joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001bbe
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
je 0x10001c02
push 0xfb
xor ebx, ebx
push ebx
push 0x124a
push 0x16cb
push 0x1cc7
push ebx
push 0x252d
push 0x8fd
push 0x26c8
call dword [sym.imp.USER32.dll_DrawIconEx]
jmp 0x10001caf
mov dword [esp + 0x14], 0x7607
cmp dword [esp + 0x14], 0x7785
push 0
pop ebx
jle 0x10001c87
push ebx
push 0x172f
call dword [sym.imp.USER32.dll_KillTimer]
mov esi, ebx
mov dword [esp + 0x10], ebx
mov edi, esi
mov esi, 0x6945
mov eax, edi
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10001c48
mov eax, dword [eax]
push eax
call fcn.100497ec
pop ecx
push ebx
push 1
lea ecx, [esp + 0x20]
call fcn.100058e2
dec edi
dec esi
jne 0x10001c30
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x2f31
jl 0x10001c29
push 0x319
push 0x11d8
push ebx
push 0x26cf
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10001c9a
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
cmp dword [esp + 0x14], 0x72c7
jge 0x10001caf
push str.osqvx_esuzhmia_srv
call fcn.100497ec
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001ddd
Capabilities:
Create pipe

Disassembly:
mov eax, 0x10061e71
call fcn.10061878
sub esp, 0x24
mov byte [ebp - 0x14], dl
push ebx
mov ebx, ecx
mov dword [ebp - 0x28], ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10001f07
mov dword [ebp - 0x24], 0x2555
cmp dword [ebp - 0x24], 0x290b
jle 0x10001e6c
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], 0x5478
mov ebx, edi
mov dword [ebp - 0x18], 0x480b
xor esi, esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x1007d818
cdq
push edx
push eax
call fcn.1000513b
inc esi
cmp esi, 0x5597
jl 0x10001e29
dec ebx
dec dword [ebp - 0x18]
jne 0x10001e27
mov esi, dword [ebp - 0x20]
add edi, esi
dec dword [ebp - 0x1c]
jne 0x10001e1e
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x2348
jl 0x10001e15
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, dword [ebp - 0x28]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x21fe
jge 0x10001ea7
mov edx, str.dfgzdnu_qawfwk_jjhz_vyqneflr_zvo_qiuta_iddknbrs_dnuovl_zvmj
mov ecx, 0x1007d818
call fcn.100077d7
jmp 0x10001ea7
mov esi, dword [ebp + 0x1c]
or dword [ebp - 4], 0xffffffff
mov dword [esi], 0
jmp 0x10001f00
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x86992f1e
push dword [ebp + 0x18]
mov dword [ebp - 0x30], 0xfffffff9
mov edx, ebx
push 0x331f
push ecx
push dword [ebp + 0x20]
push 0
push 0x2f69
push dword [ebp + 0x10]
push 0x25b8
push ecx
push ecx
push 0x2c76
push esi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x30]
push eax
call fcn.1000298a
add esp, 0x3c
dec dword [esi]
cmp dword [esi], 0xfffffff8
jge 0x10001eb6
jmp 0x10001f2f
push 0
push 0x13aa
push 0x56e
push 0x792
push 0x212b
push 0xf66
push 0x2703
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100020bb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 8], cl
test dl, dl
je 0x10002126
cmp byte [ebp + 0x10], 0
je 0x100020e7
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1000214b
push 0x59a
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x1000214b
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x100020f7
push ecx
call fcn.10002754
jmp 0x1000213d
push 1
push 0x10a0
push 1
push 0x6634
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0xfff6
push 0x4e7f
push eax
mov ecx, 0x76e7
call fcn.10001a9d
add esp, 0x1c
jmp 0x1000214b
test cl, cl
je 0x10002140
push 0x6ed1
xor dl, dl
mov byte [ebp - 2], 0
lea ecx, [ebp - 2]
call fcn.100020a4
pop ecx
jmp 0x1000214b
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esp, ebp
pop ebp
ret
Function at 0x100025ee
Capabilities:
Get common file path
Terminate process

Disassembly:
mov eax, 0x10061e99
call fcn.10061878
push ecx
push ecx
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
je 0x1000267d
mov eax, dword [edx]
mov ecx, 0xbe67e784
mov edi, dword [ebp + 0x28]
cmp ecx, eax
sbb edx, edx
xor ecx, ecx
inc edx
mov eax, dword [edi]
sub eax, 0x6d76e0bd
cmp edx, eax
mov eax, dword [ebp + 0x1c]
setl cl
xor esi, esi
sub ecx, 0x218a5f22
mov dword [eax], ecx
cmp dword [eax], esi
jne 0x1000263e
mov eax, dword [ebp + 0xc]
cmp dword [eax], esi
je 0x10002641
xor esi, esi
inc esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov ecx, dword [eax]
mov eax, dword [edi]
imul ecx, esi
mov esi, dword [ebp + 0x14]
cmp ecx, eax
mov eax, dword [esi]
setg bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, dword [eax]
setle cl
mov dword [esi], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0x5c75
cmp dword [ebp - 0x14], 0x5e0a
jle 0x10002698
push 0x562
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp + 0x20]
xor esi, esi
cmp byte [eax], 0
je 0x100026ae
push 0x59a
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x5bf5
jge 0x1000266c
mov edx, str.mjzu_nswddtlu_ocmaz_inrac_pakmlvrts_gzrezc_yym_hrid_xyeerap_islrdku_hmnhou_tzdbocd_qcevz_xukef
mov ecx, 0x1007d818
call fcn.100077d7
jmp 0x1000266c
Function at 0x10009646
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
je 0x10009690
cmp byte [edx], 0
je 0x10009719
push 0xfb
xor ebx, ebx
push ebx
push 0x124a
push 0x16cb
push 0x1cc7
push ebx
push 0x252d
push 0x8fd
push 0x26c8
call dword [sym.imp.USER32.dll_DrawIconEx]
jmp 0x10009719
mov dword [ebp - 0xc], 0x385e
cmp dword [ebp - 0xc], 0x3bdf
push 0
pop ebx
jle 0x100096f0
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x24]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100096cc
mov eax, dword [eax]
push eax
call fcn.100497ec
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x24]
call fcn.100058e2
inc edi
cmp edi, 0x78d6
jl 0x100096b1
inc esi
cmp esi, 0x5eed
jl 0x100096af
mov byte [ebp - 5], bl
cmp dword [ebp - 0xc], 0x37d7
jge 0x10009707
push str.aczvsdf_dbdkfnhkz_vhgxif_zcm_htt
call fcn.100497ec
pop ecx
cmp byte [ebp - 5], 0
je 0x10009719
push 0x59a
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009be3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov byte [ebp - 8], dl
mov eax, ecx
mov dword [ebp - 0x10], 0x1424
cmp dword [ebp - 0x10], 0x1651
push esi
push edi
mov dword [ebp - 0x14], eax
jle 0x10009c6b
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
lea eax, [ebx + edi]
xor eax, ecx
lea ecx, [ebp - 0x2c]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10009c2b
mov eax, dword [eax]
push eax
call fcn.100497ec
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100058e2
mov ecx, dword [ebp - 0xc]
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, 0x6fd5
jl 0x10009c0f
inc ebx
cmp ebx, 0x6fe9
jl 0x10009c0a
inc edi
cmp edi, 0x5698
jl 0x10009c08
inc esi
cmp esi, 0x24e
jl 0x10009c06
mov eax, dword [ebp - 0x14]
cmp byte [ebp - 8], 0
je 0x10009c80
push 0x59a
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x10009c82
inc dword [eax]
cmp dword [ebp - 0x10], 0x1409
jge 0x10009c96
push str.ygepb_ztu_qjkesvzx_ujipput_dcs_ydbadirm_srwdcmu_zli_nnarvw_tthtrckb
call fcn.100497ec
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d831
Capabilities:
Compare security identifiers
Get session user name

Disassembly:
mov eax, 0x100624b7
call fcn.10061878
sub esp, 0x3c
push ebx
push esi
mov byte [ebp - 0x14], dl
mov ebx, ecx
mov dword [ebp - 0x28], 0x6887
xor esi, esi
cmp dword [ebp - 0x28], 0x695f
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ebx
jle 0x1000d8e2
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x18], esi
mov edi, esi
mov dword [ebp - 0x24], esi
mov ebx, esi
mov eax, edi
mov dword [ebp - 0x20], 0x2b7c
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
or eax, edi
lea ecx, [ebp - 0x44]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000d89a
mov eax, dword [eax]
push eax
call fcn.100497ec
pop ecx
push esi
push 1
lea ecx, [ebp - 0x44]
call fcn.100058e2
mov eax, dword [ebp - 0x1c]
add eax, ebx
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jne 0x1000d883
mov edi, dword [ebp - 0x24]
dec ebx
cmp ebx, 0xffff87d3
jg 0x1000d874
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x1cfb
jl 0x1000d872
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x76f5
jl 0x1000d86d
mov ebx, dword [ebp - 0x2c]
cmp dword [ebp - 0x28], 0x6614
jge 0x1000d8f6
push str.bgqb_jyjzj_mllz_fvdvlzoe_mwnyih
call fcn.100497ec
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x1000d920
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
push eax
push ecx
mov ecx, ebx
call fcn.1000f23d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x28], 0x28be
cmp dword [ebp - 0x28], 0x2c38
jle 0x1000d96a
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x2c], esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x1007d818
or eax, edi
cdq
push edx
push eax
call fcn.1000513b
inc esi
cmp esi, 0x2a6d
jl 0x1000d937
inc ebx
push 0
pop esi
cmp ebx, 0x6ceb
jl 0x1000d934
inc edi
cmp edi, 0x508a
jl 0x1000d932
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000d97a
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x2797
jge 0x1000d90f
mov edx, str.rclnwdbb_ilt_kqq_jtwbsptuw_xgwgxxuge_ahruf_oeqko_muazhw_zsx_hisfn_fqqth_skdmibsi_wmturz_jlkgxe
mov ecx, 0x1007d818
call fcn.100077d7
jmp 0x1000d90f
Function at 0x10011e58
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x10011e70
mov eax, dword [ecx]
mov dword [ecx], eax
jmp 0x10011f63
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [esi], ebx
jmp 0x10011f5a
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10011eab
push ebx
push 0x13aa
push 0x56e
push 0x792
push 0x212b
push 0xf66
push 0x2703
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp - 8], 0x5886
cmp dword [ebp - 8], 0x5b27
jle 0x10011f29
push 0x1108
push 0x84c
push ebx
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
xor edi, edi
xor esi, esi
lea eax, [esi + edi]
and eax, ebx
lea ecx, [ebp - 0x20]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10011eea
mov eax, dword [eax]
push eax
call fcn.100497ec
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.100058e2
inc esi
cmp esi, 0x5613
jl 0x10011ed0
inc edi
cmp edi, 0x590e
jl 0x10011ece
inc ebx
cmp ebx, 0x18bc
jl 0x10011ecc
push 0x1ad0
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov esi, dword [ebp + 0x10]
mov byte [ebp - 1], bl
cmp dword [ebp - 8], 0x5681
jge 0x10011f40
push str.mzcicsft_txszxzx_vpoihqdj_qgmfa_tgkdrye_fbpayffm_uaq_fpnw_orciijtpf
call fcn.100497ec
pop ecx
cmp byte [ebp - 1], 0
je 0x10011f58
push ebx
push 0x59a
push ebx
push 0x2675
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
inc dword [esi]
cmp dword [esi], 2
jle 0x10011e7c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100124b0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push esi
test cl, cl
je 0x100124ef
cmp byte [ebp + 0x14], 0
je 0x100124ca
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1001252a
mov edx, dword [ebp + 0x20]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1001252a
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x1f7e2799
inc dword [edx]
cmp dword [edx], 1
jl 0x100124db
jmp 0x1001252a
cmp byte [ebp + 0x18], 0
je 0x100124fe
mov eax, dword [ebp + 0x24]
mov ecx, dword [edx]
mov dword [eax], ecx
jmp 0x1001252a
mov eax, dword [ebp + 0x28]
push 0x1a
pop esi
mov ecx, dword [eax]
cmp ecx, esi
jge 0x10012514
mov eax, dword [ebp + 0x1c]
movzx edx, word [eax]
add edx, ecx
jmp 0x10012521
mov eax, ecx
cdq
idiv esi
mov eax, dword [ebp + 8]
movzx eax, word [eax]
add edx, eax
mov ecx, dword [ebp + 0x10]
push edx
call fcn.100141fc
pop esi
pop ebp
ret
Function at 0x10013375
Capabilities:
Resume thread

Disassembly:
mov eax, 0x100627c3
call fcn.10061878
sub esp, 0xc
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x100133de
cmp byte [ebp + 8], 0
je 0x100133bf
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x100134bf
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 1
jl 0x100133ab
jmp 0x100134bf
mov dword [esi], 0
jmp 0x100133d4
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 1
inc dword [esi]
cmp dword [esi], 2
jl 0x100133c7
jmp 0x100134bf
cmp byte [ebp + 0x20], 0
je 0x100134a7
mov dword [ebp - 0x14], 0x3a90
cmp dword [ebp - 0x14], 0x3ab7
jle 0x1001343a
xor esi, esi
mov dword [ebp + 0x10], esi
mov edi, esi
mov ebx, 0x8a
xor esi, esi
mov eax, edi
mov ecx, 0x1007d818
or eax, esi
cdq
push edx
push eax
call fcn.1000513b
inc esi
cmp esi, 0x3f6b
jl 0x10013406
dec edi
dec ebx
jne 0x10013404
mov esi, dword [ebp + 0x10]
inc esi
mov dword [ebp + 0x10], esi
cmp esi, 0x31f1
jl 0x100133fd
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1001346f
push 0xfb
push 0
push 0x124a
push 0x16cb
push 0x1cc7
push 0
push 0x252d
push 0x8fd
push 0x26c8
call dword [sym.imp.USER32.dll_DrawIconEx]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x3a13
jge 0x1001348b
