joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5852cb
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x7f54ca
call fcn.007ed2bc
sub esp, 0x110
push ebx
push esi
push edi
push 0x14
mov dword [ebp - 0x14], ecx
call fcn.00798224
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x18], ebx
mov edi, ebx
add esi, 8
pop ecx
lea ecx, [ebx + 8]
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], 0x876ed0
xor edi, edi
mov dword [ebx + 4], edi
mov dword [ecx], edi
mov dword [ebx], 0x897604
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
call fcn.004437aa
push ebx
mov ecx, esi
call fcn.004771fc
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebp + 8], ebx
call dword [eax + 8]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x5853b5
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x24]
test al, al
jne 0x58534d
push str.pt__is_text__
jmp 0x5853ba
push edi
lea ecx, [ebx + 0xc]
call fcn.004771fc
lea esi, [edi + 0x30]
push esi
lea ecx, [ebx + 0x10]
call fcn.00433dcf
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00429ffe
lea esi, [edi + 0x10]
mov ecx, esi
call fcn.0042d8ef
mov edi, dword [ebp - 0x14]
mov ecx, eax
push edi
mov edx, dword [eax]
call dword [edx + 0x31c]
push 4
mov ecx, esi
call fcn.0042d8ef
push eax
mov ecx, edi
call fcn.004bc559
mov dword [ebp - 4], 1
mov ecx, ebx
mov edx, dword [ebx]
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
push 0x897490
lea ecx, [ebp - 0x118]
call fcn.0049a2c7
push 0x923c10
lea eax, [ebp - 0x118]
push eax
call fcn.00799a10
int3
Function at 0x5a32b6
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [ecx + 4]
imul edx, dword [esp + 8]
mov eax, dword [ecx]
push ebx
push ebp
push esi
add edx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x1c]
lea ebx, [eax + edx*4]
mov eax, 0xff
lea ebp, [edi + 3]
sub edi, ebx
movzx ecx, byte [ebp]
mov esi, eax
movzx eax, byte [ebp - 1]
sub esi, ecx
imul eax, ecx
xor edx, edx
movzx ecx, byte [ebx + 2]
imul ecx, esi
add eax, ecx
mov ecx, 0xff
div ecx
xor edx, edx
mov byte [ebx + 2], al
movzx ecx, byte [ebp]
movzx eax, byte [ebp - 2]
imul eax, ecx
movzx ecx, byte [ebx + 1]
imul ecx, esi
add eax, ecx
mov ecx, 0xff
div ecx
xor edx, edx
mov byte [ebx + 1], al
movzx ecx, byte [ebp]
lea ebp, [ebp + 4]
movzx eax, byte [edi + ebx]
imul eax, ecx
movzx ecx, byte [ebx]
imul ecx, esi
add eax, ecx
mov ecx, 0xff
div ecx
movzx ecx, byte [ebx + 3]
xor edx, edx
mov byte [ebx], al
mov eax, 0xff
sub eax, ecx
lea ebx, [ebx + 4]
imul eax, esi
mov ecx, 0xff
div ecx
sub dword [esp + 0x20], 1
not al
mov byte [ebx - 1], al
mov eax, ecx
jne 0x5a32d9
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x5cbf70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
push ebx
mov ebx, ecx
push ebp
push esi
mov dword [ebx], 0
lea ebp, [ebx + 8]
mov dword [ebx + 4], 0
mov esi, ebp
test edx, edx
je 0x5cbfaf
movzx eax, word [edx]
test ax, ax
je 0x5cbfaf
sub edx, ebp
nop word [eax + eax]
mov word [esi], ax
add esi, 2
movzx eax, word [edx + esi]
test ax, ax
jne 0x5cbfa0
mov eax, dword [esp + 0x14]
cdq
shr dword [esp + 0x14], 0x1f
mov ecx, eax
xor ecx, edx
mov dword [esp + 0xc], esi
sub ecx, edx
mov byte [esp + 0x1c], 0
mov eax, 0x66666667
imul ecx
push edi
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
lea eax, [edi + edi*4]
add eax, eax
sub ecx, eax
je 0x5cbff6
movsx ax, byte [ecx + str.0123456789]
mov byte [esp + 0x20], 1
mov word [esi], ax
add esi, 2
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [ecx + ecx*4]
add eax, eax
sub edi, eax
cmp byte [esp + 0x20], 0
jne 0x5cc01e
test edi, edi
je 0x5cc02c
mov byte [esp + 0x20], 1
movsx ax, byte [edi + str.0123456789]
mov word [esi], ax
add esi, 2
mov eax, 0x66666667
imul ecx
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
mov dl, byte [esp + 0x20]
lea eax, [edi + edi*4]
add eax, eax
sub ecx, eax
test dl, dl
jne 0x5cc052
test ecx, ecx
je 0x5cc060
mov dl, 1
movsx ax, byte [ecx + str.0123456789]
mov word [esi], ax
add esi, 2
test dl, dl
je 0x5cc070
mov eax, 0x2e
mov word [esi], ax
add esi, 2
nop
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [ecx + ecx*4]
add eax, eax
sub edi, eax
movsx ax, byte [edi + str.0123456789]
mov edi, ecx
mov word [esi], ax
add esi, 2
test edi, edi
jg 0x5cc070
cmp byte [esp + 0x18], 0
pop edi
je 0x5cc0af
mov eax, 0x2d
mov word [esi], ax
add esi, 2
xor eax, eax
push esi
mov word [esi], ax
call fcn.00403690
add esp, 4
push eax
push dword [esp + 0x10]
call fcn.00403690
add esp, 4
push eax
call fcn.007e6469
mov ecx, dword [esp + 0x28]
add esp, 8
test ecx, ecx
je 0x5cc0f8
movzx eax, word [ecx]
test ax, ax
je 0x5cc0f8
mov edx, eax
mov word [esi], dx
lea ecx, [ecx + 2]
movzx eax, word [ecx]
add esi, 2
mov edx, eax
test ax, ax
jne 0x5cc0e5
xor eax, eax
mov word [esi], ax
sub esi, ebx
sub esi, 8
mov dword [ebx], ebp
sar esi, 1
mov eax, ebx
mov dword [ebx + 4], esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x5d8d32
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x8016e4
call fcn.007ed2bc
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
push ebx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x14]
call fcn.0042b8fc
xor esi, esi
cmp dword [ebx], 0xf
jne 0x5d8d5f
mov eax, dword [ebx + 8]
jmp 0x5d8d61
mov eax, esi
mov edx, dword [eax + 8]
mov eax, dword [edi]
mov dword [ebp - 0x14], edx
mov ecx, dword [eax + 0x30]
lea eax, [ecx + 0xc]
neg ecx
sbb ecx, ecx
and ecx, eax
add ecx, edx
mov al, byte [ecx + 1]
mov byte [ebp + 0xc], al
mov al, byte [ecx + 2]
mov byte [ebp + 0xd], al
mov al, byte [ecx + 3]
add ecx, 4
mov byte [ebp + 0xe], al
push ecx
push dword [edi + 4]
mov al, byte [ecx]
lea ecx, [ebp - 0x24]
mov byte [ebp + 0xf], al
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], ebx
cmovb ebx, dword [ebp + 0x10]
mov dword [ebp + 0xc], ebx
call fcn.004b84f4
lea ecx, [edi + 0xc]
mov dword [ebp - 4], esi
push eax
mov dword [ebp + 0x10], ecx
call fcn.0045a794
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 1
call fcn.0042b9f0
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x5d8dee
mov edi, dword [ebp + 0x14]
mov esi, ebx
mov ebx, dword [ebp + 0x10]
push edi
mov ecx, ebx
call fcn.0045a794
add edi, 0x10
sub esi, 1
jne 0x5d8dd8
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
inc ebx
test ecx, ecx
je 0x5d8e01
mov eax, dword [ecx + 4]
lea esi, [ecx + 0xc]
shl eax, 4
add esi, eax
mov eax, ebx
mov dword [edi + 0x2c], ebx
shl eax, 4
sub esi, eax
mov eax, dword [edi]
mov dword [edi + 0x28], esi
mov ecx, dword [eax + 0x30]
lea eax, [ecx + 0xc]
neg ecx
sbb ecx, ecx
and ecx, eax
add ecx, dword [ebp - 0x14]
push ecx
mov ecx, edi
call fcn.005d73a2
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x14]
push eax
call fcn.0042b9a8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x5de690
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
push dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 4]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.005de4d0
mov ecx, dword [ebp + 8]
lea edx, [esp + 4]
add esp, 4
call fcn.005de560
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x7313f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx - 4]
jle 0x73145a
mov ecx, dword [ebp + 8]
sub ecx, ebx
push esi
mov dword [ebp + 8], ecx
push edi
nop word [eax + eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [ebp + 8]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
sub dword [ebp + 0x10], 1
mov dword [ebx - 4], eax
jne 0x731410
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x731460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jle 0x7314d3
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub ecx, eax
sub dword [ebp + 0x14], eax
push ebx
push esi
mov dword [ebp + 0xc], ecx
push edi
nop word [eax + eax]
mov ebx, dword [ecx + eax]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov ecx, ebx
and ecx, 0xffff00ff
mov edi, esi
and edi, 0xffff00ff
mov edx, esi
add edi, ecx
and edx, 0xff00
movzx ecx, bx
and esi, 0xff00ff00
add edx, ecx
and ebx, 0xff00ffff
mov ecx, dword [ebp + 0x14]
xor edi, edx
and edi, 0xff00ff
add ebx, esi
xor edi, ebx
sub dword [ebp + 0x10], 1
mov dword [ecx + eax - 4], edi
mov ecx, dword [ebp + 0xc]
jne 0x731480
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x731b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x731cb4
push esi
cmp edi, 8
jb 0x731c77
lea eax, [edi - 1]
lea eax, [ebx + eax*4]
lea esi, [edi - 1]
lea esi, [edx + esi*4]
cmp edx, eax
ja 0x731bab
cmp esi, ebx
jae 0x731c77
mov eax, edi
and eax, 0x80000007
jns 0x731bb9
dec eax
or eax, 0xfffffff8
inc eax
movaps xmm4, xmmword [0x8ae730]
mov esi, edi
movaps xmm6, xmmword [0x8aed80]
sub esi, eax
movaps xmm7, xmmword [0x8ae880]
mov eax, 8
mov edi, ebx
sub edi, edx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
movd xmm3, eax
mov eax, 0x10
movd xmm5, eax
lea eax, [edx + 0x10]
mov edx, dword [ebp - 4]
movups xmm2, xmmword [ebx + ecx*4]
add ecx, 8
lea eax, [eax + 0x20]
movaps xmm0, xmm2
psrld xmm0, xmm3
pand xmm0, xmm4
movaps xmm1, xmm0
pslld xmm1, xmm5
por xmm1, xmm0
movaps xmm0, xmm6
pand xmm0, xmm2
paddd xmm1, xmm0
movaps xmm0, xmmword [0x8aed10]
pand xmm0, xmm2
pand xmm1, xmm7
por xmm1, xmm0
movups xmm2, xmmword [edx + eax - 0x20]
movups xmmword [eax - 0x30], xmm1
movaps xmm0, xmm2
psrld xmm0, xmm3
pand xmm0, xmm4
movaps xmm1, xmm0
pslld xmm1, xmm5
por xmm1, xmm0
movaps xmm0, xmm2
pand xmm2, xmmword [0x8aed10]
pand xmm0, xmm6
paddd xmm1, xmm0
pand xmm1, xmm7
por xmm1, xmm2
movups xmmword [eax - 0x20], xmm1
cmp ecx, esi
jl 0x731bf4
mov edx, dword [ebp + 0x10]
cmp ecx, edi
jge 0x731cb3
sub ebx, edx
lea eax, [edx + ecx*4]
sub edi, ecx
mov esi, dword [eax + ebx]
lea eax, [eax + 4]
mov ecx, esi
shr ecx, 8
movzx ecx, cl
mov edx, ecx
shl edx, 0x10
or edx, ecx
mov ecx, esi
and ecx, 0xffff00ff
add edx, ecx
xor edx, esi
and edx, 0xff00ff
xor edx, esi
mov dword [eax - 4], edx
sub edi, 1
jne 0x731c82
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x732290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + eax*4]
cmp esi, edi
jae 0x7322d9
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [esi]
lea eax, [eax + 2]
mov edx, ebx
mov ecx, ebx
shr ecx, 0xc
add esi, 4
shr edx, 0x10
xor dl, cl
mov ecx, ebx
shr ecx, 0x10
and dl, 0xf
xor dl, cl
mov ecx, ebx
shr ecx, 0x1c
and bl, 0xf0
or cl, bl
mov byte [eax - 2], dl
mov byte [eax - 1], cl
cmp esi, edi
jb 0x7322a6
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x7322e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + eax*4]
cmp esi, edi
jae 0x732333
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [esi]
lea eax, [eax + 2]
mov edx, ebx
mov ecx, ebx
shr edx, 0x10
add esi, 4
shr ecx, 0xd
xor dl, cl
mov ecx, ebx
and dl, 7
shr ecx, 0x10
xor dl, cl
mov ecx, ebx
mov byte [eax - 2], dl
mov edx, ebx
shr edx, 5
shr ecx, 3
xor dl, cl
shr ebx, 5
and dl, 0x1f
xor dl, bl
mov byte [eax - 1], dl
cmp esi, edi
jb 0x7322f6
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x740e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
mov ecx, esi
mov edx, dword [esi + 4]
add edx, 7
sar edx, 3
call fcn.00754840
mov ecx, dword [esi + 4]
test eax, eax
je 0x740e5b
test ecx, ecx
jle 0x740e52
mov edx, dword [esi + 0xc]
nop dword [eax + eax]
mov al, byte [esi]
sub ecx, 8
shr dword [esi], 8
mov byte [edx], al
inc edx
test ecx, ecx
jg 0x740e40
mov dword [esi + 0xc], edx
mov dword [esi + 4], 0
xor ecx, ecx
mov eax, dword [esi + 8]
lea ebx, [ecx + 7]
sar ebx, 3
add ebx, dword [esi + 0xc]
sub ebx, eax
mov dword [ebp - 8], eax
push edi
push 0x15
mov dword [ebp - 0x24], 0x46464952
lea ecx, [ebx + 1]
mov dword [ebp - 0x1c], 0x50424557
mov esi, ecx
mov dword [ebp - 0x18], 0x4c385056
lea edx, [ecx + 0xc]
mov byte [ebp - 0x10], 0x2f
and esi, 1
add edx, esi
movzx eax, dx
mov byte [ebp - 0x20], al
shr eax, 8
mov byte [ebp - 0x1f], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x1e], al
sar eax, 8
mov byte [ebp - 0x1d], al
movzx eax, cx
mov byte [ebp - 0x14], al
shr eax, 8
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x24]
shr ecx, 0x10
mov byte [ebp - 0x12], cl
sar ecx, 8
push eax
mov eax, dword [edi + 0x48]
mov dword [ebp - 0xc], edx
mov byte [ebp - 0x11], cl
call eax
add esp, 0xc
test eax, eax
je 0x740f1a
mov eax, dword [edi + 0x48]
push edi
push ebx
push dword [ebp - 8]
call eax
add esp, 0xc
test eax, eax
je 0x740f1a
test esi, esi
je 0x740f06
push edi
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push 1
push eax
mov eax, dword [edi + 0x48]
call eax
add esp, 0xc
test eax, eax
je 0x740f1a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
add ecx, 8
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x757da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
push esi
mov dword [ebp - 0xc], ebx
mov esi, dword [ebx]
lea eax, [ecx + esi*2]
add eax, esi
imul ecx, eax, 0x2c
mov eax, dword [ebx + 4]
add ecx, dword [ebx + 0x14]
test eax, eax
jns 0x757de1
mov eax, dword [ecx]
cmp eax, 0xfffe0000
jb 0x757dd2
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, eax
jg 0x757f44
push edi
mov edi, 2
nop
mov eax, dword [ecx]
cmp eax, 0xfffe0000
jb 0x757e01
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10001
mov dword [ecx], eax
mov eax, dword [ebx + 8]
movsx edx, word [eax + esi*2]
test edx, edx
jne 0x757e49
mov eax, dword [ecx + 4]
inc esi
cmp eax, 0xfffe0000
jb 0x757e26
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
mov dword [ecx + 4], eax
movzx eax, byte [esi + 0x870b10]
imul ecx, eax, 0x84
mov eax, dword [ebx + 8]
movsx edx, word [eax + esi*2]
add ecx, dword [ebx + 0x14]
test edx, edx
je 0x757e13
mov eax, dword [ecx + 4]
inc esi
mov dword [ebp - 8], esi
cmp eax, 0xfffe0000
jb 0x757e5f
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10001
mov dword [ecx + 4], eax
lea eax, [edx + 1]
cmp edi, eax
mov eax, dword [ecx + 8]
sbb edi, edi
neg edi
cmp eax, 0xfffe0000
jb 0x757e82
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
add eax, edi
mov dword [ecx + 8], eax
lea eax, [edx + 1]
cmp eax, 2
ja 0x757eac
movzx eax, byte [esi + 0x870b10]
imul ecx, eax, 0x84
add ecx, 0x2c
add ecx, dword [ebx + 0x14]
jmp 0x757f35
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, 0x43
cmp eax, 0x43
cmovg eax, edx
xor edi, edi
movzx ebx, word [eax*4 + 0x87419c]
shr ebx, 1
movzx edx, word [eax*4 + 0x87419e]
mov dword [ebp - 4], edx
je 0x757f1d
mov esi, dword [ebp - 4]
lea edx, [ecx + 0xc]
nop dword [eax]
test bl, 1
je 0x757f12
mov ecx, edi
mov eax, 2
shl eax, cl
mov ecx, dword [edx]
and eax, esi
neg eax
sbb eax, eax
neg eax
cmp ecx, 0xfffe0000
jb 0x757f09
inc ecx
shr ecx, 1
and ecx, 0x7fff7fff
add eax, 0x10000
add eax, ecx
mov dword [edx], eax
inc edi
add edx, 4
sar ebx, 1
jne 0x757ee0
mov esi, dword [ebp - 8]
movzx eax, byte [esi + 0x870b10]
mov ebx, dword [ebp - 0xc]
imul ecx, eax, 0x84
mov eax, dword [ebx + 0x14]
add eax, 0x58
add ecx, eax
mov edi, 2
cmp esi, dword [ebx + 4]
jle 0x757df0
pop edi
cmp esi, 0x10
jge 0x757f61
mov eax, dword [ecx]
cmp eax, 0xfffe0000
jb 0x757f5a
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
mov dword [ecx], eax
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x76abc3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, dword [ebp + 8]
add esi, 0xffffff28
mov eax, dword [esi + 0x3c]
dec eax
cmp eax, 0x1c
ja case.default.0x76abdd
jmp dword [eax*4 + 0x76ae17]
mov ecx, esi
call fcn.0076946d
jmp case.default.0x76abdd
mov eax, dword [esi + 0xf4]
cmp eax, 0xffffffff
jne 0x76ac0b
mov dword [esi + 0x48], 0xfffff00d
mov dword [esi + 0xf0], 6
jmp case.default.0x76abdd
cmp eax, 2
jle 0x76ac19
push eax
call fcn.007aebf1
pop ecx
jmp 0x76ac1b
xor eax, eax
cmp eax, 0xffffffff
je 0x76abf8
and dword [esi + 0x48], 0
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.0076969b
jmp case.default.0x76abdd
mov ecx, esi
call fcn.007697ff
jmp case.default.0x76abdd
mov eax, dword [esi + 0x100]
and eax, 1
push eax
push dword [esi + 0xfc]
push dword [esi + 0xf4]
call dword [0x828198]
test eax, eax
jne case.0x76abdd.26
jmp 0x76ad02
mov ecx, esi
call fcn.0076a407
jmp case.default.0x76abdd
mov ecx, dword [esi + 0xf4]
call fcn.0076a1cc
xor edx, edx
mov ecx, esi
call fcn.0076a206
jmp case.default.0x76abdd
mov ecx, dword [esi + 0xf4]
call fcn.0076a1cc
xor edx, edx
inc edx
jmp 0x76ac76
mov ecx, esi
call fcn.0076a2b6
jmp case.default.0x76abdd
mov ecx, esi
call fcn.0076a390
jmp case.default.0x76abdd
mov ecx, esi
call fcn.0076a615
jmp case.default.0x76abdd
mov eax, dword [esi + 0xf4]
cmp eax, 0xffffffff
je 0x76abf8
push eax
call fcn.007b75fc
pop ecx
cmp eax, 0xffffffff
jne 0x76acd0
push 6
pop ecx
jmp 0x76ad56
movsd xmm2, qword [esi + 0x100]
mov ecx, eax
movsd xmm1, qword [esi + 0xf8]
call fcn.0076a5a8
test eax, eax
je case.0x76abdd.26
jmp 0x76ad02
push dword [esi + 0xf4]
call dword [0x828110]
cmp eax, 0xffffffff
jne 0x76ad12
call dword [0x8281a0]
mov dword [esi + 0xf0], eax
mov ecx, eax
jmp 0x76ad5c
test byte [esi + 0xf8], 2
je case.0x76abdd.26
and al, 0x11
cmp al, 1
jne case.0x76abdd.26
mov ecx, 0xfffff030
jmp 0x76ad56
push dword [esi + 0xf8]
push dword [esi + 0xf4]
call fcn.007ec262
pop ecx
mov dword [esi + 0x48], eax
pop ecx
cmp eax, 0xffffffff
jne case.default.0x76abdd
call fcn.007a2762
mov ecx, dword [eax]
mov dword [esi + 0xf0], ecx
call fcn.0076b22b
mov dword [esi + 0x48], eax
jmp case.default.0x76abdd
mov ecx, esi
call fcn.0076a501
jmp case.default.0x76abdd
mov ecx, esi
call fcn.0076a326
jmp case.default.0x76abdd
mov ecx, esi
call fcn.0076995e
jmp case.default.0x76abdd
push dword [esi + 0xf4]
call fcn.007ec1f7
jmp 0x76ad42
push dword [esi + 0xf4]
call fcn.007ec1cd
jmp 0x76ad42
mov ecx, esi
call fcn.00769a96
jmp case.default.0x76abdd
push 1
push dword [esi + 0xfc]
push dword [esi + 0xf4]
call dword [0x828410]
jmp 0x76ac57
mov ecx, esi
call fcn.00769c3e
jmp case.default.0x76abdd
push 0
push dword [esi + 0xf4]
push dword [esi + 0xfc]
call dword [0x828408]
jmp 0x76ac57
mov ecx, esi
call fcn.0076a96e
jmp case.default.0x76abdd
mov ecx, esi
call fcn.0076aa10
jmp case.default.0x76abdd
mov ecx, esi
call fcn.0076ab40
jmp case.default.0x76abdd
Function at 0x7dfd80
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebx]
mov eax, ecx
xor eax, dword [ebp + 0x10]
mov edx, dword [ebx + 8]
movzx eax, al
shr ecx, 8
mov eax, dword [esi + eax*4]
xor eax, ecx
mov dword [ebx], eax
movzx eax, al
add eax, dword [ebx + 4]
imul ecx, eax, 0x8088405
mov eax, dword [ebp + 0x10]
inc ecx
mov dword [ebx + 4], ecx
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [esi + ecx*4]
pop esi
mov dword [ebx + 8], edx
pop ebx
pop ebp
ret

Function at 0x7e19e0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.007e19f0

Function at 0x7e1c70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.007e1f20
Function at 0x408932
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
mov edi, ebx
call fcn.00408951
xor dword [ecx], esi
add ecx, 1
cmp ecx, eax
jne fcn.00408932
dec ebx
add ebx, edi
ret
Function at 0x66799c8b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x672a0008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x672a0008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x66799d99
jmp 0x66799e87
jmp 0x66799f75
jmp 0x6679a063
jmp 0x6679a151
jmp 0x6679a23f
jmp 0x6679a32d
jmp 0x6679a41b
jmp 0x6679a509
jmp 0x6679a5f7
jmp 0x6679a6e5
jmp 0x6679a7d3
jmp 0x6679a8c1
jmp 0x6679a9af
jmp 0x6679aa9d
jmp 0x6679ab8b
jmp 0x6679ac79
jmp 0x6679ad67
jmp 0x6679ae55
jmp 0x6679af43
jmp 0x6679b031
jmp 0x6679b11f
jmp 0x6679b20d
jmp 0x6679b2fb
jmp 0x6679b3e9
jmp 0x6679b4d7
jmp 0x6679b5c5
jmp 0x6679b6b3
mov dword [ebp - 0x14], 0
jmp 0x6679b7a8
jmp 0x6679b896
jmp 0x6679b984
jmp 0x6679ba72
jmp 0x6679bb60
jmp 0x6679bc4e
jmp 0x6679bd3c
jmp 0x6679be2a
jmp 0x6679bf18
jmp 0x6679c006
jmp 0x6679c0f4
jmp 0x6679c1e2
jmp 0x6679c2d0
jmp 0x6679c3be
jmp 0x6679c4ac
jmp 0x6679c59a
jmp 0x6679c688
jmp 0x6679c776
jmp 0x6679c864
jmp 0x6679c952
jmp 0x6679ca40
jmp 0x6679cb2e
jmp 0x6679cc1c
jmp 0x6679cd0a
jmp 0x6679cdf8
jmp 0x6679cee6
jmp 0x6679cfd4
jmp 0x6679d0c2
mov dword [ebp - 0x18], 0
jmp 0x6679d1b7
jmp 0x6679d2a5
jmp 0x6679d393
jmp 0x6679d481
jmp 0x6679d56f
jmp 0x6679d65d
jmp 0x6679d74b
jmp 0x6679d839
jmp 0x6679d927
jmp 0x6679da15
jmp 0x6679db03
jmp 0x6679dbf1
jmp 0x6679dcdf
jmp 0x6679ddcd
jmp 0x6679debb
jmp 0x6679dfa9
jmp 0x6679e097
jmp 0x6679e185
jmp 0x6679e273
jmp 0x6679e361
jmp 0x6679e44f
jmp 0x6679e53d
jmp 0x6679e62b
jmp 0x6679e719
jmp 0x6679e807
jmp 0x6679e8f5
jmp 0x6679e9e3
jmp 0x6679ead1
mov dword [ebp - 0x10], 0
jmp 0x6679ebc6
jmp 0x6679ecb4
jmp 0x6679eda2
jmp 0x6679ee90
jmp 0x6679ef7e
jmp 0x6679f06c
jmp 0x6679f15a
jmp 0x6679f248
jmp 0x6679f336
jmp 0x6679f424
jmp 0x6679f512
jmp 0x6679f600
jmp 0x6679f6ee
jmp 0x6679f7dc
jmp 0x6679f8ca
jmp 0x6679f9b8
jmp 0x6679faa6
jmp 0x6679fb94
jmp 0x6679fc82
jmp 0x6679fd70
jmp 0x6679fe5e
jmp 0x6679ff4c
jmp 0x667a003a
jmp 0x667a0128
jmp 0x667a0216
jmp 0x667a0304
jmp 0x667a03f2
jmp 0x667a04e0
mov dword [ebp - 0x10], 0
jmp 0x667a875a
jmp 0x667a05da
jmp 0x667a06c8
jmp 0x667a07b6
jmp 0x667a08a4
jmp 0x667a0992
jmp 0x667a0a80
jmp 0x667a0b6e
jmp 0x667a0c5c
jmp 0x667a0d4a
jmp 0x667a0e38
jmp 0x667a0f26
jmp 0x667a1014
jmp 0x667a1102
jmp 0x667a11f0
jmp fcn.667a12de
mov eax, dword [0x672a0008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x667a04ec
nop
leave
ret

Function at 0x667f21d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x6729f040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.667f2230