joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004725
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push ebx
lea eax, [ebp - 0x14]
push esi
push eax
lea ecx, [ebp - 4]
call fcn.10020103
push eax
lea eax, [ebp - 0x24]
push dword [ebp + 8]
push eax
call fcn.100035f2
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.10001b7f
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x24]
push eax
call fcn.10001b9f
push eax
call fcn.1001b3bf
mov esi, eax
pop ecx
cmp esi, 0xffffffff
pop ecx
jne 0x10004779
xor bl, bl
jmp 0x100048a0
lea eax, [ebp - 0x64]
lea ecx, [ebp - 4]
push eax
call fcn.10020bfc
mov ecx, eax
call fcn.10001b9f
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.1005ecc0
pop ecx
test eax, eax
pop ecx
je 0x100047d6
lea eax, [ebp - 0x34]
lea ecx, [ebp - 4]
push eax
call fcn.10020085
mov ecx, eax
call fcn.10001b9f
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.1005ecc0
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x34]
setne bl
call fcn.10001b7f
test bl, bl
je 0x100047d6
mov bl, 1
jmp 0x100047d8
xor bl, bl
lea ecx, [ebp - 0x64]
call fcn.10001b7f
test bl, bl
je 0x10004854
lea eax, [ebp - 0x178]
lea ecx, [ebp - 4]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.1002020b
push eax
lea eax, [ebp - 0x44]
push dword [ebp + 8]
push eax
call fcn.100035f2
add esp, 0xc
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.100052f2
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.10001b7f
lea ecx, [ebp - 0x54]
call fcn.10001b7f
test byte [ebp - 0x1a4], 0x10
je 0x10004839
lea eax, [ebp - 0x14]
push eax
call fcn.10004725
pop ecx
jmp 0x1000484c
lea ecx, [ebp - 0x14]
call fcn.10001b9f
push eax
call fcn.1001b376
test eax, eax
pop ecx
je 0x1000486c
lea ecx, [ebp - 0x14]
call fcn.10001b7f
lea eax, [ebp - 0x1a4]
push eax
push esi
call fcn.1001b459
pop ecx
test eax, eax
pop ecx
je 0x10004880
jmp 0x10004779
lea ecx, [ebp - 0x14]
call fcn.10001b7f
lea ecx, [ebp - 0x24]
call fcn.10001b7f
xor al, al
jmp 0x100048aa
push esi
call fcn.1001b4a6
pop ecx
mov ecx, dword [ebp + 8]
call fcn.10001b9f
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x10004772
mov bl, 1
lea ecx, [ebp - 0x24]
call fcn.10001b7f
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x100080a9
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
and dword [ebp - 4], 0
mov eax, dword [edi + 4]
mov dword [ebp + 0x14], eax
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
cmp word [eax + 6], 0
lea esi, [ecx + eax + 0x18]
jbe 0x10008178
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x10008118
mov eax, dword [ebp + 0x10]
mov ebx, dword [eax + 0x38]
test ebx, ebx
jle 0x10008163
push dword [edi + 0x34]
mov eax, dword [ebp + 0x14]
add eax, dword [esi - 4]
push 4
push 0x1000
push ebx
push eax
call dword [edi + 0x1c]
add esp, 0x14
test eax, eax
je 0x10008180
mov eax, dword [ebp + 0x14]
push ebx
add eax, dword [esi - 4]
push 0
push eax
mov dword [esi - 8], eax
call fcn.1005e290
add esp, 0xc
jmp 0x10008163
mov ecx, dword [esi + 4]
add ecx, eax
push ecx
push dword [ebp + 0xc]
call fcn.1000809d
pop ecx
test eax, eax
pop ecx
je 0x10008180
push dword [edi + 0x34]
mov ebx, dword [ebp + 0x14]
mov eax, ebx
add eax, dword [esi - 4]
push 4
push 0x1000
push dword [esi]
push eax
call dword [edi + 0x1c]
add esp, 0x14
test eax, eax
je 0x10008180
mov eax, dword [esi + 4]
push dword [esi]
add eax, dword [ebp + 8]
add ebx, dword [esi - 4]
push eax
push ebx
call fcn.1005db50
add esp, 0xc
mov dword [esi - 8], ebx
mov eax, dword [edi]
inc dword [ebp - 4]
add esi, 0x28
movzx eax, word [eax + 6]
cmp dword [ebp - 4], eax
jl 0x100080d5
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x1000817b
Function at 0x10020e15
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
lea eax, [ebp - 1]
push esi
push eax
lea ecx, [ebp - 0x14]
call fcn.10001b1a
and byte [ebp - 0x17], 0
push 0x1008eb14
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x3c], 0x5f
mov byte [ebp - 0x3b], 0x30
mov byte [ebp - 0x3a], 0x31
mov byte [ebp - 0x39], 0x32
mov byte [ebp - 0x38], 0x33
mov byte [ebp - 0x37], 0x34
mov byte [ebp - 0x36], 0x35
mov byte [ebp - 0x35], 0x36
mov byte [ebp - 0x34], 0x37
mov byte [ebp - 0x33], 0x38
mov byte [ebp - 0x32], 0x39
mov byte [ebp - 0x31], 0x41
mov byte [ebp - 0x30], 0x42
mov byte [ebp - 0x2f], 0x43
mov byte [ebp - 0x2e], 0x44
mov byte [ebp - 0x2d], 0x45
mov byte [ebp - 0x2c], 0x46
mov byte [ebp - 0x2b], 0x47
mov byte [ebp - 0x2a], 0x48
mov byte [ebp - 0x29], 0x49
mov byte [ebp - 0x28], 0x4a
mov byte [ebp - 0x27], 0x4b
mov byte [ebp - 0x26], 0x4c
mov byte [ebp - 0x25], 0x4d
mov byte [ebp - 0x24], 0x4e
mov byte [ebp - 0x23], 0x4f
mov byte [ebp - 0x22], 0x50
mov byte [ebp - 0x21], 0x51
mov byte [ebp - 0x20], 0x52
mov byte [ebp - 0x1f], 0x53
mov byte [ebp - 0x1e], 0x54
mov byte [ebp - 0x1d], 0x55
mov byte [ebp - 0x1c], 0x56
mov byte [ebp - 0x1b], 0x57
mov byte [ebp - 0x1a], 0x58
mov byte [ebp - 0x19], 0x59
mov byte [ebp - 0x18], 0x5a
call fcn.10003bbc
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x10020f08
call fcn.1001b6f9
add eax, esi
push eax
call fcn.1005ec8c
pop ecx
call fcn.1005ec99
push 0x24
cdq
pop ecx
idiv ecx
lea ecx, [ebp - 0x14]
mov al, byte [ebp + edx - 0x3c]
push eax
call fcn.10004ace
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x10020ed4
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.10001b32
lea ecx, [ebp - 0x14]
call fcn.10001b7f
mov eax, dword [ebp + 8]
pop esi
leave
ret 8
Function at 0x10053f3a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x10053f48
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x10054029
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x100817e4]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x100817e4]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x100817e4]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x100817e4]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x100817e4]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x100817e4]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x100817e4]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x100817e4]
xor eax, esi
inc edx
dec edi
jne 0x10053f65
pop ebx
cmp dword [ebp + 0x10], 0
je 0x1005404a
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x100817e4]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x1005402f
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x10054050
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [esp + 0x10]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0x100817e4]
xor eax, esi
mov esi, dword [ecx + 8]
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
mov edi, esi
and edi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr esi, 8
mov eax, dword [eax*4 + 0x100817e4]
xor eax, esi
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x10055da6
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [ebp + 8], 0
push ebx
push edi
mov ebx, 0x104
je 0x10055e1a
push ebx
lea eax, [ebp - 0x208]
push dword [ebp + 8]
push eax
call fcn.100557f7
lea eax, [ebp - 0x208]
push eax
call fcn.1005e2f0
add esp, 0x10
test eax, eax
jbe 0x10055dfa
mov cl, byte [ebp + eax - 0x209]
lea eax, [ebp + eax - 0x209]
cmp cl, 0x2f
je 0x10055df7
cmp cl, 0x5c
jne 0x10055dfa
and byte [eax], 0
lea eax, [ebp - 0x208]
push eax
call fcn.10052581
test al, al
pop ecx
jne 0x10055e1a
lea eax, [ebp - 0x208]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [ebp + 0xc]
mov al, byte [edi]
test al, al
je 0x10055ed4
push esi
mov esi, edi
mov ecx, edi
cmp al, 0x2f
je 0x10055e34
cmp al, 0x5c
jne 0x10055e36
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x10055e2c
cmp esi, edi
je 0x10055e6c
sub esi, edi
lea eax, [ebp - 0x208]
push esi
push edi
push eax
call fcn.1005db50
and byte [ebp + esi - 0x208], 0
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.10055da6
add esp, 0x14
and byte [ebp - 0x104], 0
cmp dword [ebp + 8], 0
pop esi
je 0x10055e8d
push ebx
lea eax, [ebp - 0x104]
push dword [ebp + 8]
push eax
call fcn.100557f7
add esp, 0xc
and byte [ebp - 1], 0
lea eax, [ebp - 0x104]
push eax
call fcn.1005e2f0
sub ebx, eax
lea eax, [ebp + eax - 0x104]
push ebx
push edi
push eax
call fcn.100557f7
and byte [ebp - 1], 0
lea eax, [ebp - 0x104]
push eax
call fcn.10052581
add esp, 0x14
test al, al
jne 0x10055ed4
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop ebx
leave
ret
Function at 0x1005659c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
and byte [ebp - 1], 0
push ebx
mov eax, dword fs:[0x30]
mov bl, byte [eax + 2]
mov byte [ebp - 1], bl
movzx eax, byte [ebp - 1]
pop ebx
leave
ret

Function at 0x100565b8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
and byte [ebp - 1], 0
push dword fs:[0x30]
pop edx
mov al, byte [edx + 2]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
leave
ret

Function at 0x100565d4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x10059135
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x10059158
mov eax, 0x200
jmp 0x100592c6
mov eax, dword [ebp - 0x44]
push esi
push edi
mov edx, eax
xor esi, esi
xor edi, edi
and edx, 1
je 0x1005916b
push 1
pop edi
test al, 2
je 0x10059172
or edi, 2
test al, 4
je 0x10059179
or edi, 4
mov ecx, eax
and ecx, 0x10
je 0x10059183
or edi, 0x10
test al, 0x20
je 0x1005918a
or edi, 0x20
cmp ecx, esi
je 0x10059196
or edi, 0x40000000
jmp 0x1005919c
or edi, 0x80000000
or edi, 0x1000000
cmp edx, esi
jne 0x100591ac
or edi, 0x800000
push esi
push ebx
call fcn.1001b6ac
pop ecx
cmp eax, 0x28
pop ecx
mov dword [ebp - 8], eax
jbe 0x1005924e
push esi
push esi
push esi
push ebx
call fcn.1001b601
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp + 0xa]
push 2
push eax
push ebx
call fcn.1001b656
push esi
push esi
push 0x24
push ebx
call fcn.1001b601
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0xc]
push 4
push eax
push ebx
call fcn.1001b656
add esp, 0x48
cmp word [ebp + 0xa], 0x54ad
jne 0x1005924e
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x34]
cmp dword [ebp - 8], ecx
jbe 0x1005924e
push esi
push esi
push eax
push ebx
call fcn.1001b601
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x10]
push 4
push eax
push ebx
call fcn.1001b656
mov eax, dword [ebp - 0x10]
add esp, 0x24
cmp eax, 0x5a4d
je 0x10059248
cmp eax, 0x454e
je 0x10059248
cmp eax, 0x454c
je 0x10059248
cmp eax, 0x4550
jne 0x1005924e
or edi, 0x400000
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x10059257
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
cmp eax, esi
je 0x10059263
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edi, dword [ebp + 0x14]
cmp edi, esi
je 0x10059296
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.100590cf
push dword [ebp - 0x2c]
mov dword [edi], eax
push dword [ebp - 0x30]
call fcn.100590cf
push dword [ebp - 0x3c]
mov dword [edi + 4], eax
push dword [ebp - 0x40]
call fcn.100590cf
add esp, 0x18
mov dword [edi + 8], eax
mov edi, dword [ebp + 0x18]
cmp edi, esi
je 0x100592c2
lea eax, [ebp + 0xe]
push eax
lea eax, [ebp + 0xa]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.10059072
movzx eax, word [ebp + 0xa]
movzx ecx, word [ebp + 0xe]
shl eax, 0x10
add esp, 0x10
or eax, ecx
mov dword [edi], eax
pop edi
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x1005aad3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 1
xor edi, edi
pop esi
cmp ebx, esi
jl 0x1005aaed
cmp ebx, 8
jle 0x1005aaef
xor esi, esi
lea eax, [ebp - 0x10]
push eax
call fcn.1004faa3
pop ecx
mov ecx, eax
call fcn.10001b9f
push eax
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.100592c9
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.10001b7f
cmp dword [esi + 0x6af70], edi
lea ecx, [esi + 0x6af70]
lea eax, [esi + 0x6af78]
mov dword [eax], edi
jne 0x1005ab38
mov dword [eax], 1
mov dword [ecx], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
push edi
push eax
mov dword [esi + 0x6af6c], edi
call fcn.1005e290
mov eax, ebx
add esp, 0xc
shl eax, 3
cmp ebx, 2
movzx ecx, word [eax + 0x10081e32]
mov dword [esi + 0x6af98], ecx
movzx ecx, word [eax + 0x10081e30]
mov dword [esi + 0x6af9c], ecx
movzx ecx, word [eax + 0x10081e34]
mov dword [esi + 0x6afa0], ecx
movzx eax, word [eax + 0x10081e36]
mov dword [esi + 0x6af94], eax
jg 0x1005ab99
mov eax, dword [ebp + 0x10]
or byte [eax], 4
jmp 0x1005aba4
cmp ebx, 8
jl 0x1005aba4
mov eax, dword [ebp + 0x10]
or byte [eax], 2
lea ebx, [esi + 0x1af70]
push 0x10000
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
cmp eax, edi
mov dword [esi + 0x6af90], eax
je 0x1005ac14
cmp eax, 0xffffffff
je 0x1005ac14
cmp eax, 0x106
mov dword [esi + 0x6af8c], edi
jae 0x1005abe6
push esi
call fcn.1005ae43
pop ecx
mov dword [esi + 0x6af7c], edi
movzx eax, byte [ebx + edi]
mov ecx, dword [esi + 0x6af7c]
and eax, 0x7fff
and ecx, 0x3ff
shl ecx, 5
xor eax, ecx
inc edi
cmp edi, 2
mov dword [esi + 0x6af7c], eax
jb 0x1005abec
jmp 0x1005ac24
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1005bd1e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1005bd2c
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x1005be0d
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x10081e80]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x10081e80]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x10081e80]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x10081e80]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x10081e80]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x10081e80]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x10081e80]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x10081e80]
xor eax, esi
inc edx
dec edi
jne 0x1005bd49
pop ebx
cmp dword [ebp + 0x10], 0
je 0x1005be2e
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x10081e80]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x1005be13
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x1005be34
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [esp + 0x10]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0x10081e80]
xor eax, esi
mov esi, dword [ecx + 8]
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
mov edi, esi
and edi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr esi, 8
mov eax, dword [eax*4 + 0x10081e80]
xor eax, esi
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x1005c21f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp byte [esi + 0x2d], 0
je 0x1005c293
mov eax, dword [esi + 0x3c]
xor ebx, ebx
cmp eax, ebx
je 0x1005c24b
cmp dword [esi + 0x40], edi
jae 0x1005c24b
push eax
call fcn.10078a07
pop ecx
mov dword [esi + 0x3c], ebx
cmp dword [esi + 0x3c], ebx
jne 0x1005c260
lea eax, [edi + edi]
push eax
call fcn.100789de
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x3c]
call fcn.1005db50
add esp, 0xc
test edi, edi
jbe 0x1005c290
mov eax, dword [esi + 0x3c]
mov al, byte [ebx + eax]
push eax
lea eax, [esi + 0x30]
push eax
call fcn.1005be87
pop ecx
pop ecx
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jb 0x1005c273
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1005c2c2
mov eax, dword [esi + 0x24]
lea ebx, [eax + edi]
cmp ebx, dword [esi + 0x28]
jb 0x1005c2ae
mov dword [esi + 0x14], 0x30000
jmp 0x1005c2e4
push edi
add eax, ecx
push edx
push eax
call fcn.1005db50
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
jmp 0x1005c2e6
mov eax, dword [esi + 4]
test eax, eax
je 0x1005c2dd
lea ecx, [ebp + 8]
push 0
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x1005c2e6
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1005ed70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005ed90
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1005f81e
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x1005edb3
test byte [esp + 8], 2
je 0x1005edb3
call fcn.1005f891
mov dword [eax], 0xd
call fcn.1005f89a
mov dword [eax], 5
jmp 0x1005ed8c
xor eax, eax
ret

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x402840
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x4e55ec
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x402899
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x402899
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x402899
xor eax, eax
inc eax
jmp 0x40289b
xor eax, eax
leave
ret 0x10

Function at 0x405bae
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x405cd1
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x405cb5
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x405c07
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x405be5
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x419352
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov edi, ecx
mov dword [ebp - 4], esi
jne 0x419375
mov eax, 0x8876086c
jmp 0x41948a
cmp dword [ebp + 0xc], esi
push ebx
je 0x41940d
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
je 0x4193ed
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push 0xfde9
call ebx
push eax
mov dword [ebp + 0xc], eax
call fcn.004abb44
cmp eax, esi
pop ecx
mov dword [ebp - 4], eax
jne 0x4193d1
mov eax, 0x8007000e
jmp 0x419489
push esi
push esi
push dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push 0xfde9
call ebx
mov eax, dword [ebp - 4]
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], esi
cmp dword [ebp + 0xc], esi
je 0x41940d
push esi
push 0x10000000
push 3
push esi
push 1
push accept
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x419426
push esi
push 0x10000000
push 3
push esi
push 1
push accept
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push dword [ebp - 4]
mov dword [edi], eax
call fcn.004abdc5
mov eax, dword [edi]
cmp eax, 0xffffffff
pop ecx
je 0x419477
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x419477
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
je 0x419477
cmp eax, esi
je 0x419484
push esi
push esi
push esi
push 4
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
jne 0x419487
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x419489
mov dword [edi + 8], esi
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8