joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419bf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427161
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x433018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], esi
mov eax, 1
mov dword [ebp - 4], eax
xor edi, edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], vtable.ES_CMN_FUNCS::BUFFER::CESHeapBuffer.0
mov byte [ebp - 4], 4
xor edx, edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], esi
mov word [ecx], dx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x28], eax
jmp 0x419c62
xor esi, esi
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x24]
lea ecx, [ebp - 0x20]
add edi, 0x400
call edx
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x4c]
push edi
lea ecx, [ebp - 0x20]
call edx
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x419c8c
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
mov ecx, 8
cmp dword [ebp + 0x1c], ecx
jae 0x419c9c
lea esi, [ebp + 8]
mov edx, dword [ebp + 0x40]
cmp dword [ebp + 0x54], ecx
jae 0x419ca7
lea edx, [ebp + 0x40]
cmp dword [ebp + 0x38], ecx
mov ecx, dword [ebp + 0x24]
jae 0x419cb2
lea ecx, [ebp + 0x24]
push esi
push edi
push eax
push 0x429fbc
push edx
push ecx
call ebx
lea ecx, [edi - 1]
lea edx, [ecx - 1]
cmp eax, edx
je 0x419c60
cmp eax, ecx
je 0x419c60
mov eax, dword [ebp - 0x1c]
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x419cd4
sub ecx, esi
mov esi, dword [ebp - 0x24]
sar ecx, 1
push ecx
call fcn.00401ac0
mov dword [ebp - 0x20], vtable.ES_CMN_FUNCS::BUFFER::CESHeapBuffer.0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x1c]
xor edi, edi
cmp eax, edi
je 0x419d13
push eax
lea ecx, [ebp - 0x20]
call dword [0x42bb4c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov ebx, 8
mov dword [ebp - 0x20], vtable.ES_CMN_FUNCS::BUFFER::IESBuffer.0
cmp dword [ebp + 0x1c], ebx
jb 0x419d31
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ecx, ecx
mov dword [ebp + 0x1c], 7
mov dword [ebp + 0x18], edi
mov word [ebp + 8], cx
cmp dword [ebp + 0x38], ebx
jb 0x419d53
mov edx, dword [ebp + 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [ebp + 0x38], 7
mov dword [ebp + 0x34], edi
mov word [ebp + 0x24], ax
cmp dword [ebp + 0x54], ebx
jb 0x419d75
mov ecx, dword [ebp + 0x40]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a730
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427101
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x433018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov eax, 1
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], cx
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
jae 0x41a78b
lea eax, [ebp + 8]
push ebx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
cmp edi, ebx
je 0x41a821
xor ecx, ecx
mov edx, 2
mul edx
seto cl
mov byte [ebp - 4], 2
neg ecx
or ecx, eax
push ecx
call fcn.00424f28
add esp, 4
cmp dword [ebp + 0x1c], 8
mov ebx, eax
mov eax, dword [ebp + 8]
jae 0x41a7c8
lea eax, [ebp + 8]
push ebx
push edi
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41a80c
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
push ecx
push str.StringFileInfo000004b0FileVersion
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41a80c
mov eax, dword [ebp - 0x14]
mov ecx, eax
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x41a7f7
sub ecx, edi
sar ecx, 1
push ecx
call fcn.00401ac0
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
jmp 0x41a821
cmp dword [ebp + 0x1c], 8
jb 0x41a834
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x41af90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4270b9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x433018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
mov eax, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], vtable.ES_CMN_FUNCS::BUFFER::CESHeapBuffer.0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call dword [0x42bb20]
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x4c]
push 0x20a
lea ecx, [ebp - 0x28]
call eax
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, ebx
je 0x41b0c8
push 1
push 0x23
mov eax, 0x20a
push edi
push ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [ebp - 0x24]
cmp eax, 1
jne 0x41b07f
cmp edi, ebx
je 0x41b04e
lea esi, [ebp - 0x10]
mov edx, edi
call fcn.004197a0
mov esi, dword [ebp + 8]
cmp eax, ebx
jge 0x41b057
xor ecx, ecx
jmp 0x41b05a
mov eax, 0x80070057
xor ecx, ecx
jmp 0x41b05a
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
jne 0x41b062
cmp ecx, ebx
jne 0x41b07f
cmp edi, ebx
je 0x41b0c8
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x50]
push edi
lea ecx, [ebp - 0x28]
call eax
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x41b0c8
cmp edi, ebx
je 0x41b0c8
mov eax, edi
lea edx, [eax + 2]
jmp 0x41b090
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41b090
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.00401ac0
mov edi, dword [ebp - 0x24]
cmp edi, ebx
je 0x41b0c5
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x50]
push edi
lea ecx, [ebp - 0x28]
call eax
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], ebx
je 0x41b0de
push 0x11
mov eax, str.EPSONEPSONSCAN2
mov ecx, esi
call fcn.00401990
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x28], vtable.ES_CMN_FUNCS::BUFFER::CESHeapBuffer.0
mov dword [ebp - 4], 2
cmp edi, ebx
je 0x41b0fa
push edi
lea ecx, [ebp - 0x28]
call dword [0x42bb4c]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x424ffa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433018]
jne 0x425004
repz ret
jmp fcn.00425527
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b2030]
jne 0x401116
repz ret
jmp fcn.00401b11

Function at 0x408edc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004047d5
and dword [ebp - 4], 0
cmp dword [0x4b478c], 0
mov ebx, eax
jne 0x408f8d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40903e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40903e
push eax
call fcn.00404763
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4b478c], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4b4790], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b4794], eax
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x4b479c], eax
test eax, eax
je 0x408f8d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x4b4798], eax
mov eax, dword [0x4b4798]
cmp eax, ebx
je 0x408fe5
cmp dword [0x4b479c], ebx
je 0x408fe5
push eax
call fcn.004047de
push dword [0x4b479c]
mov esi, eax
call fcn.004047de
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408fe5
test edi, edi
je 0x408fe5
call esi
test eax, eax
je 0x408fdc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408fdc
test byte [ebp - 0xc], 1
jne 0x408fe5
or dword [ebp + 0x10], 0x200000
jmp 0x40901e
mov eax, dword [0x4b4790]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40901e
mov eax, dword [0x4b4794]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b478c]
call fcn.004047de
pop ecx
test eax, eax
je 0x40903e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409040
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af90
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x4b2030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2b6d09c]
push ebx
mov ebx, dword [0x2b6cee8]
push esi
mov esi, dword [0x4b2f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40afd1
push 0x4b0358
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2b6d09c]
mov dword [0x4b48f4], esi
cmp eax, 0x114e
jne 0x40affb
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.durinarusunavabaxomoyowev
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2b6d09c]
cmp eax, 0x2f
jne 0x40b01d
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
call fcn.0040af00
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b4030]
jne 0x401116
repz ret
jmp fcn.00401ea1

