joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b8d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0040b8b0
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sym._read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x40b91c
call sym.__errno
cmp dword [eax], 4
je 0x40b8f0
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40d420
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0040e540
call sym.___main
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40d458
jmp 0x40d4f6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40d457
cmp cl, 0x22
je 0x40d4b0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x40d4d0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x40d4d0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x40d490
jmp 0x40d4d0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x40d4b0
cmp cl, 0x22
je 0x40d532
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x40d4f0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x40d4e0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x40d514
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x40d4d0

Function at 0x40d9e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x448ba0]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40da20
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x40ddd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x448ba0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40deac
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x40dec1
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x40de80
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x40de18
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x40de28
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x40de73
test edx, edx
jne 0x40de66
test ecx, ecx
je 0x40de10
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x40ded0
cmp eax, 8
je 0x40de10
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40de02
call sym.___w32_sharedptr_initialize
mov eax, dword [0x448ba0]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x40ddf4
call sym._fc_key_init_once
mov eax, dword [0x448ba0]
jmp 0x40ddf4
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x40de6b
mov eax, dword [0x448ba0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40df23
mov edi, dword [eax + 0x30]
test edi, edi
js 0x40df4e
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x40df2f
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x448ba0]
jmp 0x40df01
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40df12
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40df12
call sym._fc_key_init_once
mov eax, dword [0x448ba0]
jmp 0x40df08
Function at 0x40e050
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov eax, dword [0x448ba0]
test eax, eax
je 0x40e0b0
mov esi, dword [eax + 0x30]
test esi, esi
js 0x40e0d0
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x40e0f0
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x40e140
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sym.___w32_sharedptr_initialize
mov eax, dword [0x448ba0]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x40e072
jmp 0x40e0d0
call sym._fc_key_init_once
mov eax, dword [0x448ba0]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x40e079
jmp 0x40e0f0
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x40e0a1
lea esi, [esi]
mov eax, dword [0x448ba0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40e18d
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x40e199
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x40e16e
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40e15d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40e15d
call sym.___w32_sharedptr_initialize
mov eax, dword [0x448ba0]
jmp 0x40e14c
call sym._fc_key_init_once
mov eax, dword [0x448ba0]
jmp 0x40e153
Function at 0x40e1b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x448ba0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40e244
mov esi, dword [eax + 0x30]
test esi, esi
js 0x40e260
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x40e280
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x40e238
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x40e2ff
mov eax, dword [0x448ba0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40e2d6
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40e2f0
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40e2b0
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
jmp 0x40e1f5
call sym.___w32_sharedptr_initialize
mov eax, dword [0x448ba0]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x40e1d0
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x448ba0]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x40e1db
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40e1de
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40e227
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40e227
call sym.___w32_sharedptr_initialize
mov eax, dword [0x448ba0]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x40e219
nop
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x448ba0]
jmp 0x40e219
call sym._abort
lea esi, [esi]
lea edi, [edi]
Function at 0x40e310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x40e3a2
mov eax, dword [0x448ba0]
test eax, eax
je 0x40e396
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x40e411
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x40e3b7
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x40e42f
mov eax, dword [0x448ba0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40e402
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40e420
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40e3e3
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x448ba0]
jmp 0x40e332
mov dword [esp], edi
call sym.__Unwind_SjLj_RaiseException
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40e347
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40e385
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40e385
call sym.___w32_sharedptr_initialize
mov eax, dword [0x448ba0]
jmp 0x40e370
call sym._fc_key_init_once
mov eax, dword [0x448ba0]
jmp 0x40e33d
call sym._fc_key_init_once
mov eax, dword [0x448ba0]
jmp 0x40e37b
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x40e610
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov edx, eax
je 0x40e640
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call sym.___mingwthr_key_dtor
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret
Function at 0x411400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init

Function at 0x411d70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sym._fread
test eax, eax
mov edx, eax
jle 0x411dc0
movzx eax, byte [esi + eax - 1]
mov dword [ebx + 0x24], eax
mov ebx, dword [ebp - 8]
mov eax, edx
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [ebx + 0x24], 0xffffffff
mov eax, edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10001490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
push esi
push edi
push 0x1ff
lea eax, [ebp - 0x263]
push 0
push eax
mov byte [ebp - 0x264], 0
call fcn.1000af80
mov eax, 0x54
mov word [ebp - 0x5a], ax
lea ebx, [eax + 0x15]
mov eax, 0x53
mov word [ebp - 0x60], ax
mov eax, 0x65
mov word [ebp - 0x14], ax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x60]
push eax
push 0x80000002
mov dword [ebp - 8], 0x200
mov dword [ebp - 0x58], 0x410057
mov dword [ebp - 0x5e], 0x46004f
mov dword [ebp - 0x3c], 0x43005c
mov dword [ebp - 0x50], 0x4d005c
mov dword [ebp - 0x38], 0x790072
mov dword [ebp - 0x2c], 0x610072
mov dword [ebp - 0x24], 0x79
mov dword [ebp - 0x48], 0x6f0072
mov dword [ebp - 0x40], 0x740066
mov dword [ebp - 0x28], 0x680070
mov dword [ebp - 0x4c], 0x630069
mov dword [ebp - 0x54], 0x450052
mov dword [ebp - 0x30], 0x67006f
mov dword [ebp - 0x34], 0x740070
mov dword [ebp - 0x44], 0x6f0073
mov dword [ebp - 0xc], 0x64
mov dword [ebp - 0x1c], 0x680063
mov dword [ebp - 0x18], 0x6e0069
mov dword [ebp - 0x12], 0x750047
mov dword [ebp - 0x20], 0x61004d
mov word [ebp - 0xe], bx
call fcn.10005c90
add esp, 0x20
pop edi
pop esi
pop ebx
test eax, eax
jne 0x10001619
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call fcn.10005810
add esp, 0x18
test eax, eax
je 0x100015fa
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x60]
push eax
push 0x80000002
call fcn.10005c90
add esp, 0x14
test eax, eax
jne 0x10001619
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call fcn.10005810
add esp, 0x18
test eax, eax
jne 0x10001619
push 0xffffffffffffffff
lea eax, [ebp - 0x264]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000a32f
push dword [ebp - 4]
call fcn.10005d00
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x100016f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc90
push ebx
mov eax, 0x43
mov word [ebp - 0x54], ax
push esi
mov eax, 0x52
mov word [ebp - 0x84], ax
mov ecx, 0x72
mov eax, 0x4d
push edi
mov word [ebp - 0x7e], ax
mov eax, ecx
mov ebx, 0x65
push 0x7fc
mov word [ebp - 0x24], ax
lea eax, [ebp - 0xc8c]
push 0
lea esi, [ebx + 0xa]
push eax
mov dword [ebp - 0x52], 0x720075
mov dword [ebp - 0x6a], 0x690057
mov dword [ebp - 0x7c], 0x630069
mov dword [ebp - 0x88], 0x410057
mov dword [ebp - 0x82], 0x5c0045
mov dword [ebp - 0x90], 0x4f0053
mov dword [ebp - 0x76], 0x73006f
mov dword [ebp - 0x72], 0x66006f
mov dword [ebp - 0x42], 0x730072
mov dword [ebp - 0x8c], 0x540046
mov dword [ebp - 0x5c], 0x4e0020
mov dword [ebp - 0x4c], 0x6e0065
mov dword [ebp - 0x3e], 0x6f0069
mov dword [ebp - 0x6e], 0x5c0074
mov dword [ebp - 0x58], 0x5c0054
mov dword [ebp - 0x48], 0x560074
mov dword [ebp - 0x60], 0x730077
mov dword [ebp - 0x66], 0x64006e
mov word [ebp - 0x4e], cx
mov word [ebp - 0x78], cx
mov dword [ebp - 0x3a], 0x6e
mov word [ebp - 0x62], si
mov word [ebp - 0x44], bx
mov dword [ebp - 0x22], 0x64006f
mov dword [ebp - 0x1e], 0x630075
mov dword [ebp - 0x28], 0x50006c
mov dword [ebp - 0x2c], 0x610074
mov dword [ebp - 0x1a], 0x490074
mov dword [ebp - 0x30], 0x690067
mov dword [ebp - 0x16], 0x64
mov dword [ebp - 0x34], 0x690044
mov dword [ebp - 0xc90], 0
call fcn.1000af80
lea eax, [ebp - 4]
push eax
push 0x101
push 0
lea eax, [ebp - 0x90]
push eax
push 0x80000002
mov dword [ebp - 8], 0x800
call fcn.10005c90
add esp, 0x20
test eax, eax
jne 0x10001912
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc90]
push eax
push 0
push 0
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 4]
call fcn.10005810
add esp, 0x18
test eax, eax
jne 0x10001907
push 0x3ff
push eax
mov byte [ebp - 0x490], al
lea eax, [ebp - 0x48f]
push eax
call fcn.1000af80
push dword [ebp - 8]
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0xc90]
push eax
call fcn.10001690
add esp, 0x18
xor eax, eax
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x490]
mov dword [ebp - 0x10], 0x730025
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100018c0
sub eax, edx
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x100018d8
xor eax, eax
jmp 0x100018f2
lea eax, [esi + esi]
call fcn.1000a8d0
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x490]
push ecx
push eax
call fcn.10003aa0
push eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000999f
add esp, 0x14
push dword [ebp - 4]
call fcn.10005d00
add esp, 4
lea esp, [ebp - 0xc9c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002430
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x20
mov dword [ebp - 4], 0
call fcn.10005bf0
push eax
call fcn.10005eb0
add esp, 0xc
test eax, eax
je 0x1000249d
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push 0
call fcn.10006000
add esp, 0xc
test eax, eax
je 0x1000249d
mov eax, dword [ebp - 0xc]
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call fcn.10005d60
add esp, 0x18
push dword [ebp - 4]
call fcn.10005c40
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x10002810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x864
mov eax, dword [ebp + 0x14]
mov dword [0x1003a3ec], eax
mov eax, dword [ebp + 0x10]
mov dword [0x1003a3f0], eax
mov eax, dword [ebp + 0xc]
push 0x3ff
mov dword [0x1003a3f4], eax
lea eax, [ebp - 0x863]
push 0
push eax
mov byte [ebp - 0x864], 0
call fcn.1000af80
push 0x3ff
lea eax, [ebp - 0x463]
push 0
push eax
mov byte [ebp - 0x464], 0
call fcn.1000af80
lea eax, [ebp - 0x864]
push eax
call fcn.10001010
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x464]
push 0x400
push eax
mov word [ebp - 0x64], 0x4f5c
mov dword [ebp - 0x52], 0x6674742e
mov dword [ebp - 0x61], 0x61536e65
mov word [ebp - 0x57], 0x6269
mov word [ebp - 0x54], 0x646c
mov word [ebp - 0x59], 0x6d65
mov word [ebp - 0x5c], 0x2d73
mov byte [ebp - 0x55], 0x6f
mov byte [ebp - 0x5d], 0x6e
mov byte [ebp - 0x5a], 0x53
mov byte [ebp - 0x4e], 0
mov byte [ebp - 0x62], 0x70
mov dword [ebp - 0x41], 0x6c756765
mov dword [ebp - 0x45], 0x522d736e
mov word [ebp - 0x3b], 0x742e
mov dword [ebp - 0x4a], 0x536e6570
mov word [ebp - 0x38], 0x66
mov word [ebp - 0x4c], 0x4f5c
mov byte [ebp - 0x46], 0x61
mov word [ebp - 0x3d], 0x7261
mov byte [ebp - 0x39], 0x74
mov word [ebp - 0x34], 0x4f5c
mov word [ebp - 0x24], 0x742e
mov dword [ebp - 0x29], 0x696c6174
mov word [ebp - 0x31], 0x6e65
mov byte [ebp - 0x32], 0x70
mov word [ebp - 0x21], 0x66
mov word [ebp - 0x2e], 0x6e61
mov byte [ebp - 0x2f], 0x53
mov word [ebp - 0x2b], 0x492d
mov byte [ebp - 0x2c], 0x73
mov byte [ebp - 0x25], 0x63
mov byte [ebp - 0x22], 0x74
mov dword [ebp - 0x1a], 0x536e6570
mov dword [ebp - 0xe], 0x6674742e
mov dword [ebp - 0x13], 0x6c6f422d
mov word [ebp - 0x1c], 0x4f5c
mov word [ebp - 0x15], 0x736e
mov byte [ebp - 0x16], 0x61
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], 0
mov dword [ebp - 7], 0x732573
mov byte [ebp - 8], 0x25
call fcn.100097e4
lea eax, [ebp - 0x464]
push eax
call fcn.10005de0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x464]
push 0x400
push eax
call fcn.100097e4
add esp, 0x50
lea eax, [ebp - 0x464]
push eax
call fcn.10005de0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x464]
push 0x400
push eax
call fcn.100097e4
lea eax, [ebp - 0x464]
push eax
call fcn.10005de0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x464]
push 0x400
push eax
call fcn.100097e4
lea eax, [ebp - 0x464]
push eax
call fcn.10005de0
add esp, 0x3c
mov esp, ebp
pop ebp
ret
Function at 0x10003400
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebx + 0x1384], 0xffffffff
mov dword [ebx + 4], 0x1571
mov esi, 0x1571
mov edx, 1
lea edi, [ebx + 8]
mov eax, esi
shr eax, 0x1e
xor esi, eax
imul esi, esi, 0x6c078965
add esi, edx
inc edx
mov dword [edi], esi
lea edi, [edi + 4]
cmp edx, 0x270
jl 0x10003426
push 0x1388
push dword [ebp + 8]
mov dword [ebx], 0x270
push ebx
call fcn.1000a930
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10003d00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
mov edi, edi
mov ecx, dword [edi + 4]
shl ebx, cl
mov esi, dword [edi]
mov eax, dword [esi]
cmp eax, 0x270
jne 0x10003d29
mov ecx, esi
call fcn.10004010
jmp 0x10003d37
cmp eax, 0x4e0
jb 0x10003d37
mov ecx, esi
call fcn.10003f50
mov eax, dword [esi]
inc eax
mov edx, dword [esi + eax*4]
mov dword [esi], eax
mov eax, dword [esi + 0x1384]
mov ecx, edx
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
cmp ecx, dword [edi + 8]
ja 0x10003d15
mov eax, dword [ebp - 4]
add eax, dword [edi + 4]
or ebx, ecx
mov dword [ebp - 4], eax
cmp eax, 0x20
jb 0x10003d10
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003f50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
lea edi, [ebx + 0x9c4]
mov ecx, 0xe3
mov edx, dword [edi + 4]
xor edx, dword [edi]
lea edi, [edi + 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
shr edx, 1
xor eax, edx
mov dword [edi - 0x9c4], eax
dec ecx
jne 0x10003f60
lea esi, [ebx + 0xd50]
mov edi, 0x18c
nop
mov ecx, dword [esi]
xor ecx, dword [esi + 4]
lea esi, [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
shr ecx, 1
xor eax, ecx
mov dword [esi - 0x9c4], eax
dec edi
jne 0x10003fa0
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
shr ecx, 1
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret

Function at 0x10004010
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
lea esp, [esp]
mov edx, dword [eax - 4]
xor edx, dword [eax]
lea eax, [eax + 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
shr edx, 1
xor ecx, edx
mov dword [eax + 0x9b8], ecx
dec esi
jne 0x10004020
pop esi
ret