joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4135c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
push str.GetNativeSystemInfo
push str.kernel32.dll
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4135ed
lea ecx, [ebp - 0x38]
push ecx
call eax
jmp 0x4135f7
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24]
test eax, eax
mov ecx, 1
cmovg ecx, eax
or eax, 0xffffffff
push str.VPX_SIMD_CAPS
mov dword [edi + 0x2040], ecx
xor esi, esi
mov dword [ebp - 0x14], eax
call fcn.005ccbed
add esp, 4
test eax, eax
je 0x41363f
cmp byte [eax], 0
je 0x41363f
push esi
push esi
push eax
call fcn.005ccb3f
add esp, 0xc
mov dword [edi + 0x2c90], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.VPX_SIMD_CAPS_MASK
call fcn.005ccbed
add esp, 4
test eax, eax
je 0x413665
cmp byte [eax], 0
je 0x413665
push 0
push 0
push eax
call fcn.005ccb3f
add esp, 0xc
mov dword [ebp - 0x14], eax
push ebx
mov eax, 0
mov ecx, 0
cpuid
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
cmp dword [ebp - 4], 1
jae 0x413691
pop ebx
mov dword [edi + 0x2c90], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, 0
cpuid
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
test eax, 0x800000
mov ecx, 1
cmovne esi, ecx
test eax, 0x2000000
je 0x4136c3
or esi, 2
test eax, 0x4000000
je 0x4136cd
or esi, 4
mov eax, dword [ebp - 8]
test al, 1
je 0x4136d7
or esi, 8
test eax, 0x200
je 0x4136e1
or esi, 0x10
test eax, 0x80000
je 0x4136eb
or esi, 0x20
and eax, 0x18000000
cmp eax, 0x18000000
jne 0x41372f
xor ecx, ecx
xgetbv
and eax, 6
cmp eax, 6
jne 0x41372f
test ecx, ecx
jne 0x41372f
or esi, 0x40
mov eax, 7
mov ecx, 0
cpuid
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
test byte [ebp - 0x10], 0x20
je 0x41372f
or esi, 0x80
mov eax, dword [ebp - 0x14]
and eax, esi
pop ebx
mov dword [edi + 0x2c90], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x14]
push ebx
shl eax, 3
push esi
mov esi, edx
mov dword [ebp - 0x28], eax
lea eax, [esi*4]
push edi
mov edi, ecx
mov dword [ebp - 4], ecx
sub ecx, eax
lea eax, [esi + esi]
mov edx, edi
sub edx, eax
lea eax, [edi + esi]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp + 0x14], eax
nop
mov eax, dword [ebp + 0x10]
push dword [ebp + 0x14]
mov al, byte [eax]
mov bl, byte [edx]
push dword [ebp - 4]
lea ecx, [edx + esi]
movzx esi, al
mov eax, dword [ebp + 0x14]
mov dl, byte [ecx]
mov al, byte [eax]
push ecx
movzx ecx, dl
push dword [ebp - 8]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], eax
mov al, byte [edi]
mov edi, dword [ebp + 0x14]
add edi, dword [ebp - 0x10]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], eax
movzx eax, bl
sub eax, ecx
mov ecx, dword [ebp - 0x18]
cdq
xor eax, edx
sub eax, edx
cmp eax, esi
mov eax, dword [ebp - 0x14]
movzx eax, al
setg bl
movzx ecx, cl
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
mov ecx, dword [ebp - 0xc]
neg bl
cmp eax, esi
mov esi, dword [ebp - 0x10]
setg al
neg al
or bl, al
movzx eax, byte [edi + esi]
push eax
movzx eax, byte [edi]
push eax
push dword [ebp - 0x14]
movzx eax, byte [ecx + esi]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push eax
movzx eax, byte [ecx]
push eax
mov eax, dword [ebp + 8]
mov dl, byte [eax]
mov eax, dword [ebp + 0xc]
mov cl, byte [eax]
call fcn.00413ba0
add esp, 0x20
mov dl, bl
mov cl, al
call fcn.00413c90
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 4]
mov edx, dword [ebp - 8]
inc dword [ebp + 0x14]
inc dword [ebp - 0xc]
inc eax
inc edi
inc edx
add esp, 0x10
mov dword [ebp - 4], edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x28]
jl 0x413e10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
push ebx
push esi
shl eax, 3
push edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
lea esi, [ecx + 1]
nop
mov bl, byte [esi - 3]
mov eax, dword [ebp + 0x10]
lea edi, [esi - 3]
mov al, byte [eax]
lea edx, [esi - 2]
lea ecx, [esi - 1]
push esi
mov dword [ebp - 0x10], ebx
mov bl, byte [edx]
push ecx
push edx
push edi
mov dword [ebp - 0xc], ebx
movzx ebx, al
mov al, byte [esi]
mov dword [ebp - 4], eax
mov al, byte [ecx]
mov ecx, dword [ebp - 0xc]
movzx ecx, cl
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
movzx eax, al
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
setg al
neg al
mov byte [ebp + 0x17], al
mov eax, dword [ebp - 8]
movzx ecx, al
mov eax, dword [ebp - 4]
movzx eax, al
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
mov bl, byte [ebp + 0x17]
setg al
neg al
or bl, al
movzx eax, byte [esi + 2]
push eax
movzx eax, byte [esi + 1]
push eax
push dword [ebp - 4]
movzx eax, byte [esi - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push eax
movzx eax, byte [esi - 5]
push eax
mov eax, dword [ebp + 8]
mov dl, byte [eax]
mov eax, dword [ebp + 0xc]
mov cl, byte [eax]
call fcn.00413ba0
add esp, 0x20
mov dl, bl
mov cl, al
call fcn.00413c90
mov eax, dword [ebp - 0x14]
add esi, dword [ebp - 0x18]
inc eax
add esp, 0x10
mov dword [ebp - 0x14], eax
cmp eax, dword [ebp - 0x1c]
jl 0x413f00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4141e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
push ebx
shl eax, 3
push esi
mov dword [ebp - 0x2c], eax
lea eax, [edx*4]
mov esi, ecx
sub esi, eax
lea eax, [edx + edx*2]
mov ebx, ecx
sub ebx, eax
mov dword [ebp - 0xc], ebx
mov ebx, ecx
lea eax, [edx + edx]
sub ebx, eax
mov dword [ebp - 4], ecx
add ecx, edx
push edi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 8], ebx
mov dword [ebp + 0x14], ecx
mov eax, dword [ebp + 0x10]
lea edi, [ecx + edx]
mov al, byte [eax]
movzx esi, al
mov eax, dword [ebp + 0x14]
lea ecx, [ebx + edx]
mov al, byte [eax]
mov bl, byte [ebx]
mov dl, byte [ecx]
push edi
push dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 4]
push ebx
mov al, byte [ebx]
mov ebx, dword [ebp - 0x18]
push ecx
movzx ecx, dl
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
movzx eax, bl
sub eax, ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], edx
cdq
xor eax, edx
sub eax, edx
cmp eax, esi
mov eax, dword [ebp - 0x10]
push dword [ebp - 0xc]
movzx eax, al
setg bl
movzx ecx, cl
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
neg bl
cmp eax, esi
mov esi, dword [ebp - 0xc]
setg al
neg al
or bl, al
mov eax, dword [ebp - 0x24]
movzx eax, byte [edi + eax]
push eax
movzx eax, byte [edi]
mov edi, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
movzx eax, byte [esi]
push dword [ebp - 0x14]
push dword [ebp - 0x28]
push dword [ebp - 0x18]
push eax
movzx eax, byte [edi]
push eax
mov eax, dword [ebp + 8]
mov dl, byte [eax]
mov eax, dword [ebp + 0xc]
mov cl, byte [eax]
call fcn.00413ba0
add esp, 0x20
mov dl, bl
mov cl, al
call fcn.00413fc0
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
inc dword [ebp - 4]
inc ecx
inc ebx
inc esi
inc edi
add esp, 0x18
mov dword [ebp + 0x14], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x1c], edi
inc eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x2c]
jl 0x414226
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
push ebx
push esi
shl eax, 3
push edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
lea esi, [ecx + 1]
nop
mov bl, byte [esi - 3]
mov eax, dword [ebp + 0x10]
lea edi, [esi - 3]
mov al, byte [eax]
lea edx, [esi - 2]
lea ecx, [esi - 1]
mov dword [ebp - 0x10], ebx
mov bl, byte [edx]
mov dword [ebp - 0xc], ebx
movzx ebx, al
mov al, byte [esi]
mov dword [ebp - 4], eax
mov al, byte [ecx]
mov dword [ebp - 8], eax
lea eax, [esi + 1]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, al
push esi
push ecx
mov ecx, dword [ebp - 0xc]
push edx
movzx ecx, cl
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
setg al
neg al
mov byte [ebp + 0x17], al
mov eax, dword [ebp - 8]
movzx ecx, al
mov eax, dword [ebp - 4]
movzx eax, al
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
mov bl, byte [ebp + 0x17]
push edi
setg al
neg al
or bl, al
movzx eax, byte [esi + 2]
lea edi, [esi - 4]
push edi
push eax
movzx eax, byte [esi + 1]
push eax
push dword [ebp - 4]
movzx eax, byte [edi]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push eax
movzx eax, byte [esi - 5]
push eax
mov eax, dword [ebp + 8]
mov dl, byte [eax]
mov eax, dword [ebp + 0xc]
mov cl, byte [eax]
call fcn.00413ba0
add esp, 0x20
mov dl, bl
mov cl, al
call fcn.00413fc0
mov eax, dword [ebp - 0x14]
add esi, dword [ebp - 0x18]
inc eax
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp eax, dword [ebp - 0x1c]
jl 0x414330
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4144f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov edx, esi
sub edx, ebx
lea eax, [ebx + ebx]
mov ecx, esi
sub ecx, eax
push edi
mov dword [ebp - 4], edx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], 0x10
movzx eax, byte [edx]
movzx ecx, byte [esi]
sub eax, ecx
movzx ecx, byte [esi + ebx]
lea edi, [esi + ebx]
push edi
push esi
push edx
cdq
mov ebx, eax
mov eax, dword [ebp + 8]
xor ebx, edx
movzx eax, byte [eax]
sub eax, ecx
sub ebx, edx
cdq
xor eax, edx
sub eax, edx
cdq
sub eax, edx
sar eax, 1
lea ecx, [eax + ebx*2]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
movzx eax, byte [eax]
cmp ecx, eax
setle cl
neg cl
mov edx, ebx
call fcn.00414400
mov edx, dword [ebp - 4]
inc ebx
inc edx
add esp, 0xc
inc esi
dec dword [ebp - 8]
mov dword [ebp + 8], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
jne 0x414517
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
inc esi
mov dword [ebp + 8], 0x10
movzx ecx, byte [esi]
lea eax, [esi - 1]
push esi
push eax
movzx eax, byte [esi - 3]
sub eax, ecx
movzx ecx, byte [esi - 1]
cdq
xor eax, edx
sub eax, edx
cdq
sub eax, edx
mov edi, eax
movzx eax, byte [esi - 2]
sub eax, ecx
lea ebx, [esi - 2]
cdq
xor eax, edx
sub eax, edx
sar edi, 1
push ebx
lea ecx, [edi + eax*2]
mov eax, dword [ebp + 0x10]
lea edx, [esi - 3]
movzx eax, byte [eax]
cmp ecx, eax
setle cl
neg cl
call fcn.00414400
add esi, dword [ebp + 0xc]
add esp, 0xc
dec dword [ebp + 8]
jne 0x414591
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x489fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6a4108]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
test edx, edx
jns 0x489ffb
xor edx, edx
jmp 0x48a005
mov eax, 0x113
cmp edx, eax
cmovg edx, eax
movss xmm0, dword [ebp + 0xc]
movss xmm2, dword [0x612878]
movss xmm1, dword [0x61289c]
mov ecx, 0xffff
movzx eax, cx
mov ecx, eax
push ebx
shl eax, 0x10
or ecx, eax
push esi
mov dword [0x73fe54], ecx
push edi
mov word [0x73fe54], dx
mov byte [0x73fe40], 5
mov byte [0x73fe52], 0xff
movss dword [0x73febc], xmm0
mov dword [0x73fe58], ecx
mov dword [0x73fe5c], ecx
mov dword [0x73fe60], ecx
mov dword [0x73fe64], ecx
mov word [0x73fe68], 0
xor edi, edi
mov edx, 0x73fe54
mov ebx, 0x114
xorps xmm3, xmm3
nop
movzx esi, word [edx]
cmp si, bx
jae 0x48a0d6
mov ecx, esi
mov eax, esi
shl eax, 4
sub eax, ecx
movss xmm0, dword [eax*4 + 0x629960]
ucomiss xmm0, xmm3
lahf
test ah, 0x44
jnp 0x48a0d6
ucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x48a0b8
cmp edi, 9
jge 0x48a0b8
lea eax, [esi + 1]
mov word [edx + 2], ax
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jnp 0x48a0cf
add edx, 2
inc edi
cmp edx, 0x73fe68
jl 0x48a080
jmp 0x48a0d6
mov byte [0x73fe69], 1
movzx eax, word [0x73fe54]
mov ecx, eax
shl ecx, 4
sub ecx, eax
movss xmm1, dword [0x73fe6c]
movss xmm0, dword [ecx*4 + 0x629928]
mulss xmm0, dword [0x73febc]
movss xmm4, dword [ecx*4 + 0x62992c]
mov al, byte [0x73fe52]
divss xmm4, xmm0
movss xmm0, dword [0x73fe70]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [0x73fe74]
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [0x73fe78]
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [0x73fe7c]
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [0x73fe80]
movss dword [ebp - 8], xmm0
movss xmm0, dword [ecx*4 + 0x629948]
subss xmm0, dword [ecx*4 + 0x629930]
pop edi
movss dword [ebp - 0x1c], xmm1
pop esi
mov byte [0x73fe53], 0xff
addss xmm0, xmm1
movss xmm1, dword [ecx*4 + 0x629950]
movss dword [ebp - 0x2c], xmm1
pop ebx
movss dword [ebp - 0x34], xmm0
movss xmm0, dword [ecx*4 + 0x62994c]
movss dword [ebp - 0x30], xmm0
cmp al, 0xff
je 0x48a1b7
movzx eax, al
movss xmm0, dword [eax*4 + str.33Aff]
divss xmm0, dword [str.33Aff]
mulss xmm0, xmm1
movss dword [ebp - 0x2c], xmm0
movss xmm0, dword [ecx*4 + 0x629954]
movq xmm3, qword [ebp - 0x1c]
movq xmm2, qword [ebp - 0x14]
movq xmm1, qword [ebp - 0xc]
movss dword [ebp - 0x28], xmm0
movss xmm0, dword [ecx*4 + 0x629958]
movss dword [ebp - 0x24], xmm0
movss xmm0, dword [ecx*4 + 0x62995c]
mov ecx, dword [ebp - 4]
movss dword [ebp - 0x20], xmm0
movq xmm0, qword [ebp - 0x34]
movq qword [0x73fe9c], xmm0
movq xmm0, qword [ebp - 0x2c]
movq qword [0x73fea4], xmm0
movq xmm0, qword [ebp - 0x24]
xor ecx, ebp
movq qword [0x73fe84], xmm3
movq qword [0x73fe8c], xmm2
movq qword [0x73fe94], xmm1
movq qword [0x73feac], xmm0
movq qword [0x73fe6c], xmm3
movq qword [0x73fe74], xmm2
movq qword [0x73fe7c], xmm1
mov dword [0x73feb4], 0
movss dword [0x73feb8], xmm4
mov byte [0x73fe6a], 0
call fcn.005c7124
mov esp, ebp
pop ebp
ret
Function at 0x4b94b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x69b1fc]
cmp eax, 0x270
jl 0x4b9597
cmp eax, 0x271
jne 0x4b94d4
push 0x1571
call fcn.004b9650
add esp, 4
xor edx, edx
jmp 0x4b94e0
mov ecx, dword [edx*4 + 0x740c5c]
xor ecx, dword [edx*4 + 0x740c58]
inc edx
and ecx, 0x7fffffff
xor ecx, dword [edx*4 + 0x740c54]
mov eax, ecx
and eax, 1
shr ecx, 1
xor ecx, dword [eax*4 + 0x69b200]
xor ecx, dword [edx*4 + 0x741288]
mov dword [edx*4 + 0x740c54], ecx
cmp edx, 0xe3
jl 0x4b94e0
cmp edx, 0x26f
jge 0x4b9563
push esi
lea esi, [edx*4 + 0x740c58]
mov ecx, dword [esi]
xor ecx, dword [esi + 4]
add esi, 4
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and eax, 1
shr ecx, 1
mov eax, dword [eax*4 + 0x69b200]
xor eax, dword [esi - 0x390]
xor eax, ecx
mov dword [esi - 4], eax
cmp esi, 0x741614
jl 0x4b9530
pop esi
mov ecx, dword [0x740c58]
xor ecx, dword [0x741614]
and ecx, 0x7fffffff
xor ecx, dword [0x741614]
mov eax, ecx
and eax, 1
shr ecx, 1
xor ecx, dword [eax*4 + 0x69b200]
xor ecx, dword [0x741288]
xor eax, eax
mov dword [0x741614], ecx
mov ecx, dword [eax*4 + 0x740c58]
inc eax
mov dword [0x69b1fc], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x4b9650
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov dword [0x740c58], eax
mov esi, 1
mov eax, 0x740c58
mov edx, dword [eax]
shr edx, 0x1e
xor edx, dword [eax]
add eax, 4
imul edx, edx, 0x6c078965
add edx, esi
mov dword [eax], edx
inc esi
cmp eax, 0x741614
jl 0x4b9666
mov dword [0x69b1fc], esi
pop esi
pop ebp
ret
Function at 0x4c0120
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
call fcn.004ef900
test eax, eax
je 0x4c027a
call fcn.004ef900
mov ecx, eax
call fcn.004af940
test eax, eax
jne 0x4c027a
cmp dword [0x69b230], 1
je 0x4c027a
push ebx
mov dword [0x69b230], 1
call fcn.004135b0
mov ecx, dword [0x7419a8]
mov ecx, dword [ecx + 4]
call fcn.00509360
mov ecx, dword [0x7419a8]
lea eax, [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
push eax
call fcn.004fb920
movss xmm0, dword [0x69b238]
mov ecx, dword [0x7419a8]
sub esp, 0x10
mov ecx, dword [ecx + 0xc]
movss dword [esp + 0xc], xmm0
movss xmm0, dword [0x69b234]
movss dword [esp + 8], xmm0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.004fb320
call fcn.004d31f0
mov bl, al
call fcn.004b99d0
call fcn.004e4480
cmp byte [0x741999], 0
jne 0x4c01e5
cmp bl, 1
jne 0x4c01e0
call fcn.004c0020
jmp 0x4c01e5
call fcn.004dd4e0
call fcn.004bfa30
push 0
push 0
push 0
call fcn.004e4470
add esp, 0xc
call fcn.004be9b0
cmp byte [0x741999], 0
jne 0x4c0248
call fcn.004d7cc0
cmp byte [0x741999], 0
jne 0x4c0248
cmp bl, 1
jne 0x4c0248
call fcn.004135b0
call fcn.004d0dc0
call fcn.004d1340
call fcn.004de390
cmp byte [0x741a95], bl
jne 0x4c023a
call fcn.004c1430
cmp byte [0x741a29], 1
jne 0x4c0248
call fcn.004c0d50
movd xmm0, dword [0x7419b0]
inc dword [0x741994]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x7419c8]
cvttss2si eax, xmm0
mov dword [0x7419b0], eax
call fcn.004135b0
call fcn.004c05a0
pop ebx
jmp fcn.004b94b0
ret
Function at 0x4e7560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x4e7573
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test al, 1
jne 0x4e758b
test eax, 0x300
jne 0x4e758b
inc dword [edi + 0x14]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0
call fcn.004e7370
mov esi, eax
add esp, 4
test esi, esi
jne 0x4e75a2
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push esi
call fcn.004e4d70
mov ecx, dword [ebp + 0xc]
and ecx, 0xfffffffe
or ecx, 2
add esp, 8
cmp dword [edi + 0x3c], 0
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], 0
jle 0x4e7629
lea ebx, [edi + 0x1c]
lea esp, [esp]
mov eax, dword [ebx]
push ecx
push eax
mov dword [ebp - 4], eax
call fcn.004e6d90
add esp, 8
test eax, eax
jne 0x4e75e8
cmp dword [ebp - 4], eax
jne 0x4e7606
mov ecx, dword [esi + 0x3c]
add ebx, 4
mov dword [esi + ecx*4 + 0x1c], eax
mov eax, dword [ebp + 8]
inc dword [esi + 0x3c]
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [edi + 0x3c]
jge 0x4e7629
mov ecx, dword [ebp + 0xc]
jmp 0x4e75d0
dec dword [esi + 0x14]
jne 0x4e7620
push esi
call fcn.004e7a50
push esi
call fcn.004e4db0
push esi
call fcn.004e6730
add esp, 0xc
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push 0
push dword [edi + 0x10]
call fcn.004e7560
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
movq xmm0, qword [edi + 0x48]
movq qword [esi + 0x48], xmm0
movq xmm0, qword [edi + 0x50]
movq qword [esi + 0x50], xmm0
movq xmm0, qword [edi + 0x58]
movq qword [esi + 0x58], xmm0
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x6c]
mov dword [esi + 0x6c], eax
movq xmm0, qword [edi + 0x70]
movq qword [esi + 0x70], xmm0
movq xmm0, qword [edi + 0x78]
add esp, 8
movq qword [esi + 0x78], xmm0
mov eax, dword [edi + 0x80]
mov dword [esi + 0x80], eax
pop ebx
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4f1b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fd13f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x6a4108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0x10
lea ecx, [edi + 0x26c]
call fcn.004f8230
mov byte [ebp - 4], 0xf
lea ecx, [edi + 0x260]
call fcn.004f8230
mov byte [ebp - 4], 0xe
lea ecx, [edi + 0x250]
call fcn.0051e400
mov byte [ebp - 4], 0xd
lea ecx, [edi + 0x210]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xd
add ecx, 8
call fcn.004f1ab0
mov byte [ebp - 4], 0xc
lea ecx, [edi + 0x1e0]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xc
add ecx, 8
call fcn.004f1ab0
mov byte [ebp - 4], 0xb
lea ecx, [edi + 0x1d4]
call fcn.0051e400
mov byte [ebp - 4], 0xa
lea ecx, [edi + 0x1cc]
call fcn.0051e400
mov byte [ebp - 4], 9
lea ecx, [edi + 0x1c4]
call fcn.0051e400
mov byte [ebp - 4], 8
push fcn.0051e400
push 4
push 8
lea eax, [edi + 0x1a4]
push eax
call fcn.005c9bc8
mov byte [ebp - 4], 7
lea ecx, [edi + 0x134]
call fcn.004f1480
mov byte [ebp - 4], 6
lea ecx, [edi + 0xc4]
call fcn.004f1550
mov byte [ebp - 4], 5
lea ecx, [edi + 0x54]
call fcn.004f1550
mov byte [ebp - 4], 4
lea esi, [edi + 0x4c]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x15
mov eax, dword [esi]
push eax
push dword [eax]
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0050df60
mov byte [ebp - 4], 4
push dword [esi]
call fcn.005c68e1
add esp, 4
mov byte [ebp - 4], 3
lea esi, [edi + 0x44]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0x19
mov eax, dword [esi]
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0050df60
mov byte [ebp - 4], 3
push dword [esi]
call fcn.005c68e1
add esp, 4
mov byte [ebp - 4], 2
lea esi, [edi + 0x3c]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0x1d
mov eax, dword [esi]
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0055b8d0
mov byte [ebp - 4], 2
push dword [esi]
call fcn.005c68e1
add esp, 4
mov byte [ebp - 4], 1
lea esi, [edi + 0x30]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0x21
mov eax, dword [esi]
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.004f3670
mov byte [ebp - 4], 1
push dword [esi]
call fcn.005c68e1
add esp, 4
mov byte [ebp - 4], 0
lea esi, [edi + 4]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0x24
call fcn.0050f000
cmp dword [eax + 4], 0
je 0x4f1d4e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 0
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0
lea eax, [esi + 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
push eax
call fcn.005e26c5
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.AgSingleton_class_AgInputManager_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret