joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc4d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4bc4fb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4bc51f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4bc53a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x4c10f9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x4c111b
cmp dword [edi + 0x3c], 0
jne 0x4c111b
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.004d72f1
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.004c1148
pop edi
pop esi
pop ebx
ret 8

Function at 0x4c1196
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.004d72f1
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4c11c7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.004c11da
pop edi
pop esi
pop ebx
ret 8

Function at 0x4c27b1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c27e9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c5c2e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c5c06
jmp 0x4c27f5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c43db
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c441d
call fcn.004d72f1
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c441d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c4414
xor eax, eax
jmp 0x4c4425
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c442b
pop edi
pop esi
pop ebx
ret 4
Function at 0x4d1d8b
Capabilities:
Hash data using murmur3

Disassembly:
add ah, byte [ebx]
ror byte [ebx], 0xdf
or dword [0x52c931], edi
add esi, dword [0x5233a4]
xor edx, eax
not edx
sub edx, edx
rol edx, 0xd
xor dword [0x52c413], eax
cmp dword [0x5256f2], 0x284a2
jp 0x4d1dbd
and edx, 0x5cf87cd3
xchg ebx, esi
not esi
xor dword [0x52c365], eax
sub eax, 0x49489812
or eax, 0xb08050d6
sub eax, 0x4b85fa66
xor dword [0x52c5f3], ecx
and edx, 0xecd856f8
or ebx, 0x70c7adca
mov ecx, 0x79e92675
and esi, esi
cmp dword [0x525d71], eax
jle 0x4d1e04
xor dword [0x52c8f4], 0xb7f2d976
mov edx, dword [0x51c4b6]
and edi, esi
mov dword [0x52c4dd], edi
or eax, dword [0x521826]
shl ebx, 0x1b
and esi, ebx
cmp edi, 0x7a3218fa
jae 0x4d1e28
shr esi, 8
xchg esi, eax
and edx, dword [0x51e53e]
dec ecx
jne 0x4d1df0
add edx, 0xd145cefd
xor ebx, 0xe1ae682f
rol edx, 0x15
inc ecx
mov esi, ebp
add ebx, 0x8af5860c
shl edi, 0x18
shr ecx, 4
or dword [0x52c7e0], ecx
mov ecx, 0x5732eca2
mov edi, dword [0x51cd63]
xchg edi, edx
xor edx, ebx
invalid
invalid

Function at 0x4d57a8
Capabilities:
Create http request

Disassembly:
mov eax, 0x4eb71c
call fcn.004aefd8
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x4d57e0
call fcn.004d72f1
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x4d5805
push eax
push dword [esi + 4]
call fcn.004d6443
jmp 0x4d5811
push esi
push eax
mov ecx, 0x529c18
call fcn.004d5822
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x4d5ad3
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x4eb77b
call fcn.004aefd8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004c749f
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x52251c]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.004c5910
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.004c5910
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x401d44
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, edx
not eax
mov edx, 0xff
cmp edi, 8
jb 0x401df9
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x532ed0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x532ed0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x532ed0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x532ed0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x532ed0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x532ed0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x532ed0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x532ed0]
inc ecx
sub edi, 8
dec esi
jne 0x401d5e
pop ebx
test edi, edi
je 0x401e12
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x532ed0]
inc ecx
dec edi
jne 0x401dfd
pop edi
not eax
pop esi
ret

Function at 0x401e17
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x532ed0]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x532ed0]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x401e9f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
test byte [esi], 1
push edi
mov edi, eax
jne 0x401ed1
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401ecc
and dword [ebp - 4], eax
mov dword [esi + 8], 7
mov eax, dword [ebp - 4]
jmp 0x401ef9
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x401ee2
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 4]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00508ba0
add esp, 0xc
add dword [esi + 0x14], edi
mov eax, edi
pop edi
leave
ret
Function at 0x402820
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
cmp byte [eax], 0
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], 1
mov dword [ebp + 8], eax
je 0x40284b
cmp byte [eax + 1], 0x3a
jne 0x40284b
inc eax
inc eax
cmp byte [eax], 0x5c
jne 0x402851
inc eax
push esi
jmp 0x4028a0
cmp cl, 0x5c
je 0x402871
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x402854
xor esi, esi
test esi, esi
jne 0x402875
cmp dword [ebp + 0xc], esi
jne 0x402878
xor eax, eax
inc eax
pop esi
leave
ret
mov esi, eax
jmp 0x402862
mov byte [esi], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x402896
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4028a8
test esi, esi
je 0x40286b
mov byte [esi], 0x5c
lea eax, [esi + 1]
mov cl, byte [eax]
test cl, cl
jne 0x402854
jmp 0x40286b
test esi, esi
je 0x4028af
mov byte [esi], 0x5c
xor eax, eax
jmp 0x40286e

Function at 0x4028b3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
cmp word [eax], 0
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], 1
mov dword [ebp + 8], eax
je 0x4028e1
cmp word [eax + 2], 0x3a
jne 0x4028e1
add eax, 4
push ebx
push esi
push 0x5c
pop ebx
cmp word [eax], bx
jne 0x402948
inc eax
inc eax
jmp 0x402948
movzx ecx, cx
jmp 0x4028fe
cmp cx, bx
je 0x402915
inc eax
inc eax
movzx ecx, word [eax]
test cx, cx
jne 0x4028f4
xor esi, esi
test esi, esi
jne 0x402919
cmp dword [ebp + 0xc], esi
jne 0x40291e
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
mov esi, eax
jmp 0x402905
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40293c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402952
test esi, esi
je 0x40290e
mov eax, ebx
mov word [esi], ax
lea eax, [esi + 2]
movzx ecx, word [eax]
test cx, cx
jne 0x4028ef
jmp 0x40290e
test esi, esi
je 0x402959
mov word [esi], bx
xor eax, eax
jmp 0x402911
Function at 0x403d5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x74], eax
mov eax, dword [edi + 0x8c]
cmp ecx, eax
jbe 0x403d7f
mov ecx, eax
mov dword [edi + 0x78], ecx
test ecx, ecx
je 0x403f03
cmp dword [edi + 0x6c], 0
jne 0x403e0c
mov eax, dword [edi + 0x88]
test eax, eax
je 0x403e0c
mov ebx, 0x4000
cmp eax, ebx
jae 0x403da5
mov ebx, eax
push dword [edi + 0x64]
mov eax, ebx
mov esi, edi
call fcn.00401e9f
pop ecx
test eax, eax
je 0x403f0b
sub dword [edi + 0x88], ebx
test byte [edi + 0x3c], 1
mov eax, dword [edi + 0x64]
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], ebx
je 0x403e0c
xor esi, esi
test ebx, ebx
jbe 0x403e0c
mov eax, dword [edi + 0x98]
mov ecx, dword [edi + 0x64]
lea edx, [esi + ecx]
and eax, 0xfffd
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor byte [edx], cl
mov eax, dword [edi + 0x64]
mov dl, byte [esi + eax]
lea ecx, [edi + 0x90]
call fcn.00401e17
inc esi
cmp esi, ebx
jb 0x403dd5
mov eax, dword [edi + 0x9c]
mov ecx, dword [edi + 0x6c]
cmp eax, ecx
jbe 0x403e1b
mov eax, ecx
test eax, eax
je 0x403e4a
mov edx, dword [edi + 0x68]
lea esi, [edx + eax]
mov dl, byte [esi - 1]
sub dword [edi + 0x8c], eax
sub ecx, eax
sub dword [edi + 0x9c], eax
mov dword [edi + 0x6c], ecx
mov dword [edi + 0x68], esi
jne 0x403e4a
cmp dl, byte [edi + 0xa0]
jne 0x403f14
cmp word [edi + 0x3e], 0
jne 0x403ea7
mov eax, dword [edi + 0x78]
mov esi, dword [edi + 0x6c]
cmp eax, esi
jae 0x403e5d
mov esi, eax
push esi
push dword [edi + 0x68]
push dword [edi + 0x74]
call fcn.00508ba0
mov ecx, dword [edi + 0x74]
lea ebx, [edi + 0x84]
mov eax, dword [ebx]
add esp, 0xc
mov edx, esi
call fcn.00401d44
sub dword [edi + 0x8c], esi
mov ecx, dword [edi + 0x8c]
sub dword [edi + 0x6c], esi
sub dword [edi + 0x78], esi
add dword [edi + 0x68], esi
add dword [edi + 0x7c], esi
add dword [ebp - 4], esi
mov dword [ebx], eax
mov eax, dword [edi + 0x74]
add eax, esi
mov dword [edi + 0x74], eax
test ecx, ecx
jmp 0x403ef7
mov eax, dword [edi + 0x74]
mov ebx, dword [edi + 0x7c]
push 2
lea esi, [edi + 0x68]
mov dword [ebp + 8], eax
call fcn.00403a68
pop ecx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x403ec7
cmp eax, 1
jne 0x403f1d
mov esi, dword [edi + 0x7c]
mov ecx, dword [ebp + 8]
sub esi, ebx
lea ebx, [edi + 0x84]
mov eax, dword [ebx]
mov edx, esi
call fcn.00401d44
sub dword [edi + 0x8c], esi
add dword [ebp - 4], esi
cmp dword [ebp + 0xc], 1
mov dword [ebx], eax
mov eax, dword [edi + 0x8c]
je 0x403f03
test eax, eax
je 0x403f03
cmp dword [edi + 0x78], 0
jne 0x403d8a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
mov dword [edi + 8], 7
jmp 0x403f24
mov dword [edi + 8], 0x13
jmp 0x403f24
mov dword [edi + 8], 0x12
xor eax, eax
jmp 0x403f06
Function at 0x403f28
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push 1
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4040de
cmp dword [esi + 0x24], 0xffffffff
je 0x4040de
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [esi + 8], edi
test al, 1
je 0x403fa9
cmp word [esi + 0x58], di
jne 0x403f78
push ebx
mov eax, esi
call fcn.004022cb
pop ecx
cmp dword [esi + 8], edi
jne 0x4040d2
xor eax, eax
inc eax
mov word [esi + 0x58], ax
push dword [ebx + 0x20]
push dword [ebp + 8]
push esi
call fcn.00403d5c
add esp, 0xc
mov dword [ebx + 0x20], eax
cmp dword [esi + 8], edi
jne 0x403f9e
cmp dword [esi + 0x8c], edi
je 0x403f9e
push 5
jmp 0x4040e0
xor eax, eax
mov word [esi + 0x58], ax
jmp 0x4040d2
test byte [ebx + 4], 0x10
je 0x403fd5
test al, 2
je 0x403fce
push 1
push dword [ebp + 8]
test eax, eax
jns 0x403fc3
call fcn.004028b3
jmp 0x403fc8
call fcn.00402820
pop ecx
pop ecx
cmp eax, edi
je 0x40402c
xor eax, eax
jmp 0x4040e1
cmp eax, 4
jne 0x403fdf
mov eax, dword [ebp + 8]
jmp 0x404024
mov dword [ebp - 4], eax
and dword [ebp - 4], 0x80000000
push edi
push dword [ebp + 8]
je 0x403ff6
call fcn.004028b3
jmp 0x403ffb
call fcn.00402820
pop ecx
pop ecx
cmp eax, edi
je 0x40402c
push edi
push dword [ebx + 4]
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 8]
cmp dword [ebp - 4], edi
je 0x40401e
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x404024
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x404038
mov dword [esi + 8], 1
jmp 0x4040d2
push ebx
mov eax, esi
call fcn.004022cb
pop ecx
cmp dword [esi + 8], edi
jne 0x4040c3
cmp dword [esi + 0x34], edi
jne 0x4040a4
push 0x4000
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esi + 0x34], eax
cmp eax, edi
jne 0x4040a4
mov dword [esi + 8], 2
jmp 0x4040a4
push 0x4000
push dword [esi + 0x34]
push esi
call fcn.00403d5c
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, edi
je 0x4040a9
push edi
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [esi + 0x34]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40409d
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], eax
je 0x4040a4
mov dword [esi + 8], 3
cmp dword [esi + 8], edi
je 0x404067
cmp dword [esi + 8], edi
jne 0x4040c3
lea eax, [ebx + 0x18]
push eax
lea eax, [ebx + 8]
push eax
add ebx, 0x10
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp dword [ebp + 0xc], 4
je 0x4040d2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, esi
call fcn.0040229c
mov eax, dword [esi + 8]
jmp 0x4040e1
push 9
pop eax
pop edi
pop ebx
leave
ret
Function at 0x40417a
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
mov esi, eax
lea eax, [ebp - 0x48]
push eax
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x40419a
inc eax
jmp 0x404318
mov ecx, dword [ebp - 0x48]
xor eax, eax
push ebx
xor ebx, ebx
mov edx, ecx
inc eax
and edx, eax
mov dword [ebp - 8], ebx
je 0x4041af
mov dword [ebp - 8], eax
test cl, 2
je 0x4041b8
or dword [ebp - 8], 2
test cl, 4
je 0x4041c1
or dword [ebp - 8], 4
mov eax, ecx
and eax, 0x10
je 0x4041cc
or dword [ebp - 8], 0x10
test cl, 0x20
je 0x4041d5
or dword [ebp - 8], 0x20
cmp eax, ebx
je 0x4041e2
or dword [ebp - 8], 0x40000000
jmp 0x4041e9
or dword [ebp - 8], 0x80000000
or dword [ebp - 8], 0x1000000
cmp edx, ebx
jne 0x4041fb
or dword [ebp - 8], 0x800000
push ebx
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x3c], eax
cmp eax, 0x28
jbe 0x4042bd
cmp dword [esi + 0x10], ebx
jne 0x4042bd
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ebx
push dword [esi + 0x48]
call edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [esi + 0x48]
call ebx
push 0
push 0
push 0x24
push dword [esi + 0x48]
call edi
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x48]
call ebx
mov eax, 0x54ad
cmp word [ebp - 4], ax
jne 0x4042b2
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x34]
cmp dword [esi + 0x3c], ecx
jbe 0x4042b2
push 0
push 0
push eax
push dword [esi + 0x48]
call edi
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x48]
call ebx
mov eax, dword [ebp - 0x14]
cmp eax, 0x5a4d
je 0x4042ab
cmp eax, 0x454e
je 0x4042ab
cmp eax, 0x454c
je 0x4042ab
cmp eax, 0x4550
jne 0x4042b2
or dword [ebp - 8], 0x400000
xor eax, eax
push eax
push eax
push eax
push dword [esi + 0x48]
call edi
pop edi
push dword [ebp - 0x38]
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
push dword [ebp - 0x3c]
mov dword [esi + 0x10], eax
call fcn.00404158
push dword [ebp - 0x30]
mov dword [esi], eax
push dword [ebp - 0x34]
call fcn.00404158
push dword [ebp - 0x40]
mov dword [esi + 4], eax
push dword [ebp - 0x44]
call fcn.00404158
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.004040ff
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
shl eax, 0x10
or eax, ecx
add esp, 0x28
mov dword [esi + 0xc], eax
xor eax, eax
pop ebx
pop esi
leave
ret
Function at 0x4049c6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x4049d1
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x404a83
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x534808]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x534808]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x534808]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x534808]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x534808]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x534808]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x534808]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x534808]
inc ecx
sub edi, 8
dec esi
jne 0x4049e8
pop ebx
test edi, edi
je 0x404a9c
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x534808]
inc ecx
dec edi
jne 0x404a87
pop esi
not eax
pop edi
ret

Function at 0x404aa1
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x534808]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x534808]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x404b11
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [esi + 0x14], 0
jne 0x404baf
mov ecx, eax
shr ecx, 8
test byte [esi], 0x10
mov byte [ebp - 0xc], al
mov byte [ebp - 0xb], cl
je 0x404b50
push edi
lea edi, [esi + 0x24]
push eax
mov ecx, edi
call fcn.00404ae7
push dword [ebp - 0xb]
mov ecx, edi
mov byte [ebp - 0xc], al
call fcn.00404ae7
pop ecx
pop ecx
mov byte [ebp - 0xb], al
pop edi
test byte [esi], 1
je 0x404b7a
mov eax, dword [esi + 0x1c]
lea ecx, [eax + 2]
cmp ecx, dword [esi + 0x20]
jb 0x404b69
mov dword [esi + 0x14], 0xb
leave
ret
mov ecx, dword [esi + 4]
mov dx, word [ebp - 0xc]
mov word [eax + ecx], dx
add dword [esi + 0x1c], 2
jmp 0x404ba0
push 0
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 0xc]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404b99
cmp dword [ebp - 4], 2
je 0x404ba0
mov dword [esi + 0x14], 3
test dword [esi], 0x40000000
je 0x404baf
mov dword [esi + 0x14], 0x14
leave
ret