 6]
push eax
lea eax, [ebx + 3]
push eax
mov ecx, esi
call fcn.00434911
lea eax, [edi + 2]
lea ecx, [ebx + 4]
push eax
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.00434c76
lea eax, [edi + 5]
push eax
lea eax, [ebx + 4]
push eax
mov ecx, esi
call fcn.00434911
lea ecx, [edi + 1]
push ecx
lea eax, [ebx + 5]
push eax
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.00434c76
lea eax, [edi + 4]
push eax
lea eax, [ebx + 5]
push eax
mov ecx, esi
call fcn.00434911
push edi
add ebx, 6
push ebx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00434c76
push ebp
push ebx
mov ecx, esi
call fcn.00434911
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, esi
call fcn.004352b7
lea ecx, [esp + 0x10]
call fcn.00435232
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x10], vtable.CGdiObject.0
call fcn.00435232
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x402910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.004407b4
movzx ebx, word [esp + 0x14]
mov edi, dword [eax + 0xc]
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 2
push ebx
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x402941
push 2
push ebx
xor edi, edi
push edi
call ebp
mov esi, eax
test esi, esi
je 0x402967
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402967
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x402967
push eax
call fcn.004028d0
add esp, 4
cmp ax, 0x10
je 0x40296e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
push edi
call fcn.00437d9b
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4029a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x138
mov eax, dword [0x45aa50]
mov dword [esp + 0x134], eax
mov eax, dword [0x45b978]
test eax, eax
jne 0x402aa7
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push 0x80000001
mov dword [0x45b978], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402aa7
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402a9d
mov edx, dword [0x4478a0]
mov eax, dword [0x4478a4]
mov ecx, dword [0x4478a8]
mov dword [esp + 0xc], edx
mov edx, dword [0x4478ac]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
mov eax, dword [0x4478b0]
mov dword [esp + 0x1c], ecx
mov cx, word [0x4478b4]
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], cx
call edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
call edi
cmp esi, eax
jl 0x402a9b
lea ecx, [esp + 0x14]
push ecx
mov edx, ecx
push edx
call edi
sub esi, eax
lea eax, [esp + esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402a9b
mov dword [0x45b974], 1
pop edi
pop esi
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x134]
mov eax, dword [0x45b974]
call fcn.0041cf8e
add esp, 0x138
ret
Function at 0x402eb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x444f93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov ecx, ebx
mov dword [esp + 0x18], edi
mov dword [esi], 0x4478f8
call fcn.0042b5e7
mov dword [ebx], method.CPtrArray.virtual_0
lea ebx, [esi + 0x1c]
mov ecx, ebx
mov byte [esp + 0x18], 1
call fcn.0042b5e7
mov dword [ebx], method.CPtrArray.virtual_0
or eax, 0xffffffff
push 0x45b920
push edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc0c0c0
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x403ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x445028
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov ebp, ecx
mov eax, esi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 8]
push edi
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0xc]
xor edi, edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], vtable.CBrush.0
cmp dword [0x45b93c], 7
mov dword [esp + 0x30], edi
jne 0x403b37
call fcn.004029a0
test eax, eax
jne 0x403b37
push 0xf
jmp 0x403b39
push 4
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
call ebx
cmp dword [esp + 0x40], edi
jne 0x403b5c
fld qword [0x447920]
sub esp, 8
fstp qword [esp]
push eax
call fcn.00401aa0
add esp, 0xc
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.004351db
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x38]
mov edx, dword [edi + 4]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x10]
call fcn.00435232
cmp dword [0x45b93c], 2
jl 0x403baa
mov ecx, dword [edi + 4]
push 0xf
push 2
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_DrawEdge]
mov eax, dword [esp + 0x44]
test eax, eax
push 7
jne 0x403bce
call ebx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
add edx, 4
push edx
add eax, 4
push eax
push edi
mov ecx, ebp
call fcn.00401ef0
jmp 0x403be6
call ebx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push eax
add ecx, 4
push ecx
add edx, 5
push edx
push edi
mov ecx, ebp
call fcn.00401dd0
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x10], vtable.CGdiObject.0
call fcn.00435232
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
Function at 0x40b4f0
Capabilities:
Resolve dns

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov eax, ebx
push edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b500
sub eax, edx
lea esi, [eax + 1]
push esi
call fcn.0042c9e4
mov ebp, eax
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, ebp
add esp, 4
mov eax, ebx
sub ecx, ebx
mov dl, byte [eax]
mov byte [ecx + eax], dl
inc eax
test dl, dl
jne 0x40b531
push ebp
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x40b5c8
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
test eax, eax
mov ebx, dword [ecx]
je 0x40b55a
mov dword [eax], ebx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40b5c8
push ebx
call sub.WS2_32.dll_inet_ntoa
lea edx, [eax + 1]
jmp 0x40b570
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b570
sub eax, edx
lea edi, [eax + 1]
push edi
call fcn.0042c9e4
mov ecx, edi
mov edx, ecx
mov esi, eax
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
push ebx
rep stosb byte es:[edi], al
call sub.WS2_32.dll_inet_ntoa
mov ecx, esi
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x40b5a3
mov edx, dword [esp + 0x18]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40b5b5
push esi
call fcn.0042c9e9
add esp, 4
push ebp
call fcn.0042c9e9
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x40c2d0
Capabilities:
Create thread
Inject dll
Inject thread
Terminate process

Disassembly:
push ecx
mov eax, dword [0x45aa50]
push edi
mov edi, dword [esp + 0xc]
test edi, edi
mov dword [esp + 4], eax
jne 0x40c2f4
mov eax, 1
pop edi
mov ecx, dword [esp]
add esp, 4
jmp fcn.0041cf8e
push ebp
push 0x44876c
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
jne 0x40c324
pop ebp
mov eax, 2
pop edi
mov ecx, dword [esp]
add esp, 4
jmp fcn.0041cf8e
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c330
push esi
push 4
push 0x3000
sub eax, edx
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
jne 0x40c365
pop esi
pop ebx
pop ebp
mov eax, 3
pop edi
mov ecx, dword [esp]
add esp, 4
jmp fcn.0041cf8e
mov eax, ebx
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c370
push 0
sub eax, edx
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40c39e
mov ecx, dword [esp + 0x10]
pop esi
pop ebx
pop ebp
mov eax, 4
pop edi
add esp, 4
jmp fcn.0041cf8e
push 0
push 0
push esi
push ebp
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x40c389
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40c3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x45aa50]
push ebx
push esi
push edi
mov dword [esp + 0x224], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push 0x4487a0
push 0
call edi
mov esi, eax
test esi, esi
jne 0x40c423
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
push 0xa
call ebx
push 0x4487a0
push 0
call edi
mov esi, eax
test esi, esi
je 0x40c410
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c458
sub eax, edx
mov cl, byte [esp + eax + 0xf]
cmp cl, 0x5c
lea eax, [esp + eax + 0xf]
je 0x40c47c
mov edi, edi
mov byte [eax], 0
mov cl, byte [eax - 1]
dec eax
cmp cl, 0x5c
jne 0x40c470
lea edi, [esp + 0x10]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40c481
mov ecx, dword [str.sstorm.dll]
mov edx, dword [0x448798]
mov ax, word [0x44879c]
mov dword [edi], ecx
mov cl, byte [0x44879e]
mov dword [edi + 4], edx
lea edx, [esp + 0xc]
push edx
mov word [edi + 8], ax
push esi
mov byte [edi + 0xa], cl
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0xc]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x10]
mov esi, eax
push ecx
push esi
call fcn.0040c2d0
mov byte [esp + 0x120], 0
xor eax, eax
add esp, 8
mov ecx, 0x40
lea edi, [esp + 0x119]
rep stosd dword es:[edi], eax
push 0x104
lea edx, [esp + 0x11c]
push edx
stosw word es:[edi], ax
push 0
push esi
stosb byte es:[edi], al
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x40c533
lea eax, [esp + 0x118]
push eax
push str.gamepath
push str.dfconfig
mov ecx, 0x45b990
call fcn.0040c7d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40c550
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
lea ecx, [esp + 4]
push ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea edx, [esp + 0x18]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x7c]
push eax
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
inc eax
pop edi
add esp, 0x54
ret
Function at 0x40c9f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x418
mov eax, dword [0x45aa50]
push esi
push edi
mov edx, ecx
mov dword [esp + 0x41c], eax
xor eax, eax
mov byte [esp + 0x10], al
mov dword [esp + 0xc], eax
mov ecx, 0x100
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
mov eax, dword [edx + 4]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push 0x400
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [ebp + 8]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.004074a0
mov ecx, dword [esp + 0x41c]
mov eax, esi
call fcn.0041cf8e
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40e310
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [ecx + 4]
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x40e34e
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov edx, ecx
push edi
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
mov al, 1
pop esi
ret 8
xor al, al
ret 8

Function at 0x40f870
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x40f895
push eax
call fcn.0042c9e9
add esp, 4
mov ecx, 0x45cde8
mov dword [edi], 0
call fcn.0040fc20
push 0x400
call fcn.0042c9b9
add esp, 4
mov dword [edi], eax
xor ebx, ebx
xor ecx, ecx
test bl, 1
je 0x40f8b2
mov ecx, 0x80
mov eax, ebx
shr eax, 1
test al, 1
je 0x40f8bd
or ecx, 0x40
shr eax, 1
test al, 1
je 0x40f8c6
or ecx, 0x20
shr eax, 1
test al, 1
je 0x40f8cf
or ecx, 0x10
shr eax, 1
test al, 1
je 0x40f8d8
or ecx, 8
shr eax, 1
test al, 1
je 0x40f8e1
or ecx, 4
shr eax, 1
test al, 1
je 0x40f8ea
or ecx, 2
test al, 2
je 0x40f8f1
or ecx, 1
mov eax, dword [edi]
shl ecx, 0x18
mov dword [eax + ebx*4], ecx
mov esi, 8
mov edi, edi
mov ecx, 0x45cde8
call fcn.0040fbd0
mov ecx, dword [edi]
mov edx, dword [ecx + ebx*4]
lea ecx, [ecx + ebx*4]
mov ebp, edx
and ebp, 0x80000000
neg ebp
sbb ebp, ebp
and ebp, eax
add edx, edx
xor ebp, edx
dec esi
mov dword [ecx], ebp
jne 0x40f900
mov eax, dword [edi]
lea esi, [eax + ebx*4]
mov eax, dword [esi]
xor edx, edx
mov ecx, 0x1f
test al, 1
je 0x40f944
mov ebp, 1
shl ebp, cl
or edx, ebp
shr eax, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x40f937
inc ebx
cmp ebx, 0x100
mov dword [esi], edx
jl 0x40f8a6
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40f9a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
mov eax, 1
mov dword [ecx], edx
push esi
lea esp, [esp]
mov edx, dword [ecx]
mov esi, edx
shr esi, 0x1e
xor esi, edx
imul esi, esi, 0x6c078965
add esi, eax
mov dword [ecx + 4], esi
add ecx, 4
inc eax
cmp eax, 0x270
jl 0x40f9b0
pop esi
ret 4
Function at 0x40fa60
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov eax, ecx
mov esi, 0xe3
lea esp, [esp]
mov edx, dword [eax]
mov edi, dword [eax + 4]
xor edi, edx
and edi, 0x7ffffffe
xor edi, edx
and edx, 1
neg edx
shr edi, 1
and edx, 0x9908b0df
xor edi, edx
xor edi, dword [eax + 0x634]
mov dword [eax], edi
add eax, 4
dec esi
jne 0x40fa70
mov esi, 0x18c
mov edx, dword [eax]
mov edi, dword [eax + 4]
xor edi, edx
and edi, 0x7ffffffe
xor edi, edx
and edx, 1
neg edx
shr edi, 1
and edx, 0x9908b0df
xor edi, edx
xor edi, dword [eax - 0x38c]
mov dword [eax], edi
add eax, 4
dec esi
jne 0x40faa1
mov edx, dword [eax]
mov esi, dword [ecx]
xor esi, edx
and esi, 0x7ffffffe
xor esi, edx
and edx, 1
neg edx
shr esi, 1
and edx, 0x9908b0df
xor esi, edx
xor esi, dword [eax - 0x38c]
mov dword [eax], esi
pop edi
mov dword [ecx + 0x9c4], 0x270
mov dword [ecx + 0x9c0], ecx
pop esi
ret

Function at 0x40fb10
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [ecx + 0x9c4]
test eax, eax
jne 0x40fb1f
call fcn.0040fa60
mov edx, dword [ecx + 0x9c4]
mov eax, dword [ecx + 0x9c0]
dec edx
mov dword [ecx + 0x9c4], edx
mov edx, dword [eax]
add eax, 4
mov dword [ecx + 0x9c0], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov ecx, edx
and ecx, 0xff3a58ad
shl ecx, 7
xor edx, ecx
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x40fb70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
call fcn.0041e4c0
push eax
push 0
call fcn.0041e487
add esp, 4
push eax
mov ecx, esi
call fcn.0040f9e0
push eax
mov ecx, esi
call fcn.0040f9a0
mov ecx, esi
pop esi
jmp fcn.0040fa60
Function at 0x40fc20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x40fc3b
push eax
call fcn.0042c9e9
add esp, 4
mov dword [edi], 0
push 0x400
call fcn.0042c9b9
add esp, 4
mov dword [edi], eax
xor ebx, ebx
lea esp, [esp]
xor ecx, ecx
test bl, 1
je 0x40fc5c
mov ecx, 0x80
mov eax, ebx
shr eax, 1
test al, 1
je 0x40fc67
or ecx, 0x40
shr eax, 1
test al, 1
je 0x40fc70
or ecx, 0x20
shr eax, 1
test al, 1
je 0x40fc79
or ecx, 0x10
shr eax, 1
test al, 1
je 0x40fc82
or ecx, 8
shr eax, 1
test al, 1
je 0x40fc8b
or ecx, 4
shr eax, 1
test al, 1
je 0x40fc94
or ecx, 2
test al, 2
je 0x40fc9b
or ecx, 1
mov eax, dword [edi]
shl ecx, 0x18
mov dword [eax + ebx*4], ecx
mov esi, 8
jmp 0x40fcb0
mov ecx, 0x45cdf0
call fcn.0040fb70
mov ecx, 0x45cdf0
call fcn.0040fb10
and eax, 0xff
jle 0x40fcd2
cmp eax, 0x100
jl 0x40fce0
and eax, 0x800000ff
jns 0x40fce0
dec eax
or eax, 0xffffff00
inc eax
mov edx, dword [eax*4 + 0x4591c8]
mov ecx, dword [edi]
lea eax, [ecx + ebx*4]
mov ecx, dword [eax]
mov ebp, ecx
and ebp, 0x80000000
neg ebp
sbb ebp, ebp
and ebp, edx
lea edx, [ecx + ecx]
xor ebp, edx
dec esi
mov dword [eax], ebp
jne 0x40fcb0
mov eax, dword [edi]
lea esi, [eax + ebx*4]
mov eax, dword [esi]
xor edx, edx
mov ecx, 0x1f
test al, 1
je 0x40fd21
mov ebp, 1
shl ebp, cl
or edx, ebp
shr eax, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x40fd14
inc ebx
cmp ebx, 0x100
mov dword [esi], edx
jl 0x40fc50
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40fd60
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x45d800]
test eax, eax
je 0x40fd7c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x45d800], 0
mov eax, dword [0x45d7f0]
test eax, eax
je 0x40fd8e
push eax
call fcn.00411d10
add esp, 4
mov eax, dword [0x45d7ec]
test eax, eax
je 0x40fda0
push eax
call fcn.00411c20
add esp, 4
call fcn.00411fc0
mov dword [0x45d7fc], 0
xor eax, eax
ret

Function at 0x410010
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x45d808]
test eax, eax
je 0x41002c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x45d808], 0
mov eax, dword [0x45d7e0]
test eax, eax
je 0x41003e
push eax
call fcn.00411d10
add esp, 4
mov eax, dword [0x45d7d4]
test eax, eax
je 0x410050
push eax
call fcn.00411c20
add esp, 4
call fcn.00411fc0
mov dword [0x45d804], 0
xor eax, eax
ret