joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485c40
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x34], edi
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x38], ebp
mov ebp, dword [esp + 0x40]
mov dword [esp + 0x30], esi
mov dword [esp], str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 4], str.getaddrinfo
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x485cb7
mov edx, dword [esp + 0x44]
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp], ebp
mov dword [esp + 4], edx
call eax
sub esp, 0x10
mov esi, eax
mov eax, esi
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
ret
mov dword [edi], 0
mov esi, 0x2afb
mov dword [esp], 0x10
call fcn.00ad02a0
test eax, eax
mov edx, eax
je 0x485ca1
test ebp, ebp
mov word [eax], 2
je 0x485e15
lea eax, [eax + 4]
mov dword [esp + 0x18], edx
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.00485b70
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], 0
test eax, eax
jne 0x485d40
test ebx, ebx
je 0x485d11
test byte [ebx], 4
jne 0x485df5
mov dword [esp + 0x18], edx
mov dword [esp], ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
sub esp, 4
test eax, eax
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x18]
je 0x485e71
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [edx + 4], eax
nop
lea esi, [esi]
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x485d6f
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x18], edx
mov dword [esp], ecx
call sub.msvcrt.dll_atoi
movzx eax, ax
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
sub esp, 4
mov edx, dword [esp + 0x18]
mov word [edx + 2], ax
mov dword [esp + 0x18], edx
mov dword [esp], 0x20
call fcn.00ad02a0
mov edx, dword [esp + 0x18]
test eax, eax
mov esi, eax
je 0x485e60
test ebx, ebx
mov dword [edi], eax
mov dword [eax + 4], 2
je 0x485e54
mov eax, dword [ebx + 8]
cmp eax, 1
mov dword [esi + 8], eax
je 0x485e32
cmp eax, 2
je 0x485e02
test ebx, ebx
mov dword [esi + 0xc], 0
mov dword [esi + 0x18], edx
mov dword [esi + 0x10], 0x10
je 0x485de7
test byte [ebx], 2
je 0x485de7
mov edx, dword [esp + 0x1c]
xor eax, eax
test edx, edx
je 0x485de4
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
mov dword [esp], eax
call fcn.00ad0370
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], 0
xor esi, esi
jmp 0x485ca1
mov dword [esp], edx
call fcn.00ad0250
jmp 0x485ca1
mov dword [esi + 0xc], 0x11
mov dword [esi + 0x18], edx
mov dword [esi + 0x10], 0x10
jmp 0x485dc7
test ebx, ebx
je 0x485e40
test byte [ebx], 1
je 0x485e40
mov dword [eax + 4], 0
mov dword [esp + 0x1c], 0
jmp 0x485d40
mov dword [esi + 0xc], 6
jmp 0x485e09
mov dword [edx + 4], 0x7f000001
mov dword [esp + 0x1c], 0
jmp 0x485d40
mov dword [eax + 8], 0
jmp 0x485db2
mov dword [esp], edx
mov si, 0x2afb
call fcn.00ad0250
jmp 0x485ca1
mov dword [esp], edx
mov esi, 0x2afb
call fcn.00ad0250
jmp 0x485ca1
Function at 0x486130
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 0x8004667e
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
sub esp, 0xc
add esp, 0x1c
ret
Function at 0x517570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
add ecx, edx
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x8c
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x68], eax
lea eax, [edx + 0x30]
cmp ecx, eax
jb 0x517700
mov eax, dword [esp + 0x68]
add eax, 1
mov dword [esp + 0x78], eax
jmp 0x517645
mov ebx, dword [esi + 0x20]
movzx ebp, word [esi + 0x10]
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
add ebx, ebx
lea eax, [esi + ebx + 0x30]
cmp dword [esp + 0x64], eax
jb 0x517710
mov eax, dword [esi + ebx + 0x28]
cmp ebx, dword [esp + 0x68]
mov dword [esp + 0x6c], eax
mov eax, dword [esi + ebx + 0x2c]
mov dword [esp + 0x70], eax
jl 0x517633
mov eax, dword [esp + 0x68]
lea edi, [esi + 0x28]
mov dword [esp], edi
mov dword [esp + 0x60], edx
mov dword [esp + 0x5c], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcmp
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
test eax, eax
jne 0x517633
cmp ebx, dword [esp + 0x78]
jle 0x517739
mov eax, dword [esp + 0x68]
cmp word [esi + eax + 0x28], 0
je 0x517739
movzx ebp, bp
add esi, ebp
lea eax, [esi + 0x30]
cmp dword [esp + 0x64], eax
jb 0x517700
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x113385e
mov dword [esp], esi
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x5175b7
movzx eax, byte [esi + 0xf]
mov dword [esp + 8], str.unknown_guid__02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x__expected_dir_entry_guid__remaining_directory_entries_ignored_n
mov dword [esp + 0x48], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x44], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x40], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x3c], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x38], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x34], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x30], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 7]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 6]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 5]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 4]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 3]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 2]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 1]
mov dword [esp + 0x10], eax
movzx eax, byte [esi]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x10
mov eax, dword [esp + 0x7c]
mov dword [esp], eax
call fcn.00acfa00
add esp, 0x8c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x7c]
mov dword [esp + 8], str.filename_exceeds_buffer_size__remaining_directory_entries_ignored_n
mov dword [esp + 4], 0x10
mov dword [esp], eax
call fcn.00acfa00
add esp, 0x8c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x6c]
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00517110
Function at 0x5248b0
Capabilities:
Connect socket

Disassembly:
sub esp, 0x16c
mov dword [esp + 0x160], esi
mov esi, dword [esp + 0x174]
lea eax, [esp + 0x14c]
mov dword [esp + 0x168], ebp
mov ebp, dword [esp + 0x170]
mov dword [esp + 0x164], edi
lea edi, [esp + 0x42]
mov dword [esp + 0x15c], ebx
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0x100
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0047d460
mov edx, dword [esp + 0x14c]
xor ecx, ecx
mov eax, edi
mov dword [esp], 0
call fcn.005247c0
test eax, eax
mov edx, eax
je 0x524a40
mov ecx, dword [edx + 0x10]
lea edi, [ebx + 0x18]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x38], edx
mov dword [esp], edi
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x38]
mov eax, dword [edx + 0x10]
mov dword [esp], edx
mov dword [esp + 0x38], eax
call fcn.00485e90
mov eax, dword [esp + 0x38]
test eax, eax
mov dword [ebx + 0x98], eax
js 0x524a4a
mov dword [esp], edi
call fcn.00482510
mov dword [ebx + 0xc], eax
mov dword [esp], esi
xor esi, esi
mov dword [esp + 4], 0x3f
call sub.msvcrt.dll_strchr
test eax, eax
je 0x5249e9
lea edx, [esp + 0x142]
mov dword [esp], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x112df94
mov dword [esp + 4], 0xa
call fcn.00ad76c0
mov edx, dword [esp + 0x38]
test eax, eax
jne 0x524a10
mov eax, esi
mov ebx, dword [esp + 0x15c]
mov esi, dword [esp + 0x160]
mov edi, dword [esp + 0x164]
mov ebp, dword [esp + 0x168]
add esp, 0x16c
ret
mov eax, dword [ebx + 0x9c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], edx
mov dword [esp + 0x3c], eax
call sub.msvcrt.dll_strtol
test eax, eax
mov dword [ebx + 0x9c], eax
jne 0x524a51
xor esi, esi
jmp 0x5249e9
mov dword [ebx + 0x98], 0xfffffffb
mov esi, 0xfffffffb
jmp 0x5249e9
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x524a3c
mov eax, dword [ebx + 0x98]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
test eax, eax
je 0x5249e9
mov dword [ebx + 0x9c], 0
mov esi, 0xfffffffb
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 8], str.connect:__s_n
mov dword [esp + 4], 0x10
mov dword [esp], ebp
mov dword [esp + 0xc], eax
call fcn.00acfa00
jmp 0x5249e9
Function at 0x526350
Capabilities:
Get hostname

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x3c]
mov dword [esp + 0x28], ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x24], edi
mov dword [esp], 0x7a0
call fcn.00ad02a0
test eax, eax
mov ebx, eax
je 0x526475
mov dword [eax + 8], esi
lea edi, [ebx + 0x144]
mov edx, 0x28
mov dword [eax + 0x180], 0
test edi, 1
mov dword [eax + 0x184], 0x80000000
mov dword [eax + 0x188], 0
mov dword [eax + 0x18c], 0x80000000
mov eax, dword [esp + 0x30]
mov dword [ebx + 4], ebp
mov dword [ebx], eax
mov eax, dword [esp + 0x40]
mov dword [ebx + 0x178], eax
jne 0x526510
test edi, 2
jne 0x526500
mov ecx, edx
xor eax, eax
shr ecx, 2
test dl, 2
rep stosd dword es:[edi], eax
jne 0x526498
and edx, 1
jne 0x526490
mov word [ebx + 0x144], 0
mov edi, str.MP2T
mov dword [ebx + 0x154], 1
mov dword [esp], esi
call fcn.00486580
mov ecx, 5
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x5264b0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xd4]
cmp eax, 0xd
je 0x526450
ja 0x5264d0
cmp eax, 1
jb 0x526457
cmp eax, 2
jbe 0x526450
cmp eax, 5
jne 0x526457
nop
mov dword [ebp + 0x60], 1
mov eax, dword [esp + 0x38]
mov dword [ebx + 0x40], eax
lea eax, [ebx + 0x44]
mov dword [esp + 4], 0x100
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_gethostname]
sub esp, 8
mov eax, ebx
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add esp, 0x2c
ret
mov byte [edi], 0
jmp 0x5263fd
mov word [edi], 0
add edi, 2
and edx, 1
je 0x5263fd
jmp 0x526490
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.004e0b80
test eax, eax
mov dword [ebx + 0x34], eax
jne 0x526457
mov dword [esp], ebx
xor ebx, ebx
call fcn.00ad0250
jmp 0x526475
cmp eax, 0x1101c
je 0x5264e7
ja 0x526524
cmp eax, 0x1c
jne 0x526457
jmp 0x526450
cmp dword [edx + 0x3c], 0x1f40
jne 0x526457
mov dword [edx + 0x3c], 0x3e80
jmp 0x526457
mov word [edi], 0
sub edx, 2
add edi, 2
jmp 0x5263e2
mov byte [ebx + 0x144], 0
lea edi, [ebx + 0x145]
mov dl, 0x27
jmp 0x5263d6
sub eax, 0x15000
cmp eax, 1
ja 0x526457
jmp 0x526450
Function at 0x527410
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xac
mov eax, dword [esp + 0xc8]
lea ebp, [esp + 0x2b]
mov ebx, dword [esp + 0xc0]
mov edi, ebp
mov esi, dword [esp + 0xc4]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
test ebp, 1
mov dword [esp + 0x1c], 0x40
mov edx, eax
jne 0x52766e
test edi, 2
jne 0x527686
mov ecx, dword [esp + 0x1c]
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
test byte [esp + 0x1c], 2
je 0x527479
mov word [edi], 0
add edi, 2
test byte [esp + 0x1c], 1
je 0x527483
mov byte [edi], 0
cmp edx, 0x28
mov eax, 0x20
mov byte [esp + 0x2b], 0xa1
mov byte [esp + 0x2c], 0xe9
mov byte [esp + 0x2d], 0x14
mov byte [esp + 0x2e], 0x9d
mov byte [esp + 0x2f], 0xe
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x31], 0x3b
mov byte [esp + 0x32], 0x59
mov byte [esp + 0x6b], 5
mov byte [esp + 0x6c], 0x18
mov byte [esp + 0x6d], 0x74
mov byte [esp + 0x6e], 0xd0
mov byte [esp + 0x6f], 0xd
mov byte [esp + 0x70], 9
mov byte [esp + 0x71], 2
mov byte [esp + 0x72], 0x53
mov byte [esp + 0x73], 0xc0
mov byte [esp + 0x74], 1
mov byte [esp + 0x75], 5
mov byte [esp + 0x76], 5
mov byte [esp + 0x77], 0x67
mov byte [esp + 0x78], 3
mov byte [esp + 0x79], 0x19
mov byte [esp + 0x7a], 0x70
mov byte [esp + 0x7b], 8
mov byte [esp + 0x7c], 0x27
mov byte [esp + 0x7d], 0x66
mov byte [esp + 0x7e], 0x10
mov byte [esp + 0x7f], 0x10
mov byte [esp + 0x80], 0x72
mov byte [esp + 0x81], 8
mov byte [esp + 0x82], 9
mov byte [esp + 0x83], 0x63
mov byte [esp + 0x84], 0x11
mov byte [esp + 0x85], 3
mov byte [esp + 0x86], 0x71
mov byte [esp + 0x87], 8
mov byte [esp + 0x88], 8
mov byte [esp + 0x89], 0x70
mov byte [esp + 0x8a], 2
mov byte [esp + 0x8b], 0x10
mov byte [esp + 0x8c], 0x57
mov byte [esp + 0x8d], 5
mov byte [esp + 0x8e], 0x18
mov byte [esp + 0x8f], 0x54
je 0x5275a6
mov al, 0x38
cmp edx, 0x38
cmovle eax, edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc8]
lea edi, [esp + 0x33]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov edx, 5
xor eax, eax
jmp 0x5275d5
movzx edx, byte [esp + eax + 0x6b]
xor byte [edi + eax], dl
add eax, 1
cmp eax, 0x25
jne 0x5275d0
lea edi, [esp + 0x90]
mov dword [esp + 4], ebp
mov dword [esp], edi
mov dword [esp + 8], 0x40
call fcn.00add660
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x10
call fcn.0047d720
movzx eax, byte [ebx]
mov dword [ebx + 0x20], 0x30643130
mov dword [ebx + 0x24], 0x33653861
mov byte [ebx + 0x28], 0
mov byte [esi], al
movzx eax, byte [ebx + 4]
mov byte [esi + 1], al
movzx eax, byte [ebx + 8]
mov byte [esi + 2], al
movzx eax, byte [ebx + 0xc]
mov byte [esi + 3], al
movzx eax, byte [ebx + 0x10]
mov byte [esi + 4], al
movzx eax, byte [ebx + 0x14]
mov byte [esi + 5], al
movzx eax, byte [ebx + 0x18]
mov byte [esi + 6], al
movzx eax, byte [ebx + 0x1c]
mov byte [esi + 8], 0
mov byte [esi + 7], al
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [esp + 0x2c]
test edi, 2
mov dword [esp + 0x1c], 0x3f
je 0x52745f
mov word [edi], 0
add edi, 2
sub dword [esp + 0x1c], 2
jmp 0x52745f
Function at 0x8c7f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esp + 4], 0x20
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], 1
jmp fcn.008c6630

Function at 0x8c7f50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esp + 4], 0x20
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], 0
jmp fcn.008c6630
Function at 0x989750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x60]
mov dword [esp + 0x58], ebp
mov dword [esp + 0x4c], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x68]
mov edx, dword [eax + 0x2060]
mov ebp, dword [eax + 0x206c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x34], edx
mov edx, dword [eax + 0x2138]
mov ecx, ebp
and ecx, 1
lea esi, [ecx + ecx]
add ecx, 1
mov dword [esp + 0x30], edx
mov edx, dword [eax + 0x2088]
sar edi, cl
add esi, 1
mov dword [esp + 0x38], edx
mov edx, dword [eax + 0x208c]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x64]
sar edx, cl
mov ecx, dword [eax + ebx*4 + 0x1480]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + ebx*4 + 0x147c]
mov dword [esp + 8], ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x68]
and ecx, esi
and esi, dword [esp + 0x64]
mov dword [esp + 4], ecx
mov ecx, edi
mov dword [esp], esi
call fcn.009753f0
mov ecx, dword [esp + 0x7c]
test ecx, ecx
je 0x989832
test ebx, ebx
jle 0x989846
mov ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x64]
sub edx, dword [esp + 0x38]
movzx ecx, byte [ebx + edx]
mov edx, dword [esp + 0x68]
sub edx, dword [esp + 0x3c]
movzx edx, byte [ebx + edx]
add edx, ecx
imul edx, dword [esp + 0x34]
add eax, edx
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
mov ebx, dword [esp + 0x68]
or ebx, dword [esp + 0x64]
jne 0x98980d
jmp 0x989832
Function at 0xad4550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
xor ecx, ecx
mov dword [esp + 0x64], edi
mov edi, dword [esp + 0x70]
mov dword [esp + 0x68], ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], esi
mov eax, edi
mov edx, ebp
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00ad2b10
xor ecx, ecx
test eax, eax
mov ebx, eax
je 0xad4590
mov ecx, dword [eax + 0x2c]
mov edx, dword [esp + 0x78]
mov eax, edi
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00ad2b10
test eax, eax
mov esi, eax
je 0xad45d5
test ebx, ebx
je 0xad45d5
xor ebx, ebx
cmp dword [eax + 0xc], 0x80
je 0xad45e0
mov eax, ebx
mov esi, dword [esp + 0x60]
mov ebx, dword [esp + 0x5c]
mov edi, dword [esp + 0x64]
mov ebp, dword [esp + 0x68]
add esp, 0x6c
ret
xor ebx, ebx
jmp 0xad45bf
lea eax, [esp + 0x4c]
xor ecx, ecx
mov dword [esp + 4], eax
fld1
mov edx, ebp
mov eax, edi
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 0
fstp qword [esp + 0x40]
mov dword [esp + 0x48], 1
mov dword [esp], 0
call fcn.00ad2b10
test eax, eax
je 0xad45bf
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0xad45bf
add ecx, dword [eax + 8]
lea edx, [eax + 0x10]
mov eax, dword [eax + 0xc]
lea edi, [esp + 0x38]
mov dword [esp + 8], edi
lea edi, [esp + 0x48]
mov dword [esp + 4], edi
lea edi, [esp + 0x40]
mov dword [esp], edi
call fcn.00ad2a10
test eax, eax
js 0xad45bf
fld qword [esp + 0x40]
fild qword [esp + 0x38]
fnstcw word [esp + 0x26]
fstp qword [esp + 0x28]
fld qword [esp + 0x28]
fmulp st(1)
movzx eax, word [esp + 0x26]
mov ah, 0xc
fild dword [esp + 0x48]
mov word [esp + 0x24], ax
fdivp st(1)
fldcw word [esp + 0x24]
fistp qword [esp + 0x18]
fldcw word [esp + 0x26]
mov eax, dword [esp + 0x18]
fld qword [esi + 0x10]
fldcw word [esp + 0x24]
fistp dword [esp + 0x20]
fldcw word [esp + 0x26]
mov ebx, dword [esp + 0x20]
and ebx, eax
jmp 0xad45bf
Function at 0xad6590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x68
fld qword [esp + 0x70]
fld st(0)
fxam
wait
fnstsw ax
fstp st(0)
and eax, 0x4500
cmp eax, 0x100
je 0xad66a6
fld st(0)
fxam
wait
fnstsw ax
fstp st(0)
and eax, 0x4500
cmp eax, 0x500
je 0xad6690
fld st(0)
fabs
fld xword [0x1256ca0]
faddp st(1)
fstp qword [esp]
fstp qword [esp + 0x20]
call fcn.01088550
mov edx, 0
mov ecx, 0x3d
fldln2
fdivp st(1)
fnstcw word [esp + 0x46]
movzx eax, word [esp + 0x46]
mov ah, 0xc
mov word [esp + 0x44], ax
fldcw word [esp + 0x44]
fistp dword [esp + 0x40]
fldcw word [esp + 0x46]
mov eax, dword [esp + 0x40]
test eax, eax
cmovs eax, edx
xor edx, edx
sub ecx, eax
xor eax, eax
test cl, 0x20
sete al
setne dl
shl edx, cl
shl eax, cl
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
fild qword [esp + 0x38]
mov ebx, ecx
mov dword [esp + 0x10], eax
sar ebx, 0x1f
fstp qword [esp + 0x48]
fld qword [esp + 0x48]
lea eax, [esp + 0x58]
fld qword [esp + 0x20]
fmulp st(1)
mov dword [esp + 0x14], edx
lea edx, [esp + 0x5c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 4], edx
fadd dword [0x1256cac]
mov dword [esp + 0x18], ecx
mov dword [esp], eax
fldcw word [esp + 0x44]
fistp qword [esp + 8]
fldcw word [esp + 0x46]
call fcn.00ad5db0
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
add esp, 0x68
pop ebx
ret
fldz
xor eax, eax
fucompi st(1)
fstp st(0)
setbe al
add esp, 0x68
lea eax, [eax + eax - 1]
xor edx, edx
pop ebx
ret
fstp st(0)
add esp, 0x68
xor ax, ax
xor edx, edx
pop ebx
ret
Function at 0xadb8f0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x40
mov dword [esp + 4], 0
mov dword [esp], str._dev_urandom
call sub.msvcrt.dll__open
cmp eax, 0xffffffff
mov ebx, eax
je 0xadb940
lea eax, [esp + 0x3c]
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll__read
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll__close
cmp esi, 4
mov ecx, dword [esp + 0x3c]
je 0xadba26
mov dword [esp + 4], 0
mov dword [esp], str._dev_random
call sub.msvcrt.dll__open
cmp eax, 0xffffffff
mov ebx, eax
je 0xadb98a
lea eax, [esp + 0x3c]
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll__read
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll__close
cmp esi, 4
mov ecx, dword [esp + 0x3c]
je 0xadba26
fld dword [0x1257f48]
xor edi, edi
xor esi, esi
mov dword [esp + 0x10], 0
fstp dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x14], 0
jmp 0xadb9f4
mov edx, eax
sub edx, ebx
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
fabs
fld dword [esp + 0x1c]
fxch st(1)
fucompi st(1)
fstp st(0)
jbe 0xadb9fd
cmp esi, 0x270f
ja 0xadba32
fld dword [0x1257f4c]
fld dword [esp + 0x1c]
fxch st(1)
fucompi st(1)
jbe 0xadba30
fadd st(0)
xor ebx, ebx
cmp edi, 0x3f
mov esi, 1
fstp dword [esp + 0x1c]
jg 0xadba0c
call sub.msvcrt.dll_clock
test ebx, ebx
jne 0xadb9b0
cmp eax, 0xffffffff
je 0xadb9ca
add esi, 1
cmp edi, 0x3f
mov ebx, eax
jle 0xadb9f4
rdtsc
xor ecx, ecx
mov ebx, edx
xor edx, edx
add eax, ecx
mov ecx, dword [esp + 0x10]
adc edx, ebx
mov ebx, dword [esp + 0x14]
xor ecx, eax
xor ebx, edx
add ecx, ebx
add esp, 0x40
mov eax, ecx
pop ebx
pop esi
pop edi
ret
fstp st(0)
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], 0
shld ecx, edx, 1
add edx, edx
mov dword [esp + 0x14], ecx
mov ecx, esi
and ecx, 1
mov dword [esp + 0x10], edx
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x20]
add dword [esp + 0x10], edx
mov ecx, dword [esp + 0x24]
adc dword [esp + 0x14], ecx
add edi, 1
jmp 0xadba02