joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a9b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push eax
xor eax, eax
nop
nop
xor eax, eax
nop
nop
je 0x1000a9c7
sub dword [edx], ebp
sub ebx, dword [eax - 0x39]
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000aa05
jmp 0x1000aa34
mov dword [ebp - 0xc], 4
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push str.Start
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b150
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001179c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x100123b8
mov dword [ebp - 4], 0
push eax
xor eax, eax
xor eax, eax
je 0x1000b18f
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
dec ebp
in al, dx
pop eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10004c70
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0xc], 0
je 0x1000b1b9
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x14]
add edx, 0x124
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10004c70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10003810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000b458
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
cld
pop eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
push edx
push 0
push 0x100027e0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b510
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000b52a
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
clc
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000b54e
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0x1b62
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010340
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1001035a
sub dword [edx], ebp
sub ebx, dword [eax - 0x39]
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x7fff00
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
ja 0x10010445
push 0
lea ecx, [ebp - 8]
push ecx
push 1
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100103aa
cmp dword [ebp - 8], 0
jne 0x100103b1
xor eax, eax
jmp 0x10010448
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov al, byte [ebp - 0x14]
mov byte [edx], al
movsx ecx, byte [ebp - 0x14]
cmp ecx, 0x3e
jne 0x10010437
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 5
jb 0x10010435
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax - 1]
cmp ecx, 0x3e
jne 0x10010435
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx - 2]
cmp eax, 0x52
jne 0x10010435
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 3]
cmp edx, 0x49
jne 0x10010435
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax - 4]
cmp ecx, 0x44
jne 0x10010435
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx - 5]
cmp eax, 0x3c
jne 0x10010435
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp ecx, 0x50
jge 0x10010435
jmp 0x1001037b
jmp 0x10010445
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x1001037b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10010f20
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
nop
je 0x10010f3a
nop
nop
nop
sub dword [edx], ebp
sub ebx, dword [eax - 0x7d]
jge 0x10010f4a
pop eax
cmp dword [ebp + 0xc], 1
jne 0x10010f75
add dword [ebp + 0x34], esi
mov eax, dword [ebp + 8]
mov dword [0x10014864], eax
mov word [ebp - 0x190], 0
mov ecx, 0x63
xor eax, eax
lea edi, [ebp - 0x18e]
mov dword [ebp - 0x190], 0x63b90000
add byte [eax], al
add byte [ebx], dh
ror byte [ebp - 0x18d43], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x190]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x46f66e1f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x420c4139
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x427ca2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid

Function at 0x427ede
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
cld
invalid
jmp dword [edi]
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00426fcf
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00426f84
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00426fbf
or eax, 0x682cd45c
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.00426fbf
retf

Function at 0x428cd8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
invalid
test dword [edi - 8], ebx
invalid
invalid
Function at 0x402b4e
Capabilities:
Check for time delay via queryperformancecounter
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 8], eax
push 0x40bac0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
and dword [ebp - 0x14], 0
jmp 0x402ba7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, 0x28
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
jge 0x402d34
mov eax, dword [0x405014]
imul eax, dword [0x405018]
mov ecx, dword [0x405018]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x405014], eax
mov eax, dword [0x405014]
sub eax, 4
mov dword [0x405018], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x402cc4
mov eax, dword [0x405018]
add eax, 7
mov dword [0x405014], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0
jle 0x402cbf
mov eax, dword [0x405014]
imul eax, dword [0x405018]
mov ecx, dword [0x405018]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x405014], eax
mov eax, dword [0x405018]
add eax, 7
mov dword [0x405014], eax
push 4
push 0x1000
push dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
mov eax, dword [0x405014]
imul eax, dword [0x405018]
mov ecx, dword [0x405018]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x405014], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov eax, dword [0x405014]
imul eax, eax, 0x63
mov dword [0x405014], eax
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call fcn.004019cb
add esp, 0xc
jmp 0x402b97
push 0x40bac0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 4
push 0x1000
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
push 0x40bac0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0xc]
call fcn.0040198d
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov eax, dword [0x405018]
xor edx, edx
push 0xc
pop ecx
div ecx
mov dword [0x405018], eax
jmp 0x402b97
mov eax, dword [0x405018]
shl eax, 3
mov dword [0x405018], eax
leave
ret
Function at 0x40388f
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4038b8
cmp al, 0x22
je 0x4038b0
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4038a4
cmp byte [esi], 0x22
jne 0x4038c2
inc esi
jmp 0x4038c2
cmp al, 0x20
jle 0x4038c2
inc esi
cmp byte [esi], 0x20
jg 0x4038bc
mov al, byte [esi]
test al, al
je 0x4038cc
cmp al, 0x20
jle 0x4038b5
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040393a
push 0x405004
push section..data
call fcn.00403920
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x4038fc
movzx eax, word [ebp - 0x14]
jmp 0x4038ff
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00403952
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x405280
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
push 0x6c078965
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00405240
mov eax, dword [ebp - 4]
add esp, 4
cmp ebp, esp
call fcn.00408f20
mov esp, ebp
pop ebp
ret 4

Function at 0x4052c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
push 0x6c078965
push 0xffffffffffffffff
push 0x1571
mov ecx, dword [ebp - 4]
call fcn.00405240
mov eax, dword [ebp - 4]
add esp, 4
cmp ebp, esp
call fcn.00408f20
mov esp, ebp
pop ebp
ret

Function at 0x405ca0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0x270
jne 0x405cd3
mov ecx, dword [ebp - 4]
call fcn.00406e20
jmp 0x405ce6
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4e0
jb 0x405ce6
mov ecx, dword [ebp - 4]
call fcn.00406c80
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
shr ecx, 0xb
mov edx, dword [ebp - 4]
and ecx, dword [edx + 0x1384]
xor ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
shr edx, 0x12
xor edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add esp, 0xc
cmp ebp, esp
call fcn.00408f20
mov esp, ebp
pop ebp
ret

Function at 0x405fb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jne 0x405fc3
xor eax, eax
jmp 0x406013
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x405fdb
xor eax, eax
jmp 0x406013
mov dword [ebp - 0xc], 0x400
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x400
jle 0x405ff8
xor eax, eax
jmp 0x406013
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0x4550
je 0x406010
xor eax, eax
jmp 0x406013
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x4060b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov esi, esp
push 0xa
movzx eax, word [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp esi, esp
call fcn.00408f20
mov dword [ebp - 8], eax
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.00408f20
mov dword [ebp - 0xc], eax
mov esi, esp
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp esi, esp
call fcn.00408f20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00408690
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.004072c0
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.00408f20
mov esp, ebp
pop ebp
ret
Function at 0x406c80
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x26f
mov dword [ebp - 0xc], 0xe3
mov dword [ebp - 0x10], 0
jmp 0x406ca9
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xe3
jae 0x406d15
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 1
je 0x406ced
mov dword [ebp - 0x28], 0x9908b0df
jmp 0x406cf4
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x14]
shr eax, 1
xor eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + ecx*4 + 4], eax
jmp 0x406ca0
mov dword [ebp - 0x18], 0xe3
jmp 0x406d27
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x26f
jae 0x406d93
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x406d6b
mov dword [ebp - 0x2c], 0x9908b0df
jmp 0x406d72
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x1c]
shr eax, 1
xor eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + ecx*4 + 4], eax
jmp 0x406d1e
mov dword [ebp - 0x20], 0x26f
mov eax, 4
imul ecx, eax, 0x4df
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx + 4]
and eax, 0x80000000
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx + 4]
and edx, 0x7fffffff
or eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
and eax, 1
je 0x406ddc
mov dword [ebp - 0x30], 0x9908b0df
jmp 0x406de3
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x24]
shr ecx, 1
xor ecx, dword [ebp - 0x30]
mov edx, 4
imul eax, edx, 0x18c
mov edx, dword [ebp - 4]
xor ecx, dword [edx + eax + 4]
mov eax, 4
imul edx, eax, 0x26f
mov eax, dword [ebp - 4]
mov dword [eax + edx + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov esp, ebp
pop ebp
ret
Function at 0x406e20
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x270
jmp 0x406e3b
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x4e0
jae 0x406ea7
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x406e7f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x406e86
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [edx + ecx*4 + 4], eax
jmp 0x406e32
mov esp, ebp
pop ebp
ret
Function at 0x409eba
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409ef9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409ef9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409ef9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409ef9
cmp dword [ecx + 0x74], 0xe
jbe 0x409ef9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40aa50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x40aa77
mov ecx, 5
int 0x29
push 2
call fcn.00409f5e
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x40ab82
test esi, esi
jne 0x40ab82
push 2
call fcn.00409f5e
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00408f43
mov esp, ebp
pop ebp
ret

Function at 0x40c730
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.0040c760
mov esi, dword [ebp + 8]
test al, al
je 0x40c74e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.0040c770
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]