joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54009072
Capabilities:
Get number of processors

Disassembly:
push esi
add esi, 0x4ebe
xor esi, 0x229c
pop esi
push edi
push esi
add esp, 4
call 0x54008e90
add byte [esp + ecx*2], dh
inc ebp
dec esp
aas
xor edi, dword [ebx]
cmp cl, byte [edx + 0x46]
add esp, 4
or edi, 0x778b
jmp 0x54008e9e
pop edi
lea eax, [ebp - 0x1a68]
mov dword [ebp - 0xec0], eax
mov ecx, dword [ebp - 0x5d4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xebc], edx
xor eax, eax
mov word [ebp - 0x270], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ebx
xor ebx, 0x2163
pop ebx
push edi
push esi
add esp, 4
add edi, 0x15f47
and edi, 0x131b7
add edi, 0x11a58
pop edi
push ecx
push edx
add esp, 4
sub ecx, 0x66c
add ecx, 0x11a68
pop ecx
mov edx, dword [ebp - 0xebc]
mov ax, word [edx]
mov word [ebp - 0x12ba], ax
mov ecx, dword [ebp - 0xebc]
add ecx, 2
mov dword [ebp - 0xebc], ecx
mov dx, word [ebp - 0x12ba]
mov word [ebp - 0x270], dx
mov eax, dword [ebp - 0xec0]
mov cx, word [eax]
mov word [ebp - 0x12bc], cx
mov edx, dword [ebp - 0xec0]
add edx, 2
mov dword [ebp - 0xec0], edx
mov ax, word [ebp - 0x12bc]
mov word [ebp - 0x40], ax
inc ebp
rcl byte [ebx - 0x18], 7
add byte [eax], al
add byte [eax], al
dec esi
inc edx
inc esi
dec edx
aaa
add esp, 4
xor ebx, 0xf2a5
add ebx, 0x17957
pop ebx
push esi
or esi, 0x1384
and esi, 0xa7f3
jmp 0x54008f83
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x54008fa1
movzx edx, word [ebp - 0x270]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1930], edx
jmp 0x54008ffb
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x54008ec9
invalid
invalid
invalid
invalid
invalid
movzx eax, word [ebp - 0x270]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x54008ec9
movzx edx, word [ebp - 0x270]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x54008fe5
mov dword [ebp - 0x192c], 0xffffffff
jmp 0x54008fef
mov dword [ebp - 0x192c], 1
mov ecx, dword [ebp - 0x192c]
mov dword [ebp - 0x1930], ecx
cmp dword [ebp - 0x1930], 0
jne 0x54009044
push esi
or esi, 0x16cd0
sub esi, 0x40e1
pop esi
push edx
xor edx, 0x127a1
jmp 0x5400901e
call 0x5400902c
add byte [edx + 0x47], cl
inc edi
dec edi
dec esp
dec edx
inc esp
add esp, 4
and edx, 0xa5cb
pop edx
mov edx, dword [ebp - 0x5d4]
mov dword [ebp - 0x394], edx
jmp 0x540090ac
push ebx
push edi
add esp, 4
jmp 0x5400904f
call 0x5400905d
add byte [ecx], bh
aaa
inc edi
cmp edi, dword [eax]
cmp cl, byte [esi + 0x50]
add esp, 4
add ebx, 0x8493
call 0x54009072
add byte [edi], bh
cmp dword [edx], esi
push eax
inc edi
cmp eax, 0x5b04c483
mov eax, dword [ebp - 0x5d4]
mov ecx, dword [eax]
mov dword [ebp - 0x5d4], ecx
mov edx, dword [ebp - 0x5d4]
cmp edx, dword [ebp - 0xec4]
je 0x540090a2
mov eax, dword [ebp - 0x5d4]
cmp dword [eax + 0x30], 0
jne 0x54008e6d
mov dword [ebp - 0x394], 0
push edi
push esi
add esp, 4
or edi, 0x844c
and edi, 0xf06
pop edi
push esi
jmp 0x540090c5
jmp 0x540090cb
and esi, 0x1344a
pop esi
push ecx
push ecx
add esp, 4
and ecx, 0x16822
pop ecx
cmp dword [ebp - 0x394], 0
jne 0x540099e3
mov ecx, 0x6b
mov word [ebp - 0x1b0c], cx
mov edx, 0x65
mov word [ebp - 0x1b0a], dx
mov eax, 0x72
invalid
invalid
Function at 0x54026c2a
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edi + 0x101e4f0]
mov ebx, 0x2020230
push 0xe4f28f8b
add dword [ecx], eax
mov esp, 0x2020266
push 0xe4f4978b
add dword [ecx], eax
mov edx, 0x202026e
push 0xe4f6878b
add dword [ecx], eax
mov ebx, 0x202026e
push 0xe4f88f8b
add dword [ecx], eax
xor eax, 0x978b68d4
cli
in al, 1
add dword [ebx + edx*2 - 0x7b], edx
mov byte [esi], 0x83
in al, dx
adc byte [eax], bl
add eax, dword [edx]
pop esp
push ebx
add ebx, 0xffffffcb
add byte [edx], al
add al, byte [ebx + 0x3846bf3]
add al, byte [ebx + 0x35787cb]
add bl, byte [ebx + 0x54]
push ebx
test esi, eax
push es
xor esp, 0xffffffaa
push esi
add eax, dword [edx]
sub esp, 0xffffffde
wait
add al, byte [edx]
pop esp
enter 0xffffffffffffe687, 0xfffffffffffffff6
add dword [ecx], eax
xchg esi, esp
test byte [ecx], 1
dec esi
enter 0xffffffffffffe787, 0xfffffffffffffff6
add dword [ecx], eax
jno 0x54026c72
xchg eax, ebp
test byte [ecx], 1
arpl ax, cx
xchg ecx, ebp
test byte [ecx], 1
enter 0xffffffffffffea87, 0xfffffffffffffff6
add dword [ecx], eax
dec esi
enter 0xffffffffffffeb87, 0xfffffffffffffff6
add dword [ecx], eax
imul ecx, eax, 0xffffff87
in al, dx
test byte [ecx], 1
enter 0xffffffffffffed87, 0xfffffffffffffff6
add dword [ecx], eax
je 0x54026c9c
xchg esi, ebp
test byte [ecx], 1
arpl ax, cx
xchg edi, ebp
test byte [ecx], 1
je 0x54026caa
xchg eax, esi
test byte [ecx], 1
jnp 0x54026cb1
xchg ecx, esi
test byte [ecx], 1
pop ecx
enter 0xfffffffffffff287, 0xfffffffffffffff6
add dword [ecx], eax
add ah, byte [esi - 0x5d]
sbb al, byte [edx]
add al, byte [edx]
mov eax, dword [edi + 0x101dd6e]
lea ecx, [edi + 0x101dd6e]
lea edx, [ebx + 0x32]
mov edx, dword [edi + 0x101dd6a]
lea eax, [edi + 0x101dd6a]
mov eax, dword [edi + 0x101e982]
push edx
pop eax
test esi, eax
push es
add edx, 0x5a
adc byte [ebx], al
add al, byte [ebx + 0x241e5ea]
add al, byte [ebx + 0x27c6bca]
add al, byte [ebx + 0x35a0ef2]
add bl, byte [edx + 0x58]
adc eax, 0xffffffd2
into
add al, byte [edx]
pushal
push esp
pop eax
test esi, eax
push es
xor esp, 0xffffffdd
jns 0x54026d50
add bl, byte [ebp + eax*4 - 0x41]
sub cl, 1
add dword [edx], eax
ja 0x54026d69
mov edi, 0x101e982
add dh, byte [edi + 0x11]
leave
xchg dword [edx], ebp
cli
add dword [ecx], eax
add al, byte [edx]
add al, byte [edx]
jmp 0x54026d22
sub cl, 1
add dword [ebp + 0x448d0e53], ecx
push cs
mov eax, dword [edi + 0x101ef6a]
push ebp
sub ebp, 9
push edx
add al, byte [edx]
in eax, dx
pop es
cmp dl, byte [edx + 0x4c]
dec eax
inc edi
pop ebp
push edx
ljmp 0x3602
Function at 0x5405b548
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
mov esi, ecx
and dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
lea eax, [eax + ecx - 1]
dec ecx
not ecx
and eax, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
mov dword [esi + 4], eax
je 0x540a97c4
lea ecx, [eax + ecx - 1]
dec eax
not eax
and ecx, eax
mov dword [esi + 0x14], ecx
mov eax, esi
pop esi
leave
ret 8
mov ecx, 0x100000
jmp 0x5405b589
Function at 0x540c1294
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push edi
jle 0x540c12d6
cmp byte [esi + 0x48], bl
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
je 0x540c12c2
lea eax, [ebp - 8]
push eax
call edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x48], bl
je 0x540c12d6
lea eax, [ebp - 0x10]
push eax
call edi
pop edi
pop ebx
leave
ret 4

Function at 0x540c751f
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [ebp + 8], esi
mov eax, dword [0x54188808]
cmp eax, 0x54188808
je 0x540c7556
cmp byte [eax + 0x19], 6
jb 0x540c7556
push esi
push 0x540be030
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.540c63bc
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push esi
push 1
push esi
call edi
cmp eax, esi
mov dword [ebx + 0xc], eax
je 0x540c7595
push esi
push esi
push 1
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x10], eax
je 0x540c7595
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x540c75d3
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebx + 8], eax
jne 0x540c75c9
call fcn.540c989b
cmp eax, esi
mov dword [ebp + 8], eax
jge 0x540c75c9
mov eax, dword [0x54188808]
cmp eax, 0x54188808
je 0x540c75c9
cmp byte [eax + 0x19], 2
jb 0x540c75c9
push esi
push dword [ebp + 8]
push 0x540be030
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.540c7d1c
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x540e8643
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x37c]
sub esp, 0x18
push esi
push edi
xor edi, edi
cmp ecx, edi
mov esi, 0x8898008d
je 0x540e8820
lea eax, [edx + 0x884]
cmp byte [eax], 0
push ebx
jne 0x540e87db
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
mov byte [eax], 1
call ebx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x540e86bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x540e86a3
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x540e86ae
mov esi, 0x88980003
mov edi, 0x540be7bc
push 0x1886
jmp 0x540e876a
push edi
call ebx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x540e86f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x540e86e2
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x540e86ed
mov esi, 0x88980003
mov edi, 0x540be7bc
push 0x1887
jmp 0x540e876a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x37c]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x1f0]
mov esi, eax
test esi, esi
mov edi, 0x540be7bc
jge 0x540e8734
xor eax, eax
cmp eax, edi
push 0x1888
jne 0x540e872a
push esi
call fcn.540284a6
jmp 0x540e8734
push 1
push edi
push 4
call fcn.54107a0c
push 0
call ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x540e878a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x540e875a
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x540e8765
mov esi, 0x88980003
push 0x1889
xor eax, eax
cmp eax, edi
jne 0x540e877b
push esi
call fcn.540284a6
jmp 0x540e881f
push 1
push edi
push 4
call fcn.54107a0c
jmp 0x540e881f
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
sbb ecx, dword [ebp - 0xc]
push 0
push 0x3e8
push ecx
push eax
call fcn.54007e05
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edx
push eax
call fcn.540405e8
test esi, esi
jl 0x540e87c5
test edx, edx
ja 0x540e87c5
jb 0x540e87c0
cmp eax, 0x4b
jae 0x540e87c5
xor eax, eax
inc eax
jmp 0x540e87c7
xor eax, eax
test al, al
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x885], al
jne 0x540e8816
mov esi, 0x8898008d
jmp 0x540e8816
cmp byte [edx + 0x885], 0
je 0x540e881a
mov eax, dword [ecx]
push edi
push ecx
call dword [eax + 0x1f0]
mov esi, eax
cmp esi, edi
jge 0x540e881f
xor eax, eax
mov edi, 0x540be7bc
cmp eax, edi
push 0x189a
jne 0x540e880c
push esi
call fcn.540284a6
jmp 0x540e8816
push 1
push edi
push 4
call fcn.54107a0c
test esi, esi
jge 0x540e881f
mov esi, 0x8898008d
pop ebx
mov ecx, 0x88760827
pop edi
mov eax, esi
cmp esi, ecx
pop esi
jne 0x540e883b
mov eax, dword [ebp + 8]
mov dword [eax + 0x510], ecx
mov eax, 0x88980006
leave
ret 4
Function at 0x54107998
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
test bl, 4
je 0x541079b3
push dword [ebp + 0x10]
push dword [ebp + 8]
push 2
call fcn.54028434
test bl, 0x10
je 0x541079d7
push dword [ebp + 8]
call fcn.54107c1a
test al, al
je 0x541079d7
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x541079d7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test bl, 1
je 0x541079e2
push ebx
call fcn.54108020
pop ebx
pop ebp
ret 0xc

Function at 0x54107afa
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x5400136c]
mov dword [ebp - 0xc], eax
mov eax, dword [0x54198c70]
cmp dword [ebp - 0xc], eax
jb 0x54107ba5
test eax, eax
jne 0x54107b99
push esi
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x54107bb0
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, 0x2710
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x54107b8a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push dword [0x54198c74]
mov dword [ebp - 0x14], 4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x54107b81
cmp dword [ebp - 0x18], 4
jne 0x54107b81
cmp dword [ebp - 4], eax
jbe 0x54107b81
mov esi, dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
shr eax, 3
sub esi, eax
mov eax, esi
mov dword [0x54198c70], eax
pop esi
cmp dword [ebp - 0xc], eax
jb 0x54107ba5
mov dword [ebp - 0x10], 0x8007000e
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x541081b5
Capabilities:
Check systemkerneldebuggerinformation
Get system information on windows

Disassembly:
cmp byte [0x5419b4b5], 0
jne 0x541081da
push 0
push 2
push 0x5419b4b8
push 0x23
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x541081da
mov byte [0x5419b4b5], 1
movzx eax, byte [0x5419b4b8]
ret

Function at 0x541081e2
Capabilities:
Check systemkerneldebuggerinformation
Get system information on windows

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
cmp byte [0x541990c8], bl
je 0x5410822e
cmp byte [0x541990c9], bl
je 0x54108219
push ebx
push 2
push 0x541990c8
push 0x23
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jge 0x54108219
mov byte [0x541990c8], 1
mov byte [0x541990c9], 1
cmp byte [0x541990c8], bl
je 0x5410822e
cmp byte [0x541990c9], bl
jne 0x5410822e
xor eax, eax
inc eax
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x54108232
Capabilities:
Terminate process
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
call fcn.541081e2
test eax, eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 4], 0x3f
mov byte [ebp - 3], 0
jne 0x5410825e
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5410825e
mov byte [ebp - 4], 0x67
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [ebp - 8], 0x541083d0
jne 0x541082f4
mov dword [ebp - 8], 0x540be97c
mov edi, 0x5401e918
test eax, eax
mov esi, 0x541083d4
jne 0x5410828a
mov esi, 0x540be97c
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp + 0xc], eax
jne 0x54108299
mov edx, 0x5401e918
cmp dword [ebp + 8], eax
je 0x541082a8
cmp dword [ebp + 0xc], eax
mov ecx, 0x541083e0
jne 0x541082ad
mov ecx, 0x5401e918
cmp dword [ebp + 8], eax
mov eax, dword [ebp + 8]
jne 0x541082ba
mov eax, 0x5401e918
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 8]
push edi
push esi
push edx
push ecx
push eax
push 0x541083f0
xor esi, esi
push esi
push 0x63
pop edi
push edi
call sub.ntdll.dll_DbgPrintEx
add esp, 0x2c
cmp dword [ebp - 0xc], esi
lea eax, [ebp - 4]
je 0x541082f8
push 2
push eax
push 0x54108388
call dword [sym.imp.ntdll.dll_DbgPrompt]
jmp 0x54108311
mov edi, eax
jmp 0x5410827c
push eax
lea eax, [ebp - 4]
push eax
push 0x54108438
push esi
push edi
call sub.ntdll.dll_DbgPrintEx
add esp, 0x14
call sub.ntdll.dll_DbgBreakPoint
movsx eax, byte [ebp - 4]
cmp eax, 0x62
jg 0x54108348
je 0x5410837a
sub eax, 0x42
je 0x5410837a
sub eax, 5
je 0x5410837f
dec eax
dec eax
je 0x54108366
sub eax, 7
je 0x5410834d
sub eax, 4
jne 0x5410835f
push 0xc0000001
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x5410835f
sub eax, 0x67
jmp 0x54108324
push 0xc0000001
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x54108520
jmp 0x5410836b
push 0x541084f4
push esi
push edi
call sub.ntdll.dll_DbgPrintEx
add esp, 0xc
jmp 0x5410823c
call sub.ntdll.dll_DbgBreakPoint
pop edi
pop esi
leave
ret 0x14

Function at 0x54112fe2
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40
push 0x3000
push dword [ebp + 8]
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, esi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jne 0x54113013
mov eax, 0x8007000e
push 0x69
push eax
mov esi, eax
call fcn.540284a6
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x54115d8e
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x54115da6
mov eax, 0x80070057
jmp 0x54115e36
push dword [ebp + 8]
push 0x7c
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x54115dd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x54115e36
and eax, 0xffff
or eax, 0x80070000
jmp 0x54115e36
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
jne 0x54115df7
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], edi
mov eax, 0x80004005
jmp 0x54115e35
push edi
push edi
push edi
push 6
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [esi + 8], eax
jne 0x54115e1e
call ebx
cmp eax, edi
jle 0x54115e35
and eax, 0xffff
or eax, 0x80070000
jmp 0x54115e35
push 0x7c
push edi
push eax
call fcn.540080da
mov eax, dword [esi + 8]
mov dword [eax], 3
add esp, 0xc
mov eax, edi
pop ebx
pop edi
leave
ret 4
Function at 0x5415b5e4
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, dword [ecx + 4]
test esi, esi
je 0x5415b605
mov eax, dword [ecx]
mov eax, dword [eax + 8]
add eax, esi
jmp 0x5415b607
xor eax, eax
mov dword [edx], eax
movzx eax, word [ecx + 8]
mov dword [edx + 4], eax
movzx eax, word [ecx + 0xa]
mov dword [edx + 8], eax
movzx eax, word [ecx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 2]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 4]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 6]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 8]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 0xa]
mov dword [edx + 0x24], eax
mov eax, dword [edx + 0x20]
imul eax, dword [edx + 0x18]
imul eax, dword [edx + 0x1c]
shl eax, 2
mov dword [edx + 0x28], eax
mov esi, dword [ecx + 0x14]
test esi, esi
je 0x5415b67a
mov eax, dword [ecx]
mov eax, dword [eax + 8]
add eax, esi
jmp 0x5415b67c
xor eax, eax
pop edi
mov dword [edx + 0x2c], eax
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x407df4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40fb008], 0x8088405
inc edx
mov dword [ebx + 0x40fb008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x420640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x420699
test eax, edx
je 0x42069c
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x420657
movzx eax, word [eax]
sub eax, ecx
jmp 0x42067e
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x42067f
add ecx, 4
js 0x42066f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x42067c
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x42067e
xor eax, eax
ret
test eax, eax
je 0x4206a8
test edx, edx
jne 0x420648
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x429468
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040acdc
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040fbe8
mov edi, eax
cmp edi, 0x104
jbe 0x429413
mov eax, edi
add eax, eax
call fcn.00407a0c
mov esi, eax
jmp 0x429415
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040fbe8
push esi
call fcn.00412cd4
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42944e
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x429438
mov eax, esp
cmp esi, eax
je 0x42945b
mov eax, esi
call fcn.00407a28
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x429494
cmp bl, 0
je 0x429490
cmp bl, 0x41
jl 0x42948b
cmp bl, 0x5a
jg 0x42948b
or bl, 0x20
xor al, bl
inc esi
jmp 0x42946f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4293d4
Function at 0x4aaf04
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x4aaf0c
mov eax, edx
pop esi
pop ebx
ret
Function at 0x5bc876
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x30], eax
xor edx, edx
mov dword [esi + 0x4c], edx
xor ecx, ecx
mov dword [esi + 0x20], ecx
push esi
call fcn.005bc854
pop ecx
xor ecx, ecx
mov eax, ecx
xor edx, edx
mov ebx, eax
shr ebx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor ebx, eax
mov eax, ebx
inc edx
cmp edx, 8
jl 0x5bc89a
mov dword [esi + ecx*4 + 0x70], eax
inc ecx
cmp ecx, 0x100
jb 0x5bc896
pop esi
pop ebx
pop ebp
ret

Function at 0x5bf447
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov esi, pe_nt_image_headers32
or ebx, 0x100
add edi, edi
mov eax, ebx
shr eax, 7
and eax, 1
push eax
mov edx, esi
and edx, edi
add edx, esi
mov ecx, ebx
shr ecx, 8
add edx, ecx
shl edx, 2
add edx, dword [ebp + 0xc]
push edx
push dword [ebp + 8]
call fcn.005bf3b5
add esp, 0xc
add ebx, ebx
mov ecx, ebx
xor ecx, edi
not ecx
and esi, ecx
cmp ebx, 0x10000
jb 0x5bf45e
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5bf507
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 0xc]
xor edx, edx
or eax, 0x100
mov ecx, eax
shr ecx, 8
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + ecx*4]
mov ebx, eax
shr ebx, 7
and ebx, 1
neg ebx
and ebx, 0x7ff
xor ecx, ebx
shr ecx, 4
mov ebx, dword [ebp + 0x10]
add edx, dword [ebx + ecx*4]
add eax, eax
cmp eax, 0x10000
jb 0x5bf515
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x5bf549
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edx, pe_nt_image_headers32
or eax, 0x100
add ecx, ecx
mov esi, edx
and esi, ecx
add esi, edx
mov edi, eax
shr edi, 8
add esi, edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 7
and edi, 1
neg edi
and edi, 0x7ff
xor esi, edi
shr esi, 4
mov edi, dword [ebp + 0x14]
add ebx, dword [edi + esi*4]
add eax, eax
mov esi, eax
xor esi, ecx
not esi
and edx, esi
cmp eax, 0x10000
jb 0x5bf561
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5bf62b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov edi, 1
shl edi, cl
or eax, edi
cmp eax, 1
je 0x5bf670
mov ecx, eax
shr ecx, 1
mov ecx, dword [ebx + ecx*4]
mov edi, eax
and edi, 1
neg edi
and edi, 0x7ff
xor ecx, edi
shr ecx, 4
add edx, dword [esi + ecx*4]
shr eax, 1
cmp eax, 1
jne 0x5bf64d
mov eax, edx
pop edi
pop esi
pop ebx
pop ebp
ret