joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417aa0
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push 0xffffffffffffffff
push 0x451a78
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x469524]
xor eax, esp
mov dword [esp + 0x134], eax
push ebx
push esi
push edi
mov eax, dword [0x469524]
xor eax, esp
push eax
lea eax, [esp + 0x14c]
mov dword fs:[0], eax
push 0x124
lea eax, [esp + 0x24]
push 0
mov dword [esp + 0x15c], 0
push eax
mov dword [esp + 0x28], 0
call fcn.0043de70
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
jne 0x417b45
mov dword [esp + 0x154], eax
mov eax, dword [esp + 0x15c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417b3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x417c6c
lea ecx, [esp + 0x1c]
push ecx
push esi
mov dword [esp + 0x24], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x417c32
mov esi, dword [esp + 0x15c]
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x18], esp
mov ebx, esp
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x417b95
cmp eax, dword [esi]
jne 0x417b95
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x417bc9
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x417c93
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0043a8fb
add esp, 0x10
add edi, 0x10
mov dword [ebx], edi
mov edx, dword [esp + 0x28]
push edx
call fcn.00417ea0
add esp, 8
test eax, eax
je 0x417c17
mov eax, dword [esp + 0x24]
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x417c17
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x417c10
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x417b60
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x154], 0xffffffff
mov eax, dword [esp + 0x15c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417c67
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x14c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x134]
xor ecx, esp
call fcn.0043a8ec
add esp, 0x148
ret
call fcn.0040a570
int3
Function at 0x417ca0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x451a38
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x469524]
xor eax, esp
mov dword [esp + 0x13c], eax
push ebx
push esi
push edi
mov eax, dword [0x469524]
xor eax, esp
push eax
lea eax, [esp + 0x150]
mov dword fs:[0], eax
mov eax, dword [esp + 0x164]
mov dword [esp + 0x1c], eax
push 0x124
lea ecx, [esp + 0x2c]
push 0
mov dword [esp + 0x160], 0
push ecx
mov dword [esp + 0x30], 0
call fcn.0043de70
add esp, 0xc
xor edi, edi
push edi
push 2
mov dword [esp + 0x1c], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, 0xffffffff
jne 0x417d56
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x160]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x417d4e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
jmp 0x417e6d
lea ecx, [esp + 0x24]
push ecx
push esi
mov dword [esp + 0x2c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x417e30
mov esi, dword [esp + 0x160]
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x24], esp
mov ebx, esp
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x417da6
cmp eax, dword [esi]
jne 0x417da6
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x417dda
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x417e94
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0043a8fb
add esp, 0x10
add edi, 0x10
mov dword [ebx], edi
mov edx, dword [esp + 0x30]
push edx
call fcn.00418010
add esp, 8
test eax, eax
je 0x417e11
mov eax, dword [esp + 0x2c]
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x417e11
inc dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x417d71
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
mov dword [esp + 0x158], 0xffffffff
mov eax, dword [esp + 0x160]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417e6b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x150]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.0043a8ec
add esp, 0x14c
ret
call fcn.0040a570
int3
Function at 0x417ea0
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x451988
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x469524]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push esi
mov eax, dword [0x469524]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
push 0x220
lea eax, [esp + 0x14]
push 0
mov dword [esp + 0x244], 0
push eax
mov dword [esp + 0x18], 0
call fcn.0043de70
mov ecx, dword [esp + 0x250]
add esp, 0xc
push ecx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
or ebx, 0xffffffff
cmp esi, ebx
jne 0x417f33
mov dword [esp + 0x23c], ebx
mov eax, dword [esp + 0x248]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], ebx
dec ebx
jmp 0x417f9b
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0x224
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x417f7b
lea ebx, [ebx]
mov eax, dword [esp + 0x248]
lea edx, [esp + 0x12c]
push edx
push eax
call fcn.0043bf01
add esp, 8
test eax, eax
je 0x417fd1
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x417f50
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x23c], ebx
mov eax, dword [esp + 0x248]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x417fa9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0043a8ec
add esp, 0x234
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x23c], ebx
mov eax, dword [esp + 0x248]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], ebx
dec ebx
test ebx, ebx
jg 0x417fff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x417fab
Function at 0x418010
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x4519f3
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x469524]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x469524]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
xor ebx, ebx
push 0x220
lea eax, [esp + 0x20]
push ebx
mov dword [esp + 0x250], ebx
push eax
mov dword [esp + 0x24], ebx
call fcn.0043de70
mov ecx, dword [esp + 0x25c]
add esp, 0xc
push ecx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
or ebp, 0xffffffff
cmp esi, ebp
jne 0x4180a1
mov dword [esp + 0x248], ebp
mov eax, dword [esp + 0x254]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
jmp 0x41815d
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], 0x224
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x41813d
call fcn.0042121c
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4180d6
push 0x80004005
call fcn.0040ad10
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov edi, eax
mov byte [esp + 0x248], 1
lea esp, [esp]
mov edx, dword [esp + 0x254]
lea ecx, [esp + 0x38]
push ecx
push edx
call fcn.0043b4e8
add esp, 8
cmp eax, ebx
je 0x418195
lea eax, [esp + 0x18]
push eax
push esi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x4180f0
mov eax, edi
mov byte [esp + 0x248], bl
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41813d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x248], ebp
mov eax, dword [esp + 0x254]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x41816b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.0043a8ec
add esp, 0x238
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov byte [esp + 0x248], bl
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4181bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x248], ebp
mov eax, dword [esp + 0x254]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x4181e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x41816d
Function at 0x4181f0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x134
mov eax, dword [0x469524]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
push edi
push 0
push 0xf
or edi, 0xffffffff
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32First
jmp 0x418230
lea ecx, [esp + 0x2c]
push ecx
push str.iexplore.exe
call fcn.0043c749
add esp, 8
test eax, eax
je 0x418257
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x418230
jmp 0x41825b
mov edi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x134]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0043a8ec
add esp, 0x134
ret

Function at 0x4182c0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x134
mov eax, dword [0x469524]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x124
mov edi, eax
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x14], 0x128
call fcn.0043de70
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push edi
call sub.KERNEL32.dll_Process32First
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418310
sub eax, edx
mov ebx, eax
jmp 0x418320
push ebx
lea edx, [esp + 0x30]
push esi
push edx
call fcn.0043ca68
add esp, 0xc
test eax, eax
je 0x418359
lea eax, [esp + 8]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x418320
pop edi
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.0043a8ec
add esp, 0x134
ret
mov ecx, dword [esp + 0x134]
mov eax, dword [esp + 0x10]
pop edi
pop ebx
xor ecx, esp
call fcn.0043a8ec
add esp, 0x134
ret

Function at 0x418380
Capabilities:
Check os version
Create process on windows

Disassembly:
sub esp, 0x3c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, al
cmp eax, 6
jb 0x4183f0
push 0x38
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0043de70
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
add esp, 0xc
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x500
mov dword [esp + 0x10], str.runas
mov dword [esp + 0x14], ecx
cmp dword [eax - 0xc], 0
jle 0x4183d9
mov dword [esp + 0x18], eax
lea edx, [esp + 4]
push edx
mov dword [esp + 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov esi, eax
jmp 0x418415
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push 5
push 0
push eax
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
cmp eax, 0x20
setne dl
mov esi, edx
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418437
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418457
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
add esp, 0x3c
ret
Function at 0x418460
Capabilities:
Check os version
Create process on windows

Disassembly:
sub esp, 0x3c
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, al
cmp eax, 6
jb 0x4184fe
push 0x38
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0043de70
add esp, 0xc
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x500
test edi, edi
je 0x4184ad
mov dword [esp + 8], 0x140
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], str.runas
mov dword [esp + 0x14], ecx
cmp dword [eax - 0xc], 0
jle 0x4184cb
mov dword [esp + 0x18], eax
lea edx, [esp + 4]
push edx
mov dword [esp + 0x24], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov esi, eax
test esi, esi
je 0x418522
test edi, edi
je 0x418522
mov eax, dword [esp + 0x3c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x418522
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
push esi
push 0
push edx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setne cl
mov esi, ecx
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x418544
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418564
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
add esp, 0x3c
ret

Function at 0x418570
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebp
mov esi, eax
mov dword [esp + 8], esi
call ebp
sub eax, esi
cmp eax, dword [esp + 0x2c]
jae 0x4185e3
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4185d5
lea ecx, [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
call ebx
push 1
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
jne 0x4185b4
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x34]
jb 0x4185a1
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
ret
Function at 0x41aba0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x41aba7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x41ac84
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x45d250]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x45d250]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x45d250]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x45d250]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x45d250]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x45d250]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x45d250]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x45d250]
inc ecx
sub edx, 8
sub esi, 1
jne 0x41abc0
pop edi
test edx, edx
je 0x41acab
jmp 0x41ac90
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x45d250]
inc ecx
sub edx, 1
jne 0x41ac90
not eax
pop esi
ret

Function at 0x41acb0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x45d250]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x45d250]
mov dword [edx + 8], ecx
ret

Function at 0x41ad00
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x45d250]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x45d250]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x41b4b0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x41b4e2
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b4d8
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x41b4f5
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.004419e0
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x41b510
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x41b543
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b53d
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x41b56f
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x41b555
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.004419e0
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x41b586
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x41b580
cmp byte [esi + 8], 0
je 0x41b580
or eax, 0xffffffff
add esp, 8
ret
Function at 0x41b670
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x41b6b5
cmp byte [esi + 1], 0
je 0x41b6bd
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x41b6d2
cmp byte [esi + 1], 0
je 0x41b6c4
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x41b6db
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x41b68e
or eax, 0xffffffff
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x41b6db
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, 0xffff
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x41b6ef
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call fcn.0043ce27
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x41b70d
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0xffffffff
cmp edi, eax
jbe 0x41b821
jmp 0x41b730
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x41b741
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x41b75a
mov ebp, 0x404
cmp byte [esi], 0
je 0x41b77f
cmp byte [esi + 1], 0
je 0x41b821
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x41b782
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebp
je 0x41b7aa
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b7a4
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x41b7d0
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x41b7bb
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
push edi
add ecx, eax
push ecx
push ebx
call fcn.004419e0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x41b821
lea eax, [ebp - 3]
test eax, eax
jl 0x41b80c
dec eax
cmp byte [eax + ebx], 0x50
jne 0x41b7fc
cmp byte [eax + ebx + 1], 0x4b
jne 0x41b7fc
cmp byte [eax + ebx + 2], 5
jne 0x41b7fc
cmp byte [eax + ebx + 3], 6
je 0x41b802
test eax, eax
jge 0x41b7e0
jmp 0x41b80c
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
jne 0x41b821
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x41b724
push ebx
call fcn.0043bb43
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret