joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10057d30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
shr ecx, 2
mov eax, ecx
dec ecx
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 4]
test eax, eax
je 0x10057dbb
inc ecx
mov ebx, dword [esi]
add esi, 4
mov eax, ebx
shr ebx, 8
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x100e6748]
xor edx, edi
mov eax, ebx
shr ebx, 8
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x100e6748]
xor edx, edi
mov eax, ebx
shr ebx, 8
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x100e6748]
xor edx, edi
mov eax, ebx
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x100e6748]
xor edx, edi
dec ecx
jne 0x10057d56
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov ebx, dword [ebp - 0x10]
and ebx, 3
je 0x10057df8
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
nop
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100e6748]
inc esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
dec ebx
jne 0x10057dd0
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10057ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x10057eb0
xor al, al
pop esi
pop ebp
ret
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
test edi, edi
je 0x10057ecd
mov dl, byte [ebp + 0x10]
lea ecx, [ecx]
xor byte [eax + esi], dl
lea ecx, [eax + esi]
add dl, al
inc eax
cmp eax, edi
jb 0x10057ec0
pop edi
mov al, 1
pop esi
pop ebp
ret

Function at 0x10057ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov edx, ecx
shr edx, 8
sub dl, 0x2b
lea eax, [ecx + 7]
or dl, al
mov eax, ecx
shr eax, 0x10
and dl, al
and dl, 0x55
shr ecx, 0x18
push edi
mov edi, dword [ebp + 8]
xor dl, cl
test edi, edi
jne 0x10057f0f
xor al, al
pop edi
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
test esi, esi
je 0x10057f2d
lea esp, [esp]
xor byte [eax + edi], dl
lea ecx, [eax + edi]
add dl, al
inc eax
cmp eax, esi
jb 0x10057f20
pop esi
mov al, 1
pop edi
pop ebp
ret
Function at 0x100595b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009da38
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100e6018]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x100e6018]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x1005970a
cmp byte [edi + 0x45], 0
je 0x1005970a
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10059610
xor al, al
jmp 0x1005970c
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
lea esi, [edi + 0x48]
lea ebx, [ebx]
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x2c]
cmp ebx, 0x10
lea edx, [esp + 0x1c]
cmovae edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
cmovae ecx, dword [esp + 0x1c]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
push esi
call dword [sym.imp.MSVCP110.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x10059691
dec eax
je 0x10059695
sub eax, 2
je 0x100596f0
xor bl, bl
jmp 0x100596f2
mov byte [edi + 0x45], 0
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp ebx, 0x10
lea eax, [esp + 0x18]
cmovae eax, ecx
sub esi, eax
je 0x100596cd
push dword [edi + 0x50]
lea eax, [esp + 0x1c]
push esi
cmp ebx, 0x10
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR110.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x1005968d
cmp byte [edi + 0x45], 0
je 0x100596f0
test esi, esi
lea esi, [edi + 0x48]
jne 0x10059650
push 0
push 8
lea ecx, [esp + 0x20]
call fcn.10044460
jmp 0x10059647
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x10059706
push dword [esp + 0x18]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
jmp 0x1005970c
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100947be
mov esp, ebp
pop ebp
ret

Function at 0x100598b0
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov eax, ecx
ret

Function at 0x100598e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call sym.iImportLib.dll_private:_void___thiscall_elex::safe::MD5::update_unsigned_char_const___unsigned_int_
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x10059930
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x10059971
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call sym.iImportLib.dll_private:_void___thiscall_elex::safe::MD5::update_unsigned_char_const___unsigned_int_
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10059990
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call sym.iImportLib.dll_public:_void___thiscall_elex::safe::MD5::update_class_std::basic_ifstream_char__struct_std::char_traits_char____
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10059a00
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x1005a660
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x1005a679
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jg 0x1005a68c
pop edi
mov eax, 0xfffffffe
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
jne 0x1005a69d
pop edi
mov eax, 0xfffffffd
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jg 0x1005a6af
pop edi
mov eax, 0xfffffffc
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jne 0x1005a6c1
lea eax, [ebx - 5]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x1c]
test eax, eax
jg 0x1005a6d4
pop ebx
pop edi
mov eax, 0xfffffffa
pop esi
mov esp, ebp
pop ebp
ret
cmp ecx, eax
jge 0x1005a6e4
pop ebx
pop edi
mov eax, 0xfffffff9
pop esi
mov esp, ebp
pop ebp
ret
xor edx, edx
xor ecx, ecx
jmp 0x1005a6f0
mov al, byte [edx + esi]
mov byte [ebp + ecx - 0x200], al
lea eax, [edx + 1]
cdq
mov byte [ebp + ecx - 0x100], cl
inc ecx
idiv edi
cmp ecx, 0x100
jl 0x1005a6f0
xor edi, edi
xor esi, esi
jmp 0x1005a720
mov dl, byte [ebp + esi - 0x100]
movzx eax, byte [ebp + esi - 0x200]
movzx ecx, dl
add edi, eax
add edi, ecx
and edi, 0x800000ff
jns 0x1005a746
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x100]
mov byte [ebp + edi - 0x100], dl
mov byte [ebp + esi - 0x100], al
inc esi
cmp esi, 0x100
jl 0x1005a720
mov edi, dword [ebp + 0x1c]
xor esi, esi
xor edx, edx
test edi, edi
jle 0x1005a7ed
sub dword [ebp + 0x18], ebx
inc edx
and edx, 0x800000ff
jns 0x1005a783
dec edx
or edx, 0xffffff00
inc edx
movzx eax, byte [ebp + edx - 0x100]
add esi, eax
and esi, 0x800000ff
jns 0x1005a79d
dec esi
or esi, 0xffffff00
inc esi
movzx eax, byte [ebp + edx - 0x100]
mov cl, byte [ebp + esi - 0x100]
mov byte [ebp + esi - 0x100], al
mov byte [ebp + edx - 0x100], cl
movzx eax, byte [ebp + esi - 0x100]
movzx ecx, cl
add ecx, eax
and ecx, 0x800000ff
jns 0x1005a7d7
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, byte [ebp + ecx - 0x100]
mov ecx, dword [ebp + 0x18]
inc ebx
xor al, byte [ecx + ebx - 1]
mov byte [ebx - 1], al
dec edi
jne 0x1005a772
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005a800
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x1005a819
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jg 0x1005a82c
pop edi
mov eax, 0xfffffffe
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jne 0x1005a83e
lea eax, [ebx - 3]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jg 0x1005a851
pop ebx
pop edi
mov eax, 0xfffffffc
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
jne 0x1005a863
pop ebx
pop edi
mov eax, 0xfffffffb
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x1c]
test eax, eax
jg 0x1005a876
pop ebx
pop edi
mov eax, 0xfffffffa
pop esi
mov esp, ebp
pop ebp
ret
cmp ecx, eax
jge 0x1005a886
pop ebx
pop edi
mov eax, 0xfffffff9
pop esi
mov esp, ebp
pop ebp
ret
xor edx, edx
xor ecx, ecx
lea ebx, [ebx]
mov al, byte [edx + esi]
mov byte [ebp + ecx - 0x200], al
lea eax, [edx + 1]
cdq
mov byte [ebp + ecx - 0x100], cl
inc ecx
idiv edi
cmp ecx, 0x100
jl 0x1005a890
xor edi, edi
xor esi, esi
jmp 0x1005a8c0
mov dl, byte [ebp + esi - 0x100]
movzx eax, byte [ebp + esi - 0x200]
movzx ecx, dl
add edi, eax
add edi, ecx
and edi, 0x800000ff
jns 0x1005a8e6
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x100]
mov byte [ebp + edi - 0x100], dl
mov byte [ebp + esi - 0x100], al
inc esi
cmp esi, 0x100
jl 0x1005a8c0
mov edi, dword [ebp + 0x1c]
xor esi, esi
xor edx, edx
test edi, edi
jle 0x1005a98d
sub dword [ebp + 0x18], ebx
inc edx
and edx, 0x800000ff
jns 0x1005a923
dec edx
or edx, 0xffffff00
inc edx
movzx eax, byte [ebp + edx - 0x100]
add esi, eax
and esi, 0x800000ff
jns 0x1005a93d
dec esi
or esi, 0xffffff00
inc esi
movzx eax, byte [ebp + edx - 0x100]
mov cl, byte [ebp + esi - 0x100]
mov byte [ebp + esi - 0x100], al
mov byte [ebp + edx - 0x100], cl
movzx eax, byte [ebp + esi - 0x100]
movzx ecx, cl
add ecx, eax
and ecx, 0x800000ff
jns 0x1005a977
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, byte [ebp + ecx - 0x100]
mov ecx, dword [ebp + 0x18]
inc ebx
xor al, byte [ecx + ebx - 1]
mov byte [ebx - 1], al
dec edi
jne 0x1005a912
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005a9a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x1005aa1d
mov esi, dword [ebp + 8]
test esi, esi
je 0x1005aa1d
xor eax, eax
lea ebx, [ebx]
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x1005a9c0
push ebx
push edi
mov dword [ebp - 4], 0
xor edi, edi
mov eax, edi
cdq
idiv dword [ebp - 8]
mov bl, byte [edi + esi]
movzx eax, byte [edx + ecx]
add eax, dword [ebp - 4]
movzx ecx, bl
add ecx, eax
and ecx, 0x800000ff
jns 0x1005a9fb
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov dword [ebp - 4], ecx
mov byte [ecx + esi], bl
mov ecx, dword [ebp - 0xc]
cmp edi, 0x100
jl 0x1005a9d6
pop edi
pop ebx
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1005ab90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
push ebx
push esi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
test eax, eax
je 0x1005ac78
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1005ac78
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1005ac78
push edi
push 0x100
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
mov edx, dword [ebp + 0xc]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1005a9a0
add esp, 8
test eax, eax
jne 0x1005abe5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
xor ebx, ebx
xor ecx, ecx
test eax, eax
jle 0x1005ac5c
sub dword [ebp - 4], esi
mov dword [ebp - 8], eax
inc ebx
and ebx, 0x800000ff
jns 0x1005ac07
dec ebx
or ebx, 0xffffff00
inc ebx
mov dl, byte [ebx + edi]
movzx eax, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x1005ac1f
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, byte [ecx + edi]
mov byte [ebx + edi], al
mov dword [ebp - 0x10], ecx
mov byte [ecx + edi], dl
movzx ecx, byte [ebx + edi]
movzx eax, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x1005ac45
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, byte [ecx + edi]
mov ecx, dword [ebp - 4]
inc esi
xor al, byte [ecx + esi - 1]
dec dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov byte [esi - 1], al
jne 0x1005abf6
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0xc]
push edi
mov dword [eax], edx
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005bfe0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x5c], 0
pop ebp
ret
Function at 0x1005d640
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], 0x67452301
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
mov dword [ebp - 0x58], 0xc3d2e1f0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0xc], 0
call sym.iImportLib.dll_SHA1_Update
push 0
lea eax, [ebp - 0x68]
push esi
push eax
call sym.iImportLib.dll_SHA1_Final
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop esi
call fcn.100947be
mov esp, ebp
pop ebp
ret
Function at 0x1005f4f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1005f4fb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x1005f5c5
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a6478]
movzx eax, byte [edx + 1]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a6478]
movzx eax, byte [edx + 2]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a6478]
movzx eax, byte [edx + 3]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a6478]
movzx eax, byte [edx + 4]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a6478]
movzx eax, byte [edx + 5]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a6478]
movzx eax, byte [edx + 6]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a6478]
movzx eax, byte [edx + 7]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a6478]
add edx, 8
sub esi, 8
dec edi
jne 0x1005f510
pop edi
test esi, esi
je 0x1005f5ea
lea esp, [esp]
movzx eax, byte [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a6478]
lea edx, [edx + 1]
dec esi
jne 0x1005f5d0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x1005f600
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
and eax, 0xff
shr esi, 8
mov eax, dword [eax*4 + 0x100a6478]
xor eax, esi
movzx ecx, al
add ecx, dword [edi + 4]
mov dword [edi], eax
mov eax, dword [edi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x100a6478]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x1005f650
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov bl, dl
mov edx, ecx
mov edi, dword [edx + 8]
mov ecx, dword [edx]
mov esi, edi
and esi, 0xfffd
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
shr eax, 8
xor bl, al
movsx eax, bl
xor eax, ecx
and eax, 0xff
shr ecx, 8
mov eax, dword [eax*4 + 0x100a6478]
xor eax, ecx
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, edi
and eax, 0xff
shr edi, 8
xor edi, dword [eax*4 + 0x100a6478]
mov al, bl
mov dword [edx + 8], edi
pop edi
pop esi
pop ebx
ret
Function at 0x1005fdb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov esi, ebx
imul esi, dword [ebp + 8]
cmp byte [edi], 0
mov eax, ecx
mov dword [ebp - 8], eax
je 0x1005fdf6
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1005fdf1
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x1005fe1e
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x1005fe07
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 8]
call sub.MSVCR110.dll_memcpy
add esp, 0xc
add dword [edi + 0x1c], esi
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor edx, edx
div ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret

Function at 0x1005fe40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp byte [esi], 0
push edi
mov dword [ebp - 0xc], ebx
mov edi, 1
je 0x1005fe85
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 5]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1005fe80
mov byte [esi + 8], 1
mov edi, dword [ebp - 0xc]
jmp 0x1005feb2
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x1005fe96
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 5]
push eax
call sub.MSVCR110.dll_memcpy
lea eax, [ebx + edi]
mov ebx, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x1005fed0
movzx eax, byte [ebp - 5]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x1005febd
cmp byte [esi + 8], 0
je 0x1005febd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret
Function at 0x1005fff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x10060039
cmp byte [edi + 1], 0
je 0x10060027
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1006003f
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], eax
cmp byte [edi], 0
je 0x1006005e
cmp byte [edi + 1], 0
je 0x1006005a
push 1
push 0
push 0
push dword [edi + 4]
call ecx
sub eax, dword [edi + 0xc]
jmp 0x10060061
xor eax, eax
jmp 0x10060061
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, 0xffff
cmp eax, ebx
push esi
cmovb ebx, eax
push 0x404
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], ebx
call dword [sym.imp.MSVCR110.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x1006009b
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0xc], 0xffffffff
cmp ebx, eax
jbe 0x10060197
nop
mov ecx, dword [ebp - 0x10]
add eax, 0x400
cmp eax, ebx
mov edx, eax
cmova edx, ebx
mov ebx, dword [ebp - 0x10]
sub ecx, edx
sub ebx, ecx
cmp ebx, 0x404
mov eax, 0x404
cmova ebx, eax
cmp byte [edi], 0
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
je 0x100600fe
cmp byte [edi + 1], 0
je 0x10060197
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x10060101
mov dword [edi + 0x1c], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0x14], ebx
je 0x10060129
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10060124
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x10060152
mov edx, dword [edi + 0x1c]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
jbe 0x1006013c
mov ecx, dword [edi + 0x18]
sub ecx, edx
mov dword [ebp - 0x14], ecx
push ecx
mov ecx, dword [edi + 0x14]
add ecx, edx
push ecx
push esi
call sub.MSVCR110.dll_memcpy
mov eax, dword [ebp - 0x14]
add esp, 0xc
add dword [edi + 0x1c], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x10060197
lea eax, [ebx - 3]
test eax, eax
js 0x10060182
dec eax
cmp byte [eax + esi], 0x50
jne 0x1006017e
cmp byte [eax + esi + 1], 0x4b
jne 0x1006017e
cmp byte [eax + esi + 2], 5
jne 0x1006017e
cmp byte [eax + esi + 3], 6
je 0x100601b5
test eax, eax
jns 0x10060162
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x10060197
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
cmp eax, ebx
jb 0x100600b0
push esi
call dword [sym.imp.MSVCR110.dll_free]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add esp, 4
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.100947be
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
jmp 0x10060185