joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5043a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x558e80
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x573f3c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x577d14
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x577df8
call fcn.004b9850
mov byte [esp + 0x38], 1
call fcn.00503574
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.004b9920
mov dword [esi], 0x577e1c
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x5353b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x53543d
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0050ffe0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x535400
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x535422
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x535498
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.00535108
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x535484
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x535498
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x5353c1
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call dword [sym.imp.MSVCR100.dll_getenv]
xor ebx, ebx
pop ecx
test eax, eax
je 0x40104e
mov edi, dword [sym.imp.MSVCR100.dll_printf]
push str.Windows_original_main_args:_n
call edi
mov eax, dword [sym.imp.MSVCR100.dll___argc]
xor esi, esi
pop ecx
cmp dword [eax], ebx
jle 0x40104e
mov eax, dword [sym.imp.MSVCR100.dll___argv]
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call edi
mov eax, dword [sym.imp.MSVCR100.dll___argc]
add esp, 0xc
inc esi
cmp esi, dword [eax]
jl 0x40102f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call sub.jli.dll_JLI_MemAlloc
pop ecx
pop ecx
mov esi, eax
call sub.jli.dll_JLI_GetStdArgs
xor ecx, ecx
cmp edi, ebx
jle 0x401088
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x40107d
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
mov ebp, eax
cmp eax, ebx
jne 0x401098
mov ebp, dword [esi]
mov ecx, dword [0x40300c]
cmp ecx, ebx
jne 0x4010a4
mov ecx, dword [esi]
mov eax, dword [0x403030]
push ebx
push ebx
push ebx
cmp eax, ebx
setne dl
movzx edx, dl
push edx
push ebp
push ecx
push 0x402158
push 0x402148
push dword [0x403034]
push 1
push eax
push 1
push esi
push edi
call sub.jli.dll_JLI_Launch
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4615a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
je 0x46180d
jne 0x46180d
je 0x4611e6
jne 0x4612ed
add byte [eax], al
add byte [eax], al

Function at 0x463620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x23c
mov edi, dword [ebp + 0xc]
je 0x4637a8
jne 0x4637a8
Function at 0x464860
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
je 0x4648b6
jne 0x4648b6
jmp 0x3eb283b2
inc ebp
cmp ebp, dword [esi + edi + 0x18]
jb 0x4648d7
xor eax, eax
jmp 0x464890
mov eax, dword [esp]
je 0x46487c
jne 0x46487c
jmp 0x6852ff8f
movzx ecx, word [eax + ebp*2]
xor eax, eax
cmp dword [esi + edi + 0x14], ecx
jb 0x464890
mov eax, dword [esi + edi + 0x1c]
je 0x4648f9
jne 0x4648f9
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + edi + 0x24]
mov ebx, dword [esi + edi + 0x20]
xor ebp, ebp
je 0x46491b
jne 0x46491b
je 0x4624da
jne 0x46140a
push eax
mov edx, dword [esp + 0x1c]
xor eax, eax
mov ecx, dword [edx]
cmp dword [ecx + 0x7c], 0
je 0x464890
je 0x464938
jne 0x464938
je 0x46369f
jne 0x462cb7
je 0x1f14d66
mov eax, dword [ebx + ebp*4]
add eax, esi
push eax
push dword [esp + 0x24]
mov eax, dword [esp + 0x20]
call dword [eax + 0x24]
je 0x464907
invalid
jne 0x464907
je 0x46268a
jne 0x462922
jmp 0x3d4558a
lea ecx, [esi + ecx*4]
add esi, dword [eax + ecx]
mov eax, esi
je 0x464890
jne 0x464890
je 0x84560990
test eax, eax
je 0x464874
invalid
je 0x464869
jne 0x464869
add eax, esi
add ebx, esi
mov dword [esp], eax
nop word cs:[eax + eax]
nop dword [eax]
je 0x4648d7
jne 0x4648d7
add byte [eax], al
add byte [eax], al
mov esi, dword [edx + 4]
mov edi, dword [ecx + 0x78]
cmp dword [edi + esi + 0x18], 0
je 0x464890
cmp dword [esi + edi + 0x14], 0
je 0x464890
je 0x46489c
jne 0x46489c
push ebp
push ebx
je 0x464a05
jne 0x464a05
je 0x4e8a3b
mov dword [eax + 8], 0
mov dword [eax + 0x10], 0
mov ebx, ecx
push dword [esp + 0x20]
push dword [esp + 0x20]
push eax
je 0x4649d8
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ecx + 0x2474ffcb], cl
and bh, bh
je 0x4649ab
and byte [eax + 0x74], dl
dec ebp
jne 0x4649d8
je 0x4613d2
jne 0x46363b
add byte [eax], al
add byte [eax], al
test edi, edi
je 0x4649fb
push 0x8000
push 0
push edi
call dword [ebx + 0xc]
je 0x4649fb
or al, 0x74
dec ebp
jne 0x4649fb
jmp 0x8182a740
mov ebx, dword [ebp + 0x3c]
cmp dword [ebp + ebx], 0x4550
jne 0x4649fb
mov edi, dword [esp + 0x14]
add ebx, ebp
push 4
je 0x4649ca
jne 0x4649ca
push 0x3000
push 0x14
push 0
je 0x464a1c
jne 0x464a1c
jmp 0xec89322d
push ecx
call fcn.00463620
add esp, 0x10
test eax, eax
je 0x4649f0
mov esi, edi
mov dword [edi + 0x10], 1
jmp 0x4649fb
je 0x46499d
jne 0x46499d
pop ebx
pop ebp
ret
mov eax, esi
pop esi
pop edi
je 0x4649f4
jne 0x4649f4
je 0x6cd1a060
push edi
push esi
mov ebp, dword [esp + 0x18]
and al, 0x18
xor esi, esi
movzx eax, word [ebp]
cmp eax, 0x5a4d
jne 0x4649fb
je 0x4649b1
jne 0x4649b1
call dword [edi]
mov ecx, edi
mov dword [eax + 4], ebp
mov dword [eax], ebx
mov edi, eax
mov dword [eax + 0xc], 0
je 0x464970
jne 0x464970
nop word [eax + eax]
ret
Function at 0x46adf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
je 0x46b0ab
jne 0x46b0ab
je 0x4693c2
jne 0x46a2d9
add byte [eax], al
add byte [eax], al
push ebx
push edi
push esi
je 0x46b126
jne 0x46b126
add byte [eax], al
add byte [eax], al

Function at 0x46b180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov byte [esp], 0
jmp 0x46b2a3
je 0x46b306
jne 0x46b306
Function at 0x46b410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x30], ecx
push 1
je 0x46958c
jne 0x46958c
add byte [eax], al
add byte [eax], al
mov ebp, dword [esi + 8]
je 0x469116
jne 0x469116
add byte [eax], al
add byte [eax], al
push ebp
push eax
push 2
push edx
push ebx
call fcn.0046eab0
test eax, eax
je 0x468ea6
je 0x469393
jne 0x469393
add byte [eax], al
add byte [eax], al
mov byte [esp + 0x17], 0
mov byte [esp + 0x18], 0
mov byte [esp + 0x19], 0
mov byte [esp + 0x1a], 0
je 0x468eb3
jne 0x468eb3
je 0xf96619e4
invalid
je 0x46b867
jne 0x46b867
add byte [eax], al
add byte [eax], al
mov eax, dword [esp + 8]
je 0x46b5bc
jne 0x46b5bc
je 0x46b68c
jne 0x46b68c
add byte [eax], al
add byte [eax], al
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov byte [esp + 8], 0
je 0x46b7c3
jne 0x46b7c3
invalid
mov byte [esp + 0xb], 0
mov byte [esp + 0xc], 0
mov byte [esp + 0xd], 0
mov byte [esp + 0xe], 0
push 0x46b665
ret
mov ecx, dword [esp + 0x14]
cmp ecx, 3
push 0x46b7e3
ret
je 0x46b791
jne 0x46b791
jmp 0x1af39c3
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
sub esp, 0x14
movsd xmm0, qword [esp + 0x2c]
mov edi, dword [ebp + 8]
push 0x46b46b
ret
je 0x46b440
jne 0x46b440
add byte [eax], al
add byte [eax], al
test eax, eax
je 0x46b880
jne 0x46b880
lea eax, [esp + 0x14]
push 0
push eax
push edi
jmp 0x46b770
je 0x854f7b15
ror byte [edi], 0x84
retf
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
je 0x46b7bb
jne 0x46b7bb
push dword [esp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.HDWOMH_6aod_QddeNmda]
test eax, eax
je 0x46b7e9
je 0x46b596
jne 0x46b596
add byte [eax], al
add byte [eax], al
jmp 0x46b764
pop ebp
ret 8
mov byte [esp + 9], 0
mov byte [esp + 0xa], 0
je 0x46b576
jne 0x46b576
push 0x46b5bc
ret
mov edx, dword [esp + 4]
push edx
call fcn.004a4b33
add esp, 4
je 0x46b5a3
jne 0x46b5a3
je 0xf82fa93
test dh, cl
std
invalid
push ebp
je 0x46b636
jne 0x46b636
je 0x468fa4
jne 0x468738
je 0x46b764
push 0x46b6c7
ret
Function at 0x4874a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax + 0x1d], ch
test byte [esi], al
ret
jmp fcn.004863fd
pop edi
pop ebx
pop ebp
jmp 0x486730
setne cl
mov eax, ecx
test eax, eax
je 0x486c9f
jne 0x486c9f
mov eax, dword [esi + 4]
mov dword [eax + 0x418], 0
je 0x486ffc
jmp 0x48702a
push dword [esi + 4]
call dword [sym.imp.HDWOMH_6aod_OddwmGzmpl_ieUfephml]
mov eax, 1
pop esi
pop edi
je 0x486ff8
jne 0x486ff8
add esp, 8
push 0x48723e
ret
ret 8
jmp 0x486fda
jne 0x486ffc
je 0x48658a
jmp 0x4870de
jne 0x486964
invalid
jmp 0x48751a
push ebp
push ebx
je 0x487545
jne 0x487545
jmp 0x48bf0d8d
push 0x487698
ret
push ecx
call fcn.00464860
add esp, 0xc
jmp 0x487790
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x24]
mov esi, ecx
lea ecx, [esp + 8]
je 0x4876a5
jne 0x4876a5
jmp 0xd0fa74
push eax
push ebx
jmp 0x487529
mov edi, esp
mov ecx, edi
push 0x4bfb6d
call fcn.00470d80
je 0x4877e6
jne 0x4877e6
je 0x486fc7
jne 0x48605b
je 0x46827f
invalid
push 0x4bfb57
call fcn.00470d80
je 0x48766a
jne 0x48766a
add byte [eax], al
add byte [eax], al
push 0x487634
ret
lea ecx, [esi + 0x10]
je 0x4875bf
jne 0x4875bf
je 0x486d05
jne 0x48694e
jmp 0x48be505d
je 0x487521
jne 0x487521
jmp 0x5e593c24
mov ecx, edi
call fcn.00470f90
je 0x4876d5
jne 0x4876d5
add byte [eax], al
add byte [eax], al
push 0x4876c1
ret
Function at 0x492fc0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push esi
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov esi, dword [edx]
mov dword [eax + 0x10], esi
mov esi, dword [edx + 4]
mov dword [eax + 0x14], esi
mov esi, dword [edx + 8]
mov dword [eax + 0x18], esi
mov esi, dword [edx + 0xc]
mov dword [eax + 0x1c], esi
lea esi, [edx + 0x10]
cmp ecx, 0x100
cmovne esi, edx
mov ecx, str.expand_32_byte_kexpand_16_byte_k
mov edx, 0x4aa690
cmove edx, ecx
mov ecx, dword [esi]
mov dword [eax + 0x20], ecx
mov ecx, dword [esi + 4]
mov dword [eax + 0x24], ecx
mov ecx, dword [esi + 8]
mov dword [eax + 0x28], ecx
mov ecx, dword [esi + 0xc]
mov dword [eax + 0x2c], ecx
mov ecx, dword [edx]
mov esi, dword [edx + 4]
mov dword [eax], ecx
mov dword [eax + 4], esi
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
pop esi
ret

Function at 0x4930f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov dword [esp + 0x78], ecx
mov eax, dword [edx]
mov dword [esp + 0x38], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x3c], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x40], eax
mov eax, dword [edx + 0xc]
mov dword [esp + 0x44], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x48], eax
mov eax, dword [edx + 0x14]
mov dword [esp + 0x4c], eax
mov eax, dword [edx + 0x18]
mov dword [esp + 0x50], eax
mov eax, dword [edx + 0x1c]
mov dword [esp + 0x54], eax
mov eax, dword [edx + 0x20]
mov dword [esp + 0x58], eax
