joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a83b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x4a83ce
mov ecx, dword [ebp - 8]
call fcn.004aa010
jmp 0x4a83e1
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x4a83e1
mov ecx, dword [ebp - 8]
call fcn.004a9e90
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
shr eax, 0xb
mov ecx, dword [ebp - 8]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
shl edx, 7
and edx, 0x9d2c5680
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0x12
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4a8640
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [eax + 0xc]
jle 0x4a8664
push str.The_read_count_cannot_be_greater_than_the_buffer_size.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4a86fb
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x14], 0
jle 0x4a86fb
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
sub edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x14]
jge 0x4a8696
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
jmp 0x4a869c
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
add eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x10]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp edx, dword [eax + 4]
jne 0x4a86d5
mov dword [ebp - 0x18], 0
jmp 0x4a86de
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x14]
sub ecx, dword [ebp - 0xc]
mov dword [ebp + 0x14], ecx
jmp 0x4a8670
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a8780
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x88], 0
jne 0x4a87a5
push str._circularBuffer___null
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4a88ac
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
call fcn.004a9880
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x79]
test edx, edx
jne 0x4a8837
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0xc]
cmp eax, dword [edx + 0x6c]
jg 0x4a87ea
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
jmp 0x4a88ac
mov edx, dword [ebp - 4]
mov byte [edx + 0x79], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x6c]
push ecx
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x88]
call fcn.004a8e10
mov dword [ebp - 8], eax
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
push 1
mov edx, dword [ebp - 0x14]
push edx
call fcn.004add68
add esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x88]
call fcn.004a99f0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x1c]
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
call fcn.004a9990
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push 1
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004add68
add esp, 8
mov dword [ebp - 0x10], 0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a8a80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
jne 0x4a8aac
push str._encCircularBuffer___null
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4a8c26
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x84]
call fcn.004a9880
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x78]
test edx, edx
jne 0x4a8b68
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x6c]
push ecx
call fcn.004ae031
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x6c]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x6c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004ab300
add esp, 8
push 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x6c]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 0x20], edx
push 1
mov eax, dword [ebp - 0x20]
push eax
call fcn.004add68
add esp, 8
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x6c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x78], 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x84]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x84]
call fcn.004a8e10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004ae031
add esp, 4
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
push 1
mov edx, dword [ebp - 0x28]
push edx
call fcn.004add68
add esp, 8
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
push 1
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004add68
add esp, 8
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a8cc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], 0
jge 0x4a8ce2
push str.Negative_offset_specified._Offsets_must_be_positive.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
jmp 0x4a8dfc
cmp dword [ebp + 0x10], 0
jge 0x4a8cfb
push str.Negative_count_specified._Count_must_be_positive.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
jmp 0x4a8dfc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0xc]
jle 0x4a8d19
push str.Ringbuffer_contents_insufficient_for_take_read_operation.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
jmp 0x4a8dfc
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 0x10]
cmp dword [ebp + 0x10], edx
jge 0x4a8d37
push str.Destination_array_too_small_for_requested_output.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
jmp 0x4a8dfc
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x10], 0
jle 0x4a8df9
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 4]
sub eax, dword [edx + 8]
cmp eax, dword [ebp + 0x10]
jge 0x4a8d70
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 4]
sub eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
jmp 0x4a8d76
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
add edx, dword [eax + 8]
push edx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx + 4]
jne 0x4a8db5
mov dword [ebp - 0x18], 0
jmp 0x4a8dc1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
add eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], ecx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp - 8]
mov dword [ebp + 0x10], edx
jmp 0x4a8d44
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a8e10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 8], 0
jg 0x4a8e2e
push str.should_greater_than_0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x4a8e6a
mov eax, dword [ebp + 8]
push eax
call fcn.004ae031
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.004a8cc0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x4a9550
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x34
call fcn.00438d10
push 0x4af4b8
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x34
call fcn.0043d860
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x34
call fcn.0043e4f0
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 4]
add ecx, 0x34
call fcn.0043d860
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00435b30
add esp, 0x14
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
mov edx, dword [ebp - 4]
add edx, 0x34
push edx
call fcn.00436730
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x4a95e3
xor al, al
jmp 0x4a9632
mov edx, dword [ebp - 8]
add edx, 0x18
push edx
mov ecx, dword [ebp - 4]
add ecx, 0x4c
call fcn.00438ca0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x64], edx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x64], 0
jne 0x4a9619
push str.method_not_found
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
jmp 0x4a9632
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ecx + 0x68], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ecx + 0x6c], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x4a9820
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x10
call fcn.004ae031
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
push 0x10
push 0
mov ecx, dword [ebp - 4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00420fd0
add esp, 0xc
test eax, eax
je 0x4a9870
push str.mbedtls:_MD5_failure
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x4a9873
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4a9880
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x10], 0
jg 0x4a98a2
push str.Count_must_be_positive.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
jmp 0x4a9981
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
cmp ecx, dword [edx + 4]
jle 0x4a98c6
push str.The_buffer_does_not_have_sufficient_capacity_to_put_new_items.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
jmp 0x4a9981
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jle 0x4a997e
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + 4]
sub ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 0xc]
jge 0x4a98fe
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + 4]
sub ecx, dword [eax + 0x10]
mov dword [ebp - 0x14], ecx
jmp 0x4a9904
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
add ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp ecx, dword [edx + 4]
jne 0x4a9943
mov dword [ebp - 0x18], 0
jmp 0x4a994f
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
add edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
jmp 0x4a98d2
mov eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4a9990
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jge 0x4a99aa
push str.Negative_count_specified._Count_must_be_positive.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4a99e5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jle 0x4a99c0
push str.Ringbuffer_contents_insufficient_for_operation.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cdq
idiv dword [ecx + 4]
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
sub edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a9e90
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x4a9eab
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe3
jge 0x4a9f17
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x4a9eef
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x4a9ef6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x4a9ea2
jmp 0x4a9f22
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x26f
jge 0x4a9f8e
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 1
je 0x4a9f66
mov dword [ebp - 0x18], 0x9908b0df
jmp 0x4a9f6d
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
shr eax, 1
xor eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x4a9f19
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ecx + 4]
and ecx, 0x7fffffff
or edx, ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x4a9fcc
mov dword [ebp - 0x20], 0x9908b0df
jmp 0x4a9fd3
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
shr eax, 1
xor eax, dword [ebp - 0x20]
mov ecx, 4
imul edx, ecx, 0x18c
mov ecx, dword [ebp - 8]
xor eax, dword [ecx + edx + 4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 4], eax
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
Function at 0x4aa010
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x4aa02b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jge 0x4aa097
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x4aa06f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x4aa076
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x4aa022
mov esp, ebp
pop ebp
ret

Function at 0x4aa120
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xb4]
test ecx, ecx
je 0x4aa144
push str._disposed__true
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4aa197
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4aa160
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x8c]
mov dword [ebp - 8], edx
jmp 0x4aa16c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x90]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004aa450
add esp, 0x14
test eax, eax
je 0x4aa197
push str.aes_CryptoErrorException
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4ab440
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4e5258]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServices_s
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.004ac190
add esp, 0x10
lea edx, [ebp - 0x110]
push edx
push 3
push 0
lea eax, [ebp - 0x108]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x4ab4a3
xor al, al
jmp 0x4ab537
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x4ab4e3
mov dword [ebp - 0x118], 4
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x11c]
push ecx
push 0
push 0x4c5ac4
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10c], eax
jmp 0x4ab505
push 4
mov eax, dword [ebp + 0x10]
push eax
push 4
push 0
push 0x4c5ac8
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10c], 0
jne 0x4ab527
mov dword [ebp - 0x114], 1
jmp 0x4ab531
mov dword [ebp - 0x114], 0
mov al, byte [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004adff8
mov esp, ebp
pop ebp
ret
Function at 0x4ab550
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
push eax
push 3
push 0
push str.SYSTEMCurrentControlSetControlGroupOrderList
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4ab57e
xor al, al
jmp 0x4ab6ba
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x4ab63d
mov edx, dword [ebp + 0x10]
push edx
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4c5afc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4ab5bf
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4ab6ba
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
add ecx, 4
push ecx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x4ab5ee
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4ab6ba
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0x4c5b04
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4ab63b
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.004af4ac
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
xor al, al
jmp 0x4ab6ba
jmp 0x4ab697
mov edx, dword [ebp + 0x10]
cmp dword [edx], 4
jbe 0x4ab655
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
shr ecx, 2
sub ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x4ab65c
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov edx, dword [ebp - 0x18]
mov dword [ecx + eax], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
push 3
push 0
push str.PNP_TDI
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x4ab6b0
mov dword [ebp - 0x10], 1
jmp 0x4ab6b7
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret