joyce8/EMBER2024-capa huggingface dataset:
Function at 0xdab310
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.00db7145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0xdab3ab
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0xdab38d
lea eax, [esp + 0x18]
push eax
jmp 0xdab392
push 0xdd0720
call fcn.00db6fd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0xdab360
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0xdaaf40
push 4
push ecx
push eax
call fcn.00db743f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0xdacf20
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ecx
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 4], ebp
je 0xdacfd7
mov eax, dword [esp + 0xc]
push esi
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0xdacfcf
push ebx
push edi
push 0xdd0770
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0xdacfae
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0xdd0770
push esi
call ebx
test eax, eax
je 0xdacfae
mov ebp, 3
cmp dword [0xdd0774], ebp
jne 0xdacfaa
push 0x3e8
call edi
push 0xdd0770
push esi
call ebx
test eax, eax
jne 0xdacf8f
mov ebp, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebx
test eax, eax
jne 0xdacfc6
push 0x64
call edi
push esi
call ebx
test eax, eax
je 0xdacfbb
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
pop ecx
ret
Function at 0xdb0e00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0xdc68f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0xdb0ed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.00dad7a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0xdb0e61
mov edx, dword [eax]
jmp 0xdb0e63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00daf050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0xdb0ebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xdb0ebf
cmp esi, edi
je 0xdb0ebf
mov ecx, esi
call fcn.00da8a00
push esi
call fcn.00db61c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00dad990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0xdb0ef5
mov eax, dword [eax]
jmp 0xdb0ef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.00dac640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0xdb0f25
mov eax, dword [eax]
jmp 0xdb0f27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0xdb0f76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xdb0f76
cmp esi, edi
je 0xdb0f76
mov eax, dword [esi]
cmp eax, edi
je 0xdb0f5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0xdb0f6d
push eax
call fcn.00db61c8
add esp, 4
push esi
call fcn.00db61c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xdb0f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0xdb0ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xdb1035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00db0e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0xdb0fc5
mov edi, 0xdcb8b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xdb1035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00db0e00
add edi, 4
add esp, 0xc
cmp edi, 0xdcb8c0
jb 0xdb1000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0xdb1070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00db7082
mov esi, eax
add esp, 8
test esi, esi
je 0xdb1107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0xdb1102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00db6946
add esp, 8
test eax, eax
je 0xdb10e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0xdb10e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00db6946
add esp, 8
test eax, eax
jne 0xdb10c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0xdb1102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0xdb1f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xdc69fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xdb2002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00db5dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xdb2002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00dad6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00db620b
push 0x10
call fcn.00db61d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xdb1fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00da21c0
jmp 0xdb1fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00db1b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xdb1ff0
mov ecx, edi
call fcn.00da22c0
push edi
call fcn.00db61c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xdb2021
inc ebx
cmp ebx, 0x20
jb 0xdb1f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xdb3250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xdc7808
push 0xdb7288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xdb3329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xdb3329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00db61d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xdb3329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xdb3329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xdb332c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00db3351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xdb3d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xdb3d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xdb3d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xdb3d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xdb3d94
push eax
push esi
call fcn.00db620b
add esp, 8
pop esi
ret 0x10

Function at 0xdb3da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xdb3e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xdb3e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xdcc320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00db5dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xdb3dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xdb3e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xdb3ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xdb3eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xdcc320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00db5dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xdb3eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xdb3e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xdb4000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xdb4131
push esi
call fcn.00db7145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00da6080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xdb4131
push 0
push ebp
call fcn.00da63a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00da6260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xdb408b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00da62f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xdb4121
push 0xdcc918
push edi
call fcn.00db53f0
push eax
push ebx
push esi
call fcn.00db3f60
push 0xdcc8f8
push edi
call fcn.00db53f0
push eax
push ebx
push esi
call fcn.00db3f60
push 0xdcc8d8
push edi
call fcn.00db53f0
push eax
push ebx
push esi
call fcn.00db3f60
push 0xdcc8c0
push edi
call fcn.00db53f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00db3f60
push 0xdcc8a0
push edi
call fcn.00db53f0
push eax
push ebx
push esi
call fcn.00db3f60
push 0xdcc888
push edi
call fcn.00db53f0
push eax
push ebx
push esi
call fcn.00db3f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xdb51b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00db5140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00db5140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00db5140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00db5140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xdb5bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xdb5c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xdc787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xdb5c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xdb5c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x40f600
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x672470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x67246c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x672470], edx
cmp eax, 0x26f
jl 0x40f608
mov dword [0x561fc0], 0x270
ret

Function at 0x40f640
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x672474]
mov ebx, dword [eax*4 + 0x672470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x672aa4]
mov dword [eax*4 + 0x672470], edx
cmp eax, 0xe2
jl 0x40f648
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x672474]
mov ebx, dword [eax*4 + 0x672470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x6720e4]
mov dword [eax*4 + 0x672470], edx
cmp eax, 0x26e
jl 0x40f698
mov edx, dword [0x672470]
mov ecx, dword [0x672e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x672aa0]
mov dword [0x672e2c], eax
mov dword [0x561fc0], 0
pop ebx
ret

Function at 0x40f720
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x561fc0]
add dword [0x561fc0], 1
mov eax, dword [0x671020]
cmp eax, dword [0x561710]
jne 0x40f743
cmp ebx, 0x271
jb 0x40f764
mov eax, dword [0x671020]
call fcn.0040f600
not dword [0x671020]
mov eax, dword [0x671020]
mov dword [0x561710], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40f780
call fcn.0040f640
xor ebx, ebx
mov dword [0x561fc0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x672470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x411340
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x561460]
cmp ax, 0xcb
je 0x41144c
cmp ax, 0xcc
je 0x41144c
lea esi, [esi]
mov edx, dword [0x673070]
test edx, edx
je 0x411375
mov eax, dword [0x672f20]
call edx
mov ebx, eax
jmp 0x41137a
mov ebx, 0x672f24
cmp word [0x672f10], 0
jle 0x4113a0
mov eax, 0x672ef0
call fcn.00411600
mov eax, ebx
call fcn.00410f00
mov eax, ebx
call fcn.00410f70
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x4113c2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x4113bd
mov edx, edi
mov eax, ebx
call fcn.00410370
jmp 0x4113c0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x4113a8
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x672f10], 0
jle 0x41144c
mov edx, 0x672e30
mov eax, ebx
call fcn.004104b0
mov edi, eax
test edi, edi
je 0x41141c
mov eax, dword [0x672ec4]
mov dword [edi + 0xc], eax
cmp dword [0x672ec4], 0
je 0x411410
mov eax, dword [0x672ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x672ec4], eax
nop
sub word [0x672f10], 1
cmp word [0x672f10], 0
sete bl
mov eax, 0x672ef0
call fcn.00411620
test bl, bl
je 0x41144c
mov eax, 0x672ef0
call fcn.004115f0
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x413650
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00413630
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x41377a
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040bbf0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x4136df
mov edx, 0x6722f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x413731
call sub.kernel32.dll_GetLastError
call fcn.004042b0
lea eax, [ebp - 0x10]
call fcn.0040a3e0
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a990
mov edx, dword [ebp - 0x14]
mov ecx, 0x613344
lea eax, [ebp - 0x10]
call fcn.0040a710
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040b3a0
jmp 0x4137c8
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x41374a
cmp eax, ecx
je 0x413754
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040bbf0
cmp byte [0x5616e0], 0
jne 0x4137c8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040c190
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b4b0
lea esi, [esi]
jmp 0x4137c8
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040bbf0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x41379e
mov eax, 0x6722f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x5616e0], 0
jne 0x4137c8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040c190
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b4b0
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00413630
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413be0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x672260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413dc0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x672260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.004037b0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x5614e0], eax
mov ebx, eax
jmp 0x413d83
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x413c68
cmp byte [ebx], 0
je 0x413d8c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x413ce3
mov al, byte [ebx]
cmp al, 1
jb 0x413cd8
sub al, 0x20
jbe 0x413ca8
sub al, 2
je 0x413cbc
jmp 0x413cd8
mov al, byte [ebp - 0x114]
test al, al
je 0x413ce8
add dword [ebp - 0x110], 1
jmp 0x413ce0
cmp byte [ebx + 1], 0x22
je 0x413cd3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413ce0
add ebx, 1
jmp 0x413ce0
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413c98
test dword [ebp - 0x10c], 0xffffffff
je 0x413d7c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413dc0
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x672260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413d73
mov al, byte [ebx]
cmp al, 1
jb 0x413d68
sub al, 0x20
jbe 0x413d38
sub al, 2
je 0x413d4c
jmp 0x413d68
mov al, byte [ebp - 0x114]
test al, al
je 0x413d78
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413d70
cmp byte [ebx + 1], 0x22
je 0x413d63
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413d70
add ebx, 1
jmp 0x413d70
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413d28
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x413c6b
mov ebx, dword [ebp - 0x10c]
mov dword [0x672250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x672260
call fcn.00411180
mov eax, dword [0x672260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret