joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401df1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x401e06
xor eax, eax
jmp 0x401ecd
push edi
push ebx
lea edi, [ebp - 4]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call fcn.00401d6e
test eax, eax
pop ecx
je 0x401ec9
cmp dword [ebp - 4], 1
jb 0x401ec9
push esi
push dword [ebp - 4]
call fcn.0040f564
mov esi, eax
cmp esi, ebx
pop ecx
mov dword [ebp - 0x10], esi
je 0x401ec8
push dword [ebp - 4]
push ebx
push esi
call fcn.0040f690
push esi
call fcn.00401d6e
add esp, 0x10
test eax, eax
je 0x401ebf
mov edi, dword [ebp - 4]
cmp edi, 1
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
jb 0x401ebf
push ebx
push 0x80
push 2
push ebx
push 7
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401ebf
push ebx
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401eac
cmp edi, dword [ebp - 8]
jne 0x401eac
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [ebp - 0xc], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], ebx
je 0x401ebf
mov dword [ebp - 0x14], 1
push dword [ebp - 0x10]
call fcn.0040fa75
pop ecx
pop esi
mov eax, dword [ebp - 0x14]
pop edi
pop ebx
leave
ret
Function at 0x401ed0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x654
mov eax, dword [0x42a1d4]
xor eax, esp
mov dword [esp + 0x650], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x206
xor ebx, ebx
push esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x456]
push ebx
push eax
mov edi, ecx
mov dword [esp + 0x1c], 0x80004005
mov word [esp + 0x45c], bx
call fcn.0040f690
add esp, 0xc
push esi
lea eax, [esp + 0x24e]
push ebx
push eax
mov word [esp + 0x254], bx
call fcn.0040f690
add esp, 0xc
push 0x22c
lea eax, [esp + 0x20]
push ebx
push eax
mov dword [esp + 0x24], ebx
call fcn.0040f690
add esp, 0xc
cmp edi, ebx
je 0x40204f
cmp dword [esp + 0xc], ebx
je 0x40204f
lea eax, [esp + 0x450]
push eax
mov esi, 0x103
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40204f
push esi
push edi
lea eax, [esp + 0x250]
push 0x104
push eax
call fcn.0041004d
add esp, 0x10
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push edi
mov dword [esp + 0x18], eax
call fcn.00407c74
mov esi, eax
cmp esi, ebx
pop ecx
mov dword [esp + 0x18], ebx
mov word [esp + 0x1c], bx
mov dword [esp + 0x244], ebx
jne 0x401fde
mov dword [0x42c3c0], 0x10000
jmp 0x40201f
cmp dword [esi], 1
je 0x401fef
mov dword [0x42c3c0], 0x80000
jmp 0x40201f
mov ecx, dword [esi + 4]
push 0xffffffffffffffff
lea ebx, [esp + 0x1c]
call fcn.00407294
cmp dword [esp + 0x18], 1
mov dword [0x42c3c0], eax
jl 0x40201d
push dword [esp + 0xc]
mov eax, esi
call fcn.00407d23
test eax, eax
pop ecx
jne 0x40201d
and dword [esp + 0x10], eax
xor ebx, ebx
cmp dword [esp + 0x14], ebx
je 0x402033
lea eax, [esp + 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp esi, ebx
je 0x40204f
cmp dword [esi], 1
sete al
cmp al, bl
je 0x402048
call fcn.00407d4e
jmp 0x40204f
mov edi, esi
call fcn.00408547
mov ecx, dword [esp + 0x65c]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040f676
mov esp, ebp
pop ebp
ret
Function at 0x402128
Capabilities:
Check if file exists

Disassembly:
push 0x70
mov eax, 0x421873
call fcn.00414670
mov esi, ecx
test esi, esi
mov edi, edx
mov dword [ebp - 0x7c], edi
je 0x4021e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4021e0
test edi, edi
je 0x4021e0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
mov dword [ebp - 0x74], vtable.KMD5.0
and dword [ebp - 4], 0
push esi
lea edi, [ebp - 0x74]
call fcn.0040187c
test eax, eax
je 0x4021d8
lea esi, [ebp - 0x60]
xor edi, edi
movzx eax, byte [ebp + edi - 0x70]
push eax
push str._02x
push esi
call fcn.004019a2
add esp, 0xc
add esi, 4
inc edi
cmp edi, 0x10
jl 0x402183
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.004022a3
push dword [ebp - 0x7c]
push dword [ebp - 0x78]
call fcn.0040fda9
mov esi, eax
mov eax, dword [ebp - 0x78]
neg esi
pop ecx
sbb esi, esi
pop ecx
add eax, 0xfffffff0
inc esi
call fcn.004028bd
lea ecx, [ebp - 0x74]
call fcn.00401840
mov eax, esi
jmp 0x4021e2
lea ecx, [ebp - 0x74]
call fcn.00401840
xor eax, eax
call fcn.004146f3
ret

Function at 0x4021e8
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x42a1d4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x20a]
push edi
push eax
mov word [ebp - 0x20c], di
call fcn.0040f690
add esp, 0xc
push edi
push 0x23
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x402233
xor eax, eax
jmp 0x402281
lea eax, [ebp - 0x20c]
push eax
call fcn.00410171
lea eax, [ebp + eax*2 - 0x20e]
pop ecx
movzx ecx, word [eax]
cmp cx, 0x5c
je 0x402256
cmp cx, 0x2f
jne 0x402259
mov word [eax], di
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.00402329
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40227e
push dword [esi]
call fcn.004040f8
test eax, eax
pop ecx
je 0x40222f
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0040f676
leave
ret

Function at 0x40282b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402842
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x402877
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x402873
cmp edi, eax
jae 0x402877
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x402865
cmp edi, eax
jb 0x40287b
xor eax, eax
jmp 0x402885
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x402efa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x42a1d4]
xor eax, ebp
mov dword [ebp + 0x190], eax
and word [ebp - 0x78], 0
push 0x206
lea eax, [ebp - 0x76]
push 0
push eax
call fcn.0040f690
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.OrgOEM
push str.SoftwareKSafeCoop
push closesocket
mov dword [ebp - 0x80], 0x208
mov dword [ebp - 0x7c], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x78]
push eax
push esi
call fcn.00402329
mov eax, dword [esi]
xor ecx, ecx
cmp dword [eax - 0xc], ecx
setne cl
mov eax, ecx
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.0040f676
add ebp, 0x194
leave
ret
Function at 0x40309d
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x4219c8
call fcn.00414607
lea eax, [ebp - 0x14]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREKSafe
mov dword [ebp - 4], esi
push closesocket
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x40314b
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 0x10]
push 0x104
mov dword [ebp - 0x10], eax
call fcn.00402647
mov ebx, str.Install_Path
push ebx
lea ecx, [ebp - 0x10]
push ecx
lea esi, [ebp - 0x18]
mov edi, eax
call fcn.00403b4e
mov esi, dword [ebp + 0x10]
mov edi, eax
call fcn.0040365e
cmp dword [ebp - 0x14], 0
je 0x403113
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
test edi, edi
je 0x403152
push dword [ebp - 0x18]
call fcn.00402647
push ebx
lea ecx, [ebp - 0x10]
push ecx
lea esi, [ebp - 0x18]
mov edi, eax
call fcn.00403b4e
mov esi, dword [ebp + 0x10]
mov edi, eax
call fcn.0040365e
test edi, edi
je 0x403152
cmp dword [ebp - 0x10], 0
je 0x40314b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x403261
mov eax, dword [0x42b6ec]
mov ecx, 0x42b6ec
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x10]
lea edi, [ebp - 0x14]
call fcn.004022e8
mov esi, dword [ebp + 0x10]
push str.ksafe.exe
push esi
call fcn.0040363b
push str.ksafever.dll
mov eax, edi
push eax
call fcn.0040363b
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4031a8
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004028bd
jmp 0x40313c
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x14]
push esi
call fcn.00403037
test eax, eax
jne 0x4031bd
lea eax, [esi - 0x10]
jmp 0x4031a1
lea eax, [ebp + 0x10]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREKSafeCoop
push closesocket
mov dword [ebp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x403237
xor eax, eax
cmp dword [ebp - 0x10], esi
je 0x4031f0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ebx
jne 0x403237
mov esi, dword [ebp + 8]
push 0x104
call fcn.00402647
push str.OEMName
lea ecx, [ebp - 0x10]
push ecx
lea esi, [ebp - 0x18]
mov edi, eax
call fcn.00403b4e
mov esi, dword [ebp + 8]
mov edi, eax
call fcn.0040365e
test ebx, ebx
je 0x403233
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
test edi, edi
je 0x403244
push str.h_unknown
push dword [ebp + 8]
call fcn.00402329
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004028bd
cmp dword [ebp - 0x10], 0
je 0x40325e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
call fcn.004146df
ret 0xc
Function at 0x403b4e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403bb1
cmp dword [ebp + 0xc], 1
je 0x403b8a
cmp dword [ebp + 0xc], 2
je 0x403b8a
push 0xd
pop eax
jmp 0x403bb1
test edi, edi
mov eax, dword [ebp - 4]
je 0x403bab
test eax, eax
je 0x403ba7
test al, 1
jne 0x403b85
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x403bab
jmp 0x403b85
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x403be3
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1e0]
sub esp, 0x260
mov eax, dword [0x42a1d4]
xor eax, ebp
mov dword [ebp + 0x1dc], eax
push esi
xor esi, esi
cmp ebx, esi
jne 0x403c09
xor eax, eax
jmp 0x403c7d
push edi
push 0x40
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.0040f690
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x206
stosd dword es:[edi], eax
lea eax, [ebp - 0x2a]
push esi
push eax
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 1
mov word [ebp - 0x50], si
mov word [ebp - 0x2c], si
call fcn.0040f690
push ebx
push str._s__s
lea eax, [ebp - 0x2c]
push 0x104
push eax
call fcn.0041088d
add esp, 0x28
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
neg eax
sbb eax, eax
neg eax
pop edi
mov ecx, dword [ebp + 0x1dc]
xor ecx, ebp
pop esi
call fcn.0040f676
add ebp, 0x1e0
leave
ret
Function at 0x403f9a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
je 0x404022
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
mov ebx, str.InstallLocation
push ebx
push eax
call edi
cmp dword [ebp - 8], 1
je 0x403fd8
cmp dword [ebp - 8], 2
jne 0x404020
push esi
mov esi, dword [ebp + 0xc]
call fcn.00402607
mov eax, dword [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.00402647
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push 0
push ebx
push dword [eax]
call edi
test eax, eax
jne 0x404017
mov eax, dword [ebp - 4]
shr eax, 1
and word [esi + eax*2], 0
mov dword [ebp - 0xc], 1
mov esi, dword [ebp + 0xc]
call fcn.0040365e
pop esi
pop edi
pop ebx
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x4040f8
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 4
mov eax, 0x4214ce
call fcn.00414607
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004022a3
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404138
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004028bd
mov eax, esi
call fcn.004146df
ret
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x404122
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov ebx, 0xb7
cmp eax, ebx
je 0x404122
lea ecx, [ebp - 0x10]
call fcn.004040af
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x40416f
xor esi, esi
jmp 0x404125
push eax
call fcn.004040f8
test eax, eax
pop ecx
je 0x40416b
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x404122
call edi
cmp eax, ebx
jne 0x40416b
jmp 0x404122
Function at 0x405e03
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
mov esi, edx
jne 0x405e0e
xor eax, eax
pop esi
ret
cmp eax, 8
push ebx
not esi
mov edx, 0xff
jb 0x405ec0
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x426588]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x426588]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x426588]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x426588]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x426588]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x426588]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x426588]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x426588]
inc ecx
sub eax, 8
dec edi
jne 0x405e25
pop edi
test eax, eax
je 0x405ed9
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x426588]
inc ecx
dec eax
jne 0x405ec4
mov eax, esi
pop ebx
not eax
pop esi
ret

Function at 0x405ee0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x426588]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x426588]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x4065d2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x406602
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4065fd
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x40662a
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x406613
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0040f710
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret
Function at 0x407211
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi], 0
push edi
jne 0x40728a
cmp dword [esi + 4], 0xffffffff
jne 0x40728a
lea edi, [esi + 0x244]
push edi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.00410171
lea eax, [esi + eax*2 + 0x242]
pop ecx
movzx ecx, word [eax]
cmp cx, 0x5c
je 0x40725a
cmp cx, 0x2f
je 0x40725a
and word [eax + 4], 0
mov word [eax + 2], 0x2f
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.004064d2
test eax, eax
pop ecx
pop ecx
jne 0x407271
mov eax, dword [ebp + 8]
jmp 0x40728f
push eax
call fcn.00406845
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x40728f
mov eax, 0x1000000
pop edi
pop ebp
ret 4

Function at 0x4077f5
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x42a1d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp ebx, edi
je 0x407875
push 0x104
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0041051b
lea eax, [ebp - 0x414]
push eax
call fcn.00410171
add esp, 0x10
cmp eax, edi
jbe 0x407855
lea eax, [ebp + eax*2 - 0x416]
movzx ecx, word [eax]
cmp cx, 0x2f
je 0x407852
cmp cx, 0x5c
jne 0x407855
mov word [eax], di
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407875
push edi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx ecx, word [esi]
cmp cx, di
je 0x407942
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x407894
cmp cx, 0x5c
jne 0x407896
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
cmp cx, di
jne 0x407888
cmp eax, esi
je 0x4078d5
sub eax, esi
sar eax, 1
add eax, eax
mov edi, eax
push edi
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0040f710
and word [ebp + edi - 0x414], 0
lea eax, [ebp - 0x414]
push eax
push ebx
call fcn.004077f5
add esp, 0x14
xor edi, edi
cmp ebx, edi
mov word [ebp - 0x20c], di
je 0x4078f5
push 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0041051b
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov word [ebp - 6], di
call fcn.00410171
mov ecx, 0x104
sub ecx, eax
push ecx
lea eax, [ebp + eax*2 - 0x20c]
push esi
push eax
call fcn.0041051b
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
mov word [ebp - 6], di
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407942
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f676
leave
ret
Function at 0x4082ca
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x424da8]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x424da8]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x408334
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
je 0x4083a9
mov eax, dword [esi + 0x3c]
xor ebx, ebx
cmp eax, ebx
je 0x408360
cmp dword [esi + 0x40], edi
jae 0x408360
push eax
call fcn.0040f62c
pop ecx
mov dword [esi + 0x3c], ebx
cmp dword [esi + 0x3c], ebx
jne 0x408375
lea eax, [edi + edi]
push eax
call fcn.0040fa93
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x3c]
call fcn.0040f710
add esp, 0xc
test edi, edi
jbe 0x4083a6
lea ecx, [esi + 0x30]
mov eax, dword [esi + 0x3c]
movzx eax, byte [ebx + eax]
push eax
call fcn.0040830d
mov edx, dword [esi + 0x3c]
add esp, 4
mov byte [ebx + edx], al
inc ebx
cmp ebx, edi
jb 0x40838b
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4083d8
mov eax, dword [esi + 0x24]
lea ebx, [eax + edi]
cmp ebx, dword [esi + 0x28]
jb 0x4083c4
mov dword [esi + 0x14], 0x30000
jmp 0x4083fa
push edi
push edx
add eax, ecx
push eax
call fcn.0040f710
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
jmp 0x4083fc
mov eax, dword [esi + 4]
test eax, eax
je 0x4083f3
push 0
lea ecx, [ebp + 8]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x4083fc
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x408587
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x421ae0
call fcn.00414607
mov esi, ecx
mov eax, dword [0x42b6ec]
mov ecx, 0x42b6ec
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
call fcn.00408df2
test eax, eax
lea eax, [ebp - 0x10]
push eax
je 0x4085c0
call fcn.00408c8d
jmp 0x4085c5
call fcn.00408c4d
cmp dword [esi + 0x18], 8
jb 0x4085d0
mov eax, dword [esi + 4]
jmp 0x4085d3
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004022a3
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], 0
jg 0x4085eb
xor esi, esi
inc esi
jmp 0x408606
push dword [ebp - 0x14]
push 0xffffffffffffffff
push edi
push str.ulst
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004028bd
test esi, esi
je 0x408621
lea eax, [ebp - 0x10]
push eax
call fcn.00408c8d
mov edi, dword [ebp - 0x10]
push edi
call fcn.00410171
mov esi, dword [ebp + 8]
pop ecx
push edi
call fcn.004037e1
lea eax, [edi - 0x10]
call fcn.004028bd
call fcn.004146df
ret 4