joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56ea30
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
cmp dword [0x666d84], 0
jne 0x56eaa9
mov esi, esp
push 0
push 1
push 0
push 0
push 0x666d80
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cmp esi, esp
call fcn.004a7520
test eax, eax
jne 0x56eaa9
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004a7520
cmp eax, 0x80090016
jne 0x56eaa9
mov esi, esp
push 8
push 1
push 0
push 0
push 0x666d80
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cmp esi, esp
call fcn.004a7520
mov eax, dword [0x666d84]
add eax, 1
mov dword [0x666d84], eax
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.004a7520
mov esp, ebp
pop ebp
ret
Function at 0x40121c
Capabilities:
Delete directory
Delete file

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.0040127d
mov ecx, esi
call fcn.00401292
mov edi, eax
test edi, edi
jne 0x401255
mov ecx, esi
call fcn.0040142b
mov edi, eax
test edi, edi
jne 0x401255
mov ecx, esi
call fcn.004016d8
mov edi, eax
test edi, edi
jne 0x401255
mov ecx, esi
call fcn.00401852
mov edi, eax
cmp dword [0x409c38], 0
jne 0x401278
lea eax, [esi + 0x1210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0x1314
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, edi
pop edi
pop esi
ret
Function at 0x4016d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebp, ebp
push dword [esi + 0x1420]
call fcn.00401cf3
pop ecx
lea edi, [esi + 0x1418]
push ebp
mov ebx, eax
push dword [esi + 0x141c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll__llseek]
push dword [esi + 0x1420]
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, dword [esi + 0x1420]
jne 0x401769
lea eax, [esi + 0x1210]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
cmp eax, 0xffffffff
mov dword [esi + 0x1424], eax
jne 0x401746
lea eax, [esi + 4]
push str.Unable_to_open_setup_file
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x37
jmp 0x40177a
xor eax, eax
xor byte [eax + ebx], 7
inc eax
cmp eax, 0x7d0
jl 0x401748
push dword [esi + 0x1420]
push ebx
push dword [esi + 0x1424]
call dword [sym.imp.KERNEL32.dll__lwrite]
jmp 0x40177b
lea eax, [esi + 4]
push str.Failed_to_read_setup_engine
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x36
pop ebp
push ebx
call fcn.00401c0a
mov esi, dword [esi + 0x1424]
pop ecx
cmp esi, 0xffffffff
je 0x401794
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x40179b
Capabilities:
Create directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 1
push edi
call esi
cmp byte [eax + edi - 1], 0x5c
je 0x4017cd
push 0x4071b0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call esi
mov ebx, eax
xor esi, esi
push 0x104
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00401b70
add esp, 0xc
cmp ebx, 2
jle 0x401845
cmp byte [edi + 1], 0x3a
jne 0x401845
test ebx, ebx
jle 0x401848
lea eax, [ebp - 0x108]
sub edi, eax
cmp dword [ebp - 4], 0
je 0x401848
lea eax, [ebp + esi - 0x108]
mov cl, byte [edi + eax]
cmp cl, 0x5c
mov byte [eax], cl
jne 0x40183e
cmp esi, 2
je 0x40183e
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x40183e
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 4], eax
inc esi
cmp esi, ebx
jl 0x401800
jmp 0x401848
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x401852
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push ebx
push esi
push edi
mov esi, ecx
push 0x10
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x6c]
mov dword [ebp - 0x70], ebx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
lea eax, [ebp - 0x70]
pop edi
push edi
push ebx
push eax