mov edx, str.qnqdga_anbsva_awwfzjb_mcfksf_fsrsru_vprshgc_jrzjcr_cxulx_ulsikbb_akooesdj
mov ecx, 0x1007d818
call fcn.100077d7
jmp 0x100134bf
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x100134bf
push 0x110e
push 0x918
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10013510
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x24], 0
push esi
mov esi, edx
mov dword [ebp - 4], ecx
je 0x10013537
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1001359e
push 0x59a
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x1001359e
mov eax, dword [ebp + 8]
mov ecx, 0xbe67e784
push ebx
push edi
mov edi, dword [ebp + 0x20]
mov eax, dword [eax]
cmp ecx, eax
sbb edx, edx
xor ecx, ecx
mov eax, dword [edi]
inc edx
sub eax, 0x6d76e0bd
cmp edx, eax
setl cl
xor edx, edx
sub ecx, 0x218a5f22
mov dword [esi], ecx
cmp dword [esi], edx
jne 0x1001356e
mov eax, dword [ebp + 0x18]
cmp dword [eax], edx
je 0x10013571
xor edx, edx
inc edx
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [edi]
imul ecx, edx
pop edi
cmp ecx, eax
mov eax, dword [esi]
setg bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 4]
pop ebx
setne dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, dword [eax]
setle cl
mov dword [esi], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001445b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10014472
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10014494
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1007ef44
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1007f2d0
jl 0x100144a2
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1007f574
jl 0x100144e2
mov ecx, dword [0x100802c0]
xor ecx, dword [0x1007ef44]
and ecx, edi
xor ecx, dword [0x100802c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1007ef40], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1007f574]
mov dword [0x1007f900], eax
pop esi
ret
Function at 0x100176af
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100176dd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 1
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.1001775d
add esp, 0xc
jmp 0x10017757
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10017721
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001771f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10017757
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x40]
push eax
call fcn.10014880
pop ecx
mov esi, eax
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call fcn.10016572
shl eax, 1
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + eax*4 + 4]
mov dword [ecx], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001a1fa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001a257
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001a233
push 0x59a
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x1001a255
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1001a27d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
push 0x3919
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x7ca2
push 1
call fcn.1001a1ba
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1001bd1e
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001bd59
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1001bd44
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x1001bd54
push 0xcf0
push 0x23dd
call dword [sym.imp.USER32.dll_MonitorFromWindow]
jmp 0x1001be1c
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1001be0c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x1001bde7
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x1001bdb9
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x1001bdb9
and dword [ebp - 0xc], 0
jmp 0x1001bdc0
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xfffffff7
jle 0x1001bdcf
mov dword [ebp - 0x10], 1
jmp 0x1001bdd3
and dword [ebp - 0x10], 0
push 7
pop eax
sub eax, dword [ebp - 0x10]
cmp eax, 0xfffffff6
je 0x1001bde7
mov dword [ebp - 0x14], 1
jmp 0x1001bdeb
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
neg eax
cmp eax, 1
je 0x1001bdfe
mov dword [ebp - 0x18], 1
jmp 0x1001be02
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x1001be1c
push 0x110e
push 0x918
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esp, ebp
pop ebp
ret