joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f640
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
and ecx, 1
push 0
push 0x80
mov dword [ebp + 0xc], ecx
lea eax, [ecx + 3]
push eax
push 0
lea eax, [ecx + 2]
push 3
shl eax, 0x1e
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
lea ebx, [edi + 0x10]
mov dword [ebx], ecx
cmp ecx, 0xffffffff
jne 0x42f68b
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
or eax, esi
jne 0x42f6cf
lea eax, [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 8]
xor edx, edx
add edx, eax
mov ecx, esi
mov dword [edi + 8], edx
adc ecx, 0
or edx, ecx
mov dword [edi + 0xc], ecx
jne 0x42f6db
mov eax, ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov dword [ebx], 0
mov eax, 2
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
mov dword [ebp + 8], esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], esi
push 0
push eax
push esi
mov esi, dword [ebp + 0xc]
mov ecx, ebx
lea eax, [esi*2 + 2]
or eax, 0x8000000
push eax
push 0
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov dword [edi + 0x14], ecx
test ecx, ecx
jne 0x42f71e
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov dword [ebx], 0
mov eax, 3
pop ebx
pop ebp
ret 0x10
push 0
push 0
push 0
lea eax, [esi*2 + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi], eax
test eax, eax
jne 0x42f761
push dword [edi + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebx]
call esi
mov dword [edi + 0x14], 0
mov eax, 4
pop edi
pop esi
mov dword [ebx], 0
pop ebx
pop ebp
ret 0x10
mov dword [edi + 4], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x42f940
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62acc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x42f974
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42f974
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebx]
test al, al
je 0x42fa27
push esi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x42f98b
cmp al, 0x5c
jne 0x42f98d
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x42f983
cmp esi, ebx
je 0x42f9d0
sub esi, ebx
lea eax, [ebp - 0x20c]
push esi
push ebx
push eax
call fcn.00500630
add esp, 0xc
cmp esi, 0x104
jae 0x42fa37
lea eax, [ebp - 0x20c]
mov byte [ebp + esi - 0x20c], 0
push eax
push edi
call fcn.0042f940
add esp, 8
mov byte [ebp - 0x108], 0
pop esi
test edi, edi
je 0x42f9f1
push edi
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00503df9
add esp, 0xc
push ebx
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.005111bf
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42fa27
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
call fcn.004fed6e
int3
Function at 0x4302d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 8], ebx
cmp dword [ebx], 0
jne 0x43046b
cmp dword [ebx + 4], 0xffffffff
jne 0x43046b
push esi
lea esi, [ebx + 0x140]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x430307
sub ecx, edx
mov al, byte [ecx + ebx + 0x13f]
cmp al, 0x5c
je 0x430332
cmp al, 0x2f
je 0x430332
push 0x5a074c
push 0x104
push esi
call fcn.005111bf
add esp, 0xc
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 1
jne 0x43035d
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x430378
pop edi
pop esi
mov eax, 0x2000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 2
je 0x430375
cmp edi, 3
je 0x430375
pop edi
pop esi
mov eax, 0x10000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 8]
xor ebx, ebx
xor al, al
mov byte [ebp - 1], al
mov byte [ebp + 0x13], bl
cmp edi, 1
je 0x4303be
cmp edi, 2
jne 0x4303da
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4303b8
pop edi
pop esi
mov eax, 0x200
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov byte [ebp + 0x13], 1
jmp 0x4303c4
mov ebx, esi
mov byte [ebp + 0x13], 0
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne al
mov byte [ebp - 1], al
push 0x20
call fcn.004fee49
add esp, 4
mov esi, eax
cmp edi, 1
je 0x430415
cmp edi, 2
je 0x430415
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov word [esi], 0x100
mov byte [esi + 0x10], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0xc], 0
jmp 0x430446
mov al, byte [ebp + 0x13]
mov byte [esi + 0x10], al
mov al, byte [ebp - 1]
mov byte [esi], 1
mov byte [esi + 1], al
mov dword [esi + 4], ebx
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
test al, al
je 0x430446
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0xc], eax
push esi
call fcn.00433880
mov ecx, dword [ebp - 8]
add esp, 4
mov edx, 0x200
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
pop edi
cmove ecx, edx
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x1000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x433250
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, esi
imul ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x43328e
push 0
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x433282
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp + 8]
call fcn.00500630
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4332c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4332ce
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x43338d
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
sub edi, 1
jne 0x4332e6
pop edi
test esi, esi
je 0x4333ab
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
sub esi, 1
jne 0x433391
not eax
pop esi
pop ebp
ret
Function at 0x4336b0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x433869
cmp dword [edi + 0x18], 0
je 0x433869
cmp dword [edi + 0x7c], 0
je 0x4336db
push edi
call fcn.004333b0
add esp, 4
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push edi
call fcn.00433d40
add esp, 0x10
test eax, eax
je 0x4336fe
mov eax, 0xffffff99
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.00503e6e
mov esi, eax
add esp, 4
test esi, esi
je 0x433741
push 0x4000
call fcn.00503e6e
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x43374c
push esi
call fcn.00503e53
add esp, 4
pop esi
mov eax, 0xffffff98
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x54], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x40], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x4337a8
lea eax, [esi + 4]
mov dword [esi + 0x24], 0
push eax
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00431740
add esp, 4
test eax, eax
jne 0x4337a8
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov cl, byte [edi + 0x30]
mov dword [esi + 0x58], eax
and cl, 1
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x30]
shr eax, 3
mov byte [esi + 0x6c], cl
test al, 1
je 0x4337cc
mov al, byte [edi + 0x39]
jmp 0x4337cf
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov edx, 0xc
xor eax, eax
mov dword [esi + 0x70], 0x12345678
test cl, cl
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
cmovne eax, edx
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x7c], eax
test edx, edx
je 0x43384b
mov al, byte [edx]
test al, al
je 0x43384b
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5a28c8]
movzx eax, cl
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
mov dword [esi + 0x70], ecx
mov ecx, dword [esi + 0x78]
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5a28c8]
mov dword [esi + 0x78], ecx
add edx, 1
jne 0x433800
mov eax, dword [ebp - 8]
add eax, 0x1e
mov dword [edi + 0x7c], esi
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xffffff9a
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x434400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 1
cmp byte [esi], 0
je 0x434437
push 0
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xb]
push eax
push dword [esi + 4]
lea ebx, [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x434432
mov byte [ebx], 1
mov edi, dword [ebp - 4]
jmp 0x434464
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x434448
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp + 0xb]
push eax
call fcn.00500630
lea eax, [ebx + edi]
add esp, 0xc
mov dword [esi + 0x1c], eax
lea ebx, [esi + 8]
cmp edi, 1
jne 0x43447b
mov eax, dword [ebp + 0xc]
movzx ecx, byte [ebp + 0xb]
mov dword [eax], ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x434472
cmp byte [ebx], 0
je 0x434472
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4360e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4360ee
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x4361ad
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a31d8]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a31d8]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a31d8]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a31d8]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a31d8]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a31d8]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a31d8]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a31d8]
sub edi, 1
jne 0x436106
pop edi
test esi, esi
je 0x4361cb
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a31d8]
sub esi, 1
jne 0x4361b1
not eax
pop esi
pop ebp
ret
Function at 0x4366c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x4368cd
cmp eax, 3
jb 0x436736
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x436774
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x436774
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x43675d
mov dword [esi + 0x6afa0], eax
push ebx
push esi
call fcn.004377f0
mov ecx, dword [esi + 0x6af90]
mov edi, eax
add esp, 8
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x43684a
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
push eax
push ecx
push esi
call fcn.004364d0
mov ecx, dword [esi + 0x6af90]
add esp, 0xc
sub ecx, edi
mov dword [ebp + 8], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x436819
cmp ecx, 3
jb 0x436819
dec edi
nop word [eax + eax]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x4367c0
jmp 0x436867
add dword [esi + 0x6af84], edi
xor edi, edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
mov dword [esi + 0x6af7c], eax
jmp 0x436873
movzx eax, byte [ecx + esi + 0x1af70]
push eax
push 0
push esi
call fcn.004364d0
add esp, 0xc
mov dword [ebp + 8], eax
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
cmp dword [ebp + 8], 0
je 0x4368aa
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x43688d
lea ecx, [esi + 0x1af70]
add ecx, eax
jmp 0x43688f
xor ecx, ecx
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.00436a60
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x4368bf
push esi
call fcn.00436900
add esp, 4
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x4366e5
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x4368e1
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x4368e3
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 1
sub eax, ecx
push eax
push edx
push esi
call fcn.00436a60
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x438540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x84]
test ecx, ecx
je 0x4385a2
mov edx, dword [edi + 0x8c]
mov ebx, dword [edi + 0x88]
cmp edx, ebx
jae 0x4385e9
mov esi, dword [ebp + 8]
lea eax, [edx + ecx]
sub ebx, edx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call fcn.00500630
add dword [edi + 0x8c], ebx
add dword [edi + 0x74], ebx
push ebx
push esi
push dword [edi + 0x78]
call fcn.004360e0
add esp, 0x18
mov dword [edi + 0x78], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x4385e2
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4385e9
mov esi, dword [ebp - 4]
add dword [edi + 0x74], esi
push esi
push ebx
push dword [edi + 0x78]
call fcn.004360e0
add esp, 0xc
mov dword [edi + 0x78], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4389a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x438a75
mov ecx, dword [esi + 0x3c]
mov eax, ecx
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x4389d8
cmp dword [esi + 0x40], ebx
jae 0x4389d8
push ecx
call fcn.004ff256
add esp, 4
mov dword [esi + 0x3c], 0
jmp 0x4389dc
test eax, eax
jne 0x4389ee
lea eax, [ebx + ebx]
push eax
call fcn.004ff24d
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push eax
call fcn.00500630
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x438a72
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, ecx
or edi, 2
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x5a31d8]
movzx eax, cl
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
mov dword [esi + 0x30], ecx
mov ecx, edi
xor ecx, 1
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x5a31d8]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x438a02
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x438ab3
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x438a9a
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call fcn.00500630
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x438ad5
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x439380
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x62acc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 8]
push ecx
push 0
push eax
push 0x103
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00407c10
push dword [eax + 4]
push dword [eax]
call fcn.0050d829
push dword [ebp + 0x14]
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
call fcn.0042d590
mov eax, dword [edi + 0x14]
push str.DidPfdXO19a07m
add eax, 0x100
push eax
push 0
call fcn.00435460
mov esi, eax
add esp, 0x3c
test esi, esi
jne 0x43940c
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
push dword [edi]
lea eax, [ebp - 0x310]
push 0x6143e8
push 0x104
push eax
call fcn.00407c70
push dword [edi + 0x14]
lea eax, [ebp - 0x310]
push dword [edi + 0x18]
push eax
push esi
call fcn.00435a30
add esp, 0x20
test eax, eax
je 0x439486
push esi
call fcn.004302b0
add esp, 4
push esi
test al, al
je 0x439469
call fcn.0042f840
add esp, 4
mov eax, 0xfffffffe
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
call fcn.00435390
add esp, 4
mov eax, 0xfffffffe
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x318]
push eax
push esi
call fcn.00435a80
add esp, 0xc
test eax, eax
je 0x4394e9
push esi
call fcn.004302b0
add esp, 4
push esi
test al, al
je 0x4394cc
call fcn.0042f840
add esp, 4
mov eax, 0xfffffffd
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
call fcn.00435390
add esp, 4
mov eax, 0xfffffffd
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 0x314]
lea eax, [ebp - 0x108]
push dword [ebp - 0x318]
push eax
call fcn.0042e770
add esp, 0x10
push esi
cmp eax, dword [ebp - 0x314]
jae 0x43954d
call fcn.004302b0
add esp, 4
push esi
test al, al
je 0x439523
call fcn.0042f840
jmp 0x439528
call fcn.00435390
add esp, 4
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
mov eax, 0xfffffffd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
call fcn.004302b0
add esp, 4
push esi
test al, al
je 0x439561
call fcn.0042f840
jmp 0x439566
call fcn.00435390
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 0x314]
xor ecx, ebp
pop edi
pop esi
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
Function at 0x439580
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x62acc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
push str.DidPfdXO19a07m
add eax, 0x100
push eax
push 0
call fcn.00435460
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4395cf
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret 4
push dword [ebx]
lea eax, [ebp - 0x108]
push 0x6143e8
push 0x104
push eax
call fcn.00407c70
push dword [ebx + 0x14]
lea eax, [ebp - 0x108]
push dword [ebx + 0x18]
push eax
push esi
call fcn.00435a30
add esp, 0x20
test eax, eax
je 0x43962d
push esi
call fcn.004302b0
add esp, 4
push esi
test al, al
je 0x43961e
call fcn.0042f840
mov eax, 0xfffffffe
jmp 0x43970e
call fcn.00435390
mov eax, 0xfffffffe
jmp 0x43970e
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
call fcn.00435a80
add esp, 0xc
test eax, eax
je 0x439674
push esi
call fcn.004302b0
add esp, 4
push esi
test al, al
je 0x439665
call fcn.0042f840
mov eax, 0xfffffffd
jmp 0x43970e
call fcn.00435390
mov eax, 0xfffffffd
jmp 0x43970e
push 0
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
push edi
call fcn.0042e770
add esp, 0x10
push esi
cmp eax, dword [ebp - 0x10c]
jae 0x4396ef
call fcn.004302b0
add esp, 4
push esi
test al, al
je 0x4396c8
call fcn.0042f840
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret 4
call fcn.00435390
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret 4
call fcn.004302b0
add esp, 4
push esi
test al, al
je 0x439703
call fcn.0042f840
jmp 0x439708
call fcn.00435390
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret 4