joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425a06
Capabilities:
Encode data using xor

Disassembly:
in al, 0x56
call fcn.00425dd4
pop ecx
ror byte [eax], 1
lea esp, [ebp - 0x3c]
push ebx
adc eax, 0xfc4d8b5d
xor ecx, ebp
call fcn.0042a71e
add eax, 0x37b70fc3
add dh, dh
je 0x425a0e
mov ebx, dword [ebp - 0x28]
cmp dword [ebx], 0
je 0x425a0e
and dword [ebp - 0x1c], 0
xor ecx, ecx
mov ebx, edi
movzx edx, si
add ebx, 2
inc ecx
movzx eax, word [ebx]
cmp eax, edx
je 0x425a3e
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x28]
cmp edx, 0x64
jg 0x895a7e72
je 0x88fe446
push 0x27
pop eax
cmp edx, eax
je 0x425afc
cmp edx, 0x41
je 0x425a81
cmp edx, 0x48
je 0x425ac3
cmp edx, 0x4d
je 0x425a97
invalid
push 0x48dc08
push edi
call fcn.00420fb9
pop ecx
pop ecx
add al, 0x5f
jne 0x425adc
add edi, 0xa
jmp 0x425af5
dec ecx
je 0x425ab5
dec ecx
je 0x425abc
dec ecx
je 0x425aae
dec ecx
jne 0x8150e63f
push 0x42
jmp 0x8150e65a
push 0x62
jmp 0x4dcd5c5a
sbb byte [ebx], bh
in al, 0x24
sbb byte [ecx - 0x169295bc], cl
xchg edi, eax
add dword [eax], eax
add byte [ecx + 0x74], cl
or byte [ecx + 0x74], cl
or al, 0xe9
jno 0x425acd
push 0x6d
jmp 0x425c5a
dec ecx
je 0x425ace
dec ecx
je 0x425ad5
jmp 0x4dcd5c3f
mov ecx, dword [ebp + 0x18]
cmp esp, esp
and al, 0x18
mov dword [edx + ebp*2 + 0x48], eax
dec ebp
sbb byte [ebx], bh
in al, 0x24
sbb byte [ecx - 0x16b795bc], cl
jle 0x425adb
push 0x48
jmp 0x8c425c5a
add byte [eax + ebp*2 + 0x48dc14], cl
mov word [eax + 0x14], gs
fmul qword [eax]
push 0x48dc14
push edi
call fcn.00420fb9
pop ecx
pop ecx
add al, 0x5f
jne 0x425af2
add edi, 6
jmp 0x425af5
invalid
push 0x70
jmp 0x16c15a5d
lea edi, [edi + ecx*2]
test cl, 1
je 0x895a7f7b
movzx ecx, word [edi]
sar byte [ecx], 0xf
test dl, bh
jmp 0x55cd8cc9
invalid

Function at 0x442945
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp - 0x18], esi
movzx eax, word [edi + edx*2]
cmp ax, cx
je 0x442956
cmp ax, si
jne 0x442959
inc edx
jmp 0x442948
movzx eax, word [edi + edx*2]
push 0x22
pop ecx
mov dword [ebp - 4], ecx
cmp ax, cx
je 0x442973
push 0x27
pop ecx
mov dword [ebp - 4], ecx
cmp ax, cx
jne 0x442979
mov byte [ebp + 0xb], 1
jmp 0x44298b
cmp eax, 0x3c
jne 0x7f43aea4
push 0x3e
pop ecx
mov dword [ebp - 4], ecx
mov byte [ebp + 0xb], bl
inc edx
movzx esi, cx
movzx eax, word [edi + edx*2]
mov dword [ebp - 0x10], eax
movzx eax, ax
mov dword [ebp - 0x14], esi
cmp eax, esi
lea esi, [ebp + 0xc]
mov dword [ebp - 8], ebx
je 0x4429cb
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
test bx, bx
je 0x4429c3
mov word [esi + ecx*2], bx
inc ecx
inc edx
movzx ebx, word [edi + edx*2]
movzx eax, bx
cmp eax, dword [ebp - 0x14]
jne 0x4429ac
mov dword [ebp - 8], ecx
test dword [ebp - 4], ecx
xor ebx, ebx
cmp word [edi + edx*2], cx
jne 0xfc08afa4
push 0x20
pop ecx
inc edx
movzx eax, word [edi + edx*2]
cmp ax, cx
je 0x4429d8
cmp ax, word [ebp - 0x18]
je 0x4429d8
movzx eax, word [edi + edx*2]
test ax, ax
je 0x4429fa
cmp eax, 0x3b
jne 0x753b65a4
mov edx, dword [ebx - 8]
xor ecx, ecx
push esi
mov word [esi + eax*2], cx
call fcn.0041c277
push esi
call fcn.0040cb79
lea ecx, [ebp - 0x28]
call fcn.0040d816
leave
xor ecx, dword [ebx]
add byte [ebx], dh
push ebx
hlt
Function at 0x10001750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10006040]
xor eax, ebp
mov dword [ebp - 4], eax
push 4
call fcn.100024de
add esp, 4
mov dword [0x10006480], eax
mov dword [eax], 0
call fcn.10001020
cmp byte [eax + 2], 1
je 0x1000185a
test byte [eax + 0x68], 0x70
jne 0x1000185a
lea ecx, [ebp - 0xc]
call fcn.10001390
test eax, eax
js 0x1000185a
push 0
push 0
push 0x11
push 0xfffffffffffffffe
call dword [0x1000650c]
push 0
push 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x1e
push 0xffffffffffffffff
call dword [0x100064f8]
test eax, eax
js 0x100017f6
push 0
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 1
push dword [ebp - 0x10]
call dword [0x10006528]
test eax, eax
js 0x1000185a
push dword [ebp - 0x10]
push 0xffffffffffffffff
call dword [0x10006524]
test eax, eax
js 0x1000185a
push 0
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 7
push 0xffffffffffffffff
call dword [0x100064f8]
test eax, eax
js 0x10001819
cmp dword [ebp - 8], 0
jne 0x1000185a
call fcn.10001f80
test eax, eax
js 0x1000185a
mov ecx, dword [0x10006484]
test ecx, ecx
je 0x10001855
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10001855
mov eax, dword [ecx + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x10001855
push 0
push 0xc
lea eax, [ebp - 0x1c]
push eax
push 6
push ecx
push 0xffffffffffffffff
call dword [0x100064fc]
call fcn.10001bf0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100022d3
mov esp, ebp
pop ebp
ret
Function at 0x10001bf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
mov eax, dword [0x10006040]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push esi
push edi
call fcn.10001020
mov ecx, str.ntdll.dll
mov edi, eax
call fcn.10001890
mov esi, eax
mov edx, str.NtMapViewOfSection
mov ecx, esi
call fcn.10001970
mov edx, str.NtUnmapViewOfSection
mov dword [esp + 0x14], eax
mov ecx, esi
call fcn.10001970
mov edx, str.NtQueryVirtualMemory
mov ecx, esi
call fcn.10001970
mov edx, str.NtOpenFile
mov ecx, esi
mov ebx, eax
call fcn.10001970
mov edx, str.NtCreateSection
mov dword [esp + 0x10], eax
mov ecx, esi
call fcn.10001970
push 0
push 0x208
mov esi, eax
lea eax, [esp + 0x70]
push eax
push 2
push dword [edi + 8]
push 0xffffffffffffffff
call ebx
test eax, eax
js 0x10001df4
push 0
push 0xc
lea eax, [esp + 0x5c]
push eax
push 6
push dword [edi + 8]
push 0xffffffffffffffff
call ebx
test eax, eax
js 0x10001df4
push 0x60
lea eax, [esp + 0x6c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x64]
push 3
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x18
push eax
push 0x80100080
lea eax, [esp + 0x2c]
mov dword [esp + 0x3c], 0
push eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
call dword [esp + 0x28]
test eax, eax
js 0x10001df4
push dword [esp + 0x18]
mov eax, dword [esp + 0x5c]
push 0x11000000
mov dword [esp + 0x48], eax
lea eax, [esp + 0x48]
push 2
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], 0
push eax
push 4
lea eax, [esp + 0x34]
mov dword [esp + 0x5c], 0
push eax
mov dword [esp + 0x40], 0x18
mov dword [esp + 0x44], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
call esi
test eax, eax
js 0x10001df4
push 2
push 0
push 2
lea eax, [esp + 0x48]
mov dword [esp + 0x2c], 0
push eax
lea eax, [esp + 0x58]
mov dword [esp + 0x4c], 0
push eax
push 0
push 0
lea eax, [esp + 0x3c]
xorps xmm0, xmm0
push eax
push 0xffffffffffffffff
push dword [esp + 0x40]
movlpd qword [esp + 0x70], xmm0
call dword [esp + 0x3c]
test eax, eax
js 0x10001df4
mov ecx, dword [esp + 0x20]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10001dda
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10001dda
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.100022d3
mov esp, ebp
pop ebp
ret
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.100022d3
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x274]
mov eax, 2
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100022d3
mov esp, ebp
pop ebp
ret
Function at 0x401250
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x34], 0
jbe 0x4012ef
mov eax, dword [ebx + 0x1c]
cmp eax, dword [ebx + 0x20]
jge 0x4012ef
push esi
push edi
lea eax, [ebp - 0xc]
lea ecx, [ebx + 0x24]
call fcn.00401490
mov ecx, dword [eax]
test ecx, ecx
jne 0x401286
xor edx, edx
jmp 0x401288
mov edx, dword [ecx]
mov ecx, dword [eax + 8]
mov edi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp edi, eax
ja 0x40129c
sub eax, edi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x4012cf
mov edi, dword [ebx + 0x2c]
inc dword [ebx + 0x30]
add edi, edi
add edi, edi
cmp edi, dword [ebx + 0x30]
ja 0x4012c2
mov dword [ebx + 0x30], 0
dec eax
mov dword [ebx + 0x34], eax
jne 0x4012cf
mov dword [ebx + 0x30], 0
push 0
push 0
push ecx
push 0x401060
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc dword [ebx + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401ff0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1024
call fcn.00435d00
mov eax, dword [0x459e00]
xor eax, esp
mov dword [esp + 0x1020], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x200000
mov dword [esp + 0x28], esi
mov edi, edx
call fcn.004336e5
mov ebx, eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
add esp, 4
push ecx
mov ecx, esi
mov dword [esp + 0x1c], ebx
call fcn.00402730
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
mov dword [esi + 8], 0
cmp dword [edi + 0x14], 8
jb 0x40205a
mov edi, dword [edi]
push edi
lea edx, [esp + 0x2c]
push 0x400
push edx
call fcn.00435095
add esp, 0xc
lea eax, [esp + 0x28]
push eax
push 0x100000
push ebx
push 0
push 0
push str.string
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
jne 0x4020b1
push ebx
call fcn.00434369
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1020]
xor ecx, esp
call fcn.00434758
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004336e5
mov edi, eax
xor ebx, ebx
add esp, 4
xor eax, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
test esi, esi
jle 0x4021e2
mov ecx, dword [esp + 0x18]
mov dx, word [ecx + ebx*2]
mov word [edi + eax*2], dx
inc eax
cmp word [ecx + ebx*2], 0
jne 0x4021d5
lea eax, [esp + 0x28]
push eax
push 0x400
lea ecx, [esp + 0x830]
push ecx
push 0
push edi
push str.string
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
test eax, eax
je 0x4021c7
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004336e5
mov ebx, eax
movzx eax, word [edi]
add esp, 4
xor esi, esi
cmp eax, 0x2e
je 0x40216a
mov edx, eax
mov eax, edi
mov edi, ebx
sub edi, dword [esp + 0x14]
mov word [edi + eax], dx
movzx ecx, word [eax + 2]
add eax, 2
inc esi
mov edx, ecx
cmp ecx, 0x2e
jne 0x402153
mov edi, dword [esp + 0x14]
xor eax, eax
push ebx
mov word [ebx + esi*2], ax
call fcn.00435984
push ebx
mov esi, eax
call fcn.00434369
mov ecx, dword [esp + 0x2c]
add esp, 8
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], esi
call fcn.00402390
lea edx, [esp + 0x828]
lea ecx, [edx + 2]
lea esp, [esp]
mov si, word [edx]
add edx, 2
test si, si
jne 0x4021a0
sub edx, ecx
sar edx, 1
push edx
lea ecx, [esp + 0x82c]
push ecx
mov ecx, eax
call fcn.004028a0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x20]
push esi
push 0
push edi
call fcn.00434d00
add esp, 0xc
xor eax, eax
inc ebx
mov dword [esp + 0x10], ebx
cmp ebx, esi
jl 0x4020e2
push edi
call fcn.00434369
mov edx, dword [esp + 0x1c]
push edx
call fcn.00434369
mov ecx, dword [esp + 0x1034]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.00434758
mov esp, ebp
pop ebp
ret
Function at 0x403f00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
push esi
push edi
mov edi, dword [0x45d66c]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x403f56
mov ecx, dword [ebp + 8]
push 0x401660
push 0
push 0
push 0
push 0
push 0
push esi
push ebx
push edi
call fcn.00403b80
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x403f58
xor edi, edi
mov eax, edi
mov ecx, 2
test edi, edi
jg 0x404005
jmp 0x403f73
mov ecx, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x404005
mov edx, ecx
dec ecx
mov dword [ebp - 4], ecx
test edx, edx
jle 0x404005
push 0xbb8
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp + 0xc]
mov edi, dword [0x45d66c]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x403ff9
lea ecx, [ebp - 8]
push ecx
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push 0x401660
push 0
push 0
lea ecx, [eax + 1]
neg ecx
push 0
sbb ecx, ecx
push 0
and ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push esi
push ebx
push edi
call fcn.00403b80
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x403ffb
xor edi, edi
mov eax, edi
test edi, edi
jle 0x403f70
pop edi
pop esi
test eax, eax
je 0x404020
cmp eax, 0xffffffff
je 0x404020
cmp eax, 0xfffffffe
je 0x404020
mov eax, 1
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x404260
Capabilities:
Download and write a file
Get http content length
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x459e00]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x424], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x41c], edx
cmp edi, esi
je 0x40440a
cmp ebx, esi
je 0x40440a
push 0x3ff
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov byte [ebp - 0x40c], al
lea eax, [ebp - 0x40b]
push esi
push eax
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x414], esi
call fcn.00434d00
add esp, 0xc
push esi
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x418]
push edx
push 0x20000005
push edi
mov dword [ebp - 0x410], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
jmp 0x404312
xor esi, esi
mov dword [ebp - 0x410], 0
lea esp, [esp]
lea eax, [ebp - 0x410]
push eax
mov ecx, 0x400
sub ecx, esi
push ecx
lea edx, [ebp + esi - 0x40c]
push edx
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x404356
mov eax, dword [ebp - 0x410]
test eax, eax
je 0x404356
add esi, eax
cmp esi, 0x400
jb 0x404320
test esi, esi
je 0x4043f7
push 0
lea eax, [ebp - 0x410]
push eax
push esi
lea ecx, [ebp - 0x40c]
push ecx
push ebx
mov dword [ebp - 0x410], 0
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x404310
mov eax, dword [ebp - 0x410]
add dword [ebp - 0x414], eax
mov edx, fcn.00404030
test edx, edx
je 0x404310
mov ecx, dword [ebp - 0x418]
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x41c]
push eax
mov dword [ebp - 0x43c], ecx
mov ecx, dword [ebp - 0x420]
push ecx
mov dword [ebp - 0x434], edx
mov edx, dword [ebp - 0x424]
push edx
lea eax, [ebp - 0x43c]
push eax
push ebx
call fcn.00404030
test eax, eax
jne 0x404310
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00434758
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x414]
cmp eax, dword [ebp - 0x418]
jae 0x40440a
mov eax, 0xfffffffe
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.00434758
mov esp, ebp
pop ebp
ret
Function at 0x404740
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x459e00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 4], 1
jne 0x4047bb
push 0x447604
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.00404690
mov edx, dword [ebp - 0x20]
add esp, 0xc
cmp dword [ebp - 0xc], 8
jae 0x40477a
lea edx, [ebp - 0x20]
mov eax, edx
push edi
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404780
mov ecx, dword [esi]
sub eax, edi
push ecx
sar eax, 1
push 1
add eax, eax
push eax
push edx
call fcn.00434aa4
mov ecx, dword [esi]
push ecx
call fcn.004348f1
add esp, 0x14
cmp dword [ebp - 0xc], 8
pop edi
jb 0x4047bb
mov edx, dword [ebp - 0x20]
push edx
call fcn.00433949
add esp, 4
cmp dword [ebp + 0x1c], 8
pop esi
jb 0x4047ce
mov eax, dword [ebp + 8]
push eax
call fcn.00433949
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434758
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x404e40
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], 8
jb 0x404e4f
mov eax, dword [eax]
push esi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
mov dword [ebp + 0x10], esi
cmp esi, 0xffffffff
jne 0x404e7c
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
test eax, eax
jne 0x404ea0
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
add eax, dword [ebp + 0x14]
push ebx
push eax
call fcn.004336e5
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x404ec5
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [edi]
add edx, dword [ebp + 0x14]
push edx
push 0
push ebx
call fcn.00434d00
xor esi, esi
add esp, 0xc
cmp dword [edi], esi
jbe 0x404f04
lea esp, [esp]
mov ecx, dword [edi]
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
sub ecx, esi
push ecx
lea edx, [esi + ebx]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x404f04
add esi, dword [ebp - 4]
cmp esi, dword [edi]
jb 0x404ee0
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp esi, dword [edi]
jae 0x404f26
push ebx
call fcn.00434369
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp + 8]
mov dword [edx], ebx
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404f40
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x459e00]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x25b], eax
mov byte [ebp - 0x254], al
mov word [ebp - 0x253], ax
mov byte [ebp - 0x251], al
mov eax, dword [esi]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x260], ebx
lea ecx, [ebp - 0x25c]
mov eax, str.elex
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404fb3
test dl, dl
je 0x404faf
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404fb3
add eax, 2
add ecx, 2
test dl, dl
jne 0x404f93
xor eax, eax
jmp 0x404fb8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404fd1
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434758
mov esp, ebp
pop ebp
ret 0xc
push 0
mov dword [ebp - 0x254], 0x4034b50
mov ecx, dword [ebp - 0x254]
push edi
push esi
mov dword [esi], ecx
call fcn.00409f40
mov esi, eax
push 0x447790
push esi
call fcn.0040a320
lea edx, [ebp - 0x250]
push edx
push 0xffffffffffffffff
push esi
call fcn.00409f60
push 0x447788
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.00404690
mov eax, dword [ebp - 0x20]
mov ebx, 8
add esp, 0x2c
cmp dword [ebp - 0xc], ebx
jae 0x40502a
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
xor edi, edi
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], ebx
jae 0x40503e
lea eax, [ebp - 0x20]
push eax
push 0
push esi
call fcn.00409fb0
add esp, 0xc
test eax, eax
je 0x405054
inc edi
cmp edi, 3
jl 0x405033
push esi
call fcn.00407be0
add esp, 4
push esi
test al, al
je 0x405069
call fcn.0040a360
jmp 0x40506e
call fcn.0040ac30
mov eax, dword [ebp - 0x260]
add esp, 4
cmp dword [eax + 0x14], ebx
jb 0x40507e
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0xc], ebx
jae 0x405089
lea ecx, [ebp - 0x20]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], ebx
jae 0x40509e
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp dword [ebp - 0xc], ebx
jb 0x4050b6
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00433949
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00434758
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406af0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x406afe
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
not eax
cmp edx, 8
jb 0x406bdd
mov esi, edx
shr esi, 3
push edi
jmp 0x406b20
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44c740]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44c740]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44c740]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44c740]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44c740]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44c740]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44c740]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44c740]
add ecx, 8
sub edx, 8
dec esi
jne 0x406b20
pop edi
test edx, edx
je 0x406bfa
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x44c740]
inc ecx
dec edx
jne 0x406be1
not eax
pop esi
pop ebp
ret

Function at 0x406c00
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movsx ecx, byte [ebp + 0xc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x44c740]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x44c740]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x406c50
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov eax, ecx
and eax, 0xfffd
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
mov al, byte [ebp + 0xc]
shr edx, 8
xor al, dl
mov edx, dword [esi]
push edi
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x44c740]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x44c740]
pop edi
mov dword [esi + 8], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x4070b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x4070f0
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4070e4
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
pop ebp
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x407101
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
add eax, ecx
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
call fcn.004339b0
add dword [edi + 0x1c], esi
add esp, 0xc
pop edi
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
pop ebp
ret