joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004ce20
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x56c
push ebx
push esi
push edi
push 0x40
lea eax, [esp + 0x44]
mov dword [esp + 0x18], edx
push 0
push eax
mov esi, ecx
call fcn.1007cff0
push 0xf8
lea eax, [esp + 0x90]
push 0
push eax
call fcn.1007cff0
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 0x18
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0xc]
push 0
push eax
push 0x40
lea eax, [esp + 0x4c]
push eax
push esi
call ebx
test eax, eax
je 0x1004cff9
mov eax, 0x5a4d
cmp word [esp + 0x40], ax
jne 0x1004cff9
push 0
push 0
push dword [esp + 0x84]
push esi
call edi
push 0
lea eax, [esp + 0x10]
push eax
push 0xf8
lea eax, [esp + 0x8c]
push eax
push esi
call ebx
test eax, eax
je 0x1004cff9
cmp dword [esp + 0x80], 0x4550
jne 0x1004cff9
xor eax, eax
xor edi, edi
cmp ax, word [esp + 0x86]
jae 0x1004cff9
mov dword [esp + 0x10], 0x4034b50
movzx eax, di
push 0
push 0
lea ecx, [eax + eax*4]
movzx eax, word [esp + 0x9c]
add eax, dword [esp + 0x84]
lea eax, [eax + ecx*8]
add eax, 0x18
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1004cff9
push 0
lea eax, [esp + 0x10]
push eax
push 0x28
lea eax, [esp + 0x24]
push eax
push esi
call ebx
test eax, eax
je 0x1004cff9
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x1004cfea
lea eax, [esp + 0x18]
cmp dword [eax], 0x7865742e
jne 0x1004cf5b
cmp byte [eax + 4], 0x74
je 0x1004cfea
lea eax, [esp + 0x18]
cmp dword [eax], 0x6164722e
jne 0x1004cf6f
cmp word [eax + 4], 0x6174
je 0x1004cfea
lea eax, [esp + 0x18]
cmp dword [eax], 0x7461642e
jne 0x1004cf81
cmp byte [eax + 4], 0x61
je 0x1004cfea
lea eax, [esp + 0x18]
cmp dword [eax], 0x7273722e
jne 0x1004cf93
cmp byte [eax + 4], 0x63
je 0x1004cfea
push 0
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1004cfea
push 0
lea eax, [esp + 0x10]
push eax
push 0x400
lea eax, [esp + 0x184]
push eax
push esi
call ebx
test eax, eax
je 0x1004cfea
mov edx, dword [esp + 0xc]
cmp edx, 4
jbe 0x1004cfea
xor eax, eax
add edx, 0xfffffffc
je 0x1004cfea
nop
mov ecx, dword [esp + eax + 0x178]
lea ebx, [esp + 0x10]
cmp ecx, dword [ebx]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
je 0x1004d004
inc eax
cmp eax, edx
jb 0x1004cfd0
inc edi
cmp di, word [esp + 0x86]
jb 0x1004cef0
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x14]
test edx, edx
je 0x1004d014
mov ecx, dword [esp + 0x28]
sub ecx, eax
mov dword [edx], ecx
add eax, dword [esp + 0x2c]
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004d030
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov edx, dword [edi + 0x9c]
cmp edx, 0xffffffff
jne 0x1004d051
pop edi
or eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [edx + ebx]
cmp eax, 0x40
jbe 0x1004d0c0
push esi
lea esi, [edi + 0x40]
cmp edx, 0x40
ja 0x1004d0a6
mov dword [esi + 4], 0
mov ecx, edi
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
mov edx, dword [edi + 0x9c]
push esi
call fcn.10052130
mov ecx, dword [ebp - 4]
add esp, 4
push esi
mov edx, ebx
call fcn.10052130
add dword [edi + 0x9c], ebx
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push ecx
lea eax, [edx + edi]
push eax
call fcn.1007d410
add dword [edi + 0x9c], ebx
add esp, 0xc
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1004d0e0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov edi, dword [esi + 0x9c]
cmp edi, 0xffffffff
je 0x1004d19f
cmp edi, 0x40
jbe 0x1004d11e
lea edx, [esi + 0x40]
mov ecx, esi
call fcn.10052350
mov dword [esi + 0x9c], 0x14
mov edi, 0x14
mov eax, 0x40
sub eax, edi
push eax
lea eax, [edi + esi]
push 0
push eax
call fcn.1007cff0
add esp, 0xc
xor eax, eax
jmp 0x1004d140
xor dword [esi + eax*4], 0x36363636
inc eax
cmp eax, 0x10
jb 0x1004d140
lea edi, [esi + 0x40]
mov edx, 0x40
mov ecx, esi
mov dword [edi + 4], 0
push edi
mov dword [edi], 0
mov dword [edi + 8], 0x67452301
mov dword [edi + 0xc], 0xefcdab89
mov dword [edi + 0x10], 0x98badcfe
mov dword [edi + 0x14], 0x10325476
mov dword [edi + 0x18], 0xc3d2e1f0
call fcn.10052130
mov eax, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x9c], 0xffffffff
jmp 0x1004d1a2
lea edi, [esi + 0x40]
test ebx, ebx
je 0x1004d1b3
push edi
mov edx, ebx
mov ecx, eax
call fcn.10052130
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004d1c0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
cmp dword [esi + 0x9c], 0xffffffff
je 0x1004d1e6
push esi
xor edx, edx
xor ecx, ecx
call fcn.1004d0e0
add esp, 4
push edi
lea edi, [esi + 0x40]
mov edx, edi
lea ecx, [ebp - 0x18]
call fcn.10052350
xor eax, eax
jmp 0x1004d200
xor dword [esi + eax*4], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x1004d200
push edi
mov edx, 0x40
mov dword [edi + 4], 0
mov ecx, esi
mov dword [edi], 0
mov dword [edi + 8], 0x67452301
mov dword [edi + 0xc], 0xefcdab89
mov dword [edi + 0x10], 0x98badcfe
mov dword [edi + 0x14], 0x10325476
mov dword [edi + 0x18], 0xc3d2e1f0
call fcn.10052130
push edi
mov edx, 0x14
lea ecx, [ebp - 0x18]
call fcn.10052130
add esp, 8
lea ecx, [ebp - 0x18]
mov edx, edi
call fcn.10052350
pop edi
test ebx, ebx
je 0x1004d27a
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call fcn.1007d410
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1004d540
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a1eb1
push eax
mov dword fs:[0], esp
sub esp, 0x404
push ebx
push edi
mov edi, ecx
mov ebx, edx
mov eax, dword [edi]
test eax, 0x540000
je 0x1004d584
or eax, 0x1000
mov dword [edi], eax
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
and eax, 0x1610
cmp eax, 0x1000
jne 0x1004d63f
test ebx, ebx
je 0x1004d63f
cmp word [ebx], 0
je 0x1004d63f
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100c4fb0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100c7350]
cmp eax, dword [ecx + 4]
jg 0x1004d64f
cmp byte [0x100c7354], 0
je 0x1004d63f
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0x14
mov dword [ebp - 0x10], eax
cmp eax, 0x200
jae 0x1004d5ec
lea esi, [ebp - 0x410]
jmp 0x1004d600
add eax, eax
push eax
call fcn.1008680d
mov esi, eax
add esp, 4
test esi, esi
je 0x1004d63e
mov eax, dword [ebp - 0x10]
push ebx
mov edx, eax
mov ecx, esi
call fcn.1000aef0
mov edx, dword [ebp - 0x10]
mov ecx, esi
push str.:com.dropbox.attrs
call fcn.1000ac90
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1004d62b
and dword [edi], 0xffffefff
lea eax, [ebp - 0x410]
cmp esi, eax
je 0x1004d63e
push esi
call fcn.10086818
add esp, 4
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x100c7350
call fcn.10079f23
add esp, 4
cmp dword [0x100c7350], 0xffffffff
jne 0x1004d5c6
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SoftwareDropbox
push SysReAllocString
mov byte [0x100c7354], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004d6a8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x100c7354], 1
jmp 0x1004d6a8
push 0x100c7350
mov dword [ebp - 4], 0xffffffff
call fcn.10079ed2
add esp, 4
jmp 0x1004d5c6
Function at 0x1004d9a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1e70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
push 0xf8
push ecx
lea ecx, [ebp - 0x18]
call fcn.1004d280
cmp byte [ebp - 0xe], 0
mov esi, dword [ebp - 0x14]
je 0x1004d9e5
test esi, esi
je 0x1004d9eb
push esi
call fcn.10086818
add esp, 4
xor esi, esi
jmp 0x1004d9eb
mov eax, esi
test esi, esi
jne 0x1004d9ee
mov eax, dword [ebp - 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
mov dword [ebp - 4], 0
test esi, esi
je 0x1004da0d
push esi
call fcn.10086818
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1004dae0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a1e70
push eax
mov dword fs:[0], esp
sub esp, 0xc
push 0x104
push ecx
lea ecx, [ebp - 0x18]
call fcn.1004d280
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x1004db12
mov ecx, dword [eax]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1004db33
push eax
call fcn.10086818
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1004db50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a1e70
push eax
mov dword fs:[0], esp
sub esp, 0x268
push esi
push 0x104
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1004d280
mov esi, dword [eax + 4]
test esi, esi
jne 0x1004db86
mov esi, dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1004dbc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1004dba2
or eax, 0xffffffff
jmp 0x1004dbc6
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x1004dbb9
or eax, eax
jmp 0x1004dbc6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x270]
push ecx
mov edx, esi
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
call fcn.1004d540
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1004dbee
push eax
call fcn.10086818
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004dc10
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a1e70
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push 0x104
push ecx
lea ecx, [ebp - 0x18]
mov esi, edx
call fcn.1004d280
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x1004dc45
mov ecx, dword [eax]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1004dc66
push eax
call fcn.10086818
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1004f330
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov edx, esi
mov edi, 0x16
lea ecx, [esi + 0x82b4]
call fcn.1004f070
test eax, eax
jne 0x1004f536
mov eax, dword [esi + 0x1f998]
add eax, 0x10
push ebx
push eax
call fcn.1008680d
mov ebx, eax
add esp, 4
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x1004f52e
cmp dword [esi + 0x1f9b8], 0
mov eax, dword [esi + 0x1f99c]
mov edi, dword [esi + 0x1f998]
mov ecx, dword [esi + 0x1f990]
mov dword [ebx], eax
mov eax, dword [esi + 0x1f9a0]
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x1f9a4]
push edi
push ecx
mov dword [ebx + 8], eax
je 0x1004f3bc
mov eax, dword [esi + 0x1f9a8]
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10]
push eax
call fcn.1007d410
lea eax, [edi + 0x10]
jmp 0x1004f3c8
lea eax, [ebx + 0xc]
push eax
call fcn.1007d410
lea eax, [edi + 0xc]
add esp, 8
lea edi, [esi + 0x1fbf0]
mov edx, ebx
mov ecx, edi
push eax
call fcn.10052460
mov eax, dword [esi + 0x1f560]
add esp, 8
sub eax, 2
je 0x1004f3fc
sub eax, 1
je 0x1004f3f5
mov ecx, 0x80
jmp 0x1004f401
mov ecx, 0x100
jmp 0x1004f401
mov ecx, 0xc0
push esi
push ecx
mov edx, edi
call fcn.100524c0
add esp, 8
test eax, eax
jne 0x1004f520
cmp dword [esi + 0x1f9ac], eax
je 0x1004f505
cmp dword [esi + 0x1f9b0], eax
je 0x1004f505
mov ecx, dword [esi + 0x1fbec]
xor edx, edx
mov eax, dword [esi + 0x1f99c]
add ecx, 0x110
push esi
mov dword [ecx], eax
mov eax, dword [esi + 0x1f9a0]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x1f9a4]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x1f9a8]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x1f9b0]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [esi + 0x1f9ac]
call fcn.10052750
add esp, 0xc
test eax, eax
jne 0x1004f4fe
mov eax, dword [esi + 0x18344]
or edx, 0xffffffff
mov edi, dword [esi + 0x1f9b0]
mov dword [ebp - 0xc], eax
add edi, 0xfffffffc
mov eax, dword [esi + 0x1f9ac]
mov dword [esi + 0x18344], 0
test eax, eax
je 0x1004f4d2
test edi, edi
je 0x1004f4d2
mov ebx, eax
movsx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx eax, dl
xor ecx, eax
shr edx, 8
movzx eax, cl
xor edx, dword [eax*4 + 0x100b0570]
sub edi, 1
jne 0x1004f4b2
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 0x1f9b0]
not edx
mov ecx, dword [esi + 0x1f9ac]
mov edi, edx
mov dword [esi + 0x18344], edx
sub edi, dword [eax + ecx - 4]
mov eax, dword [ebp - 0xc]
neg edi
mov dword [esi + 0x18344], eax
sbb edi, edi
and edi, 3
jmp 0x1004f50a
mov edi, 0x16
jmp 0x1004f50a
mov edi, 4
push ebx
call fcn.10086818
add esp, 4
test edi, edi
jne 0x1004f52e
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov edi, 0x16
call fcn.10086818
add esp, 4
mov ecx, esi
call fcn.1004f540
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004f5b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [0x100c7608]
mov esi, edx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
xor eax, eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x1004f67e
test esi, esi
sets al
dec eax
and eax, esi
cmp eax, 2
jle 0x1004f5e9
mov eax, 2
imul eax, eax, 0x1002
push ebx
push edi
add eax, ecx
lea ebx, [eax + 0x1b550]
mov dword [ebp - 8], eax
xor eax, eax
xor esi, esi
mov word [ebx], ax
test esi, esi
js 0x1004f675
mov edi, dword [esi*8 + 0x100c30b0]
cmp edi, dword [ebp - 4]
jne 0x1004f635
push 0x7ff
push dword [esi*8 + 0x100c30b4]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov word [eax + 0x1c54e], cx
lea eax, [ecx + 1]
test edi, edi
jne 0x1004f63e
or esi, 0xffffffff
jmp 0x1004f63f
inc esi
test eax, eax
je 0x1004f603
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx + 0x7148]
test ecx, ecx
je 0x1004f67a
push dword [edx + 0x714c]
lea eax, [edx + 0x1e556]
xor esi, esi
push eax
push ebx
push esi
push dword [ebp - 4]
mov word [eax], si
push esi
push 0xd
call ecx
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [ebx], ax
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004f690
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a1e60
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
push dword [0x100c7608]
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x1004f6d6
lea eax, [edi + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x104
push ebx
lea ecx, [ebp - 0x24]
call fcn.1004d280
cmp byte [ebp - 0x1a], 0
mov esi, dword [ebp - 0x20]
je 0x1004f6fe
test esi, esi
je 0x1004f704
push esi
call fcn.10086818
add esp, 4
xor esi, esi
jmp 0x1004f704
mov eax, esi
test esi, esi
jne 0x1004f707
mov eax, dword [ebp - 0x24]
push 0
push 0x20
push 1
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test esi, esi
je 0x1004f737
push esi
call fcn.10086818
mov eax, dword [ebp - 0x14]
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x1b40c], eax
cmp eax, 0xffffffff
jne 0x1004f7fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x1004f7fb
cmp dword [edi + 8], 0
je 0x1004f786
mov ecx, ebx
call fcn.1004db50
cmp eax, 0xffffffff
je 0x1004f786
test al, 1
je 0x1004f786
and eax, 0xfffffffe
mov ecx, ebx
mov edx, eax
call fcn.1004dc10
test eax, eax
je 0x1004f806
mov ecx, ebx
call fcn.1004dae0
test eax, eax
je 0x1004f806
push 0x104
push ebx
lea ecx, [ebp - 0x24]
call fcn.1004d280
cmp byte [ebp - 0x1a], 0
mov esi, dword [ebp - 0x20]
je 0x1004f7b9
test esi, esi
je 0x1004f7bf
push esi
call fcn.10086818
add esp, 4
xor esi, esi
jmp 0x1004f7bf
mov eax, esi
test esi, esi
jne 0x1004f7c2
mov eax, dword [ebp - 0x24]
push 0
push 0x20
push 1
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 4], 1
test esi, esi
je 0x1004f7ee
push esi
call fcn.10086818
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x1b40c], ebx
mov eax, dword [edi + 0x1b40c]
cmp eax, 0xffffffff
jne 0x1004f81c
mov eax, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jl 0x1004f861
mov edx, dword [ebp + 8]
jg 0x1004f830
cmp edx, 0x30000
jbe 0x1004f861
push 0
lea esi, [ebp - 0x18]
push esi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1004f861
push dword [edi + 0x1b40c]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push 0
push 0
push dword [edi + 0x1b40c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100505d0
Capabilities:
Get thread local storage value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a1e70
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
push dword [0x100c7608]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x100506bb
test edi, edi
jne 0x10050679
cmp word [esi + 0x1fc10], 0xa
jne 0x10050629
lea eax, [esi + 0x1fc1c]
push eax
lea eax, [esi + 0x1fc24]
push eax
lea eax, [esi + 0x1fc2c]
jmp 0x10050656
lea eax, [ebp - 0x1c]
push eax
movzx eax, word [esi + 0x7162]
push eax
movzx eax, word [esi + 0x7164]
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [ebp - 0x14]
push eax
push eax
push eax
push dword [esi + 0x1b40c]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [esi + 0x1b40c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1b40c], 0xffffffff
mov edi, dword [esi + 0x60d4]
lea eax, [esi + 0x40d2]
push 0x104
push eax
lea ecx, [ebp - 0x28]
call fcn.1004d280
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x1005069c
mov ecx, dword [eax]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x100506bb
push eax
call fcn.10086818
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100516b0
Capabilities:
Generate random numbers using the delphi lcg
Get thread local storage value
Hash data with crc32

Disassembly:
push esi
push edi
push dword [0x100c7608]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10051717
mov edx, dword [esi + 0x8338]
mov ecx, edx
xor ecx, edi
shr edx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x100b0570]
mov ecx, dword [esi + 0x8340]
movzx eax, dl
add eax, dword [esi + 0x833c]
imul eax, eax, 0x8088405
mov dword [esi + 0x8338], edx
inc eax
mov dword [esi + 0x833c], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100b0570]
mov dword [esi + 0x8340], ecx
pop edi
pop esi
ret
Function at 0x10051e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov ebx, dword [esi + 0x208]
test eax, eax
je 0x10051f66
push edi
mov edi, 0x104
sub edi, ebx
cmp eax, edi
jae 0x10051e8f
mov edi, eax
lea eax, [esi + 0x104]
push edi
add eax, ebx
push eax
push ecx
call fcn.1007d410
mov ecx, dword [ebp - 8]
add ebx, edi
mov eax, dword [ebp - 4]
add ecx, edi
sub eax, edi
mov dword [ebp - 8], ecx
add esp, 0xc
mov dword [ebp - 4], eax
cmp ebx, 0x104
jne 0x10051f5d
lea edi, [esi + 0x104]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, 0x104
sub eax, ebx
push eax
lea eax, [ebx + esi]
push eax
mov eax, dword [esi + 0x20c]
call eax
add ebx, eax
add esp, 8
cmp ebx, 0x104
jb 0x10051ed2
lea eax, [esi + 1]
mov edi, 0x34
jmp 0x10051f00
movzx ecx, byte [eax + 0x103]
lea eax, [eax + 5]
mov dl, byte [eax + 0x102]
not cl
xor byte [eax - 6], cl
not dl
movzx ecx, byte [eax + 0xff]
xor byte [eax - 2], dl
not cl
xor byte [eax - 5], cl
movzx ecx, byte [eax + 0x100]
not cl
xor byte [eax - 4], cl
movzx ecx, byte [eax + 0x101]
not cl
xor byte [eax - 3], cl
sub edi, 1
jne 0x10051f00
mov ecx, esi
call fcn.10051990
lea ecx, [esi + 0x104]
call fcn.10051990
mov eax, dword [ebp - 4]
xor ebx, ebx
mov ecx, dword [ebp - 8]
test eax, eax
jne 0x10051e82
pop edi
mov dword [esi + 0x208], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret