joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407a12
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.00434f57
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x407a3e
call fcn.00407924
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x409b66
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x43e13d
call fcn.0042eaff
cmp byte [0x4539d5], 0
mov edi, dword [ebp + 8]
jne 0x409ba6
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.00408b08
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.0042eab5
pop ecx
test esi, esi
je 0x409bb4
mov al, 1
jmp 0x409bfa
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x409ba0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x409bc5
xor al, al
jmp 0x409bfa
lea ecx, [ebp - 0x50]
call fcn.0040a427
lea ecx, [ebp - 0x28]
call fcn.00407e94
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0040a643
test al, al
je 0x409bef
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.0042eab5
pop ecx
mov al, bl
call fcn.0042eac8
ret 4

Function at 0x409c02
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4539d5], 0
jne 0x409c3c
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b08
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042eab5
pop ecx
test esi, esi
pop esi
je 0x409c4b
mov al, 1
jmp 0x409c4d
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x409c36
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x409ddd
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040ac62
cmp eax, 0xffffffff
je 0x409e0a
mov ecx, eax
and cl, 0x11
cmp cl, 1
jne 0x409e0a
and eax, 0xfffffffe
push eax
push esi
call fcn.0040a37e
test al, al
je 0x409e42
cmp byte [0x4539d5], 0
push esi
jne 0x409e38
lea eax, [ebp - 0xc]
push eax
call fcn.00408b08
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042eab5
pop ecx
test esi, esi
je 0x409e42
mov al, 1
jmp 0x409e44
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jmp 0x409e32
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40a0bf
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4539d5], 0
jne 0x40a0f7
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b08
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042eab5
pop ecx
test esi, esi
pop esi
je 0x40a104
mov al, 1
jmp 0x40a106
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jmp 0x40a0f1
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x40a2d2
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4539d5], 0
jne 0x40a309
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b08
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042eab5
test esi, esi
pop ecx
setne al
pop esi
jmp 0x40a318
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40a37e
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4539d5], 0
jne 0x40a3b9
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b08
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042eab5
pop ecx
test esi, esi
pop esi
je 0x40a3c9
mov al, 1
jmp 0x40a3cb
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jmp 0x40a3b3
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x40ac62
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4539d5], 0
jne 0x40ac96
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b08
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042eab5
pop ecx
mov eax, esi
pop esi
jmp 0x40aca9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ae94
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40aebe
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40aebe
xor al, al
jmp 0x40aed2
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x418542
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43eaa1
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x44d094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0xa8]
call fcn.004185f1
lea ecx, [esi + 0x78]
call fcn.004185f1
push dword [esi + 0x30]
call fcn.0042eab5
push dword [esi + 0x24]
call fcn.0042eab5
push dword [esi + 0x18]
call fcn.0042eab5
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4185a6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 8]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x4185ba
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 4]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x4185ce
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4185e1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ae8f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f519
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x44d094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00419fad
lea ecx, [esi + 0x30]
call fcn.004185f1
push dword [esi + 0x24]
call fcn.0042eab5
pop ecx
lea ecx, [esi + 0xc]
call fcn.00407a69
mov ecx, esi
call fcn.0041ae55
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b519
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x43f601
call fcn.0042eaff
mov esi, ecx
push 0
push dword [ebp + 0xc]
lea ecx, [esi + 0x68]
push dword [ebp + 8]
call fcn.0041b088
push 0xce4
lea eax, [ebp - 0x18]
push eax
call fcn.0041a0ff
push dword [eax]
and dword [ebp - 4], 0
push dword [esi + 0x6c]
call fcn.0040bef1
push dword [ebp - 0x18]
call fcn.0042eab5
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
call fcn.0042eac8
ret 8
Function at 0x42d87f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x44d094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push 0x208
push esi
push eax
call fcn.004303f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x42d91b
push edi
push esi
call fcn.0042dbd2
push dword [edi]
and dword [ebp - 0x210], 0
call fcn.0042eaac
pop ecx
push 0
lea ecx, [ebp - 0x210]
mov dword [ebx], eax
push ecx
push dword [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e84e
mov esp, ebp
pop ebp
ret 8

Function at 0x42dbd2
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42dbfd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42dbfd
xor al, al
jmp 0x42dc11
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x437b1f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x443e98
push str.FlsAlloc
push 0x1e
call fcn.004379fd
mov esi, eax
add esp, 0x10
test esi, esi
je 0x437b53
push dword [ebp + 8]
mov ecx, esi
call dword [0x440280]
call esi
jmp 0x437b59
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x437b9d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x443ebc
push str.FlsGetValue
push 0x20
call fcn.004379fd
mov esi, eax
add esp, 0x10
test esi, esi
je 0x437bd4
push dword [ebp + 8]
mov ecx, esi
call dword [0x440280]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4391ae
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x43924b
push ebx
push esi
call fcn.00439177
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043782d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4391f8
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43924a
push edi
push eax
call fcn.00436d28
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x439218
call fcn.00436cee
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x439249
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043782d
add esp, 0x20
test eax, eax
jne 0x439237
push edi
call fcn.00436cee
jmp 0x43923f
push ebx
call fcn.00436cee
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4068dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 0x2000
mov edi, ecx
call fcn.00420db6
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.0040522e
mov esi, dword [ebp + 8]
cmp word [esi], 0x23
je 0x406929
push 3
pop ebx
mov eax, dword [ebp - 4]
dec dword [eax]
jne 0x40691e
push eax
call fcn.00420e2c
pop ecx
push dword [ebp - 8]
call fcn.00420e2c
pop ecx
pop edi
pop esi
mov eax, ebx
ret
push 0xf
push 0x492624
push esi
call fcn.004237cb
add esp, 0xc
test eax, eax
je 0x406a72
push 0xb
push 0x49267c
push esi
call fcn.004237cb
add esp, 0xc
test eax, eax
je 0x406a7a
push 0xd
push 0x492644
push esi
call fcn.004237cb
add esp, 0xc
test eax, eax
je 0x43e2ba
push 0x16
push 0x4925f4
push esi
call fcn.004237cb
add esp, 0xc
test eax, eax
je 0x43e2c5
push 0xd
push 0x492660
push esi
call fcn.004237cb
add esp, 0xc
test eax, eax
je 0x43e348
push 8
push 0x49242c
push esi
call fcn.004237cb
add esp, 0xc
test eax, eax
je 0x43e38a
push 0xf
push 0x48fb50
push esi
call fcn.004237cb
add esp, 0xc
test eax, eax
je 0x4069e5
push 3
push 0x48fb70
push esi
call fcn.004237cb
add esp, 0xc
test eax, eax
jne 0x406a72
xor ebx, ebx
inc ebx
mov dword [ebp + 8], ebx
push ecx
mov ecx, dword [ebp + 0x14]
push esi
call fcn.0040586d
test al, al
je 0x43e3f7
mov eax, dword [ebp + 0x10]
push esi
inc dword [eax]
call fcn.00406faa
push esi
call fcn.00406f5d
push 0xf
push 0x48fb50
push esi
call fcn.004237cb
add esp, 0xc
test eax, eax
je 0x406a84
push 3
push 0x48fb70
push esi
call fcn.004237cb
add esp, 0xc
test eax, eax
je 0x406a84
push 0xd
push 0x48fb2c
push esi
call fcn.004237cb
add esp, 0xc
test eax, eax
je 0x406a5e
push 3
push 0x48fb48
push esi
call fcn.004237cb
add esp, 0xc
test eax, eax
jne 0x4069eb
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp + 8], eax
test eax, eax
jle 0x406907
jmp 0x4069eb
xor ebx, ebx
inc ebx
jmp 0x406907
xor ebx, ebx
inc ebx
mov byte [edi], bl
jmp 0x406907
inc dword [ebp + 8]
jmp 0x4069eb
lea ecx, [ebp - 0x30]
call fcn.00407631
lea ecx, [ebp - 0x20]
call fcn.00405db6
jmp 0x4068ec
dec ebp
push esi
call fcn.00420e47
pop ecx
push dword [ebp + 0x10]
call fcn.00422d70
mov ecx, dword [ebp - 0x6d1767b3]
imul edi, esp, 0xffffffff
jmp 0x43e28e
dec esp
inc ebx
dec byte [ebp + 0x4f8b0243]
add al, 0x50
mov edx, dword [ecx]
call dword [edx + 8]
push ebx
call fcn.00420e47
pop ecx
jmp 0x406a8d
xchg esp, edi
dec dword [ebx - 0x24ccd3b9]
inc ebx
mov eax, dword [eax + esi*4]
cmp dword [eax], ebx
jle 0x406922
push 4
jmp 0x406921
cld
dec dword [ebp + 0x1ee8d84d]
jne 0x43e3fc
call fcn.0040591f
test bl, bl
je 0x43e432
inc dword [ebx + ebx*8 - 0x7c16d28c]
xchg ah, bh
call dword [esi + 0x68]
mov byte [ebx + ecx*2 - 0x74ee1500], al
inc ebp
or byte [ebp + 0x58e0fc0], al
test esp, edi
call dword [esi + 0x68]
mov ah, 0x84
dec ebx
add byte [ebx - 0x3074efbb], cl
jmp 0x406a8d
Function at 0x415cf8
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x415d20
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x415d12
pop edi
pop esi
pop ebp
ret 4

Function at 0x420016
Capabilities:
Encrypt data using rc4 prga

Disassembly:
enter 0xffffffffffffebe8, 0xffffffffffffffcf
add byte [ebx + ecx*4], ah
inc ebp
or byte [ebx], dh
rcl byte [ebx + 0x33], cl
fisttp dword [ecx + 0x4356fc55]
mov dword [ebp - 0x10], edx
push edi
cmp dword [eax + 4], edx
je 0xc0415814
add al, byte [eax]
sbb al, 0x8b
dec ebp
sbb byte [ebx + 0x77070c7d], cl
dec dword [eax + 0x10458b10]
mov byte [ecx], dl
mov ecx, dword [ebp + 0x14]
mov dword [edi], edx
mov edi, edx
mov byte [eax], dl
mov dword [ebp - 0xc], 0x2b
mov byte [ecx], dl
mov dword [ebp - 8], 0x23
push edi
mov ecx, esi
call fcn.004079db
push 0x2b
pop ecx
push 0x5e
movzx eax, word [eax]
test edi, edi
mulps xmm5, xmmword [edx + 0x21]
pop edx
je 0x45581b
test edi, edi
jle 0x39993a3
invalid
cmp ax, word [ebp - 0xc]
jne 0x455826
mov eax, dword [ebp + 0x10]
jmp 0x455845
cmp ax, cx
jne 0x455830
mov eax, dword [ebp + 0x14]
jmp 0x455845
cmp ax, dx
jne 0x45583a
mov eax, dword [ebp + 0x18]
jmp 0x455845
push 0x23
pop ecx
cmp ax, cx
jne 0x455847
mov eax, dword [ebp + 0x1c]
mov byte [eax], bl
inc edi
jmp 0x420062

Function at 0x4233bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc dword [ebp - 0x2bca1f40]
xor dword [eax + eax - 1], ecx
adc eax, 0x48f33c
test eax, eax
je 0x4233de
loopne 0x423446
or bh, bh
rcr byte [ecx - 0x7b], 1
pop ecx
invalid
xor eax, eax
pop ebp
ret

Function at 0x4233e2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
je 0x42341d
mov ecx, dword [ebx - 0x2b5cf7bb]
xor dword [eax + eax + 0x5d], ecx
ret
add byte [esi + 0x70], bh
Function at 0x424453
Capabilities:
Encrypt data using rc4 prga

Disassembly:
je 0x42448e
mov eax, dword [ecx - 0x18]
imul edx, dword [ebp - 0x4a], 0xffffff80
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
test ecx, ecx
jne 0x424469
mov ecx, dword [eax + 0x1c]
movzx edx, word [ecx]
xor eax, eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test dx, dx
je 0x4244a9
movzx ebx, word [edi]
mov eax, edi
test bx, bx
je 0x424495
mov esi, ebx
cmp si, dx
je 0x424495
add eax, 2
movzx esi, word [eax]
mov bh, 0x30
test si, si
jne 0x424485
xor edx, edx
cmp word [eax], dx
je 0x4244a7
add ecx, 2
movzx edx, word [ecx]
test dx, dx
jne 0x42447c
xor edi, dword [edx + 0x3966f18b]
add dword [esi + edi + 0xf], esi
mov bh, 0x1f
mov esi, ecx
cmp word [ecx], ax
je 0x4244ee
movzx ebx, word [edi]
xor edx, edx
mov eax, edi
test bx, bx
je 0x4244d7
movzx edx, word [ecx]
mov dword [ebp + 8], edx
mov edx, ebx
cmp dx, word [ebp + 8]
je 0x4244d5
add eax, 2
movzx edx, word [eax]
test dx, dx
jne 0x4244c4
xor edx, edx
cmp word [eax], dx
jne 0x4244e6
add ecx, 2
cmp word [ecx], dx
jne 0x4244b5
jmp 0x4244ee
xor eax, eax
mov word [ecx], ax
add ecx, 2
mov eax, dword [ebp - 4]
pop edi
mov dword [eax + 0x1c], ecx
mov eax, esi
sub eax, ecx
neg eax
sbb eax, eax
and eax, esi
add byte [eax], al
add bh, dh
loop 0x4244c8
Function at 0x45f41c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov ebx, ecx
lea ecx, [ebp - 0x28]
push edi
call fcn.00407682
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push dword [ebx + 4]
mov edi, dword [esi + 4]
mov dword [ebp - 4], edi
call fcn.00407a31
mov eax, dword [ebp + 0x10]
test eax, eax
jns 0x45f484
push 0x7fffffff
push 0xffffffffffffffff
push edi
push eax
push dword [ebp + 0x14]
mov ecx, ebx
push dword [esi]
call fcn.0045f182
mov esi, eax
test esi, esi
jns 0x45f46d
neg eax
xor edi, edi
mov esi, edi
jmp 0x45f47d
push esi
xor edi, edi
lea ecx, [ebp - 0x18]
push edi
push ebx
call fcn.00407866
mov eax, dword [ebp + 0x10]
neg eax
mov dword [ebp + 0x10], eax
jmp 0x45f488
xor edi, edi
mov esi, edi
mov eax, dword [ebp + 8]
mov ecx, ebx
push 0xffffffffffffffff
push esi
dec dword [ecx - 0x78a7604]
push 1
adc al, 0x75
adc al, 0x14
xor al, ch
loopne 0x45f49c
invalid

Function at 0x4687bd
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4c3190]
jne 0x4687ca
call fcn.004688a4
mov eax, dword [0x4c6ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c6ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x468802
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4c3190]
jne 0x468814
call fcn.004688a4
mov eax, dword [0x4c6ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c6ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x468857
fadd qword [0x4b9e48]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4b9e20]
mov esp, ebp
pop ebp
ret

Function at 0x468867
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4c6530], ecx
inc esi
mov ecx, 0x4c6530
mov edx, esi
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x4c6eec
jl 0x468878
mov dword [0x4c3190], esi
mov dword [0x4c6518], esi
pop esi
ret
Function at 0x4688a4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c6518], 0
push esi
push edi
mov esi, 0x4c6530
jne 0x4688c3
push 0
call fcn.00425225
pop ecx
mov ecx, eax
call fcn.00468867
mov dword [0x4c3190], 0x270
mov edi, 0xe3
mov dword [0x4c6ef0], esi
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi], eax
mov esi, edx
dec edi
jne 0x4688d8
mov edi, 0x18c
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, ecx
mov dword [esi], eax
lea esi, [edx]
dec edi
jne 0x46890d
mov ecx, dword [0x4c6530]
mov al, cl
and al, 1
movzx edx, al
mov eax, dword [esi]
neg edx
pop edi
sbb edx, edx
xor eax, ecx
and eax, 0x7ffffffe
and edx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, edx
mov dword [esi], eax
pop esi
ret

Function at 0x469124
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
lea ecx, [ebp - 0xdc]
push esi
push edi
call fcn.00468f7a
push dword [ebp + 0x10]
lea ecx, [ebp - 0xdc]
call fcn.00468fc0
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x469168
mov edi, dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.004690f8
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x469152
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407300
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040a7ac
test esi, esi
jne 0x407336
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040a934
jmp 0x407354
call sub.KERNEL32.DLL_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004071e0
mov edi, eax
test esi, esi
je 0x407354
cmp dword [ebx], 0
je 0x407354
dec esi
jmp 0x40733d
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4093f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004098b4
mov byte [esp], al
cmp byte [esp], 0
jne 0x40957d
test edi, edi
je 0x40957d
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4094bd
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x409498
cmp edi, 0xffffffff
je 0x409459
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409459
mov byte [esp], 0
jmp 0x40957d
cmp dword [esi], 1
jg 0x409498
cmp dword [esi], 0
jne 0x40948a
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x40948a
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x40957d
lea eax, [esp + 0xc]
call fcn.004090a4
dec ebp
test ebp, ebp
jg 0x40943e
cmp edi, 0xffffffff
je 0x4094bd
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4094bb
mov byte [esp], 0
jmp 0x40957d
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x409402
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4094bd
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.004095f8
mov edx, eax
mov ebx, dword [0x7f78fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x409521
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40951f
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x409521
xor edi, edi
cmp byte [esp], 0
je 0x409547
mov ebx, dword [esi]
test bl, 1
jne 0x40955d
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409527
mov byte [esp + 1], 1
jmp 0x40955d
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409547
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x4094d4
cmp byte [esp], 0
je 0x40957d
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret