joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417420
Capabilities:
Delete file

Disassembly:
sub esp, 8
xor eax, eax
push ebx
push ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push edi
mov eax, esi
call fcn.00406d10
mov ebx, eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
mov edi, str._UploadWhitelist.php
call fcn.00417290
mov ebp, dword [esp + 0x18]
add esp, 8
mov edi, eax
test ebp, ebp
je 0x41747c
push 0x4a1168
push ebp
call fcn.0047ba00
add esp, 8
test eax, eax
je 0x41747c
push ebp
push str._Upload_whitelist_status_code:__S_r_n
call fcn.0040a210
add esp, 8
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4174a8
push 0x4a11c0
push eax
call fcn.0047bf2d
add esp, 8
test eax, eax
je 0x4174a8
mov edx, dword [esp + 0xc]
push edx
push str._Server_reply_for_upload_whitelist:__S_r_n
call fcn.0040a210
add esp, 8
test edi, edi
jne 0x4174e5
push ebx
push str.New_hashes_are_marked_as_available_at_the_server__file__s_r_n
call fcn.0040a210
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x4174d6
push esi
push str.Deleted:__s_r_n
call fcn.0040a210
add esp, 8
jmp 0x4174f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push str._Unable_to_delete_file:__s
push eax
jmp 0x4174ec
push esi
push str._Unable_to_upload_hashes_to_the_server__file___s_.
push edi
call fcn.0040a310
add esp, 0xc
mov eax, dword [esp + 0xc]
test eax, eax
je 0x417505
push eax
call fcn.0047a868
add esp, 4
mov dword [esp + 0xc], 0
test ebp, ebp
je 0x41751a
push ebp
call fcn.0047a868
add esp, 4
cmp edi, 0x2ee2
jne 0x41752d
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x417540
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x814
mov eax, dword [0x4aab30]
xor eax, esp
mov dword [esp + 0x810], eax
xor eax, eax
push ebx
push ebp
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
push edi
mov eax, esi
call fcn.00406d10
mov ebp, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov edi, str._UploadWhitelistMissing.php
call fcn.00417290
mov ebx, dword [esp + 0x1c]
add esp, 8
mov edi, eax
test ebx, ebx
je 0x4175ad
push 0x4a1168
push ebx
call fcn.0047ba00
add esp, 8
test eax, eax
je 0x4175ad
push ebx
push str._Upload_whitelist_status_code:__S_r_n
call fcn.0040a210
add esp, 8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4175d9
push 0x4a11c0
push eax
call fcn.0047bf2d
add esp, 8
test eax, eax
je 0x4175d9
mov edx, dword [esp + 0x10]
push edx
push str._Server_response_for_upload_whitelist:__S_r_n
call fcn.0040a210
add esp, 8
test edi, edi
jne 0x417674
push ebp
push str.New_hashes_are_uploaded_to_the_server__file__s_r_n
call fcn.0040a210
add esp, 8
push ebp
call fcn.0040c1c0
push eax
push 0x49d768
lea edx, [esp + 0x24]
call fcn.004060f0
add esp, 0xc
cmp byte [esp + 0x824], 0
je 0x41763f
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x417630
lea eax, [esp + 0x18]
push eax
push str.Deleted:__s_r_n
call fcn.0040a210
add esp, 8
jmp 0x417683
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push str._Unable_to_delete_file:__s
push eax
jmp 0x41767b
push 1
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x417665
lea edx, [esp + 0x18]
push edx
push str.Submitted_file_is_moved_to:__s_r_n
call fcn.0040a210
add esp, 8
jmp 0x417683
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push str._Unable_to_make_a_copy_of_submitted_file:__s
push eax
jmp 0x41767b
push esi
push str._Unable_to_upload_new_hashes_to_the_server__file___s_.
push edi
call fcn.0040a310
add esp, 0xc
mov eax, dword [esp + 0x10]
test eax, eax
je 0x417694
push eax
call fcn.0047a868
add esp, 4
mov dword [esp + 0x10], 0
test ebx, ebx
je 0x4176a9
push ebx
call fcn.0047a868
add esp, 4
cmp edi, 0x2ee2
jne 0x4176bc
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x81c]
mov eax, edi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047a722
add esp, 0x814
ret
Function at 0x417f00
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
mov ebx, str.whitelist.rec
call fcn.0040c0f0
mov ebx, str.whitelist.new
mov edi, eax
call fcn.0040c0f0
mov esi, eax
mov bl, 1
test edi, edi
je 0x417f63
test esi, esi
je 0x417f5a
call fcn.0040c170
mov ecx, eax
call fcn.00406fa0
test al, al
je 0x417f58
mov ecx, edi
call fcn.00406fa0
test al, al
jne 0x417f58
mov ecx, esi
call fcn.00406fa0
test al, al
je 0x417f5a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, 1
jne 0x417f5a
xor bl, bl
push edi
call fcn.0047a868
add esp, 4
test esi, esi
je 0x417f70
push esi
call fcn.0047a868
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x418330
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, str.whitelist.rec
call fcn.0040c0f0
mov ebx, str.whitelist.new
mov ebp, eax
call fcn.0040c0f0
mov edi, eax
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
cmp ebp, eax
je 0x4184a1
cmp edi, eax
je 0x418498
push str.Exporting_existing_hashes...
mov esi, 0x4b1d24
call fcn.00413780
mov eax, dword [esp + 0x30]
add esp, 4
push eax
push edi
call fcn.0041b720
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4183b2
push edi
push str.Export_whitelist_failed._File:__s
push ebx
call fcn.0040a310
jmp 0x418495
push str.Searching_for_new_hashes...
mov esi, 0x4b1d24
call fcn.00413780
add esp, 4
push edi
push str.Export_whitelist_to:__s_r_n
call fcn.0040a210
add esp, 8
mov ecx, ebp
call fcn.00406fa0
test al, al
je 0x4183f4
push 0
push 0x31f38
push 0
mov edx, ebp
call fcn.0041b0d0
add esp, 0xc
mov esi, eax
jmp 0x4183f8
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x14]
push edx
mov edx, edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0x4184c0
mov dword [esp + 0x24], fcn.004159a0
mov dword [esp + 0x28], 0x7d0
call fcn.00405c30
add esp, 4
test esi, esi
je 0x41843f
mov eax, esi
call fcn.0041ca40
push esi
call fcn.0041d340
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x418467
call esi
mov ebx, eax
cmp ebx, 2
je 0x418467
push edi
push str._Unable_to_delete___s_
push ebx
call fcn.0040a310
jmp 0x418495
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x418489
call esi
push ebp
push edi
mov ebx, eax
push str._Move_file_failed._Unable_to_rename___s__to___s_
push ebx
call fcn.0040a310
add esp, 0x10
jmp 0x418498
push ebp
push edi
push str.Move___s__to___s__r_n
call fcn.0040a210
add esp, 0xc
push ebp
call fcn.0047a868
add esp, 4
test edi, edi
je 0x4184ae
push edi
call fcn.0047a868
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x18
ret

Function at 0x418640
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 1
push 0
push str.SOFTWARESecureAge_TechnologySecureAgeApplicationsUniversalAVUpload
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4186a7
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.DailyUploadLimit
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41869d
mov ecx, dword [esp]
push ecx
jmp 0x4186a1
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0xc]
test edx, edx
ja 0x4186c6
jb 0x4186bc
mov eax, dword [esp + 8]
cmp eax, 0xa00000
jae 0x4186ca
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0x10
ret
mov eax, dword [esp + 8]
add esp, 0x10
ret
Function at 0x4186d0
Capabilities:
Set registry value

Disassembly:
push ecx
cmp dword [esp + 0xc], 0
ja 0x4186ef
jb 0x4186e4
cmp dword [esp + 8], 0xa00000
jae 0x4186ef
or eax, 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARESecureAge_TechnologySecureAgeApplicationsUniversalAVUpload
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 0
call edi
mov esi, eax
test esi, esi
jne 0x418742
mov edx, dword [esp + 0xc]
push 8
lea ecx, [esp + 0x18]
push ecx
push 3
push eax
push str.DailyUploadLimit
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x418753
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x4187b6
mov esi, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00415820
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARESecureAge_TechnologySecureAgeApplicationsUniversalAVUpload
push esi
call edi
test eax, eax
jne 0x41878f
mov ecx, dword [esp + 0xc]
push ecx
call ebx
push 8
lea edx, [esp + 0x18]
push edx
push 3
push str.DailyUploadLimit
push reloc.OLEAUT32.dll_SysReAllocString
xor ecx, ecx
mov edx, str.SOFTWARESecureAge_TechnologySecureAgeApplicationsUniversalAVUpload
call fcn.0040b7f0
add esp, 0x14
pop edi
pop esi
pop ebx
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret

Function at 0x4187c0
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
push 0xa6
xor ebx, ebx
call fcn.0047a780
mov esi, eax
add esp, 4
test esi, esi
je 0x418840
push edi
push str.LatestDate
mov ecx, str.SOFTWARESecureAge_TechnologySecureAgeApplicationsUniversalAVUpload
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040bbe0
mov edi, eax
add esp, 4
test edi, edi
je 0x418824
push edi
push str.SOFTWARESecureAge_TechnologySecureAgeApplicationsUniversalAVUpload
push 0x49d768
push 0x53
push esi
call fcn.0047a84a
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040b9f0
add esp, 0x1c
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
push esi
call fcn.0047a868
add esp, 4
test edi, edi
je 0x41883a
push edi
call fcn.0047a868
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
ret
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x4189e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
cmp byte [0x4aebfc], bl
je 0x418a11
push 0x4b1b98
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x4aebfc], bl
call fcn.00418850
mov esi, eax
cmp esi, ebx
je 0x418b40
push 0x4b1b98
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x10]
push eax
push 1
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 8
call edi
test eax, eax
jne 0x418a7f
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push str.TotalUpload
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x418a74
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x418a79
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 1
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x418ac5
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push str.NumberOfUploadedFiles
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x418aba
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x418abf
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x28]
add dword [esp + 0x14], eax
mov ecx, dword [esp + 0x2c]
push 8
adc dword [esp + 0x1c], ecx
add dword [esp + 0x20], 1
lea edx, [esp + 0x18]
push edx
adc dword [esp + 0x28], ebx
push 3
push str.TotalUpload
push reloc.OLEAUT32.dll_SysReAllocString
xor ecx, ecx
mov edx, esi
mov dword [esp + 0x20], 8
call fcn.0040b7f0
add esp, 0x14
push 8
lea eax, [esp + 0x20]
push eax
push 3
push str.NumberOfUploadedFiles
push reloc.OLEAUT32.dll_SysReAllocString
xor ecx, ecx
mov edx, esi
mov dword [esp + 0x20], 8
call fcn.0040b7f0
add esp, 0x14
push 0x4b1b98
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call fcn.0047a868
add esp, 4
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x418e00
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418e06
push esi
push edi
push 0
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SOFTWARESecureAge_TechnologySecureAgeApplicationsUniversalAVDialogStatus
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x418e66
mov edx, dword [esp + 8]
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push eax
push 0x4a1fc0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x418e75
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ecx
ret

Function at 0x419000
Capabilities:
Delete file

Disassembly:
push esi
xor esi, esi
call fcn.0040c020
push eax
push 0x105
push 0x4b2c20
call fcn.0047a8f6
push 0x49ca30
push 0x105
push 0x4b2c20
call fcn.0047ac75
push str.whitelist.db
push 0x105
push 0x4b2c20
call fcn.0047ac75
add esp, 0x24
push 0x4b2c20
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x419059
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, esi
pop esi
ret

Function at 0x419c45
Capabilities:
Delete file
Set registry value

Disassembly:
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push 0xf003f
push 1
push ebx
push ebx
push str.SOFTWARESecureAge_TechnologySecureAgeApplicationsUniversalAVDialogScanResult
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x419c8c
push 4
lea ecx, [ebp - 0x28]
push ecx
push 4
push ebx
push str.InProgress
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x419c9a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x419cb1
push eax
call fcn.0047a868
add esp, 4
mov eax, dword [ebp - 0x38]
cmp eax, ebx
je 0x419cc1
push eax
call fcn.0047a868
add esp, 4
mov edi, dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp edi, ebx
je 0x419cda
push edi
call esi
push edi
call fcn.0047a868
add esp, 4
mov edi, dword [ebp - 0x30]
cmp edi, ebx
je 0x419ced
push edi
call esi
push edi
call fcn.0047a868
add esp, 4
mov edi, dword [ebp - 0x24]
cmp edi, ebx
je 0x419d00
push edi
call esi
push edi
call fcn.0047a868
add esp, 4
ret
Function at 0x419d10
Capabilities:
Create thread

Disassembly:
cmp byte [0x4b3448], 0
jne 0x419d2b
push 0x4b1bc8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x4b3448], 1
push 0x4b1bc8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4b1cfc]
test eax, eax
je 0x419d46
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push eax
push 0x419570
push 0
push 0
mov dword [0x4b1cfc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x4b1bc8
mov dword [0x4b1cf4], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
ret

Function at 0x41acd0
Capabilities:
Query environment variable

Disassembly:
mov ecx, 0x49c864
mov eax, 0x4b3570
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ad06
test dx, dx
je 0x41ad02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ad06
add eax, 4
add ecx, 4
test dx, dx
jne 0x41ace0
xor eax, eax
jmp 0x41ad0b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41ad24
push 0x105
push 0x4b3570
push str._systemroot__system32driverswhitelist2.sa
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, 0x4b3570
ret

Function at 0x41af80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41af87
push ebx
push esi
sub eax, edx
push edi
lea edi, [eax + 1]
lea esi, [edi + 0x35]
push esi
call fcn.0047a780
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41b012
push ebp
push esi
push 0
push ebx
call fcn.0047d730
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
lea ebp, [ebx + 8]
push edx
mov dword [ebp], eax
lea eax, [ebx + 0x30]
push edi
push eax
mov dword [ebx], esi
mov dword [ebp + 4], ecx
call fcn.0047b73e
mov esi, dword [esp + 0x38]
mov eax, dword [ebx]
lea edi, [ebx + 0x10]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea ecx, [eax - 8]
add esp, 0x18
not eax
test ecx, ecx
je 0x41b00c
movzx edx, byte [ebp]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4abe38]
dec ecx
inc ebp
test ecx, ecx
jne 0x41aff0
not eax
mov dword [ebx + 4], eax
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x41b060
Capabilities:
Hash data with crc32

Disassembly:
push 9
call fcn.0047a780
add esp, 4
test eax, eax
jne 0x41b06f
ret
mov dword [eax], 9
mov byte [eax + 8], 1
movzx ecx, byte [eax + 8]
xor ecx, 0xfffffff6
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4abe38]
xor ecx, 0xffffff
not ecx
mov dword [eax + 4], ecx
ret
Function at 0x41b7e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41b847
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea ecx, [esp + 0x10]
push ecx
push 8
lea edx, [esp + 0x24]
push edx
push esi
call edi
push ebx
lea eax, [esp + 0x10]
push eax
push 8
lea ecx, [esp + 0x1c]
push ecx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x41c210
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x84]
lea ebx, [edi + 0x3f]
push ebx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [edi + 0x3a]
test al, 0x20
je 0x41c245
mov byte [esp + 0x13], 1
jmp 0x41c24f
or al, 0x20
mov byte [esp + 0x13], 0
mov byte [edi + 0x3a], al
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call ebx
cmp byte [esp + 0x13], 0
jne 0x41c3da
push 0x4b4c80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x4b1d0c]
push 0x4b4c80
call ebx
cmp dword [edi + 0x2a], 0
je 0x41c290
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x2a], 0
jne 0x41c281
nop
cmp dword [edi + 0x88], 0
mov eax, edi
je 0x41c2b9
jmp 0x41c2a0
mov eax, dword [eax + 0x88]
test byte [eax + 0x3a], 0x20
je 0x41c3e5
cmp dword [eax + 0x88], 0
jne 0x41c2a0
test esi, esi
je 0x41c389
cmp byte [esi + 0x83], 0
je 0x41c360
mov edx, dword [esi + 0x57]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, 2
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x24], 0
call fcn.0041ed90
add esp, 8
lea ebx, [esi + 0x3f]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [esi + 0x3a], 0x40
mov byte [esp + 0x13], 0
jne 0x41c336
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
or byte [esi + 0x3a], 0x40
mov dword [esi + 0x32], eax
mov dword [esi + 0x36], ecx
mov dword [esi + 0x2e], 0
mov byte [esp + 0x13], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [esp + 0x13], 0
je 0x41c360
mov edx, dword [esi + 0x57]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and byte [esi + 0x3a], 0xbf
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ebx, [esi + 0x3f]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
push ebx
mov word [esi + 0x10], ax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [edi + 0x83], 0
je 0x41c397
call fcn.0041cfc0
cmp dword [edi + 0x2a], 0
je 0x41c3ae
lea ecx, [ecx]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x2a], 0
jne 0x41c3a0
push 0x4b4c80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x4b1d0c]
push 0x4b4c80
call ebx
push 0
push 0
push edi
push 0x41c1d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41c290
Function at 0x41c820
Capabilities:
Create thread

Disassembly:
push esi
push 8
call fcn.0047a780
mov esi, eax
add esp, 4
test esi, esi
je 0x41c885
cmp byte [0x4b1d08], 0
jne 0x41c84c
push 0x4b4c80
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x4b1d08], 1
push 0x4b4c80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x4b1d0c]
push 0x4b4c80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 8]
push 0
push 0
push esi
push 0x41c7c0
push 0
push 0
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
pop esi
ret

Function at 0x41c950
Capabilities:
Create thread

Disassembly:
push edi
mov edi, eax
test edi, edi
je 0x41c9d4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
cmp dword [edi + 0x88], 0
je 0x41c9c7
push 8
call fcn.0047a780
mov esi, eax
add esp, 4
test esi, esi
je 0x41c9c7
cmp byte [0x4b1d08], 0
jne 0x41c99a
push 0x4b4c80
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x4b1d08], 1
push 0x4b4c80
call ebp
inc dword [0x4b1d0c]
push 0x4b4c80
call ebx
push 0
push 0
push esi
push 0x41c7c0
push 0
push 0
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov edi, dword [edi + 0x88]
test edi, edi
jne 0x41c966
pop esi
pop ebp
pop ebx
pop edi
ret

Function at 0x41c9e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
not eax
test ecx, ecx
je 0x41ca0c
push esi
jmp 0x41c9f0
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4abe38]
dec ecx
inc edx
test ecx, ecx
jne 0x41c9f0
pop esi
not eax
ret