joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004c670
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov eax, dword [ebx + 0x18]
mov ebp, dword [ebx + 0x120]
mov dword [esp + 8], eax
jne 0x1004c7c3
push esi
lea ecx, [ebp + 0x1cc4]
push edi
lea edi, [ebp + 0x1ec4]
mov eax, ecx
mov dword [edi], ecx
cmp ecx, edi
jae 0x1004c6ad
lea eax, [ecx + 1]
mov byte [ecx], 0xff
mov dword [edi], eax
cmp eax, edi
jae 0x1004c6c1
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1004c6c1
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebp + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x18], eax
movzx eax, word [ebp + 0x1caa]
push eax
call esi
mov edx, dword [esp + 0x18]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x1004c72b
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1004c72b
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1004c72b
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1004c72b
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1004c72b
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1004c72b
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov dword [ebp + 0x1ec8], eax
lea esi, [ebp + 0x1cc4]
sub eax, esi
mov dword [edi], esi
sub eax, 2
push eax
lea eax, [ebp + 0x1cc6]
push eax
push 0x3e
push ebx
call fcn.1004c1e0
mov eax, dword [esp + 0x20]
add esp, 0x10
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0
push 3
push esi
push dword [eax + 0x1a0]
call edi
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x1004c783
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.1002f150
add esp, 0xc
push 4
lea eax, [ebp + 0x1cc7]
push eax
push ebx
call fcn.1004c530
add esp, 0xc
lea eax, [ebp + 0x1ccb]
push 0
push 2
push eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x1a0]
call edi
test eax, eax
jns 0x1004c7c1
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.1002f150
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1004dbc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x8c
mov eax, dword [0x10089014]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
mov ebp, dword [esp + 0x98]
xor ebx, ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
mov edi, dword [eax + 0x430]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edi + 0x13c]
push ebx
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [edi + 0x134], eax
cmp dword [edi + 0x130], ebx
jne 0x1004dc46
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea eax, [edi + 0xb0]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x130], eax
mov esi, dword [edi + 0x134]
cmp esi, 4
jge 0x1004dc81
push str.Received_too_short_packet
push ebp
call fcn.1002f150
add esp, 8
mov dword [edi + 0xc], 7
mov eax, ebx
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10012fae
add esp, 0x8c
ret
mov edx, dword [edi + 0x148]
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x1004dca0.1
jmp dword [ecx*4 + 0x1004dd8c]
cmp esi, 4
jle case.0x1004dca0.4
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x144]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x1004dca0.4
lea eax, [esi - 4]
push eax
lea eax, [edx + 4]
push eax
push 1
push ebp
call fcn.100303f0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je case.0x1004dca0.4
push 5
push edi
call fcn.1004e6a0
add esp, 8
jmp 0x1004dc66
movzx ecx, byte [edx + 2]
lea eax, [edx + 4]
mov dword [esp + 0x14], eax
add esi, 0xfffffffc
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
lea eax, [edx + 4]
push esi
push eax
mov dword [edi + 8], ecx
call fcn.1004e710
add esp, 8
cmp eax, esi
jae case.0x1004dca0.4
push dword [esp + 0x14]
push str.TFTP_error:__s
push ebp
call fcn.1002f220
jmp 0x1004dd61
lea eax, [esi - 2]
push eax
lea eax, [edx + 2]
push eax
push edi
call fcn.1004d970
mov ebx, eax
add esp, 0xc
test ebx, ebx
je case.0x1004dca0.4
jmp 0x1004dc66
push str.Internal_error:_Unexpected_packet
push 0x10075ed0
push ebp
call fcn.1002f150
add esp, 0xc
push ebp
call fcn.10042930
add esp, 4
test eax, eax
je 0x1004dc66
push 5
push edi
call fcn.1004e6a0
add esp, 8
mov eax, 0x2a
jmp 0x1004dc68
Function at 0x10055320
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x8c
mov eax, dword [0x10089014]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x9c]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov esi, dword [edi + 0x18]
mov ebx, dword [esi + 0x1a4]
push ebx
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1005538b
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x80
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_accept]
mov dword [esp + 0xc], eax
jmp 0x1005538f
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
jne 0x100553bf
push str.Error_accept__ing_server_connect
push edi
call fcn.1002f150
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.10012fae
add esp, 0x8c
ret
push str.Connection_accepted_from_server
push edi
call fcn.1002f220
mov byte [esi + 0x295], 0
push 1
push dword [esp + 0x18]
call fcn.10066050
lea eax, [esp + 0x1c]
push eax
push 1
push esi
push edi
call fcn.10037320
mov esi, eax
add esp, 0x20
test esi, esi
je 0x10055417
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.10012fae
add esp, 0x8c
ret
cmp dword [edi + 0x19c], 0
je 0x10055473
push 1
push edi
call fcn.1001c5b0
mov eax, dword [edi + 0x19c]
push 1
push dword [esp + 0x18]
push dword [edi + 0x1a0]
call eax
push 0
push edi
mov esi, eax
call fcn.1001c5b0
add esp, 0x1c
test esi, esi
je 0x10055473
push edi
call fcn.10055ac0
add esp, 4
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.10012fae
add esp, 0x8c
ret
mov ecx, dword [esp + 0x94]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10012fae
add esp, 0x8c
ret
Function at 0x100579e0
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0x18]
cmp eax, 0x64
jb 0x10057a10
push str.Couldnt_set_desired_mode
push esi
call fcn.1002f150
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x10057a27
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.1002f220
add esp, 0xc
mov al, byte [esp + 0x18]
push ebp
cmp al, 0x13
jne 0x10057a41
push ebx
push esi
call fcn.100576f0
add esp, 8
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp al, 0x14
jne 0x10057b4e
mov edi, dword [esi + 0x18]
xor ebx, ebx
cmp byte [esi + 0x4b8], 2
mov dword [esp + 0x18], edi
jne 0x10057abe
mov eax, dword [esi + 0x120]
mov eax, dword [eax]
test eax, eax
je 0x10057abe
push 3
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push ecx
push ebx
push eax
call fcn.10038c50
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x10057b79
push 0x2f
push dword [esp + 0x18]
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
je 0x10057aad
mov ebx, dword [esp + 0x14]
mov ecx, 1
sub eax, ebx
cmovne ecx, eax
mov byte [ecx + ebx], 0
jmp 0x10057aba
push dword [esp + 0x14]
call dword [0x100895a8]
add esp, 4
mov edi, dword [esp + 0x18]
mov ecx, dword [esi + 0x544]
test ecx, ecx
jne 0x10057adc
cmp byte [esi + 0xcfd], 0
mov ecx, str.NLST
mov eax, str.LIST
cmove ecx, eax
mov edx, 0x10076d92
test ebx, ebx
mov eax, edx
cmovne eax, ebx
push eax
mov eax, 0x100778d8
cmove eax, edx
push eax
push ecx
push 0x100781a8
call fcn.10038f70
push ebx
mov ebp, eax
call dword [0x100895a8]
add esp, 0x14
test ebp, ebp
jne 0x10057b19
mov edi, 0x1b
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
push ebp
push 0x10075ed0
lea eax, [edi + 0x430]
push eax
push esi
call fcn.1006df70
push ebp
mov edi, eax
call dword [0x100895a8]
add esp, 0x14
test edi, edi
jne 0x10057b79
push 0x1f
push esi
call fcn.10055a30
add esp, 8
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
cmp al, 0x15
jne 0x10057b66
push 0xd
push 1
push esi
call fcn.10057220
add esp, 0xc
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp al, 0x16
jne 0x10057b79
push 0xe
push 1
push esi
call fcn.10057220
add esp, 0xc
mov edi, eax
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x100708a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x100895a4]
mov esi, eax
add esp, 4
test esi, esi
jne 0x100708cb
pop esi
pop ebp
add esp, 0xc
ret
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x1007091a
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [edi]
push ebx
push dword [esp + 0x2c]
push dword [esi + 4]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x28], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov ebx, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x28], ebx
jmp 0x10070922
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x30]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x10070993
mov ebp, dword [esp + 0x14]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x10070950
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x100709c5
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x1008362d
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x1008362e
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x100709a0
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x100709d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.100326f0
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x100895a4]
mov esi, eax
add esp, 8
test esi, esi
je 0x10070b52
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x10070a52
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x10070ac3
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x10070a80
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x10070af5
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x1008362d
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x1008362e
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x10070ad0
push dword [esp + 0x30]
call fcn.100326f0
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x10070b20
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x100895a8]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x10070c40
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x10070c66
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x10070c9e
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], 0
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.100326f0
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x10070cf5
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x10070d04
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x10070d15
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret
Function at 0x10071950
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x1007199c
push ebx
mov ebx, dword [esp + 0x10]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x10071961
pop ebx
pop edi
pop esi
ret
Function at 0x66f85130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, eax
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x1c
movzx eax, byte [eax + 0x10]
mov ebx, dword [edx]
xor al, 3
mov byte [esp + 0xf], al
test ebx, ebx
je 0x66f85180
lea esi, [ecx - 1]
cmp byte [ebx + 5], 6
je 0x66f851b0
movzx eax, byte [ebx + 4]
mov ecx, dword [ebx]
mov dl, al
xor dl, 3
test byte [esp + 0xf], dl
je 0x66f85190
movzx edx, byte [ebp + 0x10]
and al, 0xf8
mov edi, ebx
and dl, 3
or al, dl
mov byte [ebx + 4], al
mov ebx, dword [edi]
test ebx, ebx
je 0x66f85180
sub esi, 1
jae 0x66f8514e
add esp, 0x1c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [edi], ecx
cmp ebx, dword [ebp + 0x18]
je 0x66f851c8
movzx eax, byte [ebx + 5]
mov edx, ebx
mov ecx, ebp
call dword [eax*4 + 0x66ff9070]
jmp 0x66f85175
lea edx, [ebx + 0x20]
mov ecx, 0xffffffff
mov eax, ebp
call fcn.66f85130
jmp 0x66f85154
mov dword [ebp + 0x18], ecx
jmp 0x66f85197
Function at 0x66f8c760
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov dword [esp + 0x70], ebx
mov eax, dword [esp + 0x88]
mov dword [esp + 0x78], edi
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x74], esi
mov edi, dword [esp + 0x84]
mov ecx, dword [esp + 0x8c]
test eax, eax
je 0x66f8c797
mov esi, dword [eax]
cmp byte [esi + 6], 0
je 0x66f8c7c8
mov dword [esp + 0x88], edi
mov esi, dword [esp + 0x74]
mov eax, 0x66ffa708
mov dword [esp + 0x80], ebx
mov edi, dword [esp + 0x78]
mov dword [esp + 0x84], eax
mov ebx, dword [esp + 0x70]
add esp, 0x7c
jmp fcn.66f92f40
mov edx, esi
mov eax, ebx
call fcn.66f8bd30
cmp eax, 0xffffffff
mov edx, eax
je 0x66f8c797
mov esi, dword [esi + 0x10]
sub esi, 0x40
mov ecx, esi
call fcn.66f8c200
test eax, eax
js 0x66f8c797
mov dword [esp + 0x2c], eax
mov edx, dword [esi + 0x2c]
mov dword [esp + 8], edx
mov edx, dword [esi + 0x28]
lea esi, [esp + 0x34]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.66f8c620
mov eax, dword [esp + 0x2c]
mov edx, str._s:_d:__s
mov dword [esp + 0x10], edi
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], edx
call fcn.66f92f40
mov ebx, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
add esp, 0x7c
ret

Function at 0x66f8d8f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x18], ebx
mov eax, dword [0x6701502c]
mov ebx, ecx
test eax, eax
je 0x66f8d9d0
mov dword [esp], ebx
mov edx, 0x20
mov dword [esp + 4], edx
call eax
sub esp, 8
test al, al
jne 0x66f8d928
mov ebx, dword [esp + 0x18]
xor eax, eax
add esp, 0x1c
ret
mov eax, dword [ebx]
mov ecx, 1
mov edx, dword [ebx + 4]
cmp ecx, eax
mov ecx, 0
sbb ecx, edx
jae 0x66f8d9c0
mov eax, dword [ebx + 8]
mov ecx, 0x3f
mov edx, dword [ebx + 0xc]
cmp ecx, eax
mov ecx, 0
sbb ecx, edx
jb 0x66f8d963
add eax, 0x40
mov dword [ebx + 8], eax
adc edx, 0
mov dword [ebx + 0xc], edx
mov eax, dword [ebx + 0x10]
mov ecx, 0x1ff
mov edx, dword [ebx + 0x14]
cmp ecx, eax
mov ecx, 0
sbb ecx, edx
jb 0x66f8d987
add eax, 0x200
mov dword [ebx + 0x10], eax
adc edx, 0
mov dword [ebx + 0x14], edx
mov eax, dword [ebx + 0x18]
mov ecx, 0x1ffff
mov edx, dword [ebx + 0x1c]
cmp ecx, eax
mov ecx, 0
sbb ecx, edx
jb 0x66f8d9ab
add eax, 0x20000
mov dword [ebx + 0x18], eax
adc edx, 0
mov dword [ebx + 0x1c], edx
mov ecx, ebx
call fcn.66f8d650
mov ebx, dword [esp + 0x18]
mov eax, 1
add esp, 0x1c
ret
add eax, 2
mov dword [ebx], eax
adc edx, 0
mov dword [ebx + 4], edx
jmp 0x66f8d941
mov dword [esp], str.advapi32.dll
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
sub esp, 0xc
test eax, eax
je 0x66f8d91b
mov dword [esp], eax
mov ecx, str.SystemFunction036
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6701502c], eax
sub esp, 8
test eax, eax
jne 0x66f8d906
jmp 0x66f8d91b
Function at 0x66f92cc0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [ebx - 0x50373], cl
dec dword [ecx - 0xac773]
call dword [ecx - 0x18]
or byte [eax], al
add byte [eax], al
Function at 0x66f92d39
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0x10dbe
xor edx, 0x44f4
add edx, 0x2219
pop edx
push eax
sub eax, 0x16c17
pop eax
mov ecx, dword [ebp - 0xc90]
mov dword [ebp - 0x15a8], ecx
jmp 0x66f92e99
Function at 0x66f936c2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
or edi, 0x91fe
add edi, 0x1516c
add edi, 0x14168
pop edi
push ebx
add ebx, 0x152ca
add ebx, 0x2da5
jmp 0x66f9366d
jmp 0x66f93675
pop ebx
lea edx, [ebp - 0x1784]
mov dword [ebp - 0xca4], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xca0], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ecx
push ecx
add esp, 4
xor ecx, 0x49ae
or ecx, 0x3d0f
call fcn.66f936c2
add byte [eax + 0x47], cl
cmp eax, 0x3e43483d
inc ebp
add esp, 4
call 0x66f936d1
add byte [ebp + 0x40], cl
xor al, 0x4c
cmp eax, dword [eax - 0x7d]
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0xca0]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xca0]
add eax, 2
mov dword [ebp - 0xca0], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca4]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xca4]
add ecx, 2
mov dword [ebp - 0xca4], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x110], dx
push edi
call 0x66f9373d
add byte [ebx + ecx*2 + 0x50], al
inc esp
dec esp
inc edi
xor eax, dword [ebx + 0x535f04c4]
push eax
add esp, 4
and ebx, 0x10a45
sub ebx, 0x3e29
pop ebx
push eax
add eax, 0x192b
jmp 0x66f93760
pop eax
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x66f93784
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15f4], ecx
jmp 0x66f937e7
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x66f936a3
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x66f936a3
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x66f937d1
mov dword [ebp - 0x15f0], 0xffffffff
jmp 0x66f937db
mov dword [ebp - 0x15f0], 1
mov eax, dword [ebp - 0x15f0]
mov dword [ebp - 0x15f4], eax
cmp dword [ebp - 0x15f4], 0
jne 0x66f93830
push ecx
xor ecx, 0x7468
xor ecx, 0x14f59
and ecx, 0x161a8
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0xc44b
call 0x66f9381e
add byte [0x4c434d4d], dh
cmp byte [edi], bh
cmp dword [edi - 0x7d], eax
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x754], ecx
jmp 0x66f93898
push esi
push esi
add esp, 4
add esi, 0x561c
sub esi, 0x14758
or esi, 0xd0b4
sub esi, 0x13f4
pop esi
push eax
sub eax, 0x55de
xor eax, 0x8179
or eax, 0x42f0
pop eax
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xca8]
je 0x66f9388e
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x66f93644
mov dword [ebp - 0x754], 0