joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65c1c520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x65da0168]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65c1c72a
sub esp, 0x68
movzx eax, byte [esp + 0x88]
test al, al
je 0x65c1c6da
mov ecx, dword [esp + 0x8c]
test ecx, ecx
sete dl
mov ebx, dword [esp + 0x90]
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x65c1c5ea
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x34], ebx
movzx eax, al
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x19
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.65c18de0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x65c1c66c
mov edx, dword [esp + 0x78]
mov dword [esp + 0x48], edx
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x4c], ebp
mov esi, dword [esp + 0x80]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x84]
mov dword [esp + 0x54], esi
movzx eax, al
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ebx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x30
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 4
call fcn.65c18de0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x89]
test bl, bl
je 0x65c1c6c1
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x44], ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov byte [esp + 0xc], 0x22
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.65c18de0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x68
ret
call fcn.65bf6720
lea eax, [0x65c8d943]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.65bf6f80
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
call fcn.65bf6c70
call fcn.65bf6920
call fcn.65bf6780
lea eax, [0x65c94ed1]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.65c26c40
nop
call fcn.65c2b2c0
jmp fcn.65c1c520
Function at 0x65c22950
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x34
mov eax, dword [esp + 0x38]
test eax, eax
je 0x65c22a50
mov eax, dword [0x65da0168]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x28], eax
mov ecx, dword [eax + 0x98]
mov edx, dword [eax + 0x9c]
lea ebx, [eax + 0x1d0]
mov dword [esp + 0x30], ebx
lea ebp, [eax + 0x318]
mov dword [esp + 0x2c], ebp
add ecx, 1
mov dword [eax + 0x98], ecx
adc edx, 0
mov dword [eax + 0x9c], edx
mov ecx, dword [eax + 0xa8]
mov dword [ecx], 0
call fcn.65c26f60
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.65bf3810
mov eax, dword [esp + 0x28]
mov byte [eax + 0x8c], 1
inc dword [eax + 0xa0]
mov ecx, dword [esp + 0x38]
mov dword [esp], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 4], edx
call fcn.65c2c350
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
mov byte [ecx + 0x8c], 0
dec dword [ecx + 0xa0]
nop
mov edx, dword [esp + 0x2c]
mov dword [esp], edx
mov dword [esp + 4], 0
call fcn.65c30dc0
lea edi, [esp + 0xc]
mov esi, dword [esp + 0x30]
call fcn.65c2cd94
call fcn.65c27110
mov eax, dword [0x65da0168]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
test byte [eax], al
lea edi, [eax + 0x1d0]
lea esi, [esp + 0xc]
call fcn.65c2cd94
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
add esp, 0x34
ret
lea eax, [0x65c8c93e]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.65c26c40
nop
int3
Function at 0x65c28fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x65da0168]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65c2911a
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x65c29110
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x65c28ffa
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x65c28ffa
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x65c2900d
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x65c290e7
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x65c290db
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x65c290d2
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x65c29060
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x65c290a3
mov eax, 1
cmp eax, ecx
ja 0x65c29097
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.65c2c7d0
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x65c290cd
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x65c2909c
mov ecx, dword [esp + 0xc]
jmp 0x65c29065
call fcn.65c2c770
xor eax, eax
mov ecx, eax
call fcn.65c2c760
call fcn.65c2c7d0
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x65c2910b
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x65c290e0
mov ecx, dword [esp + 0x18]
jmp 0x65c29012
call fcn.65c2c770
xor eax, eax
mov ecx, eax
call fcn.65c2c760
nop
call fcn.65c2b2c0
jmp fcn.65c28fa0
Function at 0x65c2a590
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x65da0168]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65c2a62b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x65da0168]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.65c2c8b7
lea ecx, [0x65c16880]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.65c2b1d0
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.65c2b2c0
jmp fcn.65c2a590
Function at 0x65c2c570
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x65da03a0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x65c2ad1b
je 0x65c2ad6e
cmp ebx, 0x20
jbe 0x65c2ad74
cmp ebx, 0x40
jbe 0x65c2adba
jmp 0x65c2ae5b
