joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425280
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b71bd
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 1
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push ecx
cmovae eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x425308
mov eax, dword [esi]
jmp 0x42530a
mov eax, esi
xor edi, edi
mov word [eax], di
mov dword [ebp - 0x2c], 1
test edx, edx
jne 0x425405
cmp ecx, 0x40000000
ja 0x425405
test edx, edx
jne 0x4253c8
cmp ecx, 0x100000
ja 0x4253c8
test edx, edx
jne 0x425385
cmp ecx, 0x400
ja 0x425385
call fcn.00573690
cvtsd2ss xmm0, xmm0
sub esp, 8
lea eax, [ebp - 0x44]
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
push str._.2f_B
push eax
call fcn.00434960
add esp, 0x10
mov ecx, esi
push eax
call fcn.0042c990
lea ecx, [ebp - 0x44]
call fcn.004236e0
jmp 0x425497
call fcn.00573690
cvtsd2ss xmm0, xmm0
sub esp, 8
lea eax, [ebp - 0x44]
cvtss2sd xmm0, xmm0
mulsd xmm0, qword [0x61e128]
movsd qword [esp], xmm0
push str._.2f_KB
push eax
call fcn.00434960
add esp, 0x10
mov ecx, esi
push eax
call fcn.0042c990
lea ecx, [ebp - 0x44]
call fcn.004236e0
jmp 0x425497
call fcn.00573690
cvtsd2ss xmm0, xmm0
lea eax, [ebp - 0x44]
sub esp, 8
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
mulsd xmm1, qword [0x61e128]
mulsd xmm1, qword [0x61e128]
movsd qword [esp], xmm1
push str._.2f_MB
push eax
call fcn.00434960
add esp, 0x10
mov edi, eax
jmp 0x425444
call fcn.00573690
cvtsd2ss xmm0, xmm0
lea eax, [ebp - 0x44]
sub esp, 8
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
movsd xmm0, qword [0x61e128]
mulsd xmm1, xmm0
mulsd xmm1, xmm0
mulsd xmm1, xmm0
movsd qword [esp], xmm1
push str._.2f_GB
push eax
call fcn.00434960
add esp, 0x10
mov edi, eax
cmp esi, edi
je 0x425482
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x42545b
inc ecx
push ecx
push dword [esi]
mov ecx, esi
call fcn.00423720
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x425473
mov eax, dword [esi]
jmp 0x425475
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push edi
call fcn.004230a0
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x425497
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00423720
mov ecx, dword [ebp + 0x20]
cmp ecx, 8
jb 0x4254ac
inc ecx
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00423720
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057277e
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4276f0
Capabilities:
Create shortcut via ishelllink
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b7590
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0
mov dword [ebp - 4], 1
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
cmp dword [esi + 0x14], 8
jb 0x427742
mov eax, dword [esi]
jmp 0x427744
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x14]
push eax
push 0x5be870
push 1
push 0
push 0x5be8e0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x42778e
cmp dword [edi + 0x14], 8
jb 0x42776f
mov edi, dword [edi]
mov eax, dword [ebp - 0x14]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push edx
push 0x5be900
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jns 0x42779e
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor bl, bl
jmp 0x4277d2
cmp dword [esi + 0x14], 8
jb 0x4277a6
mov esi, dword [esi]
mov eax, dword [ebp - 0x18]
push 2
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov bl, 1
mov eax, dword [ebp + 0x28]
cmp eax, 8
jb 0x4277e7
inc eax
lea ecx, [ebp + 0x14]
push eax
push dword [ebp + 0x14]
call fcn.00423720
mov ecx, dword [ebp + 0x40]
xor eax, eax
mov dword [ebp + 0x28], 7
mov dword [ebp + 0x24], 0
mov word [ebp + 0x14], ax
cmp ecx, 8
jb 0x427810
inc ecx
push ecx
push dword [ebp + 0x2c]
lea ecx, [ebp + 0x2c]
call fcn.00423720
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057277e
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x42caf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x42cb09
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x42cb46
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x42cb42
nop word [eax + eax]
cmp esi, edx
jae 0x42cb46
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x42cb30
cmp esi, edx
jb 0x42cb4d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42e3a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b7f69
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x63406c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 0x58
call fcn.0057279d
mov esi, eax
mov dword [ebp - 0x14], esi
push 0x58
push 0
push esi
mov dword [ebp - 4], 0
call fcn.0058b610
mov dword [esi + 0x10], 0x61c7dc
mov dword [esi + 0x4c], vtable.nbase::SupportWeakCallback.0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
add esp, 0xc
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp - 0x10], 1
push str.Global_Chores_Thread
call fcn.00439650
mov eax, dword [esi + 0x10]
mov dword [esi], vtable.MiscThread.1.0
mov eax, dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov dword [eax + esi + 0x10], vtable.MiscThread.0
mov dword [esi + 0x48], 1
mov ecx, dword [edi + 0x48]
mov dword [edi + 0x48], esi
test ecx, ecx
je 0x42e465
mov eax, dword [ecx]
push 1
call dword [eax]
mov esi, dword [edi + 0x48]
cmp dword [esi + 0x1c], 0
jne 0x42e496
mov ecx, esi
mov dword [esi + 0x18], 0
mov dword [esi + 0x28], 0
call fcn.0043a0f0
test al, al
je 0x42e496
push 0xffffffffffffffff
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [esi + 0x14], 1
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x640860]
cmp eax, dword [ecx + 4]
jle 0x42e4eb
push 0x640860
call fcn.00572bba
add esp, 4
cmp dword [0x640860], 0xffffffff
jne 0x42e4eb
mov dword [ebp - 4], 2
call fcn.00436bf0
push 0x5bdc30
call fcn.00572a71
push 0x640860
mov dword [ebp - 4], 0xffffffff
call fcn.00572b7b
add esp, 8
push 0
call fcn.00436c70
push dword [0x640690]
call fcn.00447049
add esp, 4
push 0x61c744
push 0x82
push dword [0x640690]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [0x640690]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [0x640690]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
call fcn.00447275
push 0x554
call fcn.0057279d
mov esi, eax
mov dword [ebp - 0x14], esi
push 0x554
push 0
push esi
mov dword [ebp - 4], 3
call fcn.0058b610
add esp, 0x18
mov ecx, esi
call fcn.00423b90
push 0
push accept
push accept
push accept
push accept
push 0x100
push 0x96c80000
mov esi, eax
mov dword [ebp - 4], 0xffffffff
push 0x61c74c
push 0
mov ecx, esi
call fcn.00448a0f
push 0x6b
mov ecx, esi
call fcn.00448de8
mov ecx, esi
call fcn.004488bb
push 1
push 1
mov ecx, esi
call fcn.00448f5f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42e5d0
Capabilities:
Get thread local storage value
Terminate process
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
call fcn.004474a3
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [edi + 0x48]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 8]
test eax, eax
je 0x42e61d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x42e60a
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [esi + 8]
call ebx
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov esi, dword [edi + 0x48]
cmp byte [esi + 0x14], 0
je 0x42e675
mov ecx, esi
call fcn.00439930
mov eax, dword [esi + 8]
test eax, eax
je 0x42e66f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42e65c
mov eax, dword [esi + 8]
test eax, eax
je 0x42e66f
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x42e65c
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [esi + 8]
call ebx
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov word [esi + 0x14], 0
mov ecx, dword [edi + 0x48]
mov dword [edi + 0x48], 0
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x42e68c
mov eax, dword [ecx]
push 1
call dword [eax]
call fcn.00439c40
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42e6a1
mov byte [eax + 4], 1
jmp fcn.00437040
Function at 0x42f230
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b809f
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x44], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x14], 7
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x48], eax
mov dword [eax + 0x10], 0
jb 0x42f291
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], ecx
pushal
mov ebx, dword fs:[0x18]
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xa8]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], eax
popal
cmp dword [ebp - 0x38], 5
jl 0x42f38c
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42f2f4
lea ecx, [ebp - 0x34]
push ecx
call eax
jmp 0x42f2fe
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x34]
cmp ax, 9
je 0x42f313
cmp ax, 6
mov eax, 0x20
jne 0x42f318
mov eax, 0x40
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x60]
push dword [ebp - 0x38]
push str.w_02d_02dx_d
push eax
call fcn.00434960
add esp, 0x14
mov esi, eax
mov ebx, dword [ebp - 0x40]
cmp ebx, esi
je 0x42f373
mov eax, dword [ebx + 0x14]
cmp eax, 8
jb 0x42f34c
inc eax
mov ecx, ebx
push eax
push dword [ebx]
call fcn.00423720
mov dword [ebx + 0x14], 7
cmp dword [ebx + 0x14], 8
mov dword [ebx + 0x10], 0
jb 0x42f364
mov eax, dword [ebx]
jmp 0x42f366
mov eax, ebx
xor ecx, ecx
mov word [eax], cx
mov ecx, ebx
push esi
call fcn.004230a0
mov ecx, dword [ebp - 0x4c]
cmp ecx, 8
jb 0x42f388
inc ecx
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x60]
call fcn.00423720
mov eax, ebx
jmp 0x42f38f
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057277e
mov esp, ebp
pop ebp
ret
Function at 0x431650
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x43165b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x431717
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
sub edi, 1
jne 0x431670
pop edi
test esi, esi
je 0x43173a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
sub esi, 1
jne 0x431720
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x431e50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x431e96
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x431e91
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x431ebe
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x431ea7
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 8]
call fcn.0058bc30
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
mov ecx, dword [ebp - 4]
xor edx, edx
pop edi
div ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0057277e
mov esp, ebp
pop ebp
ret
Function at 0x431ee0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
mov edi, 1
cmp byte [esi], 0
je 0x431f25
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 5]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x431f20
mov byte [esi + 8], 1
mov edi, dword [ebp - 0xc]
jmp 0x431f52
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x431f36
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 5]
push eax
call fcn.0058bc30
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 0xc]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x431f70
movzx eax, byte [ebp - 5]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057277e
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x431f5d
cmp byte [esi + 8], 0
je 0x431f5d
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057277e
mov esp, ebp
pop ebp
ret
Function at 0x432030
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x432079
cmp byte [edi + 1], 0
je 0x432067
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x43207f
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057277e
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], eax
cmp byte [edi], 0
push ebx
je 0x4320a2
cmp byte [edi + 1], 0
je 0x43209b
push 1
push 0
push 0
push dword [edi + 4]
call ecx
sub eax, dword [edi + 0xc]
jmp 0x4320a5
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4320b4
mov eax, dword [edi + 0x1c]
mov ebx, 0xffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ebx
cmp eax, ebx
jae 0x4320b9
mov ebx, eax
mov dword [ebp - 0x18], eax
push esi
push 0x404
call fcn.0058f738
mov esi, eax
add esp, 4
test esi, esi
jne 0x4320e1
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057277e
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0xc], 0xffffffff
cmp ebx, eax
jbe 0x4321d9
mov edx, dword [ebp - 0x10]
add eax, 0x400
cmp eax, ebx
mov ecx, eax
mov eax, 0x404
cmova ecx, ebx
sub edx, ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x404
mov dword [ebp - 0x1c], edx
mov ebx, ecx
cmova ebx, eax
cmp byte [edi], 0
je 0x432140
cmp byte [edi + 1], 0
je 0x4321d9
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x432143
mov dword [edi + 0x1c], edx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0x14], ebx
je 0x43216b
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x432166
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x432194
mov edx, dword [edi + 0x1c]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
jbe 0x43217e
mov ecx, dword [edi + 0x18]
sub ecx, edx
mov dword [ebp - 0x14], ecx
push ecx
mov ecx, dword [edi + 0x14]
add ecx, edx
push ecx
push esi
call fcn.0058bc30
mov eax, dword [ebp - 0x14]
add esp, 0xc
add dword [edi + 0x1c], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x4321d9
lea eax, [ebx - 3]
test eax, eax
js 0x4321c4
dec eax
cmp byte [eax + esi], 0x50
jne 0x4321c0
cmp byte [eax + esi + 1], 0x4b
jne 0x4321c0
cmp byte [eax + esi + 2], 5
jne 0x4321c0
cmp byte [eax + esi + 3], 6
je 0x4321f6
test eax, eax
jns 0x4321a4
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4321d9
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x18]
cmp eax, ebx
jb 0x4320f5
push esi
call fcn.0058f733
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 0xc]
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.0057277e
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
jmp 0x4321c7
Function at 0x432bc0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
jne 0x432bdb
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x18], 0
je 0x432bd0
cmp dword [edi + 0x7c], 0
je 0x432bec
call fcn.00433030
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.00432930
add esp, 8
test eax, eax
je 0x432c10
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.0058f738
mov esi, eax
add esp, 4
test esi, esi
je 0x432c53
push 0x4000
call fcn.0058f738
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x432c5f
push esi
call fcn.0058f733
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], 0
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x432cba
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00431950
test eax, eax
jne 0x432cba
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x432cdd
mov al, byte [edi + 0x39]
jmp 0x432ce0
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x432d5e
nop
mov al, byte [ebx]
test al, al
je 0x432d5e
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, dword [esi + 0x70]
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x619d20]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x432d10
mov eax, dword [ebp - 0xc]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4331d3
cmp dword [esi + 4], 0xffffffff
jne 0x4331d3
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433162
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x433196
cmp eax, 0x2f
je 0x433196
push 0x61c780
push 0x104
push edi
call fcn.00592bdb
add esp, 0xc
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00431db0
add esp, 8
pop edi
test eax, eax
jne 0x4331b5
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
call fcn.00432200
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
pop esi
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x433810
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x433842
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x433842
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x433903
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x43385f
cmp ax, 0x5c
jne 0x433861
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x433853
cmp esi, ebx
je 0x4338aa
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.0058bc30
add esp, 0xc
cmp esi, 0x208
jae 0x433913
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, edi
mov word [ebp + esi - 0x414], ax
call fcn.00433810
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x4338cd
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00592c50
add esp, 0xc
push ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00592bdb
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x433903
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0057277e
mov esp, ebp
pop ebp
ret
call fcn.00572de1
int3