joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42aee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f593e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 0
mov ecx, 0x534b41
call fcn.004c63e1
mov dword [ebp - 0x14], reloc.WS2_32.dll_accept
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x42af31
mov dword [ebp - 0x14], reloc.WS2_32.dll_bind
mov ecx, dword [ebp + 8]
call fcn.004078b0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 0x18]
call fcn.004079c0
mov dword [ebp - 4], 2
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00408a20
lea edx, [ebp - 0x1c]
push edx
push 0x20119
push 0
lea ecx, [ebp - 0x18]
call fcn.004086f0
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42aff6
mov dword [ebp - 0x14], reloc.WS2_32.dll_accept
lea ecx, [ebp - 0x1c]
push ecx
push 0x20119
push 0
lea ecx, [ebp - 0x18]
call fcn.004086f0
push eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42aff6
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004082a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
and eax, 1
je 0x42afdf
and dword [ebp - 0x10], 0xfffffffe
mov ecx, dword [ebp + 8]
call fcn.004082a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004082a0
mov eax, dword [ebp + 8]
jmp 0x42b097
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x104
push 0x208
push 0
lea ecx, [ebp - 0x230]
push ecx
call fcn.004c9920
add esp, 0xc
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 0
push str.InstallLocation
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42b04d
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp + 8]
call fcn.00408610
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004082a0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
and edx, 1
je 0x42b085
and dword [ebp - 0x10], 0xfffffffe
mov ecx, dword [ebp + 8]
call fcn.004082a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004082a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x42b0b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, 0x534b41
call fcn.004c63e1
lea ecx, [ebp - 4]
call fcn.004078b0
push 5
push 0
push 0
lea ecx, [ebp - 4]
call fcn.004086f0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.004082a0
mov esp, ebp
pop ebp
ret
Function at 0x42b100
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, 0x534b41
call fcn.004c63e1
lea ecx, [ebp - 4]
call fcn.004078b0
push 5
push 0
push 0
lea ecx, [ebp - 4]
call fcn.004086f0
push eax
push 0x4ff258
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.004082a0
mov esp, ebp
pop ebp
ret

Function at 0x42b150
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, 0x534b41
call fcn.004c63e1
lea ecx, [ebp - 4]
call fcn.004078b0
push 5
push 0
push 0
lea ecx, [ebp - 4]
call fcn.004086f0
push eax
push 0x4ff24c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.004082a0
mov esp, ebp
pop ebp
ret
Function at 0x42c640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 0x534e55
call fcn.004c63e1
push 0x5002f8
push 0x81
call fcn.00478fc8
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42c6df
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
push eax
call fcn.00478fc8
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42c6d5
mov ecx, dword [ebp - 4]
push ecx
call fcn.00478fc8
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x42c6d5
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0047daf8
add esp, 0xc
push 0
push ecx
mov ecx, esp
push str.res.xml
call fcn.0042c540
call fcn.0042c570
mov ecx, eax
call fcn.004843fc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esp, ebp
pop ebp
ret
Function at 0x440b10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x440b30
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x501afc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0x501b0c
push esi
mov dword [ebp - 8], ebx
call fcn.004dba02
add esp, 8
test eax, eax
je 0x440b7c
test ebx, ebx
je 0x440b6c
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x440ba5
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x440ba5
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x440c68
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440bc1
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [0x530018]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x440c5e
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x440c5e
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440c00
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440c20
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, esi
add ecx, ebx
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x440c35
mov eax, dword [ebp - 8]
test eax, eax
je 0x440c55
push 8
push 0
push ebx
call eax
jmp 0x440c5c
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0x53001c]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x461ad0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x530400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov eax, dword [ebx + 0x18]
mov edi, dword [eax + 0x260]
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [edi + 0x13c]
push esi
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [edi + 0x134], eax
cmp dword [edi + 0x130], esi
jne 0x461b5c
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [edi + 0xb0]
push eax
call fcn.004c93a0
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [edi + 0x130], eax
