joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469d98
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x469dfa
call fcn.00469d48
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00463d0c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00463d0c
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x469e78
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x48b094], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x469f52
cmp dword [0x48b090], 0
jne 0x469f52
cmp dword [0x48b274], 0
je 0x469f0c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00469c48
add esp, 8
mov ebx, eax
test eax, eax
jne 0x469ef2
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00469c48
add esp, 8
mov ebx, eax
test eax, eax
jne 0x469ef2
lea ebx, [ebp - 0x84]
jmp 0x469ef3
inc ebx
call fcn.00469e34
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x469f8d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x48b098
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00463d0c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x48b09b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x469f8d
cmp dword [0x48b090], 0
je 0x469f6c
cmp dword [0x48b090], 0xffffffff
je 0x469f8d
push esi
call dword [0x48b090]
pop ecx
mov eax, dword [0x48b094]
test eax, eax
je 0x469f8d
cmp dword [0x48b094], 0xffffffff
je 0x469f8d
cmp byte [eax], 0
je 0x469f8d
push esi
push eax
call fcn.00469d98
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a724
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x490a78], 0
jne 0x46a7a5
cmp dword [0x490a98], 0
jne 0x46a754
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x490a98], eax
test eax, eax
jne 0x46a754
push str.GetEnvironmentStrings_failed
call fcn.00469fa4
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x490a98]
jmp 0x46a768
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00463d0c
pop ecx
mov edi, eax
test eax, eax
jne 0x46a760
lea edi, [ebp + 1]
push edi
call fcn.0046374c
pop ecx
mov ebx, eax
mov dword [0x490a7c], ebx
test ebx, ebx
jne 0x46a792
xor eax, eax
jmp 0x46a868
push edi
mov edx, dword [0x490a98]
push edx
push ebx
call fcn.00463bbc
add esp, 0xc
jmp 0x46a7c5
xor esi, esi
mov ebx, dword [0x490a78]
jmp 0x46a7bf
push eax
call fcn.00463d0c
pop ecx
test eax, eax
jne 0x46a7bb
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x46a7af
lea ebx, [esi + 4]
push 4
mov dword [0x490a80], ebx
inc ebx
push ebx
call fcn.00463224
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x46a7e8
xor eax, eax
jmp 0x46a868
cmp dword [0x490a78], 0
jne 0x46a819
xor esi, esi
mov ebx, dword [0x490a7c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x46a80a
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00463d0c
pop ecx
mov edi, eax
test eax, eax
jne 0x46a800
jmp 0x46a84a
xor esi, esi
mov ebx, dword [0x490a78]
mov eax, dword [esp]
mov edi, eax
jmp 0x46a844
push eax
call fcn.00463d0c
pop ecx
test eax, eax
je 0x46a839
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x46a83d
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x46a828
mov eax, dword [0x490a78]
test eax, eax
je 0x46a85a
push eax
call fcn.0046375c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x490a78], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x470d14
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x470d42
mov eax, ebx
call fcn.004717b8
cmp dword [ebx + 0x3c], 0
je 0x470d3b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x470db3
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x470da5
cmp dword [ebx + 8], 0
je 0x470d64
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x470d76
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x470da5
cmp dword [ebx + 8], 0
je 0x470d57
cmp eax, 3
je 0x470d89
dec eax
jne 0x470d57
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x470d57
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x470d57
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x470dd1
cmp dword [ebx + 0x10], 0xcc
je 0x470dd1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00470ddc
pop ebx
ret
Function at 0x401140
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffffffffff
push 0x41f660
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x42ec3c
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
xor ebx, ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], ebx
call sub.MFC42.DLL_CString::CString_1
mov byte [esp + 0x20], 1
mov esi, 0x41
mov edi, 0x1a
push esi
lea eax, [esp + 0x14]
push 0x42c028
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator
inc esi
dec edi
jne 0x401188
mov esi, 0x61
mov edi, 0x1a
push esi
lea edx, [esp + 0x14]
push 0x42c028
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
call sub.MFC42.DLL_CString::operator
inc esi
dec edi
jne 0x4011b7
mov esi, 0x30
mov edi, 0xa
push esi
lea ecx, [esp + 0x14]
push 0x42c028
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
push edx
call sub.MFC42.DLL_CString::operator
inc esi
dec edi
jne 0x4011e6
push 0x42c024
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator_1
push 0x42c020
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator_1
mov ebp, dword [esp + 0x30]
test ebp, ebp
jle 0x4012f7
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov cl, byte [esi]
shr ecx, 2
inc eax
cmp ebp, 2
mov dl, byte [ecx + edi]
mov byte [eax - 1], dl
jle 0x401292
mov cl, byte [esi]
xor edx, edx
mov dl, byte [esi + 1]
and ecx, 3
shl ecx, 4
shr edx, 4
or ecx, edx
inc eax
mov cl, byte [ecx + edi]
mov byte [eax - 1], cl
mov dl, byte [esi + 1]
xor ecx, ecx
and edx, 0xf
mov cl, byte [esi + 2]
shl edx, 2
shr ecx, 6
or edx, ecx
inc eax
mov dl, byte [edx + edi]
mov byte [eax - 1], dl
mov cl, byte [esi + 2]
and ecx, 0x3f
mov dl, byte [ecx + edi]
mov byte [eax], dl
jmp 0x4012e3
mov ecx, ebp
dec ecx
je 0x4012cd
dec ecx
jne 0x4012e4
mov cl, byte [esi]
xor edx, edx
mov dl, byte [esi + 1]
and ecx, 3
shl ecx, 4
shr edx, 4
or ecx, edx
inc eax
mov cl, byte [ecx + edi]
mov byte [eax - 1], cl
mov dl, byte [esi + 1]
xor ecx, ecx
and edx, 0xf
mov cl, byte [esi + 2]
shl edx, 2
shr ecx, 6
or edx, ecx
mov dl, byte [edx + edi]
mov byte [eax], dl
jmp 0x4012df
mov cl, byte [esi]
and ecx, 3
shl ecx, 4
inc eax
mov dl, byte [ecx + edi]
mov byte [eax - 1], dl
mov byte [eax], 0x3d
inc eax
mov byte [eax], 0x3d
inc eax
sub ebp, 3
add esi, 3
add ebx, 4
test ebp, ebp
jg 0x40123f
jmp 0x4012fb
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x10]
mov byte [eax], 0
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x402a50
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x41fc36
push eax
mov eax, 0x2118
mov dword fs:[0], esp
call fcn.0041f060
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
push eax
lea ecx, [esp + 0x12c]
push 0x1000
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x402baa
mov edx, dword [esp + 0x18]
xor ebx, ebx
shr edx, 2
test edx, edx
mov dword [esp + 0x14], ebx
jle 0x402baa
mov ebp, dword [esp + 0x2138]
lea edi, [esp + 0x128]
mov eax, dword [edi]
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x1128]
push ecx
mov esi, eax
push 0x1000
push edx
push esi
call sub.PSAPI.DLL_EnumProcessModules
mov ecx, dword [esp + 0x1128]
lea eax, [esp + 0x24]
push 0x104
push eax
push ecx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
lea edx, [esp + 0x24]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::CString_2
push 0x5c
lea ecx, [esp + 0x14]
mov dword [esp + 0x2134], ebx
call sub.MFC42.DLL_CString::ReverseFind
inc eax
lea ecx, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
call sub.MFC42.DLL_CString::Mid
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2134], 1
call fcn.0041edca
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2130], bl
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x10]
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402b72
cmp cl, bl
je 0x402b6e
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402b72
add eax, 2
add esi, 2
cmp cl, bl
jne 0x402b4e
xor eax, eax
jmp 0x402b77
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x402bc7
lea ecx, [esp + 0x10]
mov dword [esp + 0x2130], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
inc eax
add edi, 4
shr ecx, 2
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x402ab5
xor eax, eax
mov ecx, dword [esp + 0x2128]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2124
ret 4
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2130], 0xffffffff
mov esi, dword [esp + edx*4 + 0x128]
call sub.MFC42.DLL_CString::CString
mov eax, esi
jmp 0x402bac
Function at 0x402bf0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push 0xffffffffffffffff
push 0x41fc6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
xor esi, esi
push edi
mov dword [esp + 0x10], esi
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x28]
lea ecx, [esp + 8]
push eax
mov byte [esp + 0x20], 3
call fcn.0041edca
mov eax, dword [esp + 0x28]
cmp dword [eax - 8], esi
jle 0x402c95
push ebx
mov ebx, dword [esp + 0x30]
mov al, byte [esi + eax]
xor ecx, ecx
mov cl, bh
xor cl, al
push ecx
push esi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::SetAt
mov edx, dword [esp + 0xc]
movzx ax, byte [esi + edx]
add eax, ebx
mov ebx, 0x58bf
lea ecx, [eax + eax*2]
shl ecx, 4
sub ecx, eax
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*8]
lea edx, [eax + ecx*2]
mov eax, dword [esp + 0x2c]
sub ebx, edx
inc esi
cmp esi, dword [eax - 8]
jl 0x402c50
pop ebx
lea eax, [esp + 8]
lea ecx, [esp + 0x28]
push eax
call fcn.0041edca
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::Empty
mov eax, dword [esp + 0x28]
xor edi, edi
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x402d29
mov cl, byte [edi + eax]
push 0x42c3c0
mov byte [esp + 0x30], cl
lea ecx, [esp + 0x10]
mov esi, dword [esp + 0x30]
and esi, 0xff
call fcn.0041ed8e
mov eax, 0x4ec4ec4f
lea ecx, [esp + 0xc]
imul esi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
add dl, 0x41
push edx
push 0
call sub.MFC42.DLL_CString::SetAt
mov eax, esi
mov ecx, 0x1a
cdq
idiv ecx
lea ecx, [esp + 0xc]
add dl, 0x41
push edx
push 1
call sub.MFC42.DLL_CString::SetAt
lea edx, [esp + 0xc]
lea ecx, [esp + 8]
push edx
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0x28]
inc edi
cmp edi, dword [eax - 8]
jl 0x402cb9
mov esi, dword [esp + 0x24]
lea eax, [esp + 8]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x402d80
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x41fcaf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov dword [esp + 0x14], 0
lea ecx, [esp + 4]
mov dword [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 8]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 4]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CString::Empty
mov ecx, dword [esp + 0x2c]
xor esi, esi
mov eax, dword [ecx - 8]
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x402e4a
push edi
mov al, byte [ecx + esi*2]
mov cl, byte [ecx + esi*2 + 1]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], cl
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and eax, 0xff
and ecx, 0xff
push 0x42c3c4
lea edx, [eax + eax*2]
lea eax, [eax + edx*4]
lea edi, [ecx + eax*2 - 0x6db]
lea ecx, [esp + 0x10]
call fcn.0041ed8e
push edi
push 0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::SetAt
lea edx, [esp + 0xc]
lea ecx, [esp + 8]
push edx
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 0x30]
inc esi
mov eax, dword [ecx - 8]
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jl 0x402de1
pop edi
lea eax, [esp + 4]
lea ecx, [esp + 0x2c]
push eax
call fcn.0041edca
mov edx, dword [esp + 0x2c]
xor esi, esi
mov eax, dword [edx - 8]
test eax, eax
jle 0x402ead
push ebx
mov ebx, dword [esp + 0x34]
mov dl, byte [esi + edx]
xor ecx, ecx
mov cl, bh
xor cl, dl
push ecx
push esi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::SetAt
mov edx, dword [esp + 0x30]
movzx ax, byte [esi + edx]
add eax, ebx
mov ebx, 0x58bf
lea ecx, [eax + eax*2]
shl ecx, 4
sub ecx, eax
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*8]
lea eax, [eax + ecx*2]
sub ebx, eax
mov eax, dword [edx - 8]
inc esi
cmp esi, eax
jl 0x402e6a
pop ebx
mov esi, dword [esp + 0x28]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x14], 1
lea ecx, [esp + 8]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x4065f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x42058f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
mov eax, dword [ebx]
push edi
push 0
push 0
push 0xffffffffffffffff
push eax
mov eax, dword [esp + 0x3c]
push 0
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
lea edi, [ebp + ebp + 2]
push edi
call sub.MFC42.DLL_operatornew
mov ecx, edi
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov ebx, dword [ebx]
mov eax, dword [esp + 0x34]
push 0xffffffffffffffff
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
push 0
push 0
push 0
push ecx
push 0xffffffffffffffff
push esi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
lea edi, [ebx + 1]
push edi
call sub.MFC42.DLL_operatornew
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
push 0
and ecx, 3
push ebx
push ebp
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x40]
push 0xffffffffffffffff
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::CString_1
mov edi, 1
push ebp
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x2c]
push 0x42cfb4
push ecx
call sub.MFC42.DLL_CString::Format
push esi
call sub.MFC42.DLL_operatordelete
push ebp
call sub.MFC42.DLL_operatordelete
mov esi, dword [esp + 0x38]
add esp, 0x14
lea edx, [esp + 0x28]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x416ba0
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esi]
inc eax
push eax
mov eax, dword [esp + 0x14]
push edi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 8
Function at 0x4197e0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, ecx
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [edx + 4]
push esi
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 8

Function at 0x419820
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa00
lea eax, [esp]
lea edx, [esp + 8]
push eax
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0xa0c]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
mov dword [esp + 0x18], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x419874
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0xa0c]
call fcn.0041ed8e
mov eax, 1
add esp, 0xa00
ret 8
xor eax, eax
add esp, 0xa00
ret 8
Function at 0x41be00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x41be0b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x41bf0e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x425d94]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x425d94]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x425d94]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x425d94]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x425d94]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x425d94]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x425d94]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x425d94]
xor eax, edx
inc ecx
dec edi
jne 0x41be26
pop edi
test esi, esi
je 0x41bf30
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x425d94]
xor eax, edx
inc ecx
dec esi
jne 0x41bf12
pop esi
pop ebx
not eax
ret

Function at 0x41bf40
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x425d94]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x425d94]
xor eax, edx
mov dword [ecx + 8], eax
ret
Function at 0x41c960
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x41c9a1
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41c996
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x41c9b4
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x14]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x1c]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x1c], ecx
pop ebp
pop ebx
ret