mov eax, dword [edx + 0x24]
mov dword [esp + 0x5c], eax
mov ebp, dword [edx + 0x28]
mov ebx, dword [edx + 0x2c]
mov edi, dword [edx + 0x30]
mov esi, dword [edx + 0x34]
mov ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x3c]
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x74], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x6c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x68], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x64], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x60], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov ebp, dword [esp + 0x54]
Function at 0x49c660
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x49c6f3
mov dword [eax + 0x48], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 8], 0xf3bcc908
mov dword [eax + 0x14], 0xbb67ae85
mov dword [eax + 0x10], 0x84caa73b
mov dword [eax + 0x1c], 0x3c6ef372
mov dword [eax + 0x18], 0xfe94f82b
mov dword [eax + 0x24], 0xa54ff53a
mov dword [eax + 0x20], 0x5f1d36f1
mov dword [eax + 0x2c], 0x510e527f
mov dword [eax + 0x28], 0xade682d1
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x30], 0x2b3e6c1f
mov dword [eax + 0x3c], 0x1f83d9ab
mov dword [eax + 0x38], 0xfb41bd6b
mov dword [eax + 0x44], 0x5be0cd19
mov dword [eax + 0x40], 0x137e2179
xor eax, eax
ret
mov eax, 1
ret

Function at 0x49c7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x320
mov eax, 0xffffffc0
nop word cs:[eax + eax]
nop
movsd xmm0, qword [ecx + eax + 0x48]
movsd qword [esp + eax + 0x90], xmm0
add eax, 8
jne 0x49c810
mov dword [esp + 0x94], ecx
mov eax, 0xffffff80
mov ecx, dword [edx + eax + 0x80]
mov esi, dword [edx + eax + 0x84]
bswap esi
bswap ecx
mov dword [esp + eax + 0x11c], ecx
mov dword [esp + eax + 0x118], esi
add eax, 8
jne 0x49c830
mov eax, 0xfffffe00
nop word [eax + eax]
mov esi, dword [esp + eax + 0x308]
mov ecx, dword [esp + eax + 0x30c]
mov edi, ecx
shld edi, esi, 0xd
mov edx, esi
shld edx, ecx, 0xd
mov ebx, ecx
shld ebx, esi, 0x1a
xor ebx, edi
mov edi, ecx
shld edi, esi, 3
shld esi, ecx, 3
xor ebx, esi
mov dword [esp + 8], ebx
shr ecx, 6
xor ecx, edx
xor ecx, edi
mov edi, dword [esp + eax + 0x2a0]
mov edx, dword [esp + eax + 0x2a4]
mov esi, edx
shld esi, edi, 0x1f
mov ebx, edx
shld ebx, edi, 0x19
xor ebx, esi
mov esi, edx
shld esi, edi, 0x18
xor ebx, esi
mov esi, edi
shld esi, edx, 0x1f
shld edi, edx, 0x18
shr edx, 7
xor edx, esi
xor edx, edi
mov esi, dword [esp + eax + 0x298]
add esi, dword [esp + eax + 0x2e0]
mov edi, dword [esp + eax + 0x29c]
adc edi, dword [esp + eax + 0x2e4]
add esi, dword [esp + 8]
adc edi, ecx
add esi, ebx
adc edi, edx
mov dword [esp + eax + 0x318], esi
mov dword [esp + eax + 0x31c], edi
add eax, 8
jne 0x49c860
mov eax, dword [esp + 0x8c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x74]
mov edi, dword [esp + 0x70]
mov eax, dword [esp + 0x84]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x54]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x58]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x30], 0
nop word [eax + eax]
Function at 0x49d690
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
push edi
push esi
sub esp, 0xa0
mov esi, dword [esp + 0xb0]
mov edi, dword [esp + 0xb4]
push edi
push 0x20
push dword [esp + 0xc0]
call fcn.0049d460
add esp, 0xc
and byte [edi], 0xf8
mov al, byte [edi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
mov ebx, esp
push edi
push ebx
call fcn.00497780
add esp, 8
push ebx
push esi
call fcn.00497710
add esp, 0xa8
pop esi
pop edi
pop ebx
ret
Function at 0x403b39
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe4
mov eax, dword [0x4d35d8]
push ebx
push esi
inc eax
mov esi, ecx
invalid
je 0x403b76

Function at 0x40836c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x408394
push cs
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x408386
pop edi
pop esi
pop ebp
ret 4
Function at 0x41c12d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4d2363]
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], al
push 0x8000
push edi
mov esi, edx
call fcn.0042dcde
pop ecx
push eax
call fcn.0042daff
cmp dword [esi + 0xc], 0xb
mov ebx, eax
pop ecx
pop ecx
je 0x459114
lea ecx, [ebp - 0x18]
call fcn.0041c20f
mov ecx, esi
call fcn.00408ed9
mov ecx, dword [esi + 8]
lea edx, [ebp - 0x18]
call fcn.0041f9ed
push dword [ebp - 0x18]
push 0x49e1b8
push edi
call fcn.0041c23d
add esp, 0xc
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
jne 0x459134
lea ecx, [ebp - 0x18]
call fcn.0040bdb1
mov esi, dword [ebp - 8]
push edi
call fcn.0042e122
push edi
call fcn.0042dcde
pop ecx
pop ecx
cmp ebx, 0xffffffff
sti
push dword [ebp + 5]
push edi
mov ecx, esi
call fcn.004728de
push eax
push 1
call fcn.0047286e
push eax
call fcn.0042df3c
add esp, 0x10
mov esi, eax
jmp 0x41c1a5
mov ecx, esi
call fcn.00408ed9
mov eax, dword [esi + 8]
push dword [eax]
call dword [0x49d240]
jmp 0x41c19a
Function at 0x439614
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00439493
Function at 0x46a011
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420194
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.004211a9
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x46a06c
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x46a063
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x46eb06
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, ecx
xor esi, esi
mov dword [ebp - 4], eax
mov byte [0x4d239d], 0
mov ebx, edx
test edi, edi
je 0x46eb58
mov byte [0x4d239e], 1
call dword [0x49d180]
mov dword [ebp - 0xc], eax
xor ecx, ecx
lea eax, [ebp + 0x10]
mov dword [ebp - 8], edi
push eax
push ecx
lea eax, [ebp - 0xc]
push eax
push 0x46efc7
push ecx
push ecx
call fcn.0042d5e1
mov esi, eax
add esp, 0x18
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push eax
call dword [0x49d6fc]
mov edi, eax
test esi, esi
je 0x46eb83
push 0xffffffffffffffff
push esi
mov byte [0x4d239e], 0
call dword [0x49d16c]
push esi
call dword [0x49d360]
cmp byte [0x4d239d], 1
jne 0x46eb91
or eax, 0xffffffff
jmp 0x46eb93
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x472934
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub dword [0x4d16e0], 1
jne 0x472942
call fcn.00472a1e
mov eax, dword [0x4d4014]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4d4014], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x47297a
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
sub dword [0x4d16e0], 1
jne 0x47298d
call fcn.00472a1e
mov eax, dword [0x4d4014]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4d4014], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x4729d0
fadd qword [0x4c91e0]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4c91b0]
leave
ret

Function at 0x4729de
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4d3650], ecx
inc esi
mov edx, esi
mov eax, dword [edx*4 + 0x4d364c]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [edx*4 + 0x4d3650], eax
inc edx
cmp edx, 0x270
jl 0x4729ea
mov dword [0x4d16e0], esi
mov dword [0x4d4010], esi
pop esi
ret