joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c95b
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1040
call fcn.00401200
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp word [esi], bx
je 0x40cb92
push esi
call fcn.0040aee2
cmp eax, 0x3f6
jae 0x40cb92
push edi
push 0x3c
pop edi
push edi
push ebx
lea eax, [ebp - 0x40]
push eax
call fcn.0040abb3
movzx ecx, word [esi]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], 0x5c0
cmp cx, 0x22
jne 0x40c9b2
lea eax, [esi + 2]
mov dword [ebp - 0x30], eax
jmp 0x40c9b5
mov dword [ebp - 0x30], esi
xor eax, eax
cmp cx, bx
je 0x40ca0b
mov ecx, esi
cmp word [ecx], 0x22
jne 0x40c9dd
jmp 0x40c9cd
cmp word [esi + eax*2], 0x22
je 0x40c9d6
inc eax
cmp word [esi + eax*2], bx
jne 0x40c9c6
jmp 0x40c9dd
push 0x20
pop ecx
mov word [esi + eax*2], cx
cmp word [esi + eax*2], 0x20
je 0x40c9f7
cmp word [esi + eax*2 + 2], 0x2f
je 0x40c9f7
inc eax
lea ecx, [esi + eax*2]
cmp word [ecx], bx
jne 0x40c9be
jmp 0x40ca0b
lea eax, [esi + eax*2]
cmp word [eax], 0x20
jne 0x40ca05
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov dword [ebp - 0x2c], eax
cmp byte [ebp + 8], bl
jne 0x40ca20
cmp word [0x41ca12], bx
je 0x40ca20
mov dword [ebp - 0x2c], 0x41ca12
push dword [ebp - 0x30]
mov dword [ebp - 0x24], 1
call fcn.00407e29
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x40ca4c
push str..inf
push eax
call fcn.0040f110
test eax, eax
jne 0x40ca4c
mov dword [ebp - 0x34], 0x413840
push dword [ebp - 0x30]
call fcn.00405d2b
mov bl, al
test bl, bl
je 0x40ca72
lea eax, [ebp - 0x1040]
push eax
push dword [ebp - 0x30]
call fcn.00407968
lea eax, [ebp - 0x1040]
mov dword [ebp - 0x30], eax
cmp byte [ebp + 8], 0
je 0x40cab0
test bl, bl
jne 0x40cab0
push dword [ebp - 0x30]
lea eax, [ebp - 0x840]
push eax
call fcn.0040af0c
push str..exe
lea eax, [ebp - 0x840]
push eax
call fcn.0040af79
lea eax, [ebp - 0x840]
push eax
call fcn.00405d2b
test al, al
je 0x40cb91
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 0x40]
push eax
call edi
test eax, eax
setne al
test al, al
jne 0x40cae2
and dword [ebp - 0x3c], 0xfffffbff
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x30], esi
call edi
test eax, eax
setne al
test al, al
je 0x40cb91
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
xor bl, bl
cmp byte [0x41c208], bl
jne 0x40caf7
cmp byte [ebp + 8], bl
je 0x40cb2d
mov eax, dword [0x41c200]
test eax, eax
je 0x40cb17
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40cb17
push 0
push dword [0x41c200]
call esi
mov bl, 1
push 0x7d0
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 8]
call fcn.0040c24b
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x40cb4d
push str..exe
push dword [ebp - 4]
call fcn.0040f110
test eax, eax
je 0x40cb7d
cmp byte [0x41c208], 0
je 0x40cb63
cmp byte [ebp + 8], 0
jne 0x40cb63
push 0x1b58
jmp 0x40cb77
xor eax, eax
cmp byte [ebp + 8], al
sete al
dec eax
and eax, 0xfffffce0
add eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x40cb91
cmp byte [ebp + 8], 0
je 0x40cb91
push 1
push dword [0x41c200]
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40e0e7
Capabilities:
Accept command line arguments
Read file via mapping
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
call fcn.0040ebd6
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, 0x424cf8
call fcn.0040f2ca
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp esi, ebx
je 0x40e175
push esi
call fcn.0040bfd2
cmp byte [0x41c211], bl
je 0x40e16d
push str.winrarsfxmappingfile.tmp
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x40e162
push 0x20000
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x40e15b
push esi
push str.sfxcmd
call edi
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40e175
push esi
push str.sfxcmd
call edi
push 0x400
mov esi, 0x41b8e0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push str.sfxname
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push 0x64
push edi
mov dword [0x415e78], edi
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x65
push dword [0x415e78]
mov dword [0x41b8dc], eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
lea ecx, [ebp - 8]
mov dword [0x41b8d8], eax
call fcn.00412672
push esi
mov ecx, 0x415e88
call fcn.0040a207
lea ecx, [ebp - 0x40]
call fcn.004069d9
lea ecx, [ebp - 0x24]
call fcn.004069d9
push 0x64
call fcn.0040b646
push 0x64
mov dword [ebp - 0x28], eax
call fcn.0040b646
push ebx
push 0x40d850
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x40]
mov dword [0x41b0d4], eax
push str.STARTDLG
lea eax, [ebp - 0x24]
push edi
mov dword [0x41b0d0], eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea ecx, [ebp - 0x24]
mov dword [0x41b0d0], ebx
mov dword [0x41b0d4], ebx
call fcn.004069ef
lea ecx, [ebp - 0x40]
call fcn.004069ef
lea ecx, [ebp - 8]
call fcn.004126c4
cmp byte [0x41c208], bl
je 0x40e24a
call fcn.0040c28a
push 0x100
push ebx
push 0x41c0f0
call fcn.0040abb3
cmp dword [0x41d324], ebx
jbe 0x40e26d
push dword [0x41d318]
call fcn.0040ab2f
push dword [0x41b8dc]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
mov eax, dword [0x41b8d8]
cmp eax, ebx
je 0x40e287
push eax
call esi
cmp dword [0x415e7c], ebx
jne 0x40e2a6
cmp byte [0x41c1f2], bl
je 0x40e2a6
push 0xff
mov ecx, 0x415e7c
call fcn.004033f7
mov eax, dword [0x41d32c]
mov byte [0x41c1f2], 1
cmp eax, ebx
je 0x40e2bc
push eax
call fcn.0040c24b
call dword [sym.imp.ole32.dll_OleUninitialize]
push dword [0x415e7c]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40e62e
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x412602
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x10007390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x10007398
mov eax, esi
pop esi
ret
Function at 0x1000f59f
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000f5cb
push 0xc96
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
jmp 0x1000f683
mov dword [ebp - 0xc], 0xe53d
mov dword [ebp - 8], 0xaed6b657
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000f61d
cmp dword [ebp - 0x14], 0
je 0x1000f607
xor eax, eax
inc eax
je 0x1000f607
mov dword [ebp - 0x10], 1
jmp 0x1000f60b
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000f61d
and dword [ebp - 0x20], 0
jmp 0x1000f624
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], eax
jg 0x1000f637
or eax, 0xffffffff
je 0x1000f646
cmp dword [ebp - 8], 0
je 0x1000f646
mov dword [ebp - 0x18], 1
jmp 0x1000f64a
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x18]
cmp dword [ebp - 0xc], eax
je 0x1000f65e
mov dword [ebp - 0x24], 1
jmp 0x1000f662
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0xc]
sub eax, 0x3d27
mov dword [ebp - 0x1c], eax
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000f683
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov esp, ebp
pop ebp
ret
Function at 0x1001adca
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001adfa
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001adf8
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1001ae24
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001ae24
push 0x609
push 0x192c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov esp, ebp
pop ebp
ret
Function at 0x1002b32b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002b34f
xor eax, eax
jmp 0x1002b4b4
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 0x70e7
push 0x5c75
push 0x7308
call fcn.1002aecb
add esp, 0x1c
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002b386
xor eax, eax
jmp 0x1002b4b4
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x244e
call fcn.1002b26f
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1002b3aa
xor eax, eax
jmp 0x1002b4b4
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1002afd0
add esp, 0x18
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push 0x760f
call fcn.1002b06b
add esp, 0x14
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1002b0d8
add esp, 0x10
cmp dword [ebp - 0x14], 0
je 0x1002b420
lea eax, [ebp - 4]
push eax
push 0x24ca
push 0x5727
lea eax, [ebp - 0x14]
push eax
push 1
push 0x5e7f
call fcn.1002b13d
add esp, 0x18
push dword [ebp - 4]
call fcn.1002aa9d
pop ecx
test eax, eax
jne 0x1002b434
xor eax, eax
jmp 0x1002b4b4
push 1
push 0x2d96
push 0x741b
lea eax, [ebp - 4]
push eax
call fcn.1002b26f
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002b49c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002b46b
xor eax, eax
jmp 0x1002b4b4
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002b484
xor eax, eax
jmp 0x1002b4b4
push 1
lea eax, [ebp - 4]
push eax
push 0x51da
push 0x7277
call fcn.1002b2d7
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002b4ad
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002b4b1
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10042573
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push esi
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x100425ee
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100425b0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jg 0x100425e9
mov dword [ebp - 0x30], 0
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100425d5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x34]
call fcn.100156f9
mov dword [eax], esi
jmp 0x100425a5
jmp 0x100426f5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xfffffff8
ja 0x1004265f
mov dword [ebp - 0x10], 1
jmp 0x10042663
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x10]
jne 0x10042676
mov dword [ebp - 0x18], 1
jmp 0x1004267a
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
push 1
mov ecx, dword [ebp - 0x58]
call fcn.100156f9
mov dword [eax], 1
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jge 0x100426a8
mov dword [ebp - 0x1c], 1
jmp 0x100426ac
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jg 0x100426bf
mov dword [ebp - 0x20], 1
jmp 0x100426c3
and dword [ebp - 0x20], 0
push 3
mov ecx, dword [ebp - 0x64]
call fcn.100156f9
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax]
jge 0x100426dd
mov dword [ebp - 0x24], 1
jmp 0x100426e1
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax - 0x7ee8]
mov ecx, dword [ebp - 0x6c]
mov dword [ecx], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10052ce0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x10052cfe
mov ecx, dword [ebp - 8]
call fcn.10054690
jmp 0x10052d11
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x10052d11
mov ecx, dword [ebp - 8]
call fcn.10054510
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
shr eax, 0xb
mov ecx, dword [ebp - 8]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
shl edx, 7
and edx, 0x9d2c5680
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0x12
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10054510
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x1005452b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe3
jge 0x10054597
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x1005456f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x10054576
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x10054522
jmp 0x100545a2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x26f
jge 0x1005460e
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 1
je 0x100545e6
mov dword [ebp - 0x18], 0x9908b0df
jmp 0x100545ed
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
shr eax, 1
xor eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x10054599
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ecx + 4]
and ecx, 0x7fffffff
or edx, ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x1005464c
mov dword [ebp - 0x20], 0x9908b0df
jmp 0x10054653
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
shr eax, 1
xor eax, dword [ebp - 0x20]
mov ecx, 4
imul edx, ecx, 0x18c
mov ecx, dword [ebp - 8]
xor eax, dword [ecx + edx + 4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 4], eax
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
Function at 0x10054690
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x100546ab
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jge 0x10054717
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x100546ef
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x100546f6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x100546a2
mov esp, ebp
pop ebp
ret
Function at 0x10061ac1
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006f170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10062525
mov dword [ebp - 0x14], eax
cmp dword [0x1065b178], esi
jne 0x10061bb4
push 0x800
push esi
push 0x10002d1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10061b41
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10061c94
push esi
push esi
push 0x10002d1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10061c94
push 0x10002d34
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10061c94
push eax
call ebx
push 0x10002d40
push edi
mov dword [0x1065b178], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10002d50
push edi
mov dword [0x1065b17c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10002d64
push edi
mov dword [0x1065b180], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065b188], eax
test eax, eax
je 0x10061bb1
push 0x10002d80
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065b184], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10061bd9
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10061bcc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10061bee
push 4
pop eax
jmp 0x10061c96
cmp dword [ebp - 0x14], esi
je 0x10061bee
push dword [0x1065b178]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10061bd3
mov eax, dword [0x1065b184]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10061c4c
cmp dword [0x1065b188], edi
je 0x10061c4c
push eax
call ebx
push dword [0x1065b188]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10061c4c
test eax, eax
je 0x10061c4c
call ecx
test eax, eax
je 0x10061c41
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10061c41
test byte [ebp - 8], 1
jne 0x10061c4c
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10061c7c
mov eax, dword [0x1065b17c]
cmp eax, edi
je 0x10061c79
push eax
call ebx
test eax, eax
je 0x10061c79
call eax
mov esi, eax
test esi, esi
je 0x10061c79
mov eax, dword [0x1065b180]
cmp eax, edi
je 0x10061c79
push eax
call ebx
test eax, eax
je 0x10061c79
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1065b178]
call ebx
test eax, eax
je 0x10061c94
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10061c96
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005964e
mov esp, ebp
pop ebp
ret