joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4043e0
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x420014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x210], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x4188ac
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov dword [ebp - 0x218], eax
cmp dword [ebp + 0xc], 1
jb 0x404432
cmp dword [ebp + 0xc], 0x1000
jbe 0x404443
push 0x57
call sub.KERNEL32.dll_SetLastError
jmp 0x404614
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00402bb0
test eax, eax
jne 0x404469
jmp 0x404614
cmp dword [ebp - 0x218], 0
je 0x40447e
cmp dword [ebp - 0x218], 0x104
jb 0x404488
jmp 0x404614
push 0x4188b4
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.00402640
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jge 0x4044b7
jmp 0x404614
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 0x210]
lea eax, [edx + ecx + 0xc]
push eax
push 0x4188cc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004026f0
add esp, 0x10
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jge 0x4044fc
jmp 0x404614
push 0x10
push 0
lea edx, [ebp - 0x230]
push edx
call fcn.00406b10
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.00406b10
add esp, 0xc
mov dword [ebp - 0x274], 0x44
lea ecx, [ebp - 0x230]
push ecx
lea edx, [ebp - 0x274]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [ebp + 0x14]
test eax, eax
je 0x404614
mov edx, dword [ebp - 0x210]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
push 0x418770
mov edx, dword [ebp - 0x230]
push edx
call fcn.00403f50
test eax, eax
jne 0x4045ae
push 0xffffffffffffffff
mov eax, dword [ebp - 0x230]
push eax
call sub.KERNEL32.dll_TerminateProcess
mov ecx, dword [ebp - 0x230]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x22c]
push edx
call sub.KERNEL32.dll_CloseHandle
jmp 0x404614
mov eax, dword [ebp - 0x22c]
push eax
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x230]
push ecx
call sub.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x21c], 0x1f4
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x230]
push eax
call sub.KERNEL32.dll_GetExitCodeProcess
mov ecx, dword [ebp - 0x230]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x22c]
push edx
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x21c], 0
je 0x40460a
jmp 0x404614
mov dword [ebp - 0x220], 1
lea eax, [ebp - 0x210]
push eax
call fcn.00403030
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405951
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10001910
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ebx
cmp byte [ebx], 0xe9
jne 0x10001934
lea ecx, [ebx + 5]
add ecx, dword [ebx + 1]
call fcn.10001910
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x2c]
mov ecx, dword [0x102cc2b8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x102cd2e8]
cmp eax, dword [ecx + 4]
jle 0x1000198c
push 0x102cd2e8
call fcn.1001182a
add esp, 4
cmp dword [0x102cd2e8], 0xffffffff
jne 0x1000198c
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x102cd2e8
mov dword [0x102cd2e4], eax
call fcn.100117e0
add esp, 4
push esi
mov esi, dword [0x102cd2e4]
push edi
lea edx, [esi + 0x1000]
cmp esi, edx
je 0x100019b3
nop
lea ecx, [esi + 0x1c]
call fcn.10001900
test eax, eax
je 0x100019b5
add esi, 0x20
cmp esi, edx
jne 0x100019a0
xor esi, esi
xor edi, edi
lea ecx, [edi + ebx]
call fcn.100016c0
add edi, eax
cmp edi, 5
jl 0x100019b7
test edi, edi
jle 0x100019e1
mov ecx, esi
sub ebx, esi
mov edx, edi
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x100019d0
mov ebx, dword [ebp - 0xc]
lea ecx, [edi + esi]
sub edi, ecx
mov byte [ecx], 0xe9
lea eax, [edi - 5]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add eax, ebx
mov dword [ecx + 1], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push ebx
call edi
mov eax, dword [ebp - 0x10]
sub eax, ebx
mov byte [ebx], 0xe9
sub eax, 5
mov dword [ebx + 1], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100042c0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x1004400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jmp 0x100042e5
jmp 0x100042f7
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x69676e65
push eax
mov dword [ebp - 0x20], 0x642e656e
mov word [ebp - 0x1c], 0x6c6c
mov byte [ebp - 0x1a], 0
call edi
push 0x1003f770
push str.kernel32.dll
mov dword [0x102cd28c], eax
mov dword [ebp - 0x10], 0x5f327377
mov dword [ebp - 0xc], 0x642e3233
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
mov dword [ebp - 0x18], 0x6e6e6f63
mov dword [ebp - 0x14], 0x746365
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
test eax, eax
je 0x100044f3
mov edx, 0x100030f0
mov ecx, eax
call fcn.10001910
push str.SetFilePointer
push str.kernel32.dll
mov dword [0x102cd2b0], eax
call edi
push eax
call esi
test eax, eax
je 0x100044f3
mov edx, 0x10003060
mov ecx, eax
call fcn.10001910
push str.GetFileSize
push str.kernel32.dll
mov dword [0x102cd2a4], eax
call edi
push eax
call esi
test eax, eax
je 0x100044f3
mov edx, 0x100031d0
mov ecx, eax
call fcn.10001910
push 0x1003f7a8
push str.kernel32.dll
mov dword [0x102cd2a8], eax
call edi
push eax
call esi
test eax, eax
je 0x100044f3
mov edx, 0x10003260
mov ecx, eax
call fcn.10001910
mov dword [0x102cd290], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call edi
push eax
call esi
test eax, eax
je 0x100044f3
mov edx, 0x10003010
mov ecx, eax
call fcn.10001910
mov dword [0x102cd2b8], eax
lea eax, [ebp - 0x10]
push str.send
push eax
call edi
push eax
call esi
test eax, eax
je 0x100044f3
movaps xmm0, xmmword [0x1003fba0]
lea eax, [ebp - 0x68]
movups xmmword [ebp - 0x68], xmm0
push eax
movaps xmm0, xmmword [0x1003fb90]
push dword [0x102cd28c]
movups xmmword [ebp - 0x58], xmm0
mov word [ebp - 0x28], 0x5a
movaps xmm0, xmmword [0x1003fb80]
movups xmmword [ebp - 0x48], xmm0
movaps xmm0, xmmword [str.NetworkPacket___ndler__UAEHPAPAUQueue_UNetworkHa_DispatchNetwork]
movups xmmword [ebp - 0x38], xmm0
call esi
test eax, eax
je 0x100044f3
mov edx, 0x10003390
mov ecx, eax
call fcn.10001910
push str._RequestAuthLogin_UNetworkHandler__UAEHPAG0H_Z
push dword [0x102cd28c]
mov dword [0x102cd29c], eax
call esi
test eax, eax
je 0x100044f3
mov edx, 0x100033b0
mov ecx, eax
call fcn.10001910
push str._RequestPCCafeCouponUse_UNetworkHandler__UAEXVFString___Z
push dword [0x102cd28c]
mov dword [0x102cd298], eax
call esi
test eax, eax
je 0x100044f3
mov edx, 0x10004160
mov ecx, eax
call fcn.10001910
push str._RequestServerLogin_UNetworkHandler__UAEHAAVL2ParamStack___Z
push dword [0x102cd28c]
call esi
test eax, eax
je 0x100044f3
mov edx, 0x10003660
mov ecx, eax
call fcn.10001910
mov dword [0x102cd2b4], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011680
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011680
mov esp, ebp
pop ebp
ret
Function at 0x10007720
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002fe10
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1004400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1001193b
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10012a21
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10009860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000988b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100054f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x100098ad
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x100098af
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10009933
jg 0x100098c4
test esi, esi
je 0x10009933
test ecx, ecx
jl 0x1000990d
jg 0x100098ce
test eax, eax
je 0x1000990d
cmp edi, ecx
jg 0x100098e2
jl 0x100098d8
cmp esi, eax
jae 0x100098e2
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.100160e0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10009910
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10009933
jg 0x1000991a
test esi, esi
je 0x10009933
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10009933
push eax
push esi
push 1
push edx
call fcn.1001af30
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10009950
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x1000997b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100055d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000999d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x1000999f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x10009a3e
jg 0x100099bc
test esi, esi
je 0x10009a3e
test ecx, ecx
jl 0x10009a09
jg 0x100099c6
test eax, eax
je 0x10009a09
cmp ebx, ecx
jg 0x100099da
jl 0x100099d0
cmp esi, eax
jae 0x100099da
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.100160e0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10009a10
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x10009a3e
jg 0x10009a1a
test esi, esi
je 0x10009a3e
cmp dword [edi + 0x4c], 0
je 0x10009a3e
mov ecx, edi
call fcn.1000a400
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.1001b606
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10009d70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1004400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10009da0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011680
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10009ddc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x10009ddc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011680
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10009ec1
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10009e04
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10009e37
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.10019197
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011680
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x10009ec1
cmp eax, 1
jle 0x10009e94
cmp eax, 3
jne 0x10009ec1
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10002890
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011680
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10009eb1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1001af30
add esp, 0x10
cmp edi, eax
jne 0x10009ec1
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x10009dc7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011680
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a4c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1004400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x1000a561
cmp byte [esi + 0x3d], 0
je 0x1000a561
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000a517
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1000a529
sub eax, 1
je 0x1000a52d
sub eax, 2
je 0x1000a561
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011680
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000a54a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1001af30
add esp, 0x10
cmp edi, eax
jne 0x1000a517
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011680
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.10011680
mov esp, ebp
pop ebp
ret
Function at 0x1000d000
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10030d8a
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1004400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea esi, [eax + 0x18]
mov dword [ebp - 4], 0
lea eax, [ecx + 0x18]
push esi
mov ecx, eax
mov dword [ebp + 8], eax
call fcn.10004a90
push 0x10
mov byte [ebp - 4], 1
call fcn.1001193b
mov edi, eax
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 2
mov esi, dword [esi + 0x18]
push 0x48
call fcn.1001193b
add esp, 8
mov dword [edi + 4], eax
mov byte [ebp - 4], 3
mov ecx, edi
push esi
mov dword [edi + 0xc], 0
call fcn.1000f070
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10013af6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1004400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x10013b1b
xor eax, eax
jmp 0x10013b77
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x10013b48
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x10013b48
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x10013bfc
cmp dword [edi + 0x4c], 0
je 0x10013b71
mov ecx, edi
call fcn.10013549
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x10013b87
push dword [edi + 0x4c]
push ebx
call fcn.10012d38
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x10013b76
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10011680
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x10032154]
mov ecx, dword [ebp - 0x2c]
call esi
test eax, eax
js 0x10013b71
cmp eax, 1
jle 0x10013bcf
cmp eax, 3
jne 0x10013b71
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x10013b63
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x10013bec
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.1001af30
add esp, 0x10
cmp esi, eax
jne 0x10013b71
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x10013b71
mov ax, bx
jmp 0x10013b76

Function at 0x1002391c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100235df
Function at 0x10023927
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10023760
Function at 0x101632b
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x1016336
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x10163ea
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1037d08]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1037d08]
movzx ebx, byte [ecx + 2]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1037d08]
movzx ebx, byte [ecx + 3]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1037d08]
movzx ebx, byte [ecx + 4]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1037d08]
movzx ebx, byte [ecx + 5]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1037d08]
movzx ebx, byte [ecx + 6]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1037d08]
movzx ebx, byte [ecx + 7]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1037d08]
add ecx, 8
sub edi, 8
dec esi
jne 0x101634d
pop ebx
test edi, edi
je 0x1016403
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x1037d08]
inc ecx
dec edi
jne 0x10163ee
pop esi
not eax
pop edi
ret

Function at 0x1016408
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x1037d08]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x1037d08]
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219