joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401980
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x417143
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
push 0xc
call sub.MFC71U.DLL_CWordArray::CWordArray
add esp, 4
mov dword [esp + 8], eax
xor edi, edi
cmp eax, edi
mov dword [esp + 0x38], edi
je 0x4019c1
mov ecx, eax
call fcn.0040f540
mov esi, eax
mov dword [esp + 8], esi
jmp 0x4019c7
mov dword [esp + 8], edi
mov esi, edi
cmp esi, edi
mov dword [esp + 0x38], 0xffffffff
jne 0x4019e6
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
push ebx
push ebp
push esi
lea ecx, [esp + 0x18]
call fcn.0040f700
mov eax, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x44], 1
call fcn.0040f730
test eax, eax
je 0x401a67
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, edi
lea ecx, [esp + 0x14]
call fcn.0040f7b0
push eax
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401a9b
push 0x64
call edi
push 0xffffffffffffffff
push esi
call ebp
test eax, eax
je 0x401a98
push 0x64
call edi
push esi
call ebx
mov ecx, dword [esp + 0x48]
push ecx
lea ecx, [esp + 0x18]
call fcn.0040f730
test eax, eax
jne 0x401a20
mov esi, dword [esp + 0x10]
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], 0xffffffff
call fcn.0040f810
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
push esi
call ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], 0xffffffff
call fcn.0040f810
mov ecx, dword [esp + 0x38]
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret

Function at 0x401d70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4171b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x20]
mov ecx, edi
mov dword [esp + 8], 0
call dword [sym.imp.MFC71U.DLL_CWinThread::GetMainWnd]
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_2]
mov esi, dword [esp + 0x24]
test esi, esi
mov dword [esp + 0x14], 0
jne 0x401dbb
xor eax, eax
jmp 0x401dc5
push esi
call dword [sym.imp.MSVCR71.dll_wcslen]
add esp, 4
mov ecx, dword [edi]
push eax
mov eax, dword [ecx - 0xc]
push esi
push eax
push ecx
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.MFC71U.DLL_CPreviewDC::ComputeDeltas]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x402420
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x417242
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 8]
lea edi, [esi + 0x8c]
push eax
mov ecx, edi
mov dword [esp + 0x1c], 0
call sub.MFC71U.DLL_CWnd::GetWindowTextW
mov ecx, dword [esp + 8]
mov eax, dword [ecx - 0xc]
cmp eax, 1
jge 0x40248d
mov ecx, esi
call fcn.00401b30
lea edx, [esp + 8]
push edx
mov ecx, edi
call sub.MFC71U.DLL_CWnd::GetWindowTextW
mov eax, dword [esp + 8]
cmp dword [eax - 0xc], 1
jl 0x402515
mov ecx, dword [esi + 0xe4]
add ecx, 0x114
push ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
push 0x41b028
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 1
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator]
mov edx, dword [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_CListBox::CompareItem]
test eax, eax
jne 0x4024f5
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x402532
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x403b10
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
push esi
mov esi, ecx
je 0x403b25
push eax
lea ecx, [esi + 4]
call dword [0x41a42c]
mov eax, dword [esi]
mov ecx, dword [esp + 8]
mov esi, dword [esi + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop esi
ret 0xc
Function at 0x403b50
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1008
call fcn.00416770
mov eax, dword [0x427b3c]
push ebx
mov ebx, dword [esp + 0x1014]
push ebp
mov ebp, dword [esp + 0x101c]
mov dword [esp + 0x100c], eax
mov eax, dword [esp + 0x1020]
test eax, eax
push esi
push edi
mov edi, dword [esp + 0x101c]
mov esi, ecx
mov dword [esp + 0x10], 0
je 0x403b9e
push eax
lea ecx, [esi + 4]
call dword [0x41a42c]
mov eax, dword [esi]
mov edx, dword [esi + 4]
push eax
push 0x800
lea ecx, [esp + 0x1c]
push ecx
push ebp
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_3]
mov ecx, dword [esp + 0x1014]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.00416740
add esp, 0x1008
ret 0x10

Function at 0x403c00
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x41748b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 1
push edi
lea ecx, [esp + 0x10]
mov esi, ebx
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT]
push 0x2e
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call dword [sym.imp.MFC71U.DLL_COleMessageFilter::XMessageFilter::RetryRejectedCall]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_CToolBar::Layout]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 2
call dword [0x41a404]
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 0xc]
push esi
push ecx
lea edx, [esp + 0x18]
push str._s._03d
push edx
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Format]
mov eax, dword [esp + 0x20]
add esp, 0x10
push eax
inc esi
call ebx
cmp eax, 0xffffffff
jne 0x403c85
mov ecx, dword [esp + 0x10]
mov edi, dword [edi]
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x10]
mov esi, eax
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x403cf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x403d10
Capabilities:
Move file

Disassembly:
mov edi, edi
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x403d3b
push edi
mov ecx, esi
call dword [0x41a42c]
pop edi
mov eax, 1
pop esi
ret 4
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x403fe0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4174a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT]
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call dword [sym.imp.MFC71U.DLL_CWinApp::LoadStdProfileSettings]
mov eax, dword [esp + 0x24]
test eax, eax
mov edi, dword [esp + 8]
je 0x404031
push eax
lea ecx, [esi + 4]
call dword [0x41a42c]
mov eax, dword [esi]
mov ecx, dword [esp + 0x20]
mov esi, dword [esi + 4]
push eax
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esp + 8]
mov esi, eax
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x404180
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x41753b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [esp + 0x30]
test eax, eax
mov dword [esp + 0x1c], 0
je 0x4041dd
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x34]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esi + 4]
mov byte [esp + 0x20], 1
call dword [0x41a404]
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c], 0
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
push 0x7fff
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
jne 0x404218
lea ecx, [esp + 0x24]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
mov eax, dword [esi]
mov edx, dword [esp + 0x24]
push eax
push 0x7fff
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
cmp eax, 1
jb 0x4042fc
mov edi, dword [esp + 0x2c]
mov esi, ebp
jmp 0x404240
push esi
lea ecx, [esp + 0x34]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_3]
push 1
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x24], 2
call dword [sym.imp.MFC71U.DLL_RFX_Text_Bulk]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 1
jne 0x404282
push 0
mov ecx, eax
call dword [sym.imp.MFC71U.DLL_COleVariant::operator]
movsx dx, byte [esp + 0x34]
cmp ax, dx
jne 0x404282
xor bl, bl
jmp 0x404284
mov bl, 1
lea ecx, [esp + 0x2c]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
test bl, bl
je 0x4042c2
push 0
push 0x41b218
lea ecx, [esp + 0x38]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Find]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
sub eax, edi
push eax
push edi
push ecx
lea ecx, [esp + 0x40]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Mid]
mov ecx, dword [esp + 0x2c]
call fcn.00402e30
mov dx, word [esi]
add esi, 2
test dx, dx
jne 0x4042c2
cmp word [esi + 2], dx
lea ecx, [esp + 0x30]
je 0x4042e6
mov byte [esp + 0x1c], dl
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
jmp 0x404240
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [esp + 0x24]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x14
Function at 0x4044f0
Capabilities:
Get disk information
Get disk size
Print debug messages

Disassembly:
sub esp, 0x4b8
mov eax, dword [0x427b3c]
push esi
mov esi, dword [esp + 0x4c0]
push esi
mov dword [esp + 0x4bc], eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 6
ja case.0x40451d.2
movzx ecx, byte [eax + 0x4046c4]
jmp dword [ecx*4 + 0x4046b8]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je case.0x40451d.0
mov eax, dword [esp + 8]
test eax, eax
ja 0x404558
cmp dword [esp + 4], 0x1d4c000
jbe case.0x40451d.0
mov eax, 1
pop esi
mov ecx, dword [esp + 0x4b4]
call fcn.00416740
add esp, 0x4b8
ret 4
cmp eax, 2
jne case.0x40451d.0
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [esp + 0x2b4]
push str.._s
push edx
call esi
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0
lea eax, [esp + 0x2c8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4045f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0xb4]
push str.IsValidDrive___CreateFile_failed____d__n
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x4b4]
call fcn.00416740
add esp, 0x4b8
ret 4
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x90
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0x70000
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x404694
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
jne 0x40465b
lea eax, [esp + 0xb0]
push str.The_device_is_not_ready._n
push eax
call esi
add esp, 8
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x4b4]
call fcn.00416740
add esp, 0x4b8
ret 4
push eax
lea edx, [esp + 0xb4]
push 0x41b498
push edx
call esi
add esp, 0xc
lea eax, [esp + 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x4b4]
call fcn.00416740
add esp, 0x4b8
ret 4
mov ecx, dword [esp + 0x28]
xor eax, eax
cmp ecx, 0xb
mov ecx, dword [esp + 0x4b8]
sete al
pop esi
call fcn.00416740
add esp, 0x4b8
ret 4
Function at 0x404ee0
Capabilities:
Access peb ldr_data
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4176ed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
mov ebp, ecx
push edi
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT]
mov eax, dword [ebp + 0x230]
mov ecx, dword [eax + 0x108]
mov edx, dword [eax + 0xf4]
push ecx
push edx
lea eax, [esp + 0x14]
push str._sbakdevs.exe__Script___s_
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Format]
push 0x98
call sub.MFC71U.DLL_CWordArray::CWordArray
mov esi, eax
add esp, 0x14
mov dword [esp + 0x10], esi
test esi, esi
mov byte [esp + 0x20], 1
je 0x404f70
push 0
push 0
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
mov ecx, esi
call fcn.0040ece0
mov esi, eax
jmp 0x404f72
xor esi, esi
mov eax, dword [esi]
push 0
mov ecx, esi
mov byte [esp + 0x24], 0
mov word [esi + 8], 5
call dword [eax + 0x20]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x24]
mov edi, eax
neg edi
sbb edi, edi
mov ecx, esi
inc edi
call fcn.0040e7b0
push esi
call sub.MFC71U.DLL_CNoTrackObject::operator_new
add esp, 4
test edi, edi
je 0x40500f
mov eax, dword [ebp + 0x230]
add eax, 0xf4
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
push 0x41b6c8
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 2
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
cmp eax, 0xffffffff
setne dl
lea ecx, [esp + 0x10]
mov esi, edx
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebp
add esp, 0x18
ret
Function at 0x405ad0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
sub esp, 0x410
mov eax, dword [0x427b3c]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x424]
mov dword [esp + 0x41c], eax
mov eax, dword [esp + 0x428]
push edi
lea ecx, [esp + 0x220]
push ecx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
mov esi, 0x37c5d22a
mov ebp, 0x77be9b9c
mov ebx, 0x36456178
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
mov dword [esp + 0x18], eax
jle 0x405b9d
xor edi, edi
mov edx, eax
lea esp, [esp]
movzx eax, word [esp + edi + 0x21c]
mov dword [esp + 0x10], eax
mov eax, esi
xor eax, dword [esp + 0x10]
shr esi, 8
and eax, 0xff
xor esi, dword [eax*4 + 0x427040]
mov ecx, ebx
mov eax, esi
and eax, 0xff
add eax, ebp
imul eax, eax, 0x8088405
or ecx, 2
inc eax
mov ebp, eax
shr eax, 0x18
xor eax, ebx
and eax, 0xff
shr ebx, 8
xor ebx, dword [eax*4 + 0x427040]
mov eax, ecx
xor eax, 1
imul eax, ecx
movzx cx, ah
mov eax, dword [esp + 0x10]
add edi, 2
xor ecx, eax
dec edx
mov word [esp + edi + 0x1a], cx
jne 0x405b30
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
lea ecx, [eax + eax + 2]
mov edx, ecx
shr ecx, 2
mov word [esp + eax*2 + 0x1c], 0
lea esi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebp
pop ebx
call fcn.00416740
add esp, 0x410
ret 8
Function at 0x407440
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x42c
mov eax, dword [0x427b3c]
mov dword [esp + 0x428], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
xor eax, eax
push ebx
push esi
push edi
mov byte [esp + 0x120], 0
mov ecx, 0x40
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov word [esp + 0x228], 0
mov ecx, 0x81
lea edi, [esp + 0x22a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x407579
lea ecx, [esp + 0x120]
test ecx, ecx
je 0x40750a
mov ecx, 0xc
mov esi, str.SoftwareMicrosoftMicrosoft_SQL_Server80Tools
lea edi, [esp + 0x120]
rep movsd dword es:[edi], dword [esi]
xor edx, edx
cmp edx, str.Help
movsb byte es:[edi], byte [esi]
je 0x40750a
lea edi, [esp + 0x120]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4074f0
mov eax, dword [str.Help]
mov cx, word [0x41be9c]
mov dword [edi], eax
mov word [edi + 4], cx
lea edx, [esp + 0x18]
test edx, edx
mov dword [esp + 0x14], 0x104
mov dword [esp + 0xc], 0
je 0x407579
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x12c]
push ecx
push 0x80000002
mov byte [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407579
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push str.HelpPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40758d
lea edx, [esp + 0x18]
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x407581
jmp 0x4075cd
lea edi, [esp + 0x18]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407592
mov ax, word [0x41bea0]
mov word [edi], ax
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4075a7
lea edi, [esp + 0x18]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4075b5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x104
lea ecx, [esp + 0x22c]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x24]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 0x10]
mov edx, dword [esp + 0x10]
push eax
push 0xf
lea ecx, [esp + 0x230]
push ecx
push edx
call fcn.004155e7
mov ecx, dword [esp + 0x434]
call fcn.00416740
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407760
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
mov eax, dword [0x427b3c]
push ebp
mov ebp, dword [esp + 0x130]
mov dword [esp + 0x11c], eax
movzx eax, word [esp + 0x124]
push esi
mov esi, dword [esp + 0x12c]
push edi
xor edi, edi
test eax, 0xfffffffc
mov dword [esp + 0x10], edi
jne 0x40779c
cmp esi, edi
jne 0x4077b9
pop edi
pop esi
mov eax, 0x10
pop ebp
mov ecx, dword [esp + 0x118]
call fcn.00416740
add esp, 0x11c
ret 0x10
push ebx
mov ebx, dword [esp + 0x138]
cmp bx, 2
ja 0x4077d1
mov eax, 0x10
jmp 0x407943
cmp ebp, edi
je 0x4077c7
cmp bx, 3
jae 0x4077e5
mov eax, 1
jmp 0x407943
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push edi
push str.SOFTWAREMicrosoftMSSQLServerClientConnectTo
mov byte [esi + 1], 0
mov byte [esi], 0
push 0x80000002
mov word [ebp], di
mov byte [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40787c
test byte [esp + 0x130], 2
je 0x40787c
mov edi, edi
mov ecx, dword [esp + 0x18]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
push esi
movzx edx, bx
push edi
sub edx, 2
push ecx
mov dword [esp + 0x30], edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x40787c
test eax, eax
jne 0x407874
inc word [ebp]
mov edx, dword [esp + 0x10]
mov byte [esi + edx], al
mov eax, dword [esp + 0x10]
mov ecx, 0xffff
sub ecx, eax
add ebx, ecx
inc edi
cmp bx, 2
lea esi, [esi + eax + 1]
ja 0x407820
jmp 0x40787c
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x18]
test eax, eax
mov dword [esp + 0x1c], 0x104
je 0x4078aa
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push str.DSQUERY
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4078bf
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + str.DBNMPNTW]
mov byte [esp + eax + 0x20], cl
inc eax
test cl, cl
jne 0x4078b0
mov edx, dword [esp + 0x1c]
mov byte [esp + edx + 0x20], 0
cmp byte [esp + 0x20], 0x2c
lea eax, [esp + 0x20]
je 0x4078e7
mov cl, byte [eax]
test cl, cl
je 0x4078e7
cmp cl, 0x20
je 0x4078e7
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x2c
jne 0x4078d3
mov byte [eax], 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
je 0x40792d
push str.ConnectionServerEnum
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40792d
mov di, word [ebp]
push ebp
push ebx
push esi
call eax
mov ecx, dword [esp + 0x20]
or ecx, eax
add esp, 0xc
add word [ebp], di
mov edi, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x128]
pop ebx
pop edi
pop esi
pop ebp
call fcn.00416740
add esp, 0x11c
ret 0x10