joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x18]
or eax, 0x20019
push eax
push 0
push str.SoftwareiSafe
push 0x80000002
mov dword [ebp - 8], 1
xor bl, bl
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e9d3
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push edi
push eax
push 0
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x41e9e1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret

Function at 0x41ea00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0x18]
or eax, 0x2001f
push eax
push 0
push str.SoftwareiSafe
push 0x80000002
xor bl, bl
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ea66
push dword [edi]
push esi
push 1
push eax
push str.guid
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov eax, dword [ebp - 8]
test eax, eax
je 0x41ea74
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
Function at 0x41fa00
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x449e54]
cmp eax, 0xffffffff
jne 0x41fbf3
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call dword [sym.imp.MSVCR110.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x41fa8a
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
push 0x440bd8
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0x18
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41faeb
mov dword [0x449e54], 1
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [0x449e54], 0
call sub.MSVCR110.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x20c]
call fcn.0041f930
test eax, eax
je 0x41fbee
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call sub.MSVCR110.dll_memset
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0x24
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41fbb3
lea eax, [ebp - 0x824]
push eax
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0x436b28
push str.promote
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x61c]
push 0x440c00
push eax
call dword [sym.imp.MSVCR110.dll__wcsicmp]
mov ecx, dword [0x449e54]
add esp, 8
test eax, eax
mov edx, 1
cmove ecx, edx
mov dword [0x449e54], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
mov eax, dword [0x449e54]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
Function at 0x41fd80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SoftwareiSafe
push 0x80000002
mov esi, ecx
mov dword [ebp - 8], 0x208
mov dword [ebp - 0xc], 1
xor bl, bl
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41fdf0
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push str.path
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41fdfe
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
movzx eax, bl
xor ecx, ebp
pop ebx
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret

Function at 0x4206c0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0041fa00
test eax, eax
je 0x4206ef
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x414]
call fcn.0041f930
test eax, eax
je 0x4207e8
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0x24
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4207ad
lea eax, [ebp - 0x61c]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x436b28
push str.promote
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push 0x440c00
push eax
call dword [sym.imp.MSVCR110.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x4206dc
lea eax, [ebp - 0x20c]
push 0x440d50
push eax
call dword [sym.imp.MSVCR110.dll__wcsicmp]
add esp, 8
test eax, eax
mov eax, 3
je 0x4207ed
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
Function at 0x424740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push edx
push ecx
mov dword [ebp - 0x41c], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 8]
cmp ecx, 1
je 0x4247fd
cmp ecx, 2
je 0x4247fd
cmp ecx, 4
jne 0x42486a
test esi, esi
jne 0x4247b6
test eax, eax
jne 0x42486a
lea eax, [esi + 2]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 8
cmp eax, 2
je 0x42480c
test eax, eax
jne 0x424850
cmp dword [ebp - 0x418], 4
jne 0x424850
cmp dword [ebp - 0x41c], 4
jne 0x424850
mov eax, dword [ebp - 0x414]
cmp eax, dword [esi]
je 0x42486a
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 8
test esi, esi
je 0x424866
cmp word [esi], 0
je 0x424866
cmp eax, 2
jne 0x424822
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 8
test eax, eax
jne 0x424850
mov eax, dword [ebp - 0x418]
cmp eax, 1
je 0x42483b
cmp eax, 7
je 0x42483b
cmp eax, 2
jne 0x424850
lea eax, [ebp - 0x414]
push esi
push eax
call dword [sym.imp.MSVCR110.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x42486a
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x424850
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 8
Function at 0x425030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x628]
push eax
or edx, 1
push edx
push 0
push str.SOFTWAREiSafe
push 0x80000002
mov esi, ecx
mov dword [ebp - 0x628], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4250cc
push str.SOFTWAREiSafe
push str.HKEY_LOCAL_MACHINE
push str._s_s
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x14
lea eax, [ebp - 0x20c]
push ebx
push 0
push eax
push str.SOFTWAREiSafe
push 0
push 0x3010200
call edi
test eax, eax
je 0x4250cc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x620]
push eax
push 0
push str.path
push dword [ebp - 0x628]
mov dword [ebp - 0x624], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x42513d
cmp word [esi], 0
je 0x42513d
cmp eax, 2
je 0x42514b
test eax, eax
jne 0x42514b
mov eax, dword [ebp - 0x620]
cmp eax, 1
je 0x425126
cmp eax, 7
je 0x425126
cmp eax, 2
jne 0x42514b
lea eax, [ebp - 0x61c]
push esi
push eax
call dword [sym.imp.MSVCR110.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x425141
jmp 0x42514b
test eax, eax
je 0x42514b
test esi, esi
je 0x42514b
cmp word [esi], 0
jne 0x425190
push str.path
push str.SOFTWAREiSafe
push str.HKEY_LOCAL_MACHINE
push str._s_s_s
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x18
lea eax, [ebp - 0x20c]
push ebx
push 0
push eax
push esi
push 1
push 0x3010201
call edi
test eax, eax
jne 0x4250b9
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
Function at 0x4251b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x830]
push eax
or edx, 1
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalliSafe
push 0x80000002
mov dword [ebp - 0x828], ecx
mov dword [ebp - 0x834], ebx
mov dword [ebp - 0x830], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.MSVCR110.dll_swprintf_s]
test eax, eax
je 0x425258
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalliSafe
push str.HKEY_LOCAL_MACHINE
push str._s_s
lea eax, [ebp - 0x414]
push 0x104
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x414]
push ebx
push 0
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalliSafe
push 0
push 0x2010300
call edi
test eax, eax
je 0x425258
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
push str.uninstall.exe
push dword [ebp - 0x828]
lea eax, [ebp - 0x20c]
push 0x43f69c
push 0x104
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x82c]
push eax
push 0
push str.UninstallString
push dword [ebp - 0x830]
mov dword [ebp - 0x828], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [ebp - 0x20c], 0
je 0x4252f5
cmp eax, 2
jne 0x4252bf
lea ebx, [eax - 1]
jmp 0x4252fe
test eax, eax
jne 0x4252f9
mov eax, dword [ebp - 0x82c]
cmp eax, 1
je 0x4252d8
cmp eax, 7
je 0x4252d8
cmp eax, 2
jne 0x4252f9
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.MSVCR110.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x425351
jmp 0x4252f9
test eax, eax
jne 0x425351
mov ebx, 2
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalliSafe
push str.HKEY_LOCAL_MACHINE
push str._s_s_s
lea eax, [ebp - 0x414]
push 0x104
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x414]
push dword [ebp - 0x834]
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
movzx eax, bl
shl eax, 0x10
push 1
or eax, 0x2000301
push eax
call edi
test eax, eax
jne 0x425245
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
Function at 0x4260a0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, dword [ebp + 8]
xor eax, eax
push 0xffffffffffffffff
push eax
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00402bb0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmp edx, 8
lea ecx, [ebp - 0x2c]
cmovae ecx, esi
cmp word [ecx + eax*2 - 2], 0x5c
je 0x426126
push 1
push 0x436b24
lea ecx, [ebp - 0x2c]
call fcn.00403b10
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x34]
push ecx
cmp edx, 8
lea ecx, [ebp - 0x3c]
lea eax, [ebp - 0x2c]
cmovae eax, esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
shrd edx, ecx, 0x14
shr ecx, 0x14
mov ecx, dword [ebp - 0x30]
mov dword [edi], edx
mov edx, dword [ebp - 0x34]
shrd edx, ecx, 0x14
shr ecx, 0x14
cmp dword [ebp - 0x18], 8
mov esi, eax
mov dword [ebx], edx
jb 0x426174
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret

Function at 0x4270e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov edx, ecx
shr edx, 8
sub dl, 0x2b
lea eax, [ecx + 7]
or dl, al
mov eax, ecx
shr eax, 0x10
and dl, al
and dl, 0x55
shr ecx, 0x18
xor dl, cl
test edi, edi
jne 0x427112
pop edi
xor al, al
pop esi
pop ebp
ret
xor eax, eax
test esi, esi
je 0x427125
xor byte [eax + edi], dl
lea ecx, [eax + edi]
add dl, al
inc eax
cmp eax, esi
jb 0x427118
pop edi
mov al, 1
pop esi
pop ebp
ret
Function at 0x428fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x4291d6
cmp dword [esi + 0x6af90], 3
jb 0x429048
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
movzx ecx, byte [edx + esi + 0x1af72]
shl eax, 5
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x429085
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x429085
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x42906f
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.00428cb0
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, esi
cmp edi, 3
jb 0x429156
mov edx, dword [esi + 0x6af84]
sub edx, dword [esi + 0x6af88]
lea eax, [edi - 3]
push eax
call fcn.004284a0
sub dword [esi + 0x6af90], edi
add esp, 4
mov dword [ebp - 4], eax
cmp edi, dword [esi + 0x6af98]
ja 0x42911d
cmp dword [esi + 0x6af90], 3
jb 0x42911d
dec edi
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
movzx ecx, byte [esi + edx + 0x1af72]
