joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call sym.ahclient.dll_SearchHelp
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call sym.ahclient.dll_SearchHelp
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call sym.ahclient.dll_SearchHelp
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40611c
pop dword [ebp - 0x24]
mov eax, 0x9809c5a4
add eax, 0x68369b78
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x6a5906fe
sub dword [ebp - 0x34], 0x1c06c1b3
mov dword [ebp - 0x30], 0x44302a80
add dword [ebp - 0x30], 0xee0321c5
mov dword [ebp - 0x2c], 0xc98d34b9
add dword [ebp - 0x2c], 0x82bf0f75
mov dword [ebp - 0x28], 0xa8f62026
add dword [ebp - 0x28], 0x5709dfda
lea eax, [ebp - 0x34]
push eax
mov eax, 0xad1a63a0
sub eax, 0xacd9f340
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x9320e56f
add dword [ebp - 0x34], 0xe15183e7
mov dword [ebp - 0x30], 0x8f51b912
sub dword [ebp - 0x30], 0x4de5579d
mov dword [ebp - 0x2c], 0x7304d7ea
add dword [ebp - 0x2c], 0xf06a9482
mov dword [ebp - 0x28], 0x7d12bcab
sub dword [ebp - 0x28], 0x7d12bcab
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xffac941f
add eax, 0x93dce1
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x36c3b
push 0
call eax
mov ecx, 0xaf37cb31
sub ecx, 0xaf378291
xor edi, edi
add edi, eax
mov ebx, 0x1ab6543e
add ebx, 0xe58aabc2
add ebx, dword [ebp - 0x24]
mov esi, 0x73a7ac3f
sub dword [ebp - 8], 0xff91bd8b
mov edx, dword [ebx]
add edx, esi
xor dword [ebp - 0x1c], 0x5179164f
mov dword [edi], edx
xor dword [ebp - 0x18], 0xde94149a
add edi, 0x1e344120
sub edi, 0x1e34411c
add ebx, 0x1c214d90
add ebx, 0xe3deb274
loop 0x40623a
add eax, 0xbfd082a6
add eax, 0x403092ad
xor ebx, ebx
add ebx, eax
add eax, 0xd34a01be
add eax, 0x2cb5fe47
mov ecx, 0x5024d162
sub ecx, 0x4fe4d162
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x44112a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x441139
pop dword [ebp - 0x18]
mov eax, 0x87264156
add eax, 0x791dcfe3
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x54962
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x8ecb8be6
sub ecx, 0x8ecb31f5
xor edi, edi
add edi, eax
mov ebx, 0xe0000111
sub ebx, 0xdfb8a311
add ebx, dword [ebp - 0x18]
mov edx, 0x9804b715
add edx, 0x56f1cfe
sub dword [ebp - 4], edx
mov esi, dword [ebx]
sub dword [ebp - 0xc], 0x68fcf0
xor esi, edx
xor dword [ebp - 4], edx
mov dword [edi], esi
add edi, 0x4cac9a42
sub edi, 0x4cac9a3e
add ebx, 0x734d3ec1
sub ebx, 0x734d3ebd
loop 0x441195
add eax, 0xaac3ec45
add eax, 0x553d6e52
mov ebx, eax
add eax, 0x1a41a27f
add eax, 0xe5be5d86
mov ecx, 0xe4fc3e73
sub ecx, 0xe4bc3e73
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x258010a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x258010b6
pop dword [ebp - 0x1c]
mov eax, 0x258010b6
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x633706b4
sub dword [ebp - 0x2c], 0x14e4c169
mov dword [ebp - 0x28], 0x1ab4e69
sub dword [ebp - 0x28], 0xcf780224
mov dword [ebp - 0x24], 0x3a41d4d7
sub dword [ebp - 0x24], 0xedf590a9
mov dword [ebp - 0x20], 0xafdb1b4
add dword [ebp - 0x20], 0xf5024e4c
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x957f73f1
add eax, 0x90025c53
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xc0986ec9
add dword [ebp - 0x2c], 0xb3d9fa8d
mov dword [ebp - 0x28], 0xe16b0add
add dword [ebp - 0x28], 0x60015698
mov dword [ebp - 0x24], 0x1fe2ee13
add dword [ebp - 0x24], 0x438c7e59
mov dword [ebp - 0x20], 0x59608d54
add dword [ebp - 0x20], 0xa69f72ac
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x347ac694
sub eax, 0xef8f614
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3d9d0
push 0
call eax
mov ecx, 0x1287e8b9
add ecx, 0xed786383
xor esi, esi
add esi, eax
mov edx, 0x5e92997c
add edx, 0xc6effc84
add edx, dword [ebp - 0x1c]
mov ebx, 0x9efbbeee
xor dword [ebp - 0x18], eax
mov edi, dword [edx]
add dword [ebp - 0xc], 0xa3358e9c
sub edi, ebx
xor dword [ebp - 0x10], eax
mov dword [esi], edi
sub dword [ebp - 0x18], eax
add esi, 0xef4f124b
add esi, 0x10b0edb9
add edx, 0x21b3ac7
sub edx, 0x21b3ac3
loop 0x258011cf
add eax, 0x123c3
mov ebx, eax
add eax, 0xe1b926ed
sub eax, 0xe1b926e8
mov ecx, 0x25800000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40b252
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40b261
pop dword [ebp - 0x4c]
mov eax, 0x9d285631
sub eax, 0x9ce7a3d0
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x388b7
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x121e9df
add ecx, 0xfede5b05
mov edx, eax
mov esi, 0x413bc4
add esi, dword [ebp - 0x4c]
mov ebx, 0x4dbb52f0
sub dword [ebp - 0x34], edx
mov edi, dword [esi]
add dword [ebp - 0x20], ecx
xor edi, ebx
xor dword [ebp - 0x14], eax
mov dword [edx], edi
add edx, 4
add esi, 0xaad79115
sub esi, 0xaad79111
loop 0x40b2af
add eax, 0xfb44c5be
add eax, 0x4bc40a5
mov ebx, eax
add eax, 5
mov ecx, 0x4694f487
add ecx, 0xb9ab0b79
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401ca4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x401cb3
pop dword [ebp - 0x10]
mov eax, 0xcd956df
sub eax, 0xc993a2c
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x35f51
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x3aea
xor esi, esi
add esi, eax
mov edi, 0x413bc4
add edi, dword [ebp - 0x10]
mov edx, 0x7ae96a18
add dword [ebp - 0xc], 0x2b51311c
mov ebx, dword [edi]
add dword [ebp - 0xc], esi
add ebx, edx
xor dword [ebp - 4], 0xcec38913
mov dword [esi], ebx
add dword [ebp - 0xc], 0xb8ab0ca
add esi, 0xe2a282ad
sub esi, 0xe2a282a9
add edi, 4
loop 0x401cfd
add eax, 0xde5c537e
add eax, 0x21a48afd
mov ebx, eax
add eax, 5
mov ecx, 0x9d52a6c7
sub ecx, 0x9d12a6c7
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399
Function at 0x401b68
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4ab5c0], 0
je 0x401c45
xor edx, edx
push ebp
push 0x401c3e
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x4ab049], 0
je 0x401b9a
push 0x4ab5c8
call sub.KERNEL32.DLL_TlsGetValue
mov byte [0x4ab5c0], 0
mov eax, dword [0x4ab620]
push eax
call sub.KERNEL32.DLL_lstrcpyA
xor eax, eax
mov dword [0x4ab620], eax
mov ebx, dword [0x4ab5e8]
jmp 0x401bcd
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, dword [ebx]
cmp ebx, 0x4ab5e8
jne 0x401bbb
mov eax, 0x4ab5e8
call fcn.00401468
mov eax, 0x4ab5f8
call fcn.00401468
mov eax, 0x4ab624
call fcn.00401468
mov eax, dword [0x4ab5e0]
test eax, eax
je 0x401c13
mov edx, dword [eax]
mov dword [0x4ab5e0], edx
push eax
call sub.KERNEL32.DLL_lstrcpyA
mov eax, dword [0x4ab5e0]
test eax, eax
jne 0x401bfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401c45
cmp byte [0x4ab049], 0
je 0x401c33
push 0x4ab5c8
call sub.KERNEL32.DLL_TlsSetValue
push 0x4ab5c8
call sub.KERNEL32.DLL_Sleep
ret
pop ebx
pop ebp
ret
Function at 0x402190
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4ab5c0], 0
jne 0x4021ad
call fcn.00401aa4
test al, al
je 0x4021b5
cmp ebx, 0x7ffffff8
jle 0x4021bf
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x402313
xor ecx, ecx
push ebp
push 0x40230c
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x4ab049], 0
je 0x4021e0
push 0x4ab5c8
call sub.KERNEL32.DLL_TlsGetValue
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x4021f0
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x40228f
mov eax, ebx
test eax, eax
jns 0x402205
add eax, 3
sar eax, 2
mov edx, dword [0x4ab620]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x40228f
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x402240
mov eax, ebx
test eax, eax
jns 0x40222f
add eax, 3
sar eax, 2
mov ecx, dword [0x4ab620]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x402266
mov ecx, ebx
test ecx, ecx
jns 0x402249
add ecx, 3
sar ecx, 2
mov edi, dword [0x4ab620]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4ab5b0]
sub ebx, 4
add dword [0x4ab5b4], ebx
call fcn.004043e4
jmp 0x402313
cmp ebx, dword [0x4ab618]
jg 0x4022e1
sub dword [0x4ab618], ebx
cmp dword [0x4ab618], 0xc
jge 0x4022b3
add ebx, dword [0x4ab618]
xor eax, eax
mov dword [0x4ab618], eax
mov eax, dword [0x4ab61c]
add dword [0x4ab61c], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4ab5b0]
sub ebx, 4
add dword [0x4ab5b4], ebx
call fcn.004043e4
jmp 0x402313
mov eax, ebx
call fcn.0040209c
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402313
cmp byte [0x4ab049], 0
je 0x40230b
push 0x4ab5c8
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402320
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4ab5c4], eax
cmp byte [0x4ab5c0], 0
jne 0x402358
call fcn.00401aa4
test al, al
jne 0x402358
mov dword [0x4ab5c4], 8
mov dword [ebp - 4], 8
jmp 0x4024b9
xor ecx, ecx
push ebp
push 0x4024b2
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x4ab049], 0
je 0x402379
push 0x4ab5c8
call sub.KERNEL32.DLL_TlsGetValue
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402394
mov dword [0x4ab5c4], 9
jmp 0x402489
dec dword [0x4ab5b0]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4ab5b4], eax
test bl, 1
je 0x4023f4
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x4023c4
test edx, 0x80000003
je 0x4023d3
mov dword [0x4ab5c4], 0xa
jmp 0x402489
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4023eb
mov dword [0x4ab5c4], 0xa
jmp 0x402489
add ebx, edx
mov esi, eax
call fcn.00401c48
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x4ab61c]
jne 0x402434
sub dword [0x4ab61c], ebx
add dword [0x4ab618], ebx
cmp dword [0x4ab618], 0x3c00
jle 0x402425
call fcn.00401f38
xor eax, eax
mov dword [ebp - 4], eax
call fcn.004043e4
jmp 0x4024b9
mov edx, dword [eax]
test dl, 2
je 0x402457
and edx, 0x7ffffffc
cmp edx, 4
jge 0x402452
mov dword [0x4ab5c4], 0xb
jmp 0x402489
or dword [eax], 1
jmp 0x402480
mov eax, edi
cmp dword [eax + 4], 0
je 0x40246a
cmp dword [eax], 0
je 0x40246a
cmp dword [eax + 8], 0xc
jge 0x402476
mov dword [0x4ab5c4], 0xb
jmp 0x402489
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401c48
mov edx, ebx
mov eax, esi
call fcn.00401eb0
mov eax, dword [0x4ab5c4]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4024b9
cmp byte [0x4ab049], 0
je 0x4024b1
push 0x4ab5c8
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x402978
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4029b5
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.KERNEL32.DLL_SetFileAttributesA
push esp
call sub.KERNEL32.DLL_VirtualAllocEx
lea eax, [esp + 4]
push eax
push 0x105
call sub.KERNEL32.DLL_SetFileAttributesA
test bl, bl
je 0x4029d5
lea eax, [esp + 0x109]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404c0c
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402bfc
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffff8
push esp
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x402c14
mov eax, dword [esp]
mov dword [0x4a7008], eax
pop ecx
pop edx
ret
call sub.KERNEL32.DLL_WriteProcessMemory
mov dword [0x4a7008], eax
pop ecx
pop edx
ret
Function at 0x403304
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4a7008], 0x8088405
inc edx
mov dword [ebx + 0x4a7008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403348
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor edx, edx
mov ebx, eax
mov dx, word [eax + 4]
sub edx, 0xd7b0
je 0x403374
cmp edx, 3
ja 0x40340a
call dword [ebx + 0x24]
test eax, eax
je 0x403374
call fcn.004028ec
mov word [ebx + 4], 0xd7b3
mov dword [ebx + 8], esi
mov dword [ebx + 0x24], 0x403320
mov dword [ebx + 0x1c], 0x402d34
cmp byte [ebx + 0x48], 0
je 0x4033f1
mov eax, 0xc0000000
mov dl, byte [0x4a700c]
and edx, 0x70
shr edx, 2
mov edx, dword [edx + 0x4a706c]
mov ecx, 2
sub edi, 3
je 0x4033d3
mov ecx, 3
inc edi
je 0x4033d3
mov eax, 0x40000000
inc edi
mov word [ebx + 4], 0xd7b2
je 0x4033d3
mov eax, 0x80000000
mov word [ebx + 4], 0xd7b1
push 0
push 0x80
push ecx
push 0
push edx
push eax
lea eax, [ebx + 0x48]
push eax
call sub.KERNEL32.DLL_LoadResource
cmp eax, 0xffffffff
je 0x403411
mov dword [ebx], eax
jmp 0x403421
mov dword [ebx + 0x24], 0x402d34
cmp edi, 3
je 0x403401
push 0xfffffffffffffff6
jmp 0x403403
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_MapViewOfFile
jmp 0x4033e8
mov eax, 0x66
jmp 0x40341c
mov word [ebx + 4], 0xd7b0
call sub.KERNEL32.DLL_SetFilePointer
call fcn.004028ec
pop edi
pop esi
pop ebx
ret

Function at 0x40479c
Capabilities:
Read file on windows

Disassembly:
push ecx
cmp byte [0x4ab048], 0
je 0x4047fd
cmp word [0x4ab21c], 0xd7b2
jne 0x4047c5
cmp dword [0x4ab224], 0
jbe 0x4047c5
mov eax, 0x4ab218
call dword [0x4ab234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4a7094
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_MapViewOfFile
push eax
call sub.KERNEL32.DLL_ReadFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404824
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_MapViewOfFile
push eax
call sub.KERNEL32.DLL_ReadFile
pop edx
ret
cmp byte [0x4a7034], 0
jne 0x404819
push 0
push 0x4a708c
push 0x4a7094
push 0
call sub.user32.dll_keybd_event
pop edx
ret
Function at 0x405e44
Capabilities:
Clear file content
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x405fd8
call sub.KERNEL32.DLL_SetThreadContext
mov esi, eax
test esi, esi
je 0x405eac
push 0x405fe8
push esi
call sub.KERNEL32.DLL_SetThreadLocale
mov ebx, eax
test ebx, ebx
je 0x405eac
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x405eac
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x405fce
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x405eec
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x405fce
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00405e30
mov esi, eax
cmp byte [esi], 0
je 0x405fce
lea eax, [esi + 1]
call fcn.00405e30
mov esi, eax
cmp byte [esi], 0
je 0x405fce
jmp 0x405ef2
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x405fb1
lea eax, [esi + 1]
call fcn.00405e30
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x405fce
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_TerminateProcess
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov esi, eax
cmp esi, 0xffffffff
je 0x405fce
push esi
call sub.KERNEL32.DLL_ResumeThread
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x405fce
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_TerminateProcess
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x405f10
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret