joyce8/EMBER2024-capa huggingface dataset:
Function at 0x525680
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x64916c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.005530d0
add esp, 4
test eax, eax
je 0x5258d8
mov eax, dword [0x6b418c]
test eax, eax
je 0x5256b9
push eax
call fcn.00565600
add esp, 4
push ebx
push esi
push 0x9d02
call fcn.00565530
mov esi, eax
push 0x9d02
push 0
push esi
mov dword [ebp - 0xd0], esi
mov dword [0x6b418c], esi
call fcn.0059ea70
push 1
push 0x5c9acc
call fcn.00552e20
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x5258d1
push edi
jmp 0x525706
mov esi, dword [ebp - 0xd0]
push 0
push ebx
push 1
push 0x5c983c
call fcn.0052fc40
add esp, 0x10
test eax, eax
je 0x5258b8
mov ecx, eax
imul ecx, ecx, 0x9a
push 0x6b7d14
push ebx
lea esi, [ecx + esi - 0x9a]
push 1
push 0x5c9ac0
mov word [esi], ax
call fcn.00552ee0
add esp, 0x10
test eax, eax
je 0x525795
push 0xc8
lea edx, [ebp - 0xcc]
push 0
push edx
call fcn.0059ea70
push 8
lea eax, [ebp - 0xcc]
push eax
push 0x6b7d14
call fcn.0052ff30
add esp, 0x18
cmp eax, 8
jg 0x525795
xor ecx, ecx
test eax, eax
jle 0x525795
lea edx, [esi + 2]
mov di, word [ebp + ecx*4 - 0xcc]
mov word [edx], di
inc ecx
add edx, 2
cmp ecx, eax
jl 0x525782
push 0x6b7d14
push ebx
push 1
push 0x5c9ab0
call fcn.00552ee0
add esp, 0x10
test eax, eax
je 0x525803
push 0xc8
lea ecx, [ebp - 0xcc]
push 0
push ecx
call fcn.0059ea70
push 8
lea edx, [ebp - 0xcc]
push edx
push 0x6b7d14
call fcn.0052ff30
add esp, 0x18
cmp eax, 8
jg 0x525803
xor ecx, ecx
test eax, eax
jle 0x525803
lea edx, [esi + 0x12]
jmp 0x5257f0
mov di, word [ebp + ecx*4 - 0xcc]
mov word [edx], di
inc ecx
add edx, 2
cmp ecx, eax
jl 0x5257f0
push 0x6b7d14
push ebx
push 1
push 0x5c9aa4
xor edi, edi
call fcn.00552ee0
add esp, 0x10
test eax, eax
je 0x5258b8
add esi, 0x24
cmp edi, 6
jge 0x5258b8
push 0xc8
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.0059ea70
push 6
lea ecx, [ebp - 0xcc]
push ecx
push 0x6b7d14
call fcn.0052ff30
add esp, 0x18
cmp eax, 6
jne 0x5258b8
mov dx, word [ebp - 0xcc]
mov word [esi - 2], dx
mov ax, word [ebp - 0xc8]
mov word [esi], ax
mov ecx, dword [ebp - 0xc4]
mov dword [esi + 2], ecx
mov edx, dword [ebp - 0xc0]
mov dword [esi + 6], edx
mov eax, dword [ebp - 0xbc]
push 0x6b7d14
inc edi
mov dword [esi + 0xa], eax
mov ecx, dword [ebp - 0xb8]
push ebx
lea edx, [edi + 1]
push edx
mov dword [esi + 0xe], ecx
push 0x5c9aa4
add esi, 0x14
call fcn.00552ee0
add esp, 0x10
test eax, eax
jne 0x525825
push ebx
push 0x5c9acc
call fcn.00552e80
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x525700
pop edi
call fcn.005532c0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059ea5e
mov esp, ebp
pop ebp
ret
Function at 0x53f0c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x24], eax
mov dword [ecx + 4], 1
mov dword [ecx], reloc.MSVCRT.dll_strncpy
xor eax, eax
jmp 0x53f0f0
xor byte [eax + ecx], 0xcc
inc eax
cmp eax, 0x428
jl 0x53f0f0
pop ebp
ret

Function at 0x545f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5004
call fcn.005a0040
mov eax, dword [0x64916c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, reloc.MSVCRT.dll_strncpy
push edx
call fcn.005a00ef
lea eax, reloc.MSVCRT.dll_strncpy
add esp, 0xc
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x545fc5
mov cx, word [0x5c0afc]
mov dl, byte [0x5c0afe]
push esi
mov esi, dword [0x6b728c]
mov word [eax], cx
mov byte [eax + 2], dl
test esi, esi
je 0x546017
lea eax, reloc.MSVCRT.dll_strncpy
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x545ff4
push esi
sub eax, edx
push 1
push eax
lea eax, reloc.MSVCRT.dll_strncpy
push eax
call fcn.005a18ea
add esp, 0x10
or byte [0x6b7298], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0059ea5e
mov esp, ebp
pop ebp
ret

Function at 0x548880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esi + 0x22]
push edi
mov eax, dword [esi + 0x62]
mov edi, dword [esi + 0x32]
mov ecx, dword [esi + 0x6a]
sub edi, eax
sub edi, ecx
jne 0x5488a0
test eax, eax
jne 0x5488ac
test ecx, ecx
jne 0x5488ac
mov edi, ebx
jmp 0x548919
cmp edi, reloc.MSVCRT.dll_strncpy
jne 0x5488ac
mov edi, GetInterfaceInfo
jmp 0x548919
mov ecx, dword [esi + 0x22]
lea edx, reloc.MSVCRT.dll_strncpy
cmp eax, edx
jb 0x548919
mov eax, dword [esi + 0x2e]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0059eca0
mov edx, dword [esi + 0x42]
mov eax, dword [esi + 0x3a]
sub dword [esi + 0x66], ebx
sub dword [esi + 0x62], ebx
add esp, 0xc
sub dword [esi + 0x52], ebx
lea ecx, [eax + edx*2]
lea ecx, [ecx]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x5488ef
sub eax, ebx
jmp 0x5488f1
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x5488e0
mov ecx, dword [esi + 0x36]
mov edx, ebx
lea ecx, [ecx + ebx*2]
nop
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x54890f
sub eax, ebx
jmp 0x548911
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x548900
add edi, ebx
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x548973
mov edx, dword [esi + 0x6a]
add edx, dword [esi + 0x62]
mov ecx, edi
add edx, dword [esi + 0x2e]
mov edi, eax
push edx
call fcn.00548630
add dword [esi + 0x6a], eax
mov edx, dword [esi + 0x6a]
add esp, 4
cmp edx, 3
jb 0x54895f
mov edi, dword [esi + 0x62]
add edi, dword [esi + 0x2e]
mov ecx, dword [esi + 0x4e]
movzx eax, byte [edi]
mov dword [esi + 0x3e], eax
shl eax, cl
movzx ecx, byte [edi + 1]
xor eax, ecx
and eax, dword [esi + 0x4a]
mov dword [esi + 0x3e], eax
cmp edx, 0x106
jae 0x548973
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x548885
pop edi
pop ebx
ret
Function at 0x549980
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x54999c
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x549aa7
jmp 0x5499b0
mov eax, ebx
cmp ebx, 0x15b0
jb 0x5499bf
mov eax, 0x15b0
sub ebx, eax
mov dword [ebp + 0x10], ebx
cmp eax, 0x10
jl 0x549a6c
mov edx, eax
shr edx, 4
mov ebx, edx
neg ebx
shl ebx, 4
add eax, ebx
jmp 0x5499e0
movzx ebx, byte [esi]
add ecx, ebx
movzx ebx, byte [esi + 1]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 2]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 3]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 4]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 5]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 6]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 7]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 8]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 9]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xa]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xb]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xc]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xd]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xe]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xf]
add edi, ecx
add ecx, ebx
add edi, ecx
add esi, 0x10
dec edx
jne 0x5499e0
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x549a7b
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
dec eax
jne 0x549a70
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
jne 0x5499b0
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
pop ebp
ret
Function at 0x54ea30
Capabilities:
Encode data using xor

Disassembly:
call fcn.00564360
mov edx, dword [0x6b7554]
mov ecx, eax
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [0x6b7558]
add eax, edx
mov edx, dword [0x6b7550]
cmp eax, edx
jl fcn.0054ea30
mov dword [0x5e3fc0], eax
sub eax, edx
mov dword [0x6b7554], ecx
mov dword [0x6b7558], eax
ret

Function at 0x567b0a
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
xor byte [esi], al
inc esi
dec ecx
jne 0x567b18
pop esi
leave
ret

Function at 0x567c1b
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov ecx, 8
xor esi, esi
mov eax, dword [esi + reloc.MSVCRT.dll_strncpy]
mov edx, eax
xor eax, dword [esi + reloc.MSVCRT.dll_strncpy]
and eax, dword [esi + reloc.MSVCRT.dll_strncpy]
mov dword [esi + 0x6b8788], edx
mov dword [esi + 0x6b87c8], eax
add esi, 4
dec ecx
jne 0x567c24
pop edi
pop esi
ret
Function at 0x56f620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x56f6b6
push ebx
push esi
mov esi, dword [ecx]
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov esi, dword [ecx + 4]
xor eax, eax
push edi
cmp esi, edx
jle 0x56f66e
mov edi, dword [ecx]
movzx edi, byte [edi + edx]
mov ebx, eax
shr ebx, 0x18
xor edi, ebx
shl eax, 8
xor eax, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
inc edx
cmp edx, esi
jl 0x56f650
xor edx, edx
mov esi, dword [ecx + 0xc]
cmp esi, edx
jle 0x56f692
mov edi, dword [ecx + 8]
movzx edi, byte [edi + edx]
mov ebx, eax
shr ebx, 0x18
xor edi, ebx
shl eax, 8
xor eax, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
inc edx
cmp edx, esi
jl 0x56f675
mov edx, dword [ecx]
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
pop edi
shr eax, 0x18
pop esi
mov byte [ecx + 0x19], al
pop ebx
pop ebp
ret
Function at 0x583e20
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x583e50
push esi
call fcn.00584330
mov al, byte [esi + 0x48]
add esp, 4
test al, al
je 0x583e49
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x583ed6
mov eax, dword [esi + reloc.MSVCRT.dll_strncpy]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x583ebf
mov eax, dword [esi + 8]
test eax, eax
je 0x583e74
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + reloc.MSVCRT.dll_strncpy]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x583ebb
cmp eax, 2
je 0x583ebf
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x583e67
cmp eax, 3
je 0x583e9a
cmp eax, 1
jne 0x583e67
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x583e67
mov edx, dword [esi + reloc.MSVCRT.dll_strncpy]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x583e67
xor al, al
pop esi
ret
mov eax, dword [esi + 0x84]
push esi
mov dword [esi + 0x8c], eax
call fcn.00583f10
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x583ef6
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.00583f10
add esp, 4
pop esi
ret
Function at 0x595f80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bc2bc
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x64916c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov dword [esi], 0x5cc83c
mov dword [ebp - 4], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [ebp - 4], 4
cmp esi, 0x6b88b0
je 0x596025
cmp dword [0x6b8920], 2
je 0x596025
mov dword [ebp - 0x1c], 0x5cc72c
mov dword [ebp - 0x18], 0x595970
mov byte [ebp - 0x14], bl
lea eax, [ebp - 0x1c]
push eax
push 0x6b8920
mov byte [ebp - 4], 5
call fcn.005989a0
add esp, 8
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.00597da0
xor eax, eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x59c810
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x64916c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 8], esi
push edi
mov edi, dword [ebp + 0x10]
cmp dword [edx], esi
je 0x59c8b8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov ecx, dword [edi]
push ebx
cmp eax, 0x80
jb 0x59c857
mov bl, al
or bl, 0x80
mov byte [ecx], bl
shr eax, 7
inc ecx
cmp eax, 0x80
jae 0x59c845
mov byte [ecx], al
inc ecx
mov dword [edi], ecx
mov eax, dword [edx + 0xc]
cmp eax, 0x80
jb 0x59c878
mov bl, al
or bl, 0x80
mov byte [ecx], bl
shr eax, 7
inc ecx
cmp eax, 0x80
jae 0x59c866
mov byte [ecx], al
inc ecx
mov dword [edi], ecx
cmp dword [edx], esi
jle 0x59c8b7
mov ecx, dword [edx + 8]
mov eax, dword [ecx + esi*8 + 8]
mov ebx, dword [edi]
mov ecx, dword [ecx + esi*8 + 0xc]
push ebx
mov edx, ecx
mov ebx, ecx
shld ecx, eax, 1
sar ebx, 0x1f
sar edx, 0x1f
add eax, eax
xor ebx, ecx
xor edx, eax
push ebx
push edx
call fcn.005989f0
mov edx, dword [ebp + 8]
inc esi
add esp, 0xc
mov dword [edi], eax
cmp esi, dword [edx]
jl 0x59c881
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0059ea5e
mov esp, ebp
pop ebp
ret

Function at 0x5b59b0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movzx ecx, byte [ebp + 8]
mov eax, dword [0x6bb960]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + reloc.MSVCRT.dll_strncpy]
mov ecx, dword [0x6bb968]
mov dword [0x6bb960], eax
movzx eax, al
add eax, dword [0x6bb964]
imul eax, eax, 0x8088405
inc eax
mov dword [0x6bb964], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + reloc.MSVCRT.dll_strncpy]
mov dword [0x6bb968], ecx
pop ebp
ret
Function at 0x5b5a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x64916c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push 0xc
lea eax, [ebp - 0x10]
push eax
push ecx
call fcn.00564ff0
add esp, 0xc
cmp eax, 0xc
jne 0x5b5ae8
push esi
xor esi, esi
lea ebx, [ebx]
call fcn.005b5a10
mov dl, al
xor dl, byte [ebp + esi - 0x10]
mov byte [ebp - 0x14], dl
mov eax, dword [ebp - 0x14]
push eax
call fcn.005b59b0
mov byte [ebp + esi - 0x10], dl
inc esi
add esp, 4
cmp esi, 0xc
jl 0x5b5ab0
mov eax, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059ea5e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0059ea5e
mov esp, ebp
pop ebp
ret

Function at 0x5b5b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x5b5b31
push esi
mov esi, dword [ebp + 8]
nop
dec edi
call fcn.005b5a10
mov dl, al
xor dl, byte [esi]
mov byte [ebp + 0xc], dl
mov eax, dword [ebp + 0xc]
push eax
call fcn.005b59b0
mov byte [esi], dl
add esp, 4
inc esi
test edi, edi
jg 0x5b5b10
pop esi
pop edi
pop ebp
ret
Function at 0x5b66d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x64916c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
xor eax, eax
xor edx, edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov word [ebp - 8], dx
cmp dword [ebp + 0xc], esi
jne 0x5b6705
mov dword [ebp - 0x1c], reloc.MSVCRT.dll_strncpy
mov dword [ebp - 0x18], eax
jmp 0x5b672a
mov dword [ebp - 0x1c], reloc.MSVCRT.dll_strncpy
mov dword [ebp - 0x18], 1
mov eax, 4
mov dl, al
add dl, dl
lea ecx, [edx + eax - 0x5b]
xor byte [ebp + eax - 0x1c], cl
inc eax
cmp eax, 0x16
jb 0x5b6718
mov eax, dword [ebp + 8]
push 0x16
lea edx, [ebp - 0x1c]
push edx
push eax
call fcn.00565020
add esp, 0xc
cmp eax, 0x16
mov eax, 1
je 0x5b6748
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0059ea5e
mov esp, ebp
pop ebp
ret

Function at 0x5b6a90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jl 0x5b6b71
mov edx, esi
shr edx, 3
mov ecx, edx
neg ecx
lea esi, [esi + ecx*8]
mov ecx, dword [ebp + 0xc]
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
add ecx, 8
dec edx
jne 0x5b6ab5
pop edi
jmp 0x5b6b74
mov ecx, dword [ebp + 0xc]
test esi, esi
je 0x5b6b99
jmp 0x5b6b80
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll_strncpy]
inc ecx
dec esi
jne 0x5b6b80
not eax
pop esi
pop ebp
ret

Function at 0x5b6bf0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movzx ecx, byte [ebp + 8]
mov eax, dword [0x6bb950]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + reloc.MSVCRT.dll_strncpy]
mov ecx, dword [0x6bb958]
mov dword [0x6bb950], eax
movzx eax, al
add eax, dword [0x6bb954]
imul eax, eax, 0x8088405
inc eax
mov dword [0x6bb954], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + reloc.MSVCRT.dll_strncpy]
mov dword [0x6bb958], ecx
pop ebp
ret
Function at 0x5b6c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x5b6ca4
push ebx
push esi
mov esi, dword [ebp + 8]
mov bl, byte [esi]
dec edi
mov byte [ebp + 0xc], bl
call fcn.005b6c50
mov dl, al
mov eax, dword [ebp + 0xc]
push eax
call fcn.005b6bf0
xor dl, bl
mov byte [esi], dl
add esp, 4
inc esi
test edi, edi
jg 0x5b6c80
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x70df5e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [esp + 4]
shl bl, cl
jmp 0x70dfb3
bsf cx, si
jmp 0x70e056
jb 0x70e04d
bswap ecx
bsf eax, edi
jmp 0x70df9c
neg dx
jmp 0x70e06a
dec bh
call fcn.0070dff4
or dword [ebx - reloc.MSVCRT.dll_strncpy], 0xb51c
add byte [eax], al
xchg bx, dx
jmp 0x70e021
not edx
mov ecx, esi
cmc
jno 0x70dfd6
dec bh
jmp 0x70e036
lea esi, [esi - 0x1d]
xchg bh, al
bts dx, cx
sbb ebx, esi
xchg ah, dh
xchg dword [esp], esi
jmp 0x70e087
mov ax, 0x6cfc
mov eax, dword [esp]
mov dh, byte [esp]
jmp 0x70e063
bswap ecx
bsf eax, edi
bsf cx, si
sub esp, 0xbc
mov ebp, esp
setle ah
jmp 0x70e012
mov dl, 0xbf
jmp 0x70dfcc
sub esp, 3
jb 0x70e0b7
lea esp, [esp + 3]
jmp 0x70e0bb
cmc
clc
mov bx, word [esp]
mov eax, dword [esp]
bsr bx, cx
push dword [esp]
ret 4
xchg ebx, eax
mov ax, si
xchg ebx, edx
neg al
jb 0x70e178
jae 0x70e0d6
sub al, 0xb4
sub cl, byte [ebp - 0x44]
mov eax, dr4
mov dword [reloc.MSVCRT.dll_strncpy], eax
and al, 3
lea esp, [esp + 3]
rol esi, 0
jmp 0x70e09a
xchg dx, ax
jmp 0x70e181
mov edx, dword [esp]
not al
mov dl, 0xca
jmp 0x70e0c0
bsf ebx, esi
mov eax, 0xb5bea710
neg ah
jmp 0x70e131
jmp 0x70e0df
mov bx, si
jmp 0x70e153
rol esi, 0
mov edx, 0xcf943abd
neg ax
jae 0x70e0f7
mov bx, si
rdtsc
jmp 0x70e155
not ax
sub esp, 9
lea esp, [esp + 1]
jmp 0x70e10d
rdtsc
call fcn.0070e13d
jmp 0x70e1de
mov edx, 0xd5a4bdfd
jmp 0x70e1ba
mov edx, dword [esp]
not al
mov dl, 0xca
xchg dx, ax
add esi, 0x6fb5d0e4
mov eax, dword [esp]
neg ebx
jae 0x70e0f5
bsf ebx, esi
mov eax, 0xb5bea710
neg ah
not ax
sub esp, 9
jmp 0x70e137
mov dh, 0xe
jmp 0x70e206
mov dl, 0xf9
add esi, 0x794abe5
mov ebx, 0x6ca8c27e
neg bl
jmp 0x70e1fb
lea esp, [esp + 0xc]
add esi, 0x180af85f
bsf bx, di
jnp 0x70e15f
mov edx, 0xd5a4bdfd
mov dl, 0xf9
jmp 0x70e1bc
jge 0x70e1a4
mov dh, 0xe
call fcn.0070e7fb
inc edi
out dx, al
add esi, dword [edi]
xor bl, 0xbc
jmp 0x70e643
mov edx, eax
jmp 0x70e683
jnp 0x70e621
mov edx, eax
jmp 0x70e683
rdtsc
lea edx, reloc.MSVCRT.dll_strncpy
call fcn.0070e6d7
dec ebp
fisttp qword [ebp + 0x14]
out 0x53, eax
lodsb al, byte [esi]
mov edi, 0x1eb60f86
movzx ebx, byte [esi]
add ah, 0x81
jmp 0x70e68f
jle 0x70e66d
rdtsc
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0x70e675

Function at 0x70e13d
Capabilities:
Execute anti-debugging instructions

Disassembly:
and al, 1
mov word [esp], si
rcl bx, 0xd
jbe 0x70e15a
ja 0x70e15a
std
jle 0x70e138
mov eax, dword [esi - reloc.MSVCRT.dll_strncpy]
or byte [edi], 0x31
Function at 0x70ee9e
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
jmp 0x71050d
mov edx, dword [esp]
mov eax, dword [esp]
jmp 0x70ef42
jmp 0x70ef8e
mov ebx, 0xa781e126
cmc
js 0x70ef6c
xchg bx, dx
jmp 0x70ef6f
add eax, 0xe70c7b2f
jmp 0x70f6bb
mov dx, bx
sub edi, 4
bts dx, si
jns 0x70ef27
mov dl, byte [esp]
and dx, ax
jmp 0x70ef94
mov dword [edi], eax
rdtsc
rol ax, cl
ja 0x70ef71
not bh
jmp fcn.0070efaf
xchg bx, dx
jmp 0x70ef56
not bh
jmp fcn.0070efaf
add eax, 0xf070ea91
jmp 0x70f6c0
mov dl, byte [esp]
and dx, ax
mov eax, dword [ebx + ebp]
jmp 0x70ef29
and ebx, 0x3c
btc eax, esi
jae 0x70ef1f
mov edx, dword [esp]
call fcn.0070eea6
xchg dx, bx
mov bl, 0x44
not dh
mov dx, 0x3c71
jmp 0x70f714
clc
rdtsc
setb al
jmp 0x70f1be
clc
rdtsc
setb al
jmp 0x70f019
mov dword [esp + 0x1c], ebx
mov edx, ebp
popal
jmp 0x70f657
neg cx
jmp 0x70f626
not dx
lea edx, [esi*4]
jmp 0x70ef36
setns dh
mov dh, 0x38
shl eax, 2
neg dx
jmp 0x70f668
jbe 0x70f641
not dx
lea edx, [esi*4]
jmp 0x70ef36
pushal
stc
jle 0x70f63c
neg cx
mov dword [esp + 0x1c], ebx
mov edx, ebp
popal
setns dh
jmp 0x70f65a
mov edx, edi
mov eax, dword [eax + reloc.MSVCRT.dll_strncpy]
mov edx, dword [esp]
jmp 0x70ef79
rcr dh, 5
jmp 0x70f6da
jmp 0x70f6e0
mov esp, ebp
push dx
mov edx, dword [esp]
mov edx, 0x114bdd11
add esp, 1
jmp 0x70f70c
jno 0x70f6a0
mov edx, edi
jmp 0x70f6a2
mov dl, byte [esp]
push cx
lea edx, [ebp*4]
lea esp, [esp + 2]
jmp 0x70f6c2
pop dword [esp + 1]
mov dword [esp + 0xc], esi
lea esp, [esp + 1]
jmp 0x70f68d
jns 0x70f72f
lea esp, [esp + 1]
jmp 0x70f733
ja 0x70f0e9
shr ah, cl
jbe 0x70f74b
ja 0x70f74b
and esp, dword [edx + edi + reloc.MSVCRT.dll_strncpy]
rol dword [ecx + 0x20], 1
shl dword [eax + edx*8 + 0x53], cl
retf 0x648d
lea esp, [esp + 1]
push eax
ret
call fcn.0070f735
mov eax, ebp
mov dl, ch
jmp 0x70f75a
mov ebx, dword [esp]
inc dx
jne 0x70f7cf
je 0x70f7cf
inc ebp
int 0x5d
and al, 0xd7
adc edx, ebp
pop esi
int3
jmp 0x70f6fe
mov dl, 0xee
sub bl, 0x47
sub esp, 0x1d
jo 0x70f771
pop dword [esp + 1]
mov dword [esp + 0xc], esi
lea esp, [esp + 1]
jmp 0x70f68d
lea ebx, [ebp + 0x40]
setle dl
jmp 0x70f7db
pushal
xchg dh, dl
sub ebx, eax
neg edx
jae 0x70f81a
adc dx, si
dec dh
jmp 0x70f81c
adc dx, si
dec dh
jmp 0x70f81c
jmp 0x70f804
lea edx, [edi - 0x80]
call 0x70f825
mov word [esp], si
mov word [esp], si
add esp, 1
jle 0x70f8a1
jg 0x70f85e
loopne 0x70f89f
std
test byte [edi - 0x3f], dh
bnd jle 0x70f825
mov eax, dword [esi - reloc.MSVCRT.dll_strncpy]
setne al
clc
jmp 0x70f7b4
push word [esp]
lea esp, [esp + 1]
jmp 0x70f8a9
xchg ecx, eax
adc byte [esi - 1], ah
xor al, 0x24
push word [esp]
lea esp, [esp + 1]
and dl, 0xfc
call fcn.0070f848
lea esp, [esp + 4]
neg bl
xor ax, di
jno 0x70f1b8
jo 0x70f076
inc eax
xchg dword [esp + 0x14], ecx
mov ax, 0x9882
neg ax
stc
mov al, dl
jmp 0x710587
mov ax, di
push dword [esp + 0x14]
ret 0x18