joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7b32b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [ecx + 4]
cmp edx, 0x18
je 0x7b32d0
mov eax, dword [esp + 4]
cmp edx, 0x17
jne 0x7b32d5
push ecx
push eax
call sym.adb.exe_ASN1_UTCTIME_print
add esp, 8
ret
jmp sym.adb.exe_ASN1_GENERALIZEDTIME_print
push 0xe
push 0x9331ed
push eax
call sym.adb.exe_BIO_write
add esp, 0xc
xor eax, eax
ret
Function at 0x7d97a4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x99d3b8
call fcn.007fda4e
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x7d97d0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x7d9812
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str._buildbot_src_android_mingw_toolchain_mingw_mingw_w64_v6.x_mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.006f4fc0
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x99d3b8
call fcn.007fdaac
mov eax, dword [ebp + 0xc]
leave
ret
Function at 0x7eecb0
Capabilities:
Enumerate services

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test eax, eax
je 0x7eed3f
xor ebx, ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
xor edi, edi
jmp 0x7eed07
mov ebx, dword [esp + 4]
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov edi, eax
test eax, eax
je 0x7eeda6
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push ebx
push edi
push 3
push 0x30
push esi
call ebp
test eax, eax
jne 0x7eed6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x7eed5b
test edi, edi
je 0x7eecf0
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
jmp 0x7eecf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
test eax, eax
je 0x7eedd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x7eedd2
jmp 0x7eece0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x7eed9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x7eed9e
mov ebx, dword [esp]
test ebx, ebx
je 0x7eed9e
mov ebp, edi
nop dword [eax + eax]
push str.Bonjour_Service
push dword [ebp]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x7eedaa
add ebp, 0x24
dec ebx
jne 0x7eed80
xor ebx, ebx
jmp 0x7eedbe
xor ebx, ebx
test edi, edi
jne 0x7eedbe
jmp 0x7eedc7
xor ebx, ebx
jmp 0x7eedc7
mov eax, dword [ebp + 0xc]
cmp eax, 7
sete cl
cmp eax, 1
sete al
or al, cl
movzx ebx, al
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
test esi, esi
je 0x7eedd2
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x815420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x1c]
mov byte [eax + 0x1a1], 0
mov eax, dword [ecx + 0x1c]
mov dword [eax + 0x1a4], 0
jmp fcn.007d1fc0
push edi
push esi
mov edi, dword [esp + 0xc]
push edi
call fcn.00730620
add esp, 4
push edi
call sym.adb.exe_SSL_is_dtls
add esp, 4
test eax, eax
je 0x815538
xor esi, esi
push edi
call fcn.00815130
add esp, 4
test al, al
je 0x815555
mov esi, 0xffffffff
push edi
call fcn.00815380
add esp, 4
test al, al
je 0x815555
mov eax, dword [edi + 0x1c]
shl dword [eax + 0x1c0], 1
mov eax, dword [edi + 0x1c]
cmp dword [eax + 0x1c0], 0xea61
jb 0x81548e
mov dword [eax + 0x1c0], 0xea60
mov eax, dword [edi + 0x1c]
mov ecx, dword [eax + 0x1b0]
or ecx, dword [eax + 0x1b4]
jne 0x8154b1
cmp dword [eax + 0x1b8], 0
jne 0x8154b1
mov ecx, dword [edi + 0x28]
mov dword [eax + 0x1c0], ecx
mov eax, dword [edi + 0x1c]
add eax, 0x1b0
push eax
push edi
call fcn.00730c40
add esp, 8
mov ecx, dword [edi + 0x1c]
mov eax, 0x10624dd3
mul dword [ecx + 0x1c0]
shr edx, 6
add dword [ecx + 0x1b0], edx
adc dword [ecx + 0x1b4], 0
mov edx, 0x10624dd3
mov esi, dword [edi + 0x1c]
mov ecx, dword [esi + 0x1c0]
mov eax, ecx
mul edx
shr edx, 6
imul eax, edx, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
add dword [esi + 0x1b8], eax
mov eax, dword [edi + 0x1c]
cmp dword [eax + 0x1b8], 0xf4240
jb 0x815531
add dword [eax + 0x1b0], 1
adc dword [eax + 0x1b4], 0
mov eax, dword [edi + 0x1c]
add dword [eax + 0x1b8], 0xfff0bdc0
pop esi
pop edi
jmp 0x7d2610
push 0xfc
push str.external_boringssl_src_ssl_d1_lib.cc
push 0x42
push 0
push 0x10
call sym.adb.exe_ERR_put_error
add esp, 0x14
mov esi, 0xffffffff
mov eax, esi
pop esi
pop edi
ret
Function at 0x837740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
xorps xmm0, xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
cmp dword [eax], 0
je 0x8377a1
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x10], ecx
movups xmm0, xmmword [eax]
movups xmmword [esp], xmm0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea ecx, [esp + 0x40]
call fcn.00834d80
sub esp, 0x1c
mov si, 0x1c
mov eax, 3
jmp 0x8377d4
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x10], ecx
movups xmm0, xmmword [eax]
movups xmmword [esp], xmm0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea ecx, [esp + 0x40]
call fcn.00834b50
sub esp, 0x1c
mov si, 1
mov eax, 2
mov dword [esp + 0x68], eax
mov ecx, dword [edi]
mov dword [esp + 0x30], ecx
movsd xmm0, qword [edi + 4]
movsd qword [esp + 0x34], xmm0
mov ecx, dword [edi + 0xc]
mov dword [esp + 0x3c], ecx
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], pe_nt_image_headers32
mov byte [esp + 0x78], 0
mov dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x40]
mov dword [esp + 8], ecx
lea edi, [esp + 0x78]
mov dword [esp + 4], edi
lea ebx, [esp + 0x24]
mov dword [esp], ebx
call dword [eax*4 + 0x946204]
mov eax, dword [esp + 0x68]
mov dword [esp + 0xa0], eax
movsd xmm0, qword [esp + 0x28]
movsd qword [esp + 0x10], xmm0
mov dword [esp + 0x18], edi
movzx eax, si
mov dword [esp + 4], eax
lea eax, [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 1
mov ecx, dword [ebp + 8]
call fcn.00836bc0
sub esp, 0x1c
mov eax, dword [esp + 0xa0]
cmp eax, 0xffffffff
je 0x8378a1
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax*4 + 0x9461e4]
mov dword [esp + 0xa0], 0xffffffff
mov esi, dword [esp + 0x34]
test esi, esi
je 0x8378c4
mov eax, dword [esp + 0x38]
cmp eax, esi
jne 0x8378f6
mov dword [esp], esi
call fcn.0051c570
mov eax, dword [esp + 0x68]
cmp eax, 0xffffffff
je 0x8378df
lea ecx, [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], ebx
call dword [eax*4 + 0x9461e4]
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, edi
cmp edi, esi
je 0x8378bc
lea edi, [eax - 0xc]
test byte [eax - 0xc], 1
je 0x8378f0
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.0051c570
jmp 0x8378f0
Function at 0x84fe70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
inc esi
xor eax, eax
cmp esi, edx
ja 0x84ffdb
mov ebp, dword [esp + 0x1c]
movzx ebx, byte [edx + ebp - 1]
add esi, ebx
mov ecx, edx
sub ecx, esi
xor esi, edx
xor ecx, edx
or ecx, esi
xor ecx, edx
sar ecx, 0x1f
not ecx
cmp edx, 0x100
mov eax, 0x100
cmovb eax, edx
test eax, eax
je 0x84ffb7
xor edi, edi
cmp eax, 4
jb 0x84ff87
mov edi, eax
and edi, 0x1fc
movd xmm1, ecx
movaps xmm0, xmmword [0x947070]
movss xmm0, xmm1
movd xmm2, ebx
pshufd xmm1, xmm2, 0
punpcklbw xmm2, xmm2
pshuflw xmm2, xmm2, 0
lea ecx, [edx + ebp]
add ecx, 0xfffffffc
mov esi, eax
and esi, 0xfffffffc
neg esi
movdqa xmm4, xmmword [0x947080]
xor ebp, ebp
por xmm1, xmmword [0x947090]
pxor xmm5, xmm5
movdqa xmm7, xmmword [0x9470a0]
nop dword [eax + eax]
movdqa xmm3, xmm4
pxor xmm3, xmmword [0x947090]
pcmpgtd xmm3, xmm1
movd xmm6, dword [ecx + ebp]
punpcklbw xmm6, xmm5
pshuflw xmm6, xmm6, 0x1b
packuswb xmm6, xmm6
pxor xmm6, xmm2
punpcklbw xmm6, xmm5
punpcklwd xmm6, xmm5
pxor xmm6, xmmword [0x9470b0]
por xmm6, xmm3
pand xmm0, xmm6
paddd xmm4, xmm7
add ebp, 0xfffffffc
cmp esi, ebp
jne 0x84ff20
pshufd xmm1, xmm0, 0xee
pand xmm1, xmm0
pshufd xmm0, xmm1, 0x55
pand xmm0, xmm1
movd ecx, xmm0
cmp eax, edi
mov ebp, dword [esp + 0x1c]
je 0x84ffb7
mov esi, dword [esp + 0x20]
sub esi, edi
add esi, ebp
dec esi
mov ebp, 0xffffffff
nop word cs:[eax + eax]
movzx edx, byte [esi]
xor dl, bl
cmp edi, ebx
movzx edx, dl
not edx
cmova edx, ebp
and ecx, edx
inc edi
dec esi
cmp eax, edi
jne 0x84ffa0
xor eax, eax
cmp cl, 0xff
sete al
neg eax
inc ebx
and ebx, eax
mov ecx, dword [esp + 0x20]
sub ecx, ebx
mov edx, dword [esp + 0x18]
mov dword [edx], ecx
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x8509e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
movdqu xmm0, xmmword [edx]
movdqu xmm1, xmmword [edx + 0x10]
pshufd xmm2, xmm1, 0x4e
movdqu xmm3, xmmword [ecx]
movdqa xmm1, xmmword [str.expand_32_byte_kexpand_32_byte_k]
mov ecx, 0xfffffffe
nop dword [eax + eax]
paddd xmm1, xmm0
pshufd xmm4, xmm2, 0x93
pshufd xmm0, xmm0, 0x39
pxor xmm3, xmm1
movdqa xmm2, xmm3
psrld xmm2, 0x10
pslld xmm3, 0x10
por xmm3, xmm2
pshufd xmm2, xmm3, 0x39
paddd xmm2, xmm4
pxor xmm0, xmm2
movdqa xmm4, xmm0
psrld xmm4, 0x14
pslld xmm0, 0xc
por xmm0, xmm4
pshufd xmm4, xmm0, 0x93
paddd xmm4, xmm1
pxor xmm3, xmm4
pshufd xmm1, xmm3, 0x39
movdqa xmm3, xmm1
psrld xmm3, 0x18
pslld xmm1, 8
por xmm1, xmm3
paddd xmm2, xmm1
pxor xmm0, xmm2
movdqa xmm3, xmm0
psrld xmm3, 0x19
pslld xmm0, 7
por xmm0, xmm3
paddd xmm4, xmm0
pshufd xmm3, xmm1, 0x4e
pxor xmm3, xmm4
movdqa xmm1, xmm3
psrld xmm1, 0x10
pslld xmm3, 0x10
por xmm3, xmm1
pshufd xmm2, xmm2, 0x39
paddd xmm2, xmm3
pxor xmm0, xmm2
movdqa xmm1, xmm0
psrld xmm1, 0x14
pslld xmm0, 0xc
por xmm0, xmm1
movdqa xmm1, xmm4
paddd xmm1, xmm0
pxor xmm3, xmm1
movdqa xmm4, xmm3
psrld xmm4, 0x18
pslld xmm3, 8
por xmm3, xmm4
paddd xmm2, xmm3
pxor xmm0, xmm2
pshufd xmm0, xmm0, 0x93
movdqa xmm4, xmm0
psrld xmm4, 0x19
pslld xmm0, 7
por xmm0, xmm4
pshufd xmm3, xmm3, 0x39
add ecx, 2
cmp ecx, 0x12
jb 0x850a10
movdqu xmmword [eax], xmm1
movdqu xmmword [eax + 0x10], xmm3
ret
Function at 0x8530e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
test esi, esi
je 0x85313a
xor ebp, ebp
nop word [eax + eax]
inc ecx
movzx ecx, cl
mov edi, esi
mov esi, dword [eax + ecx*4 + 8]
add edx, esi
movzx edx, dl
mov ebx, dword [eax + edx*4 + 8]
mov dword [eax + ecx*4 + 8], ebx
mov dword [eax + edx*4 + 8], esi
add ebx, esi
movzx esi, bl
mov ebx, dword [esp + 0x1c]
movzx ebx, byte [ebx + ebp]
xor bl, byte [eax + esi*4 + 8]
mov esi, edi
mov edi, dword [esp + 0x20]
mov byte [edi + ebp], bl
inc ebp
cmp esi, ebp
jne 0x853100
mov dword [eax], ecx
mov dword [eax + 4], edx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x853b40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xd0
mov esi, ecx
cmp dword [ebp + 8], 0
jne 0x853c42
push str.external_openscreen_discovery_mdns_mdns_reader.cc
push 4
call fcn.0075e090
add esp, 8
test al, al
je 0x853c42
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], str.external_openscreen_discovery_mdns_mdns_reader.cc
mov dword [esp + 0x38], 0x99
lea ecx, [esp + 0x7c]
lea edi, [esp + 0x44]
mov dword [esp + 0x44], 0x866ac4
lea ebx, [esp + 0x48]
mov dword [esp + 0x3c], 0x866be8
mov dword [esp + 0x7c], 0x866bfc
mov dword [esp + 0x40], 0
push ebx
call fcn.004cf350
mov dword [esp + 0xc4], 0
mov dword [esp + 0xc8], 0xffffffff
mov dword [esp + 0x3c], 0x866ab0
mov dword [esp + 0x7c], 0x866ad8
mov dword [esp + 0x44], 0x866ac4
mov ecx, ebx
call fcn.004cf9a0
mov dword [esp + 0x48], 0x865954
xorps xmm0, xmm0
movups xmmword [esp + 0x68], xmm0
mov dword [esp + 0x78], 0x18
push 0xa
push 0x947742
push edi
call fcn.00402f60
add esp, 0xc
push 3
push 0x947789
push eax
call fcn.00402f60
add esp, 0xc
push 0xa
push 0x947775
push eax
call fcn.00402f60
add esp, 0xc
lea ecx, [esp + 0x30]
call fcn.0060f450
mov eax, dword [esi + 4]
mov dword [esp + 8], eax
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
lea ebx, [esp + 0x10]
mov ecx, ebx
call fcn.00833c80
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
lea edx, [eax + 2]
cmp edx, ecx
ja 0x853d49
mov dword [esi + 4], edx
lea edx, [eax + 4]
cmp edx, ecx
ja 0x853d49
movzx edi, word [eax]
mov dword [esi + 4], edx
lea edx, [eax + 6]
cmp edx, ecx
ja 0x853d49
mov word [esp + 0xe], di
movzx edi, word [eax + 2]
mov word [esp + 4], di
mov dword [esi + 4], edx
lea edi, [eax + 8]
cmp edi, ecx
ja 0x853d49
movzx eax, word [eax + 4]
mov word [esp + 2], ax
mov dword [esi + 4], edi
movzx edi, word [edx]
mov ecx, esi
push ebx
call fcn.008535c0
test al, al
je 0x853d49
movzx edx, word [esp + 2]
movzx ecx, word [esp + 0xe]
rol cx, 8
mov eax, dword [esi + 4]
sub eax, dword [esp + 8]
movzx ecx, cx
add ecx, 2
cmp eax, ecx
jne 0x853d49
rol word [esp + 4], 8
rol dx, 8
mov word [esp + 2], dx
rol di, 8
lea ecx, [esp + 0x20]
push ebx
call fcn.00833e00
movzx eax, di
movzx edx, word [esp + 2]
movzx edi, word [esp + 4]
lea ecx, [esp + 0x30]
lea ebx, [esp + 0x20]
push ebx
push eax
push edx
push edi
call fcn.00834850
mov ecx, dword [ebp + 8]
lea edi, [esp + 0x30]
push edi
call fcn.00834a10
mov ecx, edi
call fcn.00856a60
lea ecx, [esp + 0x20]
call fcn.00856ab0
mov eax, dword [esi + 4]
mov dword [esp + 8], eax
mov bl, 1
jmp 0x853d4b
xor ebx, ebx
mov edi, dword [esp + 0x14]
test edi, edi
je 0x853da1
mov eax, dword [esp + 0x18]
mov ecx, edi
cmp eax, edi
je 0x853d94
mov dword [esp + 4], ebx
jmp 0x853d76
mov eax, ebx
cmp ebx, edi
je 0x853d8c
lea ebx, [eax - 0xc]
test byte [eax - 0xc], 1
je 0x853d70
push dword [eax - 4]
call fcn.0051c570
add esp, 4
jmp 0x853d70
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 4]
mov dword [esp + 0x18], edi
push ecx
call fcn.0051c570
add esp, 4
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x858f60
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x28]
xor ebx, ebx
cmp dword [eax + 8], 1
mov esi, ecx
mov edi, 0x84
cmovne edi, ebx
mov ecx, dword [ecx + 4]
lea ebp, [ecx + 2]
cmp ebp, dword [esi + 8]
ja 0x859062
mov ebx, dword [eax + 0x10]
sub ebx, dword [eax + 0xc]
mov edx, dword [eax + 0x1c]
sub edx, dword [eax + 0x18]
mov dword [esp + 0x10], edx
movzx edx, byte [eax + 6]
mov byte [esp + 7], dl
mov edx, dword [eax + 0x28]
sub edx, dword [eax + 0x24]
mov dword [esp + 0xc], edx
mov edx, dword [eax + 0x34]
sub edx, dword [eax + 0x30]
mov dword [esp + 8], edx
movzx eax, word [eax + 4]
mov dword [esi + 4], ebp
rol ax, 8
mov word [ecx], ax
mov ebp, dword [esi + 4]
lea eax, [ebp + 2]
cmp eax, dword [esi + 8]
jbe 0x858fd6
xor ebx, ebx
jmp 0x859062
mov dword [esp], ecx
movzx edi, di
mov ecx, edi
or ecx, 2
cmp byte [esp + 7], 0
mov dword [esi + 4], eax
cmovne edi, ecx
mov word [ebp], di
mov eax, dword [esi + 4]
lea edi, [eax + 2]
cmp edi, dword [esi + 8]
ja 0x85905d
shr ebx, 3
imul ecx, ebx, 0xffffaaab
mov dword [esi + 4], edi
rol cx, 8
mov word [eax], cx
mov eax, dword [esi + 4]
lea edi, [eax + 2]
cmp edi, dword [esi + 8]
ja 0x85905d
mov ecx, dword [esp + 0x10]
shr ecx, 4
imul ecx, ecx, 0xffffcccd
mov dword [esi + 4], edi
rol cx, 8
mov word [eax], cx
mov eax, dword [esi + 4]
lea edx, [eax + 2]
cmp edx, dword [esi + 8]
ja 0x85905d
mov ecx, dword [esp + 0xc]
shr ecx, 4
imul ecx, ecx, 0xffffcccd
mov dword [esi + 4], edx
rol cx, 8
mov word [eax], cx
mov eax, dword [esi + 4]
lea ecx, [eax + 2]
cmp ecx, dword [esi + 8]
jbe 0x859071
xor ebx, ebx
mov ecx, dword [esp]
mov dword [esi + 4], ecx
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov edx, dword [esp + 8]
shr edx, 4
imul edx, edx, 0xffffcccd
mov dword [esi + 4], ecx
rol dx, 8
mov word [eax], dx
mov eax, dword [esp + 0x28]
mov ebx, dword [eax + 0xc]
mov edi, dword [eax + 0x10]
cmp ebx, edi
je 0x8590e1
mov ecx, esi
push ebx
call fcn.00858190
test al, al
je 0x85905d
mov eax, dword [esi + 4]
lea ecx, [eax + 2]
cmp ecx, dword [esi + 8]
ja 0x85905d
movzx edx, word [ebx + 0x10]
mov dword [esi + 4], ecx
rol dx, 8
mov word [eax], dx
mov eax, dword [esi + 4]
lea ecx, [eax + 2]
cmp ecx, dword [esi + 8]
ja 0x85905d
mov edx, dword [ebx + 0x14]
shl edx, 0xf
or dx, word [ebx + 0x12]
rol dx, 8
mov dword [esi + 4], ecx
mov word [eax], dx
add ebx, 0x18
cmp ebx, edi
jne 0x859096
mov eax, dword [esp + 0x28]
mov edi, dword [eax + 0x18]
mov ebx, dword [eax + 0x1c]
cmp edi, ebx
je 0x859106
mov ecx, esi
push edi
call fcn.00858e20
test al, al
je 0x85905d
add edi, 0x50
cmp edi, ebx
jne 0x8590ef
mov eax, dword [esp + 0x28]
mov edi, dword [eax + 0x24]
mov ebx, dword [eax + 0x28]
cmp edi, ebx
je 0x85912b
mov ecx, esi
push edi
call fcn.00858e20
test al, al
je 0x85905d
add edi, 0x50
cmp edi, ebx
jne 0x859114
mov eax, dword [esp + 0x28]
mov edi, dword [eax + 0x30]
mov ebp, dword [eax + 0x34]
mov bl, 1
cmp edi, ebp
je 0x859152
mov ecx, esi
push edi
call fcn.00858e20
test al, al
je 0x85905d
add edi, 0x50
cmp edi, ebp
jne 0x85913b
mov ecx, dword [esi + 4]
jmp 0x859062
Function at 0x8594e0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x1c]
movzx ebx, byte [eax]
test bl, 1
je 0x859504
mov ebx, dword [eax + 4]
mov eax, dword [eax + 8]
cmp ebx, 4
jae 0x85950c
mov ecx, ebx
mov edx, ebx
jmp 0x859592
inc eax
shr ebx, 1
cmp ebx, 4
jb 0x8594fb
lea edx, [ebx - 4]
test dl, 4
jne 0x85953b
imul ecx, dword [eax], 0x5bd1e995
mov esi, ecx
shr esi, 0x18
xor esi, ecx
imul esi, esi, 0x5bd1e995
imul ecx, ebx, 0x5bd1e995
xor ecx, esi
add eax, 4
mov ebx, edx
cmp edx, 4
jae 0x859542
jmp 0x859592
mov ecx, ebx
cmp edx, 4
jb 0x859592
mov edx, ebx
nop word cs:[eax + eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
imul esi, dword [eax + 4], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 8
add edx, 0xfffffff8
cmp edx, 3
ja 0x859550
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
cmp edx, 1
je 0x8595bb
cmp edx, 2
je 0x8595b2
cmp edx, 3
jne 0x8595c6
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
push 8
call fcn.0051c3d0
add esp, 4
mov ecx, eax
mov dword [eax], esi
xor esi, ebp
mov edx, 0xeb382d69
mov eax, esi
mul edx
imul ebx, esi, 0x9ddfea08
add ebx, edx
imul esi, edi, 0xeb382d69
add esi, ebx
xor edi, esi
shr esi, 0xf
xor esi, ebp
xor esi, eax
mov eax, esi
mov edx, 0xeb382d69
mul edx
mov dword [ecx + 4], 0
imul ebx, esi, 0x9ddfea08
add ebx, edx
imul esi, edi, 0xeb382d69
add esi, ebx
imul ebp, esi, 0xeb382d69
shr esi, 0xf
xor esi, eax
mov eax, esi
mov edx, 0xeb382d69
mul edx
mov edi, eax
mov ebx, edx
imul eax, esi, 0x9ddfea08
add ebx, eax
add ebx, ebp
push ecx
call fcn.0051c570
add esp, 4
mov eax, edi
mov edx, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402aac
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004045b4
test esi, esi
jne 0x402ae2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004046a4
jmp 0x402b00
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029c0
mov edi, eax
test esi, esi
je 0x402b00
cmp dword [ebx], 0
je 0x402b00
dec esi
jmp 0x402ae9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4030b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x49c008], 0x8088405
inc edx
mov dword [ebx + 0x49c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x49c010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4036a8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403688
xor eax, eax
push ebp
push 0x403681
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4036c4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403688
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x49c010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x49c010], ax
mov esp, ebp
pop ebp
ret

Function at 0x4043b4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49f04c], 0
je 0x404415
cmp word [0x49f220], 0xd7b2
jne 0x4043dd
cmp dword [0x49f228], 0
jbe 0x4043dd
mov eax, 0x49f21c
call dword [0x49f238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x49c058
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40443c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x49c020], 0
jne 0x404431
push 0
push 0x49c078
push 0x49c058
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404568
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402784
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x49f04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404530
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc