joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022c5d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xec
mov eax, 0x100553ba
call fcn.10026c7b
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xec], eax
xor eax, eax
mov dword [ebp - 0xe4], 0x7263444b
push eax
push eax
sub esp, 0xc
mov dword [ebp - 0xe0], 0x59556e4a
mov ecx, esp
mov dword [ebp - 0xdc], 0x776f6948
mov dword [ebp - 0xd8], 0x69465350
mov dword [ebp - 0xd4], 0x3856544a
mov dword [ebp - 0xd0], 0x5238684d
mov dword [ebp - 0xcc], 0x42346a49
mov dword [ebp - 0xc8], 0x52305143
mov dword [ebp - 0xc4], 0x45775446
mov dword [ebp - 0xc0], 0x55775461
mov dword [ebp - 0xbc], 0x78355750
mov dword [ebp - 0xb8], 0x2b464265
mov dword [ebp - 0xb4], 0x41385164
mov dword [ebp - 0xb0], 0x7941324b
mov dword [ebp - 0xac], 0x37746945
mov dword [ebp - 0xa8], 0x774d5149
mov dword [ebp - 0xa4], 0x64777965
mov dword [ebp - 0xa0], 0x53556948
mov dword [ebp - 0x9c], 0x53774146
mov dword [ebp - 0x98], 0x5a51774f
mov dword [ebp - 0x94], 0x7a384441
mov dword [ebp - 0x90], 0x6e49784c
mov dword [ebp - 0x8c], 0x7663514e
mov dword [ebp - 0x88], 0x3249694f
mov dword [ebp - 0x84], 0x4834794e
mov dword [ebp - 0x80], 0x54415342
mov dword [ebp - 0x7c], 0x6d554744
mov dword [ebp - 0x78], 0x6a597741
mov dword [ebp - 0x74], 0x78596d65
mov dword [ebp - 0x70], 0x724d6850
mov dword [ebp - 0x6c], 0x46384345
mov dword [ebp - 0x68], 0x6b777749
mov dword [ebp - 0x64], 0x4b345145
mov dword [ebp - 0x60], 0x30304450
mov dword [ebp - 0x5c], 0x2b414241
mov dword [ebp - 0x58], 0x676c784b
mov dword [ebp - 0x54], 0x2b6b784a
mov dword [ebp - 0x50], 0x6e414259
mov dword [ebp - 0x4c], 0x2b557a4d
mov dword [ebp - 0x48], 0x51496e4e
mov dword [ebp - 0x44], 0x78315448
mov dword [ebp - 0x40], 0x69383250
mov dword [ebp - 0x3c], 0x4d457961
mov dword [ebp - 0x38], 0x38416847
mov dword [ebp - 0x34], 0x3638414d
mov dword [ebp - 0x30], 0x30345144
mov dword [ebp - 0x2c], 0x5767684c
mov dword [ebp - 0x28], 0x674a4259
mov dword [ebp - 0x24], 0x41776744
mov dword [ebp - 0x20], 0x4f434141
mov byte [ebp - 0xe8], al
push dword [ebp - 0xe8]
mov dword [ebp - 4], eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.10017be3
lea eax, [ebp - 0xf8]
push eax
call fcn.1001ad84
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.100245b7
push eax
lea ecx, [ebp + 0x14]
call fcn.1001afe6
cmp eax, 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf8]
setne bl
call fcn.10024437
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi]
call dword [eax + 4]
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.1002456e
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
test bl, bl
push 0x18
pop esi
push 0
pop edx
push ecx
mov ecx, dword [ebp - 0xec]
cmovne edx, esi
push eax
add ecx, edx
push ecx
call fcn.1002b210
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.100243b4
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.1001ec41
mov al, 1
call fcn.10026c25
ret
Function at 0x10025e6b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x1009572c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [eax]
mov dword [ebp - 0x24], eax
call fcn.10025e2e
push esi
call fcn.10026193
mov esi, eax
push edi
mov dword [ebp - 0x14], esi
call fcn.10026193
push 0x58
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.10029570
lea eax, [ebp - 0x7c]
push eax
push 5
push esi
call fcn.10025d18
mov edi, eax
add esp, 0x20
cmp edi, 5
jb 0x10026009
push edi
push esi
call fcn.10026277
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push esi
call fcn.10026403
mov ebx, eax
add esp, 0x1c
test ebx, ebx
je 0x10026004
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
and dword [ebp - 8], 0
push ecx
push 0x40
push edi
push esi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x10025fe9
lea eax, [ebp - 8]
push eax
push 0x40
push 0x6c
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x10025fcc
xor edx, edx
lea ecx, [ebx + 0x2c]
test edi, edi
je 0x10025f52
sub esi, ecx
mov al, byte [esi + ecx]
mov byte [ecx], al
mov byte [ebx + edx + 0x4c], al
inc edx
inc ecx
cmp edx, edi
jb 0x10025f3d
mov esi, dword [ebp - 0x14]
lea ecx, [ebx + 0x2c]
lea eax, [edi + esi]
push eax
lea eax, [ecx + edi]
push eax
call fcn.10025de5
mov edx, dword [ebp - 0x18]
mov eax, edx
pop ecx
pop ecx
mov ecx, esi
sub eax, esi
sub ecx, edx
cmp edx, esi
push edx
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x10025f98
lea esi, [ebx + 0xc]
push esi
call fcn.10025de5
pop ecx
pop ecx
sub eax, ebx
sub eax, 0xc
push eax
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push esi
mov esi, dword [ebp - 0x14]
push esi
call fcn.10025de5
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov dword [ebx + 8], eax
lea eax, [ebx + 0x2c]
push edi
push eax
push dword [ebp - 0x10]
mov dword [ebx + 4], edi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x6c
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [ebx], 0
je 0x10025ff8
mov ecx, dword [ebp - 0x24]
lea eax, [ebx + 0x2c]
mov dword [ecx], eax
jmp 0x10026004
push 1
push ebx
call fcn.1002650a
pop ecx
pop ecx
xor ebx, ebx
call fcn.10026115
push 0x10097990
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.10026547
mov esp, ebp
pop ebp
ret
Function at 0x1002602c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1009572c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0xc], ebx
xor edi, edi
call fcn.10025e2e
xor esi, esi
mov eax, dword [esi*4 + 0x100979a8]
test eax, eax
je 0x10026064
add eax, 0x2c
cmp eax, dword [ebx]
je 0x10026109
inc esi
cmp esi, 0x40
jb 0x1002604e
xor esi, esi
test esi, esi
je 0x100260eb
push dword [esi + 4]
push dword [esi]
call fcn.10026277
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 8], edi
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x100260e6
mov edx, dword [esi]
xor ecx, ecx
cmp dword [esi + 4], ecx
jbe 0x100260b3
mov al, byte [esi + ecx + 0x4c]
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [esi + 4]
jb 0x100260a6
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 0xc]
xor edi, edi
mov eax, dword [esi]
inc edi
push 0
push esi
mov dword [ecx], eax
call fcn.1002650a
pop ecx
pop ecx
call fcn.10026115
push 0x10097990
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026547
mov esp, ebp
pop ebp
ret
mov esi, dword [esi*4 + 0x100979a8]
jmp 0x1002606c

Function at 0x10026115
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x10097ab0], esi
jbe 0x10026167
mov eax, dword [0x10097aac]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x10097aac]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x10097ab0]
jb 0x10026142
push dword [0x10097aac]
call fcn.10030285
and dword [0x10097aac], 0
and dword [0x10097ab0], 0
pop ecx
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100261cb
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x1009572c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x10026265
test esi, esi
je 0x10026265
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1002625c
mov dword [ebp - 0x2d0], 0x10001
xor ebx, ebx
jmp 0x10026248
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x218], eax
jb 0x10026265
add eax, dword [ebp + 0x10]
cmp dword [ebp - 0x218], eax
jae 0x10026265
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp ebx, 3
jge 0x1002625c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc ebx
lea eax, [ebp - 0x2d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x10026216
jmp 0x10026265
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026547
mov esp, ebp
pop ebp
ret

Function at 0x10026403
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1009572c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 0x48], eax
cmp dword [0x10097aa8], 0x40
jae 0x100264f9
push esi
lea esi, [edx + ecx]
add ecx, dword [ebp + 0x14]
push edi
cmp ecx, 0x80000000
lea edi, [ebp - 0x44]
push 9
lea eax, [ecx + 0x7ff80000]
mov edx, 0xfff80000
cmovb edx, eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
mov esi, dword [ebp - 0x48]
cmovb edi, eax
cmp edi, esi
jae 0x100264f7
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100264d2
cmp dword [ebp - 0x10], 0x10000
jne 0x100264c6
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jb 0x100264c9
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
jb 0x100264c9
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x100264d6
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
add edi, eax
cmp edi, esi
jb 0x1002647b
test ebx, ebx
je 0x100264f7
xor eax, eax
cmp dword [eax*4 + 0x100979a8], 0
je 0x100264ea
inc eax
cmp eax, 0x40
jb 0x100264d8
jmp 0x100264f7
inc dword [0x10097aa8]
mov dword [eax*4 + 0x100979a8], ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10026547
mov esp, ebp
pop ebp
ret

Function at 0x10033675
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003357a
Function at 0x1003e1c5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4060b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021ba
and dword [ebp - 4], 0
cmp dword [0x40b654], 0
mov ebx, eax
jne 0x406167
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406218
push eax
call fcn.00402148
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b654], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b658], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b65c], eax
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b664], eax
test eax, eax
je 0x406167
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b660], eax
mov eax, dword [0x40b660]
cmp eax, ebx
je 0x4061bf
cmp dword [0x40b664], ebx
je 0x4061bf
push eax
call fcn.004021c3
push dword [0x40b664]
mov esi, eax
call fcn.004021c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bf
test edi, edi
je 0x4061bf
call esi
test eax, eax
je 0x4061b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b6
test byte [ebp - 0xc], 1
jne 0x4061bf
or dword [ebp + 0x10], 0x200000
jmp 0x4061f8
mov eax, dword [0x40b658]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f8
mov eax, dword [0x40b65c]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b654]
call fcn.004021c3
pop ecx
test eax, eax
je 0x406218
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40621a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x400000
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0x400000
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0x400000
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [0x541484], 0
mov esi, eax
je 0x404bac
call fcn.00415540
mov dword [0x541484], 0
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp + 0x10]
mov edx, esi
push ecx
mov ecx, eax
call fcn.004152c0
add esp, 8
mov dword [0x541484], eax
xor ecx, ecx
mov edx, 4
test eax, eax
cmove ecx, edx
pop edi
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x408a60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x408a91
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x408a80
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x40cd40
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x40cf64
nop word [eax + eax]
cmp eax, 0x7c
je 0x40cf64
cmp eax, 0x29
jne 0x40cd8e
cmp dword [esi + 0x10], 0
jne 0x40cf64
cmp eax, eax
jne 0x40cd8e
test dword [esi + 0x50], 0x10000000
je 0x40cf76
jmp 0x40cf1d
cmp eax, 0x2e
jne 0x40cded
push 5
lea ecx, [esi + 0x24]
call fcn.0040cfe0
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x40cde1
cmp word [eax], 0x5c
jne 0x40cddc
lea ecx, [eax + 2]
cmp ecx, edx
je 0x40cddc
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x40cdc8
movzx edi, word [ecx]
cmp edi, 0x28
je 0x40cdda
cmp edi, 0x29
je 0x40cdda
test dl, 0x10
jne 0x40cddc
movzx edx, word [ecx]
cmp edx, 0x7b
je 0x40cdda
cmp edx, 0x7d
jne 0x40cddc
mov eax, ecx
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.0040aad0
jmp 0x40cf4f
cmp eax, 0x5c
jne 0x40ce4c
mov ecx, esi
call fcn.0040ccf0
test byte [esi + 0x50], 0x80
je 0x40ce40
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x40ce1e
push 4
lea ecx, [esi + 0x24]
call fcn.0040cfe0
mov ecx, esi
call fcn.0040ccf0
jmp 0x40cf56
cmp eax, 0x42
jne 0x40ce40
push 4
lea ecx, [esi + 0x24]
call fcn.0040cfe0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0040ccf0
jmp 0x40cf56
mov ecx, esi
call fcn.0040e200
jmp 0x40cf4f
cmp eax, 0x5b
jne 0x40cead
mov ecx, esi
call fcn.0040ccf0
lea ecx, [esi + 0x24]
call fcn.0040f2b0
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x40ce79
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0040ccf0
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x40ce97
cmp eax, 0x5d
jne 0x40ce97
push eax
lea ecx, [esi + 0x24]
call fcn.0040f340
mov ecx, esi
call fcn.0040ccf0
mov ecx, esi
call fcn.0040ecd0
cmp dword [esi + 0x4c], 0x5d
jne 0x40cf7f
jmp 0x40cf48
cmp eax, 0x28
jne 0x40ced9
mov ecx, esi
call fcn.0040ccf0
mov ecx, esi
call fcn.0040e350
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x40cf76
mov ecx, esi
call fcn.0040ccf0
test bl, bl
je 0x40cf56
jmp 0x40cf4f
cmp eax, 0x5e
jne 0x40cef1
push 2
lea ecx, [esi + 0x24]
call fcn.0040cfe0
mov ecx, esi
call fcn.0040ccf0
jmp 0x40cf56
cmp eax, 0x24
jne 0x40cf09
push 3
lea ecx, [esi + 0x24]
call fcn.0040cfe0
mov ecx, esi
call fcn.0040ccf0
jmp 0x40cf56
cmp eax, 0x2a
je 0x40cf6d
cmp eax, 0x2b
je 0x40cf6d
cmp eax, 0x3f
je 0x40cf6d
cmp eax, 0x7b
je 0x40cf6d
cmp eax, 0x7d
jne 0x40cf2d
test dword [esi + 0x50], 0x10000000
je 0x40cf88
jmp 0x40cf3b
cmp eax, 0x5d
jne 0x40cf3b
test dword [esi + 0x50], 0x10000000
je 0x40cf7f
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0040e5b0
mov ecx, esi
call fcn.0040ccf0
mov ecx, esi
call fcn.0040e460
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x40cd60
pop edi
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa
mov ecx, esi
call fcn.0040aac0
push 5
mov ecx, esi
call fcn.0040aac0
push 4
mov ecx, esi
call fcn.0040aac0
push 6
mov ecx, esi
call fcn.0040aac0
int3
Function at 0x412f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x412f4b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x413007
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5095b0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5095b0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5095b0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5095b0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5095b0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5095b0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5095b0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5095b0]
sub edi, 1
jne 0x412f60
pop edi
test esi, esi
je 0x41302a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5095b0]
sub esi, 1
jne 0x413010
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x413040
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x5095b0]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5095b0]
mov dword [edi + 8], ecx
pop edi
pop esi
ret

Function at 0x4137f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov ebx, esi
mov dword [ebp - 8], esi
imul ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x413838
push 0
lea ecx, [ebp + 8]
push ecx
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41382a
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp - 4]
call fcn.004c0b70
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413870
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x4138ab
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4138a6
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x4138d8
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x4138bc
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.004c0b70
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x4138ec
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x4138e3
cmp byte [esi + 8], 0
je 0x4138e3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret