joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001054
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
lea ecx, [ebp - 8]
call fcn.100011f8
lea ecx, [ebp + 0x28]
call fcn.10001ba2
push ecx
mov ecx, esp
push eax
call fcn.100679df
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0xc]
push eax
call fcn.100230af
push eax
lea ecx, [ebp - 8]
call fcn.10067a5e
lea ecx, [ebp - 0x10]
call fcn.10067971
lea eax, [ebp - 1]
lea ecx, [ebp - 8]
push eax
call fcn.10001203
push eax
lea ecx, [ebp - 0x30]
call fcn.10001b5f
lea eax, [ebp - 1]
lea ecx, [ebp - 8]
push eax
call fcn.10001203
push eax
lea ecx, [ebp - 0x20]
call fcn.10001b5f
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0xc]
push eax
call fcn.10022249
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10003622
add esp, 0xc
lea ecx, [ebp - 0x30]
push eax
call fcn.10001b8a
lea ecx, [ebp - 0x40]
call fcn.10001b82
lea ecx, [ebp - 0x50]
call fcn.10001b82
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0xc]
push eax
call fcn.10021f82
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.10003622
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
call fcn.10001b8a
lea ecx, [ebp - 0x50]
call fcn.10001b82
lea ecx, [ebp - 0x40]
call fcn.10001b82
lea ecx, [ebp - 0x30]
call fcn.10001ba2
push eax
call fcn.100045f0
pop ecx
lea eax, [ebp + 0x18]
push 0
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.10003622
add esp, 0xc
mov ecx, eax
call fcn.10001ba2
push eax
lea ecx, [ebp + 0x28]
call fcn.10001ba2
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebp - 0x50]
call fcn.10001b82
push 0x1007db14
lea ecx, [ebp + 8]
call fcn.10001ba2
push eax
call fcn.1004c240
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x100011c5
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0xc]
push eax
call fcn.10021d08
mov ecx, eax
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x20]
call fcn.10001ba2
push eax
push esi
call fcn.10001206
add esp, 0xc
lea ecx, [ebp - 0x50]
call fcn.10001b82
push esi
call fcn.1004c2bf
lea eax, [ebp - 0x20]
push eax
call fcn.1000473f
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
call fcn.10001b82
lea ecx, [ebp - 0x30]
call fcn.10001b82
lea ecx, [ebp - 8]
call fcn.10067971
lea ecx, [ebp + 8]
call fcn.10001b82
lea ecx, [ebp + 0x18]
call fcn.10001b82
lea ecx, [ebp + 0x28]
call fcn.10001b82
pop esi
leave
ret
Function at 0x10004352
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
lea eax, [ebp - 2]
push edi
push eax
lea eax, [ebp - 1]
xor ebx, ebx
push eax
push 0xb
lea ecx, [ebp - 0x14]
mov byte [ebp - 1], bl
call fcn.10004bb8
push ebx
lea ecx, [ebp - 0x14]
call fcn.10004bf2
push 1
lea ecx, [ebp - 0x14]
mov byte [eax], 0x4b
call fcn.10004bf2
push 2
lea ecx, [ebp - 0x14]
mov byte [eax], 0x50
call fcn.10004bf2
push 3
lea ecx, [ebp - 0x14]
mov byte [eax], 0x54
call fcn.10004bf2
push 4
lea ecx, [ebp - 0x14]
mov byte [eax], 0x5b
call fcn.10004bf2
push 5
lea ecx, [ebp - 0x14]
mov byte [eax], 0x5e
call fcn.10004bf2
push 6
lea ecx, [ebp - 0x14]
mov byte [eax], 0x4a
call fcn.10004bf2
push 7
lea ecx, [ebp - 0x14]
mov byte [eax], 0x46
call fcn.10004bf2
push 8
lea ecx, [ebp - 0x14]
mov byte [eax], 0x58
call fcn.10004bf2
push 9
lea ecx, [ebp - 0x14]
mov byte [eax], 0x57
call fcn.10004bf2
push 0xa
lea ecx, [ebp - 0x14]
mov byte [eax], 0x50
call fcn.10004bf2
mov byte [eax], 0x51
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 1], bl
call fcn.10002b4c
push eax
lea ecx, [ebp - 0x24]
call fcn.10004bb8
lea ecx, [ebp - 0x14]
call fcn.10002b4c
lea ecx, [ebp + 0xc]
mov edi, eax
xor esi, esi
call fcn.10002b4c
test eax, eax
jbe 0x1000446f
mov eax, esi
lea ecx, [ebp - 0x14]
cdq
idiv edi
push edx
call fcn.10004bf2
push esi
lea ecx, [ebp + 0xc]
mov ebx, eax
call fcn.10004bf2
mov dl, byte [eax]
push esi
xor dl, byte [ebx]
lea ecx, [ebp - 0x24]
mov byte [ebp - 1], dl
call fcn.10004bf2
mov cl, byte [ebp - 1]
inc esi
mov byte [eax], cl
lea ecx, [ebp + 0xc]
call fcn.10002b4c
cmp esi, eax
jb 0x10004434
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call fcn.10001bef
lea ecx, [ebp - 0x24]
call fcn.10001c34
lea ecx, [ebp - 0x14]
call fcn.10001c34
lea ecx, [ebp + 0xc]
call fcn.10001c34
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000473f
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push ebx
lea eax, [ebp - 0x14]
push esi
push eax
lea ecx, [ebp - 4]
call fcn.1001db7c
push eax
lea eax, [ebp - 0x24]
push dword [ebp + 8]
push eax
call fcn.10003622
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.10001b82
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x24]
push eax
call fcn.10001ba2
push eax
call fcn.10019303
mov esi, eax
pop ecx
cmp esi, 0xffffffff
pop ecx
jne 0x10004793
xor bl, bl
jmp 0x100048ba
lea eax, [ebp - 0x64]
lea ecx, [ebp - 4]
push eax
call fcn.1001e6cb
mov ecx, eax
call fcn.10001ba2
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.1004df30
pop ecx
test eax, eax
pop ecx
je 0x100047f0
lea eax, [ebp - 0x34]
lea ecx, [ebp - 4]
push eax
call fcn.1001dafe
mov ecx, eax
call fcn.10001ba2
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.1004df30
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x34]
setne bl
call fcn.10001b82
test bl, bl
je 0x100047f0
mov bl, 1
jmp 0x100047f2
xor bl, bl
lea ecx, [ebp - 0x64]
call fcn.10001b82
test bl, bl
je 0x1000486e
lea eax, [ebp - 0x178]
lea ecx, [ebp - 4]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.1001dc84
push eax
lea eax, [ebp - 0x44]
push dword [ebp + 8]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10005323
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.10001b82
lea ecx, [ebp - 0x54]
call fcn.10001b82
test byte [ebp - 0x1a4], 0x10
je 0x10004853
lea eax, [ebp - 0x14]
push eax
call fcn.1000473f
pop ecx
jmp 0x10004866
lea ecx, [ebp - 0x14]
call fcn.10001ba2
push eax
call fcn.100192ba
test eax, eax
pop ecx
je 0x10004886
lea ecx, [ebp - 0x14]
call fcn.10001b82
lea eax, [ebp - 0x1a4]
push eax
push esi
call fcn.1001939d
pop ecx
test eax, eax
pop ecx
je 0x1000489a
jmp 0x10004793
lea ecx, [ebp - 0x14]
call fcn.10001b82
lea ecx, [ebp - 0x24]
call fcn.10001b82
xor al, al
jmp 0x100048c4
push esi
call fcn.100193ea
pop ecx
mov ecx, dword [ebp + 8]
call fcn.10001ba2
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x1000478c
mov bl, 1
lea ecx, [ebp - 0x24]
call fcn.10001b82
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x100058e4
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1068
call fcn.1004e0e0
push ebx
push esi
lea eax, [ebp - 1]
push edi
push eax
lea ecx, [ebp - 0x24]
call fcn.10001b1d
lea eax, [ebp - 1]
lea ecx, [ebp - 0x38]
push eax
call fcn.10001b1d
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0xc]
sub esp, 0x10
mov ecx, esp
push eax
call fcn.10001b35
call fcn.1000575d
add esp, 0x18
lea eax, [ebp - 1]
lea ecx, [ebp - 0x48]
push eax
call fcn.10001bd7
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push ebx
push ebx
push 1
push eax
lea ecx, [ebp - 0xc]
call fcn.1001ea35
mov ecx, eax
call fcn.10001ba2
push eax
call fcn.1000e537
mov esi, eax
add esp, 0x14
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x14], esi
call fcn.10001b82
cmp esi, ebx
jne 0x10005979
lea eax, [ebp - 2]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 1]
jmp 0x10005a50
push 4
push 0x10079318
push 2
push esi
call fcn.10018ddc
lea eax, [ebp - 0x28]
push 4
push eax
push 0x1f
push esi
mov dword [ebp - 0x28], 0x3100
call fcn.10018ddc
add esp, 0x20
lea ecx, [ebp - 0x38]
push 1
push ebx
push 3
push ebx
push ebx
push 0x50
call fcn.10001ba2
push eax
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x100059cf
lea eax, [ebp - 2]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 1]
jmp 0x10005a50
push ebx
push 0x80080000
push ebx
lea eax, [ebp - 0x68]
push ebx
push eax
lea ecx, [ebp - 0xc]
call fcn.1001f08a
mov ecx, eax
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x24]
call fcn.10001ba2
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xc]
call fcn.1001ebba
mov ecx, eax
call fcn.10001ba2
push eax
push dword [ebp - 0x10]
call fcn.10019682
add esp, 0x20
lea ecx, [ebp - 0x58]
mov edi, eax
call fcn.10001b82
lea ecx, [ebp - 0x68]
call fcn.10001b82
cmp edi, ebx
jne 0x10005a35
lea eax, [ebp - 2]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 1]
jmp 0x10005a50
push ebx
push ebx
push ebx
push ebx
push edi
call fcn.100196e1
add esp, 0x14
test eax, eax
jne 0x10005a5c
lea eax, [ebp - 2]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 1]
mov ecx, dword [ebp + 8]
push eax
push ebx
call fcn.10004bb8
jmp 0x10005ac2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1068]
push 0x1000
push eax
push edi
call fcn.10018ebf
add esp, 0x10
test al, al
je 0x10005a9d
cmp dword [ebp - 8], ebx
jbe 0x10005a9d
xor esi, esi
cmp dword [ebp - 8], ebx
jbe 0x10005a5c
lea eax, [ebp + esi - 0x1068]
lea ecx, [ebp - 0x48]
push eax
call fcn.10001c60
inc esi
cmp esi, dword [ebp - 8]
jb 0x10005a85
jmp 0x10005a5c
push dword [ebp - 0x10]
call fcn.10018e82
push edi
call fcn.10018e82
push dword [ebp - 0x14]
call fcn.10018e82
mov ecx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
call fcn.10001bef
lea ecx, [ebp - 0x48]
call fcn.10001c34
lea ecx, [ebp - 0x38]
call fcn.10001b82
lea ecx, [ebp - 0x24]
call fcn.10001b82
lea ecx, [ebp + 0xc]
call fcn.10001b82
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005fed
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
and dword [ebp - 4], 0
mov eax, dword [edi + 4]
mov dword [ebp + 0x14], eax
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
cmp word [eax + 6], 0
lea esi, [ecx + eax + 0x18]
jbe 0x100060bc
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x1000605c
mov eax, dword [ebp + 0x10]
mov ebx, dword [eax + 0x38]
test ebx, ebx
jle 0x100060a7
push dword [edi + 0x34]
mov eax, dword [ebp + 0x14]
add eax, dword [esi - 4]
push 4
push 0x1000
push ebx
push eax
call dword [edi + 0x1c]
add esp, 0x14
test eax, eax
je 0x100060c4
mov eax, dword [ebp + 0x14]
push ebx
add eax, dword [esi - 4]
push 0
push eax
mov dword [esi - 8], eax
call fcn.1004d500
add esp, 0xc
jmp 0x100060a7
mov ecx, dword [esi + 4]
add ecx, eax
push ecx
push dword [ebp + 0xc]
call fcn.10005fe1
pop ecx
test eax, eax
pop ecx
je 0x100060c4
push dword [edi + 0x34]
mov ebx, dword [ebp + 0x14]
mov eax, ebx
add eax, dword [esi - 4]
push 4
push 0x1000
push dword [esi]
push eax
call dword [edi + 0x1c]
add esp, 0x14
test eax, eax
je 0x100060c4
mov eax, dword [esi + 4]
push dword [esi]
add eax, dword [ebp + 8]
add ebx, dword [esi - 4]
push eax
push ebx
call fcn.1004cdc0
add esp, 0xc
mov dword [esi - 8], ebx
mov eax, dword [edi]
inc dword [ebp - 4]
add esi, 0x28
movzx eax, word [eax + 6]
cmp dword [ebp - 4], eax
jl 0x10006019
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x100060bf
Function at 0x1001e8e4
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
lea eax, [ebp - 1]
push esi
push eax
lea ecx, [ebp - 0x14]
call fcn.10001b1d
and byte [ebp - 0x17], 0
push 0x1007db14
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x3c], 0x5f
mov byte [ebp - 0x3b], 0x30
mov byte [ebp - 0x3a], 0x31
mov byte [ebp - 0x39], 0x32
mov byte [ebp - 0x38], 0x33
mov byte [ebp - 0x37], 0x34
mov byte [ebp - 0x36], 0x35
mov byte [ebp - 0x35], 0x36
mov byte [ebp - 0x34], 0x37
mov byte [ebp - 0x33], 0x38
mov byte [ebp - 0x32], 0x39
mov byte [ebp - 0x31], 0x41
mov byte [ebp - 0x30], 0x42
mov byte [ebp - 0x2f], 0x43
mov byte [ebp - 0x2e], 0x44
mov byte [ebp - 0x2d], 0x45
mov byte [ebp - 0x2c], 0x46
mov byte [ebp - 0x2b], 0x47
mov byte [ebp - 0x2a], 0x48
mov byte [ebp - 0x29], 0x49
mov byte [ebp - 0x28], 0x4a
mov byte [ebp - 0x27], 0x4b
mov byte [ebp - 0x26], 0x4c
mov byte [ebp - 0x25], 0x4d
mov byte [ebp - 0x24], 0x4e
mov byte [ebp - 0x23], 0x4f
mov byte [ebp - 0x22], 0x50
mov byte [ebp - 0x21], 0x51
mov byte [ebp - 0x20], 0x52
mov byte [ebp - 0x1f], 0x53
mov byte [ebp - 0x1e], 0x54
mov byte [ebp - 0x1d], 0x55
mov byte [ebp - 0x1c], 0x56
mov byte [ebp - 0x1b], 0x57
mov byte [ebp - 0x1a], 0x58
mov byte [ebp - 0x19], 0x59
mov byte [ebp - 0x18], 0x5a
call fcn.10003bd6
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x1001e9d7
call fcn.1001963d
add eax, esi
push eax
call fcn.1004defc
pop ecx
call fcn.1004df09
push 0x24
cdq
pop ecx
idiv ecx
lea ecx, [ebp - 0x14]
mov al, byte [ebp + edx - 0x3c]
push eax
call fcn.10004ae8
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x1001e9a3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.10001b35
lea ecx, [ebp - 0x14]
call fcn.10001b82
mov eax, dword [ebp + 8]
pop esi
leave
ret 8
Function at 0x100431b1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x100431bf
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x100432a0
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x100707ec]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x100707ec]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x100707ec]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x100707ec]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x100707ec]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x100707ec]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x100707ec]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x100707ec]
xor eax, esi
inc edx
dec edi
jne 0x100431dc
pop ebx
cmp dword [ebp + 0x10], 0
je 0x100432c1
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x100707ec]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x100432a6
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x100432c7
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [esp + 0x10]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0x100707ec]
xor eax, esi
mov esi, dword [ecx + 8]
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
mov edi, esi
and edi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr esi, 8
mov eax, dword [eax*4 + 0x100707ec]
xor eax, esi
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x1004501d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [ebp + 8], 0
push ebx
push edi
mov ebx, 0x104
je 0x10045091
push ebx
lea eax, [ebp - 0x208]
push dword [ebp + 8]
push eax
call fcn.10044a6e
lea eax, [ebp - 0x208]
push eax
call fcn.1004d560
add esp, 0x10
test eax, eax
jbe 0x10045071
mov cl, byte [ebp + eax - 0x209]
lea eax, [ebp + eax - 0x209]
cmp cl, 0x2f
je 0x1004506e
cmp cl, 0x5c
jne 0x10045071
and byte [eax], 0
lea eax, [ebp - 0x208]
push eax
call fcn.100417f8
test al, al
pop ecx
jne 0x10045091
lea eax, [ebp - 0x208]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [ebp + 0xc]
mov al, byte [edi]
test al, al
je 0x1004514b
push esi
mov esi, edi
mov ecx, edi
cmp al, 0x2f
je 0x100450ab
cmp al, 0x5c
jne 0x100450ad
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x100450a3
cmp esi, edi
je 0x100450e3
sub esi, edi
lea eax, [ebp - 0x208]
push esi
push edi
push eax
call fcn.1004cdc0
and byte [ebp + esi - 0x208], 0
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.1004501d
add esp, 0x14
and byte [ebp - 0x104], 0
cmp dword [ebp + 8], 0
pop esi
je 0x10045104
push ebx
lea eax, [ebp - 0x104]
push dword [ebp + 8]
push eax
call fcn.10044a6e
add esp, 0xc
and byte [ebp - 1], 0
lea eax, [ebp - 0x104]
push eax
call fcn.1004d560
sub ebx, eax
lea eax, [ebp + eax - 0x104]
push ebx
push edi
push eax
call fcn.10044a6e
and byte [ebp - 1], 0
lea eax, [ebp - 0x104]
push eax
call fcn.100417f8
add esp, 0x14
test al, al
jne 0x1004514b
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop ebx
leave
ret
Function at 0x10045813
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
and byte [ebp - 1], 0
push ebx
mov eax, dword fs:[0x30]
mov bl, byte [eax + 2]
mov byte [ebp - 1], bl
movzx eax, byte [ebp - 1]
pop ebx
leave
ret

Function at 0x1004582f
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
and byte [ebp - 1], 0
push dword fs:[0x30]
pop edx
mov al, byte [edx + 2]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
leave
ret

Function at 0x1004584b
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x100483b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x100483d3
mov eax, 0x200
jmp 0x10048541
mov eax, dword [ebp - 0x44]
push esi
push edi
mov edx, eax
xor esi, esi
xor edi, edi
and edx, 1
je 0x100483e6
push 1
pop edi
test al, 2
je 0x100483ed
or edi, 2
test al, 4
je 0x100483f4
or edi, 4
mov ecx, eax
and ecx, 0x10
je 0x100483fe
or edi, 0x10
test al, 0x20
je 0x10048405
or edi, 0x20
cmp ecx, esi
je 0x10048411
or edi, 0x40000000
jmp 0x10048417
or edi, 0x80000000
or edi, 0x1000000
cmp edx, esi
jne 0x10048427
or edi, 0x800000
push esi
push ebx
call fcn.100195f0
pop ecx
cmp eax, 0x28
pop ecx
mov dword [ebp - 8], eax
jbe 0x100484c9
push esi
push esi
push esi
push ebx
call fcn.10019545
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp + 0xa]
push 2
push eax
push ebx
call fcn.1001959a
push esi
push esi
push 0x24
push ebx
call fcn.10019545
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0xc]
push 4
push eax
push ebx
call fcn.1001959a
add esp, 0x48
cmp word [ebp + 0xa], 0x54ad
jne 0x100484c9
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x34]
cmp dword [ebp - 8], ecx
jbe 0x100484c9
push esi
push esi
push eax
push ebx
call fcn.10019545
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x10]
push 4
push eax
push ebx
call fcn.1001959a
mov eax, dword [ebp - 0x10]
add esp, 0x24
cmp eax, 0x5a4d
je 0x100484c3
cmp eax, 0x454e
je 0x100484c3
cmp eax, 0x454c
je 0x100484c3
cmp eax, 0x4550
jne 0x100484c9
or edi, 0x400000
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x100484d2
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
cmp eax, esi
je 0x100484de
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edi, dword [ebp + 0x14]
cmp edi, esi
je 0x10048511
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.10048337
push dword [ebp - 0x2c]
mov dword [edi], eax
push dword [ebp - 0x30]
call fcn.10048337
push dword [ebp - 0x3c]
mov dword [edi + 4], eax
push dword [ebp - 0x40]
call fcn.10048337
add esp, 0x18
mov dword [edi + 8], eax
mov edi, dword [ebp + 0x18]
cmp edi, esi
je 0x1004853d
lea eax, [ebp + 0xe]
push eax
lea eax, [ebp + 0xa]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.100482da
movzx eax, word [ebp + 0xa]
movzx ecx, word [ebp + 0xe]
shl eax, 0x10
add esp, 0x10
or eax, ecx
mov dword [edi], eax
pop edi
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x10049d4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 1
xor edi, edi
pop esi
cmp ebx, esi
jl 0x10049d68
cmp ebx, 8
jle 0x10049d6a
xor esi, esi
lea eax, [ebp - 0x10]
push eax
call fcn.1003ed2d
pop ecx
mov ecx, eax
call fcn.10001ba2
push eax
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.10048544
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.10001b82
cmp dword [esi + 0x6af70], edi
lea ecx, [esi + 0x6af70]
lea eax, [esi + 0x6af78]
mov dword [eax], edi
jne 0x10049db3
mov dword [eax], 1
mov dword [ecx], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
push edi
push eax
mov dword [esi + 0x6af6c], edi
call fcn.1004d500
mov eax, ebx
add esp, 0xc
shl eax, 3
cmp ebx, 2
movzx ecx, word [eax + 0x10070e3a]
mov dword [esi + 0x6af98], ecx
movzx ecx, word [eax + 0x10070e38]
mov dword [esi + 0x6af9c], ecx
movzx ecx, word [eax + 0x10070e3c]
mov dword [esi + 0x6afa0], ecx
movzx eax, word [eax + 0x10070e3e]
mov dword [esi + 0x6af94], eax
jg 0x10049e14
mov eax, dword [ebp + 0x10]
or byte [eax], 4
jmp 0x10049e1f
cmp ebx, 8
jl 0x10049e1f
mov eax, dword [ebp + 0x10]
or byte [eax], 2
lea ebx, [esi + 0x1af70]
push 0x10000
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
cmp eax, edi
mov dword [esi + 0x6af90], eax
je 0x10049e8f
cmp eax, 0xffffffff
je 0x10049e8f
cmp eax, 0x106
mov dword [esi + 0x6af8c], edi
jae 0x10049e61
push esi
call fcn.1004a0be
pop ecx
mov dword [esi + 0x6af7c], edi
movzx eax, byte [ebx + edi]
mov ecx, dword [esi + 0x6af7c]
and eax, 0x7fff
and ecx, 0x3ff
shl ecx, 5
xor eax, ecx
inc edi
cmp edi, 2
mov dword [esi + 0x6af7c], eax
jb 0x10049e67
jmp 0x10049e9f
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1004af99
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1004afa7
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x1004b088
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x10070e88]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x10070e88]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x10070e88]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x10070e88]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x10070e88]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x10070e88]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x10070e88]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x10070e88]
xor eax, esi
inc edx
dec edi
jne 0x1004afc4
pop ebx
cmp dword [ebp + 0x10], 0
je 0x1004b0a9
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x10070e88]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x1004b08e
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x1004b0af
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [esp + 0x10]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0x10070e88]
xor eax, esi
mov esi, dword [ecx + 8]
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
mov edi, esi
and edi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr esi, 8
mov eax, dword [eax*4 + 0x10070e88]
xor eax, esi
pop esi
mov dword [ecx + 8], eax
ret