joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aeca0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c31e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x3c]
push 1
push edi
mov esi, ecx
push eax
lea ecx, [esp + 0x14]
call fcn.004a5f00
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 8]
mov eax, dword [edx + 4]
push ecx
lea ecx, [esp + eax + 0xc]
push edi
push ecx
mov ecx, esi
call fcn.004adcc0
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x28]
pop edi
mov dword [esp + 0x20], vtable.CryptoPP::BufferedTransformation.0
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc

Function at 0x4b11f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c3520
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push 0x19
xor ebx, ebx
push str.Integer:_division_by_zero
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.0040e480
mov dword [esp + 0x30], ebx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.004a8070
mov byte [esp + 0x30], 2
cmp dword [esp + 0x24], 0x10
jb 0x4b125b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004606bf
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov dword [esi], vtable.CryptoPP::Integer::DivideByZero.0
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x4b12d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c3520
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push 0x10
xor ebx, ebx
push str.BER_decode_error
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.0040e480
mov dword [esp + 0x30], ebx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.004a8070
mov byte [esp + 0x30], 2
cmp dword [esp + 0x24], 0x10
jb 0x4b133b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004606bf
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov dword [esi], vtable.CryptoPP::BERDecodeErr.0
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4b1810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c35b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0xc], ebx
mov esi, dword [esp + 0x2c]
mov ecx, esi
call fcn.004ad970
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
call fcn.004ad970
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x30]
push eax
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
call fcn.004b16b0
add esp, 0x10
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x10]
call fcn.00455fa0
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8

Function at 0x4b1d3c
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c3610
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x2c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x2c]
push eax
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.004b0ac0
mov dword [esp + 0x30], 0
lea ecx, [esi + 0xc]
push ecx
push eax
lea edx, [esp + 0x18]
push edx
call fcn.004b1c60
add esp, 0x18
mov byte [esp + 0x24], 1
push eax
lea ecx, [esi + 0x24]
call fcn.004aebf0
mov esi, eax
mov byte [esp + 0x24], 0
lea ecx, [esp + 4]
call fcn.00455fa0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00455fa0
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8

Function at 0x4b1ed8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c3610
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
push edi
lea edi, [esi + 0xc]
shl eax, 5
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004aeb60
mov dword [esp + 0x30], 0
push edi
push eax
lea edx, [esp + 0x18]
push edx
call fcn.004b1c60
add esp, 0x14
mov byte [esp + 0x28], 1
push eax
lea ecx, [esi + 0x24]
call fcn.004aebf0
mov esi, eax
mov byte [esp + 0x28], 0
lea ecx, [esp + 8]
call fcn.00455fa0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00455fa0
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x4b3060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c37e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.004b2340
mov dword [esp + 0x20], 2
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], eax
call fcn.0047e5f0
mov esi, dword [esp + 0x28]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.004b2340
mov byte [esp + 0x20], 2
mov dword [esp + 4], 1
mov byte [esp + 0x20], 0
lea ecx, [esp + 8]
call fcn.0047df40
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x4b57c9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c3c40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebp
push esi
mov esi, ecx
push edi
lea eax, [esi - 0x30]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
call fcn.004b5230
xor edi, edi
mov dword [esp + 0x38], edi
mov ebp, dword [esi - 0xc]
mov ecx, dword [esi - 8]
add esi, 0xffffffe8
add ecx, ebp
cmp ebp, ecx
jbe 0x4b57f8
call fcn.00483a80
cmp dword [esp + 0x44], edi
mov dword [esp + 0xc], edi
jbe 0x4b58d5
push ebx
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 0x10]
add edi, eax
cmp eax, edi
jbe 0x4b5818
call fcn.00483a80
cmp edi, dword [esi + 0xc]
ja 0x4b5822
call fcn.00483a80
add edi, 0xffffffff
cmp esi, esi
je 0x4b582e
call fcn.00483a80
cmp ebp, edi
je 0x4b58d4
mov edx, dword [esi + 0x10]
add edx, dword [esi + 0xc]
mov edi, ebp
mov ebx, ebp
shr edi, 2
and ebx, 3
cmp ebp, edx
jb 0x4b584f
call fcn.00483a80
mov eax, dword [esi + 8]
cmp eax, edi
ja 0x4b5858
sub edi, eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + edi*4]
mov edx, dword [ecx + ebx*4]
mov edi, dword [esp + 0x44]
push edx
push edi
lea ecx, [esp + 0x20]
call fcn.004b78d0
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx - 0x38]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + ebx - 0x38]
mov eax, dword [edx + 0x20]
lea ecx, [ecx + ebx - 0x38]
call eax
test eax, eax
je 0x4b58af
mov ecx, dword [ebx - 0x38]
mov edx, dword [ecx + 4]
mov eax, dword [edx + ebx - 0x38]
mov edi, dword [edi]
lea ecx, [edx + ebx - 0x38]
mov edx, dword [eax + 0x20]
add edi, 0x10
call edx
mov ecx, dword [esp + 0x44]
sub eax, 1
push eax
mov eax, dword [edi]
call eax
mov ecx, dword [esi + 0x10]
add ecx, dword [esi + 0xc]
add dword [esp + 0x10], 1
cmp ebp, ecx
jb 0x4b58c3
call fcn.00483a80
mov edx, dword [esp + 0x10]
add ebp, 1
cmp edx, dword [esp + 0x48]
jb 0x4b5807
pop ebx
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov dword [esp + 0xc], vtable.CryptoPP::BufferedTransformation.0
pop ebp
mov dword fs:[0], ecx
add esp, 0x30
ret 8
sub ecx, dword [ecx - 4]
jmp 0x4b57b0

Function at 0x4b67d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
mov ecx, eax
or ecx, esi
or ecx, edx
test cl, 3
jne 0x4b6800
shr edx, 2
je 0x4b681d
mov ecx, esi
sub ecx, eax
mov esi, dword [ecx + eax]
xor dword [eax], esi
add eax, 4
sub edx, 1
jne 0x4b67f1
pop esi
ret
test edx, edx
jbe 0x4b681d
mov ecx, esi
sub ecx, eax
mov esi, edx
lea ebx, [ebx]
mov dl, byte [eax + ecx]
xor byte [eax], dl
add eax, 1
sub esi, 1
jne 0x4b6810
pop esi
ret
Function at 0x4b7d00
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x4b7d1e
pop edi
mov eax, 1
pop esi
ret 0xc
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x4b7e2c
push ebp
lea esp, [esp]
cmp ebx, 0x15b0
mov eax, ebx
jb 0x4b7d3f
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x4b7deb
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x4b7d60
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x4b7d60
test eax, eax
je 0x4b7dff
nop
movzx edx, byte [esi]
add ecx, edx
add esi, 1
add edi, ecx
sub eax, 1
jne 0x4b7df0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x4b7d30
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret 0xc
Function at 0x4b7f90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4b7f9d
xor eax, eax
ret 0xc
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x14]
cmp edi, 8
not esi
jb 0x4b8097
push ebp
mov ebp, edi
shr ebp, 3
jmp 0x4b7fc0
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4dca18]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4dca18]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + 0x4dca18]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4dca18]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4dca18]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4dca18]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4dca18]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4dca18]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x4b7fc0
pop ebp
test edi, edi
je 0x4b80bc
jmp 0x4b80a0
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x4dca18]
add ecx, 1
sub edi, 1
jne 0x4b80a0
mov eax, esi
pop edi
not eax
pop esi
ret 0xc
Function at 0x4bd426
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x512f80]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004bd3bb
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00488650
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4bd475
cmp dword [ebp - 0x1c], 5
jb 0x4bd48d
jmp 0x4bd489
cmp dword [ebp - 0x10], 1
jne 0x4bd48d
cmp dword [ebp - 0x1c], 4
ja 0x4bd489
jne 0x4bd48d
cmp dword [ebp - 0x18], 0
jbe 0x4bd48d
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4dde20
call fcn.004bd2ac
test eax, eax
jge 0x4bd4ae
mov byte [0x523ef8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0048162f
add ebp, 0x78
leave
ret
Function at 0x1000dc50
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x8000
jg 0x1000dd57
je 0x1000dd50
cmp eax, 0x80
jg 0x1000dce4
je 0x1000dcdd
cmp eax, 8
jg 0x1000dcb5
je 0x1000dcae
cmp eax, 2
jg 0x1000dc9e
je 0x1000dc97
cmp eax, 0x80000000
je 0x1000dc90
cmp eax, 1
jne 0x1000de1e
pop ebp
ret
mov eax, 0x40000000
pop ebp
ret
mov eax, 2
pop ebp
ret
cmp eax, 4
jne 0x1000de1e
mov eax, 0x80000000
pop ebp
ret
mov eax, 4
pop ebp
ret
cmp eax, 0x10
je 0x1000dcd6
cmp eax, 0x20
je 0x1000dccf
cmp eax, 0x40
jne 0x1000de1e
mov eax, 0x20
pop ebp
ret
mov eax, 0x10
pop ebp
ret
mov eax, 8
pop ebp
ret
mov eax, 0x40
pop ebp
ret
cmp eax, 0x800
jg 0x1000dd22
je 0x1000dd1b
cmp eax, 0x100
je 0x1000dd14
cmp eax, 0x200
je 0x1000dd0d
cmp eax, 0x400
jne 0x1000de1e
mov eax, 0x200
pop ebp
ret
mov eax, 0x100
pop ebp
ret
mov eax, 0x80
pop ebp
ret
mov eax, 0x400
pop ebp
ret
cmp eax, 0x1000
je 0x1000dd49
cmp eax, 0x2000
je 0x1000dd42
cmp eax, 0x4000
jne 0x1000de1e
mov eax, 0x2000
pop ebp
ret
mov eax, 0x1000
pop ebp
ret
mov eax, 0x800
pop ebp
ret
mov eax, 0x4000
pop ebp
ret
cmp eax, 0x800000
jg 0x1000ddcf
je 0x1000ddc8
cmp eax, 0x80000
jg 0x1000dd9e
je 0x1000dd97
cmp eax, 0x10000
je 0x1000dd90
cmp eax, 0x20000
je 0x1000dd89
cmp eax, 0x40000
jne 0x1000de1e
mov eax, 0x20000
pop ebp
ret
mov eax, 0x10000
pop ebp
ret
mov eax, 0x8000
pop ebp
ret
mov eax, 0x40000
pop ebp
ret
cmp eax, 0x100000
je 0x1000ddc1
cmp eax, 0x200000
je 0x1000ddba
cmp eax, 0x400000
jne 0x1000de1e
mov eax, 0x200000
pop ebp
ret
mov eax, 0x100000
pop ebp
ret
mov eax, 0x80000
pop ebp
ret
mov eax, 0x400000
pop ebp
ret
cmp eax, 0x8000000
jg 0x1000de09
je 0x1000de02
cmp eax, 0x1000000
je 0x1000ddfb
cmp eax, 0x2000000
je 0x1000ddf4
cmp eax, 0x4000000
jne 0x1000de1e
mov eax, 0x2000000
pop ebp
ret
mov eax, 0x1000000
pop ebp
ret
mov eax, 0x800000
pop ebp
ret
mov eax, 0x4000000
pop ebp
ret
cmp eax, 0x10000000
je 0x1000de30
cmp eax, 0x20000000
je 0x1000de29
cmp eax, 0x40000000
je 0x1000de22
xor eax, eax
pop ebp
ret
mov eax, 0x20000000
pop ebp
ret
mov eax, 0x10000000
pop ebp
ret
mov eax, 0x8000000
pop ebp
ret
Function at 0x1000de40
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x8000
jg 0x1000df47
je 0x1000df40
cmp eax, 0x80
jg 0x1000ded4
je 0x1000decd
cmp eax, 8
jg 0x1000dea5
je 0x1000de9e
cmp eax, 2
jg 0x1000de8e
je 0x1000de87
cmp eax, 0x80000000
je 0x1000de80
cmp eax, 1
jne 0x1000e00e
pop ebp
ret
mov eax, 4
pop ebp
ret
mov eax, 2
pop ebp
ret
cmp eax, 4
jne 0x1000e00e
mov eax, 8
pop ebp
ret
mov eax, 0x10
pop ebp
ret
cmp eax, 0x10
je 0x1000dec6
cmp eax, 0x20
je 0x1000debf
cmp eax, 0x40
jne 0x1000e00e
mov eax, 0x80
pop ebp
ret
mov eax, 0x40
pop ebp
ret
mov eax, 0x20
pop ebp
ret
mov eax, 0x100
pop ebp
ret
cmp eax, 0x800
jg 0x1000df12
je 0x1000df0b
cmp eax, 0x100
je 0x1000df04
cmp eax, 0x200
je 0x1000defd
cmp eax, 0x400
jne 0x1000e00e
mov eax, 0x800
pop ebp
ret
mov eax, 0x400
pop ebp
ret
mov eax, 0x200
pop ebp
ret
mov eax, 0x1000
pop ebp
ret
cmp eax, 0x1000
je 0x1000df39
cmp eax, 0x2000
je 0x1000df32
cmp eax, 0x4000
jne 0x1000e00e
mov eax, 0x8000
pop ebp
ret
mov eax, 0x4000
pop ebp
ret
mov eax, 0x2000
pop ebp
ret
mov eax, 0x10000
pop ebp
ret
cmp eax, 0x800000
jg 0x1000dfbf
je 0x1000dfb8
cmp eax, 0x80000
jg 0x1000df8e
je 0x1000df87
cmp eax, 0x10000
je 0x1000df80
cmp eax, 0x20000
je 0x1000df79
cmp eax, 0x40000
jne 0x1000e00e
mov eax, 0x80000
pop ebp
ret
mov eax, 0x40000
pop ebp
ret
mov eax, 0x20000
pop ebp
ret
mov eax, 0x100000
pop ebp
ret
cmp eax, 0x100000
je 0x1000dfb1
cmp eax, 0x200000
je 0x1000dfaa
cmp eax, 0x400000
jne 0x1000e00e
mov eax, 0x800000
pop ebp
ret
mov eax, 0x400000
pop ebp
ret
mov eax, 0x200000
pop ebp
ret
mov eax, 0x1000000
pop ebp
ret
cmp eax, 0x8000000
jg 0x1000dff9
je 0x1000dff2
cmp eax, 0x1000000
je 0x1000dfeb
cmp eax, 0x2000000
je 0x1000dfe4
cmp eax, 0x4000000
jne 0x1000e00e
mov eax, 0x8000000
pop ebp
ret
mov eax, 0x4000000
pop ebp
ret
mov eax, 0x2000000
pop ebp
ret
mov eax, 0x10000000
pop ebp
ret
cmp eax, 0x10000000
je 0x1000e020
cmp eax, 0x20000000
je 0x1000e019
cmp eax, 0x40000000
je 0x1000e012
xor eax, eax
pop ebp
ret
mov eax, 0x80000000
pop ebp
ret
mov eax, 0x40000000
pop ebp
ret
mov eax, 0x20000000
pop ebp
ret

Function at 0x1001e4c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.10050e31
xor ecx, ecx
add esp, 4
cmp eax, 0xffffffff
setne al
pop ebp
ret 4
Function at 0x403200
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x40320b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x40330e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4127b4]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4127b4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4127b4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4127b4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4127b4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4127b4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4127b4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4127b4]
xor eax, edx
inc ecx
dec edi
jne 0x403226
pop edi
test esi, esi
je 0x403330
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4127b4]
xor eax, edx
inc ecx
dec esi
jne 0x403312
pop esi
pop ebx
not eax
ret

Function at 0x403340
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x4127b4]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x4127b4]
xor eax, edx
mov dword [ecx + 8], eax
ret
Function at 0x403d90
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x403dd1
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403dc6
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x403de4
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x14]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x1c]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x1c], ecx
pop ebp
pop ebx
ret
Function at 0x404ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
cmp edi, ebx
jne 0x404ade
pop edi
pop esi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x18], ebx
jne 0x404af0
pop edi
pop esi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x7c], ebx
je 0x404afe
push edi
call fcn.00405020
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push edi
call fcn.004048c0
add esp, 0x10
test eax, eax
je 0x404b27
pop edi
pop esi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
mov ebp, dword [sym.imp.MSVCRT.dll_malloc]
push 0x84
call ebp
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x404b4a
pop edi
pop esi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
push 0x4000
call ebp
mov dword [esi], eax
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x44], ecx
mov edx, dword [esp + 0x14]
add esp, 4
cmp eax, ebx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x404b82
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 0xffffff98
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp edx, ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
sete al
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
cmp eax, ebx
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
jne 0x404bd0
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
push eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00403620
add esp, 4
test eax, eax
jne 0x404bd0
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x404bfd
mov edx, dword [edi + 0x38]
shr edx, 8
mov byte [esi + 0x80], dl
jmp 0x404c09
mov eax, dword [edi + 0x3c]
shr eax, 0x18
mov byte [esi + 0x80], al
mov cl, byte [esi + 0x6c]
mov ebp, dword [esp + 0x20]
neg cl
sbb ecx, ecx
lea ebx, [esi + 0x70]
and ecx, 0xc
mov dword [esi + 0x74], 0x23456789
test ebp, ebp
mov dword [esi + 0x7c], ecx
mov dword [ebx], 0x12345678
mov dword [esi + 0x78], 0x34567890
je 0x404c49
mov al, byte [ebp]
test al, al
je 0x404c49
push eax
push ebx
call fcn.00403340
add esp, 8
inc ebp
jne 0x404c35
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
mov dword [esi + 8], 0
lea ecx, [edx + eax + 0x1e]
xor eax, eax
mov dword [esi + 0x3c], ecx
mov dword [edi + 0x7c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x405200
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x4052e2
cmp dword [ebp + 4], 0xffffffff
jne 0x4052e2
push ebx
lea ebx, [ebp + 0x140]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov cl, byte [ecx + ebp + 0x13f]
cmp cl, 0x5c
je 0x405272
cmp cl, 0x2f
je 0x405272
mov edi, 0x4162a0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
cmp edi, 1
pop ebx
jne 0x40529e
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40529e
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push edi
push ecx
push esi
call fcn.00403b40
add esp, 0x10
test eax, eax
jne 0x4052c1
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.00404110
add esp, 4
mov dword [ebp], eax
neg eax
sbb eax, eax
pop edi
and eax, 0xfffffe00
pop esi
add eax, 0x200
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc