joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf20058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xf201a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xf2007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf2006a
add dl, dl
jne 0xf20089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf200dc
xor eax, eax
add dl, dl
jne 0xf20096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf2017d
add dl, dl
jne 0xf200a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf200b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf200bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf200c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xf200d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xf20075
mov eax, 1
add dl, dl
jne 0xf200ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf200f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf200e1
sub eax, ebx
mov ebx, 1
jne 0xf20128
mov ecx, 1
add dl, dl
jne 0xf2010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf20119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf20105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf20075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf2013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf2014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf20136
cmp eax, 0x7d00
jae 0xf2016d
cmp eax, 0x500
jb 0xf20168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf20075
cmp eax, 0x7f
ja 0xf20170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf20075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xf2019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xf20075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x20011d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x200122b
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x200121c
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x2001218
cmp esi, eax
jae 0x200121c
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x200120a
cmp esi, eax
jb 0x2001220
xor eax, eax
jmp 0x200122a
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x200202c
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x2002042
push 0x80004005
call fcn.02001105
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x2002045
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x20025e1
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x2019688]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.02001411
mov edi, eax
cmp edi, esi
je 0x2002649
lea ecx, [ebp - 0x70]
call fcn.020013fa
mov eax, edi
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0201016a
add ebp, 0x98
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x2002661
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.020025e1
cmp eax, esi
jne 0x2002694
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x2002651
lea ecx, [ebp - 0x70]
call fcn.020013fa
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.020013fa
mov eax, esi
jmp 0x200262f

Function at 0x2002d37
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
call fcn.0200c03c
mov eax, dword [eax]
push 1
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0200151a
mov eax, esi
pop esi
leave
ret 8
Function at 0x2003d68
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2003dc2
cmp dword [ebp + 0x10], 1
je 0x2003da7
cmp dword [ebp + 0x10], 2
je 0x2003da7
push 0xd
pop eax
jmp 0x2003dc2
test edi, edi
mov eax, dword [ebp - 4]
je 0x2003dbe
test eax, eax
je 0x2003dbb
cmp byte [eax + edi - 1], 0
je 0x2003dbe
jmp 0x2003da2
mov byte [edi], 0
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x2004441
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x54]
mov ecx, eax
and ecx, 0xc
cmp cl, 0xc
push edi
mov byte [ebp - 1], 1
jne 0x200448e
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call edi
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x4e
jmp 0x20044b5
shr eax, 2
test al, 1
je 0x20044be
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
movzx ecx, di
push ecx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x20044f1
push ebx
push 1
xor ebx, ebx
push ebx
push ebx
push dword [esi + 0x28]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
seta byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x20044f0
or byte [esi + 0x58], 2
push 1
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop ebx
mov al, byte [ebp - 1]
pop edi
pop esi
leave
ret

Function at 0x20050df
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x2019688]
xor eax, ebp
mov dword [ebp + 0x74], eax
push 0x90
lea eax, [ebp - 0x1c]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x2005132
cmp dword [ebp - 0x1c], 5
jae 0x200512e
cmp dword [ebp - 0x1c], 4
jne 0x2005132
cmp dword [ebp - 0x18], 0x5a
jb 0x2005132
xor eax, eax
jmp 0x2005135
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.0201016a
add ebp, 0x78
leave
ret
Function at 0x20053ee
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [eax + 0xc]
test esi, esi
jl 0x2005440
mov eax, dword [ecx + 0x20]
cmp dword [eax + 8], esi
jl 0x2005440
push eax
mov eax, dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 8]
call fcn.020016b6
test esi, esi
jle 0x2005423
lea ecx, [ebp - 8]
call fcn.02001ba7
dec esi
jne 0x2005418
lea ecx, [ebp - 8]
call fcn.020019ba
push 1
push 0
push 0
push dword [eax]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
pop esi
leave
ret 0xc

Function at 0x2005447
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x7f98]
mov eax, 0x8018
call fcn.020102f0
mov eax, dword [0x2019688]
xor eax, ebp
mov dword [ebp + 0x7f94], eax
and dword [ebp - 0x78], 0
push ebx
push esi
push 0x8000
lea eax, [ebp - 0x6f]
push 0
push eax
mov ebx, ecx
mov byte [ebp - 0x70], 0
call sub.MSVCR80.dll_memset
mov esi, dword [ebp + 0x7fa0]
add esp, 0xc
test esi, esi
jl 0x2005562
mov eax, dword [ebx + 0x20]
cmp dword [eax + 8], esi
jl 0x2005562
push eax
mov eax, dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x80]
call fcn.020016b6
test esi, esi
jle 0x20054bc
lea ecx, [ebp - 0x80]
call fcn.02001ba7
dec esi
jne 0x20054b1
push edi
lea ecx, [ebp - 0x80]
call fcn.020019ba
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [eax]
push 0xcc
push dword [ebx + 4]
call esi
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowTextA]
push eax
call edi
lea ecx, [ebp - 0x80]
call fcn.020019ba
mov eax, dword [eax + 4]
push 0xcd
push dword [ebx + 4]
mov dword [ebp - 0x74], eax
call esi
push dword [ebp - 0x74]
push eax
call edi
lea ecx, [ebp - 0x80]
call fcn.020019ba
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
mov dword [ebp - 0x74], eax
je 0x2005550
push 0
lea ecx, [ebp - 0x78]
push ecx
push 0x8000
lea ecx, [ebp - 0x70]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x78]
push dword [ebp - 0x74]
mov byte [ebp + eax - 0x70], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xcb
push dword [ebx + 4]
call esi
lea ecx, [ebp - 0x70]
push ecx
push eax
call edi
pop edi
mov ecx, dword [ebp + 0x7f94]
pop esi
xor ecx, ebp
pop ebx
call fcn.0201016a
add ebp, 0x7f98
leave
ret 4
Function at 0x20066af
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x2019688]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, ecx
push 0x3eb
push dword [esi + 4]
call edi
push 0xcd
push dword [esi + 4]
mov dword [ebp - 0x7c], eax
call edi
push dword [ebp - 0x7c]
mov edi, dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x80], eax
call edi
push dword [ebp - 0x80]
mov ebx, eax
call edi
inc ebx
lea edi, [esi + 0x20]
push ebx
mov ecx, edi
mov dword [ebp - 0x78], eax
call fcn.02005626
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextA]
push eax
push dword [ebp - 0x7c]
call ebx
push 0xffffffffffffffff
mov ecx, edi
call fcn.02004fdb
mov eax, dword [ebp - 0x78]
inc eax
lea ecx, [esi + 0x24]
push eax
mov dword [ebp - 0x78], eax
call fcn.02005626
push dword [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call ebx
push 0xffffffffffffffff
lea ecx, [esi + 0x24]
call fcn.02004fdb
mov eax, dword [edi]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
je 0x20067c6
push ebx
push 0x40
mov ecx, edi
call fcn.02005006
test eax, eax
jl 0x200677d
push ebx
push 0x40
mov ecx, edi
call fcn.02005006
push 0x2e
mov ecx, edi
mov dword [ebp - 0x78], eax
call fcn.02001896
mov ecx, dword [ebp - 0x78]
cmp eax, ecx
jge 0x20067c6
push 0xff
lea eax, [ebp - 0x74]
push eax
push 0xe10b
push dword [0x2019864]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x78]
push eax
call fcn.0200beae
push ebx
push dword [eax]
lea eax, [ebp - 0x74]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0x78]
add ecx, 0xfffffff0
call fcn.0200151a
push dword [ebp - 0x7c]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x20067d7
movzx eax, word [ebp + 0x9c]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [ebp + 0x8c]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0201016a
add ebp, 0x90
leave
ret 0x10

Function at 0x2006e99
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, dword [0x201960a]
mov eax, dword fs:[0x30]
push esi
push edi
mov edi, dword [eax + 0xc]
add edi, 0xc
xor ebx, ebx
mov esi, dword [edi]
jmp 0x2006ecb
push dword [esi + 0x30]
call fcn.02006e6d
pop ecx
cmp ebp, eax
je 0x20074a8
mov esi, dword [esi]
cmp esi, edi
jne 0x2006eb8
mov esi, ebx
mov dword [esp + 0x10], ebx
push dword [0x201964a]
mov esi, dword [esi + 0x18]
mov dword [esp + 0x10], esi
jmp 0x2006ed5
Function at 0x20072ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ecx, esi
mov dword [esp + 0x2c], ecx
add edx, esi
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
add ecx, esi
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], eax
test eax, eax
je 0x200731d
mov eax, dword [edx + ebp*4]
add eax, esi
push eax
mov dword [esp + 0x4c], eax
call fcn.02006e3c
mov dword [esp + 0x44], eax
test eax, eax
pop ecx
mov eax, ebx
je 0x2007308
mov edx, dword [esp + 0x48]
mov esi, eax
mov edi, dword [esp + 0x40]
imul eax, dword [esp + 0x3c]
movzx ecx, byte [esi + edx]
add eax, ecx
inc esi
cmp esi, edi
jb 0x20072f0
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp eax, dword [esp + 0x20]
je 0x200750c
mov edx, dword [esp + 0x34]
inc ebp
cmp ebp, dword [esp + 0x38]
jb 0x20072cc
mov dword [esp + 0x1c], ebx
movsx eax, byte [edi]
mov ebp, ebx
mov ecx, dword [0x20195fe]
add edi, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x20], ebx
lea eax, [edi + 1]
push eax
call fcn.02006e3c
mov edx, ebx
pop ecx
test eax, eax
je 0x200735f
imul ebp, dword [esp + 0x4c]
movzx ecx, byte [edx + edi + 1]
add ebp, ecx
inc edx
cmp edx, eax
jb 0x200734a
mov dword [esp + 0x20], ebp
mov eax, dword [0x20195fe]
mov ebp, ebx
mov ecx, dword [0x2019632]
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x3c]
invalid
invalid
Function at 0x2008e87
Capabilities:
Create process memory minidump
Query environment variable

Disassembly:
push 0x1c
mov eax, 0x201173a
call fcn.02010179
mov dword [ebp - 0x1c], ecx
xor esi, esi
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
push 0x20198f8
mov ecx, ebx
mov dword [ebp - 4], esi
call fcn.02001939
xor edi, edi
lea eax, [ebp - 0x14]
inc edi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], edi
call fcn.0200beae
push dword [eax]
mov dword [ebp - 4], edi
push str.TEMP
call dword [sym.imp.MSVCR80.dll_getenv]
pop ecx
push eax
push str._s_s.dmp
push ebx
call fcn.02006e1c
mov ecx, dword [ebp - 0x14]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0200151a
mov eax, dword [ebx]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, esi
je 0x2008f4a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x18]
push ecx
neg eax
push esi
sbb eax, eax
lea ecx, [ebp - 0x28]
and eax, ecx
push eax
push esi
push edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x2008939
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.dbghelp.dll_MiniDumpWriteDump
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.02010218
ret 4
Function at 0x200b511
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4

Function at 0x200bf83
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x184]
sub esp, 0x204
mov eax, dword [0x2019688]
xor eax, ebp
mov dword [ebp + 0x180], eax
push ebx
push esi
mov esi, dword [ebp + 0x18c]
xor ebx, ebx
push 0xf5
lea eax, [ebp + 0x89]
push ebx
mov dword [ebp - 0x80], ebx
push eax
mov byte [ebp + 0x88], bl
call sub.MSVCR80.dll_memset
push 0x103
lea eax, [ebp - 0x7b]
push ebx
push eax
mov byte [ebp - 0x7c], bl
call sub.MSVCR80.dll_memset
add esp, 0x18
lea eax, [ebp + 0x88]
push eax
push 0xf6
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x200c016
lea eax, [ebp - 0x80]
push eax
call fcn.0200beae
lea ecx, [ebp - 0x7c]
push ecx
push ebx
push dword [eax]
lea eax, [ebp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.0200151a
lea eax, [ebp - 0x7c]
push eax
mov ecx, esi
call fcn.020078cd
mov ecx, dword [ebp + 0x180]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0201016a
add ebp, 0x184
leave
ret 4

Function at 0x200c03c
Capabilities:
Delete file

Disassembly:
push ebp
sub esp, 0x280
lea ebp, [esp - 4]
mov eax, dword [0x2019688]
xor eax, ebp
mov dword [ebp + 0x280], eax
push 0xc
mov eax, 0x2011c3b
call fcn.02010179
mov edi, dword [ebp + 0x28c]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ebx
call fcn.0200beae
mov eax, dword [eax]
push ebx
push str.Zip_Files__.zip_
push 6
push eax
xor esi, esi
push 0x2014ec4
inc esi
push ebx
lea ecx, [ebp]
mov dword [ebp - 4], esi
call fcn.02005271
mov dword [ebp], 0x20127f8
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.0200151a
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp]
call fcn.02005330
cmp eax, esi
jne 0x200c0dc
lea eax, [ebp + 0x17c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp + 0x17c]
push eax
mov ecx, edi
call fcn.020078cd
jmp 0x200c0e8
push 0x20128b8
mov ecx, edi
call fcn.020078cd
cmp dword [ebp + 0x14], ebx
mov byte [ebp - 4], bl
mov dword [ebp - 0x10], esi
je 0x200c0fb
push dword [ebp + 0x14]
call fcn.02010056
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x280]
xor ecx, ebp
call fcn.0201016a
add ebp, 0x284
leave
ret 4
Function at 0x200d4e3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x200d4f2
xor eax, eax
jmp 0x200d5cc
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x200d5ad
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x2015080]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x2015080]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x2015080]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x2015080]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x2015080]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x2015080]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x2015080]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x2015080]
inc edx
sub eax, 8
dec edi
jne 0x200d512
pop edi
test eax, eax
je 0x200d5c6
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x2015080]
inc edx
dec eax
jne 0x200d5b1
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc

Function at 0x200d5cf
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
movzx edx, byte [esp + 8]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x2015080]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x2015080]
pop esi
mov dword [ecx + 8], eax
ret 8
Function at 0x200d78d
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x200d7b0
mov eax, 0x200
jmp 0x200d92e
mov ecx, dword [ebp - 0x4c]
xor eax, eax
push ebx
xor ebx, ebx
mov edx, ecx
inc eax
and edx, eax
push esi
mov dword [ebp - 8], ebx
je 0x200d7c6
mov dword [ebp - 8], eax
test cl, 2
je 0x200d7cf
or dword [ebp - 8], 2
test cl, 4
je 0x200d7d8
or dword [ebp - 8], 4
mov eax, ecx
and eax, 0x10
je 0x200d7e3
or dword [ebp - 8], 0x10
test cl, 0x20
je 0x200d7ec
or dword [ebp - 8], 0x20
cmp eax, ebx
je 0x200d7f9
or dword [ebp - 8], 0x40000000
jmp 0x200d800
or dword [ebp - 8], 0x80000000
or dword [ebp - 8], 0x1000000
cmp edx, ebx
jne 0x200d812
or dword [ebp - 8], 0x800000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x28
mov dword [ebp - 0x10], eax
jbe 0x200d8b0
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ebx
push edi
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 4]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
call edi
push ebx
push ebx
push 0x24
push dword [ebp + 8]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call edi
cmp word [ebp - 4], 0x54ad
jne 0x200d8b0
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 0x34]
cmp dword [ebp - 0x10], ecx
jbe 0x200d8b0
push ebx
push ebx
push eax
push dword [ebp + 8]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 0x18]
cmp eax, 0x5a4d
je 0x200d8a9
cmp eax, 0x454e
je 0x200d8a9
cmp eax, 0x454c
je 0x200d8a9
cmp eax, 0x4550
jne 0x200d8b0
or dword [ebp - 8], 0x400000
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x200d8bc
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x200d8c8
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov esi, dword [ebp + 0x14]
cmp esi, ebx
je 0x200d901
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.0200d70a
push dword [ebp - 0x34]
mov dword [esi], eax
push dword [ebp - 0x38]
mov dword [esi + 4], edx
call fcn.0200d70a
push dword [ebp - 0x44]
mov dword [esi + 8], eax
push dword [ebp - 0x48]
mov dword [esi + 0xc], edx
call fcn.0200d70a
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [ebp + 0x18]
cmp esi, ebx
je 0x200d92a
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.0200d72e
movzx eax, word [ebp + 8]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
mov dword [esi], eax
pop esi
xor eax, eax
pop ebx
pop edi
leave
ret 0x14