joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x3e6867ae
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x3c361987
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x415f6c
Capabilities:
Encode data using xor

Disassembly:
push eax
mov dh, 0x86
ror byte [esi - 0x21e6c25c], cl
pop ds
mov dl, 0xea
or dword fs:[ecx], eax
mov byte [eax], 0xc2
jge 0x415f2f
push edx
dec edi
wait
xlatb
add byte [edi - 4], ch
sbb byte [ebx + edx*4 - 0xe32a1e6], dl
int 0x92
int1
popfd
out dx, al
bound esp, qword [edi + 0x7350194e]
add al, 0x75
xchg esp, eax
aad 0x55
ror byte [esi - 0x9465e75], 1
mov ecx, 0xa7c7df09
ffreep st(7)
cmpsd dword [esi], dword es:[edi]
ffreep st(7)
cmpsd dword [esi], dword es:[edi]
pop esp
adc bh, bh
loopne 0x415f28
sahf
int1
test byte [eax + ecx*2], bl
outsd dx, dword [esi]
or cl, byte [edi + 4]
lodsd eax, dword [esi]
js 0x415eb3
scasd eax, dword es:[edi]
outsd dx, dword [esi]
dec eax
shl dl, cl
cdq
leave
cmp eax, 0x926ba2f7
xchg edx, eax
jo 0x415f58
fisttp qword [ebx + 0x4e]
push ebx
dec sp
sbb eax, 0xdaf15283
fmul dword [esi - 0x5cead392]
std
adc byte [ecx - 0x1d], bh
jecxz fcn.00415f8d
adc edx, dword [ebp + 0x70]
cmpsb byte [esi], byte es:[edi]
mov al, byte [0xde607178]
mov esp, 0x8a9f3125
ja 0x415f19
mov eax, dword [0xf9057c7e]

Function at 0x415f8c
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
test eax, 0x5cf0ef1e
jbe 0xfaacf007
nop
invalid
cli
imul edi, edx, 0xffffffbb
jg 0x415fee
mov ebx, 0x59945c7f
xchg esp, eax
pop ecx
aas
out dx, al
cmp eax, 0xf9dd4a8
cmpsd dword [esi], dword es:[edi]
scasb al, byte es:[edi]
cmpsd dword [esi], dword es:[edi]
dec ebx
adc esp, edx
xor dword [eax], 0xffffffae
ror dword [ecx], 1
jb 0x415f83
outsd dx, dword [esi]
wait
inc ebx
xchg ebp, eax
push ebx
xchg ecx, eax
movsd dword es:[edi], dword [esi]
cmp bh, byte [edi + 0x4a0fda3e]
pop ebp
bound ebp, qword [ebp - 0x16]
push ecx
call 0xb06cdf3b
ret 0xd68f
jmp 0x5877dcb5

Function at 0x4287b4
Capabilities:
Encode data using xor

Disassembly:
imul esp, dword [eax], 0x787e7b36
mov ch, ah
and ebp, ecx
and al, 0x74
cmp al, 7
push ebp
mov al, byte [0xd3cf90e0]
sti
adc al, 0x4e
adc eax, 0x7e16add4
inc esi
push 0xffffffffffffff8b
sub al, 0xff
inc esp
inc edx
js 0x42882c
dec eax
fmul st(0), st(0)
cmp byte [eax - 0x80], 0x8b
aaa
dec edx
cmc
invalid
invalid
insb byte es:[edi], dx
invalid
Function at 0x40154c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 8], 0xb0
jae 0x4015ea
mov eax, dword [ebp + 8]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
add ecx, 1
mov dword [ebp - 0x118], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x118]
push eax
call fcn.0040154c
add esp, 8
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 3
div ecx
test edx, edx
jne 0x4015a6
mov byte [ebp - 0x114], 0
jmp 0x4015e8
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 4
div ecx
test edx, edx
jne 0x4015ca
lea edx, [ebp - 0x104]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x4015e8
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 0xd
div ecx
test edx, edx
jne 0x4015e8
mov byte [ebp - 0x112], 0x4d
mov byte [ebp - 0x111], 0
jmp 0x4015f3
mov edx, dword [ebp + 0xc]
mov dword [edx], 1
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x401a4b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 0x64
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x450a84]
mov dword [ecx + 0x118], edx
mov eax, dword [ebp - 4]
mov ecx, dword [0x450a90]
mov dword [eax + 8], ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, dword [ebp - 4]
mov dword [edx + 0x134], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x134], 0
je 0x401ab1
mov ecx, dword [ebp - 8]
add ecx, 0x7c
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x240], 0x450a98
jmp 0x401b52
mov eax, dword [str.dslini.xm]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x455124]
mov dword [ebp - 0x18], ecx
mov dx, word [0x455128]
mov word [ebp - 0x14], dx
push 0
push 0
push 4
push 0
push 0
push 1
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401b52
push 4
push 0x1000
push 0x1f4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401b41
push 0
lea ecx, [ebp - 8]
push ecx
push 4
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 4
jne 0x401b41
push 0
lea ecx, [ebp - 8]
push ecx
push 4
mov edx, dword [ebp - 4]
add edx, 0x980
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x8000
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x134]
mov dword [edx + 0x11c], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x450a88]
mov dword [edx + 0x114], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x450a8c]
mov dword [ecx + 0x120], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x224], 0x42c030
mov ecx, dword [ebp - 4]
push ecx
call fcn.004255d3
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x401ee3
Capabilities:
Copy file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 1
push 0xd
call fcn.004019df
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x401f46
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x10], eax
push 0xe6
push 0xb4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 4], 0
je 0x401f59
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 0x18], eax
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0
je 0x401f79
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov eax, dword [ebp - 8]
jmp 0x4020c3
mov dword [ebp - 0x86c], 0
mov edx, dword [str.applset.txt]
mov dword [ebp - 0x864], edx
mov eax, dword [0x455130]
mov dword [ebp - 0x860], eax
mov ecx, dword [0x455134]
mov dword [ebp - 0x85c], ecx
mov edx, dword [str.vlgbl]
mov dword [ebp - 0x858], edx
mov ax, word [0x45513c]
mov word [ebp - 0x854], ax
push 0
push 0x80
push 4
push 0
push 1
push 4
lea ecx, [ebp - 0x858]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20], eax
push 0
lea edx, [ebp - 0x858]
push edx
lea eax, [ebp - 0x864]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [ebp - 0x20], 0xffffffff
jne 0x402001
xor eax, eax
jmp 0x4020c3
cmp dword [ebp - 0x86c], 0xffffffff
jne 0x40203d
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.setini.xml
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x86c], eax
cmp dword [ebp - 0x86c], 0xffffffff
jne 0x40203d
xor eax, eax
jmp 0x4020c3
push 0
lea ecx, [ebp - 0x874]
push ecx
push 0x830
lea edx, [ebp - 0x850]
push edx
mov eax, dword [ebp - 0x86c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40209a
push 2
push 0
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x870], eax
push 0
lea edx, [ebp - 0x868]
push edx
mov eax, dword [ebp - 0x874]
push eax
lea ecx, [ebp - 0x850]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x874], 0x830
je 0x402001
mov eax, dword [ebp - 0x86c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x425a12
Capabilities:
Copy file
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x455b50], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x455aec
push 0x455a88
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x425a5a
xor eax, eax
jmp 0x425a83
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x42932d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x455260
cmp edx, dword [eax]
je 0x42934f
add eax, 8
inc ecx
cmp eax, 0x4552f0
jl 0x429340
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x455260]
jne 0x42947d
mov eax, dword [0x455b5c]
cmp eax, 1
je 0x429457
test eax, eax
jne 0x429380
cmp dword [0x4551b4], 1
je 0x429457
cmp edx, 0xfc
je 0x42947d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4293b7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0042a0f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00428630
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4293fa
lea eax, [ebp - 0x1a4]
push eax
call fcn.00428630
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42b4a0
push edi
call fcn.0042a2e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0042a0f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0042a100
lea eax, [ebp - 0xa0]
push 0x42b480
push eax
call fcn.0042a100
push dword [esi + 0x455264]
lea eax, [ebp - 0xa0]
push eax
call fcn.0042a100
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0042a254
add esp, 0x2c
pop edi
jmp 0x42947d
lea eax, [ebp + 8]
lea esi, [esi + 0x455264]
push 0
push eax
push dword [esi]
call fcn.00428630
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x408f08
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408ebc
test al, al
jne 0x408f29
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408f75
xor eax, eax
push ebp
push 0x408f65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004033cc
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f6c
lea eax, [ebp - 0xc]
call fcn.00408ef8
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40927c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40936b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406c90
mov edx, dword [ebp - 8]
mov ecx, 0x409384
xor eax, eax
call fcn.00409170
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x409339
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x40929c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408d44
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c20
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407220
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00408d14
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x4045ec
call fcn.0040581c
call fcn.00402e88
jmp 0x40929c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004031e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409372
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403170
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403170
ret

Function at 0x409394
Capabilities:
Shutdown system

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov esi, edx
mov ebx, eax
cmp dword [0x40b07c], 2
jne 0x409401
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4093bc
xor eax, eax
jmp 0x40940e
lea eax, [esp + 8]
push eax
push 0x409414
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x409401
xor eax, eax
jmp 0x40940e
push esi
push ebx
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x409428
Capabilities:
Check if file exists

Disassembly:
xor edx, edx
mov eax, 2
call fcn.00409394
ret
Function at 0x409904
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4099d7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4099f0
push ebx
push 0x4099fc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040336c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409984
mov al, 0x62
call fcn.004095a8
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004098d8
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40998d
call fcn.004098d8
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4099de
lea eax, [ebp - 4]
call fcn.00403150
ret

Function at 0x409a70
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b24
jmp 0x409b19
cmp dword [esi + 0x10], 0x1000
jne 0x409b05
test byte [esi + 0x15], 1
jne 0x409b05
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409ac4
cmp eax, 2
je 0x409ac4
cmp eax, 0x10
je 0x409ac4
cmp eax, 0x20
jne 0x409ad9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409ad9
mov bl, 1
xor ebp, ebp
jmp 0x409aea
mov eax, dword [esi]
add eax, ebp
call fcn.00409a68
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409add
test bl, bl
je 0x409b05
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b24
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a9c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401190
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [0x416044]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4011d5
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0040603f
add esp, 0x10
ret
push 0
push 0
push 0
push esi
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0x44
mov byte [esp + 0x19], 0x41
mov byte [esp + 0x1a], 0x56
mov byte [esp + 0x1b], 0x53
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 8]
push eax
push 4
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0040603f
add esp, 0x10
ret
Function at 0x404a00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x404a07
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x404ae4
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x413f60]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x413f60]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x413f60]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x413f60]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x413f60]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x413f60]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x413f60]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x413f60]
inc ecx
sub edx, 8
sub esi, 1
jne 0x404a20
pop edi
test edx, edx
je 0x404b0b
jmp 0x404af0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x413f60]
inc ecx
sub edx, 1
jne 0x404af0
not eax
pop esi
ret

Function at 0x404b10
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x413f60]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x413f60]
mov dword [edx + 8], ecx
ret
Function at 0x404cb0
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, dword [esp + 0x60]
push esi
mov esi, eax
push edi
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x404cda
mov eax, 0x200
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov eax, dword [esp + 0x28]
mov edx, eax
xor edi, edi
and edx, 1
je 0x404cf3
mov dword [esp + 0x14], 1
mov edi, dword [esp + 0x14]
test al, 2
je 0x404cfa
or edi, 2
test al, 4
je 0x404d01
or edi, 4
mov ecx, eax
and ecx, 0x10
je 0x404d0b
or edi, 0x10
test al, 0x20
je 0x404d12
or edi, 0x20
test ecx, ecx
je 0x404d1e
or edi, 0x40000000
jmp 0x404d24
or edi, 0x80000000
or edi, 0x1000000
mov dword [esp + 0x14], edi
test edx, edx
jne 0x404d3c
or edi, 0x800000
mov dword [esp + 0x14], edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x1c], eax
cmp eax, 0x28
jbe 0x404df0
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebx
mov edx, 0x54ad
cmp word [esp + 0x10], dx
jne 0x404dec
mov eax, dword [esp + 0x20]
lea ecx, [eax + 0x34]
cmp dword [esp + 0x1c], ecx
jbe 0x404dec
push 0
push 0
push eax
push esi
call edi
push 0
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x30]
push eax
push esi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x404de4
cmp eax, 0x454e
je 0x404de4
cmp eax, 0x454c
je 0x404de4
cmp eax, 0x4550
jne 0x404dec
or dword [esp + 0x14], 0x400000
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
test eax, eax
je 0x404dfa
mov dword [eax], edi
mov eax, dword [esp + 0x64]
test eax, eax
je 0x404e08
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
test ebp, ebp
je 0x404e86
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
push 0
sub edx, 0xd53e8000
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.004100a0
mov dword [ebp + 4], edx
push 0
mov ecx, edi
sub ecx, 0xd53e8000
mov edx, esi
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [ebp], eax
call fcn.004100a0
mov ecx, dword [esp + 0x30]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x2c]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
mov dword [ebp + 0xc], edx
call fcn.004100a0
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], edx
mov ebx, dword [esp + 0x6c]
test ebx, ebx
je 0x404eb3
push esi
push edi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.00404c40
movzx ecx, word [esp + 0x20]
movzx edx, word [esp + 0x24]
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [ebx], ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret