joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a3a
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], str.expand_32_byte_k
mov eax, dword [ebp + 8]
lea edx, [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 8]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0xc]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x10]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x2c]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x30]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x14]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x34]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x18]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x38]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 8]
lea edx, [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x18]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x1c]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x20]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x24]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x40]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x44]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x14]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x48]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x18]
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x4c]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x1c]
mov dword [edx], eax
nop
leave
ret
Function at 0x401c3a
Capabilities:
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401dfe
mov dword [esp + 4], str.personal_id
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401dfe
mov dword [esp + 4], 0x40c0c6
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401e01
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_ftell
mov dword [ebp - 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov ecx, 0
mov eax, 0x18
and eax, 0xfffffffc
mov edx, eax
mov eax, 0
mov dword [ebp + eax - 0x2c], ecx
add eax, 4
cmp eax, edx
jb 0x401d2a
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00401b5c
mov dword [esp + 4], 0x40c0c9
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401d81
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x401e02
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x130]
mov dword [esp], eax
call sub.msvcrt.dll__snprintf
lea eax, [ebp - 0x130]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_MoveFileA
sub esp, 8
jmp 0x401e02
nop
jmp 0x401e02
nop
leave
ret
Function at 0x40201b
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x378
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x250]
mov dword [esp], eax
call fcn.004033f0
lea eax, [ebp - 0x14c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x250]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x402145
mov dword [esp + 4], 0x40c074
lea eax, [ebp - 0x14c]
add eax, 0x2c
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402114
mov dword [esp + 4], 0x40c076
lea eax, [ebp - 0x14c]
add eax, 0x2c
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402114
lea eax, [ebp - 0x14c]
add eax, 0x2c
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40c079
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x354]
mov dword [esp], eax
call fcn.004033f0
mov eax, dword [ebp - 0x14c]
and eax, 0x10
test eax, eax
je 0x402105
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x354]
mov dword [esp], eax
call fcn.0040201b
jmp 0x402115
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea edx, [eax + 1]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x402115
nop
lea eax, [ebp - 0x14c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
jne 0x402071
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_FindClose
sub esp, 4
jmp 0x402146
nop
leave
ret
Function at 0x402e00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40f048
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40f040]
sub esp, 4
test ebx, ebx
je 0x402e4b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x402e44
test esi, esi
je 0x402e44
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402e20
mov dword [esp], 0x40f048
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x403030
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x403080
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x403158
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4030be
cmp eax, 4
jne 0x4030e0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4030ce
cmp edx, 4
je 0x4030ce
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00403030
Function at 0x861cc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x892c20]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.00876cc0
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x861d8f
mov eax, 0x88c894
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x861d05
sub eax, edx
sar eax, 1
je 0x861d8f
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [fcn.00889234]
push 0x88c894
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.008748ea
push 0x88c8b0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00874e3b
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x861d8f
push eax
push 1
push 0x200
push esi
call fcn.0087512e
mov eax, dword [esp + 0x14]
push eax
call fcn.008751c2
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.008748db
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.008748db
add esp, 0x214
ret

Function at 0x861db0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x892c20]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.00876cc0
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x861eb5
mov eax, 0x88c7e0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x861df5
sub eax, edx
sar eax, 1
je 0x861eb5
cmp dword [0x893fbc], 3
jne 0x861e3c
push 0x104
lea edx, [esp + 0x10]
push edx
call dword [fcn.00889214]
push 0x88c8b8
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.008748ea
add esp, 0xc
jmp 0x861e4c
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [fcn.00889234]
push 0x88c7e0
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.008748ea
push 0x88c8b0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00874e3b
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x861eb5
push eax
push 1
push 0x200
push esi
call fcn.0087512e
mov edx, dword [esp + 0x14]
push edx
call fcn.008751c2
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.008748db
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.008748db
add esp, 0x214
ret
Function at 0x8625c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
or eax, 0xffffffff
push ebx
mov ebx, 1
push ebp
push esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x74], eax
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
call fcn.008749e8
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x88e4b0]
fadd qword [0x88e4c8]
call fcn.008789e0
mov ebp, eax
xor esi, esi
xor edi, edi
test ebp, ebp
jle 0x8626e0
call fcn.008749e8
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x88e4b0]
fmul qword [0x88e4c0]
fadd qword [0x88e4b8]
call fcn.008789e0
mov ecx, eax
mov eax, dword [esp + ecx*4 + 0x18]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jle 0x8626c8
lea esp, [esp]
add ecx, ebx
cmp ecx, 0x1a
jne 0x8626b9
xor ecx, ecx
mov eax, dword [esp + ecx*4 + 0x18]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jg 0x8626b0
add esi, dword [esp + ecx*4 + 0x18]
mov eax, dword [esp + 0x84]
add ecx, 0x61
mov word [eax + edi*2], cx
add edi, ebx
cmp edi, ebp
jl 0x862677
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret

Function at 0x862780
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x892c20]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push 0x206
xor esi, esi
lea ecx, [esp + 0x12]
xor eax, eax
push esi
push ecx
mov word [esp + 0x18], ax
call fcn.00876cc0
add esp, 0xc
cmp edi, esi
je 0x862868
mov eax, 0x88c790
mov dword [esp + 4], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x8627c5
sub eax, edx
sar eax, 1
je 0x8627ef
push 0x88c924
lea edx, [esp + 8]
push 0x88c790
push edx
call fcn.00874e3b
add esp, 0xc
jmp 0x86282a
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [fcn.00889234]
push 0x88c894
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.008748ea
push 0x88c924
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00874e3b
add esp, 0x18
mov eax, dword [esp + 4]
cmp eax, esi
je 0x86284d
push eax
push 1
push 0x200
push edi
call fcn.00875401
mov ecx, dword [esp + 0x14]
push ecx
call fcn.008751c2
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.008748db
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.008748db
add esp, 0x214
ret
Function at 0x862880
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push 0x88c8b0
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0
call fcn.00874e3b
add esp, 0xc
test eax, eax
je 0x8628a4
xor eax, eax
pop ecx
ret
mov edx, dword [esp]
push ebx
push ebp
push esi
push edi
push 2
push 0
push edx
call fcn.0087550d
mov eax, dword [esp + 0x1c]
push eax
call fcn.0087572f
mov ecx, dword [esp + 0x20]
push 0
push 0
push ecx
mov esi, eax
call fcn.0087550d
lea ebp, [esi + 0x32]
push ebp
call fcn.008757ec
mov edx, dword [esp + 0x30]
push edx
push 1
mov edi, eax
push esi
push edi
call fcn.0087512e
mov eax, dword [esp + 0x40]
push eax
call fcn.008751c2
lea ebx, [edi + esi]
mov eax, 0x32
call fcn.00862950
mov ecx, dword [esp + 0x4c]
push 0x88c924
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.00874e3b
add esp, 0x40
test eax, eax
je 0x862922
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x10]
push eax
push 1
push ebp
push edi
call fcn.00875401
mov ecx, dword [esp + 0x20]
push ecx
call fcn.008751c2
add esp, 0x14
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x864570
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x100c
call fcn.00879170
mov eax, dword [0x892c20]
xor eax, esp
mov dword [esp + 0x1008], eax
mov edx, dword [edi]
mov eax, dword [esp + 0x1010]
push ebx
push ebp
mov ebp, dword [0x8893d4]
xor ebx, ebx
push ebx
push 4
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x1c], eax
call ebp
cmp eax, 4
je 0x8645c8
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.008748db
add esp, 0x100c
ret
cmp dword [esp + 8], ebx
jbe 0x864607
push esi
nop
mov ecx, dword [edi]
push 0
push 0x1000
lea eax, [esp + 0x1c]
push eax
push ecx
call ebp
mov esi, eax
test esi, esi
je 0x864606
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push eax
push esi
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.00875401
add ebx, esi
add esp, 0x10
cmp ebx, dword [esp + 0xc]
jb 0x8645d0
pop esi
mov edx, dword [esp + 0xc]
mov eax, dword [edx]
push eax
call fcn.008751c2
mov ecx, dword [esp + 0x1014]
add esp, 4
cmp ebx, dword [esp + 8]
pop ebp
sbb eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.008748db
add esp, 0x100c
ret
Function at 0x8661b0
Capabilities:
Hash data using sha1
Read file on windows

Disassembly:
mov eax, 0x1068
call fcn.00879170
mov eax, dword [0x892c20]
xor eax, esp
mov dword [esp + 0x1064], eax
mov eax, dword [esp + 0x106c]
push ebx
push ebp
push 0x88c8b0
push eax
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x14], ebx
xor ebp, ebp
call fcn.00874e3b
mov eax, dword [esp + 0x14]
add esp, 0xc
cmp eax, ebx
jne 0x86621b
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
pop ebp
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
pop ebx
mov ecx, dword [esp + 0x1064]
xor ecx, esp
call fcn.008748db
add esp, 0x1068
ret
push esi
push 2
push ebx
push eax
call fcn.0087550d
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0087572f
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push edx
mov dword [esp + 0x2c], eax
call fcn.0087550d
mov eax, dword [esp + 0x28]
push eax
push 0x1000
lea ecx, [esp + 0x94]
push 1
push ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], 0x67452301
mov dword [esp + 0x4c], 0xefcdab89
mov dword [esp + 0x50], 0x98badcfe
mov dword [esp + 0x54], 0x10325476
mov dword [esp + 0x58], 0xc3d2e1f0
call fcn.0087512e
mov esi, eax
add esp, 0x2c
cmp esi, ebx
jbe 0x8662c6
lea edx, [esp + 0x70]
push esi
push edx
lea ebx, [esp + 0x1c]
call fcn.00866020
mov eax, dword [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x80]
push 1
push ecx
add ebp, esi
call fcn.0087512e
mov esi, eax
add esp, 0x18
test esi, esi
ja 0x866291
xor ebx, ebx
push edi
lea esi, [esp + 0x18]
call fcn.008660c0
mov edx, dword [esp + 0x10]
push edx
call fcn.008751c2
add esp, 8
pop esi
cmp ebp, dword [esp + 0xc]
jb 0x8661f4
mov ecx, dword [esp + 0x106c]
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.008748db
add esp, 0x1068
ret
Function at 0x868080
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x868087
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x868164
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x88de80]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x88de80]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x88de80]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x88de80]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x88de80]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x88de80]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x88de80]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x88de80]
inc ecx
sub edx, 8
sub esi, 1
jne 0x8680a0
pop edi
test edx, edx
je 0x86818b
jmp 0x868170
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x88de80]
inc ecx
sub edx, 1
jne 0x868170
not eax
pop esi
ret

Function at 0x868190
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x88de80]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x88de80]
mov dword [edx + 8], ecx
ret

Function at 0x8681e0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x88de80]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x88de80]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0x8695e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x8695fe
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x8695f2
cmp dword [edi + 0x7c], ebx
je 0x86960d
call fcn.008699c0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00869350
add esp, 0xc
test eax, eax
je 0x869634
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x7e
call fcn.008757ec
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x869672
push 0x4000
call fcn.008757ec
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x86967f
push esi
call fcn.00875d47
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x8696c7
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.008684a0
test eax, eax
jne 0x8696c7
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x8696ee
mov cl, byte [edi + 0x39]
mov byte [esi + 0x7d], cl
jmp 0x8696f4
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x7d], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x6d]
mov dword [esi + 0x79], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x71], 0x23456789
mov dword [esi + 0x75], 0x34567890
cmp ebp, ebx
je 0x869731
lea ecx, [ecx]
mov cl, byte [ebp]
cmp cl, bl
je 0x869731
call fcn.00868190
add ebp, 1
jne 0x869720
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret