joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bbe0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3d8
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x42bc07
push 0x64
lea ecx, [esp + 0x124]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42bc11
xor edx, edx
mov word [esp + 0x120], dx
xor eax, eax
push 0xfe
push eax
lea ecx, [esp + 0x2a]
push ecx
mov word [esp + 0x2c], ax
call fcn.0048bac0
mov esi, dword [0x4c3854]
add esp, 0xc
test esi, esi
je 0x42bc5d
cmp byte [esi + 0x11], 0
je 0x42bc56
mov edx, dword [esi]
mov eax, dword [edx]
push eax
push 0x4a3260
mov eax, 0x7d
lea ecx, [esp + 0x28]
call fcn.00466f80
add esp, 8
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x42bc35
cmp word [esp + 0x20], 0
je 0x42bcb8
lea eax, [esp + 0x20]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42bc70
sub eax, edx
sar eax, 1
cmp eax, 0x7b
jbe 0x42bca6
mov esi, 0x7f
sub esi, eax
push esi
lea edi, [esp + eax*2 + 0x24]
push 0x49f3c0
push edi
call fcn.00485434
add esp, 0xc
xor ecx, ecx
mov word [edi + esi*2], cx
jmp 0x42bcb8
cmp word [esp + eax*2 + 0x1e], 0x20
lea eax, [esp + eax*2 + 0x20]
jne 0x42bcb8
xor edx, edx
mov word [eax - 2], dx
mov eax, dword [0x4bf870]
cmp byte [eax + 0xee], 0
je 0x42bcd7
cmp byte [0x4c3895], 0
mov dword [esp + 0x14], 1
je 0x42bcdf
mov dword [esp + 0x14], 0
mov eax, dword [0x4c0e78]
mov dword [esp + 0x18], str.__preempted:_they_will_resume_when_the_current_thread_finishes_
cmp eax, 1
jg 0x42bdfd
mov dword [esp + 0x18], 0x4a5c64
xor ebp, ebp
cmp dword [0x4c0e50], 0
mov edi, 0x49e1a0
je 0x42bd12
mov edi, 0x49e198
cmp dword [0x4c0e4c], 0
mov esi, 0x49e1a0
je 0x42bd25
mov esi, 0x49e198
push 1
call fcn.00410f70
mov bl, al
add esp, 4
lea eax, [esp + 0x1e8]
call fcn.00411300
mov ecx, dword [0x4c0e74]
mov edx, dword [0x4c0e78]
push eax
mov eax, dword [0x4c0e7c]
sub eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
mov eax, dword [0x4c385c]
push ecx
mov ecx, dword [0x4c3860]
push ebp
lea edx, [esp + 0x38]
push edx
push eax
push ecx
push edi
mov edi, dword [esp + 0x414]
push esi
lea edx, [esp + 0x14c]
push edx
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
mov esi, 0xfffe
call fcn.00466f40
lea esi, [edi + eax*2]
mov eax, esi
mov ebx, edi
sub eax, ebx
sar eax, 1
mov ecx, 0xfffe
add esp, 0x34
sub ecx, eax
push ecx
push esi
call fcn.00408d20
mov eax, esi
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42bdb2
sub eax, edx
sar eax, 1
cmp dword [0x4c189c], 0
lea edi, [esi + eax*2]
mov eax, str._r_nPress__F5__to_refresh.
jne 0x42bdd7
mov eax, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
mov edx, edi
sub edx, ebx
sar edx, 1
mov esi, 0xfffe
push eax
sub esi, edx
call fcn.00466f40
add esp, 4
lea eax, [edi + eax*2]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3d8
ret 4
lea ebp, [eax - 1]
jmp 0x42bcff
Function at 0x4311a8
Capabilities:
Log keystrokes

Disassembly:
cmp al, 0x9e
jne 0x4311b1
mov byte [esp + 0xc], 1
cmp al, 0x9c
je 0x4311bd
cmp al, 0x9d
je 0x4311bd
xor cl, cl
jmp 0x4311bf
mov cl, 1
cmp byte [esp + 0xc], 0
mov byte [esp + 0xe], cl
je 0x4311ee
xor edx, edx
cmp al, 0x9f
setne dl
mov ebx, 0x20a
lea edi, [edx - 1]
and edi, 0xf0
lock add byte [eax], al
add byte [ebx - 0x50f07739], al
jge 0x4311f2
shl edi, 0x10
jmp 0x43127c
test cl, cl
je 0x431213
xor edx, edx
cmp al, 0x9c
setne dl
mov ebx, 0x20e
lea edi, [edx - 1]
and edi, 0xffffff10
add edi, 0x78
imul edi, dword [ebp + 0xc]
shl edi, 0x10
jmp 0x43127c
movzx eax, al
dec eax
cmp eax, 5
ja case.0x431220.3
jmp dword [eax*4 + 0x431418]
mov ebx, 0x201
mov dword [esp + 0x14], 0x202
mov edi, 1
jmp 0x43127c
mov ebx, 0x204
mov dword [esp + 0x14], 0x205
mov edi, 2
jmp 0x43127c
mov ebx, 0x207
mov dword [esp + 0x14], 0x208
mov edi, 0x10
jmp 0x43127c
mov edi, 0x20
jmp 0x43126f
mov edi, 0x40
mov dword [esp + 0x14], 0x20c
mov ebx, 0x20b
cmp byte [esp + 0xd], 0
mov byte [esp + 0xf], 0
je 0x4312dd
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x24], eax
test eax, eax
je 0x4312ce
mov ecx, eax
cmp ecx, dword [0x4c2fa4]
je 0x4312ce
mov esi, dword [esp + 0x10]
call fcn.0046b600
test al, al
jne 0x4312ce
mov edx, dword [esp + 0x24]
mov eax, dword [0x4c2fa4]
push 1
push edx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0xf]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov cl, byte [esp + 0xe]
cmp byte [esp + 0xc], 0
jne 0x43136e
test cl, cl
jne 0x43136e
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x431399
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [0x4bd4c4]
mov eax, dword [edx + 0x58]
cmp eax, 0xffffffff
jle 0x431399
push 1
push eax
call fcn.00401350
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4311c2
Capabilities:
Log keystrokes

Disassembly:
cmp al, 0x9e
jne 0x4311b1
mov byte [esp + 0xc], 1
cmp al, 0x9c
je 0x4311bd
cmp al, 0x9d
je 0x4311bd
xor cl, cl
jmp 0x4311bf
mov cl, 1
cmp byte [esp + 0xc], 0
mov byte [esp + 0xe], cl
je 0x4311ee
xor edx, edx
cmp al, 0x9f
setne dl
mov ebx, 0x20a
lea edi, [edx - 1]
and edi, 0xf0
lock add byte [eax], al
add byte [ebx - 0x50f07739], al
jge 0x4311f2
shl edi, 0x10
jmp 0x43127c
test cl, cl
je 0x431213
xor edx, edx
cmp al, 0x9c
setne dl
mov ebx, 0x20e
lea edi, [edx - 1]
and edi, 0xffffff10
add edi, 0x78
imul edi, dword [ebp + 0xc]
shl edi, 0x10
jmp 0x43127c
movzx eax, al
dec eax
cmp eax, 5
ja case.0x431220.3
jmp dword [eax*4 + 0x431418]
mov ebx, 0x201
mov dword [esp + 0x14], 0x202
mov edi, 1
jmp 0x43127c
mov ebx, 0x204
mov dword [esp + 0x14], 0x205
mov edi, 2
jmp 0x43127c
mov ebx, 0x207
mov dword [esp + 0x14], 0x208
mov edi, 0x10
jmp 0x43127c
mov edi, 0x20
jmp 0x43126f
mov edi, 0x40
mov dword [esp + 0x14], 0x20c
mov ebx, 0x20b
cmp byte [esp + 0xd], 0
mov byte [esp + 0xf], 0
je 0x4312dd
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x24], eax
test eax, eax
je 0x4312ce
mov ecx, eax
cmp ecx, dword [0x4c2fa4]
je 0x4312ce
mov esi, dword [esp + 0x10]
call fcn.0046b600
test al, al
jne 0x4312ce
mov edx, dword [esp + 0x24]
mov eax, dword [0x4c2fa4]
push 1
push edx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0xf]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov cl, byte [esp + 0xe]
cmp byte [esp + 0xc], 0
jne 0x43136e
test cl, cl
jne 0x43136e
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x431399
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [0x4bd4c4]
mov eax, dword [edx + 0x58]
cmp eax, 0xffffffff
jle 0x431399
push 1
push eax
call fcn.00401350
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4311db
Capabilities:
Log keystrokes

Disassembly:
cmp al, 0x9e
jne 0x4311b1
mov byte [esp + 0xc], 1
cmp al, 0x9c
je 0x4311bd
cmp al, 0x9d
je 0x4311bd
xor cl, cl
jmp 0x4311bf
mov cl, 1
cmp byte [esp + 0xc], 0
mov byte [esp + 0xe], cl
je 0x4311ee
xor edx, edx
cmp al, 0x9f
setne dl
mov ebx, 0x20a
lea edi, [edx - 1]
and edi, 0xf0
lock add byte [eax], al
add byte [ebx - 0x50f07739], al
jge 0x4311f2
shl edi, 0x10
jmp 0x43127c
test cl, cl
je 0x431213
xor edx, edx
cmp al, 0x9c
setne dl
mov ebx, 0x20e
lea edi, [edx - 1]
and edi, 0xffffff10
add edi, 0x78
imul edi, dword [ebp + 0xc]
shl edi, 0x10
jmp 0x43127c
movzx eax, al
dec eax
cmp eax, 5
ja case.0x431220.3
jmp dword [eax*4 + 0x431418]
mov ebx, 0x201
mov dword [esp + 0x14], 0x202
mov edi, 1
jmp 0x43127c
mov ebx, 0x204
mov dword [esp + 0x14], 0x205
mov edi, 2
jmp 0x43127c
mov ebx, 0x207
mov dword [esp + 0x14], 0x208
mov edi, 0x10
jmp 0x43127c
mov edi, 0x20
jmp 0x43126f
mov edi, 0x40
mov dword [esp + 0x14], 0x20c
mov ebx, 0x20b
cmp byte [esp + 0xd], 0
mov byte [esp + 0xf], 0
je 0x4312dd
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x24], eax
test eax, eax
je 0x4312ce
mov ecx, eax
cmp ecx, dword [0x4c2fa4]
je 0x4312ce
mov esi, dword [esp + 0x10]
call fcn.0046b600
test al, al
jne 0x4312ce
mov edx, dword [esp + 0x24]
mov eax, dword [0x4c2fa4]
push 1
push edx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0xf]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov cl, byte [esp + 0xe]
cmp byte [esp + 0xc], 0
jne 0x43136e
test cl, cl
jne 0x43136e
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x431399
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [0x4bd4c4]
mov eax, dword [edx + 0x58]
cmp eax, 0xffffffff
jle 0x431399
push 1
push eax
call fcn.00401350
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x43135e
Capabilities:
Log keystrokes

Disassembly:
cmp dword [esp + 0x1c], 1
je 0x431333
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
push edx
push edi
push ebx
push eax
call esi
mov ecx, dword [0x4bd4c4]
mov eax, dword [ecx + 0x58]
cmp eax, 0xffffffff
jle 0x431333
push 1
push eax
call fcn.00401350
add esp, 8
cmp dword [esp + 0x1c], 0
je 0x431366
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push edx
push 0
push eax
push ecx
call esi
mov edx, dword [0x4bd4c4]
mov eax, dword [edx + 0x58]
cmp eax, 0xffffffff
jle 0x431366
push 1
push eax
call fcn.00401350
add esp, 8
dec dword [esp + 0x10]
jne 0x431305
jmp 0x431399
cmp byte [esp + 0xf], 0
je 0x4313b4
mov eax, dword [esp + 0x24]
mov ecx, dword [0x4c2fa4]
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push 0x49c138
call fcn.004698a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x434760
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
cmp byte [ebp + 0x24], 0
push ebx
mov ebx, dword [ebp + 0x20]
push esi
push edi
mov esi, eax
jne 0x43478f
mov eax, str.Fast
mov ecx, esi
call fcn.004672f0
mov byte [esp + 0x12], 0
test eax, eax
je 0x434794
mov byte [esp + 0x12], 1
mov eax, 0x4a493c
mov ecx, esi
call fcn.004672f0
add eax, dword [eax]
Function at 0x434e52
Capabilities:
Capture screenshot
Resolve function by parsing pe exports

Disassembly:
add byte [esi + 0x57], dl
mov esi, eax
mov al, 1
cmp al, byte [ecx + 1]
mov ecx, dword [0x4c1688]
push 1
push 0
sbb edi, edi
and edi, dword [0x4c0cc4]
push 0xffffffffffffffff
push 0x49ef34
mov dword [esp + 0x90], ebx
add byte [eax], al
add byte [ecx + 0x9824bc], cl
add byte [eax], al
call fcn.004698a0
test ebx, ebx
je 0x434e9b
push 1
push 0
push 0xffffffffffffffff
push 0
mov ecx, ebx
call fcn.004698a0
xor ebx, ebx
cmp edi, ebx
je fcn.00434eae
push 1
push ebx
push 0xffffffffffffffff
push ebx
mov ecx, edi
call fcn.004698a0

Function at 0x434e79
Capabilities:
Capture screenshot
Resolve function by parsing pe exports

Disassembly:
add byte [esi + 0x57], dl
mov esi, eax
mov al, 1
cmp al, byte [ecx + 1]
mov ecx, dword [0x4c1688]
push 1
push 0
sbb edi, edi
and edi, dword [0x4c0cc4]
push 0xffffffffffffffff
push 0x49ef34
mov dword [esp + 0x90], ebx
add byte [eax], al
add byte [ecx + 0x9824bc], cl
add byte [eax], al
call fcn.004698a0
test ebx, ebx
je 0x434e9b
push 1
push 0
push 0xffffffffffffffff
push 0
mov ecx, ebx
call fcn.004698a0
xor ebx, ebx
cmp edi, ebx
je fcn.00434eae
push 1
push ebx
push 0xffffffffffffffff
push ebx
mov ecx, edi
call fcn.004698a0

Function at 0x434eae
Capabilities:
Capture screenshot
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [0x4bd4c4]
xor eax, eax
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
test byte [edx + 0xe8], 1
jne 0x434efd
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x43523d
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
add dword [ebp + 8], eax
add dword [ebp + 0xc], ecx
add dword [ebp + 0x10], eax
add dword [ebp + 0x14], ecx
dec ebp
invalid
push 0x2e
push esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.00483835
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x434f75
add edi, 2
push 0x4a4944
push edi
call fcn.00481dd9
add esp, 8
test eax, eax
je 0x434f5f
push 0x4a494c
push edi
call fcn.00481dd9
add esp, 8
test eax, eax
je 0x434f5f
push 0x4a4954
push edi
call fcn.00481dd9
add esp, 8
test eax, eax
jne 0x434f75
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call edi
push 0x32
mov dword [esp + 0x20], eax
call edi
mov dword [esp + 0x20], eax
mov edi, esi
movzx eax, word [edi]
cmp eax, 0x20
je 0x434f84
cmp eax, 9
jne 0x434f89
add edi, 2
jmp 0x434f77
cmp word [edi], 0x2a
jne 0x4351fc
Function at 0x434efb
Capabilities:
Capture screenshot
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [0x4bd4c4]
xor eax, eax
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
test byte [edx + 0xe8], 1
jne 0x434efd
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x43523d
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
add dword [ebp + 8], eax
add dword [ebp + 0xc], ecx
add dword [ebp + 0x10], eax
add dword [ebp + 0x14], ecx
dec ebp
invalid
push 0x2e
push esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.00483835
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x434f75
add edi, 2
push 0x4a4944
push edi
call fcn.00481dd9
add esp, 8
test eax, eax
je 0x434f5f
push 0x4a494c
push edi
call fcn.00481dd9
add esp, 8
test eax, eax
je 0x434f5f
push 0x4a4954
push edi
call fcn.00481dd9
add esp, 8
test eax, eax
jne 0x434f75
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call edi
push 0x32
mov dword [esp + 0x20], eax
call edi
mov dword [esp + 0x20], eax
mov edi, esi
movzx eax, word [edi]
cmp eax, 0x20
je 0x434f84
cmp eax, 9
jne 0x434f89
add edi, 2
jmp 0x434f77
cmp word [edi], 0x2a
jne 0x4351fc
Function at 0x436100
Capabilities:
Enumerate gui resources

Disassembly:
cmp eax, 0x4c2fec
add byte [edi + edx - 0x75], dh
adc eax, 0x4c2fe4
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor esi, esi
mov dword [0x4c2fec], esi
jmp 0x436121
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4c2ffc], esi
mov dword [0x4c2fe4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 0x46b4b0

Function at 0x4371c0
Capabilities:
Get graphical window text

Disassembly:
adc al, 0x85
dec dword [edi]
mov byte [ecx], bh
add dword [eax], eax
add byte [edi], cl
mov bh, 0x45
adc byte [eax - 0x7d], cl
clc
add dword [edi], ecx
xchg dword [ebx], ebp
add dword [eax], eax
add byte [ebx - 0x48f0ef8b], cl
salc
push 0xc9
push ebx
mov dword [esp + 0x18], edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4372bb
cmp si, 2
Function at 0x438f79
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
add byte [eax], al
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x24], 0xa
mov byte [0x4bfb2e], 0
mov byte [0x4bfb2d], 0
mov byte [0x4bfb2c], 0
mov dword [0x4bfb28], esi
mov byte [esp + 0x17], 0
mov byte [esp + 0x14], 0
mov byte [esp + 0x15], 0
mov byte [esp + 0x18], 0
mov byte [esp + 0x13], 0
mov byte [esp + 0x16], 0
cmp word [edi], si
je 0x439166
movzx ecx, word [edi]
push ecx
call fcn.004848ba
movzx eax, ax
add eax, 0xffffffbd
add esp, 4
cmp eax, 0x19
ja case.0x438fef.69
movzx edx, byte [eax + 0x439abc]
jmp dword [edx*4 + 0x439a94]
movzx ebx, word [edi + 2]
test ebx, 0xffffff80
jne 0x439014
push 2
push ebx
call fcn.00482fce
add esp, 8
cmp eax, esi
je 0x439014
and ebx, 0xffffffdf
cmp bx, 0x4c
jne 0x439029
add edi, 2
mov byte [0x4bfb2e], 2
jmp case.0x438fef.69
mov byte [0x4bfb2e], 1
jmp case.0x438fef.69
cmp word [edi + 2], si
je case.0x438fef.69
movzx eax, word [edi + 2]
add edi, 2
cmp ax, si
je case.0x438fef.69
mov dword [esp + 0x24], eax
jmp case.0x438fef.69
movzx eax, word [edi + 2]
add edi, 2
cmp eax, 0x20
je case.0x438fef.70
cmp eax, 9
je case.0x438fef.70
mov ebx, 0x49eed0
mov eax, edi
call fcn.00408fc0
mov ebx, eax
test ebx, ebx
jne 0x439092
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x439080
sub eax, edx
sar eax, 1
lea ebx, [edi + eax*2]
mov ecx, ebx
sub ecx, edi
push 0
sar ecx, 1
push ecx
push edi
mov ecx, 0x4c3000
call fcn.0041ceb0
mov ecx, eax
mov dword [0x4bfb24], ecx
test ecx, ecx
je 0x4399df
cmp byte [ecx + 0x31], 0
jne 0x4399df
mov eax, dword [ecx + 0xc]
cmp eax, 2
jl 0x4399df
cmp eax, 3
jg 0x4399df
mov eax, dword [ecx + 8]
cmp word [eax + 4], 0
jne 0x4399df
cmp word [eax + 0x14], 0
jne 0x4399df
lea edi, [ebx - 2]
xor esi, esi
jmp case.0x438fef.69
mov byte [0x4bfb2d], 1
jmp case.0x438fef.69
lea edx, [edi + 2]
push edx
call fcn.00483016
add esp, 4
cmp eax, 1
jge 0x439114
mov eax, 1
dec eax
mov dword [0x4bfb28], eax
jmp case.0x438fef.69
push 6
push str.Random
push edi
call fcn.00482612
add esp, 0xc
test eax, eax
jne 0x43913a
mov byte [esp + 0x13], 1
add edi, 0xa
jmp case.0x438fef.69
mov byte [0x4bfb2c], 1
jmp case.0x438fef.69
mov byte [esp + 0x16], 1
mov dword [esp + 0x34], esi
jmp case.0x438fef.69
mov byte [esp + 0x17], 1
jmp case.0x438fef.69
mov byte [esp + 0x18], 1
add edi, 2
cmp word [edi], si
jne 0x438fcd
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax]
cmp cx, si
je 0x4399df
mov esi, dword [0x4c0cc0]
mov al, byte [esi + 0x17]
mov dword [esp + 0x1c], esi
test al, al
jne 0x43918c
mov edx, dword [esi + 0xc]
mov al, byte [edx + 0x17]
cmp al, 2
ja 0x4399df
mov edx, dword [ebp + 0xc]
mov ebx, dword [esp + 0x24]
mov edi, 1
mov eax, edx
cmp cx, bx
jne 0x4391a8
inc edi
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4391a2
mov ebx, eax
sub ebx, edx
sar ebx, 1
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], ebx
cmp byte [esp + 0x17], cl
jne 0x4391de
cmp eax, edx
jbe 0x4391de
mov ax, word [eax - 2]
cmp ax, word [esp + 0x24]
jne 0x4391de
dec edi
mov dword [esp + 0x20], edi
jmp 0x439208
cmp word [esp + 0x24], 0xa
jne 0x43920d
mov ecx, edx
push 0xa
push ecx
Function at 0x438fec
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
add byte [eax], al
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x24], 0xa
mov byte [0x4bfb2e], 0
mov byte [0x4bfb2d], 0
mov byte [0x4bfb2c], 0
mov dword [0x4bfb28], esi
mov byte [esp + 0x17], 0
mov byte [esp + 0x14], 0
mov byte [esp + 0x15], 0
mov byte [esp + 0x18], 0
mov byte [esp + 0x13], 0
mov byte [esp + 0x16], 0
cmp word [edi], si
je 0x439166
movzx ecx, word [edi]
push ecx
call fcn.004848ba
movzx eax, ax
add eax, 0xffffffbd
add esp, 4
cmp eax, 0x19
ja case.0x438fef.69
movzx edx, byte [eax + 0x439abc]
jmp dword [edx*4 + 0x439a94]
movzx ebx, word [edi + 2]
test ebx, 0xffffff80
jne 0x439014
push 2
push ebx
call fcn.00482fce
add esp, 8
cmp eax, esi
je 0x439014
and ebx, 0xffffffdf
cmp bx, 0x4c
jne 0x439029
add edi, 2
mov byte [0x4bfb2e], 2
jmp case.0x438fef.69
mov byte [0x4bfb2e], 1
jmp case.0x438fef.69
cmp word [edi + 2], si
je case.0x438fef.69
movzx eax, word [edi + 2]
add edi, 2
cmp ax, si
je case.0x438fef.69
mov dword [esp + 0x24], eax
jmp case.0x438fef.69
movzx eax, word [edi + 2]
add edi, 2
cmp eax, 0x20
je case.0x438fef.70
cmp eax, 9
je case.0x438fef.70
mov ebx, 0x49eed0
mov eax, edi
call fcn.00408fc0
mov ebx, eax
test ebx, ebx
jne 0x439092
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x439080
sub eax, edx
sar eax, 1
lea ebx, [edi + eax*2]
mov ecx, ebx
sub ecx, edi
push 0
sar ecx, 1
push ecx
push edi
mov ecx, 0x4c3000
call fcn.0041ceb0
mov ecx, eax
mov dword [0x4bfb24], ecx
test ecx, ecx
je 0x4399df
cmp byte [ecx + 0x31], 0
jne 0x4399df
mov eax, dword [ecx + 0xc]
cmp eax, 2
jl 0x4399df
cmp eax, 3
jg 0x4399df
mov eax, dword [ecx + 8]
cmp word [eax + 4], 0
jne 0x4399df
cmp word [eax + 0x14], 0
jne 0x4399df
lea edi, [ebx - 2]
xor esi, esi
jmp case.0x438fef.69
mov byte [0x4bfb2d], 1
jmp case.0x438fef.69
lea edx, [edi + 2]
push edx
call fcn.00483016
add esp, 4
cmp eax, 1
jge 0x439114
mov eax, 1
dec eax
mov dword [0x4bfb28], eax
jmp case.0x438fef.69
push 6
push str.Random
push edi
call fcn.00482612
add esp, 0xc
test eax, eax
jne 0x43913a
mov byte [esp + 0x13], 1
add edi, 0xa
jmp case.0x438fef.69
mov byte [0x4bfb2c], 1
jmp case.0x438fef.69
mov byte [esp + 0x16], 1
mov dword [esp + 0x34], esi
jmp case.0x438fef.69
mov byte [esp + 0x17], 1
jmp case.0x438fef.69
mov byte [esp + 0x18], 1
add edi, 2
cmp word [edi], si
jne 0x438fcd
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax]
cmp cx, si
je 0x4399df
mov esi, dword [0x4c0cc0]
mov al, byte [esi + 0x17]
mov dword [esp + 0x1c], esi
test al, al
jne 0x43918c
mov edx, dword [esi + 0xc]
mov al, byte [edx + 0x17]
cmp al, 2
ja 0x4399df
mov edx, dword [ebp + 0xc]
mov ebx, dword [esp + 0x24]
mov edi, 1
mov eax, edx
cmp cx, bx
jne 0x4391a8
inc edi
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4391a2
mov ebx, eax
sub ebx, edx
sar ebx, 1
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], ebx
cmp byte [esp + 0x17], cl
jne 0x4391de
cmp eax, edx
jbe 0x4391de
mov ax, word [eax - 2]
cmp ax, word [esp + 0x24]
jne 0x4391de
dec edi
mov dword [esp + 0x20], edi
jmp 0x439208
cmp word [esp + 0x24], 0xa
jne 0x43920d
mov ecx, edx
push 0xa
push ecx