joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec7c8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, 0x10
call fcn.00407274
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4ec7fd
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00406f74
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4ec826
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00407274
mov esp, ebp
pop ebp
ret

Function at 0x4f4ee8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4c
push 0
push 0
dec ecx
jne 0x4f4ef0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406ed0
xor eax, eax
push ebp
push 0x4f50aa
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.004f43d8
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.004f43f8
mov ebx, eax
jmp 0x4f5076
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.004070f8
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.004151f0
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x234]
call fcn.00413258
mov eax, dword [ebp - 0x234]
push eax
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 4]
call fcn.004151f0
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x240]
call fcn.00413258
mov edx, dword [ebp - 0x240]
pop eax
call fcn.004075d0
je 0x4f5008
lea eax, [ebp - 0x24c]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.004070f8
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x248]
call fcn.00413258
mov eax, dword [ebp - 0x248]
push eax
lea edx, [ebp - 0x254]
mov eax, dword [ebp - 4]
call fcn.004151f0
mov eax, dword [ebp - 0x254]
lea edx, [ebp - 0x250]
call fcn.00413258
mov edx, dword [ebp - 0x250]
pop eax
call fcn.004075d0
jne 0x4f5067
lea edx, [ebp - 0x25c]
mov eax, dword [ebp - 0x228]
call fcn.004f50bc
mov eax, dword [ebp - 0x25c]
lea edx, [ebp - 0x258]
call fcn.00413258
mov eax, dword [ebp - 0x258]
push eax
lea edx, [ebp - 0x260]
mov eax, dword [ebp - 4]
call fcn.00413258
mov edx, dword [ebp - 0x260]
pop eax
call fcn.004075d0
jne 0x4f5067
push 0
mov eax, dword [ebp - 0x228]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.004f4418
mov ebx, eax
test ebx, ebx
jne 0x4f4f41
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f50b1
lea eax, [ebp - 0x260]
mov edx, 0xc
call fcn.00406ee0
lea eax, [ebp - 4]
call fcn.00406ed8
ret
Function at 0x4f5a5c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x4f5aad
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4f5ac4
call fcn.00406f3c
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406f74
push eax
push 0x4f5bcc
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5ab4
lea eax, [ebp - 4]
call fcn.00406ed8
ret
Function at 0x4f9248
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4f9276
mov eax, ebx
call fcn.004f9cfc
cmp dword [ebx + 0x40], 0
je 0x4f926f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4f92e7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4f92d9
cmp dword [ebx + 8], 0
je 0x4f9298
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4f92aa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4f92d9
cmp dword [ebx + 8], 0
je 0x4f928b
cmp eax, 3
je 0x4f92bd
dec eax
jne 0x4f928b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4f928b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4f928b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4f9305
cmp dword [ebx + 0x14], 0xcc
je 0x4f9305
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004f9310
pop ebx
ret
Function at 0x51651c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5165a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004149f4
test al, al
je 0x516558
lea eax, [ebp - 4]
mov edx, esi
call fcn.00406f3c
jmp 0x516560
lea eax, [ebp - 4]
call fcn.005164dc
lea eax, [ebp - 0x20c]
push eax
xor bl, 1
movzx eax, bl
push eax
push 0x5165b8
mov eax, dword [ebp - 4]
call fcn.00406f74
push eax
call sub.kernel32.dll_GetTempFileNameW
mov eax, edi
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.004070f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5165b0
lea eax, [ebp - 4]
call fcn.00406ed8
ret

Function at 0x51664c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x516708
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004152e4
mov edx, dword [ebp - 4]
mov eax, 0x516724
call fcn.0040dfbc
test al, al
je 0x516695
lea eax, [ebp - 4]
mov ecx, 8
mov edx, 1
call fcn.00407708
jmp 0x5166b8
mov edx, dword [ebp - 4]
mov eax, 0x516744
call fcn.0040dfbc
test al, al
je 0x5166b8
lea eax, [ebp - 4]
mov ecx, 4
mov edx, 1
call fcn.00407708
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00415018
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0041c0dc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00406f3c
mov eax, dword [ebp - 4]
call fcn.00406f74
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51670f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406ee0
ret

Function at 0x517c14
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, edx
mov edx, dword [eax]
dec ecx
test ecx, ecx
jl 0x517c3f
inc ecx
mov ebx, edx
xor bl, byte [esi]
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x5a5b90]
shr edx, 8
and edx, 0xffffff
xor ebx, edx
mov edx, ebx
inc esi
dec ecx
jne 0x517c20
mov dword [eax], edx
pop esi
pop ebx
ret

Function at 0x519b14
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [eax]
dec ecx
test ecx, ecx
jl 0x519b3c
inc ecx
mov ebx, edx
xor bl, byte [esi]
movzx ebx, bl
mov edi, dword [0x5a7d38]
mov ebx, dword [edi + ebx*4]
shr edx, 8
xor ebx, edx
mov edx, ebx
inc esi
dec ecx
jne 0x519b21
mov dword [eax], edx
pop edi
pop esi
pop ebx
ret

Function at 0x51ebf8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51ec3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x30]
call fcn.0051d774
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51ec45
lea eax, [ebp - 4]
call fcn.00406ed8
ret
Function at 0x520dc8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x520ed7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x20]
mov edx, dword [eax]
xor ecx, ecx
mov dword [eax], ecx
mov eax, edx
call fcn.00405018
inc dword [ebx + 0x10]
cmp dword [ebx + 0x2c], 0
jne 0x520e06
cmp dword [ebx + 0x28], 0
jbe 0x520e3a
jmp 0x520e08
jle 0x520e3a
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x10]
mov eax, ebx
call fcn.005207ac
mov esi, dword [ebp - 8]
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 0xc]
call fcn.00406f74
push eax
mov eax, dword [ebx + 4]
call fcn.00406f74
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x520e9c
cmp word [ebx + 0x32], 0
je 0x520e7b
mov byte [ebp - 1], 0
lea ecx, [ebp - 1]
mov edx, ebx
mov eax, dword [ebx + 0x34]
call dword [ebx + 0x30]
cmp byte [ebp - 1], 0
je 0x520e67
mov dl, 1
mov eax, dword [0x5139fc]
call fcn.005153ec
call fcn.00405af0
mov eax, dword [ebx + 4]
call fcn.00516750
cmp edx, 0xffffffff
jne 0x520e77
cmp eax, 0xffffffff
je 0x520e45
jmp 0x520e8c
mov dl, 1
mov eax, dword [0x5139fc]
call fcn.005153ec
call fcn.00405af0
mov eax, dword [ebx + 4]
call fcn.005165c0
mov edx, dword [ebx + 0x10]
call fcn.00518140
push 0xff20
mov ecx, dword [ebx + 4]
mov dl, 1
mov eax, dword [0x431080]
call fcn.0043d2c0
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x520ede
lea eax, [ebp - 8]
call fcn.00406ed8
ret
Function at 0x52b8b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52baae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0051d904
cmp ebx, eax
jl 0x52b917
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [0x5a87d0]
call fcn.0040a5d0
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x42d3f8]
call fcn.0041a5b0
call fcn.00405af0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.0051d8f0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x6a]
sub al, 2
jne 0x52b943
mov dl, 1
mov eax, dword [0x514904]
call fcn.005160b8
call fcn.00405af0
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x6a], 1
jne 0x52b9aa
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x52b969
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x64
jl 0x52b972
mov al, 1
jmp 0x52b995
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.00528c64
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x52b98f
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x64
setge al
test al, al
je 0x52b9aa
mov dl, 1
mov eax, dword [0x514904]
call fcn.005160b8
call fcn.00405af0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x10]
test al, al
je 0x52b9c3
mov eax, dword [ebp - 8]
call fcn.005163e4
jmp 0x52ba62
push 0xff40
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x431080]
call fcn.0043d2c0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x52ba2a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x52ba19
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52ba20
mov eax, dword [ebp - 0xc]
call fcn.00405018
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x48]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 8]
call fcn.00517f8c
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00518048
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52bab5
lea eax, [ebp - 0x28]
call fcn.00406ed8
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406ee0
ret
Function at 0x52babc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x52bc0c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x30]
call fcn.0051d904
cmp ebx, eax
jl 0x52bb1e
mov dword [ebp - 8], ebx
mov byte [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0
lea edx, [ebp - 0xc]
mov eax, dword [0x5a87d0]
call fcn.0040a5d0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x42d3f8]
call fcn.0041a5b0
call fcn.00405af0
mov edx, ebx
mov eax, dword [esi + 0x30]
call fcn.0051d8f0
mov ebx, eax
movzx eax, byte [ebx + 0x6a]
sub al, 2
jne 0x52bb43
mov dl, 1
mov eax, dword [0x514904]
call fcn.005160b8
call fcn.00405af0
cmp byte [ebx + 0x6a], 1
jne 0x52bba5
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x52bb65
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x64
jl 0x52bb6e
mov al, 1
jmp 0x52bb90
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00528c64
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x52bb8a
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x64
setge al
test al, al
je 0x52bba5
mov dl, 1
mov eax, dword [0x514904]
call fcn.005160b8
call fcn.00405af0
mov eax, dword [ebx + 0xac]
shl eax, 9
cdq
add eax, dword [ebx + 0xa0]
adc edx, dword [ebx + 0xa4]
push edx
push eax
mov eax, dword [esi + 4]
call fcn.0043c90c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
cmp edx, 0
jne 0x52bbd4
cmp eax, 0
je 0x52bbe9
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
push edx
push eax
mov edx, dword [esi + 4]
mov eax, edi
call fcn.0043cbb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52bc13
lea eax, [ebp - 0x18]
call fcn.00406ed8
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00406ee0
ret
Function at 0x537998
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov ebx, eax
cmp dword [ebp - 0xc], 0
jne 0x5379c3
mov ecx, 0x18e
mov edx, 0x537b90
mov eax, 0x537be4
call fcn.00406204
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00537f44
mov dword [ebp - 0x14], 0xa
lea edi, [ebp - 0x20]
mov eax, pe_nt_image_headers32
call fcn.0040475c
mov byte [ebp - 0xd], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 0xd]
call fcn.00517c44
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00517c44
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 0xd]
mov byte [edi], al
inc edi
dec dword [ebp - 0x14]
jne 0x5379d7
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00537f44
mov dword [ebp - 0x14], 0xa
lea edi, [ebp - 0x20]
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
movzx eax, byte [edi]
mov edx, dword [ebx + 8]
call fcn.00517c44
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00517c44
mov dword [ebx + 0x10], eax
mov eax, esi
xor byte [edi], al
inc edi
dec dword [ebp - 0x14]
jne 0x537a53
movzx eax, byte [ebp + 0xa]
mov byte [ebp - 0xd], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 0xd]
call fcn.00517c44
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00517c44
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 0xd]
mov byte [ebp - 0x16], al
movzx eax, byte [ebp + 0xb]
mov byte [ebp - 0xd], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 0xd]
call fcn.00517c44
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00517c44
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 0xd]
mov byte [ebp - 0x15], al
mov byte [ebx + 4], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 8], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x537d9c
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
lea edi, [esp + 4]
mov eax, dword [esp]
cmp byte [eax + 4], 0
jne 0x537dcb
mov ecx, 0x1f9
mov edx, 0x537e70
mov eax, 0x537ec4
call fcn.00406204
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [edi + 4], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov dword [edi + 8], eax
mov esi, ebx
dec ebp
test ebp, ebp
jl 0x537e40
inc ebp
mov eax, dword [edi + 8]
and eax, 0xffff
or eax, 2
movzx ebx, byte [esi]
mov edx, ebx
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [esi], dl
mov edx, dword [edi]
mov eax, ebx
call fcn.00517c44
mov dword [edi], eax
mov eax, dword [edi]
and eax, 0xff
add dword [edi + 4], eax
imul ebx, dword [edi + 4], 0x8088405
inc ebx
mov dword [edi + 4], ebx
mov eax, ebx
shr eax, 0x18
mov edx, dword [edi + 8]
call fcn.00517c44
mov dword [edi + 8], eax
inc esi
dec ebp
jne 0x537ded
mov eax, dword [esp]
mov edx, dword [edi]
mov dword [eax + 8], edx
mov eax, dword [esp]
mov edx, dword [edi + 4]
mov dword [eax + 0xc], edx
mov eax, dword [esp]
mov edx, dword [edi + 8]
mov dword [eax + 0x10], edx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x537f44
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406898
xor eax, eax
push ebp
push 0x538002
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [ebp - 4]
test eax, eax
je 0x537f9a
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x537f9a
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.004064f4
test eax, eax
je 0x537fa3
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x537fec
mov edi, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.00517c44
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00517c44
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x537fae
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x538009
lea eax, [ebp - 4]
call fcn.004062d8
ret
Function at 0x539668
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x2c]
sub eax, dword [ebx + 0x28]
cmp eax, dword [esp]
jge 0x539697
mov ecx, 0xf0
mov edx, 0x5397bc
mov eax, 0x53980c
call fcn.00406204
mov eax, dword [esp + 4]
cmp eax, dword [esp]
je 0x5396be
mov eax, dword [esp]
dec eax
cmp eax, dword [esp + 4]
je 0x5396be
mov ecx, 0xf2
mov edx, 0x5397bc
mov eax, 0x539898
call fcn.00406204
mov eax, dword [ebx + 0x28]
mov edx, dword [esp]
cmp edx, dword [esp + 4]
jle 0x5396cb
inc eax
mov edx, dword [ebx + 0x18]
mov dword [esp + 8], edx
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x20]
mov esi, dword [esp + 4]
dec esi
test esi, esi
jl 0x53970b
inc esi
shl edx, 5
movzx edi, byte [eax + 2]
xor edx, edi
and edx, 0x3fff
mov edi, eax
and edi, dword [ebx + 0x5c]
mov ebp, dword [esp + 8]
lea ebp, [ebp + edi*4]
mov edi, dword [ecx + edx*4]
mov dword [ebp], edi
mov dword [ecx + edx*4], eax
inc eax
dec esi
jne 0x5396e2
mov esi, dword [esp + 8]
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x28], eax
cmp byte [ebx + 4], 0
je 0x539744
mov eax, dword [esp]
add dword [ebx + 0x44], eax
mov eax, dword [esp]
add dword [ebx + 0x48], eax
cmp byte [ebx + 0x34], 0
je 0x53975e
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x53975e
mov eax, ebx
call fcn.00539c5c
jmp 0x53975e
mov edx, eax
sub edx, dword [ebx + 0x44]
cmp edx, dword [ebx + 0x60]
jl 0x53975e
mov byte [ebx + 4], 1
sub eax, dword [ebx + 0x60]
sub eax, dword [ebx + 0x44]
add dword [ebx + 0x44], eax
add dword [ebx + 0x48], eax
cmp word [ebx + 0x3a], 0
je 0x539796
mov eax, dword [esp]
add dword [ebx + 0x10], eax
mov esi, dword [ebx + 0x10]
test esi, 0xfff
jne 0x539796
mov dword [esp + 0xc], esi
fild dword [esp + 0xc]
fmul dword [0x53990c]
fild qword [ebx + 0x50]
fdivp st(1)
call fcn.004047ec
mov edx, eax
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x5397a5
mov eax, ebx
call fcn.00539c5c
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x575880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
test dl, dl
je 0x575893
add esp, 0xfffffff0
call fcn.0040554c
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x57590c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00404fe8
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x18], 0
lea edx, [ebp - 4]
mov eax, esi
call fcn.00575dd8
mov edx, dword [ebp - 4]
lea eax, [esi + 0xc]
call fcn.00406ee8
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x10]
mov edx, 0x57593c
call fcn.004073cc
mov ecx, esi
mov dl, 1
mov eax, dword [0x574e14]
call fcn.00576348
mov dword [esi + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575913
lea eax, [ebp - 4]
call fcn.00406ed8
ret

Function at 0x575b5c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor edx, edx
push ebp
push 0x575c07
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0057633c
mov ebx, eax
lea eax, [ebx + 0x1c]
mov edx, dword [ebp - 4]
call fcn.00406ee8
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.004151f0
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00406ee8
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 8]
call fcn.00406ee8
test edi, edi
je 0x575bc9
mov edx, edi
mov eax, ebx
call fcn.0057710c
jmp 0x575bd6
lea eax, [ebx + 0x14]
mov edx, 0x575c28
call fcn.00406ee8
test esi, esi
je 0x575be4
lea eax, [ebx + 0x10]
mov edx, esi
call fcn.00406ee8
lea eax, [ebx + 0x18]
mov edx, 0x575c4c
call fcn.00406ee8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575c0e
lea eax, [ebp - 0xc]
call fcn.00406ed8
ret