Function at 0x4086ae
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406a72
and dword [ebp - 4], 0
cmp dword [0x4b6814], 0
mov ebx, eax
jne 0x40875f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408810
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408810
push eax
call fcn.00406a00
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4b6814], eax
call esi
push eax
call fcn.00406a00
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4b6818], eax
call esi
push eax
call fcn.00406a00
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b681c], eax
call esi
push eax
call fcn.00406a00
pop ecx
mov dword [0x4b6824], eax
test eax, eax
je 0x40875f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406a00
pop ecx
mov dword [0x4b6820], eax
mov eax, dword [0x4b6820]
cmp eax, ebx
je 0x4087b7
cmp dword [0x4b6824], ebx
je 0x4087b7
push eax
call fcn.00406a7b
push dword [0x4b6824]
mov esi, eax
call fcn.00406a7b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4087b7
test edi, edi
je 0x4087b7
call esi
test eax, eax
je 0x4087ae
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4087ae
test byte [ebp - 0xc], 1
jne 0x4087b7
or dword [ebp + 0x10], 0x200000
jmp 0x4087f0
mov eax, dword [0x4b6818]
cmp eax, ebx
je 0x4087f0
push eax
call fcn.00406a7b
pop ecx
test eax, eax
je 0x4087f0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4087f0
mov eax, dword [0x4b681c]
cmp eax, ebx
je 0x4087f0
push eax
call fcn.00406a7b
pop ecx
test eax, eax
je 0x4087f0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b6814]
call fcn.00406a7b
pop ecx
test eax, eax
je 0x408810
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408812
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cc40
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x4b4030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2c94114]
push ebx
mov ebx, dword [0x2c93f60]
push esi
mov esi, dword [0x4b5050]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40cc81
push str.lefovuweceh
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2c94114]
mov dword [0x4b69ec], esi
cmp eax, 0x114e
jne 0x40ccab
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.nanucucolumisocifozoguvex
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
mov eax, dword [0x2c94114]
cmp eax, 0x2f
jne 0x40cccd
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
call fcn.0040cbb0
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret
Function at 0x40ce0a
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push esi
lea edx, [6]
push edx
mov edi, 0x4ee
shr edi, 8
push edi
pop dword [0x42499a]
push 0x424b96
mov ebx, 0x482
and ebx, 0xff
or ebx, ebx
jne 0x40ce3f
shl ebx, 6
mov dword [ebp - 0x30], ebx
push 0x60
jmp loc.004623e3
Function at 0x1002cb7b
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x1003ee55
call fcn.1003b3a5
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x1002cc74
cmp byte [esi + 0x46], bl
je 0x1002cc74
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x1002cbb7
xor al, al
jmp 0x1002cc76
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.10014076
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ebx, edi
cmp eax, 0x10
jae 0x1002cbe4
lea ebx, [ebp - 0x28]
mov edi, ebx
mov ecx, dword [esi + 0x40]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
mov edx, dword [ecx]
push eax
push edi
lea eax, [esi + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1002cc0b
dec eax
je 0x1002cc0f
dec eax
dec eax
je 0x1002cc62
xor bl, bl
jmp 0x1002cc64
mov byte [esi + 0x46], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov ecx, edi
cmp eax, 0x10
jae 0x1002cc1f
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
sub ebx, ecx
je 0x1002cc48
cmp eax, 0x10
jae 0x1002cc2e
lea edi, [ebp - 0x28]
push dword [esi + 0x50]
push ebx
push 1
push edi
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x1002cc07
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
cmp byte [esi + 0x46], 0
je 0x1002cc62
test ebx, ebx
jne 0x1002cbd8
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.10014015
jmp 0x1002cbd2
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10010630
mov al, bl
jmp 0x1002cc76
mov al, 1
call fcn.1003b354
ret

Function at 0x1002ed7b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.MSVCR120.dll__beginthreadex]
mov dword [esi], eax
add esp, 0x18
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
pop esi
pop ebp
ret

Function at 0x1003d8f0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1003d92b
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1003d912
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1003d923
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1003d92d
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1003d908
xor eax, eax
pop edi
pop esi
ret
Function at 0x423bba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp byte [ebp - 8], 0
je 0x423bc7
mov ecx, dword [ebp - 0xc]
and dword [ecx + 0x70], 0xfffffffd
mov eax, esi
leave
mov dword [esi + 0xc], eax
mov edx, 0x8b53c304
fcom qword [ecx + 0x51]
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
insb byte es:[edi], dx
and al, 4
add byte [eax], al
add byte [ebx - 0x74a8a9d8], cl
jnp 0x423bf9
xor eax, eax
movzx ecx, word [edi]
mov dword [ebp - 8], ecx
cmp ax, cx
xor eax, ebp
movsb byte es:[edi], byte [esi]
inc ebx
or cl, ch
call 0xe94a7fa2
pop eax
add al, byte [eax]
add byte [ecx + 0x4c41f8], ah
cmp eax, 1
jle 0xccb73d05
call 0x104161dc
mov dh, 0x87
push 2
pop esi
cmp eax, 0x87b60ff0
ja 0x423c27
movdqu xmm0, xmmword [edi]
jmp 0x423c50
push 8
pxor xmm0, xmm0
movzx ecx, cx
pop edx
movzx eax, cx
psrldq xmm0, 2
pinsrw xmm0, eax, 7
xor eax, eax
cmp ax, cx
je 0x423c4a
add edi, esi
movzx ecx, word [edi]
dec edx
jne 0x423c31
mov ecx, dword [ebp - 8]
mov edx, dword [ebx + 8]
mov eax, edx
and eax, 0x87b60fff
cmp eax, 0x87b60ff0
ja 0x423cc5
movdqu xmm1, xmmword [edx]
pcmpistri xmm0, xmm1, 0xd
jbe 0x423c75
add edx, 0x10
mov ecx, dword [ebp - 8]
jmp 0x423c53
jae 0x423e58
pcmpistri xmm0, xmm1, 0xd
lea edx, [edx + ecx*2]
mov ecx, dword [ebx + 0xc]
mov edi, edx
mov eax, edi
mov dword [ebp - 4], ecx
and eax, 0x87b60fff
cmp eax, 0x87b60ff0
ja 0x423cdf
mov eax, ecx
and eax, 0x87b60fff
cmp eax, 0x87b60ff0
ja 0x423cdf
movdqu xmm1, xmmword [edi]
movdqu xmm2, xmmword [ecx]
pcmpistri xmm2, xmm1, 0xd
jno 0x423cf7
js 0x423cfe
mov ecx, dword [ebp - 4]
add edi, 0x10
add ecx, 0x10
jmp 0x423c89
movzx eax, word [edx]
xor edi, edi
cmp di, ax
je 0x103a3e58
pop dword [ecx]
cdq
je 0x423c84
add edx, esi
jmp 0x8b424053
cmp al, 0xb7
add dword [ebx + 0x668bfc65], eax
cmp dword [ebp - 4], eax
je 0x423cfe
cmp word [edi], ax
jne 0x423cf7
add edi, esi
add ecx, esi
jmp 0x423c89
add edx, esi
jmp 0x8b424070
mov eax, edx
jmp 0x83a83e5a
adc eax, 0xc89c933
mov edx, 0x5be38b04
ret

Function at 0x468a97
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4c4190]
jne 0x468aa9
call 0x834d5739
mov eax, dword [0x4c7ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c7ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xff7fdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x468aec
fadd qword [0x4bbac8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4bbaa0]
mov esp, ebp
pop ebp
ret

Function at 0x468afc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4c7530], ecx
inc esi
mov ecx, 0x4c7530
mov edx, esi
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x4c7eec
jl 0x468b0d
mov dword [0x4c4190], esi
mov dword [0x4c7518], esi
pop esi
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x407136
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x407151
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x5d2dea
Capabilities:
Encode data using xor

Disassembly:
call 0x907a4b21
mov eax, edi
dec eax
test eax, eax
jl 0x5d2e17
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x6937fc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5d2df9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x10013074
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10013083
pop dword [ebp - 8]
mov eax, 0x3941b803
sub eax, 0x29408780
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x8eb537f4
sub dword [ebp - 0x18], 0x4062f2a9
mov dword [ebp - 0x14], 0x8a50a8ec
add dword [ebp - 0x14], 0xa7e2a359
mov dword [ebp - 0x10], 0x2c934050
add dword [ebp - 0x10], 0x1fb903de
mov dword [ebp - 0xc], 0x5f4cc38d
sub dword [ebp - 0xc], 0x5f4cc38d
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x3b88afde
add dword [ebp - 0x18], 0x38e9b978
mov dword [ebp - 0x14], 0x5c581fec
sub dword [ebp - 0x14], 0x1aebbe77
mov dword [ebp - 0x10], 0xa94d5fa0
sub dword [ebp - 0x10], 0x45ddf334
mov dword [ebp - 0xc], 0x612d748a
sub dword [ebp - 0xc], 0x612d748a
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x37f5c
push 0
call eax
mov ecx, 0xa17f51bb
sub ecx, 0xa17f0c70
mov edi, eax
mov esi, 0x10041c00
add esi, dword [ebp - 8]
mov ebx, 0x822fe9b2
mov edx, dword [esi]
add dword [ebp - 4], 0x1646f3d2
sub edx, ebx
xor dword [ebp - 4], 0xac5810d2
mov dword [edi], edx
sub dword [ebp - 4], 0xbcbf0227
add edi, 0x957593d7
add edi, 0x6a8a6c2d
add esi, 4
loop 0x1001318f
add eax, 0x61901ee6
add eax, 0x9e70e919
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret