joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475d40
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x49b180]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0046ab32
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0046ab32
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x475db7
cmp word [ecx], dx
je 0x475db7
mov eax, dword [0x486674]
push edi
dec eax
push eax
push 0x486560
call fcn.00475cdf
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x475e2a
cmp word [eax], dx
je 0x475e2a
mov eax, dword [edi]
test eax, eax
je 0x475ddb
cmp word [eax], dx
je 0x475ddb
lea eax, [ebp - 0x10]
push eax
call fcn.004756c2
jmp 0x475de4
lea eax, [ebp - 0x10]
push eax
call fcn.0047575d
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x475e54
mov eax, dword [0x48655c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x486250
call fcn.00475cdf
add esp, 0xc
test al, al
je 0x475e54
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x475e1f
cmp word [eax], di
je 0x475e1f
lea eax, [ebp - 0x10]
push eax
call fcn.004756c2
pop ecx
jmp 0x475e56
lea eax, [ebp - 0x10]
push eax
call fcn.0047575d
jmp 0x475e1c
mov eax, dword [edi]
test eax, eax
je 0x475e41
cmp word [eax], dx
je 0x475e41
lea eax, [ebp - 0x10]
push eax
call fcn.00475677
pop ecx
jmp 0x475e54
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x475f1f
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00475b64
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x475f1f
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x475f1f
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x475f1f
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x475eac
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0046c71e
test ebx, ebx
je 0x475f1a
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0046c71e
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x475f1f
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x475f1f
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0047965d
add esp, 0x10
xor eax, eax
inc eax
jmp 0x475f21
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00453277
leave
ret
Function at 0x478b1d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x49b180]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x478b60
call fcn.00460f32
mov dword [eax], 0xf
call fcn.00460f45
mov dword [eax], 0xd
call fcn.0045a08f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453277
leave
ret
test eax, eax
jne 0x478b67
inc eax
jmp 0x478b54
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x478b52
xor eax, eax
cmp ecx, 1
setne al
jmp 0x478b54

Function at 0x47ab20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47ab4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47ab4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x53f172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x53f1a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x53f1a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x53fdff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.0053ff04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.0053ff20
push edx
push dword [ebp + 0x10]
push eax
call fcn.0053feec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0053ff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0053fecb
push ecx
push dword [ebp + 8]
call fcn.0053ff04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0053ff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0053fecb
push ecx
push dword [ebp + 8]
call fcn.0053ff04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0053ff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0053fecb
push ecx
push dword [ebp + 8]
call fcn.0053ff04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0053ff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0053fecb
cmp ecx, 0x2b
jne 0x53fe0f
leave
ret 0xc

Function at 0x5414b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x541544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x9c410
push 0
call dword [eax + 0x20]
test eax, eax
je 0x5415d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x9c410
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x9c410
call fcn.005413fa
push 0x9c410
push dword [ebp + 0xc]
call fcn.0053f1a8
test eax, eax
jne 0x5415b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x9c410
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.005415dd
test eax, eax
je 0x5415d6
jmp 0x541574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x5415d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x403b20
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x48180c
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4a6554]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [esi], vtable.KR_.0
push ebx
mov edi, 7
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x48f9e8
mov word [ecx + 4], bx
call fcn.004042e0
mov dword [esp + 0x18], ebx
mov dword [esi + 0x20], 0xff010101
mov dword [esi + 0x24], 0xffa2a2ab
lea ecx, [esi + 0x38]
mov dword [esi + 0x28], 0xc
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 0x64
push 2
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x48f8b8
mov word [ecx + 4], bx
call fcn.004042e0
lea ecx, [esi + 0x54]
mov byte [esp + 0x18], 1
push 4
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.left
mov byte [ecx + 4], bl
call fcn.004033f0
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 2
push 6
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.center
mov byte [ecx + 4], bl
call fcn.004033f0
lea ecx, [esi + 0x8c]
mov byte [esp + 0x18], 3
push 6
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.normal
mov byte [ecx + 4], bl
call fcn.004033f0
mov byte [esi + 0xa8], 1
mov byte [esi + 0xa9], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x4049c0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x48172c
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4a6554]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [esi], method.ka_CoW_47.virtual_0
push ebx
mov edi, 7
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x48f9e8
mov word [ecx + 4], bx
call fcn.004042e0
mov dword [esp + 0x18], ebx
mov dword [esi + 0x20], 0xff010101
mov dword [esi + 0x24], 0xffa2a2ab
lea ecx, [esi + 0x38]
mov dword [esi + 0x28], 0xc
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 0x64
push 2
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x48f8b8
mov word [ecx + 4], bx
call fcn.004042e0
lea ecx, [esi + 0x54]
mov byte [esp + 0x18], 1
push 4
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.left
mov byte [ecx + 4], bl
call fcn.004033f0
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 2
push 6
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.center
mov byte [ecx + 4], bl
call fcn.004033f0
lea ecx, [esi + 0x8c]
mov byte [esp + 0x18], 3
push 6
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.normal
mov byte [ecx + 4], bl
call fcn.004033f0
mov byte [esi + 0xa8], 1
mov byte [esi + 0xa9], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x40e200
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x47f81b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4a6554]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x4870f0
call fcn.004461bf
push 4
mov dword [esp + 0x24], 0
call fcn.00447b94
mov edi, eax
add esp, 4
test edi, edi
je 0x40e284
call fcn.00445fe5
mov dword [edi], eax
call fcn.00445e19
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00445d8b
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40e279
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00445dac
jmp 0x40e286
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x40e390
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x47f7eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4a6554]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x4846c4
call fcn.004461bf
push 4
mov dword [esp + 0x24], 0
call fcn.00447b94
mov edi, eax
add esp, 4
test edi, edi
je 0x40e414
call fcn.00445fe5
mov dword [edi], eax
call fcn.00445e19
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00445d8b
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40e409
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00445dac
jmp 0x40e416
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x412d00
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x48136c
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4a6554]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [esi], method.ka_CoW_47.virtual_0
push ebx
mov edi, 7
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x48f9e8
mov word [ecx + 4], bx
call fcn.004042e0
mov dword [esp + 0x18], ebx
mov dword [esi + 0x20], 0xff010101
mov dword [esi + 0x24], 0xffa2a2ab
lea ecx, [esi + 0x38]
mov dword [esi + 0x28], 0xc
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 0x64
push 2
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x48f8b8
mov word [ecx + 4], bx
call fcn.004042e0
lea ecx, [esi + 0x54]
mov byte [esp + 0x18], 1
push 4
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.left
mov byte [ecx + 4], bl
call fcn.004033f0
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 2
push 6
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.center
mov byte [ecx + 4], bl
call fcn.004033f0
lea ecx, [esi + 0x8c]
mov byte [esp + 0x18], 3
push 6
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.normal
mov byte [ecx + 4], bl
call fcn.004033f0
mov byte [esi + 0xa8], 1
mov byte [esi + 0xa9], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x41fd4a
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 0x34
call fcn.00447b94
mov esi, eax
xor ebx, ebx
cmp esi, ebx
pop ecx
je 0x41fd67
lea ecx, [esi + 4]
call fcn.004010a0
jmp 0x41fd69
xor esi, esi
mov eax, dword [esp + 0x10]
push dword [esp + 0x18]
lea ecx, [esi + 4]
mov dword [esi], eax
call fcn.004042b0
mov eax, dword [esp + 0x1c]
push ebx
push ebx
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push 1
push ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], eax
call dword [0x4840d4]
mov edi, dword [0x484124]
push eax
mov dword [esi + 0x24], eax
call edi
push esi
push ebx
push 0x41fcae
call fcn.00449182
add esp, 0xc
push 0x7530
push dword [esi + 0x24]
mov dword [esi + 0x2c], eax
call dword [0x4840fc]
push dword [esi + 0x24]
call edi
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x42285a
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x422872
mov eax, dword [esp + 4]
add eax, ecx
xor byte [eax], 0x97
inc ecx
cmp ecx, dword [esp + 8]
jb 0x422862
xor eax, eax
ret
Function at 0x4228f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
shr eax, 5
push ebx
mov ebx, ecx
lea ecx, [eax - 4]
cmp ecx, 0xa
mov dword [ebp - 4], ebx
ja 0x422a61
push esi
xor ecx, ecx
test eax, eax
push edi
jbe 0x422936
mov edx, dword [ebp + 8]
sub edx, 0x4a8864
mov esi, dword [edx + ecx*4 + 0x4a8864]
mov dword [ecx*4 + 0x4a8864], esi
inc ecx
cmp ecx, eax
jb 0x422923
push 0xf
mov dword [eax*4 + 0x4a8864], eax
inc eax
pop ecx
cmp eax, ecx
jae 0x422952
lea edi, [eax*4 + 0x4a8864]
sub ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
push 4
xor esi, esi
lea edi, [ebx + 4]
pop edx
xor eax, eax
mov ecx, dword [eax + 0x4a5a64]
mov ecx, dword [ecx*4 + 0x4a8864]
mov ebx, dword [eax + 0x4a5aa0]
xor ecx, dword [ebx*4 + 0x4a8864]
lea ebx, [eax + esi]
rol ecx, 3
xor ecx, ebx
xor dword [eax + 0x4a8864], ecx
add eax, edx
cmp eax, 0x3c
jb 0x42295c
mov dword [ebp + 0xc], edx
xor ecx, ecx
mov ebx, dword [ecx + 0x4a5a28]
mov ebx, dword [ebx*4 + 0x4a8864]
and ebx, 0x1ff
mov ebx, dword [ebx*4 + 0x4a5228]
lea eax, [ecx + 0x4a8864]
add ebx, dword [eax]
add ecx, edx
rol ebx, 9
cmp ecx, 0x3c
mov dword [eax], ebx
jb 0x422990
dec dword [ebp + 0xc]
jne 0x42298e
mov eax, edi
xor ecx, ecx
mov edi, dword [ecx + 0x4a5adc]
mov edi, dword [edi*4 + 0x4a8864]
mov dword [eax], edi
add ecx, edx
add eax, edx
cmp ecx, 0x28
jb 0x4229c7
inc esi
cmp esi, edx
mov edi, eax
jb 0x42295a
mov esi, dword [ebp - 4]
add esi, 0x18
mov dword [ebp + 0xc], 0x10
mov ecx, dword [esi]
mov edx, ecx
or edx, 3
mov eax, edx
shr eax, 1
mov edi, edx
not edi
xor eax, edi
and eax, 0x7fffffff
mov edi, eax
shr edi, 2
mov ebx, eax
shr ebx, 1
and edi, ebx
and eax, edi
mov edi, eax
mov ebx, eax
shr edi, 6
shr ebx, 3
and edi, ebx
and eax, edi
je 0x422a55
add eax, eax
lea edi, [eax + eax]
or eax, edi
and ecx, 3
mov edi, eax
shl edi, 2
or eax, edi
mov edi, dword [ecx*4 + 0x4a5b18]
mov cl, byte [esi - 4]
rol edi, cl
mov ecx, eax
shl ecx, 4
or ecx, eax
and edi, ecx
and edi, 0xfffffffc
xor edx, edi
mov dword [esi], edx
add esi, 8
dec dword [ebp + 0xc]
jne 0x4229f7
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x431b8c
Capabilities:
Create thread

Disassembly:
push 0x38
mov eax, 0x47db08
call fcn.0044803d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x20]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], 7
call fcn.00401d60
mov edi, dword [0x484158]
mov dword [ebp - 4], ebx
call edi
push 0x4c
mov dword [ebp - 0x3c], eax
call fcn.00447b94
cmp eax, ebx
pop ecx
je 0x431bed
mov ecx, eax
call fcn.004315bf
mov esi, eax
jmp 0x431bef
xor esi, esi
push dword [ebp - 0x34]
mov ecx, esi
call fcn.004042b0
push dword [ebp - 0x30]
lea ecx, [esi + 0x1c]
call fcn.004042b0
mov eax, dword [ebp + 0x10]
push ebx
push ebx
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0x14]
push 1
push ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], ebx
call dword [0x4840d4]
push esi
push ebx
push 0x431b48
mov dword [esi + 0x44], eax
call fcn.00449182
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x40]
mov dword [eax], ebx
mov dword [ebp - 0x30], 1
add esp, 0xc
mov eax, dword [ebp - 0x30]
dec eax
je 0x431c81
dec eax
jne 0x431c42
push 0x3e8
push dword [ebp - 0x34]
call dword [0x4840fc]
cmp eax, ebx
je 0x431cbc
cmp eax, 0x102
jne 0x431cbc
call edi
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx]
push eax
push str.WaitSetup__d_r_n
call fcn.00447033
add eax, 0x40
push eax
call fcn.004480de
jmp 0x431c3f
push 0x3e8
push dword [esi + 0x44]
call dword [0x4840fc]
cmp eax, ebx
je 0x431ca9
cmp eax, 0x102
jne 0x431ca9
call edi
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx]
push eax
push str.WaitUAC__d_r_n
jmp 0x431c71
mov dword [ebp - 0x30], 2
call edi
sub eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
jmp 0x431c42
push dword [ebp - 0x34]
call dword [0x4840d8]
call edi
sub eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov eax, dword [esi + 0x48]
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
mov edi, dword [esi + 0x3c]
mov ecx, esi
call fcn.004315d3
push esi
call fcn.00446c0b
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401660
mov eax, edi
call fcn.004480c0
ret
Function at 0x437137
Capabilities:
Create thread

Disassembly:
push 0x38
mov eax, 0x47e354
call fcn.00447fd4
mov esi, ecx
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x4371ca
cmp dword [ebp + 8], edi
je 0x4371ca
push dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
call fcn.004039c0
lea ecx, [esi + 0x30]
push ecx
push eax
mov dword [ebp - 4], edi
call fcn.00435bd8
pop ecx
pop ecx
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
push edi
inc edi
push edi
lea ecx, [ebp - 0x28]
inc bl
call fcn.00401660
test bl, bl
jne 0x4371ca
push dword [ebp + 8]
lea ecx, [ebp - 0x44]
call fcn.004039c0
lea ecx, [esi + 0x4c]
push ecx
push eax
mov dword [ebp - 4], edi
call fcn.00435bd8
pop ecx
pop ecx
mov ebx, eax
neg ebx
push 0
sbb bl, bl
push edi
lea ecx, [ebp - 0x44]
inc bl
call fcn.00401660
test bl, bl
jne 0x4371ca
push esi
push 0
push 0x4370bc
call fcn.00449182
add esp, 0xc
mov dword [esi + 4], eax
call fcn.004480ac
ret 8

Function at 0x43c4d8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x43c4e3
xor eax, eax
ret
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x43c59e
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x489fd0]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x489fd0]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x489fd0]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x489fd0]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x489fd0]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x489fd0]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x489fd0]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x489fd0]
inc edx
sub eax, 8
dec edi
jne 0x43c503
pop edi
test eax, eax
je 0x43c5b7
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x489fd0]
inc edx
dec eax
jne 0x43c5a2
mov eax, esi
pop esi
not eax
pop ebx
ret

Function at 0x43c5be
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
movzx edx, byte [esp + 8]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x489fd0]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x489fd0]
pop esi
mov dword [ecx + 8], eax
ret