joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409ca0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x14
mov eax, dword [0x43b14c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x409cfd
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00418df4
add esp, 0x14
ret
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x409d16
mov dword [esp + 4], ebx
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 4]
pop ebx
xor ecx, esp
call fcn.00418df4
add esp, 0x14
ret

Function at 0x409d40
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x254
mov eax, dword [0x43b14c]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
xor ebx, ebx
lea edi, [esp + 0x10]
lea esi, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
call fcn.00409bf0
test eax, eax
je 0x409dee
cmp dword [esp + 0xc], 6
jbe 0x409dee
call fcn.00409ca0
test eax, eax
jne 0x409dee
push 0x208
lea ecx, [esp + 0x56]
push ebx
push ecx
mov word [esp + 0x5c], ax
call fcn.0041a630
add esp, 0xc
lea edx, [esp + 0x50]
push 0x104
push edx
call fcn.00408b70
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x38
lea eax, [esp + 0x1c]
push ebx
push eax
mov dword [esp + 0x20], 0x3c
call fcn.0041a630
add esp, 0xc
lea edx, [esp + 0x14]
lea ecx, [esp + 0x50]
push edx
mov dword [esp + 0x24], str.runas
mov dword [esp + 0x28], ecx
mov dword [esp + 0x34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
lea eax, [ebx + 1]
jne 0x409df0
mov eax, ebx
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00418df4
add esp, 0x254
ret
Function at 0x40b120
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x429b88
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43b14c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x40]
mov edi, dword [eax + 8]
mov ebp, dword [eax]
mov eax, dword [eax + 0xc]
mov edx, dword [0x44130c]
xor ebx, ebx
mov dword [esp + 0x28], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x44130c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], edi
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0x44]
lea eax, [esp + 0x40]
call fcn.004030d0
mov edx, dword [esp + 0x40]
cmp dword [edx - 4], 1
jle 0x40b1ab
mov ecx, dword [edx - 0xc]
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.00403760
mov edx, dword [esp + 0x40]
push ebp
lea ebx, [esp + 0x20]
mov ecx, edi
call fcn.00412620
add esp, 4
test eax, eax
je 0x40b2e0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x40b2e0
push ebx
call fcn.00418bbe
add esp, 4
push ebx
mov edi, eax
push 0
push edi
call fcn.0041a630
mov edx, dword [esp + 0x4c]
add esp, 0xc
cmp dword [edx - 4], 1
jle 0x40b201
mov eax, dword [edx - 0xc]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.00403760
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x24]
push edi
push ebp
call fcn.004126c0
add esp, 8
test eax, eax
jne 0x40b26a
mov esi, str._ustr
call fcn.00401aa0
test edi, edi
je 0x40b22a
push edi
call fcn.00418de9
add esp, 4
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b252
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
lea edx, [esp + 0x20]
push edx
push ebx
xor ebp, ebp
push edi
mov dword [esp + 0x2c], ebp
call fcn.00410860
add esp, 0xc
test eax, eax
jne 0x40b28a
mov esi, str._u6pf
jmp 0x40b218
cmp edi, ebp
je 0x40b2d3
cmp ebx, ebp
jne 0x40b296
cmp ebp, ebp
je 0x40b2d3
mov eax, dword [esi]
cmp eax, ebp
jne 0x40b2a7
push ebx
call fcn.00418ee0
add esp, 4
jmp 0x40b2b6
mov ecx, dword [esi + 8]
add ecx, ebx
push ecx
push eax
call fcn.00418faa
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x40b2d3
mov edx, dword [esi + 8]
push ebx
push edi
add edx, eax
push ebx
push edx
call fcn.004191c5
add esp, 0x10
add dword [esi + 8], ebx
adc dword [esi + 0xc], ebp
mov dword [esp + 0x18], 1
jmp 0x40b21d
mov esi, str._ulen
call fcn.00401aa0
jmp 0x40b22a
Function at 0x40c080
Capabilities:
Create process on windows
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x429558
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43b14c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x40c192
push 0xf003f
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, eax
test ebp, ebp
je 0x40c1a1
lea eax, [esp + 0x1c]
push eax
push 1
push ebp
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40c196
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x40c196
mov edx, dword [0x44130c]
mov eax, dword [edx + 0xc]
mov ecx, 0x44130c
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push esi
push str.sc.exe_stop__s
lea edi, [esp + 0x1c]
mov dword [esp + 0x48], 0
call fcn.004016c0
mov esi, dword [esp + 0x1c]
add esp, 8
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.00403020
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c16c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x40], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c196
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40c196
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x40c1a1
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x40c1ac
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x4103e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4294f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x43b14c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, ebx
mov edi, edx
mov dword [esp + 0x18], 0
call fcn.00401360
mov eax, dword [esp + 0x20]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x10], esp
mov edi, esp
call fcn.004014f0
sub esi, ebx
sar esi, 2
push esi
add eax, 0x10
push 0
push ebx
mov dword [edi], eax
call fcn.0040fee0
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410467
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x410480
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push edi
lea ecx, [esp + 8]
push ecx
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
ja 0x4104ac
xor eax, eax
pop edi
add esp, 0x10
ret
push ebp
push esi
lea ebp, [edi + 1]
push ebp
call fcn.00418bbe
push ebp
xor ebp, ebp
mov esi, eax
push ebp
push esi
call fcn.0041a630
add esp, 0x10
push esi
push edi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4104f4
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x437788
push esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x4104fd
pop esi
pop ebp
xor eax, eax
pop edi
add esp, 0x10
ret
mov eax, dword [esp + 0xc]
mov cx, word [eax + 0xa]
mov dx, word [eax + 8]
mov di, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
movzx eax, di
push eax
movzx edx, dx
movzx eax, cx
mov ecx, dword [esp + 0x20]
push edx
push eax
push 0x43778c
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
cmp esi, ebp
je 0x41053e
push esi
call fcn.0041970c
add esp, 4
pop esi
pop ebp
mov eax, 1
pop edi
add esp, 0x10
ret

Function at 0x410860
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0x1000
jae 0x410873
xor eax, eax
jmp 0x4108c8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41088d
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x410891
xor eax, eax
jmp 0x4108c8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0x4550
je 0x4108ac
xor eax, eax
jmp 0x4108c8
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 4]
xor edx, edx
cmp ecx, 0x14c
sete dl
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x410960
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
je 0x410972
cmp dword [ebp + 0x10], 0
jne 0x410979
xor eax, eax
jmp 0x410aa8
cmp dword [ebp + 8], 0
jne 0x410986
xor eax, eax
jmp 0x410aa8
mov dword [ebp - 0x14], 0
push 0x432dcc
call fcn.00410710
call fcn.00410800
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x20
jne 0x4109d0
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410ab0
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x410aa8
push 0x432df0
push 0x432e00
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4109f7
xor eax, eax
jmp 0x410aa8
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
test eax, eax
jne 0x410a14
xor eax, eax
jmp 0x410aa8
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00410860
add esp, 0xc
test eax, eax
jne 0x410a37
xor eax, eax
jmp 0x410aa8
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0xc]
je 0x410a43
xor eax, eax
jmp 0x410aa8
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jne 0x410a57
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x410a82
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410ea0
add esp, 0x18
mov dword [ebp - 0x14], eax
jmp 0x410aa5
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410ab0
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x411950
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0x10], 0
jle 0x411986
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x4c], edx
jmp 0x411994
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x34], ecx
cmp dword [ebp + 0x10], 0
jle 0x4119c9
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x1c]
add eax, 8
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x58], edx
mov eax, dword [ecx - 4]
mov dword [ebp - 0x54], eax
jmp 0x4119d7
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 0x10], 0
jle 0x411a0c
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [edx - 4]
mov dword [ebp - 0x5c], ecx
jmp 0x411a1a
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0x10], 0
jle 0x411a4f
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x68], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x64], edx
jmp 0x411a5d
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 8
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x48], 0
xor eax, eax
mov word [ebp - 0x44], ax
mov word [ebp - 0x44], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0x48], esp
and esp, 0xfffffff0
push 0x33
call 0x411abd
add dword [esp], 5
retf

Function at 0x411b50
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
cmp dword [ebp + 8], 0
je 0x411b70
cmp dword [ebp + 0xc], 0
jne 0x411b6a
cmp dword [ebp + 0x10], 0
je 0x411b70
cmp dword [ebp + 0x14], 0
jne 0x411b72
jmp 0x411bc5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.00411b85
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411bd0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
cmp dword [ebp + 8], 0
je 0x411bf0
cmp dword [ebp + 0xc], 0
jne 0x411bea
cmp dword [ebp + 0x10], 0
je 0x411bf0
cmp dword [ebp + 0x14], 0
jne 0x411bf4
xor al, al
jmp 0x411c58
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.00411c0b
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x411c60
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x33
call fcn.00411c7b
Function at 0x4144f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x4144f7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x4145d4
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4323f0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4323f0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4323f0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4323f0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4323f0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4323f0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4323f0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4323f0]
inc ecx
sub edx, 8
sub esi, 1
jne 0x414510
pop edi
test edx, edx
je 0x4145fb
jmp 0x4145e0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4323f0]
inc ecx
sub edx, 1
jne 0x4145e0
not eax
pop esi
ret

Function at 0x414600
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4323f0]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x4323f0]
mov dword [edx + 8], ecx
ret

Function at 0x414650
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x4323f0]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4323f0]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x414da0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x414dd2
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414dc8
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x414de5
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.0041d460
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x414e00
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x414e33
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414e2d
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x414e5f
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x414e45
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.0041d460
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x414e76
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x414e70
cmp byte [esi + 8], 0
je 0x414e70
or eax, 0xffffffff
add esp, 8
ret
Function at 0x414f60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x414fa5
cmp byte [esi + 1], 0
je 0x414fad
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x414fc2
cmp byte [esi + 1], 0
je 0x414fb4
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x414fcb
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x414f7e
or eax, 0xffffffff
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x414fcb
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, 0xffff
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x414fdf
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call fcn.00418ee0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x414ffd
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0xffffffff
cmp edi, eax
jbe 0x415111
jmp 0x415020
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x415031
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x41504a
mov ebp, 0x404
cmp byte [esi], 0
je 0x41506f
cmp byte [esi + 1], 0
je 0x415111
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x415072
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebp
je 0x41509a
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x415094
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x4150c0
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x4150ab
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
push edi
add ecx, eax
push ecx
push ebx
call fcn.0041d460
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x415111
lea eax, [ebp - 3]
test eax, eax
jl 0x4150fc
dec eax
cmp byte [eax + ebx], 0x50
jne 0x4150ec
cmp byte [eax + ebx + 1], 0x4b
jne 0x4150ec
cmp byte [eax + ebx + 2], 5
jne 0x4150ec
cmp byte [eax + ebx + 3], 6
je 0x4150f2
test eax, eax
jge 0x4150d0
jmp 0x4150fc
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
jne 0x415111
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x415014
push ebx
call fcn.00418e03
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret