joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f5300
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ad60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push edi
push str.tam9
lea eax, [ebp - 0x44]
push 0x572bbc
push eax
call fcn.00413af0
xor ebx, ebx
mov dword [ebp - 4], ebx
push str.tam9
lea ecx, [ebp - 0x28]
push 0x572bf4
push ecx
call fcn.00413af0
add esp, 0x18
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x28]
mov edi, 8
cmp dword [ebp - 0x14], edi
jae 0x4f535f
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x30], edi
jae 0x4f536a
lea eax, [ebp - 0x44]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4f53bf
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], edi
jb 0x4f538c
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x30], edi
jb 0x4f53b5
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor edx, edx
mov word [ebp - 0x44], dx
mov al, 1
jmp 0x4f5405
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], edi
jb 0x4f53d4
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], cx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x30], edi
jb 0x4f53fd
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov word [ebp - 0x44], ax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x34], ebx
pop edi
mov dword [ebp - 0x30], 7
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4fe2a0
Capabilities:
List tcp connections and listeners

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51dfcd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push ebx
push 5
push 0x17
push ebx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x1579a70]
push ecx
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
call esi
cmp eax, 0x7a
jne 0x4fe319
mov edx, dword [ebp - 0x14]
push edx
call fcn.0050ec2a
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
mov dword [0x57493c], ecx
mov dword [0x1579a70], eax
push ebx
push 5
push 0x17
push ebx
lea edx, [ebp - 0x14]
push edx
push eax
call esi
cmp eax, ebx
jne 0x4fe3e9
mov eax, dword [0x1579a70]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x20]
jge 0x4fe3e7
lea esi, [eax*8]
sub esi, eax
add esi, esi
add esi, esi
add esi, esi
mov edx, dword [0x1579a70]
cmp dword [esi + edx + 0x38], 8
jbe 0x4fe3de
mov eax, 0x528bd8
lea ecx, [ebp - 0x40]
call fcn.0040fae0
mov byte [ebp - 4], 1
mov eax, dword [0x1579a70]
lea ecx, [esi + eax + 0x1c]
push ecx
mov edx, dword [esi + eax + 0x30]
push edx
mov ecx, dword [esi + eax + 0x18]
push ecx
mov edx, dword [esi + eax + 0x34]
push edx
mov eax, dword [esi + eax + 0x38]
push eax
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [edi + 0x120]
call fcn.00502720
mov bl, al
mov byte [ebp - 4], 0
lea esi, [ebp - 0x40]
call fcn.004150b0
test bl, bl
je 0x4fe3de
mov eax, dword [edi + 0x120]
mov esi, dword [ebp + 8]
mov edx, esi
mov ecx, dword [eax]
call fcn.004fd330
mov ecx, dword [edi + 0x120]
mov dword [ecx + 0x130], eax
mov edx, dword [edi + 0x120]
cmp dword [edx + 0x130], 0
je 0x4fe3de
push esi
push edx
push edi
call fcn.004fd920
mov eax, dword [ebp - 0x1c]
inc eax
jmp 0x4fe32d
xor ebx, ebx
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x4fe3fa
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4fe5c0
Capabilities:
List tcp connections and listeners

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51df4d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
push ebx
push 5
push 2
push ebx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x1579a74]
push ecx
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
call esi
cmp eax, 0x7a
jne 0x4fe632
mov eax, dword [ebp - 0x14]
mov dword [0x5749a4], eax
push eax
call fcn.0050ec2a
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [0x1579a74], eax
push ebx
push 5
push 2
push ebx
lea edx, [ebp - 0x14]
push edx
push eax
call esi
cmp eax, ebx
jne 0x4fe6fa
mov eax, dword [0x1579a74]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
xor esi, esi
mov dword [ebp - 0x18], esi
cmp esi, dword [ebp - 0x1c]
jge 0x4fe6fa
lea esi, [esi + esi*2]
add esi, esi
add esi, esi
add esi, esi
mov edx, dword [0x1579a74]
cmp dword [esi + edx + 0x18], 8
jbe 0x4fe6f1
mov eax, 0x528bd8
lea ecx, [ebp - 0x40]
call fcn.0040fae0
mov byte [ebp - 4], 1
mov eax, dword [0x1579a74]
mov ecx, dword [esi + eax + 0x10]
push ecx
mov edx, dword [esi + eax + 0x14]
push edx
mov ecx, dword [esi + eax + 0xc]
push ecx
mov edx, dword [esi + eax + 4]
push edx
mov eax, dword [esi + eax + 0x18]
push eax
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [edi + 0x120]
call fcn.00502410
mov bl, al
mov byte [ebp - 4], 0
lea esi, [ebp - 0x40]
call fcn.004150b0
test bl, bl
je 0x4fe6f1
mov eax, dword [edi + 0x120]
mov esi, dword [ebp + 8]
mov edx, esi
mov ecx, dword [eax]
call fcn.004fd330
mov ecx, dword [edi + 0x120]
mov dword [ecx + 0x130], eax
mov edx, dword [edi + 0x120]
cmp dword [edx + 0x130], 0
je 0x4fe6f1
push esi
push edx
push edi
call fcn.004fd920
mov esi, dword [ebp - 0x18]
inc esi
jmp 0x4fe646
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4fe70b
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x502be0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51f0f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
xor ebx, ebx
jmp 0x502c24
mov esi, dword [esp + 0x20]
xor eax, eax
cmp byte [0x573da6], al
push 3
setne al
push eax
push edi
call fcn.00502db0
push 4
push 1
push ebx
mov edi, eax
call fcn.00502db0
xor ecx, ecx
cmp byte [0x573ede], cl
push 0
setne cl
mov ebx, eax
push ecx
push esi
call fcn.00502db0
xor edx, edx
cmp byte [0x573c6f], dl
push 2
setne dl
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
push edx
push eax
call fcn.00502db0
mov ecx, dword [esp + 0x18]
push 5
push 1
push ecx
mov dword [esp + 0x20], eax
call fcn.00502db0
mov edx, dword [esp + 0x1c]
push 1
push 1
push edx
mov dword [esp + 0x24], eax
call fcn.00502db0
mov dword [esp + 0x1c], eax
call fcn.00429800
xor eax, eax
mov word [esp + 0x24], ax
push 0xd
mov eax, str.ThreadManager
lea esi, [esp + 0x28]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
call fcn.00412b10
xor esi, esi
mov dword [esp + 0x4c], esi
lea ecx, [esp + 0x24]
push ecx
mov ecx, 0xea60
call fcn.0046aca0
add esp, 4
test al, al
sete byte [esp + 0x13]
mov dword [esp + 0x4c], 0xffffffff
cmp dword [esp + 0x38], 8
jb 0x502d06
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], esi
mov word [esp + 0x24], ax
cmp byte [esp + 0x13], al
je 0x502c20
xor ecx, ecx
mov ebx, 7
xor edi, edi
push 0x19
mov eax, str.TamnunSnd_exit_on_demmand
lea esi, [esp + 0x28]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], edi
mov word [esp + 0x28], cx
call fcn.00412b10
mov dword [esp + 0x4c], 1
push 1
push 1
mov edx, esi
push edx
push 0x51
push str.ThreadManager::run
call fcn.0044d970
add esp, 0x14
mov dword [esp + 0x4c], 0xffffffff
cmp dword [esp + 0x38], 8
jb 0x502d84
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ecx, ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], edi
mov word [esp + 0x24], cx
call fcn.00429800
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x5051e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x516bb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
mov edx, dword [ebp + 8]
call fcn.004308e0
mov dword [esi], eax
mov dword [esi + 4], edx
mov edx, dword [ebp + 0xc]
call fcn.004308e0
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov edx, dword [ebp + 0x10]
call fcn.004308e0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov edx, dword [ebp + 0x14]
call fcn.004308e0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
mov edx, dword [ebp + 0x18]
call fcn.004308e0
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
mov edx, dword [ebp + 0x1c]
call fcn.004308e0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x506bc0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51bf50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
wait
cmp dword [0x1579a90], 0
jne 0x506c05
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x30]
mov dword [0x1579a90], ecx
call fcn.00452050
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x506c1e
mov dword [ebp - 0x18], 0xbad1d
call fcn.00451990
fmul qword [0x54df18]
fnstcw word [ebp - 0x12]
movzx eax, word [ebp - 0x12]
or eax, 0xc00
mov dword [ebp - 0x1c], eax
fldcw word [ebp - 0x1c]
fistp qword [ebp - 0x20]
fldcw word [ebp - 0x12]
mov esi, dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul eax, esi
test eax, eax
jne 0x506c77
call fcn.00451990
fadd qword [0x54df10]
fnstcw word [ebp - 0x12]
movzx eax, word [ebp - 0x12]
or eax, 0xc00
mov dword [ebp - 0x1c], eax
fldcw word [ebp - 0x1c]
fistp qword [ebp - 0x20]
fldcw word [ebp - 0x12]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
add esp, 4
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
wait
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x507050
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51e81e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [esi + 8], eax
lea ecx, [esi + 0x14]
push ecx
push 0
push eax
push 0x506cd0
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x10], eax
test eax, eax
jne 0x5071ce
mov eax, 0x528928
lea ecx, [ebp - 0x68]
call fcn.0040fae0
mov byte [ebp - 4], 1
mov eax, 0x528928
lea ecx, [ebp - 0x4c]
call fcn.0040fae0
mov byte [ebp - 4], 2
mov eax, 0x528928
lea ecx, [ebp - 0x30]
call fcn.0040fae0
mov byte [ebp - 4], 3
mov eax, 0x528928
lea ecx, [ebp - 0x84]
call fcn.0040fae0
mov byte [ebp - 4], 4
mov eax, 0x528928
lea ecx, [ebp - 0xbc]
call fcn.0040fae0
mov byte [ebp - 4], 5
mov eax, 0x54d04c
lea ecx, [ebp - 0xa0]
call fcn.0040fae0
mov bl, 6
mov byte [ebp - 4], bl
push str.ubthread::start
lea edx, [ebp - 0xd8]
push edx
mov ecx, 0x88
call fcn.00451470
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x84]
push edx
push eax
lea edx, [ebp - 0xbc]
lea ecx, [ebp - 0xa0]
call fcn.0044f9c0
add esp, 0x1c
mov byte [ebp - 4], bl
lea esi, [ebp - 0xd8]
call fcn.004150b0
mov byte [ebp - 4], 5
lea esi, [ebp - 0xa0]
call fcn.004150b0
mov byte [ebp - 4], 4
lea esi, [ebp - 0xbc]
call fcn.004150b0
mov byte [ebp - 4], 3
lea esi, [ebp - 0x84]
call fcn.004150b0
mov byte [ebp - 4], 2
lea esi, [ebp - 0x30]
call fcn.004150b0
mov byte [ebp - 4], 1
lea esi, [ebp - 0x4c]
call fcn.004150b0
mov byte [ebp - 4], 0
lea esi, [ebp - 0x68]
call fcn.004150b0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50c630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
mov dword [ebp - 4], 0
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x50c84e
lea ebx, [ebx]
cmp dword [esi + 0x6af90], 3
jb 0x50c6b7
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x50c6f7
mov edx, dword [esi + 0x6af84]
sub edx, ecx
cmp edx, 0x7efa
ja 0x50c6f7
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x50c6e2
mov dword [esi + 0x6afa0], eax
mov eax, ecx
call fcn.0050c350
mov ebx, eax
mov eax, dword [esi + 0x6af90]
cmp ebx, eax
jbe 0x50c6f7
mov ebx, eax
mov eax, dword [esi + 0x6af84]
mov ecx, esi
cmp ebx, 3
jb 0x50c7db
sub eax, dword [esi + 0x6af88]
lea edx, [ebx - 3]
call fcn.0050bb50
sub dword [esi + 0x6af90], ebx
mov ecx, dword [esi + 0x6af90]
mov dword [ebp - 8], eax
cmp ebx, dword [esi + 0x6af98]
ja 0x50c7a4
cmp ecx, 3
jb 0x50c7a4
mov edi, 1
sub ebx, edi
lea esp, [esp]
add dword [esi + 0x6af84], edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
sub ebx, edi
mov dword [esi + edx*4 + 0x2af70], ecx
mov edx, dword [esi + 0x6af84]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af7c]
mov dword [esi + ecx*4 + 0x4af70], edx
jne 0x50c740
add dword [esi + 0x6af84], edi
mov eax, dword [ebp - 8]
jmp 0x50c7f6
add dword [esi + 0x6af84], ebx
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx edx, byte [edx + esi + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, 0x7fff
mov dword [esi + 0x6af7c], edx
jmp 0x50c7f6
movzx edx, byte [eax + esi + 0x1af70]
xor eax, eax
call fcn.0050bb50
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x50c830
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x50c80d
lea edx, [ecx + esi + 0x1af70]
jmp 0x50c80f
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
push edx
xor edi, edi
mov ecx, esi
call fcn.0050b9b0
mov ecx, dword [esi + 0x6af84]
add esp, 4
mov dword [esi + 0x6af74], ecx
cmp dword [esi + 0x6af90], 0x106
jae 0x50c841
call fcn.0050c4f0
cmp dword [esi + 0x6af90], 0
jne 0x50c660
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x50c861
lea edx, [ecx + esi + 0x1af70]
jmp 0x50c863
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
push edx
mov edi, 1
mov ecx, esi
call fcn.0050b9b0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50d510
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x50d517
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x50d5ed
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x539a00]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x539a00]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x539a00]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x539a00]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x539a00]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x539a00]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x539a00]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x539a00]
add ecx, 8
sub edx, 8
dec esi
jne 0x50d530
pop edi
test edx, edx
je 0x50d60a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x539a00]
inc ecx
dec edx
jne 0x50d5f1
not eax
pop esi
ret

Function at 0x50d610
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x539a00]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x539a00]
mov dword [edx + 8], ecx
ret
Function at 0x50d790
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, eax
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x50d7b6
mov eax, 0x200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x4c]
mov edx, eax
xor edi, edi
and edx, 1
je 0x50d7cc
mov dword [ebp - 8], 1
mov edi, dword [ebp - 8]
test al, 2
je 0x50d7d3
or edi, 2
test al, 4
je 0x50d7da
or edi, 4
mov ecx, eax
and ecx, 0x10
je 0x50d7e4
or edi, 0x10
test al, 0x20
je 0x50d7eb
or edi, 0x20
test ecx, ecx
je 0x50d7f7
or edi, 0x40000000
jmp 0x50d7fd
or edi, 0x80000000
or edi, 0x1000000
mov dword [ebp - 8], edi
test edx, edx
jne 0x50d813
or edi, 0x800000
mov dword [ebp - 8], edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp eax, 0x28
jbe 0x50d8ba
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [ebp - 0xc]
push ecx
push 2
lea edx, [ebp - 4]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea ecx, [ebp - 0x14]
push ecx
push esi
call ebx
mov edx, 0x54ad
cmp word [ebp - 4], dx
jne 0x50d8b7
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 0x34]
cmp dword [ebp - 0x10], ecx
jbe 0x50d8b7
push 0
push 0
push eax
push esi
call edi
push 0
lea edx, [ebp - 0xc]
push edx
push 4
lea eax, [ebp - 0x18]
push eax
push esi
call ebx
mov eax, dword [ebp - 0x18]
cmp eax, 0x5a4d
je 0x50d8b0
cmp eax, 0x454e
je 0x50d8b0
cmp eax, 0x454c
je 0x50d8b0
cmp eax, 0x4550
jne 0x50d8b7
or dword [ebp - 8], 0x400000
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 8]
test eax, eax
je 0x50d8c3
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x50d8cf
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x38]
test esi, esi
je 0x50d949
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
push 0
sub edx, 0xd53e8000
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.0050f670
mov dword [esi + 4], edx
push 0
mov ecx, ebx
sub ecx, 0xd53e8000
mov edx, edi
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [esi], eax
call fcn.0050f670
mov ecx, dword [ebp - 0x44]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x48]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
mov dword [esi + 0xc], edx
call fcn.0050f670
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x50d971
push edi
push ebx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
call fcn.0050d730
movzx ecx, word [ebp - 4]
movzx edx, word [ebp - 8]
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [esi], ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50da20
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
je 0x50db14
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x50da58
cmp dword [esi + 0x40], edi
jae 0x50da58
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x50da70
lea eax, [edi + edi]
push eax
call fcn.0050ec2a
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x50db11
jmp 0x50da90
mov edx, dword [esi + 0x3c]
mov cl, byte [ebx + edx]
mov edi, dword [esi + 0x30]
mov byte [ebp + 8], cl
movsx ecx, cl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x539a00]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x38]
shr edi, 8
xor dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x539a00]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebp + 8]
inc ebx
mov byte [ebx + ecx - 1], al
cmp ebx, dword [ebp + 0xc]
jb 0x50da90
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x50db53
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x50db38
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push eax
add ecx, edx
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x50db75
push 0
lea edx, [ebp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8