joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406cf0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d95c
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x564020]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x8c], 0
jle 0x406d3b
mov ecx, dword [ebp + 0x10]
push ecx
push str.Saving_file:__s_n
call fcn.004114f0
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.95aaef3f_473a_4b8d_a89f_013cd1536108
push 1
push 0
call edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406d64
cmp eax, 5
je 0x406d64
xor bl, bl
jmp 0x406d66
mov bl, 1
test esi, esi
je 0x406d84
cmp eax, 0xb7
je 0x406d7d
cmp eax, 5
je 0x406d7d
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x406d91
push 0x64
call sub.KERNEL32.dll_Sleep
jmp 0x406d41
mov esi, dword [ebp + 0x10]
mov ecx, esi
call fcn.0040d1a0
push 1
push 0x40
push 0x22
push esi
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::constructor_wchar_t_const___int__int_]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xa4]
mov eax, dword [edx + 4]
cmp dword [ebp + eax - 0x9c], 0
jne 0x406e39
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0x10
mov ecx, dword [eax + 0x14]
jb 0x406ddd
mov eax, dword [eax + 4]
jmp 0x406de0
add eax, 4
push ecx
push eax
lea ecx, [ebp - 0xa4]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const___int_]
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ecx + 4]
cmp dword [ebp + edx - 0x9c], 0
lea ecx, [ebp - 0xa4]
jne 0x406e33
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::close_void_]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::close_void_]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
push str.Save_on_disk_failed_n
call fcn.004114d0
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4071d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50e50c
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x564020]
xor eax, esp
mov dword [esp + 0xc0], eax
push esi
push edi
mov eax, dword [0x564020]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov eax, dword [esp + 0xe0]
lea edi, [eax + 4]
mov esi, ecx
call fcn.00413430
push 0x55cc84
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0xdc], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push str.updater
lea ecx, [esp + 0x4c]
mov byte [esp + 0xdc], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x70]
push eax
mov ecx, edi
mov byte [esp + 0xe8], 2
call fcn.00414d20
mov dword [esp + 0x64], vtable.configlib::configitem_int_.0
mov dword [esp + 0xc0], 1
mov dword [esp + 0xc4], 1
lea ecx, [esp + 0x48]
mov byte [esp + 0xd8], 4
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x10]
mov byte [esp + 0xd8], 5
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x2c]
mov byte [esp + 0xd8], 6
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor ecx, ecx
cmp byte [esp + 0xe4], cl
lea esi, [esp + 0x64]
setne cl
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
call fcn.00407500
push edi
call fcn.004135a0
mov dword [esp + 0xd8], 0xffffffff
mov ecx, esi
mov dword [esp + 0x64], vtable.configlib::configitem_int_.0
call fcn.00414e00
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.00419fc4
add esp, 0xd0
ret 8
Function at 0x407500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50e4b9
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x564020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edx, dword [ecx]
lea eax, [esi + 0x60]
push eax
mov dword [eax], edx
lea eax, [esp + 0xc]
push eax
call fcn.00407ec0
add esp, 8
lea edx, [esi + 4]
push edx
mov dword [esp + 0x34], 0
mov edx, dword [esi + 0x58]
push edx
lea ecx, [esi + 0x20]
mov edx, eax
call fcn.00413a00
mov eax, dword [esi + 0x58]
push eax
call fcn.004135a0
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4085d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x55c858
lea edi, [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.00408580
mov esi, dword [esp + 8]
test eax, eax
jl 0x40863c
mov ecx, dword [esp + 0xc]
dec ecx
cmp eax, ecx
jge 0x40863c
mov edi, dword [esi + eax*4 + 4]
test edi, edi
je 0x40863c
call fcn.004086d0
mov edi, eax
test esi, esi
je 0x408634
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
test esi, esi
je 0x408647
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x408650
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x55c870
lea edi, [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.00408580
mov esi, dword [esp + 8]
test eax, eax
jl 0x4086bc
mov ecx, dword [esp + 0xc]
dec ecx
cmp eax, ecx
jge 0x4086bc
mov edi, dword [esi + eax*4 + 4]
test edi, edi
je 0x4086bc
call fcn.00408720
mov edi, eax
test esi, esi
je 0x4086b4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
test esi, esi
je 0x4086c7
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x408770
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
push ebx
push edi
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push str._forceworkdir
lea edi, [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.00408580
test eax, eax
mov eax, dword [esp + 8]
setge bl
test eax, eax
je 0x4087bd
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov al, bl
pop ebx
add esp, 0xc
ret
Function at 0x4088b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50e06a
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x564020]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
lea eax, [esi + 0x10]
push eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.00411dc0
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esp + 0x14], ebx
lea ecx, [esi + 0x40]
push ecx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
call fcn.00411dc0
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
lea edx, [esi + 0x60]
push edx
mov byte [esp + 0x18], 1
call fcn.00411dc0
lea eax, [esi + 0x78]
push eax
mov byte [esp + 0x18], 2
call fcn.00411dc0
lea ecx, [esi + 0x90]
mov byte [esp + 0x14], 3
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
push 1
lea ecx, [esi + 0xac]
mov byte [esp + 0x18], 4
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_fstream_char__struct_std::char_traits_char__::constructor_void_]
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov byte [esi + 0x144], bl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x40bda0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50de48
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x564020]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
lea eax, [esp + 8]
push eax
call fcn.00411dc0
mov ecx, dword [esp + 0x34]
xor esi, esi
push ecx
lea edx, [esp + 0xc]
mov dword [esp + 0x30], esi
call fcn.0040c290
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40bdf3
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [esp + 8]
push edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret

Function at 0x40d110
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x564020]
xor eax, esp
mov dword [esp + 0x208], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40d182
push 0x55c6b4
lea eax, [esp + 4]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__]
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
mov al, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00419fc4
add esp, 0x20c
ret
mov ecx, dword [esp + 0x208]
xor ecx, esp
xor al, al
call fcn.00419fc4
add esp, 0x20c
ret
Function at 0x410be0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x564020]
xor eax, esp
mov dword [esp + 0x410], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp]
push edx
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x410cd4
push edi
mov edi, 0x55c31c
lea edx, [esp + 4]
call fcn.004115a0
mov eax, dword [esp + 0x41c]
sub eax, 1
je 0x410c85
sub eax, 1
jne 0x410c93
push 0x206
push eax
lea ecx, [esp + 0x216]
push ecx
mov word [esp + 0x218], ax
call sub.MSVCR90.dll_memset
lea edx, [esp + 0x218]
push edx
call fcn.00410cf0
add esp, 0x10
lea edi, [esp + 0x20c]
test al, al
jne 0x410c8a
mov edi, 0x55c320
jmp 0x410c8a
mov edi, str.Command_and_Conquer_Generals_Data
lea edx, [esp + 4]
call fcn.004115a0
mov edi, 0x55c3bc
lea edx, [esp + 4]
call fcn.004115a0
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
pop edi
test eax, eax
je 0x410cd4
lea ecx, [esp]
push ecx
mov ecx, esi
call dword [0x50f214]
mov al, 1
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00419fc4
add esp, 0x414
ret
mov ecx, dword [esp + 0x410]
xor ecx, esp
xor al, al
call fcn.00419fc4
add esp, 0x414
ret

Function at 0x410cf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push 0x55c3c0
push reloc.WS2_32.dll_bind
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410d4b
mov edx, dword [esp + 0x10]
lea ecx, [esp + 8]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.UserDataLeafName
push eax
mov dword [esp + 0x20], 0x206
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410d40
mov bl, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x411620
Capabilities:
Get system information on windows

Disassembly:
xor eax, eax
sub esp, 0x24
lea ecx, [esp]
push ecx
mov dword [esi], vtable.CTrampolineManager.0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0x214], eax
mov dword [esi + 0x218], eax
mov dword [esi + 0x21c], eax
mov dword [esi + 0x220], eax
mov dword [esi + 0x224], 0x20
mov dword [esi + 0x228], eax
mov dword [esi + 0x22c], eax
mov word [esi + 0xc], ax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0x21c], edx
mov dword [esi + 0x218], eax
xor edx, edx
div dword [esi + 0x224]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x220], ecx
dec eax
mov dword [esi + 0x22c], eax
mov eax, esi
add esp, 0x24
ret
Function at 0x4116c0
Capabilities:
Allocate or change rwx memory
Delete file

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x214]
push edi
lea edi, [esi + 0x214]
mov dword [esi], vtable.CTrampolineManager.0
test eax, eax
je 0x4116f0
mov edx, dword [esi + 0x218]
lea ecx, [esp + 8]
push ecx
push 0x40
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test edi, edi
je 0x41170e
mov eax, dword [edi]
test eax, eax
je 0x41170e
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [edi], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x411726
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
pop edi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov word [esi + 0xc], cx
pop esi
pop ecx
ret

Function at 0x411740
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
sub esp, 0x220
mov eax, dword [0x564020]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esi + 8]
push ebx
xor ebx, ebx
push ebp
push edi
cmp eax, ebx
je 0x411771
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
lea ebp, [esi + 0xc]
push str.ws2_32.dll
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov word [ebp], cx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov dword [esi + 4], edi
cmp edi, ebx
je 0x411828
push 0x206
lea eax, [esp + 0x26]
xor edx, edx
push ebx
push eax
mov word [esp + 0x2c], dx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x103
lea ecx, [esp + 0x24]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x411828
push ebp
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x411828
xor edx, edx
lea ebx, [esp + 0xc]
mov word [esp + 0x1c], dx
call fcn.0040c890
mov edi, str.tmp_
mov edx, ebp
call fcn.004115a0
mov edi, ebx
mov edx, ebp
call fcn.004115a0
mov edi, str..dll
mov edx, ebp
call fcn.004115a0
push 0
push ebp
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x411828
push 1
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x228]
xor eax, eax
cmp dword [esi + 8], eax
pop edi
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.00419fc4
add esp, 0x220
ret
Function at 0x411850
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push esi
push edi
mov edi, eax
mov esi, ecx
mov eax, dword [esi + 4]
push edi
push eax
call ebx
mov ecx, dword [esi + 8]
push edi
push ecx
mov dword [esp + 0x24], eax
call ebx
cmp dword [esp + 0x1c], 0
mov ebp, eax
je 0x4119e0
test ebp, ebp
je 0x4119e0
mov ebx, dword [esi + 0x224]
push ebx
call fcn.00419fb9
mov edi, eax
add esp, 4
test edi, edi
je 0x4118af
push ebx
push 0
push edi
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [esp + 0x14], edi
jmp 0x4118bb
mov dword [esp + 0x14], 0
mov edi, dword [esp + 0x14]
mov edx, dword [esi + 0x224]
add edx, edi
mov eax, ebp
mov ebx, edi
mov dword [esp + 0x24], edx
lea ecx, [esp + 0x18]
push ecx
push 0
push eax
lea edx, [esp + 0x30]
push edx
push ebx
mov esi, eax
mov dword [esp + 0x2c], 0
call fcn.0041c020
mov ecx, dword [esp + 0x18]
sub ecx, esi
add ecx, eax
add ebx, ecx
mov cl, byte [esi]
mov edi, eax
sub edi, ebp
cmp cl, 0xeb
je 0x411954
cmp cl, 0xe9
je 0x411954
cmp cl, 0xe0
je 0x411954
cmp cl, 0xc2
je 0x411954
cmp cl, 0xc3
je 0x411954
cmp cl, 0xcc
je 0x411954
cmp cl, 0xff
jne 0x411921
cmp byte [esi + 1], 0x25
je 0x411954
cmp cl, 0x26
je 0x41193f
cmp cl, 0x2e
je 0x41193f
cmp cl, 0x36
je 0x41193f
cmp cl, 0xe3
je 0x41193f
cmp cl, 0x64
je 0x41193f
cmp cl, 0x65
jne 0x41194b
cmp byte [esi + 1], 0xff
jne 0x41194b
cmp byte [esi + 2], 0x25
je 0x411954
cmp edi, 5
jb 0x4118cb
xor ebx, ebx
mov eax, ebp
test edi, edi
jbe 0x411971
mov esi, dword [esp + 0x1c]
sub esi, ebp
mov cl, byte [esi + eax]
mov dl, byte [eax]
inc eax
cmp cl, dl
jne 0x411984
inc ebx
cmp ebx, edi
jb 0x411962
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x2c]
push edx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
jmp 0x4119e4
mov ebx, ebp
mov ebp, dword [esp + 0x2c]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x411995
xor eax, eax
jmp 0x41199a
mov eax, dword [ebp + 0x14]
sub eax, ecx
mov esi, dword [ebp + 0x10]
mov edx, esi
sub edx, ecx
cmp edx, eax
jae 0x4119af
mov al, byte [ebx]
mov byte [esi], al
inc esi
mov dword [ebp + 0x10], esi
jmp 0x4119cb
cmp ecx, esi
jbe 0x4119b9
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov eax, dword [ebp]
push esi
push eax
push ebx
lea ecx, [esp + 0x28]
push ecx
mov eax, ebp
call fcn.00411e20
inc ebx
sub edi, 1
jne 0x411986
mov edx, dword [esp + 0x14]
push edx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
jmp 0x4119e4
mov ebp, dword [esp + 0x2c]
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 0xc]
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret 4

Function at 0x411be0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
test eax, eax
je 0x411bf9
lea ecx, [esp]
push ecx
mov ecx, dword [edx + 0x218]
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x411c00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [edi + 0x218]
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, 0x40000000
lea ecx, [eax - 1]
and ecx, esi
je 0x411c22
mov esi, eax
sub esi, ecx
add esi, 0x40000000
cmp esi, dword [esp + 0x2c]
jae 0x411cd7
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x411c40
lea ecx, [esi - 0x50000000]
cmp ecx, 0x30000000
ja 0x411c56
lea esi, [eax - 0x80000000]
jmp 0x411ccd
xor eax, eax
push 0x1c
lea edx, [esp + 0x10]
push edx
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call ebp
test eax, eax
je 0x411cd7
cmp dword [esp + 0x1c], 0x10000
mov ecx, dword [esp + 0x18]
jne 0x411cb3
mov eax, dword [edi + 0x218]
cmp ecx, eax
jb 0x411cb3
push 0x40
push 0x3000
push eax
push esi
call ebx
test eax, eax
jne 0x411cd9
mov eax, dword [edi + 0x218]
add esi, eax
jmp 0x411ccd
mov eax, dword [esp + 0xc]
lea esi, [eax + ecx]
mov eax, dword [edi + 0x218]
lea ecx, [eax - 1]
and ecx, esi
je 0x411ccd
mov edx, eax
sub edx, ecx
add esi, edx
cmp esi, dword [esp + 0x2c]
jb 0x411c40
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4

Function at 0x411cf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [edi + 0x218]
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, 0x40000000
sub esi, eax
lea ecx, [eax - 1]
and ecx, esi
je 0x411d0c
sub esi, ecx
cmp esi, dword [esp + 0x2c]
jbe 0x411db3
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [esi - 0x50000000]
cmp ecx, 0x30000000
ja 0x411d39
mov esi, 0x50000000
sub esi, eax
jmp 0x411da9
xor eax, eax
push 0x1c
lea edx, [esp + 0x10]
push edx
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call ebp
test eax, eax
je 0x411db3
cmp dword [esp + 0x1c], 0x10000
jne 0x411d94
mov eax, dword [edi + 0x218]
cmp dword [esp + 0x18], eax
jb 0x411d94
push 0x40
push 0x3000
push eax
push esi
call ebx
test eax, eax
jne 0x411db5
mov eax, dword [edi + 0x218]
sub esi, eax
jmp 0x411da9
mov eax, dword [edi + 0x218]
mov esi, dword [esp + 0x10]
sub esi, eax
lea ecx, [eax - 1]
and ecx, esi
je 0x411da9
sub esi, ecx
cmp esi, dword [esp + 0x2c]
ja 0x411d22
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x417780
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x41778b
xor eax, eax
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
jmp fcn.004177a0
Function at 0x417a80
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi]
mov edx, ecx
xor edx, eax
shr ecx, 8
and edx, 0xff
mov edx, dword [edi + edx*4]
xor edx, ecx
movzx ecx, dl
add ecx, dword [esi + 4]
mov dword [esi], edx
mov edx, dword [esi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 4], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [edi + ecx*4]
mov dword [esi + 8], edx
ret