joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c004]
jne 0x40100a
repz ret
jmp fcn.0040149b

Function at 0x40452b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004039fa
and dword [ebp - 0x14], 0
cmp dword [0x42ec40], 0
mov dword [ebp - 0x18], eax
jne 0x4045de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404686
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404686
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42ec40], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42ec44], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42ec48], eax
call edi
push eax
call esi
mov dword [0x42ec50], eax
test eax, eax
je 0x4045de
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42ec4c], eax
mov eax, dword [0x42ec4c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404637
cmp dword [0x42ec50], ecx
je 0x404637
push eax
call esi
push dword [0x42ec50]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404637
test ebx, ebx
je 0x404637
call edi
test eax, eax
je 0x40462e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40462e
test byte [ebp - 8], 1
jne 0x404637
or dword [ebp + 0x10], 0x200000
jmp 0x40466a
mov eax, dword [0x42ec44]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40466a
mov eax, dword [0x42ec48]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42ec40]
call esi
test eax, eax
je 0x404686
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404688
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x4253e0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x804
mov eax, dword [0x42c004]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [0x81d808]
imul eax, eax, 0x343fd
cmp dword [0x81fc7c], 0x139e
mov dword [0x81d808], eax
jne 0x425421
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EraseTape]
mov eax, dword [0x81d808]
add eax, 0x269ec3
push esi
mov dword [0x81d808], eax
movzx esi, word [0x81d80a]
and esi, 0x7fff
cmp dword [0x81fc7c], 0x8e7
jne 0x425456
push 0
lea eax, [esp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x804]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x804
ret

Function at 0x4254a0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x4254b4
call fcn.004253e0
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x4254a7
pop esi
cmp ebx, 0x2d
jne 0x4254ce
mov dword [0x81fc88], 0xa62e7790
mov dword [0x81fc8c], 0xffffffff
ret

Function at 0x4254d0
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x42cdb8]
sub esp, 0x14
push ebx
mov ebx, dword [0x81fc7c]
push edi
mov edi, dword [0x81d80c]
call fcn.00425470
cmp dword [0x81fc7c], 0x2f
jne 0x42552a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.004254a0
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x425810
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00407bd0
mov eax, dword [0x42c004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x425839
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe0f4a
jge 0x4258e1
cmp dword [0x81fc7c], 0xa5f
jne 0x425885
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x818]
push edx
push str.xonatoyuhejigoriramadiguyo
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 4], 0x84620b
jne 0x4258aa
mov eax, dword [0x42dbd8]
mov dword [0x81fc7c], eax
mov ecx, dword [0x81fc7c]
add ecx, 0xa231
mov dword [0x81fc7c], ecx
cmp dword [0x81fc7c], 0x141
jne 0x4258dc
push str.wucusipeyekexe_zelisapecuyozabozecaxufer_miweyumeriwosizupuyubahu_regorekuzet_begazixezibunodumekacefasuhato
lea edx, [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x42f180], 0xec58acac
mov dword [0x42f184], 0xffffffff
jmp 0x425830
call fcn.00425540
jmp dword [0x81d80c]
Function at 0x4028f0
Capabilities:
Encrypt data using rc4 prga
Inspect section memory permissions

Disassembly:
mov byte [ebp - 0x70], 0x16
call fcn.00402415
xchg ecx, eax
xor ch, ah
clc
lea eax, [ebp - 0x84]
push eax
call fcn.00402425
push eax
push esi
push dword [ebp + 8]
call fcn.004023da
cli
invalid
inc dword [ebx - 0x7a76ef3c]
inc eax
invalid
invalid
jmp [edx + 0x40]
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x402c0e
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
Function at 0x402c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
insd dword es:[edi], dx
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00402425
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004023da
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
inc dword [eax]

Function at 0x402d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00402425
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004023da
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
invalid
test dword [ecx], ebx
cld

Function at 0x406750
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x21c], ecx
mov ecx, dword [ebp - 0x21c]
call fcn.004099d0
test eax, eax
je 0x406782
mov eax, 1
jmp 0x406827
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4067a1
xor eax, eax
jmp 0x406827
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push str.RPCSS
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 1
push 3
push 0x10
push 0xf01ff
mov edx, dword [ebp - 0x21c]
add edx, 0x230
push edx
mov eax, dword [ebp - 0x21c]
add eax, 0x230
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40680e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x406827
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x404532
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x404541
pop dword [ebp - 0x20]
mov eax, 0x4ea0549b
add eax, 0xb19ff0a6
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x35552
push 0
mov eax, 0x47cfb8cd
sub eax, 0x478ed7f5
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xfc94ce92
add ecx, 0x36b69f0
mov edx, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x20]
mov edi, 0x6779a5fb
xor dword [ebp - 8], ebx
mov esi, dword [ebx]
add esi, edi
sub dword [ebp - 0x10], esi
mov dword [edx], esi
add dword [ebp - 0xc], eax
add edx, 0x50702307
sub edx, 0x50702303
add ebx, 4
loop 0x404594
add eax, 0xd4db
mov ebx, eax
add eax, 5
mov ecx, 0x6141c037
add ecx, 0x9efe3fc9
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x100064e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, pe_overlay
mov esi, ecx
cmp ax, di
jne 0x10006515
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100076a8
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000654a
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x1000654a
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_wchar_t____thiscall_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Pninc_void_]
mov word [eax], di
mov ax, di
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100076a8
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push ebx
je 0x10006656
mov ebx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ebx], eax
jne 0x10006575
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov eax, dword [esi + 0x1c]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100065af
push dword [esi + 0x4c]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
mov ecx, pe_overlay
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x1000665b
pop ebx
pop edi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100076a8
mov esp, ebp
pop ebp
ret 4
movzx eax, di
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
test eax, eax
js 0x10006656
cmp eax, 1
jle 0x10006616
cmp eax, 3
jne 0x10006656
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
mov ecx, pe_overlay
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x1000665b
pop ebx
pop edi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100076a8
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x10006634
push dword [esi + 0x4c]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x10006656
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
je 0x10006656
pop ebx
mov ax, di
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100076a8
mov esp, ebp
pop ebp
ret 4
mov eax, pe_overlay
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.100076a8
mov esp, ebp
pop ebp
ret 4
Function at 0x10007190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x1000723f
cmp byte [esi + 0x3e], 0
je 0x1000723f
mov eax, dword [esi]
push pe_overlay
call dword [eax + 0xc]
mov ecx, pe_overlay
cmp cx, ax
je 0x100071f4
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10007206
sub eax, 1
je 0x1000720a
sub eax, 2
je 0x1000723f
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100076a8
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10007228
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100071f4
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100076a8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100076a8
mov esp, ebp
pop ebp
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40673a
pop dword [ebp - 0x2c]
mov eax, 0x40673a
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xbfdfa254
add dword [ebp - 0x3c], 0x8e72a2f7
mov dword [ebp - 0x38], 0xeaed7eb7
sub dword [ebp - 0x38], 0xb8ba3272
mov dword [ebp - 0x34], 0x4d7a615f
sub dword [ebp - 0x34], 0x12e1d31
mov dword [ebp - 0x30], 0x3b4d4306
sub dword [ebp - 0x30], 0x3b4d4306
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x9a8e042
sub eax, 0x9685f3e
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x550d8a31
add dword [ebp - 0x3c], 0x1f64df25
mov dword [ebp - 0x38], 0x5d252a56
add dword [ebp - 0x38], 0xe447371f
mov dword [ebp - 0x34], 0x425ac90c
sub dword [ebp - 0x34], 0xdeeb5ca0
mov dword [ebp - 0x30], 0xac4c54d0
sub dword [ebp - 0x30], 0xac4c54d0
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x390e9
push 0
call eax
mov ecx, 0x4e2a
xor edi, edi
add edi, eax
mov edx, 0x71d73be1
sub edx, 0x719057e1
add edx, dword [ebp - 0x2c]
mov esi, 0x51b87c42
xor dword [ebp - 0x1c], eax
mov ebx, dword [edx]
sub dword [ebp - 0x28], 0x9c3f9608
xor ebx, esi
xor dword [ebp - 0x18], 0x7069a635
mov dword [edi], ebx
add dword [ebp - 0x10], eax
add edi, 0x1d153b0f
sub edi, 0x1d153b0b
add edx, 0x95147bbb
sub edx, 0x95147bb7
loop 0x406848
add eax, 0x12b7b
xor ebx, ebx
add ebx, eax
add eax, 0xcdb71974
add eax, 0x3248e691
mov ecx, 0xb74f6ee7
sub ecx, 0xb70f6ee7
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40eb10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x641470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x64146c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x641470], edx
cmp eax, 0x26f
jl 0x40eb18
mov dword [0x575000], 0x270
ret

Function at 0x40eb50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x641474]
mov ebx, dword [eax*4 + 0x641470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x641aa4]
mov dword [eax*4 + 0x641470], edx
cmp eax, 0xe2
jl 0x40eb58
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x641474]
mov ebx, dword [eax*4 + 0x641470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x6410e4]
mov dword [eax*4 + 0x641470], edx
cmp eax, 0x26e
jl 0x40eba8
mov edx, dword [0x641470]
mov ecx, dword [0x641e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x641aa0]
mov dword [0x641e2c], eax
mov dword [0x575000], 0
pop ebx
ret

Function at 0x40ec30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x575000]
add dword [0x575000], 1
mov eax, dword [0x640020]
cmp eax, dword [0x574750]
jne 0x40ec53
cmp ebx, 0x271
jb 0x40ec74
mov eax, dword [0x640020]
call fcn.0040eb10
not dword [0x640020]
mov eax, dword [0x640020]
mov dword [0x574750], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40ec90
call fcn.0040eb50
xor ebx, ebx
mov dword [0x575000], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x641470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x410780
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x5744a0]
cmp ax, 0xcb
je 0x41088c
cmp ax, 0xcc
je 0x41088c
lea esi, [esi]
mov edx, dword [0x642070]
test edx, edx
je 0x4107b5
mov eax, dword [0x641f20]
call edx
mov ebx, eax
jmp 0x4107ba
mov ebx, 0x641f24
cmp word [0x641f10], 0
jle 0x4107e0
mov eax, 0x641ef0
call fcn.00410a40
mov eax, ebx
call fcn.00410340
mov eax, ebx
call fcn.004103b0
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x410802
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x4107fd
mov edx, edi
mov eax, ebx
call fcn.0040f7b0
jmp 0x410800
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x4107e8
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x641f10], 0
jle 0x41088c
mov edx, 0x641e30
mov eax, ebx
call fcn.0040f8f0
mov edi, eax
test edi, edi
je 0x41085c
mov eax, dword [0x641ec4]
mov dword [edi + 0xc], eax
cmp dword [0x641ec4], 0
je 0x410850
mov eax, dword [0x641ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x641ec4], eax
nop
sub word [0x641f10], 1
cmp word [0x641f10], 0
sete bl
mov eax, 0x641ef0
call fcn.00410a60
test bl, bl
je 0x41088c
mov eax, 0x641ef0
call fcn.00410a30
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x412a80
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x641260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00412c60
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x641260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00403470
call sub.kernel32.dll_GetCommandLineA
mov dword [0x574520], eax
mov ebx, eax
jmp 0x412c23
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x412b08
cmp byte [ebx], 0
je 0x412c2c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x412b83
mov al, byte [ebx]
cmp al, 1
jb 0x412b78
sub al, 0x20
jbe 0x412b48
sub al, 2
je 0x412b5c
jmp 0x412b78
mov al, byte [ebp - 0x114]
test al, al
je 0x412b88
add dword [ebp - 0x110], 1
jmp 0x412b80
cmp byte [ebx + 1], 0x22
je 0x412b73
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x412b80
add ebx, 1
jmp 0x412b80
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x412b38
test dword [ebp - 0x10c], 0xffffffff
je 0x412c1c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00412c60
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x641260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x412c13
mov al, byte [ebx]
cmp al, 1
jb 0x412c08
sub al, 0x20
jbe 0x412bd8
sub al, 2
je 0x412bec
jmp 0x412c08
mov al, byte [ebp - 0x114]
test al, al
je 0x412c18
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x412c10
cmp byte [ebx + 1], 0x22
je 0x412c03
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x412c10
add ebx, 1
jmp 0x412c10
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x412bc8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x412b0b
mov ebx, dword [ebp - 0x10c]
mov dword [0x641250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x641260
call fcn.004105c0
mov eax, dword [0x641260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428970
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x44]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040d680
call fcn.00403e00
push eax
test eax, eax
jne 0x428aec
lea eax, [ebp - 8]
mov edx, str.gtutorial_i386.exe
call fcn.00408870
push 0
mov eax, dword [0x575110]
lea edx, [ebp - 0x38]
call fcn.0044ad60
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0043cb30
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00408970
mov eax, dword [ebp - 4]
call fcn.0043d170
test al, al
je 0x428a34
push 5
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x38]
call fcn.0043cb30
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x428a0b
mov eax, 0x6412f0
push eax
mov eax, 0x5e33d8
push eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x428a1e
mov eax, 0x6412f0
push eax
mov eax, 0x5e33dc
push eax
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess
mov eax, dword [0x575110]
lea edx, [ebp - 0x34]
call fcn.0044ad60
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 4]
call fcn.0043cba0
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x34]
call fcn.0043cd00
mov eax, dword [ebp - 0x34]
mov edx, 0x5e33f0
call fcn.00409410
test eax, eax
jne 0x428aec
push 0
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x34]
call fcn.0043cb30
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, str.tutorialgraphical_
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
lea edx, [ebp - 0x44]
lea eax, [ebp - 4]
mov ecx, 2
call fcn.00408be0
mov eax, dword [ebp - 4]
call fcn.0043d170
test al, al
je 0x428aec
push 5
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x34]
call fcn.0043cb30
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x428ac2
mov eax, 0x6412f0
push eax
mov eax, 0x5e33d8
push eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x428ad5
mov eax, 0x6412f0
push eax
mov eax, 0x5e33dc
push eax
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess
call fcn.0040d8f0
lea eax, [ebp - 0x38]
call fcn.00403940
lea eax, [ebp - 0x34]
call fcn.00403940
lea eax, [ebp - 4]
call fcn.00403940
lea eax, [ebp - 8]
call fcn.00403940
pop eax
test eax, eax
je 0x428b1b
call fcn.0040da20
mov esp, ebp
pop ebp
ret

Function at 0x4316c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push dword [ebx + 4]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x4316dc
mov dword [ebx + 0xc], 0
mov esi, esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x446970
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x44697c
mov eax, 0x6412f0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x44698f
and eax, 0x10
sete al
jmp 0x446991
xor al, al
mov esp, ebp
pop ebp
ret