joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003f590
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
lea eax, [ebp - 4]
push 0
push 0
push dword [ebp + 0x14]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_WSASend]
push 0x101ad288
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea ecx, [ebp - 0x14]
call fcn.1001be50
mov dword [ebp - 8], 0x1ffff7
movq xmm0, qword [eax]
movq qword [edi], xmm0
mov ecx, dword [eax + 8]
mov esi, ecx
mov dword [edi + 8], ecx
cmp esi, 1
je 0x1003f5f5
mov eax, dword [edi]
mov ecx, eax
jmp 0x1003f607
mov eax, dword [edi + 4]
xor edx, edx
div dword [ebp - 8]
mov ecx, dword [edi]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x40
jne 0x1003f668
mov ecx, dword [0x101ad290]
mov eax, dword [0x101ad294]
cmp ecx, 0x257edfd1
jne 0x1003f626
cmp eax, 0xb2ab117a
je 0x1003f635
cmp ecx, 0x257edfd0
jne 0x1003f643
cmp eax, 0xb2ab117a
jne 0x1003f643
mov al, 1
mov dword [ebp - 0x14], 0x2746
jmp 0x1003f6d9
mov eax, dword [0x101ad288]
push 0x2746
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x101653ec]
mov ecx, 0x101ad288
call esi
mov dword [ebp - 0x14], 0x2746
jmp 0x1003f6d9
cmp esi, 1
jne 0x1003f681
mov eax, dword [edi + 4]
xor edx, edx
mov esi, 0x1ffff7
div esi
imul eax, edx, 0x3e8
add ecx, eax
cmp ecx, 0x4d2
jne 0x1003f6f2
mov ecx, dword [0x101ad290]
mov eax, dword [0x101ad294]
cmp ecx, 0x257edfd1
jne 0x1003f6a3
cmp eax, 0xb2ab117a
je 0x1003f6b2
cmp ecx, 0x257edfd0
jne 0x1003f6b6
cmp eax, 0xb2ab117a
jne 0x1003f6b6
mov al, 1
jmp 0x1003f6d2
mov eax, dword [0x101ad288]
push 0x274d
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x101653ec]
mov ecx, 0x101ad288
call esi
mov dword [ebp - 0x14], 0x274d
mov dword [ebp - 0x10], 0x101ad288
movq xmm0, qword [ebp - 0x14]
movzx eax, al
add eax, 2
movq qword [edi], xmm0
mov dword [edi + 8], eax
test ebx, ebx
je 0x1003f700
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003faa0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x1003fb23
mov ecx, dword [0x101ad290]
mov eax, dword [0x101ad294]
cmp ecx, 0x257edfd1
jne 0x1003fac9
cmp eax, 0xb2ab117a
je 0x1003fad8
cmp ecx, 0x257edfd0
jne 0x1003fadc
cmp eax, 0xb2ab117a
jne 0x1003fadc
mov al, 1
jmp 0x1003faf8
mov eax, dword [0x101ad288]
push 0x2719
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x101653ec]
mov ecx, 0x101ad288
call esi
mov dword [ebp - 0xc], 0x2719
movzx ecx, al
mov eax, dword [ebp + 0x20]
add ecx, 2
mov dword [ebp - 8], 0x101ad288
movq xmm0, qword [ebp - 0xc]
pop esi
movq qword [eax], xmm0
mov dword [eax + 8], ecx
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
cmp edx, 0xa5100000
jne 0x1003fbd6
cmp ecx, 2
jne 0x1003fb96
mov ecx, dword [0x101ad290]
mov eax, dword [0x101ad294]
cmp ecx, 0x257edfd1
jne 0x1003fb54
cmp eax, 0xb2ab117a
je 0x1003fb63
cmp ecx, 0x257edfd0
jne 0x1003fb6e
cmp eax, 0xb2ab117a
jne 0x1003fb6e
mov al, 1
mov dword [ebp - 0xc], 0x2726
jmp 0x1003faff
mov eax, dword [0x101ad288]
push 0x2726
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x101653ec]
mov ecx, 0x101ad288
call esi
mov dword [ebp - 0xc], 0x2726
jmp 0x1003faff
cmp ecx, 1
jne 0x1003fbec
cmp dword [ebp + 0x1c], 4
jne 0x1003fb3a
mov esi, dword [ebp + 0xc]
xorps xmm0, xmm0
mov cl, byte [esi]
mov al, cl
or cl, 4
and al, 0xfb
movzx edx, cl
movzx ecx, al
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
mov eax, dword [ebp + 0x20]
cmove edx, ecx
mov byte [esi], dl
pop esi
movq qword [eax], xmm0
mov dword [eax + 8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp edx, 0xffff
jne 0x1003fbec
cmp ecx, 0x80
jne 0x1003fbec
mov eax, dword [ebp + 0xc]
or byte [eax], 8
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ecx
push edx
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, eax
test esi, esi
setne cl
movzx ecx, cl
push ecx
push dword [ebp + 0x20]
call fcn.10030000
add esp, 8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10040210
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 1
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10040269
cmp dword [ebp + 8], 0x17
xorps xmm0, xmm0
mov ecx, dword [ebp + 0x14]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
jne 0x10040262
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0x101ad288
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea ecx, [ebp - 0x10]
call fcn.1001be50
mov ecx, dword [ebp + 0x14]
pop esi
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x10040300
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
je 0x1004032e
mov ecx, dword [esi + 4]
push 0
push 0
push dword [ebp + 0x1c]
call fcn.10035b60
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x10040351
mov ecx, dword [esi + 4]
push 0
push 0x2719
push dword [ebp + 0x1c]
call fcn.10035b60
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
push ebx
push edi
mov edi, dword [ebp + 0x1c]
push 0
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x1004038f
mov eax, 0x2746
jmp 0x1004039c
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x100403bd
cmp eax, 0x3e5
je 0x100403bd
push dword [ebp - 4]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.10035b60
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.10035ca0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10049400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015bf21
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x101cd100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x10], 0
je 0x10049468
mov dword [esi], sym.drillClient.dll_const_Drill::DateTimeHolder::vbtablefor__Drill::DateHolder
mov dword [esi + 0x10], sym.drillClient.dll_const_Drill::DateTimeHolder::vbtablefor__Drill::TimeHolder
mov dword [esi + 0x30], vtable.Drill::DateTimeBase.0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.Drill::DateHolder.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 4]
mov dword [esi + eax + 0x10], vtable.Drill::TimeHolder.0
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + esi + 0xc], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.Drill::DateTimeHolder.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x30]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [eax + esi + 8], ecx
lea ecx, [esi + 0x30]
mov dword [eax + esi + 0xc], edx
call sym.drillClient.dll_public_virtual:_void___thiscall_Drill::DateTimeHolder::load_void_
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10054210
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015c9cd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101cd100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ecx + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ecx + 8]
mov eax, dword [ecx]
mov ecx, dword [0x101d9d78]
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x20], edi
mov esi, dword [eax + ecx*4]
cmp byte [esi + 0x24], 0
jne 0x10054269
call fcn.10132a84
mov eax, dword [esi + 8]
test eax, eax
je 0x10054278
mov eax, dword [eax + 4]
jmp 0x1005427a
xor eax, eax
push 4
push 0x54
push eax
push dword [ebp - 0x14]
call fcn.10011590
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x1c], esi
push dword [ebp - 0x10]
mov dword [esi + 0x14], 0
xorps xmm0, xmm0
mov dword [esi + 0x18], 0x1005d2e0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
movq qword [esi + 0x20], xmm0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov ecx, dword [edi + 4]
mov eax, dword [edi]
push 0
mov dword [esi + 0x34], ecx
lea ecx, [esi + 0x38]
push 0
mov dword [ebp - 4], 0
mov dword [esi + 0x30], eax
call fcn.10017a30
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + 0xc]
push esi
push eax
push ebx
lea eax, [ecx + 0x14]
mov byte [ebx + 8], 1
mov ecx, dword [ecx + 0x34]
push eax
mov dword [ebp - 0x18], esi
call fcn.10016330
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 1
call fcn.1006c490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10056110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159588
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101cd100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebx], vtable.boost_sb::exception_detail::clone_base.0
mov esi, dword [ebp + 8]
lea eax, [ebx + 8]
xorps xmm0, xmm0
mov dword [ebx + 4], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [esi + 8]
mov dword [ebp - 4], 0
push eax
call fcn.10134025
mov dword [ebx + 4], vtable.boost_sb::system::system_error.0
add esp, 8
movq xmm0, qword [esi + 0x10]
movq qword [ebx + 0x10], xmm0
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov dword [ebx + 4], vtable.boost_sb::lock_error.0
lea edi, [ebx + 0x1c]
mov byte [ebp - 4], 1
mov dword [edi], vtable.boost_sb::exception.0
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x10], eax
mov dword [edi + 4], eax
test eax, eax
je 0x100561bb
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x101653ec]
mov ecx, dword [ebp - 0x10]
call esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x24]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x14], eax
mov eax, ebx
mov dword [ebx], vtable.boost_sb::wrapexcept_class_boost_sb::lock_error_.0
mov dword [ebx + 4], vtable.boost_sb::wrapexcept_class_boost_sb::lock_error_.1.0
mov dword [edi], vtable.boost_sb::wrapexcept_class_boost_sb::lock_error_.2.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100563f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015cd89
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x101cd100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.boost_sb::detail::thread_data_base.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea esi, [edi + 0x14]
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
push 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10132688
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push 0
push 0
push 1
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x100564cc
mov dword [edi + 0x34], eax
mov eax, edi
mov byte [edi + 0x38], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x2c]
call fcn.1001cc30
push eax
mov byte [ebp - 4], 4
call fcn.10016700
int3
Function at 0x10070ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, dword [edi + 0x1c]
cmp esi, eax
je 0x10070d07
cmp dword [eax + 0x14], 0xf
mov ecx, eax
jbe 0x10070cfc
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
mov ecx, esi
call fcn.10025e30
mov dword [esi + 0x18], 0xffffffff
lea ecx, [esi + 0x30]
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x20], 0
mov eax, dword [edi + 0x30]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov eax, dword [edi + 0x10]
cmp ecx, eax
je 0x10070d4c
cmp dword [eax + 0x14], 0xf
mov edx, eax
jbe 0x10070d43
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.10025e30
mov eax, dword [edi + 0x14]
lea ecx, [esi + 0x48]
cmp ecx, eax
je 0x10070d69
cmp dword [eax + 0x14], 0xf
mov edx, eax
jbe 0x10070d60
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.10025e30
mov eax, dword [edi + 0x18]
lea ecx, [esi + 0x60]
cmp ecx, eax
je 0x10070d86
cmp dword [eax + 0x14], 0xf
mov edx, eax
jbe 0x10070d7d
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.10025e30
mov eax, dword [edi + 0x20]
lea ecx, [esi + 0x78]
cmp ecx, eax
je 0x10070da3
cmp dword [eax + 0x14], 0xf
mov edx, eax
jbe 0x10070d9a
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.10025e30
mov eax, dword [edi + 0x24]
lea ebx, [esi + 0x90]
cmp ebx, eax
je 0x10070dc5
cmp dword [eax + 0x14], 0xf
mov ecx, eax
jbe 0x10070dba
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
mov ecx, ebx
call fcn.10025e30
movzx eax, byte [edi + 0x38]
mov byte [esi + 0xa8], al
mov eax, dword [edi + 0x34]
mov dword [esi + 0xac], eax
movzx eax, byte [edi + 0x39]
mov byte [esi + 0xa9], al
mov eax, dword [edi + 0x3c]
cmp eax, 4
ja case.0x10070dea.0
jmp dword [eax*4 + 0x10070e80]
mov eax, 1
jmp 0x10070e0f
mov eax, 2
jmp 0x10070e0f
mov eax, 3
jmp 0x10070e0f
mov eax, 4
jmp 0x10070e0f
xor eax, eax
mov dword [esi + 0xb4], eax
mov eax, dword [edi + 0x40]
sub eax, 0
je 0x10070e35
sub eax, 1
je 0x10070e2e
sub eax, 1
jne 0x10070e35
mov eax, 2
jmp 0x10070e37
mov eax, 1
jmp 0x10070e37
xor eax, eax
push dword [esi + 0x28]
mov dword [esi + 0xb8], eax
movzx eax, byte [edi + 0x3b]
mov byte [esi + 0xbc], al
movzx eax, byte [edi + 0x44]
mov byte [esi + 0xbd], al
movzx eax, byte [edi + 0x45]
mov byte [esi + 0xbe], al
movzx eax, byte [edi + 0x46]
push ebx
mov byte [esi + 0xbf], al
call fcn.10070ad0
add esp, 8
mov dword [esi + 0xc0], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10075300
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ecx + 4]
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ecx + 8]
sub edi, ebx
jne 0x1007531c
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 0xffffffff
jne 0x10075331
mov ecx, esi
call fcn.100752b0
pop edi
pop esi
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 1]
or eax, 0xffffffff
xor edx, edx
div ecx
cmp edx, edi
lea ecx, [eax + 1]
cmovne ecx, eax
mov dword [ebp - 4], ecx
nop word [eax + eax]
cmp dword [esi + 0x9c0], 0x270
jne 0x10075363
mov ecx, esi
call fcn.10076fd0
mov eax, dword [esi + 0x9c0]
xor edx, edx
mov ecx, dword [esi + eax*4]
inc eax
mov dword [esi + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
div dword [ebp - 4]
cmp eax, edi
ja 0x10075350
pop edi
pop esi
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100754a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x101cd100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10075578
cmp byte [ebx + 0x3d], 0
je 0x10075578
mov eax, dword [ebx]
push esi
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x101653ec]
mov ecx, ebx
call esi
cmp eax, 0xffffffff
je 0x10075566
push edi
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [edi]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
mov esi, dword [esi + 0x20]
mov ecx, esi
call dword [0x101653ec]
mov ecx, edi
call esi
pop edi
sub eax, 0
je 0x1007552e
sub eax, 1
je 0x10075532
sub eax, 2
jne 0x10075566
mov byte [ebx + 0x3d], al
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10132a90
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x1007554f
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.1013dd3c
add esp, 0x10
cmp esi, eax
jne 0x10075566
cmp byte [ebx + 0x3d], 0
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10132a90
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10132a90
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.10132a90
mov esp, ebp
pop ebp
ret
Function at 0x10076b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x101cd100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x10076b70
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10132a90
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x10076bac
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [esi + ecx]
cmp ecx, eax
jae 0x10076bac
lea ecx, [esi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10132a90
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x4c], 0
je 0x10076cb5
mov esi, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [esi], eax
jne 0x10076bd4
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], edx
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x10076c0a
push dword [edi + 0x4c]
movsx eax, bl
push eax
call fcn.1013d3c5
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10132a90
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov esi, dword [eax]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [esi + 0x1c]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x101653ec]
mov ecx, dword [ebp - 0x2c]
call esi
sub eax, 0
je 0x10076c75
sub eax, 1
je 0x10076c75
sub eax, 2
jne 0x10076cb5
push dword [edi + 0x4c]
push dword [ebp - 0x28]
call fcn.10074db0
add esp, 8
or ecx, 0xffffffff
test al, al
cmove ebx, ecx
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10132a90
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x10076c92
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.1013dd3c
add esp, 0x10
cmp esi, eax
jne 0x10076cb5
lea ecx, [ebp - 0x28]
mov byte [edi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x34], ecx
pop esi
pop edi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10132a90
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.10132a90
mov esp, ebp
pop ebp
ret 4
Function at 0x10076fd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor eax, eax
cmp dword [0x101d9d80], 2
push edi
mov edi, ecx
jl 0x10077050
movaps xmm3, xmmword [0x101702a0]
xor ecx, ecx
movaps xmm4, xmmword [0x101702b0]
xor edx, edx
movaps xmm5, xmmword [0x101702c0]
movaps xmm6, xmmword [0x10170290]
nop
movups xmm2, xmmword [edi + ecx + 4]
lea ecx, [ecx + 0x10]
movups xmm1, xmmword [edx + edi]
lea edx, [edx + 0x10]
movaps xmm0, xmm2
andps xmm2, xmm6
andps xmm1, xmm4
andps xmm0, xmm3
orps xmm1, xmm0
movups xmm0, xmmword [edi + eax*4 + 0x634]
psrld xmm1, 1
pmulld xmm2, xmm5
xorps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [edi + eax*4], xmm1
add eax, 4
cmp eax, 0xdc
jb 0x10077000
cmp eax, 0xde
jae 0x10077081
nop dword [eax + eax]
mov esi, dword [edi + eax*4]
mov edx, dword [edi + eax*4 + 4]
xor esi, edx
and esi, 0x7ffffffe
and edx, 1
xor esi, dword [edi + eax*4]
imul ecx, edx, 0x9908b0df
shr esi, 1
xor esi, ecx
xor esi, dword [edi + eax*4 + 0x634]
mov dword [edi + eax*4], esi
inc eax
cmp eax, 0xde
jb 0x10077050
mov esi, dword [edi + 0x37c]
mov ecx, esi
mov eax, dword [edi + 0x378]
xor ecx, eax
and ecx, 0x7ffffffe
mov edx, dword [edi + 0x380]
xor ecx, eax
mov eax, esi
shr ecx, 1
and eax, 1
imul eax, eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [edi + 0x9ac]
and eax, 1
mov dword [edi + 0x378], ecx
mov ecx, esi
xor ecx, edx
imul eax, eax, 0x9908b0df
and ecx, 0x7ffffffe
xor ecx, esi
mov esi, dword [edi + 0x384]
shr ecx, 1
xor ecx, eax
mov eax, esi
xor ecx, dword [edi + 0x9b0]
and eax, 1
mov dword [edi + 0x37c], ecx
mov ecx, esi
xor ecx, edx
imul eax, eax, 0x9908b0df
and ecx, 0x7ffffffe
xor ecx, edx
mov edx, dword [edi + 0x388]
shr ecx, 1
xor ecx, eax
mov eax, edx
xor ecx, dword [edi + 0x9b4]
and eax, 1
mov dword [edi + 0x380], ecx
mov ecx, edx
xor ecx, esi
imul eax, eax, 0x9908b0df
and ecx, 0x7ffffffe
xor ecx, esi
mov esi, 0xe3
shr ecx, 1
xor ecx, eax
mov eax, dword [edi + 0x38c]
xor ecx, dword [edi + 0x9b8]
mov dword [edi + 0x384], ecx
mov ecx, eax
xor ecx, edx
and eax, 1
and ecx, 0x7ffffffe
imul eax, eax, 0x9908b0df
xor ecx, edx
shr ecx, 1
xor ecx, eax
xor ecx, dword [edi + 0x9bc]
mov dword [edi + 0x388], ecx
nop dword [eax + eax]
mov ecx, dword [edi + esi*4 + 4]
mov edx, ecx
xor edx, dword [edi + esi*4]
and ecx, 1
and edx, 0x7ffffffe
imul eax, ecx, 0x9908b0df
xor edx, dword [edi + esi*4]
shr edx, 1
xor edx, eax
xor edx, dword [edi + esi*4 - 0x38c]
mov dword [edi + esi*4], edx
inc esi
cmp esi, 0x26f
jb 0x10077170
mov eax, dword [edi + 0x9bc]
mov ecx, dword [edi]
mov edx, ecx
xor edx, eax
mov dword [edi + 0x9c0], 0
and edx, 0x7ffffffe
and ecx, 1
xor edx, eax
imul eax, ecx, 0x9908b0df
shr edx, 1
xor edx, eax
xor edx, dword [edi + 0x630]
mov dword [edi + 0x9bc], edx
pop edi
pop esi
ret