call fcn.00401b70
push 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.00401b70
mov eax, dword [esi + 0x1420]
add esp, 0x18
add eax, dword [esi + 0x141c]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x3c], ebx
push eax
lea eax, [ebp - 0x194]
push str.__IRAOFF:_u
push eax
mov word [ebp - 0x3e], bx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esi + 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
je 0x4018ef
lea eax, [esi + 0x804]
push 0x407218
push eax
call edi
lea eax, [ebp - 0x194]
push eax
lea eax, [esi + 0x804]
push eax
call edi
lea eax, [esi + 0x110c]
push eax
lea eax, [ebp - 0x194]
push str.___IRAFN:_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esi + 0x804]
push 0x407218
push eax
call edi
lea eax, [ebp - 0x194]
push eax
lea eax, [esi + 0x804]
push eax
call edi
cmp dword [0x409c38], ebx
je 0x401957
lea eax, [esi + 0x1210]
push ebx
push eax
lea eax, [esi + 0x804]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [esi + 0x1314]
push eax
push ebx
push 0x20
push ebx
push ebx
lea eax, [esi + 0x804]
push ebx
push eax
lea eax, [esi + 0x1210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40199b
add esi, 4
push str.Could_not_start_the_setup
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x37
pop edi
jmp 0x401a3a
cmp dword [esi + 0x1108], ebx
je 0x401a06
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0xff
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push ebx
push eax
push 1
call edi
cmp eax, 1
jne 0x401a06
push 1
push ebx
push ebx
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jle 0x4019f6
cmp dword [ebp - 0x28], 0xf
je 0x4019e0
cmp dword [ebp - 0x28], 0x200
jne 0x4019be
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4019be
push 0xff
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push ebx
push eax
push 1
jmp 0x4019b7
lea edi, [esi + 0x1428]
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edi, dword [edi]
cmp edi, 0x103
jne 0x401a2a
cmp dword [esi + 0x1108], ebx
jne 0x401a2a
xor edi, edi
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403b52
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4093e8
cmp edx, dword [eax]
je 0x403b74
add eax, 8
inc ecx
cmp eax, 0x409478
jl 0x403b65
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4093e8]
jne 0x403ca2
mov eax, dword [0x409c88]
cmp eax, 1
je 0x403c7c
test eax, eax
jne 0x403ba5
cmp dword [0x407234], 1
je 0x403c7c
cmp edx, 0xfc
je 0x403ca2
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403bdc
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004047d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004048c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x403c1f
lea eax, [ebp - 0x1a4]
push eax
call fcn.004048c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x406488
push edi
call fcn.00404e40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004047d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004047e0
lea eax, [ebp - 0xa0]
push 0x406468
push eax
call fcn.004047e0
push dword [esi + 0x4093ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.004047e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00404db2
add esp, 0x2c
pop edi
jmp 0x403ca2
lea eax, [ebp + 8]
lea esi, [esi + 0x4093ec]
push 0
push eax
push dword [esi]
call fcn.004048c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40175b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
lea eax, [ebp - 0x104]
push edi
push 0x104
push 0
push eax
call fcn.00405bd0
add esp, 0xc
lea eax, [ebp - 0x208]
push 0x104
push eax
push dword [0x40a10c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x104]
push ecx
push 0xe4
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4017b1
cmp eax, 0xe4
jbe 0x4017c7
push 0x415080
lea eax, [ebp - 0x104]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
jmp 0x4017cd
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
call edi
test eax, eax
jg 0x40183e
mov al, byte [ebp - 0x208]
or al, 0x20
cmp al, 0x63
jge 0x4017fc
push 0x415084
lea eax, [ebp - 0x104]
push eax
call esi
jmp 0x40183e
push 0
lea eax, [ebp - 0x104]
push 0
lea ecx, [ebp - 0x208]
push 0
push eax
push ecx
call fcn.00405c12
add esp, 0x14
lea ecx, [ebp - 0x104]
push 0
push 0
push ecx
call edi
lea ecx, [ebp + eax - 0x104]
lea edx, [ebp - 0x208]
push ecx
push 0
push edx
call fcn.00405c12
add esp, 0x14
lea eax, [ebp - 0x104]
push eax
call edi
test eax, eax
jle 0x401870
lea eax, [ebp - 0x104]
push eax
call edi
cmp byte [ebp + eax - 0x105], 0x5c
je 0x401870
push 0x415088
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call esi
lea ecx, [ebp - 0x104]
push ecx
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40209a
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor esi, esi
push ebp
xor edi, edi
cmp dword [esp + 0x18], esi
je 0x402109
push edi
mov eax, dword [0x412b4c]
push edi
push eax
push dword [0x412b64]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4020c9
mov edi, 1
call fcn.00401f36
test eax, eax
je 0x402120
call fcn.00401fca
test eax, eax
je 0x402120
mov dword [0x413024], 0
mov byte [0x40a7a0], 0
push 0x24
push 0
push 0x412ff0
call fcn.00405bd0
mov dword [0x40a8b0], 0
add esp, 0xc
jmp 0x402125
push 0
mov eax, dword [0x412b64]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x402125
mov edi, 1
test edi, edi
jne 0x4022d6
cmp dword [0x413154], 0
je 0x4022d6
cmp dword [0x40a8ac], 0
je 0x4022d6
test edi, edi
jne 0x4022d6
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, word [0x412b46]
cmp eax, dword [0x40a8b0]
jle 0x4022d6
lea eax, [esp + 0x10]
push 0
push eax
push 0x2e
push 0x40a760
push dword [0x412b64]
call ebx
mov ecx, dword [0x412ecc]
cmp eax, 1
jne 0x4022c9
cmp dword [esp + 0x10], 0x2e
jne 0x4022c9
cmp dword [0x40a760], 0x2014b50
jne 0x4022a9
movsx edx, word [0x40a77c]
movsx eax, word [0x40a77e]
add edx, eax
push 2
movsx eax, word [0x40a780]
lea ebp, [edx + eax]
mov eax, dword [0x413154]
lea ecx, [ebp + ecx + 0x2e]
push ecx
mov dword [0x412ecc], ecx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
test eax, eax
je 0x4022a2
push eax
mov dword [0x413154], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [0x413028], eax
test eax, eax
je 0x40229b
mov eax, dword [0x40a8b0]
push eax
push dword [0x40a8ac]
call fcn.00401c3d
add esp, 8
mov ecx, dword [0x413028]
add ecx, eax
push 0x2e
push 0x40a760
mov dword [0x413028], ecx
push ecx
call fcn.00405f64
lea ecx, [esp + 0x1c]
add esp, 0xc
mov eax, dword [0x413028]
push 0
add eax, 0x2e
push ecx
push ebp
mov dword [0x413028], eax
push eax
push dword [0x412b64]
call ebx
test eax, eax
je 0x402279
cmp ebp, dword [esp + 0x10]
jne 0x402279
inc esi
mov eax, dword [0x412ecc]
push eax
inc dword [0x40a8b0]
push dword [0x40a8b0]
push dword [0x40a8ac]
call fcn.00401c67
add esp, 0xc
jmp 0x402283
mov esi, 0xffffffff
mov edi, 1
mov eax, dword [0x413154]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x413028], 0
jmp 0x4022ce
mov esi, 0xffffffff
jmp 0x4022c9
mov esi, 0xffffffff
jmp 0x4022c9
cmp dword [0x40a760], 0x4034b50
jne 0x4022c9
cmp word [0x412b46], 0x7fff
jne 0x4022c9
mov word [0x412b46], 0
mov edi, 1
test edi, edi
je 0x402155
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x4025a3
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
push 0x415220
call fcn.0040443d
mov esi, dword [esp + 0x14]
add esp, 4
movzx edi, byte [esi + ebx]
inc ebx
call fcn.004043bb
xor edi, eax
push edi
call fcn.004043d4
add esp, 4
cmp ebx, 0xc
jl 0x4025b9
test byte [0x412c86], 8
je 0x4025eb
mov ax, word [0x412c8a]
shr ax, 8
movzx eax, ax
jmp 0x4025f6
mov eax, dword [0x40a770]
shr eax, 0x10
movzx eax, ah
movzx ecx, di
cmp ecx, eax
je 0x402604
mov eax, 0xffffffff
jmp 0x40264d
mov eax, dword [0x412b3c]
cmp dword [0x40a904], eax
jge 0x402619
mov esi, dword [0x40a904]
jmp 0x40261f
mov esi, dword [0x412b3c]
mov edi, dword [0x412ed0]
mov eax, esi
dec esi
test eax, eax
je 0x40264b
call fcn.004043bb
mov ebx, eax
movzx eax, byte [edi]
xor ebx, eax
push ebx
call fcn.004043d4
add esp, 4
mov eax, esi
dec esi
mov byte [edi], bl
inc edi
test eax, eax
jne 0x40262c
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x4026ab
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov eax, dword [0x412c92]
mov ebp, esp
mov dword [0x40a904], eax
sub esp, 4
mov eax, dword [0x412c96]
mov dword [0x41528c], 0
push esi
mov dword [0x40a8b8], eax
test byte [0x412c86], 8
push edi
je 0x402708
mov eax, dword [0x40a770]
mov ecx, dword [0x40a774]
mov edx, dword [0x40a778]
mov dword [0x412c8e], eax
mov dword [0x412c92], ecx
mov dword [0x412c96], edx
mov dword [0x40a904], ecx
mov dword [0x40a8b8], edx
movsx ecx, word [0x412c9a]
movsx eax, word [0x412c9c]
add ecx, eax
mov edx, dword [0x40a78a]
lea edi, [ecx + edx + 0x1e]
mov ecx, 0x2800
mov eax, edi
cdq
idiv ecx
mov esi, edx
mov eax, edi
sub eax, esi
test edi, edi
jl 0x402859
push 0
push 0
push eax
push dword [0x412b68]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 4]
push ecx
mov dword [0x413030], eax
push 0x2800
mov eax, dword [0x412b38]
push eax
push dword [0x412b68]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40284f
cmp dword [ebp - 4], 0
je 0x40284f
mov eax, dword [0x412b38]
add eax, esi
mov dword [0x412ed0], eax
mov eax, dword [ebp - 4]
and eax, 0xffff
sub eax, esi
test byte [0x40a786], 8
mov dword [0x412b3c], eax
je 0x4027ad
mov eax, 0x2e
jmp 0x40285e
cmp dword [0x41521c], 0
je 0x4027c3
call fcn.00402651
test eax, eax
jne 0x40285e
mov ecx, dword [0x415100]
test ecx, ecx
jne 0x4027eb
cmp dword [0x4150b8], 0
jne 0x4027eb
push dword [ebp + 8]
call fcn.00404479
add esp, 4
mov esi, eax
mov ecx, dword [0x415100]
jmp 0x4027f7
mov dword [0x412ca8], 0xffffffff
xor esi, esi
test esi, esi
jne 0x402815
call fcn.00404194
mov esi, eax
mov ecx, dword [0x415100]
test esi, esi
jne 0x402815
cmp dword [0x415094], 0
je 0x40284b
cmp dword [0x412ca8], 0xffffffff
je 0x402830
mov eax, dword [0x412ca8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x415100]
test ecx, ecx
jne 0x40284b
cmp dword [0x4150b8], 0
jne 0x40284b
cmp esi, 0x32
jne 0x40284b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
jmp 0x40285e
mov dword [0x412b3c], 0
mov eax, 3
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40397c
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
cmp dword [0x412b54], 0
push esi
je 0x403990
xor eax, eax
jmp 0x403acd
push dword [esp + 0xc]
mov esi, 0xffffffff
mov dword [0x412ec8], esi
call fcn.004019c0
add esp, 4
cmp eax, 0xfffffffd
jne 0x4039ee
mov word [0x412b40], si
xor eax, eax
mov word [0x412b42], ax
mov dword [0x412b48], eax
mov word [0x412b44], ax
mov dword [0x412b4c], eax
mov dword [0x412b54], 1
mov word [0x412b46], 0x7fff
mov word [0x412b50], ax
call fcn.00401e43
jmp 0x403acd
cmp eax, 0xfffffffc
jne 0x4039ff
mov ecx, 2
mov esi, 5
jmp 0x403a17
cmp eax, 0xffffffff
jne 0x403a10
mov ecx, 2
mov esi, 3
jmp 0x403a17
mov ecx, 1
xor esi, esi
cmp ecx, 1
jne 0x403a34
mov ecx, 2
cmp eax, 0xffffffff
jne 0x403a2d
mov esi, 3
jmp 0x403a2f
xor esi, esi
cmp ecx, 1
je 0x403a1c
test esi, esi
jne 0x403acb
push 0
mov dword [0x412ec8], eax
push 0
add eax, 4
push eax
push dword [0x412b64]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 4]
push 0
push ecx
push 0x12
push 0x412b40
push dword [0x412b64]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403abc
cmp dword [esp + 4], 0
je 0x403abc
mov dword [0x412b54], 1
cmp word [0x412b40], 0
jne 0x403ac6
mov ax, word [0x412b40]
cmp word [0x412b42], ax
je 0x403acb
mov ax, word [0x412b46]
cmp word [0x412b44], ax
jne 0x403acb
xor eax, eax
mov word [0x412b40], ax
mov word [0x412b42], ax
jmp 0x403acb
mov dword [0x412ec8], 0xffffffff
mov esi, 3
mov eax, esi
pop esi
add esp, 4
ret

Function at 0x4043d4
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [0x40a750]
xor ecx, dword [esp + 4]
and ecx, 0xff
mov eax, dword [ecx*4 + 0x4155d0]
mov ecx, dword [0x40a750]
shr ecx, 8
xor eax, ecx
mov dword [0x40a750], eax
and eax, 0xff
add dword [0x40a754], eax
mov eax, dword [0x40a754]
imul eax, eax, 0x8088405
inc eax
mov ecx, dword [0x40a758]
shr ecx, 8
mov dword [0x40a754], eax
shr eax, 0x18
xor eax, dword [0x40a758]
and eax, 0xff
mov eax, dword [eax*4 + 0x4155d0]
xor eax, ecx
mov dword [0x40a758], eax
ret

Function at 0x404479
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
cmp dword [0x415098], 0
push esi
mov esi, dword [esp + 8]
je 0x4044ba
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4044ba
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x4044b3
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4044ba
mov eax, 0x1c
jmp 0x4044e1
mov eax, 0x1c
jmp 0x4044e1
push 0
push 0x8000020
push 2
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x412ca8], eax
inc eax
cmp eax, 1
sbb eax, eax
and eax, 0x1c
pop esi
ret
Function at 0x4044e3
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
sub esp, 4
mov eax, dword [0x40a904]
dec dword [0x40a904]
push ebx
push esi
test eax, eax
push edi
jg 0x4044ff
xor eax, eax
jmp 0x4045d5
cmp dword [0x412b3c], 0
jne 0x4045b4
lea eax, [esp + 0xc]
push 0
push eax
push 0x2800
push dword [0x412b38]
push dword [0x412b68]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x40453f
mov eax, dword [esp + 0xc]
and eax, 0xffff
mov dword [0x412b3c], eax
jmp 0x404549
mov dword [0x412b3c], 0xffffffff
cmp dword [0x412b3c], 0
jg 0x404556
xor eax, eax
jmp 0x4045d5
add dword [0x413030], 0x2800
cmp dword [0x41521c], 0
mov eax, dword [0x412b38]
mov dword [0x412ed0], eax
je 0x4045b4
mov edi, dword [0x40a904]
inc edi
cmp dword [0x412b3c], edi
jg 0x404588
mov edi, dword [0x412b3c]
mov esi, dword [0x412b38]
mov eax, edi
dec edi
test eax, eax
je 0x4045b4
call fcn.004043bb
movzx ecx, byte [esi]
xor eax, ecx
push eax
mov ebx, eax
call fcn.004043d4
add esp, 4
mov eax, edi
dec edi
mov byte [esi], bl
inc esi
test eax, eax
jne 0x404595
mov eax, dword [0x412ed0]
mov edx, dword [esp + 0x14]
movzx cx, byte [eax]
mov word [edx], cx
mov eax, 8
inc dword [0x412ed0]
dec dword [0x412b3c]
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x4045dc
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
cmp dword [0x412c74], 0
push ebx
push esi
push edi
push ebp
je 0x404617
mov eax, dword [0x41301c]
mov ecx, dword [0x413018]
add dword [0x413038], eax
mov dword [0x413040], ecx
mov dword [0x41301c], 0
mov eax, 0x32
jmp 0x404896
cmp dword [0x41301c], 0
je 0x404894
cmp dword [0x4150b8], 0
mov esi, dword [0x41301c]
jne 0x40464e
mov eax, dword [0x41302c]
add eax, esi
cmp eax, dword [0x40a8b8]
jle 0x40464e
mov esi, dword [0x40a8b8]
sub esi, dword [0x41302c]
test esi, esi
jg 0x4046bd
cmp dword [0x4150b8], 0
jne 0x4046a7
mov eax, 1
mov dword [0x415094], eax
mov dword [0x4150ac], eax
mov eax, dword [0x41301c]
mov ecx, dword [0x413018]
add dword [0x413038], eax
mov dword [0x413040], ecx
mov dword [0x41301c], 0
cmp dword [0x4150b8], 0
je 0x404880
mov eax, dword [0x4150c8]
mov dword [0x41302c], eax
jmp 0x404886
mov dword [0x415094], 1
mov dword [0x412c74], 2
jmp 0x40466a
push esi
mov eax, dword [0x413018]
push eax
call fcn.00405b90
add esp, 8
cmp dword [0x415100], 0
jne 0x4047bc
cmp dword [0x4150b8], 0
jne 0x4047c9
cmp dword [0x41315c], 0x4000
jne 0x404771
mov edi, dword [0x41303c]
mov ebx, esi
mov byte [esp + 0x12], 0xd
mov byte [esp + 0x13], 0xa
xor ebp, ebp
test esi, esi
jle 0x40466a
test ebp, ebp
jne 0x40466a
xor ebp, ebp
cmp byte [edi], 0xa
jne 0x404740
lea eax, [esp + 0x14]
push ebp
lea ecx, [esp + 0x16]
push eax
push 2
push ecx
push dword [0x412ca8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404761
cmp dword [esp + 0x14], ebp
jmp 0x40475f
lea eax, [esp + 0x14]
push 0
push eax
push 1
push edi
push dword [0x412ca8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404761
cmp dword [esp + 0x14], 0
ja 0x404766
mov ebp, 1
inc edi
dec ebx
test ebx, ebx
jg 0x40470e
jmp 0x40466a
mov edi, esi
push 0
lea eax, [esp + 0x18]
push eax
push edi
push dword [0x41303c]
mov eax, dword [0x412ca8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40479b
cmp dword [esp + 0x14], edi
je 0x40466a
cmp dword [0x4150f4], 0
jne 0x40466a
mov dword [0x412c74], 2
mov eax, 0x32
jmp 0x404896
cmp dword [0x4150b8], 0
je 0x40466a
mov ecx, dword [0x41303c]
mov edx, dword [0x4150c8]
add edx, dword [0x4150c4]
mov eax, dword [0x4150bc]
mov edi, eax
cmp dword [0x40a8b8], eax
jge 0x4047f6
mov edi, dword [0x40a8b8]
sub edi, dword [0x4150c0]
test esi, esi
jle 0x40466a
mov eax, dword [0x4150c0]
cmp dword [0x4150cc], eax
jl 0x40482f
mov eax, dword [0x4150bc]
cmp dword [0x4150c8], eax
jge 0x40485e
cmp dword [0x4150c8], edi
jge 0x40484d
mov al, byte [ecx]
dec esi
inc ecx
mov byte [edx], al
inc edx
inc dword [0x4150c8]
jmp 0x404844
mov eax, dword [0x412c96]
inc dword [0x4150cc]
cmp dword [0x4150cc], eax
jge 0x40486f
dec esi
inc ecx
test esi, esi
jg 0x4047fe
jmp 0x40466a
mov dword [0x412c74], 3
mov eax, 2
jmp 0x404896
mov dword [0x412c74], 2
mov eax, 0x32
jmp 0x404896
mov dword [0x412c74], 3
mov eax, 2
jmp 0x404896
add dword [0x41302c], esi
mov eax, dword [0x41302c]
push eax
call fcn.00403b09
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x40489e
Capabilities:
Set file attributes

Disassembly:
push ebp
mov eax, dword [0x412ca8]
mov ebp, esp
sub esp, 0x10
cmp eax, 0xffffffff
push esi
push edi
je 0x4048c5
push eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov dword [0x412ca8], 0xffffffff
jmp 0x4048cb
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov cx, word [0x412c8a]
lea eax, [ebp - 0x10]
mov dx, word [0x412c8c]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea ecx, [ebp - 8]
lea edx, [ebp - 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
push 0
push 0x8000080
push 3
push 0
push 0
push 0x40000000
push 0x412cb0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov edi, eax
je 0x40493a
mov eax, dword [0x413034]
or al, 0x20
push eax
push 0x412cb0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 8]
push ecx
push ecx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret