joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413c0e
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
mov edx, dword [ecx + 8]
push ebx
mov ebx, eax
mov eax, dword [ecx]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
push esi
mov esi, dword [ecx + 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
je 0x413c98
push edi
mov edi, 0xff
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebx]
mov ebx, dword [ebp - 4]
shr ebx, 8
movzx edx, al
xor edx, dword [ebp - 4]
and edx, edi
xor ebx, dword [esi + edx*4]
movzx edx, bl
add edx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0xc]
imul edx, edx, 0x8088405
inc edx
mov dword [ebp - 8], edx
shr edx, 0x18
xor edx, dword [ebp - 0xc]
shr ebx, 8
and edx, edi
xor ebx, dword [esi + edx*4]
dec dword [ebp + 8]
mov edx, ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], al
inc ebx
cmp dword [ebp + 8], 0
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ebx
jne 0x413c3b
pop edi
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
pop esi
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
pop ebx
leave
ret 4

Function at 0x413cac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [eax]
movzx edx, dl
xor edx, ecx
push esi
mov esi, dword [eax + 0xc]
push edi
mov edi, 0xff
and edx, edi
mov edx, dword [esi + edx*4]
shr ecx, 8
xor edx, ecx
mov ecx, dword [eax + 8]
mov dword [eax], edx
movzx edx, dl
add edx, dword [eax + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [eax + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, edi
shr ecx, 8
xor ecx, dword [esi + edx*4]
pop edi
mov dword [eax + 8], ecx
pop esi
ret

Function at 0x413cef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43f050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
mov cx, word [eax + 8]
or cx, 2
movzx ecx, cx
mov ebx, ecx
xor ebx, 1
imul ebx, ecx
lea edi, [ebp + esi - 0x10]
sar ebx, 8
xor bl, byte [edi]
mov dl, bl
call fcn.00413cac
inc esi
cmp esi, 0xb
mov byte [edi], bl
jl 0x413d0f
mov cx, word [eax + 8]
or cx, 2
movzx ecx, cx
mov byte [ebp - 0x11], bl
mov ebx, ecx
xor ebx, 1
imul ebx, ecx
sar ebx, 8
xor bl, byte [ebp + esi - 0x10]
mov dl, bl
call fcn.00413cac
cmp bl, byte [ebp + 0x10]
pop edi
pop esi
pop ebx
jne 0x413d79
mov dl, byte [ebp - 0x11]
xor ecx, ecx
cmp dl, byte [ebp + 0xc]
setne cl
mov dword [eax + 0x10], ecx
xor eax, eax
inc eax
jmp 0x413d7b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f998
leave
ret 0xc

Function at 0x4146c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4146d2
xor eax, eax
ret
not al
movzx eax, al
shr eax, 4
and eax, 1
ret
Function at 0x4146de
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
push dword [esp + 0x10]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x414728
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x414704
cmp eax, 2
jne 0x414724
mov eax, dword [esp + 0x10]
call fcn.00414d44
mov edi, eax
test edi, edi
je 0x414724
push edi
call esi
push edi
mov ebx, eax
call fcn.0041fde1
pop ecx
cmp ebx, 0xffffffff
jne 0x414728
xor eax, eax
jmp 0x414733
not bl
movzx eax, bl
shr eax, 4
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x415f04
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43f050]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0x88]
push dword [ecx + 0x1c]
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.00418b34
add esp, 0xc
mov dword [esi + 0x68], eax
cmp eax, 0xffffffff
je 0x415f7b
test edi, edi
je 0x415f7b
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x415f7b
cmp word [edi + 2], 0x3a
jne 0x415f7b
cmp word [edi + 4], 0x5c
jne 0x415f7b
mov ax, word [edi]
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [esi + 0x98], eax
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [esi + 0x68], 0xffffffff
setne al
xor ecx, ebp
call fcn.0041f998
leave
ret 4

Function at 0x415f92
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x54], 1
jne 0x415fa7
xor eax, eax
jmp 0x4160d9
push esi
push edi
call fcn.00418a19
mov edi, dword [ebp + 0xc]
cmp edi, eax
jbe 0x415ff6
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
test eax, eax
je 0x4160d5
xor esi, esi
push esi
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp + 0xc], esi
push dword [ebx + 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4160d5
add ebx, 0x90
add dword [ebx], edi
adc dword [ebx + 4], esi
xor eax, eax
inc eax
jmp 0x4160d7
and dword [ebp - 4], 0
lea eax, [ebx + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 8]
lea esi, [ebx + 0x18]
call fcn.0040db4f
test eax, eax
jne 0x41601c
mov dword [ebx + 0x54], 1
jmp 0x41603c
push dword [ebx + 0x48]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [ebx + 0x2c]
call fcn.00418a19
cmp esi, eax
jbe 0x416038
mov dword [ebp - 4], 1
and dword [ebx + 0x14], 0
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edi, [ebx + 0x30]
push edi
call esi
and dword [ebp - 8], 0
mov dword [ebp + 8], 0xbb8
jmp 0x4160b0
cmp dword [ebp + 8], 0
je 0x4160b6
cmp dword [ebp - 4], 0
je 0x41606c
push 0xa
push dword [ebx + 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebx + 0x54], 0
jne 0x4160b6
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 4], eax
call fcn.00418a19
cmp dword [ebp - 4], eax
jbe 0x4160a9
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 4], 1
cmp dword [ebp - 8], eax
jne 0x41609d
dec dword [ebp + 8]
jmp 0x4160ad
mov dword [ebp - 8], eax
mov dword [ebp + 8], 0xbb8
jmp 0x4160ad
and dword [ebp - 4], 0
push edi
call esi
cmp dword [ebp - 4], 0
jne 0x416055
xor eax, eax
inc eax
cmp dword [ebx + 0x54], eax
je 0x4160d5
cmp dword [ebp + 8], 0
jle 0x4160d5
mov ecx, dword [ebp + 0xc]
add ebx, 0x90
add dword [ebx], ecx
adc dword [ebx + 4], 0
jmp 0x4160d7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x416144
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x6c]
xor ebx, ebx
push edi
mov dword [esi + 0x58], ebx
mov dword [ebp - 0x10], 0x436014
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
cmp eax, ebx
je 0x41617b
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041571a
push dword [esi + 0x6c]
call fcn.0041fde1
pop ecx
cmp dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x6c], ebx
jne 0x416198
xor edi, edi
inc edi
lea esi, [ebp - 0x10]
call fcn.00415770
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
call fcn.00416232
xor eax, eax
inc eax
mov dword [ebp - 4], eax
cmp dword [esi + 0x54], eax
jne 0x4161ab
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 0x68]
mov dword [esi + 0x54], ebx
cmp ecx, 0xffffffff
je 0x4161ce
cmp dword [ebp - 4], ebx
je 0x4161c5
lea eax, [esi + 0x70]
push ecx
call fcn.00414f06
pop ecx
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x68], 0xffffffff
push 6
xor eax, eax
pop ecx
lea edi, [esi + 0x70]
mov dword [esi + 0x98], ebx
rep stosd dword es:[edi], eax
cmp dword [ebp + 8], ebx
je 0x4161f5
cmp dword [ebp - 0xc], ebx
je 0x4161f5
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 4]
jmp 0x416187

Function at 0x41628c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebx + 0x60]
and dword [ebp - 8], 0
push esi
push edi
mov dword [ebp - 4], eax
lea esi, [ebx + 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
mov edi, dword [ebx + 0x2c]
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x4162cf
test eax, eax
jne 0x4162cf
mov eax, 0x8000
cmp edi, eax
sbb edi, edi
and edi, 0xffff8000
add edi, eax
jmp 0x4162dc
cmp edi, 0x8000
jb 0x4162dc
mov edi, 0x8000
test edi, edi
jne 0x4162ed
test ecx, ecx
je 0x416303
mov dword [ebp - 8], 1
jmp 0x416303
push 1
push dword [ebp - 4]
lea esi, [ebx + 0x18]
call fcn.0040dbe6
push dword [ebx + 0x50]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebx + 0x2c]
lea esi, [ebx + 0x30]
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x416345
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 4]
push dword [ebx + 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x416333
cmp dword [ebp - 0xc], edi
je 0x416350
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x54], 1
jmp 0x416350
push 2
push dword [ebx + 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edi, edi
cmp dword [ebp - 0x10], edi
je 0x41636d
cmp dword [ebx + 0x54], edi
jne 0x416361
cmp dword [ebp - 0x14], edi
jne 0x41636d
push dword [ebx + 0x4c]
mov dword [ebx + 0x14], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebp - 8], edi
je 0x4162a1
pop edi
pop esi
leave
ret
Function at 0x418b34
Capabilities:
Delete file
Set file attributes

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
xor eax, eax
push eax
push eax
push 2
push eax
push 5
mov edi, 0x40000000
push edi
push ebp
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x418bfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp eax, 5
je 0x418ba5
cmp eax, 0x7b
je 0x418ba5
cmp eax, 3
jne 0x418be6
cmp dword [esp + 0x20], 0
je 0x418bf2
mov eax, ebp
call fcn.00414d44
mov ebp, eax
xor eax, eax
cmp ebp, eax
je 0x418bf2
push eax
push eax
push 2
push eax
push 1
push edi
push ebp
call esi
push ebp
mov ebx, eax
call fcn.0041fde1
pop ecx
jmp 0x418be1
push ebp
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x418be6
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push eax
push eax
push 2
push eax
push 1
push edi
push ebp
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x418bfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp ebx, 0xffffffff
jne 0x418bfc
cmp dword [esp + 0x10], 0
mov eax, 0xa0000031
je 0x418bf6
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x418e1d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43f050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x44]
and dword [edi], 0
cmp dword [esi + 0xc], 0xffffffff
je 0x418e42
mov eax, dword [esi]
call dword [eax + 0x28]
push edi
push dword [ebp + 8]
push ebx
call fcn.00418c04
add esp, 0xc
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
jne 0x418e5b
xor eax, eax
jmp 0x418eaf
call fcn.0041940e
push ebx
call fcn.004193d7
test ebx, ebx
je 0x418eac
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x418eac
cmp word [ebx + 2], 0x3a
jne 0x418eac
cmp word [ebx + 4], 0x5c
jne 0x418eac
mov ax, word [ebx]
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [esi + 0x10], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041f998
leave
ret 4
Function at 0x418f3a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4190d3
push edi
mov edi, dword [esi + 0x1c]
sub edi, dword [esi + 0x20]
mov dword [ebp - 4], eax
jns 0x418f64
mov dword [esi + 0x44], 0xa0000047
jmp 0x419099
cmp dword [esi + 0x14], 0
jne 0x418f83
mov eax, dword [esi + 0x18]
test eax, eax
je 0x418f83
push eax
call fcn.0041febe
pop ecx
mov dword [esi + 0x14], eax
test eax, eax
je 0x419099
cmp ebx, edi
ja 0x418fb4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x418fb4
mov ecx, dword [esi + 0x20]
push ebx
add ecx, eax
push ecx
push dword [ebp + 8]
call fcn.00422db0
add dword [esi + 0x20], ebx
mov eax, dword [ebp + 0xc]
add esp, 0xc
add dword [esi + 0x28], ebx
adc dword [esi + 0x2c], 0
mov dword [eax], ebx
jmp 0x4190cf
mov eax, dword [ebp + 0xc]
and dword [eax], 0
test edi, edi
jle 0x418ff7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x418ff7
mov ecx, dword [esi + 0x20]
push edi
add ecx, eax
push ecx
push dword [ebp + 8]
call fcn.00422db0
and dword [esi + 0x1c], 0
and dword [esi + 0x20], 0
mov eax, dword [ebp + 0xc]
add dword [eax], edi
mov eax, dword [ebp + 8]
add eax, edi
mov dword [ebp - 4], eax
mov eax, edi
cdq
add esp, 0xc
sub ebx, edi
add dword [esi + 0x28], eax
adc dword [esi + 0x2c], edx
mov eax, dword [esi + 0x18]
cmp ebx, eax
jb 0x41902d
and dword [ebp + 8], 0
push 0
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp - 4]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419090
mov eax, dword [ebp + 8]
add dword [esi + 0x28], eax
mov ecx, dword [ebp + 0xc]
adc dword [esi + 0x2c], 0
add dword [ecx], eax
jmp 0x4190cf
mov edx, eax
shr edx, 1
lea ecx, [ebx + 0x1000]
cmp ecx, edx
ja 0x419045
shr eax, 2
mov dword [ebp + 8], edx
cmp ecx, eax
ja 0x419048
mov dword [ebp + 8], eax
push 0
mov edi, 0x1000
push edi
push dword [esi + 0x2c]
push dword [esi + 0x28]
call fcn.00428a90
mov ecx, eax
or ecx, edx
je 0x419071
mov ecx, dword [ebp + 8]
cmp ecx, edi
jbe 0x41906a
sub ecx, eax
cmp ecx, ebx
jb 0x419071
mov dword [ebp + 8], ecx
xor eax, eax
push eax
lea edi, [esi + 0x1c]
push edi
push dword [ebp + 8]
mov dword [edi], eax
push dword [esi + 0x14]
mov dword [esi + 0x20], eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41909d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x44], eax
xor eax, eax
jmp 0x4190d2
mov edi, dword [edi]
test edi, edi
je 0x4190cf
cmp ebx, edi
jb 0x4190a9
mov ebx, edi
test ebx, ebx
je 0x4190cf
mov eax, dword [esi + 0x14]
add eax, dword [esi + 0x20]
push ebx
push eax
push dword [ebp - 4]
call fcn.00422db0
add dword [esi + 0x20], ebx
mov eax, dword [ebp + 0xc]
add esp, 0xc
add dword [esi + 0x28], ebx
adc dword [esi + 0x2c], 0
add dword [eax], ebx
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 8
Function at 0x41940e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 1
push 0
push 0
push dword [ebp - 4]
mov edi, eax
call fcn.00428b50
xor ecx, ecx
add eax, edi
adc edx, ecx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edx
pop edi
leave
ret

Function at 0x41944d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x40], edi
jne 0x41945f
xor eax, eax
jmp 0x419486
push ebx
mov ebx, dword [ebp + 0xc]
push edi
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
mov dword [esi + 0x1c], edi
push dword [esi + 0xc]
mov dword [esi + 0x20], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
je 0x419485
add dword [esi + 0x28], ebx
adc dword [esi + 0x2c], edi
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x419675
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x13c]
test eax, eax
jne 0x419686
inc eax
leave
ret
push 0
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [esi + 0x3c]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
cmp ecx, dword [esi + 0x13c]
je 0x4196a9
xor eax, eax
leave
ret
and dword [esi + 0x13c], 0
leave
ret

Function at 0x4196f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
call fcn.00419675
mov ebx, dword [ebp + 0xc]
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp + 0xc], eax
cmp eax, edi
je 0x419799
cmp dword [esi + 0x38], 2
jne 0x419799
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 0x30]
push edi
mov edi, 0x400
push edi
push ecx
push eax
call fcn.004289e0
push 0
push edi
push edx
push eax
call fcn.004289e0
push 0
push 0xa
push edx
push eax
call fcn.004289e0
mov dword [ebp - 0xc], eax
xor eax, eax
add ebx, dword [esi + 0x30]
mov dword [ebp - 8], edx
adc eax, dword [esi + 0x34]
mov dword [esi + 0x30], ebx
xor ebx, ebx
push ebx
push edi
push eax
push dword [esi + 0x30]
mov dword [esi + 0x34], eax
call fcn.004289e0
push ebx
push edi
push edx
push eax
call fcn.004289e0
push ebx
push 0xa
push edx
push eax
call fcn.004289e0
cmp dword [ebp - 0xc], eax
jne 0x41978e
cmp dword [ebp - 8], edx
je 0x41979f
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x41979f
add dword [esi + 0x30], ebx
adc dword [esi + 0x34], edi
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4197a9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
mov dword [ebp - 0x10], 0x436014
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
cmp eax, ebx
je 0x4197dd
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041571a
push dword [esi + 0x10]
call fcn.0041fde1
pop ecx
cmp dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], ebx
jne 0x4197fa
xor edi, edi
inc edi
lea esi, [ebp - 0x10]
call fcn.00415770
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
mov dword [ebp - 4], 1
call fcn.00419675
test eax, eax
jne 0x41980d
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 0xc]
cmp ecx, 0xffffffff
je 0x41982c
lea eax, [esi + 0x14]
push ecx
call fcn.00414f06
pop ecx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0xc], 0xffffffff
push 6
xor eax, eax
pop ecx
lea edi, [esi + 0x14]
mov dword [esi + 0x38], ebx
rep stosd dword es:[edi], eax
cmp dword [ebp + 8], ebx
je 0x41984c
cmp dword [ebp - 0xc], ebx
je 0x41984c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 4]
jmp 0x4197e9
Function at 0x41b7d9
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebx + 0x9c]
push edi
cmp eax, 0xffffffff
je 0x41b843
cmp eax, 0x40
jbe 0x41b800
push esi
lea esi, [ebx + 0x40]
push ebx
call fcn.0041bb35
pop ecx
mov dword [ebx + 0x9c], 0x14
pop esi
mov eax, dword [ebx + 0x9c]
push 0x40
pop ecx
sub ecx, eax
push ecx
add eax, ebx
push 0
push eax
call fcn.00422930
add esp, 0xc
xor eax, eax
xor dword [ebx + eax*4], 0x36363636
inc eax
cmp eax, 0x10
jb 0x41b81b
lea eax, [ebx + 0x40]
call fcn.0041baa4
push 0x40
mov edi, eax
mov ecx, ebx
call fcn.0041bacf
or dword [ebx + 0x9c], 0xffffffff
pop ecx
cmp dword [esp + 0xc], 0
je 0x41b85b
push dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
lea edi, [ebx + 0x40]
call fcn.0041bacf
pop ecx
pop edi
ret

Function at 0x41b85d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x43f050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp dword [ebx + 0x9c], 0xffffffff
push esi
push edi
mov dword [ebp - 0x1c], eax
je 0x41b88c
push 0
push 0
call fcn.0041b7d9
pop ecx
pop ecx
lea eax, [ebp - 0x18]
lea esi, [ebx + 0x40]
push eax
call fcn.0041bb35
pop ecx
xor eax, eax
xor dword [ebx + eax*4], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x41b89b
mov eax, esi
call fcn.0041baa4
push 0x40
mov edi, esi
mov ecx, ebx
call fcn.0041bacf
push 0x14
lea ecx, [ebp - 0x18]
call fcn.0041bacf
lea eax, [ebp - 0x18]
push eax
call fcn.0041bb35
add esp, 0xc
cmp dword [ebp + 0xc], 0
pop edi
pop esi
pop ebx
jbe 0x41b8eb
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call fcn.00422db0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f998
leave
ret
Function at 0x41b8f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
push edi
xor esi, esi
lea edx, [eax + 0x1c]
mov ecx, dword [edx]
mov edi, ecx
ror edi, 8
and edi, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or edi, ecx
mov dword [ebp + esi*4 - 0x150], edi
inc esi
add edx, 4
cmp esi, 0x10
jb 0x41b908
push 0x40
lea ecx, [ebp - 0x148]
pop edx
mov esi, dword [ecx + 0x2c]
xor esi, dword [ecx + 0x18]
xor esi, dword [ecx - 8]
xor esi, dword [ecx]
add ecx, 4
dec edx
rol esi, 1
mov dword [ecx + 0x34], esi
jne 0x41b939
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
and dword [ebp - 4], 0
mov dword [ebp - 8], edi
mov edi, dword [eax + 0x18]
mov dword [ebp - 0x10], edi
mov edi, esi
not edi
and edi, dword [ebp - 8]
mov dword [ebp - 0xc], edx
mov ebx, ecx
and ebx, esi
xor edi, ebx
rol edx, 5
add edx, edi
mov edi, dword [ebp - 4]
add edx, dword [ebp + edi*4 - 0x150]
mov edi, dword [ebp - 0x10]
inc dword [ebp - 4]
ror esi, 2
cmp dword [ebp - 4], 0x14
lea edx, [edx + edi + 0x5a827999]
mov edi, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov ecx, esi
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x10], edi
jb 0x41b968
mov dword [ebp - 4], 0x14
mov ebx, dword [ebp - 8]
xor ebx, ecx
mov dword [ebp - 0xc], edx
xor ebx, esi
rol edx, 5
add edx, ebx
mov ebx, dword [ebp - 4]
add edx, dword [ebp + ebx*4 - 0x150]
inc dword [ebp - 4]
ror esi, 2
cmp dword [ebp - 4], 0x28
lea edx, [edx + edi + 0x6ed9eba1]
mov edi, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov ecx, esi
mov esi, dword [ebp - 0xc]
jb 0x41b9b2
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0x28
mov edi, ecx
xor edi, esi
and edi, dword [ebp - 8]
mov ebx, ecx
and ebx, esi
xor edi, ebx
mov ebx, dword [ebp - 4]
add edi, dword [ebp + ebx*4 - 0x150]
mov dword [ebp - 0xc], edx
rol edx, 5
add edx, dword [ebp - 0x10]
inc dword [ebp - 4]
lea edx, [edi + edx - 0x70e44324]
mov edi, dword [ebp - 8]
ror esi, 2
push 0x3c
mov dword [ebp - 0x10], edi
pop edi
mov dword [ebp - 8], ecx
mov ecx, esi
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 4], edi
jb 0x41b9f3
mov dword [ebp - 4], edi
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
xor edi, ecx
mov dword [ebp - 0xc], edx
xor edi, esi
add edi, dword [ebp + ebx*4 - 0x150]
mov ebx, dword [ebp - 8]
rol edx, 5
add edx, dword [ebp - 0x10]
inc dword [ebp - 4]
ror esi, 2
cmp dword [ebp - 4], 0x50
mov dword [ebp - 8], ecx
mov ecx, esi
mov esi, dword [ebp - 0xc]
lea edx, [edi + edx - 0x359d3e2a]
mov dword [ebp - 0x10], ebx
jb 0x41ba39
mov edi, dword [eax + 8]
add edi, edx
mov edx, dword [eax + 0xc]
add edx, esi
mov dword [eax + 0xc], edx
mov edx, dword [eax + 0x10]
add edx, ecx
mov ecx, dword [eax + 0x14]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 8]
add ecx, edx
mov dword [eax + 0x14], ecx
mov ecx, dword [eax + 0x18]
mov dword [eax + 8], edi
pop edi
add ecx, ebx
pop esi
mov dword [eax + 0x18], ecx
pop ebx
leave
ret