shl eax, 5
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
dec edi
jne 0x4290c3
mov eax, dword [ebp - 4]
jmp 0x429175
add dword [esi + 0x6af84], edi
mov eax, dword [esi + 0x6af84]
xor edi, edi
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x42917b
mov eax, dword [esi + 0x6af84]
xor edx, edx
movzx eax, byte [eax + esi + 0x1af70]
push eax
call fcn.004284a0
add esp, 4
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x4291b6
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x429193
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x429195
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
push 0
push eax
mov ecx, esi
call fcn.004282f0
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x4291c9
mov ecx, esi
call fcn.00428e70
cmp dword [esi + 0x6af90], 0
jne 0x428ff3
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x4291ea
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x4291ec
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
push 1
push eax
mov ecx, esi
call fcn.004282f0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429f20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x429f2b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x429ff5
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x43ab10]
movzx eax, byte [edx + 1]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x43ab10]
movzx eax, byte [edx + 2]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x43ab10]
movzx eax, byte [edx + 3]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x43ab10]
movzx eax, byte [edx + 4]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x43ab10]
movzx eax, byte [edx + 5]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x43ab10]
movzx eax, byte [edx + 6]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x43ab10]
movzx eax, byte [edx + 7]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x43ab10]
add edx, 8
sub esi, 8
dec edi
jne 0x429f40
pop edi
test esi, esi
je 0x42a01a
lea esp, [esp]
movzx eax, byte [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x43ab10]
lea edx, [edx + 1]
dec esi
jne 0x42a000
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x42a030
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
and eax, 0xff
shr esi, 8
mov eax, dword [eax*4 + 0x43ab10]
xor eax, esi
movzx ecx, al
add ecx, dword [edi + 4]
mov dword [edi], eax
mov eax, dword [edi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x43ab10]
mov dword [edi + 8], eax
pop edi
pop esi
ret
Function at 0x42a4d0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x2d], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ebx
je 0x42a5be
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x42a515
cmp dword [esi + 0x40], ebx
jae 0x42a515
push eax
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x42a52d
lea eax, [ebx + ebx]
push eax
call fcn.0042ec57
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push dword [esi + 0x3c]
call sub.MSVCR110.dll_memcpy
xor edx, edx
add esp, 0xc
mov dword [ebp - 0xc], edx
test ebx, ebx
je 0x42a5bb
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
movsx eax, bl
xor eax, ecx
and eax, 0xff
shr ecx, 8
mov eax, dword [eax*4 + 0x43ab10]
xor eax, ecx
mov dword [esi + 0x30], eax
movzx eax, al
add eax, dword [esi + 0x34]
mov edi, edx
imul eax, eax, 0x8088405
and edi, 0xfffd
or edi, 2
inc eax
mov dword [esi + 0x34], eax
mov ecx, edi
xor ecx, 1
shr eax, 0x18
imul ecx, edi
xor eax, edx
and eax, 0xff
shr edx, 8
xor edx, dword [eax*4 + 0x43ab10]
shr ecx, 8
mov dword [esi + 0x38], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x3c]
xor cl, bl
mov ebx, dword [ebp - 8]
mov byte [edx + eax], cl
inc edx
mov dword [ebp - 0xc], edx
cmp edx, ebx
jb 0x42a543
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42a5fe
mov edx, dword [esi + 0x24]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x42a5d9
mov dword [esi + 0x14], 0x30000
jmp 0x42a631
push ebx
add ecx, edx
push edi
push ecx
call sub.MSVCR110.dll_memcpy
add esp, 0xc
add dword [esi + 0x24], ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x42a62a
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x14], 0x1000000
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 8
Function at 0x42aaf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x84]
test edx, edx
je 0x42ab69
mov ecx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
cmp ecx, esi
jae 0x42abb8
sub esi, ecx
cmp esi, dword [ebp + 0xc]
lea eax, [ecx + edx]
cmova esi, dword [ebp + 0xc]
push esi
push eax
push ebx
call sub.MSVCR110.dll_memcpy
mov ecx, dword [edi + 0x78]
add dword [edi + 0x8c], esi
add dword [edi + 0x74], esi
push esi
mov edx, ebx
call fcn.00429f20
add esp, 0x10
mov dword [edi + 0x78], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x42abb1
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42abb8
mov esi, dword [ebp - 8]
mov ecx, dword [edi + 0x78]
add dword [edi + 0x74], esi
push esi
mov edx, ebx
call fcn.00429f20
add esp, 4
mov dword [edi + 0x78], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x14], 0x1000000
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 8