joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd2bdc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x108
push eax
mov dword [ebp - 0x24], esp
sub esp, 0xc
mov dword [ebp - 0x10], esp
sub esp, 0x200
mov ebx, esp
sub esp, 0x2c
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x34], esp
push eax
mov edi, esp
mov eax, dword [0xd63480]
mov dword [ebp - 0x114], 0x28e85688
mov dword [ebp - 0x110], 0x2c922aa3
mov dword [ebp - 0x10c], 0x20932e91
mov dword [ebp - 0x108], 0x24dc2280
mov dword [ebp - 0x104], 0x38d926d0
mov dword [ebp - 0x100], 0x3cdb3ac9
mov dword [ebp - 0xfc], 0x30e83ec5
mov dword [ebp - 0xf8], 0x348d3288
mov dword [ebp - 0xf4], 0x8883691
mov dword [ebp - 0xf0], 0xcb80abe
mov dword [ebp - 0xec], 0xd10eed
mov dword [ebp - 0xe8], 0x4e302d5
mov dword [ebp - 0xe4], 0x18f706f4
mov dword [ebp - 0xe0], 0x1ceb1ae7
mov dword [ebp - 0xdc], 0x10ff1ed6
mov dword [ebp - 0xd8], 0x14aa12c6
mov dword [ebp - 0xd4], 0xe8e116ab
mov dword [ebp - 0xd0], 0xec20ea1d
mov dword [ebp - 0xcc], 0xe067ee0d
mov dword [ebp - 0xc8], 0xe417e217
mov dword [ebp - 0xc4], 0xf807e61c
mov dword [ebp - 0xc0], 0xfc4bfa38
mov dword [ebp - 0xbc], 0xf043fe4d
mov dword [ebp - 0xb8], 0xf424f254
mov dword [ebp - 0xb4], 0xc855f650
mov dword [ebp - 0xb0], 0xcc72ca12
mov dword [ebp - 0xac], 0xc030ce79
mov dword [ebp - 0xa8], 0xc430c234
mov dword [ebp - 0xa4], 0xd839c632
mov dword [ebp - 0xa0], 0xdc2dda2a
mov dword [ebp - 0x9c], 0xd027de3d
mov dword [ebp - 0x98], 0xd40bd20a
mov dword [ebp - 0x94], 0xa80ad601
mov dword [ebp - 0x90], 0xac57aa75
mov dword [ebp - 0x8c], 0xa013ae4d
mov dword [ebp - 0x88], 0xa418a218
mov dword [ebp - 0x84], 0xb847a600
mov dword [ebp - 0x80], 0xbc1eba7e
mov dword [ebp - 0x7c], 0xb004be1e
mov dword [ebp - 0x78], 0xb44ab20e
mov dword [ebp - 0x74], 0x8874b655
mov dword [ebp - 0x70], 0x8c398a31
mov dword [ebp - 0x6c], 0x80328e32
mov dword [ebp - 0x68], 0x847c8224
mov dword [ebp - 0x64], 0x98768674
mov dword [ebp - 0x60], 0x9c659a50
mov dword [ebp - 0x5c], 0x90619e6d
mov dword [ebp - 0x58], 0x946d9261
mov dword [ebp - 0x54], 0x68779665
mov dword [ebp - 0x50], 0x6cca6aba
mov dword [ebp - 0x4c], 0x60ce6ecb
mov dword [ebp - 0x48], 0x64da62d3
mov dword [ebp - 0x44], 0x7892669a
mov dword [ebp - 0x40], 0x7c8c7a8a
mov dword [ebp - 0x3c], 0x708c7e83
mov dword [ebp - 0x38], 0x74737287
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xbd
xor dl, byte [ebp + ecx - 0x114]
add dl, 0x18
mov byte [ebp + ecx - 0x114], dl
inc ecx
cmp ecx, 0xe0
jne 0xd2bff0
lea ecx, [ebp - 0x114]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0xd5dc68]
mov ecx, 0x5a65caf3
xor ecx, dword [0xd5dc70]
add eax, ecx
inc eax
jmp eax
Function at 0xd41320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x88
push eax
sub esp, 0x14
mov esi, esp
sub esp, 0x14
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x56], 0x1fdf1df9
mov dword [ebp - 0x52], 0xe352e150
mov dword [ebp - 0x4e], 0xe747e520
mov dword [ebp - 0x4a], 0xeb4be95c
mov dword [ebp - 0x46], 0xef32ed09
mov dword [ebp - 0x42], 0xf35af124
mov dword [ebp - 0x3e], 0xf758f541
mov dword [ebp - 0x3a], 0xfb5ff95c
mov dword [ebp - 0x36], 0xff5cfd4e
mov dword [ebp - 0x32], 0xc370c169
mov dword [ebp - 0x2e], 0xc71ac560
mov dword [ebp - 0x2a], 0xcb78c918
mov dword [ebp - 0x26], 0xcf68cd63
mov dword [ebp - 0x22], 0xd37ed179
mov dword [ebp - 0x1e], 0xd765d571
lea eax, [ebp - 0x1a]
mov word [ebp - 0x1a], 0xd9d8
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0xfc
xor dl, byte [ebp + ecx - 0x56]
add dl, 0x20
mov byte [ebp + ecx - 0x56], dl
inc ecx
cmp ecx, 0x3e
jne 0xd413b0
lea ebx, [ebp - 0x94]
lea edx, [ebp - 0x56]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x58]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [ebp - 0x18]
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [fcn.00d647d4]
xor ecx, ecx
cmp eax, 0xc0000023
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0xd5f460]
Function at 0x99677c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9967a3
call fcn.00938d18
mov dword [eax], esi
call fcn.00938d05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093995a
mov eax, esi
jmp 0x9967f8
test dword [ebp + 0xc], 0xfffffff9
jne 0x996789
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9967d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00938d2b
pop ecx
call fcn.00938d05
mov eax, dword [eax]
jmp 0x9967f8
test al, 0x10
jne 0x9967f6
test al, 1
je 0x9967f6
test byte [ebp + 0xc], 2
je 0x9967f6
call fcn.00938d18
mov dword [eax], 5
call fcn.00938d05
mov dword [eax], 0xd
jmp 0x9967c7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x10002bf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
mov edi, ebp
xor ecx, ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10075067
call fcn.100153c0
nop
call fcn.10014120
nop
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10015390
push eax
call fcn.100145f0
nop
push 0x10003160
push 0x100730ec
call fcn.10013bb0
nop
call fcn.10014180
test eax, eax
je 0x10002c6f
mov esi, esp
push 0x30
push 0x1005a454
push str.Error_in_Attack_Connect
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.10015390
nop
push 0
call fcn.1001ce90
nop
jmp 0x10002cde
call fcn.10014120
nop
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10015390
push eax
call fcn.100145f0
nop
push 0x10003030
push 0x100730f0
call fcn.10013bb0
nop
call fcn.10014180
nop
call fcn.10014120
nop
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10015390
push eax
call fcn.100145f0
nop
push 0x10003250
push 0x100730e0
call fcn.10013bb0
nop
call fcn.10014180
test eax, eax
je 0x10002cde
push 0
call fcn.1001ce90
nop
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.10015390
mov esp, ebp
pop ebp
ret
Function at 0x10004530
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
push ebx
push esi
push edi
lea edi, [ebp - 0x38]
mov ecx, 0xe
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100720c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10075164
call fcn.100153c0
nop
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10004710
add esp, 8
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
add ecx, 5
push ecx
call fcn.10015460
add esp, 4
mov dword [ebp - 0xf4], eax
mov edx, dword [ebp - 0xf4]
mov dword [ebp - 0x28], edx
mov esi, esp
lea eax, [ebp - 0x1c]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
add edx, 5
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015390
nop
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.100178a0
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x28]
mov byte [edx + ecx], 0xe9
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x28]
add eax, dword [edx + 4]
push eax
call fcn.100046c0
add esp, 8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + edx + 1], eax
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x10], 0xe9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100046c0
add esp, 8
mov edx, 1
shl edx, 0
mov dword [ebp + edx - 0x10], eax
push 5
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100178a0
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
push edx
mov ecx, ebp
push eax
lea edx, [0x10004684]
call fcn.10015330
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10015400
add esp, 0xf8
cmp ebp, esp
call fcn.10015390
mov esp, ebp
pop ebp
ret
Function at 0x10004710
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10075164
call fcn.100153c0
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015390
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x10072008
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015390
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x10072010
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015390
nop
push 5
mov eax, 1
imul ecx, eax, 0
add ecx, 0x10072008
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10018780
add esp, 0xc
test eax, eax
jne 0x100047b4
mov eax, 0xb
jmp 0x100047df
push 5
mov eax, 1
imul ecx, eax, 0
add ecx, 0x10072010
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10018780
add esp, 0xc
test eax, eax
jne 0x100047dc
mov eax, 5
jmp 0x100047df
mov eax, dword [ebp + 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x10004804]
call fcn.10015330
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10015390
mov esp, ebp
pop ebp
ret

Function at 0x10006f30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10075179
call fcn.100153c0
nop
push 0x6c078965
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.10006ec0
nop
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10015390
mov esp, ebp
pop ebp
ret 4
Function at 0x100091b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10075179
call fcn.100153c0
nop
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x100091f1
mov ecx, dword [ebp - 8]
call fcn.1000bbe0
nop
jmp 0x10009205
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4e0
jb 0x10009205
mov ecx, dword [ebp - 8]
call fcn.1000b9f0
nop
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
shr eax, 0xb
mov ecx, dword [ebp - 8]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x12
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.10015390
mov esp, ebp
pop ebp
ret

Function at 0x10009e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x1007517a
call fcn.100153c0
nop
mov dword [ebp - 8], 0
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015390
nop
mov esi, esp
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.10015390
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.10015390
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015390
nop
push edx
mov ecx, ebp
push eax
lea edx, [0x10009ec0]
call fcn.10015330
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10015390
mov esp, ebp
pop ebp
ret
Function at 0x1000b9f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x70]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10075179
call fcn.100153c0
nop
mov dword [ebp - 0x14], 0x26f
mov dword [ebp - 0x20], 0xe3
mov dword [ebp - 0x2c], 0
jmp 0x1000ba3b
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xe3
jae 0x1000bab0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 + 0x9c8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
and eax, 1
je 0x1000ba82
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000ba8c
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x38]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 + 0xff8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000ba32
mov dword [ebp - 0x44], 0xe3
jmp 0x1000bac2
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x26f
jae 0x1000bb37
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 + 0x9c8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
and eax, 1
je 0x1000bb09
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000bb13
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x50]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 - 0x388]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000bab9
mov dword [ebp - 0x5c], 0x26f
mov eax, 4
imul ecx, eax, 0x4df
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 4]
and eax, 0x80000000
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx + 4]
and edx, 0x7fffffff
or eax, edx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
and eax, 1
je 0x1000bb83
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000bb8d
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x68]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, 4
imul eax, edx, 0x18c
mov edx, dword [ebp - 8]
xor ecx, dword [edx + eax + 4]
mov eax, 4
imul edx, eax, 0x26f
mov eax, dword [ebp - 8]
mov dword [eax + edx + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0
pop edi
pop esi
pop ebx
add esp, 0x130
cmp ebp, esp
call fcn.10015390
mov esp, ebp
pop ebp
ret
Function at 0x1000bbe0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x28]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10075179
call fcn.100153c0
nop
mov dword [ebp - 0x14], 0x270
jmp 0x1000bc1d
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4e0
jae 0x1000bc92
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 - 0x9bc]
and edx, 0x80000000
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 - 0x9b8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
and eax, 1
je 0x1000bc64
mov dword [ebp - 0xe8], 0x9908b0df
jmp 0x1000bc6e
mov dword [ebp - 0xe8], 0
mov ecx, dword [ebp - 0x20]
shr ecx, 1
xor ecx, dword [ebp - 0xe8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 - 0x388]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000bc14
pop edi
pop esi
pop ebx
add esp, 0xe8
cmp ebp, esp
call fcn.10015390
mov esp, ebp
pop ebp
ret
Function at 0x100106d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x58]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x1007516e
call fcn.100153c0
nop
cmp dword [ebp + 0x10], 0
jg 0x10010712
jl 0x10010709
cmp dword [ebp + 0xc], 0
ja 0x10010712
xor eax, eax
xor edx, edx
jmp 0x1001084b
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10010734
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call fcn.100108b0
jmp 0x1001084b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
call fcn.1000ab80
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jbe 0x100107a4
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.100020f0
add esp, 8
mov edx, dword [eax]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
call fcn.1000e2a0
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10003fb0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x3c]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
call fcn.1000dd00
nop
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x1001083c
mov ecx, dword [ebp - 8]
call fcn.1000bcb0
nop
mov dword [ebp - 0x48], 0xfff
cmp dword [ebp - 0x14], 0xfff
jbe 0x10010815
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
push 0xfff
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.10022a50
add esp, 0x10
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x54]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x54], 0xfff
je 0x10010813
xor eax, eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
sbb edx, eax
mov eax, ecx
jmp 0x1001084b
jmp 0x100107c1
cmp dword [ebp - 0x14], 0
jbe 0x1001083c
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.10022a50
add esp, 0x10
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x14], ecx
xor eax, eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
sbb edx, eax
mov eax, ecx
push edx
mov ecx, ebp
push eax
lea edx, [0x10010874]
call fcn.10015330
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x118
cmp ebp, esp
call fcn.10015390
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10012a60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10012c10
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10012b2d
mov edx, dword [ebp - 4]
cmp edx, dword [0x10072084]
jb 0x10012aaa
mov eax, dword [ebp - 4]
cmp eax, dword [0x10072088]
ja 0x10012aaa
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10012a7a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10019140
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10012ad0
jmp 0x10012b2d
cmp dword [ebp - 0x14], 0x10000
jne 0x10012b13
cmp dword [ebp - 0x18], 0x10000
jb 0x10012b13
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10012b06
mov eax, dword [ebp - 8]
jmp 0x10012b2f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10012b28
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10012c10
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10012a7a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10012b40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10012c40
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10012c05
mov edx, dword [ebp - 4]
cmp edx, dword [0x10072084]
jb 0x10012b85
mov eax, dword [ebp - 4]
cmp eax, dword [0x10072088]
ja 0x10012b85
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10012b55
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10019140
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10012bab
jmp 0x10012c05
cmp dword [ebp - 0x14], 0x10000
jne 0x10012bee
cmp dword [ebp - 0x18], 0x10000
jb 0x10012bee
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10012be1
mov eax, dword [ebp - 8]
jmp 0x10012c07
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10012c00
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10012c40
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10012b55
xor eax, eax
mov esp, ebp
pop ebp
ret