joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009cda0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100a2d08
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100d8dd0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x100e21e4]
test eax, eax
jne 0x1009cdd2
xor esi, esi
jmp 0x1009cddb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x1009ce1d
cmp dword [esi + 0x14], 0
jne 0x1009ce5f
cmp dword [esi + 0x10], 0
jne 0x1009ce65
push 0x1009cb10
push 0x100e21e0
call fcn.1009ccf0
mov eax, dword [0x100e21e4]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x1009ce4b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1009ce4b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x1009cea5
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1009ce93
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x1009ce65
cmp dword [esi + 0x14], 0
je 0x1009cdf7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1009ceca
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1009cefb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1009cefb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1009cefb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x1009ceaf
jmp 0x1009cdf1
jmp 0x1009cda0
Function at 0x1009cf20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100a2d08
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100d8dd0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x100e21e4]
test eax, eax
jne 0x1009cdd2
xor esi, esi
jmp 0x1009cddb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x1009ce1d
cmp dword [esi + 0x14], 0
jne 0x1009ce5f
cmp dword [esi + 0x10], 0
jne 0x1009ce65
push 0x1009cb10
push 0x100e21e0
call fcn.1009ccf0
mov eax, dword [0x100e21e4]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x1009ce4b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1009ce4b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x1009cea5
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1009ce93
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x1009ce65
cmp dword [esi + 0x14], 0
je 0x1009cdf7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1009ceca
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1009cefb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1009cefb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1009cefb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x1009ceaf
jmp 0x1009cdf1
jmp 0x1009cda0
Function at 0x402dd0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40804c
call sym._EnterCriticalSection_4
mov ebx, dword [0x408044]
sub esp, 4
test ebx, ebx
je 0x402e1b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402e14
test esi, esi
je 0x402e14
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402df0
mov dword [esp], 0x40804c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x403000
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x403050
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x403128
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40308e
cmp eax, 4
jne 0x4030b0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40309e
cmp edx, 4
je 0x40309e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00403000
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x404d5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x404d6c
pop dword [ebp - 0x40]
mov eax, 0x87dba05a
add eax, 0x7864ad12
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xa0fa5ca6
sub dword [ebp - 0x50], 0x52a8175b
mov dword [ebp - 0x4c], 0xa1b8f118
add dword [ebp - 0x4c], 0x907a5b2d
mov dword [ebp - 0x48], 0x9d639d04
sub dword [ebp - 0x48], 0x511758d6
mov dword [ebp - 0x44], 0x93c59b04
add dword [ebp - 0x44], 0x6c3a64fc
lea eax, [ebp - 0x50]
push eax
mov eax, 0x345999de
sub eax, 0x3418c992
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x257d7f98
sub dword [ebp - 0x50], 0xb10b1642
mov dword [ebp - 0x4c], 0x466888c9
add dword [ebp - 0x4c], 0xfb03d8ac
mov dword [ebp - 0x48], 0xe1ccaef1
sub dword [ebp - 0x48], 0x7e5d4285
mov dword [ebp - 0x44], 0x36b4a134
sub dword [ebp - 0x44], 0x36b4a134
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xba8c503a
add eax, 0x45b4800e
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x39ed3
push 0
call eax
mov ecx, 0x69a0559
sub ecx, 0x699bb72
mov ebx, eax
mov edi, 0x33308e36
sub edi, 0x32eede36
add edi, dword [ebp - 0x40]
mov edx, 0x49425e4d
sub edx, 0xe7f7cb1e
mov esi, dword [edi]
xor dword [ebp - 0x2c], 0x7abde670
add esi, edx
xor dword [ebp - 0x34], eax
mov dword [ebx], esi
add ebx, 0x80c06c9c
sub ebx, 0x80c06c98
add edi, 0x5159e0f5
sub edi, 0x5159e0f1
loop 0x404e8e
add eax, 0xd072aeba
sub eax, 0xd071944b
mov ebx, eax
add eax, 0x653de5a
sub eax, 0x653de55
mov ecx, 0x7e827209
add ecx, 0x81bd8df7
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0xfd9850
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa5d000]
push edi
or ebp, 0xffffffff
jmp 0xfd9872
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xfd9879
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfd9868
mov eax, 1
add ebx, ebx
jne 0xfd988b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xfd989c
jne 0xfd98bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfd98bb
dec eax
add ebx, ebx
jne 0xfd98a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xfd9880
add ebx, ebx
jne 0xfd98b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xfd990d
xor ecx, ecx
sub eax, 3
jb 0xfd98d3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xfd9942
sar eax, 1
mov ebp, eax
jmp 0xfd98de
add ebx, ebx
jne 0xfd98de
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfd98ac
inc ecx
add ebx, ebx
jne 0xfd98ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfd98ac
add ebx, ebx
jne 0xfd98f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xfd98ee
jne 0xfd990a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xfd98ee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xfd992c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xfd991e
jmp 0xfd986e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xfd992c
add edi, ecx
jmp 0xfd986e
pop esi
mov edi, esi
mov ecx, 0xb45c37
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xfd9967
cmp byte [edi], 0x25
jne 0xfd994c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xfd994a
lea edi, [esi + 0xbd7000]
mov eax, dword [edi]
or eax, eax
je 0xfd99b8
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbdbb88]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbdbbc4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xfd996d
mov ecx, edi
jns 0xfd999c
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbdbbc8]
or eax, eax
je 0xfd99b2
mov dword [ebx], eax
add ebx, 4
jmp 0xfd998a
call dword [esi + 0xbdbbd8]
mov ebp, dword [esi + 0xbdbbcc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xfd99ec
sub esp, 0xffffff80
jmp 0x462198
Function at 0x40160c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp esi, 0x100000
jge 0x401622
mov esi, 0x100000
jmp 0x40162e
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 1
push 0x2000
push esi
push 0
call sub.KERNEL32.DLL_WaitForSingleObject
mov edi, eax
mov dword [ebx], edi
test edi, edi
je 0x40166b
mov edx, ebx
mov eax, 0x57a5ec
call fcn.004014c0
test al, al
jne 0x40166b
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_WinExec
xor eax, eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x401670
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov esi, edx
mov ebp, eax
mov dword [ebx + 4], 0x100000
push 4
push 0x2000
push 0x100000
push ebp
call sub.KERNEL32.DLL_WaitForSingleObject
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x4016ba
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 4
push 0x2000
push esi
push ebp
call sub.KERNEL32.DLL_WaitForSingleObject
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x4016e2
mov edx, ebx
mov eax, 0x57a5ec
call fcn.004014c0
test al, al
jne 0x4016e2
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_WinExec
xor eax, eax
mov dword [ebx], eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4016e8
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], 0xffffffff
xor edx, edx
mov dword [esp + 0xc], edx
mov ebp, eax
mov eax, dword [esp]
add eax, ebp
mov dword [esp + 0x10], eax
mov ebx, dword [0x57a5ec]
jmp 0x401768
mov edi, dword [ebx]
mov esi, dword [ebx + 8]
cmp ebp, esi
ja 0x401766
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0x10]
ja 0x401766
cmp esi, dword [esp + 8]
jae 0x401735
mov dword [esp + 8], esi
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0xc]
jbe 0x401744
mov dword [esp + 0xc], eax
push 0x8000
push 0
push esi
call sub.KERNEL32.DLL_WinExec
test eax, eax
jne 0x40175f
mov dword [0x57a5c8], 1
mov eax, ebx
call fcn.004014f0
mov ebx, edi
cmp ebx, 0x57a5ec
jne 0x401717
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
cmp dword [esp + 0xc], 0
je 0x401798
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401834
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov esi, ebx
add esi, 0xfff
and esi, 0xfffff000
mov dword [esp], esi
mov ebp, ebx
add ebp, edx
and ebp, 0xfffff000
mov eax, dword [esp]
mov dword [ecx], eax
mov eax, ebp
sub eax, dword [esp]
mov dword [ecx + 4], eax
mov esi, dword [0x57a5ec]
jmp 0x4018a3
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
add edi, ebx
cmp ebx, dword [esp]
jae 0x40187b
mov ebx, dword [esp]
cmp ebp, edi
jae 0x401881
mov edi, ebp
cmp edi, ebx
jbe 0x4018a1
push 0x4000
sub edi, ebx
push edi
push ebx
call sub.KERNEL32.DLL_WinExec
test eax, eax
jne 0x4018a1
mov dword [0x57a5c8], 2
mov esi, dword [esi]
cmp esi, 0x57a5ec
jne 0x40186b
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401af4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401baa
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x57a5cc
call sub.KERNEL32.DLL_WriteFile
cmp byte [0x57a04d], 0
je 0x401b22
push 0x57a5cc
call sub.KERNEL32.DLL_WritePrivateProfileStringA
mov eax, 0x57a5ec
call fcn.004014b8
mov eax, 0x57a5fc
call fcn.004014b8
mov eax, 0x57a628
call fcn.004014b8
push 0xff8
push 0
call sub.KERNEL32.DLL_VirtualProtect
mov dword [0x57a624], eax
cmp dword [0x57a624], 0
je 0x401b89
mov eax, 3
mov edx, dword [0x57a624]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401b5f
mov eax, 0x57a60c
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x57a618], eax
mov byte [0x57a5c4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401bb1
cmp byte [0x57a04d], 0
je 0x401ba9
push 0x57a5cc
call sub.KERNEL32.DLL_lstrcmpA
ret

Function at 0x401bb8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x57a5c4], 0
je 0x401c95
xor edx, edx
push ebp
push 0x401c8e
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x57a04d], 0
je 0x401bea
push 0x57a5cc
call sub.KERNEL32.DLL_WritePrivateProfileStringA
mov byte [0x57a5c4], 0
mov eax, dword [0x57a624]
push eax
call sub.KERNEL32.DLL_VirtualQuery
xor eax, eax
mov dword [0x57a624], eax
mov ebx, dword [0x57a5ec]
jmp 0x401c1d
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_WinExec
mov ebx, dword [ebx]
cmp ebx, 0x57a5ec
jne 0x401c0b
mov eax, 0x57a5ec
call fcn.004014b8
mov eax, 0x57a5fc
call fcn.004014b8
mov eax, 0x57a628
call fcn.004014b8
mov eax, dword [0x57a5e4]
test eax, eax
je 0x401c63
mov edx, dword [eax]
mov dword [0x57a5e4], edx
push eax
call sub.KERNEL32.DLL_VirtualQuery
mov eax, dword [0x57a5e4]
test eax, eax
jne 0x401c4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401c95
cmp byte [0x57a04d], 0
je 0x401c83
push 0x57a5cc
call sub.KERNEL32.DLL_lstrcmpA
push 0x57a5cc
call sub.KERNEL32.DLL_lstrcpyA
ret
pop ebx
pop ebp
ret

Function at 0x403408
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x573008], 0x8088405
inc edx
mov dword [ebx + 0x573008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x4049b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x57a638
mov esi, section.DATA
mov edi, 0x57a048
cmp byte [ebx + 0x28], 0
jne 0x4049e3
cmp dword [edi], 0
je 0x4049e3
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x4049d2
cmp dword [0x573004], 0
je 0x4049fd
call fcn.0040489c
call fcn.00404928
xor eax, eax
mov dword [0x573004], eax
cmp byte [ebx + 0x28], 2
jne 0x404a0d
cmp dword [esi], 0
jne 0x404a0d
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.0040472c
cmp byte [ebx + 0x28], 1
jbe 0x404a1d
cmp dword [esi], 0
je 0x404a3e
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x404a3e
call fcn.004066f8
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 4]
je 0x404a3e
test eax, eax
je 0x404a3e
push eax
call sub.KERNEL32.DLL_OpenMutexA
call fcn.00404704
cmp byte [ebx + 0x28], 1
jne 0x404a4c
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x404a57
call fcn.004048f8
cmp dword [ebx], 0
jne 0x404a73
cmp dword [0x57a028], 0
je 0x404a6b
call dword [0x57a028]
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_LockResource
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x4049fd
Function at 0x4061a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x406334
call sub.KERNEL32.DLL_ReadFile
mov esi, eax
test esi, esi
je 0x406208
push 0x406344
push esi
call sub.KERNEL32.DLL_ReadProcessMemory
mov ebx, eax
test ebx, ebx
je 0x406208
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x406208
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
jmp 0x40632a
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x406248
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x40632a
mov eax, dword [ebp - 4]
add eax, 2
call fcn.0040618c
mov esi, eax
cmp byte [esi], 0
je 0x40632a
lea eax, [esi + 1]
call fcn.0040618c
mov esi, eax
cmp byte [esi], 0
je 0x40632a
jmp 0x40624e
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_SetErrorMode
jmp 0x40630d
lea eax, [esi + 1]
call fcn.0040618c
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x40632a
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_SetErrorMode
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_MultiByteToWideChar
mov esi, eax
cmp esi, 0xffffffff
je 0x40632a
push esi
call sub.KERNEL32.DLL_MulDiv
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetEvent
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x40632a
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_SetErrorMode
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetEvent
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x40626c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406358
Capabilities:
Clear file content
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_RaiseException
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406588
push 0x80000001
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x4063db
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406588
push 0x80000002
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x4063db
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4065a4
push 0x80000001
call sub.user32.dll_UnregisterClassA
test eax, eax
jne 0x406464
xor eax, eax
push ebp
push 0x40645d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004061a0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x406442
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4065c4
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x406442
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406464
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnhookWindowsHookEx
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetErrorMode
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_ResumeThread
push eax
call sub.KERNEL32.DLL_QueryPerformanceFrequency
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40657e
cmp byte [ebp - 0xd], 0
jne 0x4064ab
cmp byte [ebp - 0x12], 0
je 0x40657e
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEvent
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4064c4
dec ebx
cmp byte [ebx], 0x2e
je 0x4064d3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4064c3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40657e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406510
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SetErrorMode
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov esi, eax
test esi, esi
jne 0x40657e
cmp byte [ebp - 0xd], 0
je 0x40657e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetErrorMode
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov esi, eax
test esi, esi
jne 0x40657e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetErrorMode
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret