joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x4c3718]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x274]
push edi
push 0x20a
push 0
push eax
mov dword [ebp - 0x28c], 0
call fcn.00474170
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x411ebf
mov word [ebp - 8], ax
movzx eax, byte [ebp - 0x275]
push eax
movzx eax, byte [ebp - 0x276]
push eax
movzx eax, byte [ebp - 0x277]
push eax
movzx eax, byte [ebp - 0x278]
push eax
movzx eax, byte [ebp - 0x279]
push eax
movzx eax, byte [ebp - 0x27a]
push eax
movzx eax, byte [ebp - 0x27b]
push eax
movzx eax, byte [ebp - 0x27c]
push eax
movzx eax, word [ebp - 0x27e]
push eax
movzx eax, word [ebp - 0x280]
push eax
push dword [ebp - 0x284]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 0x300025
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x274]
mov dword [ebp - 0x64], 0x580038
push 0x104
push eax
mov dword [ebp - 0x60], 0x25002d
mov dword [ebp - 0x5c], 0x340030
mov dword [ebp - 0x58], 0x2d0058
mov dword [ebp - 0x54], 0x300025
mov dword [ebp - 0x50], 0x780034
mov dword [ebp - 0x4c], 0x25002d
mov dword [ebp - 0x48], 0x320030
mov dword [ebp - 0x44], 0x250058
mov dword [ebp - 0x40], 0x320030
mov dword [ebp - 0x3c], 0x2d0058
mov dword [ebp - 0x38], 0x300025
mov dword [ebp - 0x34], 0x580032
mov dword [ebp - 0x30], 0x300025
mov dword [ebp - 0x2c], 0x580032
mov dword [ebp - 0x28], 0x300025
mov dword [ebp - 0x24], 0x580032
mov dword [ebp - 0x20], 0x300025
mov dword [ebp - 0x1c], 0x580032
mov dword [ebp - 0x18], 0x300025
mov dword [ebp - 0x14], 0x580032
mov dword [ebp - 0x10], 0x300025
mov dword [ebp - 0xc], 0x580032
call fcn.00404390
add esp, 0x3c
jmp 0x411f61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp + 0xc]
mov ecx, eax
mov dword [ebp - 0x3c], 0x25007b
xor eax, eax
mov dword [ebp - 0x38], 0x320030
mov word [ebp - 8], ax
mov eax, ecx
and eax, 0xff000000
mov dword [ebp - 0x34], 0x2d0078
push eax
mov eax, ecx
mov dword [ebp - 0x30], 0x300025
and eax, 0xff0000
mov dword [ebp - 0x2c], 0x780032
push eax
mov eax, ecx
mov dword [ebp - 0x28], 0x25002d
and eax, 0xff00
mov dword [ebp - 0x24], 0x320030
push eax
movzx eax, cl
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x20], 0x2d0078
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x274]
mov dword [ebp - 0x1c], 0x300025
push 0x104
push eax
mov dword [ebp - 0x18], 0x780032
mov dword [ebp - 0x14], 0x25002d
mov dword [ebp - 0x10], 0x320030
mov dword [ebp - 0xc], 0x7d0078
call fcn.00404390
add esp, 0x24
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [ebp - 0x274], ax
je 0x411f95
lea eax, [ebp - 0x274]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411f86
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x274]
mov ecx, esi
push eax
call fcn.00404000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00472961
mov esp, ebp
pop ebp
ret
Function at 0x412240
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x41228e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41228e
mov dword [esi + 4], ecx
lea ecx, [esi + 0x14]
push eax
call fcn.004049c0
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x4123c0
push 0
push 0
call fcn.0047bd48
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x412286
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0xc]
pop esi
pop ebp
ret 8
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x412850
Capabilities:
Hide graphical window
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x12c
push dword [esi + 8]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0
push 0x12
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x412896
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4128ca
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4128ba
push 1
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x4128c3
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
lea eax, [esi + 0x14]
push eax
call fcn.004028b0
mov ecx, eax
call fcn.0040e710
mov eax, dword [esi + 0x11c]
test eax, eax
je 0x4128f5
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [esi + 0x11c], 0
pop esi
ret

Function at 0x4129a0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4129ee
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4129ee
mov dword [esi + 4], ecx
lea ecx, [esi + 0x18]
push eax
call fcn.004049c0
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x412ea0
push 0
push 0
call fcn.0047bd48
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x4129e6
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0xc]
pop esi
pop ebp
ret 8
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x4133e0
Capabilities:
Hide graphical window
Terminate thread

Disassembly:
push edi
mov edi, ecx
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [edi + 0x18]
push eax
call fcn.004028b0
mov ecx, eax
call fcn.0040e710
lea eax, [edi + 0x12c]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0xc8
push dword [edi + 8]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x3e8
push dword [edi + 8]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [edi + 0x128]
test eax, eax
je 0x413444
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [edi + 0x128], 0
push 0
push 0
push 0x12
push dword [edi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [edi + 0x10]
test eax, eax
je 0x41346e
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [edi + 0x10], 0
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4134a9
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x413499
push 1
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 0xc], 0
pop edi
ret
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0xc], 0
pop edi
ret

Function at 0x4135b0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4135fe
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4135fe
mov dword [esi + 8], ecx
lea ecx, [esi + 0x20]
push eax
call fcn.004049c0
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x413610
push 0
push 0
call fcn.0047bd48
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x4135f6
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0xc]
pop esi
pop ebp
ret 8
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x414250
Capabilities:
Hide graphical window
Terminate thread

Disassembly:
push edi
mov edi, ecx
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [edi + 0x20]
push eax
call fcn.004028b0
mov ecx, eax
call fcn.0040e710
push 0x64
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0xc8
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0
push 0x12
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4142b1
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [edi + 0x10], 0
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4142e5
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4142d5
push 1
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x4142de
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0xc], 0
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x4142f8
mov eax, dword [ecx]
call dword [eax + 0x34]
mov dword [edi + 0x18], 0
pop edi
ret
Function at 0x414400
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x41444e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41444e
mov dword [esi + 8], ecx
lea ecx, [esi + 0x1c]
push eax
call fcn.004049c0
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x414460
push 0
push 0
call fcn.0047bd48
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x414446
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0xc]
pop esi
pop ebp
ret 8
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x414bb0
Capabilities:
Hide graphical window
Terminate thread

Disassembly:
push edi
mov edi, ecx
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [edi + 0x1c]
push eax
call fcn.004028b0
mov ecx, eax
call fcn.0040e710
push 0x64
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0xc8
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0
push 0x12
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [edi + 0x10]
test eax, eax
je 0x414c11
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [edi + 0x10], 0
mov eax, dword [edi + 0xc]
test eax, eax
je 0x414c45
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x414c35
push 1
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x414c3e
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0xc], 0
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x414c58
mov eax, dword [ecx]
call dword [eax + 0x34]
mov dword [edi + 0x18], 0
pop edi
ret

Function at 0x414d60
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x414dae
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x414dae
mov dword [esi + 8], ecx
lea ecx, [esi + 0x1c]
push eax
call fcn.004049c0
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x414de0
push 0
push 0
call fcn.0047bd48
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x414da6
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0xc]
pop esi
pop ebp
ret 8
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x415510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4c3718]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4c0218]
cmp eax, 0xffffffff
jne 0x4155bd
xor eax, eax
mov dword [ebp - 0x28], 0x65006b
mov word [ebp - 0x18], ax
mov byte [ebp - 6], al
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x6e0072
push eax
mov dword [ebp - 0x20], 0x6c0065
mov dword [ebp - 0x1c], 0x320033
mov dword [ebp - 0x14], 0x6f577349
mov dword [ebp - 0x10], 0x50343677
mov dword [ebp - 0xc], 0x65636f72
mov word [ebp - 8], 0x7373
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4155b0
push 0x4c0218
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x4155b0
mov eax, dword [0x4c0218]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472961
mov esp, ebp
pop ebp
ret
mov dword [0x4c0218], 0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472961
mov esp, ebp
pop ebp
ret
Function at 0x419350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ac07
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c3718]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
lea ebx, [edi + 0x38]
mov dword [edi], 0
mov ecx, ebx
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [ebp + 8], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
call fcn.00423f50
mov dword [ebx], eax
lea esi, [edi + 0x40]
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00416030
mov dword [esi], eax
add edi, 0x48
mov byte [ebp - 4], 1
mov ecx, edi
mov dword [ebp + 8], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00423f80
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
mov ecx, ebx
mov dword [eax + 0x50], 0
call fcn.004240e0
mov ecx, esi
call fcn.004240e0
mov eax, dword [edi]
mov ecx, edi
mov byte [ebp - 4], 3
push dword [eax + 4]
call fcn.00453980
mov eax, dword [edi]
mov byte [ebp - 4], 2
mov dword [eax + 4], eax
mov eax, dword [edi]
mov dword [eax], eax
mov eax, dword [edi]
mov dword [eax + 8], eax
mov dword [edi + 4], 0
call fcn.00429bb0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x28], eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x419d50
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4c3718]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x419ebd
test ebx, ebx
je 0x419ebd
cmp word [ebx], 0
je 0x419ebd
push esi
push 0xfffffffffffffff0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x419e42
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
jne 0x419e42
push 0x30
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.00474170
mov eax, dword [edi + 0x18]
add esp, 0xc
mov dword [ebp - 0x34], 0x2c
mov dword [ebp - 0x30], 0xa1
mov dword [ebp - 0x2c], eax
push 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x432
push dword [edi]
mov dword [ebp - 0x10], ebx
call esi
lea ecx, [ebp - 0x3c]
call fcn.0040f990
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x38]
add eax, 0xf
movzx ecx, ax
mov eax, dword [ebp - 0x3c]
add eax, 0xf
shl ecx, 0x10
movzx eax, ax
or ecx, eax
push ecx
push 0
push 0x412
push dword [edi]
call esi
lea eax, [ebp - 0x34]
push eax
push 1
push 0x411
jmp 0x419eb8
push 0x30
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.00474170
mov eax, dword [edi + 0x18]
add esp, 0xc
mov dword [ebp - 0x34], 0x2c
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], eax
push 0
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
push dword [edi + 0x18]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x34]
push eax
push 0
push 0x432
push dword [edi]
call esi
lea ecx, [ebp - 0x3c]
call fcn.0040f990
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push 0
push 0x41c
push dword [edi]
call esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00472961
mov esp, ebp
pop ebp
ret 4
Function at 0x41e560
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4c3718]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x41e594
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41e594
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x41e658
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x41e5b1
cmp ax, 0x5c
jne 0x41e5b3
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x41e5a5
cmp esi, ebx
je 0x41e5ff
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.00474c90
add esp, 0xc
cmp esi, 0x208
jae 0x41e668
xor eax, eax
mov word [ebp + esi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.0041e560
add esp, 8
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x41e622
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00478c26
add esp, 0xc
push ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00478bb1
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41e658
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00472961
mov esp, ebp
pop ebp
ret
call fcn.00472f93
int3

Function at 0x41ee40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x41ef0a
cmp dword [esi + 4], 0xffffffff
jne 0x41ef0a
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ee71
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x41eea5
cmp eax, 0x2f
je 0x41eea5
push 0x49e770
push 0x104
push edi
call fcn.00478bb1
add esp, 0xc
mov edi, dword [ebp + 0x10]
cmp edi, 1
jne 0x41eecb
push edi
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41eecb
pop edi
mov eax, 0x2000000
pop esi
pop ebp
ret 0xc
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00421ae0
add esp, 0x10
test eax, eax
jne 0x41eeeb
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret 0xc
push eax
call fcn.00422200
add esp, 4
mov dword [esi], eax
xor ecx, ecx
mov edx, 0x200
test eax, eax
cmove ecx, edx
pop edi
mov eax, ecx
pop esi
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x41f590
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x4a1a10]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a1a10]
mov dword [edx + 8], ecx
pop ebp
ret
Function at 0x421c10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x421c4e
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x421c42
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x421c5f
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.00474c90
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x421ce0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x421cee
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x421dad
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a1a10]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a1a10]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a1a10]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a1a10]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a1a10]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a1a10]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a1a10]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a1a10]
sub edi, 1
jne 0x421d06
pop edi
test esi, esi
je 0x421dcb
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a1a10]
sub esi, 1
jne 0x421db1
not eax
pop esi
pop ebp
ret

Function at 0x422e60
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov dl, byte [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
mov ecx, esi
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
mov ecx, dword [edi]
shr eax, 8
xor dl, al
movsx eax, dl
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x4a1a10]
xor eax, ecx
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, esi
shr esi, 8
movzx ecx, al
mov al, dl
xor esi, dword [ecx*4 + 0x4a1a10]
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
ret