joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416b40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x61df64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x208
push esi
push eax
mov dword [ebp - 0x418], esi
call fcn.0056c4b0
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0056c4b0
add esp, 0x18
mov dword [ebp - 0x41c], 0x208
lea eax, [ebp - 0x418]
push eax
push 0x20019
push esi
push str.SOFTWARETencentMobileGamePCUI
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416c75
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.InstallPath
push dword [ebp - 0x418]
call esi
cmp word [ebp - 0x20c], 0
jne 0x416beb
xor ecx, ecx
jmp 0x416c03
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416bf4
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004107f0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x208
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push str.Version
push dword [ebp - 0x418]
call esi
cmp word [ebp - 0x414], 0
jne 0x416c49
xor ecx, ecx
jmp 0x416c61
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416c52
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
call fcn.004107f0
mov esi, 1
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x416c86
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00567f8c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x61df64]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x208
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x214]
push esi
push eax
mov dword [ebp - 0x424], esi
call fcn.0056c4b0
push 0x208
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.0056c4b0
add esp, 0x18
mov dword [ebp - 0x420], 0x208
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x424]
push eax
push 0x20019
push esi
push str.SOFTWARETencentMobileGamePCVDI_100
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416e49
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.InstallPath
push dword [ebp - 0x424]
call esi
cmp word [ebp - 0x214], 0
jne 0x416d61
xor ecx, ecx
jmp 0x416d7f
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416d70
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x214]
mov ecx, edi
push eax
call fcn.004107f0
lea eax, [ebp - 0x420]
mov dword [ebp - 0x420], 0x208
push eax
lea eax, [ebp - 0x41c]
push eax
push 0
push 0
push str.Version
push dword [ebp - 0x424]
call esi
cmp word [ebp - 0x41c], 0
jne 0x416dc5
xor ecx, ecx
jmp 0x416ddf
lea ecx, [ebp - 0x41c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416dd0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x41c]
mov ecx, ebx
push eax
call fcn.004107f0
lea eax, [ebp - 0x420]
mov dword [ebp - 0x420], 4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x5ec0b0
push dword [ebp - 0x424]
call esi
cmp word [ebp - 0xc], 0
jne 0x416e1f
xor ecx, ecx
jmp 0x416e34
lea ecx, [ebp - 0xc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416e25
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x428]
lea eax, [ebp - 0xc]
push eax
call fcn.004107f0
mov esi, 1
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x416e5a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00567f8c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x416e70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x61df64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x208
push esi
push eax
mov dword [ebp - 0x418], esi
call fcn.0056c4b0
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0056c4b0
add esp, 0x18
mov dword [ebp - 0x41c], 0x208
lea eax, [ebp - 0x418]
push eax
push 0x20019
push esi
push str.SOFTWARETencentMobileGamePCVDI_0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416fa5
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.InstallPath
push dword [ebp - 0x418]
call esi
cmp word [ebp - 0x20c], 0
jne 0x416f1b
xor ecx, ecx
jmp 0x416f33
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416f24
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004107f0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x208
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push str.Version
push dword [ebp - 0x418]
call esi
cmp word [ebp - 0x414], 0
jne 0x416f79
xor ecx, ecx
jmp 0x416f91
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416f82
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
call fcn.004107f0
mov esi, 1
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x416fb6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00567f8c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416fd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x61df64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x208
push esi
push eax
mov dword [ebp - 0x620], esi
call fcn.0056c4b0
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0056c4b0
push 0x208
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x624], 0x208
push esi
push eax
call fcn.0056c4b0
push dword [ebp + 0x14]
lea eax, [ebp - 0x61c]
push str.SOFTWARETencentMobileGamePCAOW_Rootfs_
push str._s_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x34
lea eax, [ebp - 0x620]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x61c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417133
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.InstallPath
push dword [ebp - 0x620]
call esi
cmp word [ebp - 0x20c], 0
jne 0x4170a9
xor ecx, ecx
jmp 0x4170c1
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4170b2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004107f0
lea eax, [ebp - 0x624]
mov dword [ebp - 0x624], 0x208
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push str.Version
push dword [ebp - 0x620]
call esi
cmp word [ebp - 0x414], 0
jne 0x417107
xor ecx, ecx
jmp 0x41711f
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417110
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
call fcn.004107f0
mov esi, 1
mov eax, dword [ebp - 0x620]
test eax, eax
je 0x417144
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00567f8c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x417160
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x61df64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
xor esi, esi
push 0x208
push esi
push eax
mov dword [ebp - 0x210], esi
call fcn.0056c4b0
add esp, 0xc
mov dword [ebp - 0x214], 0x208
lea eax, [ebp - 0x210]
push eax
push 0x20019
push esi
push str.SoftwareTencentMobileGamePC
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417223
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x5ebf18
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x417223
cmp word [ebp - 0x20c], si
jne 0x4171f2
xor ecx, ecx
jmp 0x41720f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417200
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004107f0
mov esi, 1
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x417234
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00567f8c
mov esp, ebp
pop ebp
ret 4
Function at 0x41de70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push dword [edi]
push 1
push dword [edi + 8]
push esi
call fcn.0057c3fc
mov ecx, dword [edi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
cdq
sete bl
idiv dword [edi + 0x18]
mov byte [ebp - 1], bl
mov dword [edi + 0x1c], eax
test bl, bl
je 0x41dfd1
add dword [edi + 0x14], ecx
mov edx, 0x18
push 0xffffffffffffffff
push eax
mov eax, dword [edi + 0x24]
push ecx
mov ecx, esp
push ecx
mov dword [ecx], eax
mov eax, esp
lea ecx, [edi + 0x20]
mov dword [eax], str.read
call fcn.0041c1a0
mov ecx, dword [edi + 0x1c]
add esp, 0x10
mov edx, dword [edi + 0x18]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], edx
test ecx, ecx
je 0x41df76
dec ecx
mov dword [ebp - 0xc], ecx
xor ecx, ecx
cmp dword [ebp - 8], 1
jne 0x41def7
cmp byte [esi], cl
jmp 0x41defa
cmp word [esi], cx
sete cl
test ecx, ecx
je 0x41df24
test eax, eax
je 0x41df1d
cmp esi, eax
je 0x41df1d
mov ecx, esi
imul edx, ebx
sub ecx, eax
push ecx
push eax
sub eax, edx
push eax
call fcn.0056b650
add esp, 0xc
mov edx, dword [edi + 0x18]
inc ebx
lea eax, [edx + esi]
mov ecx, dword [ebp - 0xc]
add esi, edx
test ecx, ecx
jne 0x41dee7
test eax, eax
je 0x41df4a
cmp esi, eax
je 0x41df4a
mov ecx, dword [edi + 0x18]
sub esi, eax
imul ecx, ebx
push esi
push eax
sub eax, ecx
push eax
call fcn.0056b650
add esp, 0xc
test ebx, ebx
je 0x41df76
push 0xffffffffffffffff
push ebx
push ecx
mov eax, esp
mov edx, 1
push ecx
lea ecx, [edi + 0x20]
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.nulls_removed
call fcn.0041c1a0
add esp, 0x10
sub dword [edi + 0x1c], ebx
cmp dword [edi + 0x18], 1
jle 0x41dfc5
test byte [edi + 4], 0x80
je 0x41dfc5
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x41dfa2
mov edx, dword [ebp + 8]
nop dword [eax]
movzx eax, word [edx + ecx*2 - 2]
dec ecx
rol ax, 8
mov word [edx + ecx*2], ax
test ecx, ecx
jne 0x41df90
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov esi, esp
xor edx, edx
push ecx
lea ecx, [edi + 0x20]
mov dword [esi], 0
mov esi, esp
mov dword [esi], str.endian_swap
call fcn.0041c1a0
add esp, 0x10
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, edi
call fcn.0041dc80
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41e430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp + 8], 0
mov esi, edx
mov eax, dword [edi + 0x18]
mov ebx, dword [edi + 0x1c]
imul eax, ebx
mov dword [edi + 8], eax
mov eax, dword [ebp + 0xc]
test eax, eax
cmovne esi, eax
test byte [edi + 4], 0x80
je 0x41e4d5
test edx, edx
jne 0x41e493
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043847b
mov ecx, dword [edi + 0x1c]
mov ebx, eax
add ecx, ecx
mov dword [ebp + 8], ebx
push ecx
push esi
push ebx
call fcn.0056bf30
add esp, 0x10
mov edx, ebx
mov esi, ebx
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x41e4b2
nop word [eax + eax]
movzx eax, word [edx + ecx*2 - 2]
dec ecx
rol ax, 8
mov word [edx + ecx*2], ax
test ecx, ecx
jne 0x41e4a0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov eax, esp
xor edx, edx
push ecx
lea ecx, [edi + 0x20]
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.endian_swap
call fcn.0041c1a0
add esp, 0x10
push dword [edi]
push 1
push dword [edi + 8]
push esi
call fcn.0057c6e4
add esp, 0x10
cmp eax, 1
mov eax, dword [ebp + 8]
sete bl
test eax, eax
je 0x41e4fb
push eax
call fcn.00438484
add esp, 4
test bl, bl
je 0x41e534
mov eax, dword [edi + 8]
mov edx, 0x18
add dword [edi + 0x14], eax
push 0xffffffffffffffff
push dword [edi + 0x1c]
push ecx
mov ecx, dword [edi + 0x24]
mov esi, esp
push ecx
mov dword [esi], ecx
mov ecx, esp
mov dword [ecx], str.write
lea ecx, [edi + 0x20]
call fcn.0041c1a0
add esp, 0x10
mov al, bl
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, edi
call fcn.0041dc80
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 8
Function at 0x424f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x425178
cmp dword [esi + 0x6af90], 3
jb 0x424fe8
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x425025
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x425025
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x42500f
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.00424c40
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, esi
cmp edi, 3
jb 0x4250f8
mov edx, dword [esi + 0x6af84]
lea eax, [edi - 3]
sub edx, dword [esi + 0x6af88]
push eax
call fcn.00424430
sub dword [esi + 0x6af90], edi
add esp, 4
mov dword [ebp - 4], eax
cmp edi, dword [esi + 0x6af98]
ja 0x4250bf
cmp dword [esi + 0x6af90], 3
jb 0x4250bf
dec edi
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [esi + edx + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x425063
mov eax, dword [ebp - 4]
jmp 0x425117
add dword [esi + 0x6af84], edi
xor edi, edi
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x42511d
mov eax, dword [esi + 0x6af84]
xor edx, edx
movzx eax, byte [eax + esi + 0x1af70]
push eax
call fcn.00424430
add esp, 4
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x425158
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x425135
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x425137
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00424280
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x42516b
mov ecx, esi
call fcn.00424e10
cmp dword [esi + 0x6af90], 0
jne 0x424f93
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x42518c
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x42518e
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.00424280
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425e70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x425e7b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x425f37
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ed858]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ed858]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ed858]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ed858]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ed858]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ed858]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ed858]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ed858]
sub edi, 1
jne 0x425e90
pop edi
test esi, esi
je 0x425f5a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ed858]
sub esi, 1
jne 0x425f40
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x426250
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x426328
mov eax, dword [esi + 0x3c]
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x426284
cmp dword [esi + 0x40], ebx
jae 0x426284
push eax
call fcn.00438484
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x42629c
lea eax, [ebx + ebx]
push eax
call fcn.0043847b
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push dword [esi + 0x3c]
call fcn.0056bf30
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x426325
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
shr ecx, 8
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, dword [esi + 0x30]
or edi, 2
movzx eax, al
mov eax, dword [eax*4 + 0x5ed858]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x5ed858]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x4262b2
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x426366
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x42634d
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call fcn.0056bf30
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x426388
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x426650
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x78]
test edx, edx
je 0x4266ad
mov ecx, dword [edi + 0x80]
mov ebx, dword [edi + 0x7c]
cmp ecx, ebx
jae 0x4266f5
mov esi, dword [ebp + 8]
lea eax, [ecx + edx]
sub ebx, ecx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call fcn.0056bf30
mov ecx, dword [edi + 0x6c]
mov edx, esi
add dword [edi + 0x80], ebx
add dword [edi + 0x68], ebx
push ebx
call fcn.00425e70
add esp, 0x10
mov dword [edi + 0x6c], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x70]
test eax, eax
je 0x4266ee
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4266f5
mov esi, dword [ebp - 4]
mov edx, ebx
mov ecx, dword [edi + 0x6c]
add dword [edi + 0x68], esi
push esi
call fcn.00425e70
add esp, 4
mov dword [edi + 0x6c], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42749a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 0xc], edx
cmp dword [edi + 0x6c], eax
jb 0x427539
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.0056bf30
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 8], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x4274ee
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x427515
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x427663
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x427566
xor eax, eax
jmp 0x4275b7
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x427583
mov edx, dword [esi]
push ecx
mov ecx, dword [esi + 0x30]
call fcn.0042abc5
jmp 0x42759b
cmp eax, 2
jne 0x42759f
mov edx, dword [esi]
test edx, edx
jne 0x427592
xor eax, eax
jmp 0x42759c
push ecx
mov ecx, dword [esi + 0x30]
call fcn.0042ae12
pop ecx
mov dword [esi + 0x30], eax
push dword [ebp - 8]
push dword [esi]
push dword [ebp - 0xc]
call fcn.0056bf30
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x4275df
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x4275f4
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4274ab
mov ecx, dword [edi + 0x16c0]
mov ebx, dword [edi + 0x3c]
cmp ecx, ebx
jae 0x427663
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x74]
cmp ecx, esi
jae 0x427633
mov eax, 0x102
sub ebx, esi
cmp ebx, eax
cmova ebx, eax
mov eax, dword [edi + 0x38]
push ebx
add eax, esi
push 0
push eax
call fcn.0056c4b0
lea eax, [ebx + esi]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x427663
lea eax, [esi + 0x102]
cmp ecx, eax
jae 0x427663
mov eax, dword [edi + 0x38]
sub esi, ecx
sub ebx, ecx
add esi, 0x102
cmp esi, ebx
cmova esi, ebx
add eax, ecx
push esi
push 0
push eax
call fcn.0056c4b0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret