joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c1e0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bt cx, 8
clc
mov dword [ebp - 0x10], ecx
neg ch
rcl ch, cl
mov ecx, dword [ebp + 0xc]
test dh, 0
mov byte [esp], 0xe4
cmc
pushfd
cmp ecx, 0xffff
pushfd
push eax
mov byte [esp], 0x9d
lea esp, [esp + 0x10]
jbe 0x51310b
mov bl, 0x1c
mov edi, dword [edx + 0x24]
neg bl
jmp 0x513b9f
neg bx
add edi, eax
bts bx, 4
rol cx, cl
sbb bx, 0x1052
sub cl, dh
mov ebx, dword [edx + 0x20]
lea ecx, [esi*2 - 0x36f86092]
add ebx, eax
ror ch, 1
adc cx, dx
mov dword [ebp - 8], 0
dec cl
movzx cx, dl
test al, ah
dec ch
mov ecx, dword [edx + 0x18]
stc
pushal
cmp ecx, dword [ebp - 8]
mov byte [esp], 0x49
mov byte [esp], 0x8a
call fcn.0050eae0
add byte [eax], al
push edi
jb 0x513c58
je 0x513c56
inc esi
imul ebp, dword [ebp], 0xf5ea3966
test eax, eax
mov byte [esp], 0x89
pushal
lea esp, [esp + 0x24]
jns 0x50f570
push esi
lea esp, [esp + 4]
je 0x513093
bswap si
dec esi
jl 0x513bd9
stc
mov eax, 0xfc6f0ce8
dec dword [ebp + 0xf502464]
lea esp, [esp + 0x50]
invalid
test dword [ecx], ebx
loop 0x513c63
push eax
push esi
rcl dl, 1
shl byte [edi], 1
call 0xc5500ea6

Function at 0x4d1fdb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
clc
mov word [esp], 0x4daa
mov word [esp], 0x6e10
mov ah, al
cmc
clc
pushfd
ror al, 2
cmc
cmc
mov byte [esp], ah
pushal
neg al
jmp 0x513633
mov byte [esp], dh
pushfd
rol al, 1
push esi
bt di, 0xa
bt di, cx
test bh, cl
not al
clc
xor al, 0x74
test dl, ah
pushfd
jmp 0x50e647
jmp 0x4d2561
add ecx, 1
push 0xd3f9a39d
mov byte [esp + 8], 0x1c
test ebp, 0xefcd32c9
test ah, ah
pushal
pushfd
lea esp, [esp + 0x30]
jne 0x4c1e8a
call fcn.004dc405
push 0x51727c7a
pushal
call fcn.0051313b
add byte [eax], al
inc edi
je 0x4dba6b
push 0x64616572
inc esp
jae 0x4dba8b
je 0x4dba91
jo 0x4dba24
add byte [eax], al
push ebx
jne 0x4dba9c
jo 0x4dba90
outsb dx, byte [esi]
push esp
push 0x64616572
add byte [ebx - 0x73], dl
push ebx
lea esp, [esp + 0x10]
je 0x49e758
pushfd
push ebp
lea esp, [esp + 8]
jmp 0x49e770
inc esp
dec esp
dec esp
add byte [edi], cl
test dword [esi - 0x63fffffc], ebp
popal
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x74697243
imul esp, dword [ebx + 0x61], 0x6365536c
je 0x4dbb06
imul ebp, dword [edi + 0x6e], 0x44000000
outsb dx, byte [esi]
jae 0x4dbaec
outsd dx, dword [esi]
add byte [eax], al
add byte [ebx + 0x65], dl
je 0x4dbb52
add bl, dh
movsb byte es:[edi], byte [esi]
call fcn.004dbb12
add byte [eax], al
push esp
jb fcn.004dc413
imul ebp, dword [esi + 0x61], 0x72506574
outsd dx, dword [esi]
arpl word [ebp + 0x73], sp
jae 0x4dc3b3
bt esi, esi
add edi, eax
jmp 0x50ec3d
not al
jmp 0x5132f9
mov dword [esp], ecx
bt bx, dx
stc
stc
pushfd
xor al, 0x45
lea esp, [esp + 0x38]
je 0x4dc39b
pushfd
mov byte [ecx], al
test al, cl
cmc
push 0x4edb4d67
jmp 0x4db9e0
stc
clc
not al
jmp 0x4db999
Function at 0x4dbb12
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, 0xc
bt cx, si
mov al, byte [ecx]
call fcn.004d1fdb
add byte [eax], al
inc esi
jb 0x4c1f01
inc ebp
outsb dx, byte [esi]
jbe 0x4c1f0a
jb 0x4c1f12
outsb dx, byte [esi]
insd dword es:[edi], dx
outsb dx, byte gs:[esi]
je 0x4c1efc
je 0x4c1f1d
imul ebp, dword [esi + 0x67], 0xf005773
mov ds, word [ebx]
dec edx
pop edx
pop esp
mov bh, 0xe4
ljmp 0xb2a2:0xe98c2fdc
push eax
mov byte [ecx], al
bt esi, 6
cmp dl, 0x4a
clc
add ecx, 1
pushfd
test al, dh
push dword [esp]
test ah, ah
mov dword [esp], 0xde3a8e47
pushal
push dword [esp]
jmp 0x5120df
jmp 0x4c26f3
jne 0x4d1c55
pushal
mov dword [esp + 0x1c], edi
mov word [esp + 4], bp
jmp 0x511fef
mov byte [esp], ah
pushal
mov dword [esp + 0x38], ebx
call fcn.004d1c5a
add byte [eax], al
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
inc ecx
outsb dx, byte [esi]
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
push ebx
imul esp, dword [eax + eax - 0x56], 0x648d9c9c
stosb byte es:[edi], al
pushfd
pushfd
lea esp, [esp + 0x2c]
jmp 0x49e47e
lea esp, [esp + 0x34]
jne 0x4c1e8a
jmp 0x4dbebd

Function at 0x5136b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x4daa59
add byte [eax], al
jle 0x4dbed2
pushfd
pushfd
jne 0x4db66a
jae 0x4dc343
dec al
pushfd
mov bl, 2
call fcn.0050ec31
setb bl
mov bl, 2
inc al
inc al
inc ecx
push ecx
jmp 0x513891
pushfd
call 0x50e1ff
pushal
lea esp, [esp + 0x20]
jne 0x4a1552
pushal
push ecx
lea esp, [esp + 0x24]
call fcn.0050fe7a
cmp si, sp
cmp cl, 0x16
sub ecx, ebx
pushal
mov byte [esp + 0x1c], dl
lea esp, [esp + 0x20]
jne 0x4d1ce9
pushfd
lea esp, [esp + 4]
call fcn.0050fe70
push 0xcd62a0c8
pushal
push dword [esp + 0xc]
pushfd
lea esp, [esp + 0x2c]
jmp fcn.004c28d6
lea esp, [esp + 0x24]
jae 0x4c1eb1
stc
pushal
xor eax, eax
pushal
pushfd
lea esp, [esp + 0x44]
call fcn.0050ea6d
jle 0x4dac56
pushal
lea esp, [esp + 0x20]
jae 0x4dc343
pushal
inc bl
jmp 0x4db099
mov al, 0x10
lea esp, [esp + 0x24]
Function at 0x10018be0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10018bf5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10018c34
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10018c30
lea ebx, [ebx]
cmp esi, edx
jae 0x10018c34
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10018c20
cmp esi, edx
jb 0x10018c39
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x100191b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067148
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x100864b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
lea eax, [ebp + 8]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.10015100
lea ecx, [ebp - 0x28]
call fcn.10019d30
mov esi, eax
add esp, 0x18
lea eax, [ebp + 8]
cmp eax, esi
je 0x10019241
cmp dword [ebp + 0x1c], 0x10
jb 0x10019226
push dword [ebp + 8]
call fcn.10027712
add esp, 4
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
call fcn.10014360
cmp dword [ebp - 0x14], 0x10
jb 0x10019252
push dword [ebp - 0x28]
call fcn.10027712
add esp, 4
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmovae eax, dword [ebp + 8]
push eax
call esi
test eax, eax
jne 0x1001927c
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call esi
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 0x10
jb 0x100192a0
push dword [ebp + 8]
call fcn.10027712
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019980
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067280
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x100864b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
lea eax, [ebp + 8]
mov dword [ebp - 0x14], 7
push eax
mov dword [ebp - 0x18], 0
call fcn.10014790
sub esp, 0x18
mov byte [ebp - 4], 1
mov esi, esp
xor eax, eax
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.10014790
mov ecx, esi
call fcn.1001c5d0
add esp, 0x18
call fcn.10019050
add esp, 0x18
mov bl, al
cmp dword [ebp - 0x14], 8
jb 0x10019a23
push dword [ebp - 0x28]
call fcn.10027712
add esp, 4
test bl, bl
jne 0x10019a2b
mov bl, 1
jmp 0x10019a59
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0x80
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x10019a6a
push dword [ebp + 8]
call fcn.10027712
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b3a0
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100676f0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100864b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae eax, dword [ebp + 8]
push eax
movzx eax, cx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x1001b4be
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x1001b4be
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001b4be
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1001b4be
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp + 0x20]
cmovae ecx, dword [ebp + 0x20]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1001b45e
sub esp, 0x18
lea eax, [ebp + 0x20]
mov ecx, esp
push eax
call fcn.10015230
mov edx, 0x64
mov ecx, 0xbb8
call fcn.10019a80
add esp, 0x18
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 0x20]
push 0
cmovae eax, dword [ebp + 0x20]
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001b4be
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1001b4be
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
lea eax, [ebp + 0x20]
mov ecx, esp
push eax
call fcn.10015230
call fcn.10019050
add esp, 0x18
test al, al
je 0x1001b4be
mov bl, 1
jmp 0x1001b4c0
xor bl, bl
cmp dword [ebp + 0x1c], 0x10
jb 0x1001b4d1
push dword [ebp + 8]
call fcn.10027712
add esp, 4
cmp dword [ebp + 0x34], 0x10
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
jb 0x1001b4f4
push dword [ebp + 0x20]
call fcn.10027712
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100325a2
mov esp, ebp
pop ebp
ret
Function at 0x1001b520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x1c], 0x10
push ebx
push esi
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x24]
push eax
movzx eax, cx
push eax
push edi
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x1001b59c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x1001b59c
cmp dword [ebp - 8], 0
jne 0x1001b56f
mov eax, dword [ebp - 4]
mov bl, 1
mov dword [eax], esi
jmp 0x1001b59e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001b59c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x1001b59c
push esi
push eax
mov eax, dword [ebp - 4]
push dword [eax]
push dword [ebp - 8]
call fcn.10033542
add esp, 0x10
mov bl, 1
jmp 0x1001b59e
xor bl, bl
cmp dword [ebp + 0x1c], 0x10
jb 0x1001b5af
push dword [ebp + 8]
call fcn.10027712
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001b980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067b3a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100864b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.1004ff7a
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x1001ba26
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.10041753
push 0x10084704
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.10033a26
push edi
push esi
call fcn.1004ccfd
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100325a2
mov esp, ebp
pop ebp
ret 4
Function at 0x1001ba50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067b3a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100864b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x18], esi
call fcn.1004ff7a
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x1001baf6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.10041753
push 0x10084704
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.10033a26
push edi
push 0x3f
push esi
call fcn.1004eb1e
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100325a2
mov esp, ebp
pop ebp
ret 8

Function at 0x1001cb10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x1001cb41
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1001cb30
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x1001d340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x1001d371
lea ecx, [ecx]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1001d360
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x1001f810
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1001f81b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x1001f8e5
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100796f0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100796f0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100796f0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100796f0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100796f0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100796f0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100796f0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100796f0]
dec edi
jne 0x1001f830
pop edi
test esi, esi
je 0x1001f90a
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100796f0]
dec esi
jne 0x1001f8f0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x1001f920
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
and eax, 0xff
shr esi, 8
mov eax, dword [eax*4 + 0x100796f0]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x100796f0]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x1001f970
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
push esi
mov bl, dl
mov edx, ecx
push edi
mov edi, dword [edx + 8]
mov esi, edi
mov ecx, dword [edx]
and esi, 0xfffd
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
shr eax, 8
xor bl, al
movsx eax, bl
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x100796f0]
xor eax, ecx
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, edi
shr edi, 8
and eax, 0xff
xor edi, dword [eax*4 + 0x100796f0]
mov al, bl
mov dword [edx + 8], edi
pop edi
pop esi
pop ebx
ret
Function at 0x100200e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100864b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x10020126
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10020121
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x1002014e
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x10020137
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 8]
call fcn.10039a90
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
mov ecx, dword [ebp - 4]
xor edx, edx
pop edi
div ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.100325a2
mov esp, ebp
pop ebp
ret

Function at 0x10020170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100864b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
mov edi, 1
cmp byte [esi], 0
je 0x100201b5
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 5]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100201b0
mov byte [esi + 8], 1
mov edi, dword [ebp - 0xc]
jmp 0x100201e2
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x100201c6
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 5]
push eax
call fcn.10039a90
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 0xc]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x10020200
movzx eax, byte [ebp - 5]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100325a2
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x100201ed
cmp byte [esi + 8], 0
je 0x100201ed
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100325a2
mov esp, ebp
pop ebp
ret
Function at 0x100202c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100864b0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x10020309
cmp byte [edi + 1], 0
je 0x100202f7
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1002030f
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100325a2
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], eax
cmp byte [edi], 0
push ebx
je 0x10020334
cmp byte [edi + 1], 0
je 0x1002032d
push 1
push 0
push 0
push dword [edi + 4]
call ecx
mov ebx, eax
sub ebx, dword [edi + 0xc]
jmp 0x10020337
xor ebx, ebx
mov dword [ebp - 0x14], ebx
jmp 0x10020346
mov ebx, dword [edi + 0x1c]
mov eax, 0xffff
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
cmp ebx, eax
jae 0x10020349
mov dword [ebp - 0x10], ebx
push esi
push 0x404
call fcn.10033994
mov esi, eax
add esp, 4
test esi, esi
jne 0x10020371
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100325a2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov eax, 4
mov dword [ebp - 0xc], 0xffffffff
cmp ecx, eax
jbe 0x10020478
jmp 0x10020390
add eax, 0x400
cmp eax, ecx
mov edx, eax
mov eax, 0x404
cmova edx, ecx
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x20], edx
sub ebx, ecx
mov dword [ebp - 0x1c], ecx
cmp ebx, 0x404
cmova ebx, eax
cmp byte [edi], 0
je 0x100203da
cmp byte [edi + 1], 0
je 0x10020478
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x100203dd
mov dword [edi + 0x1c], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0x18], ebx
je 0x10020405
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10020400
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x1002042e
mov edx, dword [edi + 0x1c]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
jbe 0x10020418
mov ecx, dword [edi + 0x18]
sub ecx, edx
mov dword [ebp - 0x18], ecx
push ecx
mov ecx, dword [edi + 0x14]
add ecx, edx
push ecx
push esi
call fcn.10039a90
mov eax, dword [ebp - 0x18]
add esp, 0xc
add dword [edi + 0x1c], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x10020478
lea eax, [ebx - 3]
test eax, eax
js 0x10020460
mov edi, edi
dec eax
cmp byte [eax + esi], 0x50
jne 0x1002045c
cmp byte [eax + esi + 1], 0x4b
jne 0x1002045c
cmp byte [eax + esi + 2], 5
jne 0x1002045c
cmp byte [eax + esi + 3], 6
je 0x10020495
test eax, eax
jns 0x10020440
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x10020478
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
cmp eax, ecx
jb 0x10020390
push esi
call fcn.10033013
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 0xc]
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.100325a2
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
jmp 0x10020463