joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f6cc4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x38
mov eax, 0x66f011
call fcn.005b47af
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x34]
push esi
call fcn.00411307
lea eax, [ebp - 0x34]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00414df1
mov bl, al
pop ecx
neg bl
lea ecx, [ebp - 0x1c]
sbb bl, bl
or dword [ebp - 4], 0xffffffff
call fcn.00409ec4
push edi
push 1
lea ecx, [ebp - 0x34]
call fcn.00409de7
add bl, 1
je 0x4f6d14
xor al, al
jmp 0x4f6de2
push esi
lea ecx, [ebp - 0x34]
call fcn.00411307
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 1
push eax
call fcn.00414c98
pop ecx
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00409ec4
push edi
push 1
lea ecx, [ebp - 0x34]
call fcn.00409de7
test bl, bl
jne 0x4f6d0d
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
jb 0x4f6d57
mov eax, dword [esi]
jmp 0x4f6d59
mov eax, esi
push edi
push edi
push 0x80
push 3
push 1
push SysReAllocStringLen
push eax
lea ecx, [ebp - 0x3c]
call fcn.004130cf
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
jne 0x4f6db8
lea eax, [ebp - 0x44]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x3c]
movlpd qword [ebp - 0x44], xmm0
call fcn.0041355a
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x4f6d9c
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x40], 0
ja 0x4f6da8
cmp dword [ebp - 0x44], 1
jbe 0x4f6dbb
test eax, eax
je 0x4f6d0d
push eax
call edi
jmp 0x4f6d0d
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x4f6dc2
push eax
call edi
cmp dword [esi + 0x14], 8
jb 0x4f6dca
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4f6d0d
test eax, 0x11111
setne al
call fcn.005b4759
ret 4
Function at 0x4f99fe
Capabilities:
Create service
Persist via windows service

Disassembly:
push 0x3bc
mov eax, 0x66f909
call fcn.005b47af
push 0x104
lea eax, [ebp - 0x218]
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x4f9a51
lea eax, [ebp - 0x218]
push eax
call fcn.005ff18e
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040a315
lea eax, [ebp - 0x230]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x260]
push 0x687d7c
push eax
call fcn.00417d55
push str.___service
push eax
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 1
push eax
call fcn.0040bca5
add esp, 0x18
push ebx
push 1
lea ecx, [ebp - 0x260]
call fcn.00409de7
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.00409de7
mov edi, 0xf003f
push edi
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x264], esi
mov byte [ebp - 4], 5
test esi, esi
jne 0x4f9b39
push 1
push 3
lea ecx, [ebp - 0x318]
call fcn.004078ff
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x308]
push str.OpenSCManager__error
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0x318]
push eax
push str.ServiceApp::create
push 0x135
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push ebx
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x318]
call fcn.0040843a
jmp 0x4f9c00
push edi
push dword [0x7213fc]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov byte [ebp - 4], 7
test eax, eax
jne 0x4f9bfa
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push ebx
cmovae eax, dword [ebp - 0x248]
push ebx
push ebx
push ebx
push ebx
push eax
mov eax, dword [str.Chistilka]
push 1
push 2
push 0x10
push 0xf01ff
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x268], eax
test eax, eax
jne 0x4f9bfa
push 1
push 3
lea ecx, [ebp - 0x3c8]
call fcn.004078ff
mov byte [ebp - 4], 8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x3b8]
push str.CreateService__error
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0x3c8]
push eax
push str.ServiceApp::create
push 0x14e
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push ebx
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x3c8]
call fcn.0040843a
jmp 0x4f9bfd
push eax
call edi
push esi
call edi
push ebx
push 1
lea ecx, [ebp - 0x248]
call fcn.00409de7
call fcn.005b4759
ret
Function at 0x4fa173
Capabilities:
Query service status

Disassembly:
push 0x2f0
mov eax, 0x66faa2
call fcn.005b47af
lea eax, [ebp - 0x38]
push eax
call fcn.004fa320
mov esi, dword [ebp - 0x38]
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
jne 0x4fa1ec
push 1
push 3
lea ecx, [ebp - 0xec]
call fcn.004078ff
lea eax, [ebp - 0xdc]
mov byte [ebp - 4], 1
push str.Failed_to_open_service__either_not_exists_or_error_occured
push eax
call fcn.0040710b
pop ecx
pop ecx
lea eax, [ebp - 0xec]
push eax
push str.ServiceApp::isRunning
push 0x183
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push 1
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0xec]
jmp 0x4fa2b3
lea eax, [ebp - 0x3c]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push 1
push 3
test eax, eax
jne 0x4fa261
lea ecx, [ebp - 0x19c]
call fcn.004078ff
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x18c]
push str.QueryServiceStatusEx_failed__last_error_:
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0x19c]
push eax
push str.ServiceApp::isRunning
push 0x190
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push ebx
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x19c]
jmp 0x4fa2b3
cmp dword [ebp - 0x30], 4
je 0x4fa2ba
lea ecx, [ebp - 0x24c]
call fcn.004078ff
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 3
push str.isRunning______false
push eax
call fcn.0040710b
pop ecx
pop ecx
lea eax, [ebp - 0x24c]
push eax
push str.ServiceApp::isRunning
push 0x196
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push 1
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x24c]
call fcn.0040843a
jmp 0x4fa30d
lea ecx, [ebp - 0x2fc]
call fcn.004078ff
lea eax, [ebp - 0x2ec]
mov byte [ebp - 4], 4
push str.isRunning______true
push eax
call fcn.0040710b
pop ecx
pop ecx
lea eax, [ebp - 0x2fc]
push eax
push str.ServiceApp::isRunning
push 0x19a
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push 1
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x2fc]
call fcn.0040843a
mov bl, 1
test esi, esi
je 0x4fa318
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
call fcn.005b4759
ret
Function at 0x4fa57a
Capabilities:
Start service

Disassembly:
push 0x100
mov eax, 0x66fb93
call fcn.005b47af
lea eax, [ebp - 0x5c]
push eax
call fcn.004fa320
mov esi, dword [ebp - 0x5c]
xor edi, edi
mov dword [ebp - 4], edi
test esi, esi
je 0x4fa5af
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4fa6a3
mov dword [ebp - 0x18], edi
xor eax, eax
mov edi, str.net_start
mov dword [ebp - 0x14], 7
push edi
mov word [ebp - 0x28], ax
call fcn.005ff18e
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040a315
push dword [0x7213fc]
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040bca5
add esp, 0xc
xor edi, edi
mov byte [ebp - 4], 3
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00409de7
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x58]
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.004078a3
push edi
push edi
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 4
push edi
push eax
call fcn.0059a4b2
add esp, 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
push edi
push 1
call fcn.00409de7
push 1
push 3
lea ecx, [ebp - 0x10c]
call fcn.004078ff
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0xfc]
push str.StartService__error
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0x10c]
push eax
push str.ServiceApp::start
push 0x16e
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push edi
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x10c]
call fcn.0040843a
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.00409de7
test esi, esi
je 0x4fa6ae
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.005b4759
ret
Function at 0x4fb113
Capabilities:
Create thread

Disassembly:
push 0x160
mov eax, 0x66fd4f
call fcn.005b477b
mov esi, ecx
xor edi, edi
lea ecx, [ebp - 0xbc]
inc edi
push edi
push 3
call fcn.004078ff
and dword [ebp - 4], 0
lea eax, [ebp - 0xac]
push str.startProcessControlling
push eax
call fcn.0040710b
pop ecx
pop ecx
lea eax, [ebp - 0xbc]
mov ebx, str.ServiceApp::startProcessControlling
push eax
push ebx
push 0xc8
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push edi
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.0040843a
lea eax, [esi + 4]
push eax
push 0
push 0x4fa452
call fcn.00626de3
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4fb1f3
push edi
push 3
lea ecx, [ebp - 0x16c]
call fcn.004078ff
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x15c]
push str.Failed_to_start_process_termination_waiter__last_error_:
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0x16c]
push eax
push ebx
push 0xcb
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push edi
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x16c]
call fcn.0040843a
call fcn.005b4744
ret

Function at 0x4fb1f9
Capabilities:
Stop service

Disassembly:
push 0xb4
mov eax, 0x66fd80
call fcn.005b477b
lea eax, [ebp - 0x10]
push eax
call fcn.004fa320
and dword [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x4fb29f
push 0x736b90
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4fb296
push 1
push 3
lea ecx, [ebp - 0xc0]
call fcn.004078ff
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0xb0]
push str.ControlService__error
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0xc0]
push eax
push str.ServiceApp::stop
push 0x177
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push 0
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0xc0]
call fcn.0040843a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.005b4744
ret
Function at 0x5034a3
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 8]
push eax
xor eax, eax
push eax
push esi
push 0x5034e8
push eax
push eax
call fcn.00626e6f
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
setne al
pop esi
ret

Function at 0x5034d6
Capabilities:
Terminate thread

Disassembly:
cmp dword [ecx + 4], 0
je 0x5034e7
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
ret

Function at 0x5166d5
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6747ec
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.005b4b80
mov eax, dword [0x72232c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], ebx
jb 0x516717
mov eax, dword [eax]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
test esi, esi
je 0x5167ea
cmp esi, 0xffffffff
je 0x5167ea
lea eax, [ebp - 0x2024]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2028], edi
cmp edi, 0xffffffff
je 0x5167ea
mov eax, dword [ebp - 0x2024]
mov edi, ebx
mov dword [ebp - 0x2020], eax
mov dword [ebp - 0x2014], ebx
push ebx
lea eax, [ebp - 0x2014]
push eax
push 0x2000
lea eax, [ebp - 0x2010]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x5167c4
cmp dword [ebp - 0x2014], ebx
je 0x5167c4
push dword [ebp - 0x2014]
lea eax, [ebp - 0x2010]
push eax
lea ecx, [ebp + 0xc]
call fcn.0051622e
add edi, dword [ebp - 0x2014]
cmp dword [ebp - 0x2014], ebx
ja 0x51677a
push esi
mov dword [ebp - 0x2018], edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [ebp - 0x201c]
cmp edi, dword [ebp - 0x2018]
jne 0x5167ea
cmp dword [ebp - 0x2020], ebx
jne 0x5167ea
xor ebx, ebx
inc ebx
lea ecx, [ebp + 0xc]
call fcn.0051633d
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b4733
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x518ee1
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x674fec
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x72232c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x70]
call fcn.00518263
push eax
push 1
mov ecx, esi
call fcn.00518c50
xor ebx, ebx
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00409de7
lea ecx, [ebp - 0x70]
call fcn.00518f78
mov dword [esi + 0x1c], 7
xor eax, eax
mov dword [esi + 0x18], ebx
mov word [esi + 8], ax
mov eax, 0xffff
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], eax
mov eax, esi
mov dword [esi + 0x28], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x34], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b4733
mov esp, ebp
pop ebp
ret

Function at 0x526c3e
Capabilities:
Reference sql statements

Disassembly:
push 0x6c
mov eax, 0x677522
call fcn.005b47af
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x68]
mov edi, dword [ebp + 0xc]
call fcn.00545727
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.0040d0f1
push eax
xor ebx, ebx
lea eax, [ebp - 0x40]
push str.SELECT__FROM_scan_WHERE_name
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.0047bccf
push 0x696a30
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
call fcn.0047bc2b
add esp, 0x20
push eax
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.005457c3
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 4
call fcn.00545741
lea ecx, [ebp - 0x78]
call fcn.0054573c
xor esi, esi
lea ecx, [ebp - 0x28]
push esi
push ebx
call fcn.00409d92
push esi
push ebx
lea ecx, [ebp - 0x40]
call fcn.00409d92
push esi
push ebx
lea ecx, [ebp - 0x58]
call fcn.00409d92
cmp byte [ebp - 0x60], 0
jne 0x526ce1
cmp dword [ebp - 0x64], esi
jne 0x526ce3
xor bl, bl
lea ecx, [ebp - 0x68]
call fcn.0054573c
mov al, bl
call fcn.005b4759
ret 8
Function at 0x52c2a3
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x72232c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x52c2d7
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x52c2d7
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x52c389
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x52c2f4
cmp ax, 0x5c
jne 0x52c2f6
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x52c2e8
cmp esi, ebx
je 0x52c33c
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.005f2e80
add esp, 0xc
cmp esi, 0x208
jae 0x52c399
xor eax, eax
mov word [ebp + esi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.0052c2a3
pop ecx
pop ecx
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x52c359
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00614e07
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0062a4ec
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x52c389
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.005b4733
mov esp, ebp
pop ebp
ret
call fcn.005b4988
int3

Function at 0x52cbe2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x52cc8e
cmp dword [esi + 4], 0xffffffff
jne 0x52cc8e
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push edi
call fcn.005ff18e
pop ecx
movzx eax, word [esi + eax*2 + 0x242]
cmp eax, 0x5c
je 0x52cc35
cmp eax, 0x2f
je 0x52cc35
push 0x6869a4
push edi
call fcn.0062a4ec
pop ecx
pop ecx
cmp dword [ebp + 0x10], 1
pop edi
jne 0x52cc57
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x52cc57
mov eax, 0x2000000
jmp 0x52cc93
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0052f3d2
add esp, 0x10
test eax, eax
jne 0x52cc75
mov eax, dword [ebp - 4]
jmp 0x52cc93
push eax
call fcn.0052fbad
pop ecx
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
jmp 0x52cc93
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x52d1ff
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x6aa5b8]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6aa5b8]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x52f4d1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x52f505
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x52f500
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x52f52c
mov edx, dword [edi + 0x1c]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x18]
jbe 0x52f515
mov esi, dword [edi + 0x18]
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.005f2e80
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x52f644
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x52f652
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x52f711
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6aa5b8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6aa5b8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6aa5b8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6aa5b8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6aa5b8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6aa5b8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6aa5b8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6aa5b8]
sub edi, 1
jne 0x52f66a
pop edi
test esi, esi
je 0x52f72d
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6aa5b8]
inc edx
sub esi, 1
jne 0x52f715
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x531dad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x531dbb
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x531e7a
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6ab558]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6ab558]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6ab558]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6ab558]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6ab558]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6ab558]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6ab558]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6ab558]
sub edi, 1
jne 0x531dd3
pop edi
test esi, esi
je 0x531e96
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6ab558]
inc edx
sub esi, 1
jne 0x531e7e
not ecx
mov eax, ecx
pop esi
pop ebp
ret