joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a9dc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.00417820
push esi
push ebx
xor esi, esi
lea esi, [esi]
add esp, 0xfffffff4
lea ebx, [ebp - 0x2000]
push ebx
call fcn.00404e1c
add esp, 0xfffffff4
push 0
call sub.msvcrt.dll_time
push eax
push ebx
push 0x40a9a8
push 0x42e198
call sub.msvcrt.dll_sprintf
add esp, 0x30
add esp, 0xfffffff8
push 0x42e198
push 0x40a9b1
call fcn.0040874c
add esp, 0xfffffff8
push 0
push 0x42e198
call sub.KERNEL32.dll_CreateDirectoryA
add esp, 0x18
test eax, eax
jne 0x40aa7a
add esp, 0xfffffff8
call sub.KERNEL32.dll_GetLastError
push eax
push 0x40a9be
call fcn.0040874c
add esp, 0x10
inc esi
cmp esi, 9
jle 0x40a9f0
mov byte [0x42e198], 0
add esp, 0xfffffff8
push 0x40a9d8
push 0x3f1
call fcn.00403b2c
lea esp, [ebp - 0x2018]
pop ebx
pop esi
leave
ret

Function at 0x40aae8
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
add esp, 0xfffffff4
push 0x1388
call sub.KERNEL32.dll_Sleep
add esp, 0xfffffffc
call fcn.0040b0e8
add esp, 0x10
test al, al
je 0x40ab6d
add esp, 0xfffffffc
lea eax, [ebp - 0x14]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
add esp, 4
test eax, eax
je 0x40ab79
add esp, 0xfffffffc
lea ebx, [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
push 0x40aad4
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
add esp, 0xfffffffc
push 0
push 0
push 0
push ebx
push 0
push dword [ebp - 0x14]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
add esp, 0xfffffff8
call sub.KERNEL32.dll_GetLastError
add esp, 0x10
test eax, eax
jne 0x40ab79
add esp, 0xfffffff8
push 0
push 2
call sub.USER32.dll_ExitWindowsEx
mov ebx, dword [ebp - 0x38]
leave
ret
Function at 0x40ac0c
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8010
call fcn.00417820
push edi
push ebx
add esp, 0xfffffffc
push 0x2000
lea ebx, [ebp - 0x6000]
push ebx
push 0x2714
call fcn.00401aa8
add esp, 0xfffffff8
push ebx
push 0x40ab7e
call fcn.0040874c
add esp, 0x20
add esp, 0xfffffff4
push ebx
call fcn.00406e34
add esp, 0xfffffff8
push ebx
lea ebx, [ebp - 0x4000]
push ebx
call fcn.00404184
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
add esp, 0x20
cmp ecx, 0xfffffffe
je 0x40ac96
mov edi, ebx
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
cmp byte [ebx + ecx - 2], 0x3b
je 0x40ac96
add esp, 0xfffffff8
push 0x40ab93
push ebx
call sub.msvcrt.dll_strcat
add esp, 0x10
add esp, 0xfffffffc
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov eax, 0x4001
sub eax, ecx
push eax
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebx + ecx - 1]
push eax
push 0x40ab95
call sub.KERNEL32.dll_GetEnvironmentVariableA
add esp, 0xfffffffc
push ebx
push 0x40ab95
call sub.KERNEL32.dll_SetEnvironmentVariableA
add esp, 8
test eax, eax
je 0x40acec
add esp, 0xfffffff8
push ebx
push 0x40ab9a
jmp 0x40acfb
add esp, 0xfffffffc
call sub.KERNEL32.dll_GetLastError
push eax
push ebx
push 0x40abd0
call fcn.0040874c
add esp, 0x10
add esp, 0xfffffffc
push ebx
push 0x40ac03
lea ebx, [ebp - 0x8000]
push ebx
call sub.msvcrt.dll_sprintf
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll__putenv
lea esp, [ebp - 0x8018]
pop ebx
pop edi
leave
ret
Function at 0x40ae94
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x400c
call fcn.00417820
push edi
push esi
push ebx
mov ebx, dword [ebp + 0xc]
mov byte [0x42e198], 0
test ebx, ebx
je 0x40af58
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
sub eax, edx
sar eax, 2
cmp eax, 1
jbe 0x40af58
add esp, 0xfffffff8
push 0x40ad30
push dword [edx + 4]
call sub.msvcrt.dll_wcscmp
add esp, 0x10
test eax, eax
je 0x40af2b
add esp, 0xfffffff8
push 0x40ad50
mov eax, dword [ebx]
push dword [eax + 4]
call sub.msvcrt.dll_wcscmp
add esp, 0x10
test eax, eax
je 0x40af2b
add esp, 0xfffffff8
push 0x40ad70
mov eax, dword [ebx]
push dword [eax + 4]
call sub.msvcrt.dll_wcscmp
add esp, 0x10
test eax, eax
je 0x40af2b
add esp, 0xfffffff8
push 0x40ad90
mov eax, dword [ebx]
push dword [eax + 4]
call sub.msvcrt.dll_wcscmp
add esp, 0x10
test eax, eax
jne 0x40af58
mov eax, dword [ebx]
lea ecx, [eax + 4]
add eax, 8
mov edx, dword [ebx + 4]
cmp eax, edx
je 0x40af4d
add esp, 0xfffffffc
sub edx, eax
and edx, 0xfffffffc
push edx
push eax
push ecx
call sub.msvcrt.dll_memmove
add esp, 0x10
add dword [ebx + 4], 0xfffffffc
mov byte [0x42287e], 1
add esp, 0xfffffff4
push ebx
call fcn.00401c1c
mov eax, dword [ebp + 8]
mov dword [0x430198], eax
call fcn.0040aa94
add esp, 0x10
cmp byte [0x42287d], 0
jne 0x40afe4
add esp, 0xfffffffc
push 0x2000
lea ebx, [ebp - 0x2000]
push ebx
push 0x92
call fcn.00401aa8
add esp, 0x10
cmp byte [ebp - 0x2000], 0
je 0x40afd4
add esp, 0xfffffffc
add esp, 0xfffffffe
push 1
push ebx
lea ebx, [ebp - 0x4000]
push ebx
call fcn.00404a4c
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_SetCurrentDirectoryA
add esp, 0xfffffff4
push ebx
push 0x40adb0
call fcn.0040874c
add esp, 0x30
jmp 0x40afe4
add esp, 0xfffffff4
push 0x40adcf
call fcn.0040874c
add esp, 0x10
cmp byte [0x42287e], 0
je 0x40b0dc
add esp, 0xfffffffc
call fcn.004086c4
push eax
push 0x40adf0
lea edi, [ebp - 0x4000]
push edi
call sub.msvcrt.dll_sprintf
push 4
push dword [0x43019c]
push edi
push 0
call sub.USER32.dll_MessageBoxA
add esp, 0x10
cmp eax, 6
jne 0x40b0dc
add esp, 0xfffffffc
push 0x104
lea esi, [ebp - 0x2000]
push esi
call fcn.004086c4
push eax
call sub.KERNEL32.dll_GetShortPathNameA
add esp, 0xfffffffc
push 0x104
lea ebx, [ebp - 0x1ef0]
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
add esp, 0xfffffff8
push esi
push ebx
push 0x40ae45
push edi
call sub.msvcrt.dll_sprintf
add esp, 0x20
add esp, 0xfffffff8
push edi
push 0x40ae60
call fcn.0040874c
add esp, 0xfffffffc
push 0x10
push 0
lea esi, [ebp - 0x1de0]
push esi
call sub.msvcrt.dll_memset
add esp, 0x20
add esp, 0xfffffffc
push 0x44
push 0
lea ebx, [ebp - 0x1dd0]
push ebx
call sub.msvcrt.dll_memset
mov dword [ebp - 0x1dd0], 0x44
add esp, 0xfffffff8
push esi
push ebx
push 0
push 0
push 0x20
push 1
push 0
push 0
push edi
push 0
call sub.KERNEL32.dll_CreateProcessA
add esp, 0x18
test eax, eax
jne 0x40b0dc
add esp, 0xfffffff8
call sub.KERNEL32.dll_GetLastError
push eax
push 0x40ae70
call fcn.0040874c
lea esp, [ebp - 0x4018]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x40be2c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x201c
call fcn.00417820
push edi
push esi
push ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x2010], eax
mov dword [ebp - 0x200c], edx
mov esi, dword [ebp + 0x14]
add esp, 0xfffffffc
push 0x40bdf0
push ecx
lea ebx, [ebp - 0x2000]
push ebx
call fcn.0040bd90
add esp, 0xfffffff4
push 0
lea eax, [ebp - 0x2004]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ebx
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0x1c
test eax, eax
jne 0x40bee9
add esp, 0xfffffff8
push 8
lea eax, [ebp - 0x2010]
push eax
push 3
push 0
push 0x40be15
push dword [ebp - 0x2004]
call sub.ADVAPI32.DLL_RegSetValueExA
mov edi, esi
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
push esi
push 1
push 0
push 0x40be23
push dword [ebp - 0x2004]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0xfffffffc
push dword [ebp - 0x2004]
call sub.ADVAPI32.DLL_RegCloseKey
lea esp, [ebp - 0x2028]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x40bfe0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x802c
call fcn.00417820
push edi
push esi
push ebx
mov edx, dword [ebp + 8]
mov byte [ebp - 0x8019], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
add esp, 0xfffffff4
lea eax, [ebp - 0x8004]
push eax
push 0x20019
push 0
push 0x40bf10
push edx
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x40c136
mov eax, 0x2000
mov dword [ebp - 0x8014], eax
mov dword [ebp - 0x8018], eax
xor esi, esi
jmp 0x40c0ec
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
xor eax, eax
cmp eax, ecx
jge 0x40c074
mov dl, byte [eax + ebx]
cmp dl, 0x2f
jne 0x40c068
mov byte [eax + ebp - 0x6000], 0x5c
jmp 0x40c06f
mov byte [eax + ebp - 0x6000], dl
inc eax
cmp eax, ecx
jl 0x40c054
add esp, 0xfffffff4
add esp, 0xfffffffe
push 1
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
lea edi, [ebp - 0x8000]
push edi
lea ebx, [ebp - 0x6000]
push ebx
call fcn.0040c744
add esp, 0x20
test al, al
je 0x40c0d7
add esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
push eax
push edi
call sub.msvcrt.dll_strcmp
add esp, 0x10
test eax, eax
jle 0x40c0d7
add esp, 0xfffffff8
push edi
mov eax, dword [ebp + 0x10]
push eax
call sub.msvcrt.dll_strcpy
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_strcpy
mov byte [ebp - 0x8019], 1
add esp, 0x20
inc esi
mov dword [ebp - 0x8014], 0x2000
mov dword [ebp - 0x8018], 0x2000
lea eax, [ebp - 0x8010]
push eax
lea eax, [ebp - 0x8014]
push eax
lea eax, [ebp - 0x2000]
push eax
push 0
lea eax, [ebp - 0x8018]
push eax
lea ebx, [ebp - 0x4000]
push ebx
push esi
push dword [ebp - 0x8004]
call sub.ADVAPI32.DLL_RegEnumKeyExA
cmp eax, 0x103
jne 0x40c040
add esp, 0xfffffff4
push dword [ebp - 0x8004]
call sub.ADVAPI32.DLL_RegCloseKey
mov al, byte [ebp - 0x8019]
lea esp, [ebp - 0x8038]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x40c148
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x203c
call fcn.00417820
push edi
push esi
push ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x2020], eax
mov dword [ebp - 0x201c], edx
add esp, 0xfffffffc
push 0x40bdf0
push ecx
lea ebx, [ebp - 0x2000]
push ebx
call fcn.0040bd90
add esp, 0xfffffff4
lea eax, [ebp - 0x2004]
push eax
push 0x20019
push 0
push ebx
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0x1c
test eax, eax
jne 0x40c246
mov dword [ebp - 0x2008], 8
add esp, 0xfffffff8
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2024], eax
push eax
lea esi, [ebp - 0x2010]
push esi
lea ebx, [ebp - 0x2014]
push ebx
push 0
push 0x40be15
push dword [ebp - 0x2004]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x40c238
cmp dword [ebp - 0x2008], 8
jne 0x40c238
lea edi, [ebp - 0x2020]
mov ecx, 8
cld
test al, 0
repe cmpsb byte [esi], byte es:[edi]
jne 0x40c238
mov dword [ebp - 0x2008], 0x2000
add esp, 0xfffffff8
mov eax, dword [ebp - 0x2024]
push eax
push dword [ebp + 0x14]
push ebx
push 0
push 0x40be23
push dword [ebp - 0x2004]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
sete al
jmp 0x40c248
add esp, 0xfffffff4
push dword [ebp - 0x2004]
call sub.ADVAPI32.DLL_RegCloseKey
mov al, 0
lea esp, [ebp - 0x2048]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x40caa8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov bl, 0
add esp, 0xfffffff4
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x40cafe
add esp, 0xfffffff8
push dword [ebp + 0x18]
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
sete bl
add esp, 0xfffffff4
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov al, bl
mov ebx, dword [ebp - 0x28]
leave
ret

Function at 0x40cc64
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x601c
call fcn.00417820
push edi
push esi
push ebx
add esp, 0xfffffffc
push 0x2000
lea esi, [ebp - 0x2000]
push esi
push 0xa0
call fcn.00401aa8
mov edi, esi
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
add esp, 0x10
cmp ecx, 0xfffffffe
jne 0x40ccb0
jmp 0x40cdd1
mov al, 1
jmp 0x40cdd1
add esp, 0xfffffff4
lea eax, [ebp - 0x6004]
push eax
push 0x20019
push 0
push 0x40cc10
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x40cdcf
mov dword [ebp - 0x6008], 0x2000
add esp, 0xfffffff8
lea eax, [ebp - 0x6008]
push eax
lea ebx, [ebp - 0x4000]
push ebx
lea eax, [ebp - 0x600c]
push eax
push 0
push esi
push dword [ebp - 0x6004]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x40cdc1
cmp dword [ebp - 0x6008], 0
je 0x40cdc1
add esp, 0xfffffff8
push ebx
push 0x40cc41
call fcn.0040874c
add esp, 0xfffffff8
push 0x40cc59
push ebx
call sub.msvcrt.dll_strtok
mov edx, eax
add esp, 0x20
jmp 0x40cdac
add esp, 0xfffffffc
push edx
push 0x40cc5b
lea ebx, [ebp - 0x6000]
push ebx
call sub.msvcrt.dll_sprintf
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040bcec
add esp, 0x20
test al, al
je 0x40cd98
add esp, 0xfffffff4
add esp, 0xfffffffe
push 1
add esp, 0xfffffffe
push 0
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040c63c
add esp, 0x20
test al, al
jne 0x40cca8
add esp, 0xfffffff8
push 0x40cc59
push 0
call sub.msvcrt.dll_strtok
mov edx, eax
add esp, 0x10
test edx, edx
je 0x40cdc1
mov edi, edx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp ecx, 0xfffffffe
jne 0x40cd44
add esp, 0xfffffff4
push dword [ebp - 0x6004]
call sub.ADVAPI32.DLL_RegCloseKey
mov al, 0
lea esp, [ebp - 0x6028]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x40d76c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.00417820
push edi
push esi
push ebx
mov esi, dword [ebp + 8]
add esp, 0xfffffffc
push 0x2000
lea ebx, [ebp - 0x2000]
push ebx
push dword [ebp + 0xc]
call sub.KERNEL32.dll_GetEnvironmentVariableA
add esp, 4
test eax, eax
je 0x40d810
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
xor edx, edx
cmp ecx, 0xfffffffe
je 0x40d7d0
cmp byte [edx + ebx], 0x2f
jne 0x40d7ba
mov byte [edx + ebx], 0x5c
inc edx
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp edx, eax
jb 0x40d7b0
mov bl, 0
add esp, 0xfffffff8
lea eax, [ebp - 0x2000]
push eax
push esi
call fcn.0040bcec
add esp, 0x10
test al, al
je 0x40d809
add esp, 0xfffffff4
add esp, 0xfffffffe
push 1
add esp, 0xfffffffe
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call fcn.0040c63c
test al, al
setne bl
mov al, bl
jmp 0x40d812
mov al, 0
lea esp, [ebp - 0x2018]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x40e058
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x607c
call fcn.00417820
push edi
push esi
push ebx
add esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
push eax
lea ebx, [ebp - 0x2000]
push ebx
call sub.msvcrt.dll_strcpy
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov byte [ebx + ecx - 6], al
add esp, 0xfffffff4
mov eax, dword [ebp + 0xc]
push eax
call fcn.004044ac
add esp, 0x20
test al, al
jne 0x40e0b4
add esp, 0xfffffff4
push 0x40df63
call fcn.0040874c
jmp 0x40e1ef
add esp, 0xfffffffc
push dword [ebp + 8]
push 0x40df7c
lea eax, [ebp - 0x4000]
mov dword [ebp - 0x6064], eax
push eax
call sub.msvcrt.dll_sprintf
push ebx
mov eax, dword [ebp + 0xc]
push eax
push 0x40df91
lea esi, [ebp - 0x6000]
push esi
call sub.msvcrt.dll_sprintf
add esp, 0x20
add esp, 0xfffffff4
mov eax, dword [ebp - 0x6064]
push eax
call fcn.0040874c
add esp, 0xfffffff4
push esi
call fcn.0040874c
add esp, 0x20
add esp, 0xfffffffc
push 0x10
push 0
lea edi, [ebp - 0x6010]
push edi
call sub.msvcrt.dll_memset
add esp, 0xfffffffc
push 0x44
push 0
lea ebx, [ebp - 0x6060]
push ebx
call sub.msvcrt.dll_memset
mov dword [ebp - 0x6060], 0x44
mov dword [ebp - 0x6034], 1
mov word [ebp - 0x6030], 0
add esp, 0x20
add esp, 0xfffffff8
push edi
push ebx
push 0
push 0
push 0x20
push 1
push 0
push 0
push esi
mov eax, dword [ebp - 0x6064]
push eax
call sub.KERNEL32.dll_CreateProcessA
add esp, 8
test eax, eax
jne 0x40e192
add esp, 0xfffffff4
push 0x40dfb0
call fcn.0040874c
add esp, 0xfffffff8
push 0x40dfd0
push 0x3f1
call fcn.00403b2c
add esp, 0x20
add esp, 0xfffffff4
push 0x40dff0
call fcn.0040874c
add esp, 0xfffffff8
push 0xffffffffffffffff
push dword [ebp - 0x6010]
call sub.KERNEL32.dll_WaitForSingleObject
add esp, 0xfffffffc
push 0x40e010
call fcn.0040874c
add esp, 0x20
add esp, 0xfffffff4
mov eax, dword [ebp + 0xc]
push eax
call sub.KERNEL32.dll_DeleteFileA
add esp, 0xc
test eax, eax
jne 0x40e1ef
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x40e1ef
add esp, 0xfffffff8
call sub.KERNEL32.dll_GetLastError
push eax
push 0x40e030
call fcn.0040874c
lea esp, [ebp - 0x6088]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x412ea8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
add esp, 0xfffffffc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 0x38]
call sub.msvcrt.dll__read
leave
ret

Function at 0x417910
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x417938
mov dword [0x43034c], eax
add esp, 0xfffffff8
push 0x4178d4
push eax
call fcn.0041bef0
jmp 0x41793d
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x417950
mov dword [0x422bd8], 0x417a30
jmp 0x41795a
mov dword [0x422bd8], 0x4179e4
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4010f0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x40332c], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp + 4]
mov dword [0x40319f], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401121
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40319f]
mov dword [ebp - 0x48], eax
mov eax, 0x401b7b
mov dword [ebp - 0x54], eax
mov ecx, 0x4030bd
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x40319f]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x403378], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403378]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4011d9
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4011cb
mov esp, ebp
ret
Function at 0x403918
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x8e4008], 0x8088405
inc edx
mov dword [ebx + 0x8e4008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret