joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e65f
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x48b068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x58]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.0043c400
mov dword [ebp - 0x58], ebx
add esp, 0xc
xor ebx, ebx
inc ebx
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x44], ebx
jb 0x41e699
mov edi, dword [edi]
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x41e6b0
xor al, al
jmp 0x41e6ee
mov eax, dword [ebp - 0x4c]
push 3
pop ecx
sub eax, ecx
je 0x41e6c7
sub eax, 1
je 0x41e6c3
mov dword [esi], ebx
jmp 0x41e6cd
mov dword [esi], ecx
jmp 0x41e6cd
mov dword [esi], 2
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x48]
call fcn.00417138
push eax
lea ecx, [esi + 4]
call fcn.00409fe1
lea ecx, [ebp - 0x1c]
call fcn.00406b80
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439e76
leave
ret

Function at 0x4241e5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0043c400
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
sete al
leave
ret

Function at 0x424980
Capabilities:
Get common file path

Disassembly:
push 0x2c
mov eax, 0x462d9d
call fcn.0043a790
mov esi, ecx
mov dword [ebp - 0x38], esi
push ecx
push 0x104
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], esi
call fcn.004115a2
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [ebp - 0x34]
mov edx, eax
mov eax, dword [ebp - 0x30]
sub eax, ecx
cmp edx, eax
jbe 0x4249e3
lea eax, [ebp - 0x34]
push eax
push edx
mov ecx, eax
call fcn.004171ae
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004069c2
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00425ed2
lea ecx, [ebp - 0x28]
call fcn.00406b80
lea ecx, [ebp - 0x34]
call fcn.004115dc
mov eax, esi
call fcn.0043a73a
ret

Function at 0x425c7e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 0x10
jb 0x425c86
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
ret

Function at 0x425c94
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 0x10
jb 0x425c9c
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x425caf
test al, 0x10
je 0x425caf
mov al, 1
ret
xor al, al
ret
Function at 0x426f3b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0xac
push 0xffffffffffffffff
push 0x46358e
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x48b068]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp + 0xb4]
lea ecx, [ebp + 0x78]
mov edi, dword [ebp + 0xb8]
mov eax, dword [ebp + 0xbc]
mov dword [ebp - 0x20], esi
push edi
mov dword [ebp - 0x20], eax
call fcn.00426659
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x88], eax
je 0x426fd8
push eax
lea eax, [ebp + 0x78]
push eax
push ebx
lea ecx, [ebp + 0x3c]
call fcn.004268c6
push dword [ebp - 0x20]
lea ecx, [ebp + 0x90]
mov byte [ebp - 4], 1
push ecx
push esi
mov ecx, eax
call fcn.00426f3b
lea ecx, [ebp + 0x3c]
call fcn.0042695e
jmp 0x427050
mov ecx, eax
mov dword [ebp - 0x10], eax
mov edx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov byte [ebp - 4], 2
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp ecx, edx
cmove ecx, eax
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x427001
mov eax, dword [edi]
lea edx, [ebp - 0x1c]
push edx
push ecx
push dword [ebp - 0x20]
push 0
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
cmp ebx, 0xea
je 0x42708a
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
jne 0x4270a7
test ebx, ebx
jne 0x4270ab
test ecx, ecx
jne 0x42708d
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, eax
call fcn.00414ee1
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00414eb4
lea ecx, [ebp - 0x18]
call fcn.004115dc
lea ecx, [ebp + 0x90]
call fcn.00406b80
lea ecx, [ebp + 0x78]
call fcn.00406b80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa8]
xor ecx, ebp
call fcn.00439e76
add ebp, 0xac
leave
ret 0xc
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, eax
call fcn.00414ee1
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x24]
jmp 0x426fe9
test ebx, ebx
je 0x427031
push str.query_value
lea ecx, [ebp + 0x60]
call fcn.004069c2
lea ecx, [ebp]
call fcn.0040a00a
mov ecx, dword [ebp - 0x24]
push eax
push edi
lea eax, [ebp + 0x60]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp + 0x48]
push eax
call fcn.004279b8
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 5
call fcn.00417432
push str.System_error
push ebx
mov byte [ebp - 4], 6
lea eax, [ebp - 0xd4]
push dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x30]
push eax
call fcn.0042b099
mov edx, eax
push 0x12b
push str.Registry::getValue
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u361_3183_install_src_windows_common_Registry.cpp
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.00404614
push eax
lea ecx, [ebp + 0x18]
call fcn.0041ec53
lea eax, [ebp + 0x18]
mov dword [esp], 0x4891cc
push eax
call fcn.0043db4d
int3
Function at 0x42a29b
Capabilities:
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x463f08
call fcn.0043a75c
mov edi, ecx
push str.Global_MSIExecute
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
mov byte [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x42a34d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x42a346
cmp dword [0x48e67c], 1
jg 0x42a346
push ecx
push ecx
lea ecx, [ebp - 0xb0]
call fcn.0040a894
mov edx, str.finish_waiting_for_mutex:
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb0]
call fcn.0040c4f1
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb0]
call fcn.0040f181
lea eax, [ebp - 0xb0]
mov ecx, 0x48e67c
push eax
push str.msi::waitForInstallationCompletion
push 0x1c8
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u361_3183_install_src_windows_common_MsiUtils.cpp
push 1
call fcn.004089d8
lea ecx, [ebp - 0xb0]
call fcn.0040898c
mov eax, dword [ebp - 0x10]
cmp eax, 0x102
je 0x42a34f
mov bl, 1
push esi
mov dword [ebp - 4], 3
call fcn.0042acda
pop ecx
mov al, bl
call fcn.0043a725
ret

Function at 0x42e26f
Capabilities:
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x464c33
call fcn.0043a75c
mov eax, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
push ecx
mov edx, 0x47b918
mov ecx, eax
call fcn.00431001
mov esi, eax
mov ecx, esi
call fcn.0042f3be
pop ecx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 1
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push 0x100001
mov ecx, eax
call fcn.004171ae
push esi
mov ebx, 0x100000
push ebx
push 1
push dword [ebp - 0x28]
call fcn.004445c2
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp eax, ebx
ja 0x42e34a
push esi
call fcn.0044a48d
pop ecx
test eax, eax
je 0x42e2ef
push 0x133
jmp 0x42e34f
push esi
call fcn.0044a461
pop ecx
test eax, eax
jne 0x42e301
push 0x13b
jmp 0x42e34f
mov ebx, dword [ebp - 0x28]
mov ecx, ebx
mov edx, dword [ebp - 0x10]
call fcn.0042e23b
mov ecx, dword [ebp - 0x10]
and dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea eax, [ebx + ecx]
cmp ebx, eax
je 0x42e32f
push ecx
push ebx
mov ecx, edi
call fcn.00406baa
lea ecx, [ebp - 0x28]
call fcn.004115dc
test esi, esi
je 0x42e342
push esi
call fcn.004439bd
pop ecx
mov eax, edi
call fcn.0043a725
ret
push 0xc8
lea ecx, [ebp - 0x38]
call fcn.0040d16b
push 0x488e78
lea eax, [ebp - 0x38]
push eax
call fcn.0043db4d
int3
Function at 0x4316a9
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x23c]
sub esp, 0x23c
push 0xffffffffffffffff
push 0x465413
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x48b068]
xor eax, ebp
mov dword [ebp + 0x238], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [ebp + 0x30]
mov dword [ebp - 0x10], edi
push eax
xor ebx, ebx
push ebx
push ebx
push 0x2c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x431783
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp]
call fcn.00417812
mov esi, eax
mov dword [ebp - 4], ebx
mov ebx, str.OracleJavajava.settings.cfg
push ebx
call fcn.004431e8
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.004178a6
xor ecx, ecx
mov byte [ebp - 0x10], cl
push dword [ebp - 0x10]
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x2c], ecx
lea ecx, [ebp + 0x18]
push eax
call fcn.0041612e
lea edx, [ebp + 0x18]
mov byte [ebp - 4], 1
mov ecx, edi
call fcn.00430de9
lea ecx, [ebp + 0x18]
call fcn.0040b2ef
lea ecx, [ebp]
call fcn.0040b2ef
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.00439e76
add ebp, 0x23c
leave
ret
push 0xc8
lea ecx, [ebp - 0x20]
call fcn.0040d16b
push 0x488e78
lea eax, [ebp - 0x20]
push eax
call fcn.0043db4d
int3

Function at 0x4341db
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebx, ecx
push edi
mov edi, dword [esp + 0x24]
mov ebp, SysReAllocString
test edi, edi
jl 0x43425e
jg 0x434207
test esi, esi
je 0x43425e
test edi, edi
jg 0x434207
jl 0x434203
cmp esi, ebp
jae 0x434207
mov eax, esi
jmp 0x434209
mov eax, ebp
and dword [esp + 0x20], 0
cmp dword [esp + 0x18], 0xffffffff
je 0x43424f
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
push ebx
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x434239
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x434259
jmp 0x43424f
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x43424a
add ebx, eax
cdq
sub esi, eax
sbb edi, edx
jmp 0x4341ef
cmp eax, 0xffffffff
jne 0x434259
call fcn.004422c4
cmp dword [eax], 4
je 0x4341ef
or eax, 0xffffffff
jmp 0x434260
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x402306
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 8], 0
je 0x402326
mov eax, dword [ebp + 8]
mov byte [eax], 0
test ebx, ebx
je 0x40232f
cmp byte [ebx], 0
jne 0x402336
xor eax, eax
jmp 0x4023b6
xor esi, esi
jmp 0x402379
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
inc ebx
cmp ecx, 0x3d
jne 0x402360
cmp dword [ebp - 4], 0
je 0x402360
test esi, esi
jne 0x402360
cmp dword [ebp + 8], 0
je 0x40235c
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov esi, edx
jmp 0x402379
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x40236e
cmp ecx, 0xa
jne 0x402376
cmp ecx, 0xd
jne 0x40237e
inc ebx
jmp 0x40237e
mov byte [edx], al
inc edx
cmp byte [ebx], 0
jne 0x40233a
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x4023b4
mov eax, dword [ebp - 4]
test esi, esi
mov byte [eax], 0
je 0x4023b4
push 0x1000
lea edx, [ebp - 0x1004]
push edx
push esi
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
lea edx, [ebp - 0x1004]
mov eax, dword [ebp - 4]
call fcn.00406b54
mov byte [esi], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x402606
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffffbe0
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
cmp byte [0x40c045], 0
jne 0x40268f
mov eax, esp
call fcn.004056f8
mov ecx, 6
mov edx, dword [str.RarSFX]
call fcn.00406c00
test eax, eax
jne 0x40268f
push 0x40c1f4
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.00406ad4
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x400]
mov ecx, 0x1e
xor edx, edx
call fcn.00406a78
mov dword [esp + 0x404], 3
mov word [esp + 0x410], 0x14
mov eax, esp
mov dword [esp + 0x408], eax
lea edx, [esp + 0x400]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x420
ret

Function at 0x4027c9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffff7f4
mov ebx, eax
cmp byte [0x40c05d], 0
je 0x402842
lea edx, [esp + 0xc]
mov eax, ebx
call fcn.00402719
push esp
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x402842
mov dword [esp + 4], 0x400
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x410]
push eax
lea edx, [esp + 0x10]
push edx
push 0
lea ecx, [esp + 0x1c]
push ecx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x40283a
lea edx, [esp + 0x40c]
mov eax, ebx
call fcn.00406b54
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x80c
pop ebx
ret

Function at 0x402936
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret
Function at 0x402ba4
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push esi
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x40372c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov dword [0x40ccac], 1
mov ebx, dword [0x40cc94]
test ebx, ebx
je 0x403754
mov eax, 0x7d
call fcn.00402874
push eax
push 1
push ebx
call sub.USER32.DLL_SetDlgItemTextA
xor edx, edx
mov dword [0x40ccb0], edx
mov dword [0x40ccb4], 1
mov eax, dword [0x40cc94]
test eax, eax
je 0x4037ad
push 1
push eax
call sub.USER32.DLL_ShowWindow
cmp dword [0x40c054], 0
jne 0x4037a4
cmp byte [0x40c019], 0
jne 0x4037a4
push 0
push 1
push 0x111
push dword [0x40cc94]
call sub.USER32.DLL_SendMessageA
jmp 0x4037a4
call fcn.004028f0
cmp dword [0x40cc9c], 2
jne 0x40379f
cmp byte [0x40c044], 0
je 0x4037bb
call fcn.00402606
pop ebx
ret

Function at 0x403f94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00403cf8
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00403cad
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x403fd6
invalid
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00403ce8
add dh, byte [eax - 0x10]
je 0x403fb8
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x405870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
invalid
test dword [edx - 8], edi
invalid
invalid
Function at 0x405d64
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
je 0x405cd9
jmp 0x405d8e
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x405d32
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x405d37
jmp 0x40568a
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x405d7e
lea eax, [ebp - 0x714]
push eax
call fcn.00403cf8
call [ecx + 0x50]
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00403cad
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x405d89
jmp 0x405d8e
jmp 0x40568a
cmp dword [ebp - 0x37c], 0
jne 0x405e38
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
test dword [esp + edi*8 - 1], esi
dec dword [ecx - 0x7e77b]
inc dword [ebx - 0x7df5b]
inc dword [eax]
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00403ec4
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x405e24
lea eax, [ebp - 0x714]
push eax
call fcn.00403cf8
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.00403d8d
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409440
Capabilities:
Set file attributes

Disassembly:
mov edx, 0x40c7a2
mov eax, 0x41b23c
call fcn.0040695c
mov dword [0x41b224], eax
test eax, eax
jne 0x409491
push 0
push 0x41b23c
call sub.KERNEL32.DLL_SetFileAttributesA
mov edx, 0x40c7a2
mov eax, 0x41b23c
call fcn.0040695c
mov dword [0x41b224], eax
test eax, eax
jne 0x409491
mov eax, 0x40ccb8
mov edx, 9
call fcn.0040666c
push 0x41b23c
mov eax, 0x6e
call fcn.00402874
push eax
call fcn.00402e2c
add esp, 8
mov eax, 1
ret
xor eax, eax
ret
Function at 0x409620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
cmp dword [0x40eb00], 0
jg 0x40963e
dec dword [0x40eb00]
xor eax, eax
mov dword [0x41b138], eax
or eax, 0xffffffff
pop esi
pop ebx
ret
cmp dword [0x41b138], 0
jg 0x409693
push dword [0x41b154]
mov ecx, 0x2000
mov edx, 1
mov eax, dword [0x41b130]
call fcn.00406a08
mov dword [0x41b138], eax
test eax, eax
jne 0x409678
xor edx, edx
or eax, 0xffffffff
mov dword [0x41b138], edx
pop esi
pop ebx
ret
add dword [0x41b15c], 0x2000
mov edx, dword [0x41b130]
mov dword [0x41b134], edx
call fcn.004094e4
mov ecx, dword [0x40f124]
test byte [ecx + 0x14], 1
je 0x4096ca
mov esi, dword [0x41b138]
mov ebx, dword [0x41b134]
jmp 0x4096c1
call fcn.0040a890
xor byte [ebx], al
mov al, byte [ebx]
and eax, 0xff
call fcn.0040a8b4
inc ebx
mov edx, esi
add esi, 0xffffffff
test edx, edx
jne 0x4096ad
dec dword [0x41b138]
mov ecx, dword [0x41b134]
inc dword [0x41b134]
xor eax, eax
mov al, byte [ecx]
pop esi
pop ebx
ret

Function at 0x40a8b4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x41b348]
push ebx
mov ecx, edx
mov ebx, dword [0x41b128]
xor ecx, eax
and ecx, 0xff
shr edx, 8
mov ecx, dword [ebx + ecx*4]
xor ecx, edx
mov dword [0x41b348], ecx
and ecx, 0xff
add dword [0x41b34c], ecx
imul edx, dword [0x41b34c], 0x8088405
inc edx
mov dword [0x41b34c], edx
shr edx, 0x18
mov ecx, dword [0x41b350]
xor edx, ecx
mov ebx, dword [0x41b128]
and edx, 0xff
shr ecx, 8
mov edx, dword [ebx + edx*4]
xor edx, ecx
mov dword [0x41b350], edx
pop ebx
ret

Function at 0x40aafc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
jne 0x40ab10
xor eax, eax
jmp 0x40ac08
call fcn.0040aaf4
xor ebx, 0xffffffff
cmp edi, 8
jb 0x40abe5
xor edx, edx
sub edi, 8
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x40ab21
test edi, edi
je 0x40ac03
xor edx, edx
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
dec edi
mov ebx, ecx
jne 0x40abe9
mov eax, ebx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
Function at 0x44b610
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov al, byte [0x66004e]
mov cl, byte [0x660043]
xor cl, al
mov byte [0x660043], cl
mov cl, byte [0x660041]
or cl, 0xc
shr cl, 2
and ecx, 0xff
mov dword [esp], ecx
fild dword [esp]
fdivr qword [0x6639b0]
fadd qword [0x663950]
fstp qword [0x6639b0]
call dword [sym.imp.USER32.dll_GetDialogBaseUnits]
mov dl, byte [0x660042]
mov al, byte [0x660049]
mov ecx, dword [0x660030]
xor al, dl
mov byte [0x660049], al
mov eax, dword [0x660034]
mov edx, dword [str.0rxY_]
and eax, 4
add ecx, eax
and edx, 0xff
mov dword [0x660030], ecx
mov ecx, dword [0x66003c]
and ecx, 0xc
mov eax, dword [esp + 8]
imul ecx, edx
mov edx, dword [0x660038]
push eax
xor edx, ecx
mov dword [0x660038], edx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [0x663bb4], eax
mov eax, dword [0x663bb0]
test eax, eax
jne 0x44b6fd
mov ecx, dword [0x663a9c]
push ecx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0xa3
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jne 0x44b6ed
mov eax, dword [esp + 8]
mov ecx, dword [0x663bb4]
cmp eax, ecx
je 0x44b6ed
mov dword [0x663bb4], eax
xor eax, eax
mov dword [0x663bb0], 1
pop ecx
ret 4
mov eax, dword [esp + 8]
pop ecx
ret 4
Function at 0x5d9418
Capabilities:
Encode data using xor

Disassembly:
cwde
or dh, al
fidivr dword [esi + 0x49]
loop 0x5d946c
shl dword [esi + 0x72fc5d65], 0x3d
dec ecx
out dx, al
hlt
invalid
and dh, byte [0x59f8faf1]
mov al, byte [0x504ca005]
pop es
rol byte [eax - 0xa4d0310], cl
loope 0x5d9437
invalid