joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bd4b
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x425024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x248], edx
mov esi, ecx
test esi, esi
jne 0x409e51
xor eax, eax
jmp 0x409fda
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.0040c190
cmp byte [ebp - 0x210], 0
mov dword [ebp - 0x22c], 0xf
mov dword [ebp - 0x230], 0
mov byte [ebp - 0x240], 0
jne 0x409e9c
xor ecx, ecx
jmp 0x409eae
lea ecx, [ebp - 0x210]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409ea5
sub ecx, edx
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x240]
call fcn.00402f80
push 0xffffffffffffffff
mov dword [ebp - 4], 0
lea eax, [ebp - 0x240]
push 0
push eax
lea ecx, [ebp - 0x228]
mov word [ebp - 0x244], 0x2427
mov byte [ebp - 0x242], 0x7e
mov dword [ebp - 0x214], 0xf
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x228], 0
call fcn.00403080
xor ebx, ebx
cmp dword [ebp - 0x230], ebx
jle 0x409f61
cmp dword [ebp - 0x22c], 0x10
lea edi, [ebp - 0x240]
lea esi, [ebp - 0x228]
mov eax, 0xaaaaaaab
cmovae edi, dword [ebp - 0x240]
mov ecx, ebx
cmp dword [ebp - 0x214], 0x10
cmovae esi, dword [ebp - 0x228]
mul ebx
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
mov al, byte [ebp + ecx - 0x244]
xor al, byte [edi + ebx]
mov byte [esi + ebx], al
inc ebx
cmp ebx, dword [ebp - 0x230]
jl 0x409f13
cmp dword [ebp - 0x214], 0x10
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push eax
push 0x200
push dword [ebp - 0x248]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov eax, dword [ebp - 0x214]
add esp, 0xc
cmp eax, 0x10
jb 0x409fa2
inc eax
push eax
push dword [ebp - 0x228]
call fcn.004032b0
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x214], 0xf
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x228], 0
cmp eax, 0x10
jb 0x409fd5
inc eax
push eax
push dword [ebp - 0x240]
call fcn.004032b0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041a772
mov esp, ebp
pop ebp
ret
Function at 0x40a0c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1218
call fcn.0041b840
mov eax, dword [0x425024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x1214]
mov dword [ebp - 0x1214], 0
push eax
push 0
push 0
push 0x41d5f0
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x40a25d
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push dword [ebp - 0x1214]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x610]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x610]
push eax
push 0x420034
push ecx
call fcn.00409af0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x610]
add esp, 0xc
push eax
lea eax, [ebp - 0x210]
push eax
call esi
push 0x400
lea eax, [ebp - 0xa10]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa10]
push eax
push str._t_4_5_
push ecx
call fcn.00409af0
add esp, 0xc
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
push 0x400
lea eax, [ebp - 0xe10]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xe10]
push eax
push 0x420044
push ecx
call fcn.00409af0
add esp, 0xc
lea eax, [ebp - 0xe10]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
push 0x400
lea eax, [ebp - 0x1210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1210]
push eax
push str._t_e4.3
push ecx
call fcn.00409af0
add esp, 0xc
lea eax, [ebp - 0x1210]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
push 0x104
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push dword [ebp - 0x1214]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a772
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a772
mov esp, ebp
pop ebp
ret
Function at 0x40cb80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bdf6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x425024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x420]
call fcn.0040a0c0
test eax, eax
je 0x40cc12
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push 0x41d7ac
lea ecx, [ebp - 0x424]
call fcn.00402e20
lea ecx, [ebp - 0x42c]
mov dword [ebp - 4], 0
call fcn.0040a270
mov byte [ebp - 4], 1
or edi, 0xffffffff
mov edx, dword [eax]
mov esi, dword [ebp - 0x424]
add esi, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, esi
je 0x40cc9a
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x40cc8b
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x40cc8b
call fcn.004031a0
mov dword [ebp - 0x428], eax
mov ecx, edi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x40cc80
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x428]
add eax, 0x10
mov dword [ebp - 0x424], eax
jmp 0x40cc9a
push dword [edx - 0xc]
lea ecx, [ebp - 0x424]
push edx
call fcn.00403200
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x42c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ccbb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x424]
cmp dword [eax - 0xc], 0
je 0x40cd07
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x40cd01
mov edx, eax
lea ecx, [ebp - 0x218]
call fcn.0040c300
mov eax, dword [ebp - 0x424]
mov esi, 1
jmp 0x40cd09
mov eax, dword [ebp - 0x424]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x40cd25
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041a772
mov esp, ebp
pop ebp
ret
Function at 0x40e430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c1f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x425024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40e5a2
cmp byte [edi + 0x3d], 0
je 0x40e5a2
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x40e489
xor al, al
jmp 0x40e5a4
sub esp, 8
lea ecx, [ebp - 0x28]
call fcn.0040d390
mov dword [ebp - 4], 0
nop dword [eax + eax]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x38]
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x40e4e6
sub eax, 1
je 0x40e4ea
sub eax, 2
je 0x40e585
mov byte [ebp - 0x29], 0
jmp 0x40e589
mov byte [edi + 0x3d], 0
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp ebx, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub esi, eax
je 0x40e51d
push dword [edi + 0x4c]
cmp ebx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x40e4dd
cmp byte [edi + 0x3d], 0
je 0x40e585
test esi, esi
jne 0x40e4a0
mov ecx, dword [ebp - 0x18]
or eax, 0xffffffff
sub eax, ecx
cmp eax, 8
jbe 0x40e57a
lea esi, [ecx + 8]
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00403300
test al, al
je 0x40e4a0
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
xorps xmm0, xmm0
cmovae ecx, dword [ebp - 0x28]
movq qword [ecx + eax], xmm0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x18], esi
cmovae eax, dword [ebp - 0x28]
mov byte [eax + esi], 0
jmp 0x40e4a0
push str.string_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov byte [ebp - 0x29], 1
mov ebx, dword [ebp - 0x14]
cmp ebx, 0x10
jb 0x40e59d
lea ecx, [ebx + 1]
push ecx
push dword [ebp - 0x28]
call fcn.004032b0
mov al, byte [ebp - 0x29]
jmp 0x40e5a4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041a772
mov esp, ebp
pop ebp
ret
Function at 0x40f210
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c2fb
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x425024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov esi, dword [ebp + 8]
push ebx
push 0x41d79c
push 1
push 0
push 0x41d78c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [edi], eax
test eax, eax
js 0x40f338
push 0x400
lea eax, [ebp - 0x414]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x42018c
push ecx
call fcn.00409af0
add esp, 0xc
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x418]
push eax
call fcn.004039d0
mov dword [ebp - 4], 0
mov edx, dword [eax]
test edx, edx
je 0x40f2b2
mov edx, dword [edx]
jmp 0x40f2b4
xor edx, edx
mov eax, dword [ebx]
push esi
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push edx
push eax
call dword [ecx + 0xc]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x418]
mov dword [edi], eax
test esi, esi
je 0x40f32b
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x40f321
test esi, esi
je 0x40f321
mov eax, dword [esi]
test eax, eax
je 0x40f2ff
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40f316
push eax
call fcn.0041a7e7
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0041a783
add esp, 8
mov dword [ebp - 0x418], 0
cmp dword [edi], 0
jge 0x40f342
mov eax, dword [ebx]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x40f347
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041a772
mov esp, ebp
pop ebp
ret
Function at 0x414170
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x41417b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x414237
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x41dce0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x41dce0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x41dce0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x41dce0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x41dce0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x41dce0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x41dce0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x41dce0]
sub edi, 1
jne 0x414190
pop edi
test esi, esi
je 0x41425a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x41dce0]
sub esi, 1
jne 0x414240
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x4149e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x414a23
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414a15
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x414a34
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414a60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x414a9b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414a96
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x414ac8
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x414aac
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call sub.VCRUNTIME140.dll_memcpy
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x414adc
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x414ad3
cmp byte [esi + 8], 0
je 0x414ad3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414c00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x414c35
cmp byte [edi + 1], 0
je 0x414c2d
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x414c3b
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], eax
cmp byte [edi], 0
push ebx
je 0x414c5e
cmp byte [edi + 1], 0
je 0x414c57
push 1
push 0
push 0
push dword [edi + 4]
call ecx
sub eax, dword [edi + 0xc]
jmp 0x414c61
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x414c70
mov eax, dword [edi + 0x1c]
mov ebx, 0xffff
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
cmp eax, ebx
jae 0x414c75
mov ebx, eax
mov dword [ebp - 0x10], eax
push esi
push 0x404
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x414c94
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 4], 0xffffffff
cmp ebx, eax
jbe 0x414d95
nop dword [eax + eax]
mov edx, dword [ebp - 8]
add eax, 0x400
cmp eax, ebx
mov ecx, eax
mov eax, 0x404
cmova ecx, ebx
sub edx, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x404
mov dword [ebp - 0x18], edx
mov ebx, ecx
cmova ebx, eax
cmp byte [edi], 0
je 0x414cfb
cmp byte [edi + 1], 0
je 0x414d95
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x414cfe
mov dword [edi + 0x1c], edx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0xc], ebx
je 0x414d26
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414d21
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x414d4f
mov edx, dword [edi + 0x1c]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
jbe 0x414d39
mov ecx, dword [edi + 0x18]
sub ecx, edx
mov dword [ebp - 0xc], ecx
push ecx
mov ecx, dword [edi + 0x14]
add ecx, edx
push ecx
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0xc]
add esp, 0xc
add dword [edi + 0x1c], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x414d95
lea eax, [ebx - 3]
test eax, eax
js 0x414d80
nop
dec eax
cmp byte [eax + esi], 0x50
jne 0x414d7c
cmp byte [eax + esi + 1], 0x4b
jne 0x414d7c
cmp byte [eax + esi + 2], 5
jne 0x414d7c
cmp byte [eax + esi + 3], 6
je 0x414da9
test eax, eax
jns 0x414d60
mov eax, dword [ebp - 4]
test eax, eax
jne 0x414d95
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x10]
cmp eax, ebx
jb 0x414cb0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 4]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x414d83
Function at 0x415680
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
jne 0x41569b
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x18], 0
je 0x415690
cmp dword [edi + 0x7c], 0
je 0x4156ac
call fcn.00415af0
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.004153f0
add esp, 8
test eax, eax
je 0x4156d0
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x415716
push 0x4000
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x415722
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], 0
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x41577d
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.004144e0
test eax, eax
jne 0x41577d
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x4157a0
mov al, byte [edi + 0x39]
jmp 0x4157a3
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x415820
mov al, byte [ebx]
test al, al
je 0x415820
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, dword [esi + 0x70]
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x41dce0]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x41dce0]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x4157d2
mov eax, dword [ebp - 0xc]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415b70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x415c0a
cmp dword [edi + 4], 0xffffffff
jne 0x415c0a
lea esi, [edi + 0x244]
push esi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x415ba0
sub esi, ecx
sar esi, 1
movzx eax, word [edi + esi*2 + 0x242]
cmp eax, 0x5c
je 0x415bcc
cmp eax, 0x2f
je 0x415bcc
mov dword [edi + esi*2 + 0x244], 0x2f
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00414940
add esp, 8
test eax, eax
jne 0x415beb
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
call fcn.00414dc0
xor ecx, ecx
mov dword [edi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416300
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x425024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x4163a1
push 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea ecx, [ebp - 0x20c]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416340
sub ecx, edx
sar ecx, 1
je 0x416380
movzx eax, word [ebp + ecx*2 - 0x20e]
cmp eax, 0x2f
je 0x416363
cmp eax, 0x5c
jne 0x416380
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x4164a2
xor eax, eax
mov word [ebp + ecx - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4163a1
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [edi]
test ax, ax
je 0x416492
push esi
mov esi, edi
mov ecx, edi
cmp ax, 0x2f
je 0x4163be
cmp ax, 0x5c
jne 0x4163c0
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x4163b2
cmp esi, edi
je 0x416409
sub esi, edi
lea eax, [ebp - 0x20c]
and esi, 0xfffffffe
push esi
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp esi, 0x208
jae 0x4164a2
xor eax, eax
lea edx, [ebp - 0x20c]
mov ecx, ebx
mov word [ebp + esi - 0x20c], ax
call fcn.00416300
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov word [ebp - 0x418], ax
test ebx, ebx
je 0x41642e
push 0x104
lea eax, [ebp - 0x418]
push ebx
push eax
call esi
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x418]
mov word [ebp - 0x212], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416440
sub ecx, edx
mov eax, 0x104
sar ecx, 1
sub eax, ecx
push eax
lea eax, [ebp - 0x418]
lea eax, [eax + ecx*2]
push edi
push eax
call esi
xor eax, eax
add esp, 0xc
mov word [ebp - 0x212], ax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop esi
cmp eax, 0xffffffff
jne 0x416492
push 0
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0041a772
mov esp, ebp
pop ebp
ret
call fcn.0041aea3
int3