joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10079030
Capabilities:
Create thread
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100abc10
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x100bf040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x105
lea eax, [ebp - 0x220]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x105
lea eax, [ebp - 0x118]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x224], 0
cmp dword [ebp + 0xc], 1
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
jne 0x1007921b
push 0x105
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x105
lea eax, [ebp - 0x220]
push eax
push 0x100b41ac
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x1007921b
mov esi, dword [0x100ff360]
mov ecx, esi
mov edx, dword [ebp - 0x224]
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x10079119
cmp dword [eax + 0x10], edx
jae 0x1007910f
mov eax, dword [eax + 8]
jmp 0x10079113
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10079105
cmp byte [ecx + 0xd], 0
jne 0x10079124
cmp edx, dword [ecx + 0x10]
jae 0x10079126
mov ecx, esi
cmp ecx, esi
je 0x10079213
mov esi, dword [esi]
mov dword [ebp - 0x228], esi
cmp byte [esi + 0xd], 0
jne 0x100791ed
mov edi, dword [esi + 0x10]
lea eax, [esi + 0x14]
push eax
lea ecx, [ebp - 0x248]
call fcn.1002b400
mov dword [ebp - 4], 0
cmp edi, dword [ebp - 0x224]
jne 0x10079195
cmp dword [ebp - 0x234], 0xf
lea eax, [ebp - 0x248]
push dword [ebp - 0x238]
cmova eax, dword [ebp - 0x248]
mov ecx, 0x100bf78c
push eax
call fcn.1002b6a0
mov eax, dword [esi + 0x10]
mov dword [0x100bf7ac], eax
mov byte [0x100bf7a8], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe 0x100791d2
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100791c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1007920d
push ecx
push edx
call fcn.100a4237
add esp, 8
lea ecx, [ebp - 0x228]
call fcn.1003d2f0
mov esi, dword [ebp - 0x228]
cmp byte [esi + 0xd], 0
je 0x10079140
push 0
push 0
push 0
push 0x100308d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1007921b
mov eax, 1
jmp 0x1007921d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a3dbc
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100a1030
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
push eax
call fcn.100a1860
mov edx, dword [eax + 4]
test edx, edx
je 0x100a10d7
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x100a10ac
cmp eax, edx
jne 0x100a10a4
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100a10b4
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x100a10b4
cmp eax, edx
jne 0x100a10b4
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [edi + 8]
mov eax, dword [edx + 4]
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.10027dc0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100a1160
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x1c
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp edx, edi
jne 0x100a117e
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x1c], esi
xor ecx, eax
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [esi + eax*8]
mov dword [ebp - 0x10], ecx
lea eax, [esi + eax*8]
mov esi, dword [edx]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
call fcn.10027dc0
dec dword [ebx + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0xc]
je 0x100a120e
nop dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x100a121d
mov edx, esi
mov esi, dword [esi]
call fcn.10027dc0
dec dword [ebx + 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x18], eax
jne 0x100a11f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x10], eax
jne 0x100a123d
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x100a1240
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x100a122a
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov dword [ecx + 4], eax
cmp esi, edi
je 0x100a122a
nop word [eax + eax]
movzx eax, byte [esi + 8]
mov edx, esi
xor eax, 0x811c9dc5
mov edi, esi
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
mov esi, dword [esi]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
call fcn.10027dc0
dec dword [ebx + 8]
cmp edi, dword [ebp + 8]
je 0x100a12ca
nop word [eax + eax]
mov eax, dword [ebp + 0xc]
mov edi, esi
cmp esi, eax
je 0x100a12f3
mov edx, esi
mov esi, dword [esi]
call fcn.10027dc0
dec dword [ebx + 8]
cmp edi, dword [ebp + 8]
jne 0x100a12b0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
cmp esi, edi
jne 0x100a1250
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a18d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ad225
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100bf040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100a1860
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100a195a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100a1aa0
cmp dword [ebx + 8], 0xfffffff
jne 0x100a196e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100a3dd8
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b5360]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100b5360]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100a1a53
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100a51a0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100a1a35
cmp eax, 0x200
jae 0x100a1a33
shl eax, 3
cmp eax, ecx
jae 0x100a1a35
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100420c0
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100a1860
mov edx, dword [eax]
jmp 0x100a1a56
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100a1a81
mov dword [ecx + eax*8], esi
jmp 0x100a1a93
cmp ebx, edx
jne 0x100a1a8a
mov dword [ecx + eax*8], esi
jmp 0x100a1a97
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100a1a97
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a1f60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ad225
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100bf040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100a1860
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100a1fea
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100a2132
cmp dword [ebx + 8], 0xfffffff
jne 0x100a1ffe
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100a3dd8
mov edx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b5360]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100b5360]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100a20e5
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100a51a0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100a20c7
cmp eax, 0x200
jae 0x100a20c5
shl eax, 3
cmp eax, ecx
jae 0x100a20c7
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100420c0
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100a1860
mov edx, dword [eax]
jmp 0x100a20e8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100a2113
mov dword [ecx + eax*8], esi
jmp 0x100a2125
cmp ebx, edx
jne 0x100a211c
mov dword [ecx + eax*8], esi
jmp 0x100a2129
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100a2129
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10004c90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
mov edi, ebp
xor ecx, ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x1007617c
call fcn.10012e30
nop
call fcn.10016a80
nop
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10012e00
push eax
call fcn.10016f50
nop
push 0x10005200
push 0x100740ec
call fcn.10016510
nop
call fcn.10016ae0
test eax, eax
je 0x10004d0f
mov esi, esp
push 0x30
push 0x1005b6c8
push str.Error_in_Attack_Connect
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.10012e00
nop
push 0
call fcn.1001efc0
nop
jmp 0x10004d7e
call fcn.10016a80
nop
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10012e00
push eax
call fcn.10016f50
nop
push 0x100050d0
push 0x100740f0
call fcn.10016510
nop
call fcn.10016ae0
nop
call fcn.10016a80
nop
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10012e00
push eax
call fcn.10016f50
nop
push 0x100052f0
push 0x100740e0
call fcn.10016510
nop
call fcn.10016ae0
test eax, eax
je 0x10004d7e
push 0
call fcn.1001efc0
nop
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.10012e00
mov esp, ebp
pop ebp
ret
Function at 0x100058d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
push ebx
push esi
push edi
lea edi, [ebp - 0x38]
mov ecx, 0xe
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100730c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10076279
call fcn.10012e30
nop
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10005ab0
add esp, 8
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
add ecx, 5
push ecx
call fcn.10013080
add esp, 4
mov dword [ebp - 0xf4], eax
mov edx, dword [ebp - 0xf4]
mov dword [ebp - 0x28], edx
mov esi, esp
lea eax, [ebp - 0x1c]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
add edx, 5
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10012e00
nop
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.100186b0
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x28]
mov byte [edx + ecx], 0xe9
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x28]
add eax, dword [edx + 4]
push eax
call fcn.10005a60
add esp, 8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + edx + 1], eax
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x10], 0xe9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10005a60
add esp, 8
mov edx, 1
shl edx, 0
mov dword [ebp + edx - 0x10], eax
push 5
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100186b0
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
push edx
mov ecx, ebp
push eax
lea edx, [0x10005a24]
call fcn.10012da0
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012e70
add esp, 0xf8
cmp ebp, esp
call fcn.10012e00
mov esp, ebp
pop ebp
ret
Function at 0x10005ab0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10076279
call fcn.10012e30
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10012e00
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x10073008
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10012e00
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x10073010
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10012e00
nop
push 5
mov eax, 1
imul ecx, eax, 0
add ecx, 0x10073008
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10017de0
add esp, 0xc
test eax, eax
jne 0x10005b54
mov eax, 0xb
jmp 0x10005b7f
push 5
mov eax, 1
imul ecx, eax, 0
add ecx, 0x10073010
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10017de0
add esp, 0xc
test eax, eax
jne 0x10005b7c
mov eax, 5
jmp 0x10005b7f
mov eax, dword [ebp + 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x10005ba4]
call fcn.10012da0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10012e00
mov esp, ebp
pop ebp
ret

Function at 0x10007af0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x1007628e
call fcn.10012e30
nop
push 0x6c078965
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.10007a80
nop
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10012e00
mov esp, ebp
pop ebp
ret 4
Function at 0x10009ba0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x1007628e
call fcn.10012e30
nop
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x10009be1
mov ecx, dword [ebp - 8]
call fcn.1000c3c0
nop
jmp 0x10009bf5
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4e0
jb 0x10009bf5
mov ecx, dword [ebp - 8]
call fcn.1000c1d0
nop
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
shr eax, 0xb
mov ecx, dword [ebp - 8]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x12
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.10012e00
mov esp, ebp
pop ebp
ret

Function at 0x1000a790
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x1007628f
call fcn.10012e30
nop
mov dword [ebp - 8], 0
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10012e00
nop
mov esi, esp
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.10012e00
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.10012e00
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10012e00
nop
push edx
mov ecx, ebp
push eax
lea edx, [0x1000a850]
call fcn.10012da0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10012e00
mov esp, ebp
pop ebp
ret
Function at 0x1000c1d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x70]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x1007628e
call fcn.10012e30
nop
mov dword [ebp - 0x14], 0x26f
mov dword [ebp - 0x20], 0xe3
mov dword [ebp - 0x2c], 0
jmp 0x1000c21b
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xe3
jae 0x1000c290
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 + 0x9c8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
and eax, 1
je 0x1000c262
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000c26c
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x38]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 + 0xff8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000c212
mov dword [ebp - 0x44], 0xe3
jmp 0x1000c2a2
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x26f
jae 0x1000c317
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 + 0x9c8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
and eax, 1
je 0x1000c2e9
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000c2f3
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x50]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 - 0x388]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000c299
mov dword [ebp - 0x5c], 0x26f
mov eax, 4
imul ecx, eax, 0x4df
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 4]
and eax, 0x80000000
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx + 4]
and edx, 0x7fffffff
or eax, edx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
and eax, 1
je 0x1000c363
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000c36d
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x68]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, 4
imul eax, edx, 0x18c
mov edx, dword [ebp - 8]
xor ecx, dword [edx + eax + 4]
mov eax, 4
imul edx, eax, 0x26f
mov eax, dword [ebp - 8]
mov dword [eax + edx + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0
pop edi
pop esi
pop ebx
add esp, 0x130
cmp ebp, esp
call fcn.10012e00
mov esp, ebp
pop ebp
ret