joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4682e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x1bd418c]
xor edx, edx
cmp eax, edx
jne 0x468306
xor eax, eax
mov byte [eax + 0x1bd408c], al
inc eax
cmp eax, 0x100
jl 0x4682ee
mov dword [0x1bd418c], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x1bd408c
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x468397
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x46836a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x468338
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4683a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4683f3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4683da
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46ed70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49bfde
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0046f690
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x1b916c4
call fcn.0048d8e2
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x46ee03
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048d8e2
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x46edfc
push 0
mov ecx, eax
call fcn.00465f10
mov dword [esi + 0xc], eax
jmp 0x46ee05
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x46ee05
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x10037837
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.100378b6
jae 0x10037843
xor ecx, ecx
call fcn.100378b6
jae 0x1003786d
xor eax, eax
call fcn.100378b6
jae 0x1003787e
mov al, 0x10
call fcn.100378b6
adc al, al
jae 0x1003785f
jne 0x100378ab
stosb byte es:[edi], al
jmp 0x10037844
call fcn.100378c2
dec ecx
loop 0x1003788a
mov eax, ebp
call fcn.100378c0
jmp 0x100378ac
lodsb al, byte [esi]
shr eax, 1
je 0x100378d2
adc ecx, 2
mov ebp, eax
jmp 0x100378ac
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.100378c0
cmp eax, 0x7d00
jae 0x100378aa
cmp eax, 0x500
jae 0x100378ab
cmp eax, 0x7f
ja 0x100378ac
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10037844
pop ebp
ret 8
Function at 0x410728
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x410750
add dword [ebp - 4], 2
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x410767
inc dword [ebp - 4]
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x41077f
add dword [ebp - 4], 8
mov ax, word [ebp - 4]
jmp 0x410788
pop edi
pop esi
pop ebx
leave
ret

Function at 0x419c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x419c9f
pop dword [ebp - 0x48]
mov eax, 0x419c9f
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x5110b
push 0
mov eax, 0xcb0af768
add eax, 0x353b7070
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x55a9
mov esi, eax
mov edi, 0x48e000
add edi, dword [ebp - 0x48]
mov ebx, 0x8b41172f
sub ebx, 0x6d68947
xor dword [ebp - 0x38], 0xbdda690b
mov edx, dword [edi]
sub dword [ebp - 0x24], 0x131bce4a
add edx, ebx
sub dword [ebp - 0x10], 0x9fa18c54
mov dword [esi], edx
mov dword [ebp - 0x10], 0xc5c6af06
add esi, 0x35f32f37
sub esi, 0x35f32f33
add edi, 4
loop 0x419ced
add eax, 0x61221856
sub eax, 0x6120cedf
xor ebx, ebx
add ebx, eax
add eax, 0xad7502dc
add eax, 0x528afd29
mov ecx, 0xdab7457f
sub ecx, 0xda77457f
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x50eaf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x563c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x56d356
call fcn.00462d38
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
jmp 0x50eb55
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x14]
cmp dword [ebp - 0x48], eax
jae 0x50ebfa
mov esi, esp
push 0x1c
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp esi, esp
call fcn.00462414
test eax, eax
je 0x50eb90
cmp dword [ebp - 0x2c], 0x1000
jne 0x50eb90
cmp dword [ebp - 0x28], 1
jne 0x50eb92
jmp 0x50eb4c
mov esi, esp
lea eax, [ebp - 0x18]
push eax
push 0x40
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.00462414
test eax, eax
je 0x50ebf5
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00461f37
add esp, 0x10
mov dword [ebp - 0xc], eax
mov esi, esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.00462414
cmp dword [ebp - 0xc], 0
je 0x50ebf5
jmp 0x50ebfa
jmp 0x50eb4c
mov eax, dword [ebp - 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x50ec2c]
call fcn.00462077
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461c03
add esp, 0x10c
cmp ebp, esp
call fcn.00462414
mov esp, ebp
pop ebp
ret
Function at 0x51dc80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.0051de90
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x51dd4d
mov edx, dword [ebp - 4]
cmp edx, dword [0x563d00]
jb 0x51dcca
mov eax, dword [ebp - 4]
cmp eax, dword [0x563d04]
ja 0x51dcca
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x51dc9a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.00461c30
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x51dcf0
jmp 0x51dd4d
cmp dword [ebp - 0x14], 0x10000
jne 0x51dd33
cmp dword [ebp - 0x18], 0x10000
jb 0x51dd33
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x51dd26
mov eax, dword [ebp - 8]
jmp 0x51dd4f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x51dd48
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.0051de90
add esp, 4
mov dword [ebp - 4], eax
jmp 0x51dc9a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x51dd90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.0051dec0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x51de55
mov edx, dword [ebp - 4]
cmp edx, dword [0x563d00]
jb 0x51ddd5
mov eax, dword [ebp - 4]
cmp eax, dword [0x563d04]
ja 0x51ddd5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x51dda5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.00461c30
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x51ddfb
jmp 0x51de55
cmp dword [ebp - 0x14], 0x10000
jne 0x51de3e
cmp dword [ebp - 0x18], 0x10000
jb 0x51de3e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x51de31
mov eax, dword [ebp - 8]
jmp 0x51de57
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x51de50
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.0051dec0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x51dda5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x51df00
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004620ef
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x56a548], 0
jne 0x51df3d
cmp dword [0x56a544], 0
je 0x51df3d
mov eax, dword [0x56a544]
mov dword [0x56a548], eax
cmp dword [0x56a548], 0
je 0x51dfba
mov ecx, dword [0x56a548]
cmp dword [ecx + 8], 0
je 0x51dfba
mov edx, dword [0x56a548]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x51dfba
mov ecx, dword [0x56a548]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x51dfba
mov eax, dword [0x56a548]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x51df89
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x51df90
xor eax, eax
jmp 0x51e0d9
mov ecx, dword [0x56a548]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.00461c30
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x51e0d9
mov edx, dword [0x56a544]
mov dword [0x56a548], edx
jmp 0x51dfd6
mov eax, dword [0x56a548]
mov ecx, dword [eax + 4]
mov dword [0x56a548], ecx
cmp dword [0x56a548], 0
je 0x51e016
cmp dword [0x56a548], 0
je 0x51e014
mov edx, dword [0x56a548]
cmp dword [edx + 8], 0
je 0x51e014
mov eax, dword [0x56a548]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x51e014
mov edx, dword [0x56a548]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x51e014
jmp 0x51df6e
jmp 0x51dfc8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0051e160
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x51e0d7
mov eax, dword [ebp - 0x18]
mov dword [0x56a548], eax
mov ecx, dword [0x56a548]
mov dword [ecx], 0x52727464
mov edx, dword [0x56a548]
mov dword [edx + 8], 0
mov eax, dword [0x56a548]
mov ecx, dword [0x56a544]
mov dword [eax + 4], ecx
mov edx, dword [0x56a548]
mov dword [0x56a544], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x56a548]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x51e0a7
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x51e0c7
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x51e09e
mov eax, dword [0x56a548]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x51df6e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5217c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x56a5a0], 0
je 0x5217d6
xor eax, eax
jmp 0x5219f2
cmp dword [0x56a59c], 0
je 0x5217e9
mov eax, dword [0x56a59c]
jmp 0x5219f2
push 0x24
push 0
push 0x56a570
call fcn.00461c30
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x56a570], eax
push 0
push 0
push 0x56005c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x56a574], eax
cmp dword [0x56a574], 0
jne 0x52188e
mov dword [0x56a5a0], 1
cmp dword [0x56a574], 0
je 0x521841
mov eax, dword [0x56a574]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x56a578], 0
mov dword [0x56a57c], 0
mov dword [0x56a580], 0
mov dword [0x56a584], 0
mov dword [0x56a588], 0
mov dword [0x56a58c], 0
mov dword [0x56a590], 0
xor eax, eax
jmp 0x5219f2
push str.ImagehlpApiVersionEx
mov ecx, dword [0x56a574]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56a578], eax
push str.SymInitialize
mov edx, dword [0x56a574]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56a57c], eax
push str.SymSetOptions
mov eax, dword [0x56a574]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56a580], eax
push str.SymGetOptions
mov ecx, dword [0x56a574]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56a584], eax
push str.SymLoadModule64
mov edx, dword [0x56a574]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56a588], eax
push str.SymGetModuleInfo64
mov eax, dword [0x56a574]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56a58c], eax
push str.SymFromName
mov ecx, dword [0x56a574]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56a590], eax
push 8
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.00461c30
add esp, 0xc
mov eax, 0xc
mov word [ebp - 0xc], ax
cmp dword [0x56a578], 0
je 0x521973
cmp dword [0x56a57c], 0
je 0x521973
cmp dword [0x56a588], 0
je 0x521973
cmp dword [0x56a58c], 0
je 0x521973
cmp dword [0x56a590], 0
jne 0x521978
jmp 0x521822
lea ecx, [ebp - 0xc]
push ecx
call dword [0x56a578]
movzx edx, word [ebp - 0xc]
cmp edx, 0xc
jge 0x521990
jmp 0x521822
push 0
push 0
mov eax, dword [0x56a570]
push eax
call dword [0x56a57c]
test eax, eax
jne 0x5219a9
jmp 0x521822
cmp dword [0x56a584], 0
je 0x5219e3
cmp dword [0x56a580], 0
je 0x5219e3
call dword [0x56a584]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xfffffff8
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, 0x2704
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
call dword [0x56a580]
mov dword [0x56a59c], 0x56a570
mov eax, dword [0x56a59c]
mov esp, ebp
pop ebp
ret
Function at 0x40f2c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov dword [0x5f0470], eax
xor eax, eax
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5f046c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5f0470], edx
cmp eax, 0x26f
jl 0x40f2d0
mov dword [0x578fe0], 0x270
mov esp, ebp
pop ebp
ret

Function at 0x40f310
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0xffffffff
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5f0474]
mov ebx, dword [eax*4 + 0x5f0470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5f0aa4]
mov dword [eax*4 + 0x5f0470], edx
cmp eax, 0xe2
jl 0x40f320
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5f0474]
mov ebx, dword [eax*4 + 0x5f0470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5f00e4]
mov dword [eax*4 + 0x5f0470], edx
cmp eax, 0x26e
jl 0x40f370
mov edx, dword [0x5f0470]
mov ecx, dword [0x5f0e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x5f0aa0]
mov dword [0x5f0e2c], eax
mov dword [0x578fe0], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f400
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [0x578fe0]
add dword [0x578fe0], 1
mov eax, dword [0x5ef020]
cmp eax, dword [0x578730]
jne 0x40f426
cmp ebx, 0x271
jb 0x40f448
mov eax, dword [0x5ef020]
call fcn.0040f2c0
not dword [0x5ef020]
mov eax, dword [0x5ef020]
mov dword [0x578730], eax
mov ebx, 0x270
lea esi, [esi]
cmp ebx, 0x270
jne 0x40f464
call fcn.0040f310
xor ebx, ebx
mov dword [0x578fe0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x5f0470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411090
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ax, word [0x578480]
cmp ax, 0xcb
je 0x41119c
cmp ax, 0xcc
je 0x41119c
mov edx, dword [0x5f1070]
test edx, edx
je 0x4110c5
mov eax, dword [0x5f0f20]
call edx
mov ebx, eax
jmp 0x4110ca
mov ebx, 0x5f0f24
cmp word [0x5f0f10], 0
jle 0x4110f0
mov eax, 0x5f0ef0
call fcn.00411360
mov eax, ebx
call fcn.00410c10
mov eax, ebx
call fcn.00410c90
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x411112
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x41110d
mov edx, edi
mov eax, ebx
call fcn.00410060
jmp 0x411110
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x4110f8
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5f0f10], 0
jle 0x41119c
mov edx, 0x5f0e30
mov eax, ebx
call fcn.004101b0
mov edi, eax
test edi, edi
je 0x41116c
mov eax, dword [0x5f0ec4]
mov dword [edi + 0xc], eax
cmp dword [0x5f0ec4], 0
je 0x411160
mov eax, dword [0x5f0ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5f0ec4], eax
nop
sub word [0x5f0f10], 1
cmp word [0x5f0f10], 0
sete bl
mov eax, 0x5f0ef0
call fcn.00411380
test bl, bl
je 0x41119c
mov eax, 0x5f0ef0
call fcn.00411350
lea esi, [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4134a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00413480
push ebp
push 0x414900
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x4135ca
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b760
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x41352f
mov edx, 0x5f02f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x413581
call sub.kernel32.dll_GetLastError
call fcn.00404210
lea eax, [ebp - 0x10]
call fcn.0040a320
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a7b0
mov edx, dword [ebp - 0x14]
mov ecx, 0x595364
lea eax, [ebp - 0x10]
call fcn.0040a650
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040b040
jmp 0x413618
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x41359a
cmp eax, ecx
je 0x4135a4
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040b760
cmp byte [0x578700], 0
jne 0x413618
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bca0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b0d0
lea esi, [esi]
jmp 0x413618
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b760
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x4135ee
mov eax, 0x5f02f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x578700], 0
jne 0x413618
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bca0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b0d0
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00413480
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413a50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5f0260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413c30
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5f0260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00403790
call sub.kernel32.dll_GetCommandLineA
mov dword [0x578500], eax
mov ebx, eax
jmp 0x413bf3
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x413ad8
cmp byte [ebx], 0
je 0x413bfc
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x413b53
mov al, byte [ebx]
cmp al, 1
jb 0x413b48
sub al, 0x20
jbe 0x413b18
sub al, 2
je 0x413b2c
jmp 0x413b48
mov al, byte [ebp - 0x114]
test al, al
je 0x413b58
add dword [ebp - 0x110], 1
jmp 0x413b50
cmp byte [ebx + 1], 0x22
je 0x413b43
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413b50
add ebx, 1
jmp 0x413b50
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413b08
test dword [ebp - 0x10c], 0xffffffff
je 0x413bec
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413c30
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5f0260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413be3
mov al, byte [ebx]
cmp al, 1
jb 0x413bd8
sub al, 0x20
jbe 0x413ba8
sub al, 2
je 0x413bbc
jmp 0x413bd8
mov al, byte [ebp - 0x114]
test al, al
je 0x413be8
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413be0
cmp byte [ebx + 1], 0x22
je 0x413bd3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413be0
add ebx, 1
jmp 0x413be0
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413b98
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x413adb
mov ebx, dword [ebp - 0x10c]
mov dword [0x5f0250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5f0260
call fcn.00410ec0
mov eax, dword [0x5f0260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret