joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4722f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x472323
push esi
call fcn.00475400
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x47231c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4723a9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x472392
mov eax, dword [esi + 8]
test eax, eax
je 0x472347
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x47238e
cmp eax, 2
je 0x472392
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x47233a
cmp eax, 3
je 0x47236d
cmp eax, 1
jne 0x47233a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x47233a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x47233a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004723d0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4723b8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004723d0
add esp, 4
pop esi
ret

Function at 0x49aa39
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49aa71
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00498ac3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00498a9b
jmp 0x49aa7d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49c12b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49c16d
call fcn.004a1e17
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49c16d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49c164
xor eax, eax
jmp 0x49c175
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049c17b
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a2347
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a2375
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a2393
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a22ad
jmp 0x4a2393
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a2393
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a22ad
test edi, edi
mov eax, edi
jne 0x4a237d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403351
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x40337e
mov ecx, dword [0x44ba98]
push edi
add eax, ecx
push edi
push eax
mov dword [0x4213cc], eax
push dword [0x40a594]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.0040347c
cmp eax, edi
jl 0x403475
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x40a594]
call ebx
test eax, eax
je 0x403472
cmp dword [ebp - 4], esi
jne 0x403472
push dword [ebp + 8]
add dword [0x4213cc], esi
call fcn.0040347c
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x403475
cmp dword [ebp + 0x10], edi
jne 0x403441
cmp dword [ebp + 8], edi
jle 0x40346d
mov esi, 0x41d388
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x4033f1
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x40a594]
call ebx
test eax, eax
je 0x403472
cmp edi, dword [ebp - 4]
jne 0x403472
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40343d
cmp dword [ebp + 0x14], edi
jne 0x40343d
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x4213cc], eax
cmp dword [ebp + 8], 0
jg 0x4033e4
jmp 0x40346d
push 0xfffffffffffffffe
jmp 0x403474
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40344c
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a594]
call ebx
test eax, eax
je 0x403472
mov eax, dword [ebp - 4]
add dword [0x4213cc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403475
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40347c
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x4213cc]
mov edi, eax
sub esi, dword [0x4152fc]
add edi, 0x1f4
add esi, dword [esp + 0x1c]
cmp esi, ebp
jle 0x40364c
push dword [0x4293d8]
call fcn.0040368e
push ebp
push ebp
push dword [0x4152fc]
push dword [0x40a594]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x4293d4], esi
mov dword [0x4213c8], ebp
mov eax, dword [0x4213d0]
mov ebx, 0x4000
sub eax, dword [0x4293d8]
cmp eax, ebx
jg 0x4034ef
mov ebx, eax
mov esi, 0x41d388
push ebx
push esi
call fcn.0040365c
test eax, eax
je 0x40360d
add dword [0x4293d8], ebx
mov dword [0x415318], esi
mov dword [0x41531c], ebx
cmp dword [0x44ba48], ebp
je 0x403580
cmp dword [0x44bae0], ebp
jne 0x403580
cmp dword [esp + 0x10], ebp
je 0x40354d
mov eax, dword [0x4293d4]
push ebp
sub eax, dword [0x4213cc]
sub eax, dword [esp + 0x20]
add eax, dword [0x4152fc]
mov dword [0x4213c8], eax
call fcn.004064f7
jmp 0x403580
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jbe 0x403580
mov eax, dword [0x44ba44]
neg eax
sbb eax, eax
not eax
and eax, str.unpacking_data:__d__
push eax
push 0x402fa9
push ebp
push 0x6f
push dword [0x44ba40]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
mov ecx, 0x415300
mov dword [0x415320], 0x415388
mov dword [0x415324], 0x8000
call fcn.004065cc
test eax, eax
jl 0x403657
mov esi, dword [0x415320]
mov eax, 0x415388
sub esi, eax
je 0x4035e7
lea ecx, [esp + 0x14]
push ebp
push ecx
push esi
push eax
push dword [0x40a594]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403612
cmp esi, dword [esp + 0x14]
jne 0x403612
add dword [0x4152fc], esi
cmp dword [0x41531c], ebp
jne 0x403515
jmp 0x4035f3
cmp dword [0x41531c], ebp
jne 0x403657
cmp ebx, ebp
je 0x403657
mov eax, dword [0x4213cc]
mov ecx, eax
sub ecx, dword [0x4152fc]
add ecx, dword [esp + 0x1c]
test ecx, ecx
jle 0x403616
jmp 0x4034d9
or eax, 0xffffffff
jmp 0x40364e
push 0xfffffffffffffffe
jmp 0x403659
push ebp
push ebp
push eax
push dword [0x40a594]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x10]
cmp esi, ebp
je 0x40364c
mov eax, dword [0x4293d4]
push ebp
push ebp
push 0x113
push esi
mov dword [0x4213c8], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
push 0xfffffffffffffffd
pop eax
jmp 0x40364e
Function at 0x403d64
Capabilities:
Identify system language via api

Disassembly:
push ecx
cmp byte [0x47c000], 0
push ebx
push ebp
push esi
push edi
mov ebx, pe_overlay
mov ebp, 0x47c000
je 0x403d84
push ebp
call fcn.00406043
jmp 0x403d8a
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [esp + 0x10], eax
xor esi, esi
mov edi, dword [0x44ba84]
mov eax, edi
dec edi
test eax, eax
je 0x403de6
mov eax, dword [0x44ba48]
mov ecx, dword [eax + 0x64]
mov edx, ecx
imul ecx, edi
neg edx
add ecx, dword [0x44ba80]
mov ax, word [esp + 0x10]
mov esi, ecx
xor ax, word [ecx]
and eax, ebx
test ax, ax
je 0x403dce
mov eax, edi
dec edi
add ecx, edx
test eax, eax
jne 0x403db2
jmp 0x403de6
mov eax, dword [esi + 2]
mov dword [0x447a20], eax
mov eax, dword [esi + 6]
mov dword [0x44bae8], eax
lea eax, [esi + 0xa]
mov dword [0x447a1c], eax
cmp dword [0x447a1c], 0
jne 0x403e01
cmp bx, 0xffff
jne 0x403dfd
mov ebx, 0x3ff
jmp 0x403d90
xor ebx, ebx
jmp 0x403d90
movzx eax, word [esi]
push eax
push ebp
call fcn.0040602a
push 0xfffffffffffffffe
push 0x447a40
call fcn.004060fc
push eax
push dword [0x4353ec]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x44ba6c]
mov esi, dword [0x44ba68]
mov ecx, eax
dec eax
test ecx, ecx
je 0x403e55
lea ebx, [esi + 0x18]
lea ebp, [eax + 1]
mov edi, 0x2018
mov eax, dword [esi]
test eax, eax
je 0x403e4e
push eax
push ebx
call fcn.004060fc
add esi, edi
add ebx, edi
dec ebp
jne 0x403e41
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4058fd
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x43ac18], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x405921
test al, 0x10
jne 0x405924
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x43ac18
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40594f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x4059cf
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00405cb4
test byte [ebp + 0xc], 8
mov dword [ebp - 4], eax
je 0x405a03
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x44bac8], eax
jmp 0x405bcc
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp + 8], ebx
je 0x405a21
test eax, eax
je 0x405b50
test byte [ebp + 0xc], 2
je 0x405b50
mov esi, 0x436418
push edi
push esi
call fcn.004060cd
test ebx, ebx
je 0x405a3e
push str..
push esi
call fcn.004060eb
jmp 0x405a44
push edi
call fcn.00405c19
push 0x40a228
push edi
call fcn.004060eb
push edi
call fcn.004060de
mov ebx, eax
lea eax, [ebp - 0x144]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405b46
cmp byte [ebp - 0x118], 0x2e
jne 0x405a95
cmp byte [ebp - 0x117], 0x2e
je 0x405b29
cmp byte [ebp - 0x117], 0
je 0x405b29
lea eax, [ebp - 0x118]
push eax
push ebx
call fcn.004060cd
test byte [ebp - 0x144], 0x10
je 0x405ac0
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405b29
push dword [ebp + 0xc]
push edi
call fcn.004059cf
jmp 0x405b29
push edi
push str.Delete:_DeleteFile___s__
call fcn.00406473
mov eax, dword [ebp - 0x144]
pop ecx
pop ecx
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405b21
test byte [ebp + 0xc], 4
push edi
je 0x405b0d
push str.Delete:_DeleteFile_on_Reboot___s__
call fcn.00406473
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.004053d9
push 0
push edi
call fcn.00405e16
jmp 0x405b29
push str.Delete:_DeleteFile_failed___s__
call fcn.00406473
inc dword [0x44bac8]
pop ecx
pop ecx
jmp 0x405b29
push edi
push 0xfffffffffffffff2
call fcn.004053d9
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405a72
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405b50
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp + 8], esi
je 0x405bcc
cmp dword [ebp - 4], esi
push edi
jne 0x405b72
push str.RMDir:_RemoveDirectory_invalid_input___s__
call fcn.00406473
inc dword [0x44bac8]
pop ecx
pop ecx
jmp 0x405bcc
call fcn.0040648f
test eax, eax
je 0x405bcc
push edi
call fcn.00405bd2
push edi
push str.RMDir:_RemoveDirectory___s__
call fcn.00406473
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405bc4
test byte [ebp + 0xc], 4
push edi
je 0x405bbd
push str.RMDir:_RemoveDirectory_on_Reboot___s__
call fcn.00406473
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.004053d9
push esi
push edi
call fcn.00405e16
jmp 0x405bcc
push str.RMDir:_RemoveDirectory_failed___s__
jmp 0x405b63
push edi
push 0xffffffffffffffe5
call fcn.004053d9
pop edi
pop esi
leave
ret 8
Function at 0x405cb4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x438418
push esi
call fcn.004060cd
push esi
call fcn.00405c65
mov edi, eax
test edi, edi
jne 0x405cd5
xor eax, eax
jmp 0x405d27
push edi
call fcn.0040633d
test byte [0x44ba50], 0x80
je 0x405cee
mov al, byte [edi]
test al, al
je 0x405cd1
cmp al, 0x5c
je 0x405cd1
sub edi, esi
push esi
call fcn.004060de
cmp eax, edi
push esi
jle 0x405d11
call fcn.0040648f
test eax, eax
je 0x405d09
test byte [eax], 0x10
je 0x405cd1
push esi
call fcn.00405c19
jmp 0x405cf0
call fcn.00405bd2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405d9e
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405dcd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405e12
mov eax, edi
dec edi
test eax, eax
jne 0x405dd8
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405e0c
Function at 0x405e16
Capabilities:
Get common file path
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.004064cd
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405e42
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405f86
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x43ada0], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x43ada0
je 0x405e86
push 1
push 0
push esi
call fcn.00405d9e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405f8c
cmp eax, edi
jg 0x405f8c
mov esi, 0x43a818
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405f8c
cmp eax, edi
jg 0x405f8c
push esi
push ebp
push str._s_s_r_n
push 0x43a418
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call fcn.004060eb
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405f86
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x405f6e
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x405f62
push str._Rename__r_n
push edi
call fcn.00405d2c
test eax, eax
jne 0x405f93
lea eax, [edi + esi]
push str._Rename__r_n
push eax
call fcn.004060cd
add esi, 0xa
mov eax, esi
push ebp
add eax, edi
push 0x43a418
push eax
call fcn.00405d78
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x44bad0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40a9d8
push eax
call fcn.00405d2c
test eax, eax
je 0x405f49
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x405fbc
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x405faf
sub eax, edi
jmp 0x405f4b
Function at 0x405fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406024
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x2000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406013
cmp dword [ebp + 0x14], 1
je 0x406015
cmp dword [ebp + 0x14], 2
je 0x406015
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4063d6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x4063fb
mov eax, dword [0x40a8d4]
cmp eax, 0xffffffff
je 0x4063f2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8d4], 0xffffffff
jmp 0x40646e
cmp dword [0x43b9a0], ebx
je 0x40646e
cmp byte [0x43b5a0], bl
je 0x40643a
cmp dword [0x40a8d4], 0xffffffff
jne 0x406443
push 4
push 0x40000000
push 0x43b5a0
call fcn.00405d9e
cmp eax, 0xffffffff
mov dword [0x40a8d4], eax
je 0x40646e
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8d4], 0xffffffff
je 0x40646e
push esi
mov esi, 0x43f9e0
push 0x40aaa8
push esi
call fcn.004060eb
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.004060de
push eax
push esi
push dword [0x40a8d4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x406534
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x43b1a4], esi
push edi
jne 0x40656e
mov ecx, 0x43b1a0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x40654a
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x43b5a0
jl 0x406545
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x4065a3
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43b1a0]
xor eax, esi
inc ecx
dec edx
jne 0x406586
pop edi
pop esi
not eax
ret 0xc
Function at 0x402980
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4029bd
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4029dd
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404bbc
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402be0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040494c
test esi, esi
jne 0x402c16
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404a3c
jmp 0x402c34
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402af4
mov edi, eax
test esi, esi
je 0x402c34
cmp dword [ebx], 0
je 0x402c34
dec esi
jmp 0x402c1d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403398
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x524008], 0x8088405
inc edx
mov dword [ebx + 0x524008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4033b4
Capabilities:
Read file on windows

Disassembly:
push ebx
xor ecx, ecx
mov ebx, eax
mov cx, word [eax + 4]
sub ecx, 0xd7b1
je 0x4033ca
sub ecx, 2
jne 0x4033ec
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_ReadFile
pop edx
dec eax
jne 0x4033f3
cmp edx, dword [ebx + 8]
je 0x4033fd
mov eax, 0x64
jmp 0x4033f8
mov eax, 0x67
jmp 0x4033f8
call sub.kernel32.dll_GetLastError
call fcn.004028f4
pop ebx
ret

Function at 0x40362c
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
movzx eax, word [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x40365f
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_WriteFile
pop edx
dec eax
jne 0x403666
cmp edx, dword [ebx + 8]
je 0x403670
mov eax, 0x65
jmp 0x40366b
mov eax, 5
jmp 0x40366b
call sub.kernel32.dll_GetLastError
call fcn.004028f4
mov eax, ebx
pop ebx
ret
Function at 0x4039e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x524024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a80
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403a60
xor eax, eax
push ebp
push 0x403a59
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a9c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a60
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x524024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x524024], ax
mov esp, ebp
pop ebp
ret

Function at 0x40474c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x52e04c], 0
je 0x4047ad
cmp word [0x52e220], 0xd7b2
jne 0x404775
cmp dword [0x52e228], 0
jbe 0x404775
mov eax, 0x52e21c
call dword [0x52e238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x524094
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4047d4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x524034], 0
jne 0x4047c9
push 0
push 0x52408c
push 0x524094
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040276c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x52e04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4048c8
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc