joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409f90
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], edx
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push 0x80000002
mov dword [ebp - 0x18], ecx
call fcn.00413e50
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x40a0cc
push edi
push 0x8000
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40a0c4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x8000
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push ebx
push str.UserInfo
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a0b4
cmp dword [ebp - 0x10], 3
jne 0x40a0b4
mov eax, dword [ebp - 4]
cmp eax, 0xfc
jb 0x40a0b4
mov ecx, dword [edi]
lea edx, [edi + 4]
add eax, edi
mov dword [ebp - 8], edx
mov esi, eax
xor edx, edx
sub esi, dword [ebp - 8]
add esi, 3
shr esi, 2
cmp dword [ebp - 8], eax
lea eax, [edi + 4]
cmova esi, edx
test esi, esi
je 0x40a04d
nop dword [eax]
xor dword [eax], ecx
lea eax, [eax + 4]
inc edx
add ecx, 7
cmp edx, esi
jb 0x40a040
cmp dword [edi + 4], 0x4b375249
jne 0x40a0b1
mov eax, dword [ebp - 0x18]
lea esi, [edi + 8]
test eax, eax
je 0x40a06a
push 0x40
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x40a07e
push 0x50
lea eax, [esi + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40a095
push 0x3c
lea eax, [esi + 0x90]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x40a0ac
push 0x28
lea eax, [esi + 0xcc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ebx, 1
mov esi, dword [ebp - 0xc]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push 0x80000002
mov edi, edx
call fcn.00413e50
mov esi, eax
test esi, esi
jne 0x40a285
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40a298
push eax
push str.ProxyEnabled
push esi
call fcn.00414170
test edi, edi
je 0x40a2a8
push edi
push str.ConnectIdFirst
push esi
call fcn.00414170
mov eax, dword [ebp + 8]
test eax, eax
je 0x40a2bb
push eax
push str.ConnectIdSecond
push esi
call fcn.00414170
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x40a2d3
push 0x3e8
push eax
push str.UpdtLocalMachineName
push esi
call fcn.004141c0
cmp dword [ebp + 0x10], 0
jne 0x40a2e9
cmp dword [ebp + 0x14], 0
jne 0x40a2e9
cmp dword [ebp + 0x18], 0
je 0x40a40f
push 0x1d0
call fcn.00415a0d
push 0x1d0
mov edi, eax
push 0
push edi
call fcn.00416ee0
add esp, 0x10
push 0x1d0
push edi
push str.ProxyInfo
push esi
call fcn.004140d0
cmp eax, 1
jne 0x40a401
movd xmm0, dword [edi + 8]
lea eax, [edi + 0xc]
push ebx
lea ebx, [edi + 8]
pshufd xmm1, xmm0, 0
movd xmm0, dword [edi + 4]
lea ecx, [edi + 4]
pshufd xmm2, xmm0, 0
lea edx, [eax + 0x1c0]
mov dword [ebp - 4], edx
cmp eax, ecx
ja 0x40a351
xor edx, edx
cmp dword [ebp - 4], ecx
jae 0x40a3bb
cmp eax, ebx
ja 0x40a361
lea ecx, [eax + 0x1c0]
xor edx, edx
cmp ecx, ebx
jae 0x40a3bb
mov ecx, 7
nop word [eax + eax]
movups xmm0, xmmword [eax]
pxor xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax], xmm0
movups xmm0, xmmword [eax + 0x10]
pxor xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [eax + 0x20]
pxor xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [eax + 0x30]
pxor xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x30], xmm0
add eax, 0x40
sub ecx, 1
jne 0x40a370
mov edx, 0xffffff90
add edx, 0x71
nop
mov ecx, dword [ebx]
lea eax, [eax + 4]
xor dword [eax - 4], ecx
mov ecx, dword [edi + 4]
xor dword [eax - 4], ecx
sub edx, 1
jne 0x40a3c0
lea eax, [edi + 0xc]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [edi + 0x110]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [edi + 0x190]
push eax
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
push 0x1d0
push edi
call fcn.004157ab
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d890
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], edx
push str..pipeK7RTScanPipeV1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d922
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x40d91d
push 0xffffffffffffffff
push str..pipeK7RTScanPipeV1
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..pipeK7RTScanPipeV1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40d8e0
jmp 0x40d922
cmp esi, 0xffffffff
je 0x40d981
push 0
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x40d972
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x14
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x40d972
mov eax, dword [ebp - 4]
or ecx, 0xffffffff
cmp dword [ebp - 8], 4
cmovne eax, ecx
mov dword [ebp - 4], eax
jmp 0x40d975
mov eax, dword [ebp - 4]
cmp esi, 0xffffffff
je 0x40d984
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e280
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 8], 0xffffff9c
call fcn.00414e20
test al, al
je 0x40e2fe
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
call fcn.00414590
add esp, 4
cmp eax, 1
jne 0x40e43a
mov al, byte [ebp - 1]
cmp al, 2
je 0x40e307
cmp al, 1
je 0x40e307
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov dword [ebp - 0x20], 4
lea eax, [ebp - 0x10]
mov ecx, 0x1003f
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0xc]
push eax
jns 0x40e444
lea eax, [ebp - 0x24]
push eax
call fcn.0040e700
mov eax, dword [ebp - 0xc]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00414430
test eax, eax
je 0x40e2bd
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40e43a
push 0
lea esi, [edi + 0x400]
push 0x435f14
lea ebx, [esi + 0x400]
mov dword [ebp - 0xc], esi
push 0x80000002
add esi, 0x800
mov byte [ebx], 0
call fcn.00413e50
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40e36f
push 0x104
push ebx
push str.DirProductBase
push eax
call fcn.004141c0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.K7InetChk.dll
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40e42a
mov eax, dword [ebp - 0xc]
push 0x400
push eax
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._rundll32.exe
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40e42a
push str.K7ChkInet
push ebx
push dword [ebp - 0xc]
push str._s___s___s
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov dword [esi], 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea ebx, [esi + 0x44]
push ebx
push esi
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40e403
mov dword [ebp - 8], 0xffffffff
jmp 0x40e42a
push 0xffffffffffffffff
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0040e470
mov eax, dword [ebp - 0xc]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x8000
push 8
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x40e92b
push 0
call fcn.0041bfa4
add esp, 4
mov ebx, eax
mov dword [esi], ebx
add esi, 4
mov dword [ebp - 4], esi
push 0x40
push dword [ebp - 0xc]
lea edi, [esi + 4]
mov dword [esi], 0x4b375249
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x50
push dword [ebp - 0x10]
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x3c
push dword [ebp + 8]
lea eax, [edi + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x28
push dword [ebp + 0xc]
lea eax, [edi + 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [esi + 0xfc]
xor ecx, ecx
cmp eax, esi
sbb eax, eax
and eax, 0xffffffc1
add eax, 0x3f
je 0x40e8a0
xor dword [esi], ebx
inc ecx
add ebx, 7
add esi, 4
cmp ecx, eax
jb 0x40e890
mov dword [ebp - 4], esi
mov ebx, dword [ebp - 8]
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push str.HKLM
push str.__s_s__r_n
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
push str._UserInfo_hex:
lea edi, [esi + eax]
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
mov esi, 0x100
add edi, eax
movzx eax, byte [ebx]
push eax
push str._02X_
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebx + 1]
add edi, eax
sub esi, 1
jne 0x40e8d2
push str._r_n_r_n
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
sub edi, dword [ebp - 4]
add esp, 8
mov edx, dword [ebp - 4]
lea ecx, [eax + 1]
add ecx, edi
call fcn.0040f740
push dword [ebp - 8]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411650
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x41165b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x411717
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x434718]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x434718]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x434718]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x434718]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x434718]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x434718]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x434718]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x434718]
sub edi, 1
jne 0x411670
pop edi
test esi, esi
je 0x41173a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x434718]
sub esi, 1
jne 0x411720
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x411f30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov ebx, esi
mov dword [ebp - 8], esi
imul ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x411f78
push 0
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x411f6a
mov byte [edi + 8], 1
mov eax, dword [ebp - 4]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp - 4]
call fcn.00418f60
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411fb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x411feb
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x411fe6
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x412018
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x411ffc
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.00418f60
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x41202c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x412023
cmp byte [esi + 8], 0
je 0x412023
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4120f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
mov cl, byte [ebx]
test cl, cl
je 0x41211a
cmp byte [ebx + 1], 0
je 0x41216f
push 2
push 0
push 0
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov cl, byte [ebx]
jmp 0x412120
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x1c], eax
test cl, cl
je 0x412145
cmp byte [ebx + 1], 0
je 0x41213e
push 1
push 0
push 0
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub eax, dword [ebx + 0xc]
jmp 0x412148
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x412157
mov eax, dword [ebx + 0x1c]
mov esi, 0xffff
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
cmp eax, esi
jae 0x41215c
mov esi, eax
mov dword [ebp - 0x10], eax
push 0x404
call fcn.0041957c
mov edi, eax
add esp, 4
test edi, edi
jne 0x412179
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 4], 0xffffffff
cmp esi, eax
jbe 0x412276
nop dword [eax]
mov edx, dword [ebp - 8]
add eax, 0x400
cmp eax, esi
mov ecx, esi
cmovbe ecx, eax
mov eax, 0x404
sub edx, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x404
mov dword [ebp - 0x18], edx
mov esi, ecx
cmova esi, eax
mov al, byte [ebx]
mov dword [ebp - 0xc], esi
test al, al
je 0x4121e1
cmp byte [ebx + 1], 0
je 0x412276
mov eax, dword [ebx + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [ebx]
jmp 0x4121e4
mov dword [ebx + 0x1c], edx
test al, al
je 0x412206
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x412201
mov byte [ebx + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x412230
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x14]
lea eax, [edx + esi]
mov esi, dword [ebx + 0x18]
sub esi, edx
cmp eax, dword [ebx + 0x18]
cmovbe esi, dword [ebp - 0xc]
add ecx, edx
push esi
push ecx
push edi
call fcn.00418f60
add esp, 0xc
mov eax, esi
add dword [ebx + 0x1c], esi
mov esi, dword [ebp - 0xc]
xor edx, edx
div esi
cmp eax, 1
jne 0x412276
lea eax, [esi - 3]
test eax, eax
js 0x412261
mov ecx, eax
dec eax
cmp byte [eax + edi], 0x50
jne 0x41225d
cmp byte [ecx + edi], 0x4b
jne 0x41225d
cmp byte [eax + edi + 2], 5
jne 0x41225d
cmp byte [eax + edi + 3], 6
je 0x412289
test eax, eax
jns 0x412240
mov eax, dword [ebp - 4]
test eax, eax
jne 0x412276
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
jb 0x412190
push edi
call fcn.004194d4
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x412264
Function at 0x412be0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x412d9c
cmp dword [edi + 0x18], 0
je 0x412d9c
cmp dword [edi + 0x7c], 0
je 0x412c09
call fcn.00413090
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.00412970
add esp, 8
test eax, eax
je 0x412c2d
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.0041957c
mov esi, eax
add esp, 4
test esi, esi
je 0x412c70
push 0x4000
call fcn.0041957c
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x412c7c
push esi
call fcn.004194d4
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], 0
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x412cd7
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.004119d0
test eax, eax
jne 0x412cd7
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x412cfa
mov al, byte [edi + 0x39]
jmp 0x412cfd
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x412d7d
nop dword [eax]
mov al, byte [ebx]
test al, al
je 0x412d7d
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x434718]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x434718]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x412d30
mov eax, dword [ebp - 0xc]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413800
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x413832
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x413832
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebx]
test al, al
je 0x4138f8
push edi
mov edi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x413849
cmp al, 0x5c
jne 0x41384b
mov edi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x413841
cmp edi, ebx
je 0x41388b
sub edi, ebx
lea eax, [ebp - 0x20c]
push edi
push ebx
push eax
call fcn.00418f60
add esp, 0xc
cmp edi, 0x104
jae 0x413908
lea edx, [ebp - 0x20c]
mov byte [ebp + edi - 0x20c], 0
mov ecx, esi
call fcn.00413800
mov byte [ebp - 0x108], 0
test esi, esi
je 0x4138ad
lea ecx, [ebp - 0x108]
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4138a0
mov esi, ebx
nop
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4138b0
lea edi, [ebp - 0x108]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4138c0
mov ecx, ebx
lea eax, [ebp - 0x108]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop edi
cmp eax, 0xffffffff
jne 0x4138f8
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041559f
mov esp, ebp
pop ebp
ret
call fcn.004156d1
int3