mov edx, dword [edi + 0x134]
cmp edx, 4
jge 0x461b8f
push str.Received_too_short_packet
push ebx
call fcn.0043e880
add esp, 8
mov dword [edi + 0xc], 7
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c6ee6
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x148]
push eax
call fcn.004616f0
movzx eax, ax
add esp, 4
mov dword [edi + 0xc], eax
dec eax
cmp eax, 5
ja case.0x461bae.1
jmp dword [eax*4 + 0x461d10]
cmp edx, 4
jle case.0x461bae.4
lea eax, [edi + 0x148]
push eax
call fcn.004616d0
movzx ecx, word [edi + 0x144]
add esp, 4
inc ecx
cmp cx, ax
jne case.0x461bae.4
lea eax, [edx - 4]
push eax
mov eax, dword [edi + 0x148]
add eax, 4
push eax
push 1
push ebx
call fcn.0043ec50
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x461c2e
mov eax, dword [edi + 0x134]
sub eax, 4
cdq
add dword [ebx + 0x98], eax
adc dword [ebx + 0x9c], edx
push dword [ebx + 0x9c]
push dword [ebx + 0x98]
push ebx
call fcn.0044cb50
mov esi, eax
add esp, 0xc
test esi, esi
je case.0x461bae.4
push 5
push edi
call fcn.00462560
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c6ee6
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x148]
lea eax, [edi + 0x148]
add ecx, 4
lea esi, [edx - 4]
push eax
mov dword [ebp - 0x8c], ecx
call fcn.004616d0
push esi
push dword [ebp - 0x8c]
movzx eax, ax
mov dword [edi + 8], eax
call fcn.00462690
add esp, 0xc
cmp eax, esi
jae 0x461c97
push dword [ebp - 0x8c]
push str.TFTP_error:__s
push ebx
call fcn.0043e940
add esp, 0xc
xor esi, esi
push ebx
call fcn.0044cec0
add esp, 4
test eax, eax
je 0x461b7c
push 5
push edi
call fcn.00462560
add esp, 8
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c6ee6
mov esp, ebp
pop ebp
ret
lea eax, [edx - 2]
push eax
mov eax, dword [edi + 0x148]
add eax, 2
push eax
push edi
call fcn.004618b0
mov esi, eax
add esp, 0xc
test esi, esi
je case.0x461bae.4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c6ee6
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x500444
push ebx
call fcn.0043e880
add esp, 0xc
jmp case.0x461bae.4
Function at 0x462560
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
cmp edx, 3
ja case.default.0x462570
jmp dword [edx*4 + 0x4625c4]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00462010
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00461d30
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004627c0
push str.TFTP_finished
push 0x500444
push ecx
call fcn.0043e940
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x500444
push ecx
call fcn.0043e880
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x468c80
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebx + 8]
push dword [edi + 0x14]
lea eax, [edi + 0x18]
push eax
push dword [edi + 0x98]
lea esi, [edi + 0xbc]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x468cc2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push esi
push dword [ebp + 0xc]
call fcn.004692b0
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0xc]
push esi
push ebx
call fcn.00469050
push dword [edi + 0xec]
cmp dword [edi], 5
lea eax, [edi + 0xbc]
push eax
push dword [edi + 0x120]
lea eax, [edi + 0xf0]
mov ecx, 0x5084dc
push eax
push dword [edi + 0x98]
mov eax, str.QUIC
cmovne eax, ecx
push eax
push str._s_socket__d_connected:___s:_d_______s:_d_
push ebx
push esi
call fcn.0043e9c0
push 1
push dword [edi + 0x98]
call fcn.004733f0
add esp, 0x34
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x468e30
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
jne 0x468e54
push dword [ecx + 0x14]
lea eax, [ecx + 0x18]
push eax
push dword [ecx + 0x98]
call dword [sym.imp.WS2_32.dll_connect]
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret

Function at 0x468e60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x530400]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov eax, dword [ebx]
push 0
push dword [ebp + 0x10]
mov eax, dword [eax + 8]
push ecx
mov dword [edi], 0
push dword [eax + 0x98]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x468ef0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x468ebb
mov dword [edi], 0x51
jmp 0x468eed
push 0x100
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.0044fbc0
push eax
push str.Recv_failure:__s
push dword [ebx + 4]
call fcn.0043e880
mov eax, dword [ebx + 4]
add esp, 0x18
mov dword [eax + 0x934], esi
mov dword [edi], 0x38
or esi, 0xffffffff
push dword [edi]
push esi
push dword [ebp + 0x10]
push str.nw_in_read_len_zu______d__err_d
push dword [ebx]
push dword [ebx + 4]
call fcn.0043e9c0
mov ecx, dword [ebp - 4]
add esp, 0x18
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004c6ee6
mov esp, ebp
pop ebp
ret
Function at 0x475880
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4758a5
mov eax, 0x1b
pop esi
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4758d5
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
mov eax, 2
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4759e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x530018]
mov esi, eax
add esp, 4
test esi, esi
jne 0x475a0d
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esi + 0xc]
mov dword [esi], ebx
mov dword [esi + 4], ecx
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
push edi
lea edi, [ebx + 4]
cmp eax, dword [ebx + 0x10]
jbe 0x475a58
mov eax, dword [ebx]
push ecx
call eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push dword [ebp + 0xc]
push dword [esi + 4]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebx + 0xc]
push dword [esi + 4]
mov dword [ebp - 8], eax
push eax
mov eax, dword [ebx + 8]
call eax
mov eax, dword [ebx + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x475a5e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [esi + 4]
mov eax, dword [ebx]
call eax
push dword [esi + 8]
mov eax, dword [ebx]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x475ac1
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
nop
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x475a80
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
lea edi, [eax + 4]
jmp 0x475ac4
mov eax, dword [ebp + 8]
cmp ebx, dword [eax + 0x10]
jae 0x475af8
nop dword [eax]
mov eax, dword [edi]
push 1
push 0x50a26c
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x50a26d
push dword [esi + 8]
call eax
mov eax, dword [ebp + 8]
inc ebx
add esp, 0x18
cmp ebx, dword [eax + 0x10]
jb 0x475ad0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484d13
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x484dbf
cmp dword [esi + 4], 0xffffffff
jne 0x484dbf
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.004cdefc
pop ecx
movzx eax, word [esi + eax*2 + 0x242]
cmp eax, 0x5c
je 0x484d66
cmp eax, 0x2f
je 0x484d66
push 0x50a67c
push edi
call fcn.004de2af
pop ecx
pop ecx
cmp dword [ebp + 0x10], 1
pop edi
jne 0x484d88
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x484d88
mov eax, 0x2000000
jmp 0x484dc4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00487531
add esp, 0x10
test eax, eax
jne 0x484da6
mov eax, dword [ebp - 4]
jmp 0x484dc4
push eax
call fcn.00487c0b
pop ecx
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
jmp 0x484dc4
mov eax, 0x1000000
pop esi
leave
ret 0xc
Function at 0x485286
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x50cb00]
movzx eax, cl
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
mov dword [edx], ecx
mov ecx, dword [edx + 8]
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x50cb00]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x48762e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x487661
push 0
lea eax, [ebp + 0x10]
push eax
push ecx
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x48765c
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x48768b
mov edx, dword [edi + 0x1c]
push esi
mov esi, dword [edi + 0x18]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ecx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.004c93a0
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
pop esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x4877bb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4877c9
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x487888
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x50cb00]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x50cb00]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x50cb00]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x50cb00]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x50cb00]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x50cb00]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x50cb00]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x50cb00]
sub edi, 1
jne 0x4877e1
pop edi
test esi, esi
je 0x4878a4
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x50cb00]
inc edx
sub esi, 1
jne 0x48788c
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x4dd43c
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x530400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x51a4a8
push esi
call fcn.004dba02
pop ecx
pop ecx
test eax, eax
jne 0x4dd46a
xor al, al
jmp 0x4dd4e7
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.004dd171
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x4dd4a4
push dword [ebp - 0x210]
call fcn.004cdd14
xor al, al
jmp 0x4dd4e5
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4dd4aa
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x4dd4ca
push edx
call fcn.004dd373
pop ecx
test al, al
je 0x4dd495
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4dd4d8
mov bl, 1
push dword [ebp - 0x210]
call fcn.004cdd14
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004c6ee6
leave
ret
Function at 0x4e7b8b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x51c09c
push 0x51c094
push str.FlsAlloc
push 0x1f
call fcn.004e79b6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4e7bbf
push dword [ebp + 8]
mov ecx, esi
call dword [0x4f97fc]
call esi
jmp 0x4e7bc5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4e7c09
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x51c0ac
push 0x51c0a4
push str.FlsGetValue
push 0x21
call fcn.004e79b6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4e7c40
push dword [ebp + 8]
mov ecx, esi
call dword [0x4f97fc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4e7c48
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x51c0b4
push 0x51c0ac
push str.FlsSetValue
push 0x22
call fcn.004e79b6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4e7c82
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4f97fc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]