joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f6c8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x8c], 0
je 0x44f6fd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403d30
jmp 0x44f707
mov eax, esi
mov edx, dword [ebx + 0x74]
call fcn.00403ce4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x450628
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x450660
mov eax, esi
call fcn.00438d18
test al, al
je 0x450660
mov eax, dword [ebx + 0x6c]
call fcn.004388f0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x450660
push 0
mov eax, dword [ebx + 0x6c]
call fcn.004388f0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45bac0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45bb98
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x57e858], 0
jne 0x45bb7c
lea eax, [ebp - 4]
mov edx, 0x45bbb0
call fcn.00403ce4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040408c
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x45bb7c
mov eax, ebx
call fcn.00402798
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45bb75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x45bb5f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x45bbc0
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45bb5f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x57e858], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bb7c
mov eax, dword [ebp - 0xc]
call fcn.004027b0
ret
mov ebx, dword [0x57e858]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bb9f
lea eax, [ebp - 4]
call fcn.00403c4c
ret
Function at 0x469b44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x204], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x469d26
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x469b8e
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.00469614
mov eax, dword [ebp - 0x204]
mov edx, ebx
call fcn.0040c980
cmp al, 1
jne 0x469b8e
dec ebx
mov edi, ebx
mov eax, esi
call fcn.00469928
test al, al
je 0x469cc6
test edi, edi
jge 0x469ba5
xor edi, edi
lea ebx, [edi + 1]
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.00469614
mov eax, dword [ebp - 0x204]
call fcn.00403ec8
cmp ebx, eax
jge 0x469bec
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.00469614
mov eax, dword [ebp - 0x204]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x57dc3c]
and eax, 0xff
bt dword [edx], eax
jae 0x469bec
inc ebx
mov eax, dword [esi + 0x20c]
cmp edi, eax
jl 0x469bfa
mov edi, eax
mov ebx, edi
mov ecx, ebx
mov edx, ebx
mov eax, esi
call fcn.00469b20
cmp ebx, edi
je 0x469cbe
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x200]
mov byte [eax], 0
inc eax
dec edx
jne 0x469c24
mov byte [ebp - 0x1f0], 0x81
mov eax, esi
mov bx, 0xffcf
call fcn.00403234
and eax, 0x7f
movzx eax, word [eax*2 + 0x57ae14]
mov byte [ebp + eax - 0x200], 0x81
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
mov eax, esi
mov bx, 0xffcf
call fcn.00403234
and eax, 0x7f
movzx eax, word [eax*2 + 0x57ae14]
push eax
push pe_nt_image_headers32
mov eax, esi
call fcn.004388f0
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, esi
mov bx, 0xffcf
call fcn.00403234
and eax, 0x7f
movzx eax, word [eax*2 + 0x57ae14]
push eax
push 0x101
mov eax, esi
call fcn.004388f0
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
mov dword [esi + 0x214], edi
jmp 0x469d0d
test edi, edi
jge 0x469ccc
xor edi, edi
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.00469614
mov eax, dword [ebp - 0x204]
call fcn.00403ec8
cmp edi, eax
jl 0x469d02
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.00469614
mov eax, dword [ebp - 0x204]
call fcn.00403ec8
mov edi, eax
mov ecx, edi
mov edx, edi
mov eax, esi
call fcn.00469b20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469d2d
lea eax, [ebp - 0x204]
call fcn.00403c4c
ret

Function at 0x47f4af
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x57bb76
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x47f507
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x57bb97
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x47f4fd
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x47f50b
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4953f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov ebx, dword [eax + 0x1ec]
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x495593
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x224]
mov eax, dword [ebx + 0x10]
call fcn.0041af44
cmp byte [ebp + 8], 0
je 0x495449
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x10]
call fcn.0041ae14
jmp 0x495457
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebx + 0x10]
call fcn.0041ae14
mov eax, dword [ebx + 0x10]
call fcn.0041af3c
dec eax
jle 0x49549d
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x10]
call fcn.0041ae0c
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov edi, dword [ebx + 0x10]
mov eax, edi
call fcn.0041af3c
push eax
push 0x12200
call sub.gdi32.dll_ExtCreatePen
mov edx, eax
mov eax, edi
call fcn.0041aed4
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax - 8]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x28]
call dword [ebx + 0x24]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + esi*4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
shr ecx, 1
add edx, ecx
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov bx, 0xffcf
call fcn.00403234
test al, al
je 0x4954e6
test esi, esi
jne 0x4954e6
inc dword [ebp - 0xc]
mov eax, esi
xor eax, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + eax*4]
mov dword [ebp - 0x14], edx
add eax, 2
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x18], eax
lea eax, [esi + 2]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
add eax, dword [edx]
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [esi + ebx]
mov edx, dword [ebp - 0xc]
mov dword [edi + eax*4], edx
mov eax, esi
xor eax, 1
mov edx, eax
add edx, ebx
mov ecx, dword [ebp - 0x14]
mov dword [edi + edx*4], ecx
add ebx, 2
lea edx, [esi + ebx]
mov ecx, dword [ebp - 0xc]
mov dword [edi + edx*4], ecx
add eax, ebx
mov edx, dword [ebp - 0x18]
mov dword [edi + eax*4], edx
add ebx, 2
inc dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + 0x28]
call dword [ecx + 0x24]
mov edx, dword [ebp - 4]
add eax, dword [edx]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jle 0x49551c
shr ebx, 2
push ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 0xc]
push eax
push edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1ec]
call fcn.0041ba68
push eax
call sub.gdi32.dll_PolyPolyline
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a7e80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a7f11
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp + 8]
call fcn.004a7aec
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040408c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4a7efb
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x57d864]
call fcn.00405f00
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4a79a4]
call fcn.0040c11c
call fcn.00403744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7f18
lea eax, [ebp - 0x10]
call fcn.00403c4c
ret

Function at 0x4a7f24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a7fbf
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040408c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4a7f99
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x57dc74]
call fcn.00405f00
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4a79a4]
call fcn.0040c11c
call fcn.00403744
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004a7b1c
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7fc6
lea eax, [ebp - 0x10]
call fcn.00403c4c
ret

Function at 0x4bebbc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
lea eax, [esp + 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push esp
push 0
push 0x4bec00
lea eax, [esp + 0x10c]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
mov eax, esp
call fcn.0040946c
add esp, 0x200

Function at 0x4c840c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esp, 0x1fffffa
cmp dword [ebp - 0x398], 0
je 0x4c8431
cmp dword [ebp - 0x398], 0
je 0x4c85fb
cmp dword [ebp + 0xc], 1
je 0x4c85fb
cmp dword [ebp + 0xc], 8
jne 0x4c85c3
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
invalid
Function at 0x561598
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5616b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x57d48c]
mov eax, dword [eax]
mov eax, dword [eax + 0x338]
call fcn.00432b10
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00408bb4
cmp dword [ebp - 8], 0
je 0x561608
lea edx, [ebp - 0xc]
mov eax, dword [0x57d48c]
mov eax, dword [eax]
mov eax, dword [eax + 0x334]
call fcn.00432b10
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x10]
call fcn.00408bb4
cmp dword [ebp - 0x10], 0
je 0x561608
mov eax, dword [0x57d47c]
cmp byte [eax], 6
je 0x561614
mov eax, 0x5616c4
call fcn.004567cc
jmp 0x56168a
mov eax, dword [0x57d914]
mov byte [eax], 1
mov eax, dword [0x57da4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
mov edx, dword [eax]
call dword [edx + 0xf4]
mov edx, eax
mov eax, dword [ebx + 0x2c8]
call fcn.0045cd54
xor edx, edx
mov eax, dword [ebx + 0x2c8]
call fcn.0045cd64
mov eax, dword [0x57d5a4]
cmp byte [eax], 0
jne 0x56166a
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x560d58
push 0
push 0
call sub.kernel32.dll_CreateThread
jmp 0x561682
push 0x20
mov ecx, 0x5616e4
mov edx, 0x5616f0
mov eax, dword [0x57d944]
mov eax, dword [eax]
call fcn.0044fcdc
mov eax, dword [0x57d968]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5616b7
lea eax, [ebp - 0x10]
call fcn.00403c4c
lea eax, [ebp - 0xc]
call fcn.00403c4c
lea eax, [ebp - 8]
call fcn.00403c4c
ret

Function at 0x562c00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040407c
mov eax, dword [ebp - 8]
call fcn.0040407c
mov eax, dword [ebp - 0xc]
call fcn.0040407c
xor eax, eax
push ebp
push 0x562ccf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x562ce8
call fcn.00403ed0
lea eax, [ebp - 8]
mov edx, 0x562ce8
call fcn.00403ed0
lea eax, [ebp - 0xc]
mov edx, 0x562ce8
call fcn.00403ed0
mov bl, 1
push 1
lea eax, [ebp - 0xc]
call fcn.00404098
push eax
lea eax, [ebp - 8]
call fcn.00404098
push eax
lea eax, [ebp - 4]
call fcn.00404098
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jae 0x562cb4
xor ebx, ebx
push 0
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x562cf4
call fcn.00403f14
mov eax, dword [ebp - 0x10]
mov cx, word [0x562d08]
mov dl, 1
call fcn.004566d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x562cd6
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403c70
ret
Function at 0x10002440
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x100fc474]
test al, 1
je 0x100024e4
test al, 2
je 0x1000255b
mov ecx, 0x100fb0ec
call fcn.10007000
movd xmm0, eax
movq xmm1, qword [0x1000a050]
por xmm0, xmm1
subsd xmm0, xmm1
movapd xmmword [esp + 0x10], xmm0
mov ecx, 0x100fb0ec
call fcn.10007000
movd xmm0, eax
movq xmm1, qword [0x1000a050]
por xmm0, xmm1
subsd xmm0, xmm1
mulsd xmm0, qword [0x1000a058]
addsd xmm0, qword [esp + 0x10]
mulsd xmm0, qword [0x1000a060]
movsd xmm1, qword [0x100fc480]
movsd xmm2, qword [0x100fc478]
subsd xmm1, xmm2
mulsd xmm1, xmm0
addsd xmm1, xmm2
addsd xmm1, xmm1
movsd qword [esp + 8], xmm1
fld qword [esp + 8]
mov esp, ebp
pop ebp
ret
or eax, 1
mov dword [0x100fc474], eax
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [0x100fc470], 0xffffffff
mov dword [0x100fb0f0], eax
mov ecx, 0xfffffd92
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 0x26f
mov dword [ecx*4 + 0x100fbaac], eax
test ecx, ecx
je 0x10002544
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 0x270
mov dword [ecx*4 + 0x100fbab0], eax
add ecx, 2
jmp 0x10002505
mov dword [0x100fb0ec], 0x270
mov eax, dword [0x100fc474]
test al, 2
jne 0x1000245e
or eax, 2
mov dword [0x100fc474], eax
mov dword [0x100fc47c], 0xc0bc2000
mov dword [0x100fc478], 0
mov dword [0x100fc484], 0x40bc2000
mov dword [0x100fc480], 0
jmp 0x1000245e

Function at 0x10002590
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
cmp dword [0x100f95a0], 1
jne 0x100025ac
call fcn.10002440
jmp 0x1000263f
mov eax, dword [0x100fd810]
test al, 1
je 0x10002643
test al, 2
je 0x100026ba
mov ecx, 0x100fc488
call fcn.10007000
movd xmm0, eax
movq xmm1, qword [0x1000a050]
por xmm0, xmm1
subsd xmm0, xmm1
movapd xmmword [esp + 0x10], xmm0
mov ecx, 0x100fc488
call fcn.10007000
movd xmm0, eax
movq xmm1, qword [0x1000a050]
por xmm0, xmm1
subsd xmm0, xmm1
mulsd xmm0, qword [0x1000a058]
addsd xmm0, qword [esp + 0x10]
mulsd xmm0, qword [0x1000a060]
movsd xmm1, qword [0x100fd820]
movsd xmm2, qword [0x100fd818]
subsd xmm1, xmm2
mulsd xmm1, xmm0
addsd xmm1, xmm2
movsd qword [esp + 8], xmm1
fld qword [esp + 8]
mov esp, ebp
pop ebp
ret
or eax, 1
mov dword [0x100fd810], eax
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [0x100fd80c], 0xffffffff
mov dword [0x100fc48c], eax
mov ecx, 0xfffffd92
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 0x26f
mov dword [ecx*4 + 0x100fce48], eax
test ecx, ecx
je 0x100026a3
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 0x270
mov dword [ecx*4 + 0x100fce4c], eax
add ecx, 2
jmp 0x10002664
mov dword [0x100fc488], 0x270
mov eax, dword [0x100fd810]
test al, 2
jne 0x100025c1
movsd xmm0, qword [ebp + 0x10]
movsd xmm1, qword [ebp + 8]
or eax, 2
mov dword [0x100fd810], eax
movsd qword [0x100fd818], xmm1
movsd qword [0x100fd820], xmm0
jmp 0x100025c1
Function at 0x100026f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x100febb0]
test al, 1
je 0x10002794
test al, 2
je 0x1000280b
mov ecx, 0x100fd828
call fcn.10007000
movd xmm0, eax
movq xmm1, qword [0x1000a050]
por xmm0, xmm1
subsd xmm0, xmm1
movapd xmmword [esp + 0x10], xmm0
mov ecx, 0x100fd828
call fcn.10007000
movd xmm0, eax
movq xmm1, qword [0x1000a050]
por xmm0, xmm1
subsd xmm0, xmm1
mulsd xmm0, qword [0x1000a058]
addsd xmm0, qword [esp + 0x10]
mulsd xmm0, qword [0x1000a060]
movsd xmm1, qword [0x100febc0]
movsd xmm2, qword [0x100febb8]
subsd xmm1, xmm2
mulsd xmm1, xmm0
addsd xmm1, xmm2
addsd xmm1, xmm1
movsd qword [esp + 8], xmm1
fld qword [esp + 8]
mov esp, ebp
pop ebp
ret
or eax, 1
mov dword [0x100febb0], eax
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [0x100febac], 0xffffffff
mov dword [0x100fd82c], eax
mov ecx, 0xfffffd92
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 0x26f
mov dword [ecx*4 + 0x100fe1e8], eax
test ecx, ecx
je 0x100027f4
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 0x270
mov dword [ecx*4 + 0x100fe1ec], eax
add ecx, 2
jmp 0x100027b5
mov dword [0x100fd828], 0x270
mov eax, dword [0x100febb0]
test al, 2
jne 0x1000270e
or eax, 2
mov dword [0x100febb0], eax
mov dword [0x100febbc], 0xc0240000
mov dword [0x100febb8], 0
mov dword [0x100febc4], 0x40360000
mov dword [0x100febc0], 0
jmp 0x1000270e

Function at 0x10002840
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
cmp dword [0x100f95a4], 1
jne 0x1000285c
call fcn.100026f0
jmp 0x100028ef
mov eax, dword [0x100fff50]
test al, 1
je 0x100028f3
test al, 2
je 0x1000296a
mov ecx, 0x100febc8
call fcn.10007000
movd xmm0, eax
movq xmm1, qword [0x1000a050]
por xmm0, xmm1
subsd xmm0, xmm1
movapd xmmword [esp + 0x10], xmm0
mov ecx, 0x100febc8
call fcn.10007000
movd xmm0, eax
movq xmm1, qword [0x1000a050]
por xmm0, xmm1
subsd xmm0, xmm1
mulsd xmm0, qword [0x1000a058]
addsd xmm0, qword [esp + 0x10]
mulsd xmm0, qword [0x1000a060]
movsd xmm1, qword [0x100fff60]
movsd xmm2, qword [0x100fff58]
subsd xmm1, xmm2
mulsd xmm1, xmm0
addsd xmm1, xmm2
movsd qword [esp + 8], xmm1
fld qword [esp + 8]
mov esp, ebp
pop ebp
ret
or eax, 1
mov dword [0x100fff50], eax
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [0x100fff4c], 0xffffffff
mov dword [0x100febcc], eax
mov ecx, 0xfffffd92
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 0x26f
mov dword [ecx*4 + 0x100ff588], eax
test ecx, ecx
je 0x10002953
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 0x270
mov dword [ecx*4 + 0x100ff58c], eax
add ecx, 2
jmp 0x10002914
mov dword [0x100febc8], 0x270
mov eax, dword [0x100fff50]
test al, 2
jne 0x10002871
movsd xmm0, qword [ebp + 0x10]
movsd xmm1, qword [ebp + 8]
or eax, 2
mov dword [0x100fff50], eax
movsd qword [0x100fff58], xmm1
movsd qword [0x100fff60], xmm0
jmp 0x10002871
Function at 0x4116e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4116ef
pop dword [ebp - 0x4c]
mov eax, 0x4116ef
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3e1ee
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xed798864
add ecx, 0x1286c0db
mov esi, eax
mov edx, 0x74046c3f
add edx, 0x8c3ee7c1
add edx, dword [ebp - 0x4c]
mov ebx, 0x9d47fa9
sub ebx, 0x6f3e2f70
mov edi, dword [edx]
add dword [ebp - 0x38], 0xf1e07b72
xor edi, ebx
mov dword [esi], edi
xor dword [ebp - 0x30], eax
add esi, 0x8f0357a3
add esi, 0x70fca861
add edx, 0x1ecb921
sub edx, 0x1ecb91d
loop 0x411744
add eax, 0xff42e392
add eax, 0xbe343d
mov ebx, eax
add eax, 0x91652a83
add eax, 0x6e9ad582
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x41c587
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x41c5ae
xor eax, eax
jmp 0x41c5c9
test byte [ebp - 4], 0x10
je 0x41c5c2
mov eax, 1
jmp 0x41c5c4
xor eax, eax
jmp 0x41c5c9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43b170
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov eax, 0
jne 0x43b18a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43b19d
push eax
call fcn.00441be0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x43b360
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4506b8], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x43b37e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4506b4], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x4506b0], bl
jne 0x43b3d8
cmp dword [0x1dd1c68], 0
je 0x43b3c6
mov edi, dword [0x1dd1c64]
sub edi, 4
cmp edi, dword [0x1dd1c68]
jb 0x43b3c6
mov eax, dword [edi]
test eax, eax
je 0x43b3bb
call eax
sub edi, 4
cmp edi, dword [0x1dd1c68]
jae 0x43b3b3
push 0x449030
push 0x449028
call fcn.0043b410
add esp, 8
push 0x449038
push 0x449034
call fcn.0043b410
add esp, 8
test ebx, ebx
jne 0x43b3ff
mov dword [0x4506b8], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret

Function at 0x43b800
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, 0
jne 0x43b81c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43b82f
push eax
call fcn.00441be0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x43bb40
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x43bb5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43bb72
push eax
call fcn.00441be0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret