joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443390
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4a7cb8], 0
push esi
push edi
mov esi, 0x4a72e8
jne 0x4433b0
push 0
call fcn.00414cef
push eax
call fcn.004353b4
add esp, 8
mov dword [0x49223c], 0x270
mov dword [0x4a72e4], esi
mov edx, 0xe3
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi + 0x634]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x4433c5
mov edx, 0x18c
mov edi, edi
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi - 0x38c]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x443400
mov ecx, dword [0x4a72e8]
mov dl, cl
and dl, 1
movzx eax, dl
mov edx, dword [esi]
neg eax
sbb eax, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, dword [esi]
and eax, 0x9908b0df
shr edx, 1
xor edx, dword [esi - 0x38c]
pop edi
xor edx, eax
mov dword [esi], edx
pop esi
ret

Function at 0x44419b
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x24]
xor esi, esi
mov byte [0x497296], 0
test edi, edi
je 0x4441e2
mov byte [0x497297], 1
call dword [fcn.00482160]
mov dword [esp + 8], eax
lea eax, [esp + 0x24]
push eax
push esi
lea ecx, [esp + 0x10]
push ecx
push 0x444078
push esi
push esi
mov dword [esp + 0x24], edi
call fcn.0041415e
add esp, 0x18
mov esi, eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
call dword [fcn.00482680]
mov edi, eax
test esi, esi
je 0x444219
push 0xffffffffffffffff
push esi
mov byte [0x497297], 0
call dword [fcn.004822f8]
push esi
call dword [fcn.00482308]
cmp byte [0x497296], 1
jne 0x44422b
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, edi
pop edi
pop esi
add esp, 8
ret

Function at 0x445051
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
lea ecx, [eax + 4]
push edi
mov edi, dword [eax + edx]
mov dword [esi], ecx
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov ebx, eax
mov eax, dword [esi]
add eax, dword [esp + 0x18]
lea ebp, [edi + edi]
push ebp
push eax
push ebx
call fcn.00410f70
add dword [esi], ebp
xor ecx, ecx
add esp, 0x10
xor eax, eax
mov word [ebx + ebp], cx
test edi, edi
jle 0x4450ad
xor word [ebx + eax*2], di
inc eax
cmp eax, edi
jl 0x4450a4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 8
Function at 0x457c08
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.0040c060
xor esi, esi
push 0x3c
lea eax, [esp + 0x28]
push esi
push eax
xor ebx, ebx
mov dword [esp + 0x78], esi
mov dword [esp + 0x1c], 1
call fcn.004131f0
add esp, 0xc
cmp dword [esp + 0x70], 2
jb 0x457c69
mov ecx, dword [ebp + 4]
mov eax, dword [ecx + 4]
push eax
call fcn.00453081
cmp word [eax], bx
je 0x457c69
mov edx, dword [ebp + 4]
mov eax, dword [edx + 4]
push eax
call fcn.00453081
mov edi, eax
call fcn.0040fff0
mov ebx, eax
cmp dword [esp + 0x70], 3
jb 0x457c89
mov eax, dword [ebp + 4]
mov eax, dword [eax + 8]
push eax
call fcn.00453081
mov edi, eax
call fcn.0040fff0
mov dword [esp + 0x6c], eax
mov esi, eax
cmp dword [esp + 0x70], 4
jb 0x457cc6
mov ecx, dword [ebp + 4]
mov eax, dword [ecx + 0xc]
push eax
call fcn.00453081
cmp word [eax], 0
je 0x457cc6
mov edx, dword [ebp + 4]
mov edi, dword [edx + 0xc]
push edi
call fcn.0044adff
test al, al
jne 0x457cc6
push edi
call fcn.00453063
push eax
lea esi, [esp + 0x18]
call fcn.0040df50
mov esi, dword [esp + 0x6c]
cmp dword [esp + 0x70], 5
jb 0x457cdf
mov eax, dword [ebp + 4]
mov ecx, dword [eax + 0x10]
call fcn.0040c760
movzx ecx, ax
mov dword [esp + 0x10], ecx
push 0x3c
lea edx, [esp + 0x28]
push 0
push edx
call fcn.004131f0
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 4]
mov dword [esp + 0x30], 0x3c
mov dword [esp + 0x34], 0x40
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], eax
mov eax, dword [ecx]
add esp, 0xc
push eax
call fcn.00453081
mov edx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], edx
call dword [0x482464]
mov edi, eax
test ebx, ebx
je 0x457d49
push ebx
call fcn.004112ef
add esp, 4
test esi, esi
je 0x457d56
push esi
call fcn.004112ef
add esp, 4
test edi, edi
jne 0x457d94
mov ecx, dword [esp + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
push 1
add eax, ecx
call fcn.004040e0
mov esi, dword [esp + 0x74]
call fcn.004092c0
lea ecx, [esp + 0x14]
mov dword [esi + 8], 1
mov dword [esi], edi
call fcn.00402620
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret 0x14
cmp byte [esp + 0x68], 0
je 0x457dbe
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x64]
mov dword [ecx + 0x450], eax
lea ecx, [esp + 0x14]
call fcn.00402620
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret 0x14
mov esi, dword [esp + 0x74]
call fcn.004092c0
mov eax, dword [esp + 0x5c]
mov dword [esi + 8], 1
mov dword [esi], 1
test eax, eax
je 0x457de3
push eax
call dword [fcn.00482308]
lea ecx, [esp + 0x14]
call fcn.00402620
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret 0x14
Function at 0x4781ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov ecx, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x48]
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebx
mov edi, ecx
cmp byte [0x4a7cc1], bl
je 0x478346
mov eax, dword [0x4a7cc4]
cmp eax, ebx
je 0x478346
mov edx, 3
mov word [eax + 0x38], dx
mov dword [eax + 0x40], ecx
mov word [eax + 0x98], dx
call dword [fcn.00482304]
mov edx, dword [0x4a7cc4]
mov dword [edx + 0xa0], eax
mov eax, 3
mov word [edx + 0xa8], ax
mov ecx, dword [ebp + 0xf4]
push ecx
call fcn.00437a4d
mov dword [edx + 0xb0], eax
cmp esi, ebx
je 0x4782c6
mov ecx, dword [esi + 4]
mov ebx, dword [fcn.00482430]
mov eax, 8
mov word [esp + 0x20], ax
lea eax, [esp + 0x20]
push eax
add edx, 0x68
push edx
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a7cc4]
mov ecx, dword [esi + 8]
lea edx, [esp + 0x20]
push edx
add eax, 0x58
push eax
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a7cc4]
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x20]
push edx
add eax, 0x78
push eax
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a7cc4]
mov ecx, 3
mov word [eax + 0x88], cx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x90], edx
mov word [eax + 0xb8], cx
movzx ecx, word [esi]
test cx, cx
je 0x4782b7
movzx esi, cx
jmp 0x4782ba
mov esi, dword [esi + 0x1c]
mov dword [eax + 0xc0], esi
test esi, esi
je 0x4782c6
mov edi, esi
mov eax, dword [esp + 0x50]
test eax, eax
je 0x4782db
mov edi, eax
lea ebx, [esp + 0x10]
call fcn.0040e6d0
jmp 0x4782fa
push edi
lea edx, [esp + 0x34]
push edx
call fcn.0044af5c
mov edi, eax
lea esi, [esp + 0x10]
call fcn.0040e640
lea ecx, [esp + 0x30]
call fcn.00402620
mov eax, dword [0x4a7cc4]
add eax, 0x48
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00476a8a
mov ecx, dword [0x4a7cc4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
add esp, 8
call eax
mov edx, dword [ebp]
mov ecx, dword [esp + 0x48]
mov eax, dword [edx + 4]
push 0
push ecx
add eax, ebp
call fcn.004040e0
lea esi, [esp + 0x10]
call fcn.004092c0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0x14
mov eax, dword [ebp]
mov eax, dword [eax + 4]
push ebx
push ecx
add eax, ebp
call fcn.004040e0
cmp byte [esp + 0x54], bl
je 0x478331
lea esi, [esp + 0x10]
call fcn.004092c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x30
ret 0x14
Function at 0x401e60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
fldz
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0xc], eax
fstp qword [esp + 0xc]
push edi
mov dword [esp + 0x10], eax
push esi
call fcn.0040b3f9
mov ebx, dword [esp + 0x20]
push esi
mov edi, eax
push ebx
push edi
call fcn.0040b4d0
mov cx, word [0x424b7c]
mov eax, dword [0x427644]
movsx edx, cx
add ebx, eax
mov ax, word [0x424efc]
mov dword [esp + 0x30], edx
movsx ecx, ax
fild dword [esp + 0x30]
mov dword [esp + 0x30], ecx
add esp, 0x10
lea ebp, [edi + esi]
fild dword [esp + 0x20]
mov esi, edi
fadd qword [0x425b90]
fadd qword [0x423fb8]
fsubp st(1)
call fcn.0040b1f0
sub ebx, 0x42300c
mov word [0x424b7c], ax
cmp edi, ebp
je 0x401eee
mov dl, byte [ebx]
xor byte [esi], dl
inc esi
inc ebx
cmp esi, ebp
jne 0x401ee4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x402af0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
xor eax, eax
mov word [esp + 0x14], ax
xor ecx, ecx
push 3
mov dword [esp + 0x10], eax
mov word [esp + 0x10], cx
push 0x4230a8
call fcn.00401e60
mov ebx, dword [esp + 0x24]
mov edi, eax
push edi
push ebx
call fcn.0040bccf
movzx edx, word [esp + 0x1c]
mov esi, eax
movzx eax, word [esp + 0x24]
add edx, eax
mov word [esp + 0x1c], dx
inc dword [esp + 0x24]
add esp, 0x10
test esi, esi
jne 0x402b5a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push ebx
call fcn.0040bccf
mov esi, eax
add esp, 8
test esi, esi
je 0x402b84
push esi
push 1
lea ecx, [esp + 0x28]
push 4
push ecx
call fcn.0040bb89
push esi
call fcn.0040b9ab
fld dword [0x423110]
fsub qword [0x41f4c0]
add esp, 0x14
fstp dword [0x423110]
fldz
xor eax, eax
mov word [edi], ax
fstp qword [esp + 0xc]
mov dword [esp + 0xc], 0
push edi
mov byte [edi + 2], al
call fcn.0040b29b
dec dword [0x424de0]
mov dx, word [esp + 0x18]
add esp, 4
movsx eax, dx
add eax, dword [0x424de0]
pop edi
mov dword [esp + 0x10], eax
pop esi
pop ebx
fild dword [esp + 8]
fstp qword [0x424b60]
add esp, 0xc
ret
Function at 0x4032a0
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x150
mov eax, dword [0x425e40]
xor eax, esp
mov dword [esp + 0x14c], eax
fldz
push ebp
fst qword [esp + 0x20]
push esi
fldz
push edi
fst dword [esp + 0x24]
push 0x104
fxch st(1)
xor ebp, ebp
fstp qword [esp + 0x20]
fstp dword [esp + 0x10]
call fcn.0040b3f9
add esp, 4
push ebp
mov esi, eax
push 2
mov dword [esp + 0x20], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x403477
lea eax, [esp + 0x30]
push eax
push edi
mov dword [esp + 0x38], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x403446
mov edi, esi
lea ecx, [esp + 0x54]
sub edi, ecx
jmp 0x403320
lea eax, [esp + 0x54]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x403324
push esi
call fcn.0041e4a3
inc dword [0x423688]
mov edx, dword [0x423688]
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
add esp, 4
fld qword [esp + 0x28]
fadd qword [0x41f558]
faddp st(1)
fcomp qword [0x41f550]
fnstsw ax
test ah, 5
jp 0x4033ae
fld dword [esp + 0x24]
fadd qword [0x41f548]
fcomp qword [0x41f540]
fnstsw ax
test ah, 5
jp 0x4033ae
fld dword [esp + 0xc]
fsub qword [0x41f340]
fstp dword [esp + 0xc]
fld qword [esp + 0x28]
fsub dword [esp + 0xc]
fadd dword [esp + 0xc]
mov eax, dword [0x423fc0]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmulp st(1)
call fcn.0040b1f0
mov dword [0x423fc0], eax
mov ecx, dword [esp + 0x160]
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4033d7
test dl, dl
je 0x4033d3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4033d7
add eax, 2
add ecx, 2
test dl, dl
jne 0x4033b7
xor eax, eax
jmp 0x4033dc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403420
fld dword [esp + 0xc]
fsub qword [0x41f538]
fstp dword [esp + 0xc]
cmp dword [esp + 0x164], eax
je 0x403441
mov ecx, dword [esp + 0x38]
push ecx
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40341c
push 0xffffffffffffffff
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x38], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403320
jmp 0x403442
inc ebp
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
fld qword [esp + 0x1c]
fld qword [esp + 0x1c]
fadd qword [0x41f530]
fsubp st(1)
fmul qword [0x424f28]
fstp qword [0x424f28]
fld qword [esp + 0x1c]
fsub qword [0x41f340]
fstp qword [esp + 0x1c]
push esi
call fcn.0040b29b
mov ecx, dword [esp + 0x15c]
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.0040b8e4
add esp, 0x150
ret
Function at 0x4034a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x5c
fldz
xor eax, eax
fstp dword [esp]
xor ecx, ecx
fldz
mov word [esp], ax
fstp qword [esp]
mov edx, 1
fld qword [esp]
mov dword [esp + 0x18], 0x44
fsub qword [0x41f568]
mov word [esp + 0x4a], cx
mov word [esp + 0x48], dx
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x64]
fstp qword [esp + 4]
fld qword [0x41f560]
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push 8
push eax
push eax
push eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x84]
push eax
mov dword [esp + 0x68], 1
fstp qword [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x5c
ret

Function at 0x403660
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
fldz
push ebp
fstp qword [esp + 4]
xor eax, eax
fldz
push 0x2e
mov word [esp + 8], ax
fstp dword [esp + 8]
push 0x424eb4
call fcn.00401e60
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov ebp, eax
push ebp
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4036fe
push esi
push edi
push 0x34
push 0x4234f4
call fcn.00401e60
mov edx, dword [esp + 0x24]
mov esi, eax
mov eax, edx
add esp, 8
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4036c0
sub eax, edi
push eax
push edx
mov edx, dword [esp + 0x1c]
push 1
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
fldz
push 0x34
fstp qword [esp + 0x10]
push 0
push esi
mov dword [esp + 0x18], 0
call fcn.0040b330
push esi
call fcn.0040b29b
add esp, 0x10
pop edi
pop esi
fldz
push 0x2e
push 0
fstp qword [esp + 0xc]
push ebp
mov dword [esp + 0x10], 0
call fcn.0040b330
push ebp
call fcn.0040b29b
mov eax, dword [esp + 0x1c]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
add esp, 0xc
ret
Function at 0x40a8c0
Capabilities:
Create thread

Disassembly:
sub esp, 0x14
fldz
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
fst qword [esp + 0x10]
push ebp
fst qword [esp + 0x14]
push esi
mov dword [esp + 0xc], ebx
fst qword [esp + 0x18]
xor esi, esi
fstp qword [esp + 0x10]
push edi
mov dword [0x42764c], ebx
cmp dword [0x423fa0], ebx
je 0x40a91c
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea esp, [esp]
push ebx
push ebx
push esi
push 0x401180
push ebx
push ebx
mov dword [esi*4 + 0x427188], ebx
call edi
inc esi
cmp esi, dword [0x423fa0]
jne 0x40a900
fld qword [esp + 0x14]
mov ax, word [0x4230e0]
fsub qword [0x41fa08]
movsx ecx, ax
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fmulp st(1)
call fcn.0040b1f0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov word [0x4230e0], ax
fld qword [esp + 0x14]
fsub qword [0x41f340]
push 0xa
fstp qword [esp + 0x18]
call edi
fld dword [0x4234cc]
mov dx, word [0x423060]
fsub qword [0x41fa00]
movsx eax, dx
mov dword [esp + 0x10], eax
fsub qword [0x41f9f8]
fild dword [esp + 0x10]
fmulp st(1)
call fcn.0040b1f0
mov ebp, dword [sym.imp.KERNEL32.dll_SetEvent]
mov word [0x423060], ax
fld dword [0x4234cc]
fsub qword [0x41f340]
mov esi, 0x423fa4
fstp dword [0x4234cc]
fld qword [esp + 0x14]
fsub qword [0x41f9f0]
fadd qword [esp + 0x1c]
fstp qword [esp + 0x1c]
lea esp, [esp]
movzx ecx, word [esi]
mov edx, dword [ecx*4 + 0x427188]
push edx
call ebp
movzx eax, word [esi]
cmp dword [eax*4 + 0x427188], ebx
je 0x40a9f0
lea esp, [esp]
push 0xa
call edi
movzx ecx, word [esi]
cmp dword [ecx*4 + 0x427188], ebx
jne 0x40a9e0
add esi, 2
cmp esi, 0x423fac
jne 0x40a9c0
fld qword [esp + 0x14]
fsub qword [0x41f9e8]
fstp qword [esp + 0x14]
call dword [0x42764c]
test al, 0x41
pop ebx
invalid

Function at 0x40b8e4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425e40]
jne 0x40b8ee
repz ret
jmp fcn.00410809
Function at 0x416884
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00411c01
and dword [ebp - 4], 0
cmp dword [0x4280b4], 0
mov ebx, eax
jne 0x416935
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4169e6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420ab0
push edi
call esi
test eax, eax
je 0x4169e6
push eax
call fcn.00411b8f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4280b4], eax
call esi
push eax
call fcn.00411b8f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4280b8], eax
call esi
push eax
call fcn.00411b8f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4280bc], eax
call esi
push eax
call fcn.00411b8f
pop ecx
mov dword [0x4280c4], eax
test eax, eax
je 0x416935
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00411b8f
pop ecx
mov dword [0x4280c0], eax
mov eax, dword [0x4280c0]
cmp eax, ebx
je 0x41698d
cmp dword [0x4280c4], ebx
je 0x41698d
push eax
call fcn.00411c0a
push dword [0x4280c4]
mov esi, eax
call fcn.00411c0a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41698d
test edi, edi
je 0x41698d
call esi
test eax, eax
je 0x416984
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416984
test byte [ebp - 0xc], 1
jne 0x41698d
or dword [ebp + 0x10], 0x200000
jmp 0x4169c6
mov eax, dword [0x4280b8]
cmp eax, ebx
je 0x4169c6
push eax
call fcn.00411c0a
pop ecx
test eax, eax
je 0x4169c6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4169c6
mov eax, dword [0x4280bc]
cmp eax, ebx
je 0x4169c6
push eax
call fcn.00411c0a
pop ecx
test eax, eax
je 0x4169c6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4280b4]
call fcn.00411c0a
pop ecx
test eax, eax
je 0x4169e6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4169e8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x729008], 0x8088405
inc edx
mov dword [ebx + 0x729008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cb9c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cbcd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbb5
add dl, dl
jne 0x41cbd8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc29
xor eax, eax
add dl, dl
jne 0x41cbe5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ccc6
add dl, dl
jne 0x41cbf4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cbff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc0a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cc1f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cbc4
mov eax, 1
add dl, dl
jne 0x41cc37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc42
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc2e
sub eax, ebx
mov ebx, 1
jne 0x41cc75
mov ecx, 1
add dl, dl
jne 0x41cc5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc66
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc52
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cc8c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc97
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc83
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cce7
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cbc4
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x71256f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e161
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e14a
test esi, esi
jbe 0x41e161
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ac
test eax, eax
jne 0x41e13c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e161
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e119
jmp 0x41e161
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e161
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x712576
ret