joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x40c404
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40c413
pop dword [ebp - 0x14]
mov eax, 0x86bcff06
sub eax, 0x867c3af3
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3d803
push 0
mov eax, 0x5afa8c2e
add eax, 0xa547c5ea
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x46fb
mov esi, eax
mov edx, 0x435400
add edx, dword [ebp - 0x14]
mov ebx, 0xdd609d21
add ebx, 0x42ef929e
mov edi, dword [edx]
sub dword [ebp - 8], esi
sub edi, ebx
xor dword [ebp - 0x10], esi
mov dword [esi], edi
sub dword [ebp - 0xc], ebx
add esi, 4
add edx, 0xdb5c2740
sub edx, 0xdb5c273c
loop 0x40c466
add eax, 0xc1c18c95
add eax, 0x3e3f822a
mov ebx, eax
add eax, 0x13d41531
sub eax, 0x13d4152c
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x40c20d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40c21c
pop dword [ebp - 0x48]
mov eax, 0x40c21c
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x43366
push 0
mov eax, 0x651bd54e
add eax, 0x9b267cca
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x188f2aa2
add ecx, 0xe7713318
xor esi, esi
add esi, eax
mov edx, 0x435400
add edx, dword [ebp - 0x48]
mov ebx, 0x675f42b1
add ebx, 0xc36ed12b
xor dword [ebp - 4], edx
mov edi, dword [edx]
mov dword [ebp - 0x14], 0x677a9d8e
add edi, ebx
add dword [ebp - 0x10], ecx
mov dword [esi], edi
add dword [ebp - 0x18], 0x2221189e
add esi, 0xd8bba17e
sub esi, 0xd8bba17a
add edx, 4
loop 0x40c272
add eax, 0xe6185a08
sub eax, 0xe616f04d
mov ebx, eax
add eax, 0xfd42c00d
sub eax, 0xfd42c008
mov ecx, 0x1c50cef0
add ecx, 0xe3ef3110
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1001f48a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001f5e2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0x145ccb97
jge 0x1001f4fe
mov dword [ebp - 0x14], 1
jmp 0x1001f502
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jg 0x1001f515
mov dword [ebp - 0x18], 1
jmp 0x1001f519
and dword [ebp - 0x18], 0
imul eax, dword [ebp - 0x18], 0
cmp eax, 0x46c2
jle 0x1001f52d
mov dword [ebp - 0x1c], 1
jmp 0x1001f531
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x1c], eax
jne 0x1001f544
mov dword [ebp - 0x20], 1
jmp 0x1001f548
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0xfffffffe
jne 0x1001f561
mov dword [ebp - 0x24], 1
jmp 0x1001f565
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x24], eax
je 0x1001f57e
mov eax, 0xe623
test eax, eax
jne 0x1001f57e
and dword [ebp - 0xc], 0
jmp 0x1001f585
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
cmp dword [ebp - 0xc], 0xafb5d1cb
jae 0x1001f59f
mov dword [ebp - 0x28], 1
jmp 0x1001f5a3
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [eax]
cmp ecx, 0xffffffff
jg 0x1001f5b9
mov dword [ebp - 0x10], 1
jmp 0x1001f5bd
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
cmp dword [ebp - 0x10], 5
jge 0x1001f5d4
mov dword [ebp - 0x30], 1
jmp 0x1001f5d8
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
jmp 0x1001f5f6
push 0x248b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esp, ebp
pop ebp
ret
Function at 0x10024dc6
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10024ef5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
push 0x14
push 0
push 0x345c
push 0x3942
call fcn.10034f5a
pop ecx
pop ecx
call eax
push eax
push 0x345c
push 0x32ba
call fcn.10034f5a
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and dword [eax + 8], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and dword [eax + 0x10], 0
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
push dword [eax + 0x50]
mov eax, dword [ebp - 8]
push dword [eax]
push 0x345c
push 0x2dd4
call fcn.10034f5a
pop ecx
pop ecx
call eax
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
push dword [eax + 0x54]
mov eax, dword [ebp - 8]
push dword [eax]
push 0x345c
push 0x2dd4
call fcn.10034f5a
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xc]
add eax, dword [ecx + 0x54]
push eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push dword [eax]
call fcn.10035049
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x473
push 1
push 0x22b3
push 0x765d
lea eax, [ebp - 0x14]
push eax
push 0x5c0d
call fcn.10024c7a
add esp, 0x20
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax + 0x34], ecx
jmp 0x10024f04
push 0xc25
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret
Function at 0x10025084
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100250a8
xor eax, eax
jmp 0x100251cb
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x100250c6
xor eax, eax
jmp 0x100251cb
push 1
push 0x1fe8
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push 0x4b94
call fcn.10024bd8
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x100250ee
xor eax, eax
jmp 0x100251cb
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push 1
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call fcn.10024dc6
add esp, 0x18
push 0x953
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0xbc2
call fcn.10024f08
add esp, 0x18
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.10024fa6
add esp, 0xc
push dword [ebp - 4]
call fcn.1002498c
pop ecx
test eax, eax
jne 0x10025159
xor eax, eax
jmp 0x100251cb
push 0x28d6
push 1
lea eax, [ebp - 4]
push eax
push 0x680c
call fcn.10025000
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x100251b3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x10025190
xor eax, eax
jmp 0x100251cb
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100251a9
xor eax, eax
jmp 0x100251cb
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x100251c4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x100251c8
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x1002cb23
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002cb3c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x1002ccbd
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x10
jmp 0x1002cb82
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffffffe7
jg 0x1002ccbd
mov dword [ebp - 8], 0x8f6efba1
mov dword [ebp - 0x28], 0x6b7a7bc6
mov dword [ebp - 0x54], 0x7507
mov eax, dword [ebp - 8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp dword [eax], ecx
jg 0x1002cbbc
mov dword [ebp - 0x14], 1
jmp 0x1002cbc0
and dword [ebp - 0x14], 0
cmp dword [ebp - 8], 0
je 0x1002cbee
mov eax, dword [ebp - 4]
cmp dword [eax], 5
je 0x1002cbd7
mov dword [ebp - 0x10], 1
jmp 0x1002cbdb
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x10]
je 0x1002cbee
mov dword [ebp - 0x18], 1
jmp 0x1002cbf2
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jle 0x1002cc03
mov dword [ebp - 0xc], 1
jmp 0x1002cc07
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], eax
jl 0x1002cc28
mov dword [ebp - 0x1c], 1
jmp 0x1002cc2c
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
imul eax, dword [ebp - 0x1c]
cmp eax, 0x89f7
jge 0x1002cc45
mov dword [ebp - 0x20], 1
jmp 0x1002cc49
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
cmp dword [ebp - 0x20], eax
jl 0x1002cc5c
mov dword [ebp - 0x24], 1
jmp 0x1002cc60
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x28], eax
jle 0x1002cc77
mov dword [ebp - 0x2c], 1
jmp 0x1002cc7b
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x2c], eax
jle 0x1002cc8c
mov dword [ebp - 0x30], 1
jmp 0x1002cc90
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x30], eax
jg 0x1002ccac
mov eax, 0x8f08
test eax, eax
je 0x1002ccac
mov dword [ebp - 0x38], 1
jmp 0x1002ccb0
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1002cb77
mov esp, ebp
pop ebp
ret
Function at 0x1006c4e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x1006c4fe
mov ecx, dword [ebp - 8]
call fcn.1006dc50
jmp 0x1006c511
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x1006c511
mov ecx, dword [ebp - 8]
call fcn.1006dad0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
shr eax, 0xb
mov ecx, dword [ebp - 8]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
shl edx, 7
and edx, 0x9d2c5680
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0x12
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1006dad0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x1006daeb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe3
jge 0x1006db57
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x1006db2f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x1006db36
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x1006dae2
jmp 0x1006db62
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x26f
jge 0x1006dbce
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 1
je 0x1006dba6
mov dword [ebp - 0x18], 0x9908b0df
jmp 0x1006dbad
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
shr eax, 1
xor eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x1006db59
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ecx + 4]
and ecx, 0x7fffffff
or edx, ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x1006dc0c
mov dword [ebp - 0x20], 0x9908b0df
jmp 0x1006dc13
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
shr eax, 1
xor eax, dword [ebp - 0x20]
mov ecx, 4
imul edx, ecx, 0x18c
mov ecx, dword [ebp - 8]
xor eax, dword [ecx + edx + 4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 4], eax
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
Function at 0x1006dc50
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x1006dc6b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jge 0x1006dcd7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x1006dcaf
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x1006dcb6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x1006dc62
mov esp, ebp
pop ebp
ret
Function at 0x1008293d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1009638c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1007a054
mov dword [ebp - 0x14], eax
cmp dword [0x11f05598], esi
jne 0x10082a30
push 0x800
push esi
push 0x1000ac6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100829bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10082b10
push esi
push esi
push 0x1000ac6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10082b10
push 0x1000ac84
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10082b10
push eax
call ebx
push 0x1000ac90
push edi
mov dword [0x11f05598], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000aca0
push edi
mov dword [0x11f0559c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000acb4
push edi
mov dword [0x11f055a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x11f055a8], eax
test eax, eax
je 0x10082a2d
push 0x1000acd0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x11f055a4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10082a55
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10082a48
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10082a6a
push 4
pop eax
jmp 0x10082b12
cmp dword [ebp - 0x14], esi
je 0x10082a6a
push dword [0x11f05598]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10082a4f
mov eax, dword [0x11f055a4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10082ac8
cmp dword [0x11f055a8], edi
je 0x10082ac8
push eax
call ebx
push dword [0x11f055a8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10082ac8
test eax, eax
je 0x10082ac8
call ecx
test eax, eax
je 0x10082abd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10082abd
test byte [ebp - 8], 1
jne 0x10082ac8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10082af8
mov eax, dword [0x11f0559c]
cmp eax, edi
je 0x10082af5
push eax
call ebx
test eax, eax
je 0x10082af5
call eax
mov esi, eax
test esi, esi
je 0x10082af5
mov eax, dword [0x11f055a0]
cmp eax, edi
je 0x10082af5
push eax
call ebx
test eax, eax
je 0x10082af5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x11f05598]
call ebx
test eax, eax
je 0x10082b10
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10082b12
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x1000e1d3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000e212
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e212
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e212
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000e212
cmp dword [ecx + 0x74], 0xe
jbe 0x1000e212
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10010e8f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10010f2c
push ebx
push esi
call fcn.10010e58
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10010dec
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10010ed9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10010f2b
push edi
push eax
call fcn.10011e4a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10010ef9
call fcn.1000f934
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10010f2a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10010dec
add esp, 0x20
test eax, eax
jne 0x10010f18
push edi
call fcn.1000f934
jmp 0x10010f20
push ebx
call fcn.1000f934
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10011199
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10018888
push 0x10018880
push str.FlsAlloc
push 0x1f
call fcn.100110b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100111cd
push dword [ebp + 8]
mov ecx, esi
call dword [0x10017150]
call esi
jmp 0x100111d3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10011217
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10018898
push 0x10018890
push str.FlsGetValue
push 0x21
call fcn.100110b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001124e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10017150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10011256
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100188a0
push 0x10018898
push str.FlsSetValue
push 0x22
call fcn.100110b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011290
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10017150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]