joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cee0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x790018
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor ebp, ebp
mov dword [esp + 0x30], ebp
mov edi, dword [esi + 0x10]
mov ebx, dword [esi + 0xc]
mov ecx, edi
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 8
jae 0x40cf68
cmp ebx, edi
jbe 0x40cf38
call fcn.006441b7
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push edi
push eax
lea eax, [esp + 0x40]
push eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, 8
sub edx, ecx
push edx
push esi
call fcn.0040f010
jmp 0x40cfae
jbe 0x40cfae
cmp ebx, edi
jbe 0x40cf73
call fcn.006441b7
mov ebx, dword [esi + 0xc]
mov ebp, dword [esi]
cmp ebx, dword [esi + 0x10]
jbe 0x40cf82
call fcn.006441b7
mov eax, dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
lea ebx, [esp + 0x20]
lea eax, [esp + 0x18]
call fcn.0040f400
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push edi
push ebp
push ecx
push edx
lea eax, [esp + 0x28]
push eax
call fcn.0040ef60
xor ebp, ebp
mov eax, dword [esp + 0x44]
cmp eax, ebp
je 0x40cfbf
push eax
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x38]
push ecx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebp
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x18

Function at 0x410080
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x787a48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, edx
xor ebx, ebx
push 0xffffffffffffffff
push ebx
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], ax
call fcn.00401880
mov eax, esi
mov dword [esp + 0x34], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4100d6
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [esp + 0x18]
call fcn.004106e0
push 0xffffffffffffffff
push ebx
xor edx, edx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push eax
mov ecx, edi
mov word [edi + 4], dx
call fcn.00401880
cmp dword [esp + 0x28], 8
jb 0x41011f
mov eax, dword [esp + 0x14]
push eax
call fcn.006441c7
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x4121b0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x78d744
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], eax
mov word [esi + 4], cx
mov dword [esp + 0x14], eax
mov ecx, 0xf
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov byte [esi + 0x20], al
mov dword [esi + 0x50], ecx
mov dword [esi + 0x4c], eax
mov byte [esi + 0x3c], al
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x68], eax
mov byte [esi + 0x58], al
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 3
call fcn.00401ff0
lea ecx, [esi + 0x88]
mov byte [esp + 0x14], 4
call fcn.00401ff0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x420be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x78d610
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x6c]
mov eax, dword [esp + 0x70]
xor ebx, ebx
mov dword [esp + 0x18], eax
cmp dword [ebp + 0x14], ebx
je 0x420d76
xor esi, esi
jmp 0x420c32
xor ebx, ebx
mov edi, dword [esp + 0x7c]
cmp edi, 0xffffffff
je 0x420c68
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea edx, [edx + ecx + 1]
cmp edx, edi
jne 0x420c68
mov byte [esp + 0x16], 1
or edi, 0xffffffff
jmp 0x420c8c
movzx eax, word [esp + 0x74]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x16], bl
push ecx
mov ebx, 1
mov eax, esi
mov edx, ebp
call fcn.004023a0
mov edi, eax
xor ebx, ebx
cmp edi, 0xffffffff
sete al
mov byte [esp + 0x17], al
cmp al, bl
je 0x420c9d
mov edi, dword [ebp + 0x14]
cmp byte [esp + 0x78], bl
je 0x420cd5
cmp esi, edi
jae 0x420cd5
cmp esi, dword [ebp + 0x14]
jbe 0x420cb1
call fcn.006441b7
cmp dword [ebp + 0x18], 8
jb 0x420cbc
mov eax, dword [ebp + 4]
jmp 0x420cbf
lea eax, [ebp + 4]
movzx edx, word [eax + esi*2]
push edx
call fcn.0064528b
add esp, 4
test eax, eax
je 0x420cd5
inc esi
cmp esi, edi
jb 0x420ca7
xor eax, eax
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], ax
mov ecx, edi
sub ecx, esi
mov edx, esi
push ebp
lea esi, [esp + 0x24]
mov dword [esp + 0x68], ebx
call fcn.004014a0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x70], 1
call fcn.00401880
mov byte [esp + 0x64], bl
cmp dword [esp + 0x38], 8
jb 0x420d26
mov ecx, dword [esp + 0x24]
push ecx
call fcn.006441c7
add esp, 4
mov ebx, dword [esp + 0x18]
lea edx, [esp + 0x3c]
push edx
call fcn.00404ea0
cmp byte [esp + 0x17], 0
jne 0x420d62
cmp byte [esp + 0x16], 0
jne 0x420d62
cmp dword [esp + 0x54], 8
lea esi, [edi + 1]
jb 0x420c30
mov eax, dword [esp + 0x40]
push eax
call fcn.006441c7
add esp, 4
jmp 0x420c30
cmp dword [esp + 0x54], 8
jb 0x420d76
mov ecx, dword [esp + 0x40]
push ecx
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00643db8
add esp, 0x54
ret

Function at 0x4215e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78a3a3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], eax
mov byte [esi + 4], al
mov dword [esp + 0x14], eax
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], eax
mov word [esi + 0x20], ax
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 1
call fcn.00401ff0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x42d2b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78fd18
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, edx
mov dword [esp + 0x38], 0
mov edi, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov ecx, edi
sub ecx, ebp
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jbe 0x42d336
cmp ebp, edi
jbe 0x42d30b
call fcn.006441b7
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push edi
push eax
lea eax, [esp + 0x48]
push eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
push ebx
push esi
call fcn.0042e810
jmp 0x42d385
jae 0x42d385
cmp ebp, edi
jbe 0x42d341
call fcn.006441b7
mov ebp, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x20], edx
cmp ebp, dword [esi + 0x10]
jbe 0x42d354
call fcn.006441b7
mov eax, dword [esi]
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], eax
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], ebp
call fcn.0042ed80
mov edx, dword [esp + 0x20]
mov ecx, dword [eax + 4]
push edi
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x30]
push eax
mov ebx, esi
call fcn.0042e780
lea esi, [esp + 0x58]
call fcn.0059c860
mov eax, dword [esp + 0x4c]
xor esi, esi
cmp eax, esi
je 0x42d3a1
push eax
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x40]
push ecx
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x60
Function at 0x430680
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x78a248
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x24]
xor ebx, ebx
lea eax, [esi + 0x30]
push eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00428920
lea ecx, [esi + 0x48]
call fcn.00434800
lea ecx, [esi + 0x58]
call fcn.00434800
mov dword [esp + 0x1c], ebx
lea ecx, [esi + 0x90]
mov dword [esi], vtable.Sexy::Graphics.0
push ecx
mov dword [esi + 0x7c], ebx
call fcn.00434290
mov al, 1
mov byte [esp + 0x1c], al
fldz
fst dword [esi + 8]
mov dword [esi + 0x68], ebx
fst dword [esi + 0xc]
mov dword [esi + 4], edi
fld1
mov dword [esi + 0x6c], ebx
fst dword [esi + 0x10]
mov byte [esi + 0x70], bl
fstp dword [esi + 0x14]
mov byte [esi + 0x71], bl
mov byte [esi + 0x72], al
mov byte [esi + 0x73], bl
fst dword [esi + 0x18]
fstp dword [esi + 0x1c]
cmp edi, ebx
jne 0x430726
mov dword [esi + 4], 0x88ba00
mov ecx, dword [esi + 4]
mov eax, ecx
xor edx, edx
xor edi, edi
call fcn.0045a0e0
mov ebp, eax
mov eax, ecx
call fcn.0045a0f0
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], ebp
push ebx
mov dword [esi + 0x2c], eax
call fcn.00430500
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x431ba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
cmp byte [esp + 0x20], 0
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, eax
mov esi, ecx
jne 0x431bc5
push ebx
push ebp
call fcn.00431d10
pop edi
pop esi
pop ebp
add esp, 0x18
ret 8
fld dword [esi + 8]
call fcn.0076f850
fld dword [esi + 0xc]
add eax, dword [edi]
mov dword [esp + 0x10], eax
call fcn.0076f850
add eax, dword [edi + 4]
mov ecx, dword [edi + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x18], eax
mov eax, esi
mov dword [esp + 0x1c], ecx
call fcn.00430940
mov edx, dword [esi + 0x40]
sub edx, dword [esi + 0x3c]
lea eax, [esi + 0x30]
sar edx, 4
test edx, edx
jbe 0x431c19
cmp byte [esi + 0x70], 0
je 0x431c12
lea eax, [esi + 0x48]
jmp 0x431c27
call fcn.005baf50
jmp 0x431c27
cmp byte [esi + 0x70], 0
lea eax, [esi + 0x58]
jne 0x431c27
mov eax, 0x88ba50
movzx edi, byte [esi + 0x71]
mov ecx, dword [esi + 0x78]
mov edx, dword [ecx]
mov edx, dword [edx + 0x4c]
push 1
push edi
mov edi, dword [esi + 0x6c]
push edi
push eax
add esi, 0x20
push esi
push ebx
lea eax, [esp + 0x28]
push eax
push ebp
call edx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 8

Function at 0x431c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, eax
fld dword [esi + 8]
call fcn.0076f850
fld dword [esi + 0xc]
add eax, dword [esp + 0x30]
mov dword [esp + 0x18], eax
call fcn.0076f850
add eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
mov edx, dword [edi + 0x2c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x30]
xor ebx, ebx
mov dword [esp + 0x14], eax
mov eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.00430940
mov ecx, dword [esi + 0x40]
sub ecx, dword [esi + 0x3c]
lea eax, [esi + 0x30]
sar ecx, 4
test ecx, ecx
jbe 0x431cd7
cmp byte [esi + 0x70], bl
je 0x431cd0
lea eax, [esi + 0x48]
jmp 0x431ce4
call fcn.005baf50
jmp 0x431ce4
lea eax, [esi + 0x58]
cmp byte [esi + 0x70], bl
jne 0x431ce4
mov eax, 0x88ba50
mov ecx, dword [esi + 0x78]
mov edx, dword [ecx]
mov edx, dword [edx + 0x4c]
push ebx
movzx ebx, byte [esi + 0x71]
push ebx
mov ebx, dword [esi + 0x6c]
push ebx
push eax
add esi, 0x20
push esi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
push edi
call edx
pop esi
pop ebx
add esp, 0x24
ret 0x10
Function at 0x431d10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
mov esi, ecx
fld dword [esi + 8]
push edi
mov edi, eax
call fcn.0076f850
fld dword [esi + 0xc]
add eax, dword [edi]
mov dword [esp + 0x20], eax
call fcn.0076f850
fld1
add eax, dword [edi + 4]
fcom dword [esi + 0x10]
mov ecx, dword [edi + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x28], eax
fnstsw ax
mov dword [esp + 0x2c], ecx
test ah, 0x44
jp 0x431d67
fcomp dword [esi + 0x14]
fnstsw ax
test ah, 0x44
jnp 0x431e37
jmp 0x431d69
fstp st(0)
fild dword [esp + 0x2c]
sub esp, 8
fmul dword [esi + 0x14]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp qword [esp]
call fcn.00645c10
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 0x24]
fild dword [esp + 0x30]
fmul dword [esi + 0x10]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp qword [esp]
call fcn.00645c10
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 0x20]
fild dword [esp + 0x28]
fsub dword [esi + 0x18]
fmul dword [esi + 0x10]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp qword [esp]
call fcn.0076fcb0
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fadd dword [esi + 0x18]
call fcn.0076f850
fild dword [esp + 0x2c]
mov edi, eax
fsub dword [esi + 0x1c]
fmul dword [esi + 0x14]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp qword [esp]
call fcn.0076fcb0
fstp dword [esp + 0x1c]
add esp, 8
fld dword [esp + 0x14]
fadd dword [esi + 0x1c]
call fcn.0076f850
fld dword [esp + 0x18]
mov ebx, eax
call fcn.0076f850
fld dword [esp + 0x1c]
mov dword [esp + 0x38], eax
call fcn.0076f850
mov edx, dword [esp + 0x38]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
mov eax, esi
call fcn.00430940
mov ecx, dword [esi + 0x40]
sub ecx, dword [esi + 0x3c]
lea eax, [esi + 0x30]
sar ecx, 4
test ecx, ecx
jbe 0x431e60
cmp byte [esi + 0x70], 0
je 0x431e59
lea eax, [esi + 0x48]
jmp 0x431e6e
call fcn.005baf50
jmp 0x431e6e
cmp byte [esi + 0x70], 0
lea eax, [esi + 0x58]
jne 0x431e6e
mov eax, 0x88ba50
movzx edi, byte [esi + 0x71]
mov ecx, dword [esi + 0x78]
mov edx, dword [ecx]
mov edx, dword [edx + 0x4c]
push 0
push edi
mov edi, dword [esi + 0x6c]
push edi
push eax
mov eax, dword [ebp + 0xc]
add esi, 0x20
push esi
push eax
lea eax, [esp + 0x38]
push eax
mov eax, dword [ebp + 8]
push eax
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x432280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push edi
mov eax, esi
call fcn.00430940
mov ecx, dword [esi + 0x40]
sub ecx, dword [esi + 0x3c]
lea eax, [esi + 0x30]
sar ecx, 4
test ecx, ecx
jbe 0x4322ab
cmp byte [esi + 0x70], 0
je 0x4322a4
lea eax, [esi + 0x48]
jmp 0x4322b9
call fcn.005baf50
jmp 0x4322b9
cmp byte [esi + 0x70], 0
lea eax, [esi + 0x58]
jne 0x4322b9
mov eax, 0x88ba50
movzx edi, byte [esi + 0x73]
fld dword [esi + 0xc]
fadd dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
mov ecx, dword [esi + 0x78]
mov edx, dword [ecx]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
push edi
mov edi, dword [esi + 0x6c]
mov edx, dword [edx + 0x40]
push edi
push eax
lea eax, [esi + 0x20]
push eax
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
sub esp, 8
fstp dword [esp + 4]
fld dword [esi + 8]
fadd dword [esp + 0x38]
fstp dword [esp + 0x34]
fld dword [esp + 0x34]
fstp dword [esp]
push eax
call edx
pop edi
pop ecx
ret 0x14
Function at 0x4349e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7871d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.00448d70
lea eax, [esi + 0x18]
push eax
mov dword [esp + 0x18], 0
call fcn.00448d70
mov byte [esi + 0x30], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x436a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7871d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
mov ecx, edi
call fcn.00436ac0
lea eax, [esi + 0x18]
lea ecx, [edi + 0x18]
push eax
mov dword [esp + 0x18], 0
call fcn.00436bb0
mov cl, byte [edi + 0x30]
mov byte [esi + 0x30], cl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x437c00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov edx, 0x88bad8
jmp fcn.005813d0

Function at 0x437c30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x88bad8
jmp fcn.00581380

Function at 0x437cf0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x9c], eax
cmp byte [0x87dfbd], 0
push esi
je 0x437d79
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call fcn.0064edd0
mov esi, dword [sym.imp.kernel32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x9c
call esi
test eax, eax
jne 0x437d66
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x94
call esi
test eax, eax
jne 0x437d66
xor al, al
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.00643db8
add esp, 0xa0
ret
cmp dword [esp + 8], 6
mov byte [0x87dfbd], 0
setae byte [0x8c0b3b]
mov ecx, dword [esp + 0xa0]
mov al, byte [0x8c0b3b]
pop esi
xor ecx, esp
call fcn.00643db8
add esp, 0xa0
ret

Function at 0x437da0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x9c], eax
cmp byte [0x87dfbe], 0
push esi
je 0x437e46
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call fcn.0064edd0
mov esi, dword [sym.imp.kernel32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x9c
call esi
test eax, eax
jne 0x437e1a
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x94
call esi
test eax, eax
jne 0x437e1a
xor al, al
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.00643db8
add esp, 0xa0
ret
mov eax, dword [esp + 8]
mov byte [0x87dfbe], 0
mov ecx, 1
cmp eax, 6
ja 0x437e40
jne 0x437e37
cmp dword [esp + 0xc], ecx
jae 0x437e40
mov byte [0x8c0b3c], 0
jmp 0x437e46
mov byte [0x8c0b3c], cl
mov ecx, dword [esp + 0xa0]
mov al, byte [0x8c0b3c]
pop esi
xor ecx, esp
call fcn.00643db8
add esp, 0xa0
ret
Function at 0x439ab0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x20
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x24]
lea eax, [esp]
push eax
lea edx, [esp + 0x2c]
call fcn.00439760
mov eax, dword [esp + 8]
add esp, 4
cmp dword [esp + 0x18], 0x10
jae 0x439ae1
lea eax, [esp + 4]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp dword [esp + 0x18], 0x10
jb 0x439afc
mov ecx, dword [esp + 4]
push ecx
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00643db8
add esp, 0x20
ret

Function at 0x439b10
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x24
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x34]
call fcn.00439920
mov eax, dword [esp + 0x10]
add esp, 4
cmp dword [esp + 0x20], 8
jae 0x439b43
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [esp + 0x20], 8
jb 0x439b5e
mov ecx, dword [esp + 0xc]
push ecx
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x24]
pop ebx
xor ecx, esp
call fcn.00643db8
add esp, 0x24
ret
Function at 0x4403d0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x789f1b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x20], ecx
mov esi, dword [ebp + 8]
fldz
mov ebx, dword [ebp + 0xc]
fstp dword [esi + 0xc]
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 8], eax
mov dword [esi + 0x68], ebx
mov dword [esi + 0x18], 0xffffffff
mov byte [esi + 0x14], 1
mov edi, dword [esi + 0x60]
add esi, 0x50
cmp dword [esi + 0xc], edi
jbe 0x440431
call fcn.006441b7
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ecx
cmp ecx, dword [esi + 0x10]
jbe 0x44044c
call fcn.006441b7
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov eax, dword [esi]
push edi
push edx
push ecx
push eax
lea edi, [esp + 0x34]
call fcn.0044a9c0
mov eax, dword [ebx + 0x54]
sub eax, dword [ebx + 0x50]
sar eax, 3
push eax
push esi
call fcn.00448e60
mov ecx, dword [ebx + 0x54]
sub ecx, dword [ebx + 0x50]
xor edi, edi
mov dword [esp + 0x18], edi
test ecx, 0xfffffff8
jle 0x440583
mov dword [esp + 0x1c], edi
jmp 0x440494
mov edi, dword [esp + 0x18]
mov edx, dword [ebx + 0x54]
sub edx, dword [ebx + 0x50]
sar edx, 3
cmp edi, edx
jb 0x4404a6
call fcn.006441b7
mov eax, dword [ebx + 0x50]
lea ecx, [eax + edi*8]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x4404d2
call fcn.006441b7
mov edi, dword [esi + 0xc]
add edi, dword [esp + 0x1c]
mov ecx, dword [0x88ba50]
mov dword [edi + 0x64], ecx
mov edx, dword [0x88ba54]
mov dword [edi + 0x68], edx
mov eax, dword [0x88ba58]
mov dword [edi + 0x6c], eax
mov ecx, dword [0x88ba5c]
mov eax, dword [esp + 0x14]
mov dword [edi + 0x70], ecx
mov edx, dword [eax]
mov dword [edi], edx
mov byte [edi + 0x3c], 0
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
test eax, eax
je 0x440564
push 0x84
call fcn.006442a0
add esp, 4
mov dword [esp + 0x14], eax
xor ecx, ecx
mov dword [esp + 0x38], ecx
cmp eax, ecx
je 0x44053a
push eax
call fcn.0043efd0
mov dword [esp + 0x14], eax
jmp 0x440540
mov dword [esp + 0x14], ecx
mov eax, ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x38], 0xffffffff
mov edx, dword [esp + 0x24]
push edx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x24]
push eax
call fcn.004403d0
mov eax, dword [esp + 0x14]
mov dword [edi + 4], eax
mov ecx, dword [ebx + 0x54]
sub ecx, dword [ebx + 0x50]
mov eax, dword [esp + 0x18]
add dword [esp + 0x1c], 0x78
inc eax
sar ecx, 3
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x440490
mov edx, dword [ebp + 8]
mov esi, dword [esp + 0x20]
cmp edx, dword [esi + 0x1cc]
jne 0x440597
call fcn.00442710
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8