joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e03ae18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xd50
mov eax, 0x2e07425e
call fcn.2e05658b
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc0], ebx
cmp dword [eax + 0x18], 8
mov edi, ecx
mov dword [ebp - 0xc4], eax
jb 0x2e03ae45
mov eax, dword [eax + 4]
jmp 0x2e03ae48
add eax, 4
push ebx
push ebx
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0xd8]
push eax
push 0x2e008240
push 2
call fcn.2e036b78
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x2a8]
call fcn.2e0717df
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 4], ebx
call fcn.2e071740
lea ecx, [ebp - 0x940]
call fcn.2e070c62
push 0x2e008220
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.2e029c35
lea ecx, [ebp - 0x940]
push ecx
push eax
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 2
call fcn.2e070fb2
push ebx
push esi
lea ecx, [ebp - 0x64]
mov byte [ebp - 0xb9], al
mov byte [ebp - 4], 1
call fcn.2e028a93
cmp byte [ebp - 0xb9], bl
je 0x2e03b041
lea eax, [ebp - 0x940]
push eax
lea ecx, [ebp - 0x1c0]
call fcn.2e071253
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 7
call fcn.2e0284cb
lea eax, [ebp - 0x48]
push eax
push 0x2e0b417c
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 4
call fcn.2e0712a5
test al, al
je 0x2e03b028
cmp dword [ebp - 0x34], ebx
je 0x2e03b028
lea eax, [ebp - 0x48]
push eax
call fcn.2e02ea6d
lea ecx, [edi + 0x1cc]
mov eax, dword [ecx]
push 4
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 0xc0], ecx
call dword [eax + 4]
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x2e03af50
lea eax, [ebp - 0x44]
push ebx
push ebx
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0xd8]
push eax
push 0x2e0081b8
push 2
call fcn.2e036bd0
cmp byte [ebp + 0xc], bl
je 0x2e03b028
cmp dword [edi + 0x530], ebx
je 0x2e03b028
lea ecx, [edi + 0x52c]
mov dword [ebp - 0xfc], ecx
call fcn.2e036644
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], eax
call fcn.2e029da1
mov ecx, dword [ebp - 0xc4]
add ecx, 0xd8
push ecx
push eax
call fcn.2e02bede
pop ecx
pop ecx
test al, al
je 0x2e03b028
mov ecx, dword [ebp - 0xfc]
call fcn.2e036644
add eax, 0xd8
cmp dword [eax + 0x18], 8
jb 0x2e03afd6
mov esi, dword [eax + 4]
jmp 0x2e03afd9
lea esi, [eax + 4]
mov ecx, dword [ebp - 0xc0]
call fcn.2e029da1
cmp dword [eax + 0x18], 8
jb 0x2e03afef
mov eax, dword [eax + 4]
jmp 0x2e03aff2
add eax, 4
push esi
push eax
push 0x2e008160
lea eax, [ebp - 0x5a0]
push 0x29
push eax
call fcn.2e028836
add esp, 0x14
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x402c00
pop dword [ebp - 0x10]
mov eax, 0x402c00
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x35ccdfb6
sub dword [ebp - 0x20], 0xe77a9a6b
mov dword [ebp - 0x1c], 0xa3ba8cfe
add dword [ebp - 0x1c], 0x8e78bf47
mov dword [ebp - 0x18], 0xaadeafd8
add dword [ebp - 0x18], 0xa16d9456
mov dword [ebp - 0x14], 0x196a35f6
sub dword [ebp - 0x14], 0x196a35f6
lea eax, [ebp - 0x20]
push eax
mov eax, 0x9b90938b
sub eax, 0x9b5012ff
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xef838f3d
sub dword [ebp - 0x20], 0x7b1125e7
mov dword [ebp - 0x1c], 0x1a35a0
add dword [ebp - 0x1c], 0x41522bd5
mov dword [ebp - 0x18], 0x392d03c6
sub dword [ebp - 0x18], 0xd5bd975a
mov dword [ebp - 0x14], 0x570f6d9
sub dword [ebp - 0x14], 0x570f6d9
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xaac644b3
add eax, 0x557a3c21
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x399fa
push 0
call eax
mov ecx, 0x6df49723
sub ecx, 0x6df44366
xor edi, edi
add edi, eax
mov ebx, 0x411000
add ebx, dword [ebp - 0x10]
mov esi, 0x16127392
add esi, 0xd513bb01
xor dword [ebp - 8], eax
mov edx, dword [ebx]
add dword [ebp - 0xc], 0x9b8e1103
xor edx, esi
sub dword [ebp - 4], ebx
mov dword [edi], edx
add dword [ebp - 4], edx
add edi, 4
add ebx, 4
loop 0x402d19
add eax, 0x141c7
mov ebx, eax
add eax, 0xa0f7d747
sub eax, 0xa0f7d742
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40a0c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40a0d7
pop dword [ebp - 0x14]
mov eax, 0xc3756311
add eax, 0x3ccb3dc6
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3db4b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x47c8
xor ebx, ebx
add ebx, eax
mov edx, 0x82f927fb
sub edx, 0x82b5d3fb
add edx, dword [ebp - 0x14]
mov edi, 0x508b3040
xor dword [ebp - 8], edx
mov esi, dword [edx]
xor dword [ebp - 0xc], ebx
add esi, edi
sub dword [ebp - 8], 0xc9cc1388
mov dword [ebx], esi
add dword [ebp - 0xc], 0xe60749cf
add ebx, 4
add edx, 0xf37c122c
sub edx, 0xf37c1228
loop 0x40a127
add eax, 0xb7fe0143
sub eax, 0xb7fcef50
xor ebx, ebx
add ebx, eax
add eax, 0x4d01cc75
sub eax, 0x4d01cc70
mov ecx, 0xd45c39f8
add ecx, 0x2be3c608
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x100166d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100166e5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10016724
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10016720
lea ebx, [ebx]
cmp esi, edx
jae 0x10016724
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10016710
cmp esi, edx
jb 0x10016729
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x10016ca0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064978
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x100834b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
lea eax, [ebp + 8]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.10012c30
lea ecx, [ebp - 0x28]
call fcn.100177d0
mov esi, eax
add esp, 0x18
lea eax, [ebp + 8]
cmp eax, esi
je 0x10016d31
cmp dword [ebp + 0x1c], 0x10
jb 0x10016d16
push dword [ebp + 8]
call fcn.1002506b
add esp, 4
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
call fcn.10011e90
cmp dword [ebp - 0x14], 0x10
jb 0x10016d42
push dword [ebp - 0x28]
call fcn.1002506b
add esp, 4
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmovae eax, dword [ebp + 8]
push eax
call esi
test eax, eax
jne 0x10016d6c
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call esi
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 0x10
jb 0x10016d90
push dword [ebp + 8]
call fcn.1002506b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017420
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064ac0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x100834b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
lea eax, [ebp + 8]
mov dword [ebp - 0x14], 7
push eax
mov dword [ebp - 0x18], 0
call fcn.100122c0
sub esp, 0x18
mov byte [ebp - 4], 1
mov esi, esp
xor eax, eax
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.100122c0
mov ecx, esi
call fcn.10019f60
add esp, 0x18
call fcn.10016b40
add esp, 0x18
mov bl, al
cmp dword [ebp - 0x14], 8
jb 0x100174c3
push dword [ebp - 0x28]
call fcn.1002506b
add esp, 4
test bl, bl
jne 0x100174cb
mov bl, 1
jmp 0x100174f9
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0x80
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x1001750a
push dword [ebp + 8]
call fcn.1002506b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018d80
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064f30
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae eax, dword [ebp + 8]
push eax
movzx eax, cx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x10018e35
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x10018e35
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10018e35
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x10018e35
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp + 0x20]
push 0
cmovae ecx, dword [ebp + 0x20]
push 0
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x10018e89
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
cmp dword [ebp + 0x1c], 0x10
jb 0x10018e48
push dword [ebp + 8]
call fcn.1002506b
add esp, 4
cmp dword [ebp + 0x34], 0x10
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
jb 0x10018e6b
push dword [ebp + 0x20]
call fcn.1002506b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002fef0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
lea eax, [ebp + 0x20]
mov ecx, esp
push eax
call fcn.10012d60
call fcn.10016b40
add esp, 0x18
mov bl, al
jmp 0x10018e37

Function at 0x10018eb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x1c], 0x10
push ebx
push esi
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x24]
push eax
movzx eax, cx
push eax
push edi
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x10018f2c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x10018f2c
cmp dword [ebp - 8], 0
jne 0x10018eff
mov eax, dword [ebp - 4]
mov bl, 1
mov dword [eax], esi
jmp 0x10018f2e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10018f2c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x10018f2c
push esi
push eax
mov eax, dword [ebp - 4]
push dword [eax]
push dword [ebp - 8]
call fcn.10030e92
add esp, 0x10
mov bl, 1
jmp 0x10018f2e
xor bl, bl
cmp dword [ebp + 0x1c], 0x10
jb 0x10018f3f
push dword [ebp + 8]
call fcn.1002506b
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006534a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.1004d76c
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x100193b6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.1003f0a3
push 0x10080bf0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.10031376
push edi
push esi
call fcn.1004a564
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002fef0
mov esp, ebp
pop ebp
ret 4

Function at 0x100193e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006534a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x18], esi
call fcn.1004d76c
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x10019486
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.1003f0a3
push 0x10080bf0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.10031376
push edi
push 0x3f
push esi
call fcn.1004c2f0
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002fef0
mov esp, ebp
pop ebp
ret 8

Function at 0x1001a4a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x1001a4d1
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1001a4c0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1001acd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x1001ad01
lea ecx, [ecx]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1001acf0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x1001d1a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1001d1ab
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x1001d275
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
dec edi
jne 0x1001d1c0
pop edi
test esi, esi
je 0x1001d29a
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
dec esi
jne 0x1001d280
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x1001d2b0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
and eax, 0xff
shr esi, 8
mov eax, dword [eax*4 + 0x10076460]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x10076460]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x1001d300
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
push esi
mov bl, dl
mov edx, ecx
push edi
mov edi, dword [edx + 8]
mov esi, edi
mov ecx, dword [edx]
and esi, 0xfffd
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
shr eax, 8
xor bl, al
movsx eax, bl
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x10076460]
xor eax, ecx
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, edi
shr edi, 8
and eax, 0xff
xor edi, dword [eax*4 + 0x10076460]
mov al, bl
mov dword [edx + 8], edi
pop edi
pop esi
pop ebx
ret
Function at 0x1001da70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x1001dab6
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001dab1
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x1001dade
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x1001dac7
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 8]
call fcn.100373e0
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
mov ecx, dword [ebp - 4]
xor edx, edx
pop edi
div ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1002fef0
mov esp, ebp
pop ebp
ret

Function at 0x1001db00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
mov edi, 1
cmp byte [esi], 0
je 0x1001db45
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 5]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001db40
mov byte [esi + 8], 1
mov edi, dword [ebp - 0xc]
jmp 0x1001db72
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x1001db56
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 5]
push eax
call fcn.100373e0
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 0xc]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x1001db90
movzx eax, byte [ebp - 5]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002fef0
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x1001db7d
cmp byte [esi + 8], 0
je 0x1001db7d
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002fef0
mov esp, ebp
pop ebp
ret
Function at 0x1001dc50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x1001dc99
cmp byte [edi + 1], 0
je 0x1001dc87
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1001dc9f
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002fef0
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], eax
cmp byte [edi], 0
push ebx
je 0x1001dcc4
cmp byte [edi + 1], 0
je 0x1001dcbd
push 1
push 0
push 0
push dword [edi + 4]
call ecx
mov ebx, eax
sub ebx, dword [edi + 0xc]
jmp 0x1001dcc7
xor ebx, ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001dcd6
mov ebx, dword [edi + 0x1c]
mov eax, 0xffff
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
cmp ebx, eax
jae 0x1001dcd9
mov dword [ebp - 0x10], ebx
push esi
push 0x404
call fcn.100312e4
mov esi, eax
add esp, 4
test esi, esi
jne 0x1001dd01
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002fef0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov eax, 4
mov dword [ebp - 0xc], 0xffffffff
cmp ecx, eax
jbe 0x1001de08
jmp 0x1001dd20
add eax, 0x400
cmp eax, ecx
mov edx, eax
mov eax, 0x404
cmova edx, ecx
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x20], edx
sub ebx, ecx
mov dword [ebp - 0x1c], ecx
cmp ebx, 0x404
cmova ebx, eax
cmp byte [edi], 0
je 0x1001dd6a
cmp byte [edi + 1], 0
je 0x1001de08
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1001dd6d
mov dword [edi + 0x1c], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0x18], ebx
je 0x1001dd95
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001dd90
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x1001ddbe
mov edx, dword [edi + 0x1c]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
jbe 0x1001dda8
mov ecx, dword [edi + 0x18]
sub ecx, edx
mov dword [ebp - 0x18], ecx
push ecx
mov ecx, dword [edi + 0x14]
add ecx, edx
push ecx
push esi
call fcn.100373e0
mov eax, dword [ebp - 0x18]
add esp, 0xc
add dword [edi + 0x1c], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x1001de08
lea eax, [ebx - 3]
test eax, eax
js 0x1001ddf0
mov edi, edi
dec eax
cmp byte [eax + esi], 0x50
jne 0x1001ddec
cmp byte [eax + esi + 1], 0x4b
jne 0x1001ddec
cmp byte [eax + esi + 2], 5
jne 0x1001ddec
cmp byte [eax + esi + 3], 6
je 0x1001de25
test eax, eax
jns 0x1001ddd0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x1001de08
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
cmp eax, ecx
jb 0x1001dd20
push esi
call fcn.10030963
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 0xc]
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.1002fef0
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
jmp 0x1001ddf3