test ebx, ebx
je 0x65c2ad64
add eax, 0x10
test ax, 0xff0
je 0x65c2ad50
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x65d0dd20]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x65d0de20]
jmp 0x65c2ad38
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x65c2ad38
pxor xmm1, xmmword [0x65da03b0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x65da03b0]
pxor xmm2, xmmword [0x65da03c0]
pxor xmm3, xmmword [0x65da03d0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x65da03b0]
pxor xmm2, xmmword [0x65da03c0]
pxor xmm3, xmmword [0x65da03d0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x65c2aeba
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x65d9fc05], 0
je 0x65c2c58a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x65c2ace0
jmp fcn.65bc8e00
Function at 0x65c2c590
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x65da0168]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65bc3c3c
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.65bc8e00
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.65c2b2c0
jmp 0x65bc3c00
cmp byte [0x65d9fc05], 0
je 0x65c2c5ab
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x65c2ace0
jmp 0x65bc3c00
Function at 0x65c4b370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x65da0168]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65c4b46a
sub esp, 0x20
mov ecx, dword [esp + 0x24]
test byte [ecx], al
mov edx, dword [esp + 0x28]
mov ebx, edx
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x1c], ecx
xor eax, eax
jmp 0x65c4b3b0
mov ebp, dword [esp + 0x14]
inc ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, ebp
cmp eax, 4
jge 0x65c4b3e9
mov dword [esp + 0x14], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.65bc15d0
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x2c]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x65c4b3a3
mov byte [esp + 0x30], 1
add esp, 0x20
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x65c4b3f3
inc eax
cmp eax, 4
jge 0x65c4b409
mov dword [esp + 0x18], eax
lea ebp, [ecx + eax*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
xor edi, edi
jmp 0x65c4b463
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.65bc1610
mov byte [esp + 0x30], 0
add esp, 0x20
ret
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
and esi, 0xff
xor edx, esi
mov esi, dword [esp + 0xc]
shr esi, 8
shl ebp, 0x18
mov eax, edx
mov ebx, 0x1b3
mul ebx
inc edi
or esi, ebp
mov ebp, dword [esp + 0x10]
shr ebp, 8
mov ebx, dword [esp + 0x28]
mov edx, eax
mov eax, dword [esp + 0x18]
cmp edi, 8
jl 0x65c4b42c
jmp 0x65c4b3f2
call fcn.65c2b2c0
jmp fcn.65c4b370
Function at 0x65c64e00
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.65c66410
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.65c66410
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x65c64e60
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x65da61c4]
test esi, esi
jle 0x65c64f80
mov eax, dword [0x65da61c8]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x65c64e94
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x65c64f17
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x65c64e80
mov dword [esp], ebx
call fcn.65c655a0
mov edi, eax
test eax, eax
je 0x65c64fa7
mov eax, dword [0x65da61c8]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.65c656e0
mov edx, dword [0x65da61c8]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x65c64f87
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x65c64f10
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x65c64f20
add dword [0x65da61c4], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x65da61c8]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x65c64f10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.65c64e00
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x65c64e9e
mov eax, dword [0x65da61c8]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.65c64e00
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.65c64e00
lea esi, [esi]
nop
Function at 0x65c65220
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x65da61d4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x65da61cc]
sub esp, 4
test ebx, ebx
je 0x65c65275
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x65c6526e
test esi, esi
je 0x65c6526e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x65c65250
mov dword [esp], 0x65da61d4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x65c655a0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x65bc0000], 0x5a4d
jne 0x65c655c5
mov ecx, dword [0x65bc003c]
cmp dword [ecx + 0x65bc0000], 0x4550
lea edx, [ecx + 0x65bc0000]
je 0x65c655d0
ret
cmp word [ecx + 0x65bc0018], 0x10b
jne 0x65c655c5
push esi
movzx eax, word [ecx + 0x65bc0014]
push ebx
movzx esi, word [ecx + 0x65bc0006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x65bc0000
test esi, esi
je 0x65c65618
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x65c6560e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x65c6561a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x65c65600
xor eax, eax
pop ebx
pop esi
ret
Function at 0x401090
Capabilities:
Get memory capacity
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x455664]
xor eax, esp
mov dword [esp + 0x44], eax
push 0x40
lea eax, [esp + 4]
push 0
push eax
call fcn.004353b0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp eax, 1
jne 0x4010e9
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
shrd ecx, eax, 0x14
shr eax, 0x14
test eax, eax
ja 0x4010f1
jb 0x4010e9
cmp ecx, 0x309
jae 0x4010f1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0042dcb6
mov esp, ebp
pop ebp
ret

Function at 0x4046f0
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0x404788
mov eax, dword [ebx]
push 0x40
push eax
push esi
call fcn.0042fd80
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0x4047b9
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4047b9
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0x404788
mov ecx, dword [ebx]
push edi
push 0xf8
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
call fcn.0042fd80
add esp, 0xc
cmp dword [edi], 0x4550
jne 0x4047b2
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0x4047b2
movzx eax, word [esi + 0x46]
test ax, ax
je 0x4047b2
lea edi, [eax + eax*4]
add edi, edi
add edi, edi
add edi, edi
push edi
mov dword [esi + 0x140], edi
call fcn.0042dd50
add esp, 4
mov dword [esi + 0x138], eax
test eax, eax
jne 0x40478e
mov eax, 3
pop edi
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
push ebx
lea ecx, [ecx + edx + 0x18]
push edi
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.00404d70
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop edi
ret
mov eax, 2
pop edi
ret
mov eax, 2
ret
Function at 0x40bae0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x40bae7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x40bbbd
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f308]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f308]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f308]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f308]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f308]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f308]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f308]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f308]
add ecx, 8
sub edx, 8
dec esi
jne 0x40bb00
pop edi
test edx, edx
je 0x40bbda
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x44f308]
inc ecx
dec edx
jne 0x40bbc1
not eax
pop esi
ret

Function at 0x40bbe0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x44f308]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x44f308]
mov dword [edx + 8], ecx
ret

Function at 0x40bc30
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x44f308]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x44f308]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0x420e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441e98
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x455664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x420e7c
xor eax, eax
jmp 0x421001
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x420ea5
mov eax, dword [edi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x420ea5
dec dword [eax]
mov edi, dword [edi + 0x24]
mov eax, dword [edi]
lea ecx, [eax + 1]
mov dword [edi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x421001
cmp dword [edi + 0x54], 0
je 0x420ffe
mov ecx, dword [edi + 0x10]
lea edx, [edi + 0x48]
cmp dword [ecx], edx
jne 0x420ecd
mov edx, dword [edi + 0x3c]
mov eax, dword [edi + 0x40]
mov dword [ecx], edx
mov ecx, dword [edi + 0x20]
mov dword [ecx], eax
mov edx, dword [edi + 0x30]
sub eax, eax
mov dword [edx], eax
cmp dword [edi + 0x44], 0
jne 0x420ef3
mov edi, dword [edi + 0x54]
movsx eax, bl
push edi
push eax
call fcn.0042eae8
add esp, 8
cmp eax, 0xffffffff
je 0x420ffe
mov eax, ebx
jmp 0x421001
lea esi, [ebp - 0x2c]
mov byte [ebp - 0x2d], bl
call fcn.00421780
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
jmp 0x420f10
mov edx, eax
cmp ebx, 0x10
jae 0x420f1c
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
push edx
push eax
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x2d]
push edx
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x14]
call eax
test eax, eax
js 0x420ff6
cmp eax, 1
jg 0x420fb0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x420f5c
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
sub esi, ecx
je 0x420f85
cmp ebx, 0x10
jae 0x420f6b
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0042f70b
add esp, 0x10
cmp esi, eax
jne 0x420ff6
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x2d]
mov byte [edi + 0x49], 1
cmp dword [ebp - 0x38], edx
jne 0x420fe9
test esi, esi
jne 0x420f10
cmp dword [ebp - 0x1c], 0x20
jae 0x420ff6
push esi
lea ebx, [esi + 8]
lea esi, [ebp - 0x2c]
call fcn.00415510
jmp 0x420f05
cmp eax, 3
jne 0x420ff6
mov edi, dword [edi + 0x54]
movsx eax, byte [ebp - 0x2d]
push edi
push eax
call fcn.0042eae8
add esp, 8
cmp eax, 0xffffffff
je 0x420fda
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.00408fe0
mov eax, esi
jmp 0x421001
lea ecx, [ebp - 0x2c]
or esi, 0xffffffff
call fcn.00408fe0
mov eax, esi
jmp 0x421001
lea ecx, [ebp - 0x2c]
call fcn.00408fe0
mov eax, dword [ebp + 8]
jmp 0x421001
lea ecx, [ebp - 0x2c]
call fcn.00408fe0
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042dcb6
mov esp, ebp
pop ebp
ret 4