joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
push edi
mov edi, ecx
mov eax, dword [edi + 0x1a4]
xor ebx, ebx
xor ebp, ebp
test eax, 0xfffffffe
jbe 0x4e07bd
push esi
mov edi, edi
mov eax, dword [edi + 0x1a0]
mov dword [esp + 0x10], ebx
mov esi, dword [eax + ebp*4]
cmp esi, ebx
je 0x4e07ab
mov edx, dword [esi]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push edi
mov ecx, esi
mov dword [esp + 0x40], 0x3f800000
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0x3f800000
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0x3f800000
mov byte [esp + 0x64], 1
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x80], ebx
mov dword [esp + 0x20], vtable.ytUIEvent.0
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x84], bl
mov byte [esp + 0x85], bl
mov byte [esp + 0x7c], bl
mov dword [esp + 0x68], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x28], 0x1c
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call dword [edx + 0xc]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov eax, dword [esp + 0x74]
cmp eax, ebx
mov dword [esp + 0x14], vtable.ytUIEvent.0
je 0x4e07a7
mov ecx, dword [eax]
and ecx, 0xff
cmp ecx, 0x80
mov esi, eax
jae 0x4e07a7
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x7f
jne 0x4e0796
mov edx, dword [esi]
and edx, 0xff
cmp edx, 0x80
jae 0x4e0791
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
jmp 0x4e0796
mov eax, 0xff
cmp eax, ebx
jne 0x4e07a7
mov eax, dword [esp + 0x74]
push eax
call fcn.00499410
add esp, 4
mov dword [esp + 0x74], ebx
mov ecx, dword [edi + 0x1a4]
inc ebp
shr ecx, 1
cmp ebp, ecx
jb 0x4e0660
pop esi
mov eax, dword [edi + 0x1a0]
cmp eax, ebx
je 0x4e07d0
push eax
call fcn.00489183
add esp, 4
mov eax, dword [edi + 0x1a4]
and eax, 1
mov dword [edi + 0x1a0], ebx
mov dword [edi + 0x1a4], eax
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x6c
ret
Function at 0x50e080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x1a4]
xor ebx, ebx
xor ebp, ebp
test eax, 0xfffffffe
push edi
jbe 0x50e1f2
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0x1a0]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x3c], 0x3f800000
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0x3f800000
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0x3f800000
mov byte [esp + 0x60], 1
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x7c], ebx
mov edi, vtable.ytUIEvent.0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov byte [esp + 0x80], bl
mov byte [esp + 0x81], bl
mov byte [esp + 0x78], bl
mov dword [esp + 0x64], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], esi
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x24], 0x18
mov ecx, dword [edx + ebp*4]
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x20]
push edx
push esi
call dword [eax + 0xc]
cmp eax, 0xf4242
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x1c], edi
je 0x50e1fc
cmp eax, ebx
je 0x50e1dd
mov ecx, dword [eax]
and ecx, 0xff
cmp ecx, 0x80
mov edi, eax
jae 0x50e1dd
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x7f
jne 0x50e1cc
mov edx, dword [edi]
and edx, 0xff
cmp edx, 0x80
jae 0x50e1c7
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
jmp 0x50e1cc
mov eax, 0xff
cmp eax, ebx
jne 0x50e1dd
mov eax, dword [esp + 0x7c]
push eax
call fcn.00499410
add esp, 4
mov ecx, dword [esi + 0x1a4]
inc ebp
shr ecx, 1
cmp ebp, ecx
mov dword [esp + 0x7c], ebx
jb 0x50e0a6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x74
ret
cmp eax, ebx
je 0x50e255
mov edx, dword [eax]
and edx, 0xff
cmp edx, 0x80
mov esi, eax
jae 0x50e255
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x7f
jne 0x50e244
mov eax, dword [esi]
and eax, 0xff
cmp eax, 0x80
jae 0x50e23f
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
jmp 0x50e244
mov eax, 0xff
cmp eax, ebx
jne 0x50e255
mov ecx, dword [esp + 0x7c]
push ecx
call fcn.00499410
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0xf4242
pop ebx
add esp, 0x74
ret
Function at 0x514ac0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
call fcn.00514a90
mov bl, byte [0x6b9450]
test bl, bl
je 0x514ae7
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
jmp 0x514af1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
test esi, esi
je 0x514be2
inc esi
test bl, bl
je 0x514bc9
lea ebx, [esi + esi]
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.00488a80
mov edx, dword [ebp + 8]
mov edi, esp
push esi
push edi
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
push edi
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
call fcn.0049d940
mov eax, dword [ebp + 8]
test eax, eax
je 0x514b40
add eax, 4
jmp 0x514b45
mov eax, 0x6b6e10
mov ecx, dword [ebp - 4]
push eax
call fcn.005149f0
lea ecx, [ebp + 8]
call fcn.004a0270
push ebx
push edi
call fcn.004d6d20
mov eax, dword [ebp + 8]
add esp, 8
test eax, eax
je 0x514be2
mov ecx, dword [eax]
and ecx, 0xff
cmp ecx, 0x80
mov esi, eax
jae 0x514be2
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x7f
jne 0x514bad
mov edx, dword [esi]
and edx, 0xff
cmp edx, 0x80
jae 0x514ba8
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
jmp 0x514bad
mov eax, 0xff
test eax, eax
jne 0x514be2
mov eax, dword [ebp + 8]
push eax
call fcn.00499410
add esp, 4
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push esi
mov ecx, edi
call fcn.00499780
mov ecx, dword [edi + 4]
mov edx, dword [ebp + 8]
push esi
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x516c63
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
cmp byte [esi], 0
push edi
mov dword [esp + 0x10], esi
jne 0x516c7d
mov eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x516c99
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebx + 8]
mov esi, eax
mov eax, dword [ebx + 0xc]
push eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebp, eax
push ebp
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x18], eax
sub esp, 0x10
or eax, 0xffffffff
mov edx, esp
mov dword [edx], eax
or ecx, 0xffffffff
mov dword [edx + 4], ecx
or eax, 0xffffffff
mov dword [edx + 8], eax
or eax, 0xffffffff
push esi
mov ecx, ebx
mov dword [edx + 0xc], eax
call fcn.0049ad50
push ebp
push 2
xor ebx, ebx
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x516d01
or ebx, 0xffffffff
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
push eax
push esi
mov byte [ebp], 0
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp + 4]
push edi
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret 4

Function at 0x5190d0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
mov dword [esp + 4], eax
je 0x51913f
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push ebx
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x51912e
mov dword [esp + 4], ebx
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 4]
cmp eax, ebx
setne al
pop ebx
add esp, 0x10
ret
Function at 0x51b020
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
push ecx
push 0x51b010
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x51b05c
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ecx
ret
or eax, 0xffffffff
pop esi
pop ecx
ret

Function at 0x51b820
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
xor eax, eax
mov edx, ecx
push edi
mov ecx, 0x11
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0x40]
test eax, eax
mov dword [esp + 0x14], 0x44
pop edi
lea ecx, [eax + 4]
jne 0x51b85b
mov ecx, 0x6b6e10
mov eax, dword [edx + 0x14]
test eax, eax
je 0x51b867
add eax, 4
jmp 0x51b86c
mov eax, 0x6b6e10
lea edx, [esp]
push edx
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x51b895
or eax, 0xffffffff
add esp, 0x54
ret
mov eax, dword [esp]
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
xor eax, eax
pop esi
add esp, 0x54
ret
Function at 0x51d722
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esi], 0
mov dword [esi + 4], 0x67
lea edi, [esi + 0x3ec]
mov ebx, 0xfa
mov edi, edi
call fcn.00489814
mov ebp, eax
shl ebp, 0xc
call fcn.00489814
xor ebp, eax
shl ebp, 0xc
call fcn.00489814
xor ebp, eax
mov dword [edi], ebp
sub edi, 4
dec ebx
jne 0x51d740
or edx, 0xffffffff
mov eax, SysReAllocString
lea ecx, [esi + 0x14]
mov edi, edi
mov edi, dword [ecx]
and edi, edx
or edi, eax
mov dword [ecx], edi
shr eax, 1
shr edx, 1
add ecx, 0x1c
test eax, eax
jne 0x51d770
lea ecx, [esi + 0x3f0]
lea esp, [esp]
inc eax
mov dword [ecx], eax
add ecx, 4
cmp eax, 0xfa
jl 0x51d790
pop edi
mov dword [esi + 0x7d4], 0
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x51e5e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
ret

Function at 0x5214f0
Capabilities:
Parse url

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
push ebp
mov ebp, ecx
jne 0x521504
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
push esi
push edi
or ecx, 0xffffffff
xor eax, eax
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
call fcn.0049d9d0
mov esi, dword [ebp]
mov eax, dword [esp + 0x14]
cmp esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
je 0x5215d2
test esi, esi
je 0x521599
mov ecx, dword [esi]
and ecx, 0xff
cmp ecx, 0x80
jae 0x521592
push esi
call edi
and eax, 0xff
cmp eax, 0x7f
jne 0x52157e
mov edx, dword [esi]
and edx, 0xff
cmp edx, 0x80
jae 0x521579
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
jmp 0x52157e
mov eax, 0xff
test eax, eax
jne 0x52158e
mov eax, dword [ebp]
push eax
call fcn.00499410
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [ebp], 0
test eax, eax
mov dword [ebp], eax
je 0x521627
mov ecx, dword [eax]
and ecx, 0xff
cmp ecx, 0x80
jae 0x5215c7
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
cmp eax, 0xff
jne 0x5215ce
mov ecx, ebp
call fcn.0049d350
mov eax, dword [esp + 0x14]
test eax, eax
je 0x521627
mov edx, dword [eax]
and edx, 0xff
cmp edx, 0x80
mov esi, eax
jae 0x521627
push eax
call edi
and eax, 0xff
cmp eax, 0x7f
jne 0x521616
mov eax, dword [esi]
and eax, 0xff
cmp eax, 0x80
jae 0x521611
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
jmp 0x521616
mov eax, 0xff
test eax, eax
jne 0x521627
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00499410
add esp, 4
or ecx, 0xffffffff
xor eax, eax
add ebp, 4
mov edi, ebx
repne scasb al, byte es:[edi]
push ebp
not ecx
push 0
dec ecx
push ecx
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 0xfffffffc
pop ebp
add eax, 4
pop ebx
ret 4
Function at 0x52c700
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x69ec90], 0x10
jne 0x52c70e
jmp 0x52c710
ret
mov edx, dword [esp + 8]
test edx, edx
je 0x52c788
push esi
lea esp, [esp]
mov eax, dword [0x6bdfd8]
mov ecx, dword [eax*4 + 0x6be3c8]
mov dword [0x6bdfd8], ecx
mov ecx, dword [0x6bdfdc]
mov esi, dword [ecx*4 + 0x6be3c8]
mov dword [0x6bdfdc], esi
mov esi, dword [eax*4 + 0x6bdfe0]
mov ecx, dword [ecx*4 + 0x6bdfe0]
xor esi, ecx
mov dword [eax*4 + 0x6bdfe0], esi
mov eax, esi
and eax, 0x70307
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
movd mm0, dword [eax]
movd mm1, dword [esp + 0xc]
paddusb mm0, mm1
movd dword [eax], mm0
mov ecx, dword [esp + 8]
add ecx, 4
dec edx
mov dword [esp + 8], ecx
jne 0x52c720
pop esi
emms
ret
Function at 0x52dd60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x40]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x4c]
xor ebx, ebx
mov dword [edi + 4], ecx
lea ebp, [edi + 0xc]
push 0x20
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [edi], eax
mov dword [edi + 8], edx
call fcn.0052dbb0
cmp eax, ebx
jl 0x52dedb
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [esp + 0x1c]
mov dword [edx + ecx], 0x504d444d
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push eax
mov dword [edx + ecx + 4], 0xa793
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov esi, dword [ecx]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
push edx
push eax
add esi, ecx
call fcn.0052def0
add esp, 8
mov dword [esi + 0x14], eax
push 0x48
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.0052dbb0
cmp eax, ebx
jl 0x52dedb
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov dword [eax + edx + 8], 6
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
mov dword [eax + edx + 0xc], ecx
xor esi, esi
lea edx, [esp + 0x30]
push edx
mov ecx, edi
call dword [esi + 0x6a3aa0]
test eax, eax
jl 0x52dedb
cmp eax, 1
jne 0x52de61
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [esp + 0x1c]
lea eax, [edx + ecx + 8]
dec dword [eax]
jmp 0x52de7c
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
push 0xc
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x30]
add edx, ebx
add edx, eax
push edx
call fcn.0052dca0
add esi, 4
add ebx, 0xc
cmp esi, 0x18
jb 0x52de35
mov eax, dword [edi + 0x14]
mov ecx, dword [ebp]
push 0
lea edx, [esp + 0x48]
push edx
push eax
mov eax, dword [esp + 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x52ded3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x52debd
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x14
call esi
pop edi
pop esi
and eax, 0xffff
pop ebp
or eax, 0x80070000
pop ebx
add esp, 0x2c
ret 0x14
mov dword [edi], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x14
Function at 0x52e0e0
Capabilities:
Get file version info

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp eax, edi
jne 0x52e0fe
pop edi
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
add esp, 8
ret
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
push ebp
mov dword [esp + 0x1c], edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, edi
jne 0x52e124
pop edi
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
add esp, 8
ret
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
cmp ebx, edi
jne 0x52e140
pop edi
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
add esp, 8
ret
push ebx
push esi
push edi
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
cmp eax, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edi
je 0x52e188
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x660efc
push ebx
call sub.VERSION.dll_VerQueryValueA
cmp eax, edi
je 0x52e188
mov esi, dword [esp + 0x1c]
cmp esi, edi
je 0x52e188
cmp dword [esp + 0x10], 0x34
jb 0x52e188
mov edi, dword [esp + 0x20]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x52e1a0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
sub esp, 0x34
push ebx
push ebp
mov dword [esp + 8], ecx
push esi
mov esi, dword [esp + 0x4c]
mov ecx, dword [esi + 0xac]
mov eax, 0x24924925
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, dword [esi + 0xa8]
push edi
mov edi, dword [esp + 0x4c]
shr ecx, 4
add edx, edi
xor eax, eax
test ecx, ecx
jbe 0x52e1ec
mov edi, dword [esp + 0x54]
lea esi, [edx + 0xc]
mov edi, edi
cmp dword [esi], edi
je 0x52e1fb
inc eax
add esi, 0x1c
cmp eax, ecx
jb 0x52e1e0
mov eax, 0x80004005
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 0x14
imul eax, eax, 0x1c
mov ebx, dword [eax + edx + 0x10]
mov esi, dword [eax + edx + 0x18]
push 0
push 0
push 3
push 0
add eax, edx
mov eax, dword [esp + 0x58]
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x50], eax
jne 0x52e237
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 0x34
ret 0x14
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x52e25b
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 0x34
ret 0x14
xor eax, eax
mov dword [esp + 0x20], 0
mov ecx, 8
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov eax, esi
div dword [esp + 0x3c]
mov edi, edx
lea edx, [edi + ebx]
push edx
sub esi, edi
push esi
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov eax, dword [esp + 0x10]
add esi, edi
add eax, 0xc
xor edi, edi
push ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call fcn.0052dbb0
cmp eax, edi
jl 0x52e1f1
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov edx, dword [esp + 0x18]
push ebx
add eax, edx
push esi
push eax
call fcn.0052dca0
cmp eax, edi
jl 0x52e1f1
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
mov dword [eax + 4], ecx
mov dword [eax], ebx
call esi
mov edx, dword [esp + 0x50]
push edx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34
ret 0x14
Function at 0x5317b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [edx + 4]
push esi
mov esi, dword [edx]
mov ecx, esi
xor ecx, eax
and ecx, 0xff
push edi
mov edi, dword [esp + 0x14]
mov ecx, dword [edi + ecx*4]
shr esi, 8
xor ecx, esi
mov dword [edx], ecx
and ecx, 0xff
add ecx, ebx
imul ecx, ecx, 0x8088405
inc ecx
mov dword [edx + 4], ecx
mov ecx, dword [edx + 8]
movzx esi, byte [edx + 7]
mov ebx, ecx
and ebx, 0xff
xor esi, ebx
mov esi, dword [edi + esi*4]
shr ecx, 8
xor esi, ecx
pop edi
mov dword [edx + 8], esi
pop esi
pop ebx
ret
Function at 0x53d4a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x53d4d0
push esi
call fcn.0053e3a0
mov al, byte [esi + 0x48]
add esp, 4
test al, al
je 0x53d4c9
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x53d550
mov eax, dword [esi + 0x198]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x53d539
mov eax, dword [esi + 8]
test eax, eax
je 0x53d4f4
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x198]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x53d535
cmp eax, 2
je 0x53d539
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x53d4e7
cmp eax, 3
je 0x53d51a
cmp eax, 1
jne 0x53d4e7
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x53d4e7
mov edx, dword [esi + 0x124]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x53d4e7
xor al, al
pop esi
ret
mov eax, dword [esi + 0x84]
push esi
mov dword [esi + 0x8c], eax
call fcn.0053d580
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x53d570
mov ecx, dword [esi]
mov dword [ecx + 0x14], 0x16
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0053d580
add esp, 4
pop esi
ret