joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e4157
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
push str.360leakrepair_onfixing_mutex
xor edi, edi
inc edi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x100e417d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100e417f
xor edi, edi
test esi, esi
je 0x100e418a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x100e6682
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
xor eax, eax
push eax
push 4
push ecx
push 0x100e4283
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x100e66b3
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x100e6e14
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push 0x34
mov eax, 0x10121b92
call fcn.1006051e
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], ebx
test eax, eax
je 0x100e6ec8
push 0xf01ff
push str.dsmainsrv
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x34], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x100e6ebf
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100e6e8d
cmp dword [ebp - 0x2c], 0x10
je 0x100e6e80
cmp dword [ebp - 0x2c], 0x20
jne 0x100e6e8d
lea eax, [ebp - 0x2c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
call fcn.100857cb
mov edi, eax
mov ecx, eax
call fcn.100857c7
push ebx
mov esi, eax
call fcn.100857d1
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov ecx, edi
mov ebx, eax
call fcn.100857d1
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
call fcn.100604c8
ret
Function at 0x100e9605
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor esi, esi
mov edi, edx
push esi
call fcn.1004bd30
pop ecx
push 3
pop ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], edx
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], esi
push eax
push str.lstFixEmp2
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 8
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100e967f
cmp dword [ebp - 4], ebx
jne 0x100e967f
cmp dword [ebp - 8], 8
jne 0x100e967f
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
sbb eax, dword [ebp - 0xc]
cmp eax, esi
jg 0x100e967f
jl 0x100e967c
cmp ecx, 0x1fa40
jae 0x100e967f
xor esi, esi
inc esi
test edi, edi
je 0x100e969f
push 8
lea eax, [ebp - 0x18]
push eax
push ebx
push str.lstFixEmp2
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100eba14
Capabilities:
Get disk information
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x10188074]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [ecx]
push 0x800
mov dword [ebp - 0x120], ecx
mov dword [ecx + 4], eax
call fcn.100390c2
pop ecx
push 1
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x124], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor esi, esi
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x118], esi
xor ebx, ebx
test al, 1
je 0x100ebb54
add ebx, 0x41
lea eax, [ebp - 0x84]
push ebx
push str._c:_
push 0x40
push eax
call fcn.100019e7
add esp, 0x10
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec eax
sub eax, 1
jne 0x100ebb4e
push ebx
push str.._c:
lea eax, [ebp - 0x104]
push 0x40
push eax
call fcn.100019e7
add esp, 0x10
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100ebb4e
xor eax, eax
push 0x800
push eax
push edi
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
call fcn.1003e610
and dword [ebp - 0x11c], 0
lea eax, [ebp - 0x11c]
add esp, 0xc
push 0
push eax
push 0x800
push edi
push 0xc
lea eax, [ebp - 0x110]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100ebb47
cmp dword [edi + 0x1c], 7
jne 0x100ebb47
mov ecx, dword [ebp - 0x120]
lea eax, [ebp - 0x118]
push eax
call fcn.1000b661
mov esi, dword [ebp - 0x118]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x114]
inc esi
shr eax, 1
mov dword [ebp - 0x118], esi
mov ebx, esi
mov dword [ebp - 0x114], eax
cmp esi, 0x1a
jl 0x100eba69
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
call fcn.10038d3b
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038cf9
leave
ret 4
Function at 0x100f46bc
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x10123418
call fcn.100604ea
mov edx, ecx
xor esi, esi
lea ecx, [ebp - 0x10]
call fcn.100f474e
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
mov ecx, eax
test ecx, ecx
je 0x100f4743
movzx edx, word [eax]
test dx, dx
je 0x100f4733
cmp word [eax + 2], si
je 0x100f4733
cmp edx, 0x22
jne 0x100f46f6
lea ecx, [eax + 2]
movzx edx, word [ecx + 2]
cmp edx, 0x3a
je 0x100f4712
push 0x5c
pop edi
cmp word [ecx], di
jne 0x100f4733
cmp dx, di
jne 0x100f4733
cmp word [ecx + 4], si
je 0x100f4733
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100f4730
push 1
push dword [ebp - 0x10]
call fcn.10081159
mov ecx, eax
call fcn.10080faf
mov esi, eax
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 0x10]
call fcn.10002a86
mov eax, esi
call fcn.100604b3
ret
push 0x80004005
call fcn.100027ff
int3
Function at 0x100f8fe3
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push str.Software360Safe360Scan
push SysReAllocString
mov edi, edx
mov dword [ebp - 4], esi
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x100f907d
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x100f907d
test ebx, ebx
je 0x100f9051
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push esi
push str.powerssc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100f9049
cmp dword [ebp - 8], esi
je 0x100f9072
jmp 0x100f906f
mov dword [edi], 1
jmp 0x100f9072
mov eax, dword [edi]
push 4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push str.powerssc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100f9072
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100f9087
test ebx, ebx
je 0x100f9087
mov dword [edi], 1
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x100f908e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10188074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.1003e610
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push dword [0x10193b38]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....ipcDataProt.exe
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100f9124
call fcn.1000866d
test eax, eax
jne 0x100f910c
lea ecx, [ebp - 0x210]
call fcn.1009fa4d
test eax, eax
je 0x100f9124
push esi
push esi
push esi
push 5
mov edx, 0x1013270c
lea ecx, [ebp - 0x210]
call fcn.1006b518
add esp, 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10038cf9
leave
ret 0x10

Function at 0x100f923f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10188074]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x8c], 0
lea eax, [ebp - 0x84]
push esi
mov esi, 0x80
push esi
push 0
push eax
call fcn.1003e610
add esp, 0xc
mov dword [ebp - 0x88], esi
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x8c]
push eax
push str.sys_patch_tip_pop
push str.SOFTWARE360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, dword [ebp - 4]
neg eax
pop esi
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.10038cf9
leave
ret
Function at 0x100fb27b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10188074]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1003e610
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x10193b38]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....ipcDataProt.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100fb2ec
call fcn.1000866d
test eax, eax
je 0x100fb2ec
mov al, 1
jmp 0x100fb2ee
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038cf9
leave
ret

Function at 0x100ff0da
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, 0x10124838
call fcn.100604ea
push 0
push dword [ecx + 0x30]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100ff102
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.100604b3
ret 8
Function at 0x10103ac4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 1
push edi
mov edi, ecx
jne 0x10103ad8
call fcn.101038bf
jmp 0x10103ae3
cmp dword [ebp + 8], 0
jne 0x10103aee
call fcn.101038a9
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push ecx
push dword [ebp + 8]
mov ecx, edi
call fcn.10103752
pop edi
pop ecx
pop ebp
ret 8
Function at 0x10105405
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 8
mov eax, 0x10125198
call fcn.100604ea
mov edi, ecx
mov eax, dword [ebp + 8]
push 1
pop ebx
sub eax, 0x79
je 0x101055f9
sub eax, 3
je 0x101055d0
sub eax, 4
je 0x101055b8
sub eax, ebx
je 0x101055fe
sub eax, ebx
je 0x1010554a
sub eax, ebx
jne 0x101055fe
call fcn.1007100a
xor esi, esi
cmp dword [eax + 0xec], esi
je 0x101055fe
cmp dword [eax + 0xf0], esi
je 0x101055fe
mov ecx, eax
call fcn.100703a4
cmp eax, 2
je 0x101055fe
cmp dword [ebp + 0xc], esi
je 0x101055fe
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.100026e3
mov dword [ebp - 4], ebx
lea ecx, [ebp + 0xc]
push esi
mov ebx, 0x10133740
push ebx
call fcn.10004e56
mov esi, eax
test esi, esi
jle 0x1010553a
lea eax, [esi + 2]
push eax
push ebx
lea ecx, [ebp + 0xc]
call fcn.10004e56
cmp eax, 0xffffffff
jne 0x1010553a
push esi
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp + 0xc]
call fcn.10004d45
mov byte [ebp - 4], 2
mov esi, dword [ebp + 0x10]
push esi
call fcn.1010493b
test eax, eax
jne 0x10105532
push esi
call fcn.1010480d
test eax, eax
jne 0x10105532
lea eax, [edi + 0x60]
push eax
lea ecx, [ebp + 8]
call fcn.10002155
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 3
push eax
lea ebx, [edi + 0x58]
mov edi, dword [ebx]
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.1000cbac
cmp dword [eax], edi
jne 0x10105523
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push ecx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.1000d860
mov esi, dword [ebp + 0x10]
cmp dword [ebp + 8], 0
je 0x10105532
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esi - 0x10]
call fcn.10002a86
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.10002a86
jmp 0x101055fe
call fcn.1007100a
mov ecx, eax
call fcn.10070417
inc eax
push eax
call fcn.10070407
cmp dword [ebp + 0x10], 0
je 0x101055fe
push dword [ebp + 0x10]
lea ecx, [ebp + 0x10]
call fcn.100026e3
and dword [ebp - 4], 0
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [edi + 0x1c]
call fcn.100054f9
mov esi, dword [ebp + 0xc]
cmp esi, dword [edi + 0x1c]
je 0x1010559d
push dword [esi + 0x10]
lea ecx, [ebp + 0x10]
call fcn.100073a6
test eax, eax
jns 0x101055a0
mov esi, dword [edi + 0x1c]
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.10002a86
cmp esi, dword [edi + 0x1c]
je 0x101055fe
mov eax, dword [esi + 0x14]
mov dword [eax + 0x14], ebx
jmp 0x101055fe
cmp dword [edi + 0x14], 0
jne 0x101055c1
mov dword [edi + 0x14], ebx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x101055fe
mov eax, dword [eax + 0x24]
mov dword [edi + 0x18], eax
jmp 0x101055fe
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x101055fe
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [edi + 0x24]
cmp eax, 0x64
jbe 0x101055fe
call ebx
mov dword [edi + 0x24], eax
lea ecx, [edi + 0x28]
push dword [esi + 0x3c]
call fcn.100026c3
jmp 0x101055fe
call fcn.10104eb5
xor eax, eax
inc eax
call fcn.100604b3
ret 0xc
Function at 0x10109b87
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0x2711
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [esi + 0x28]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
pop esi
ret

Function at 0x1010b6fa
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ecx + 0x28]
sub ecx, 0x10
jmp fcn.10002a86

Function at 0x1010cfbc
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
test ecx, ecx
je 0x1010d019
mov bl, byte [ebp + 8]
push 0
push 0x80
push 3
push 0
movzx eax, bl
inc eax
push eax
movzx eax, bl
xor eax, 1
inc eax
shl eax, 0x1e
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1010d019
push edi
push 0
push 0
push esi
test bl, bl
jne 0x1010d006
call dword [sym.imp.KERNEL32.dll_GetFileTime]
jmp 0x1010d00c
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x1010d01b
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1010d384
Capabilities:
Check if file exists
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10188074]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10194db0], 0
push esi
jne 0x1010d441
cmp dword [0x10194dac], 0
jne 0x1010d441
push 0x208
xor esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.1003e610
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push dword [0x10193b38]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....Configpromotepopularize_scan_left.xml
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1010d412
xor edx, edx
lea ecx, [ebp - 0x210]
inc edx
call fcn.1010cb64
push esi
push 4
push esi
push 0x1010c0e5
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10194db0], eax
test eax, eax
je 0x1010d441
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [0x10194db0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10038cf9
leave
ret

Function at 0x1010dbcd
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x30], 0
je 0x1010dbf9
push dword [esi + 0x30]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1010dbf9
push 0x46
push dword [esi + 0x30]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push dword [esi + 0x30]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x1010e754
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x10190228
push 0xc
mov edi, ecx
call fcn.10038d70
mov esi, eax
xor ebx, ebx
pop ecx
pop ecx
test esi, esi
je 0x1010e79d
call fcn.100029f0
push eax
mov ecx, esi
call fcn.1000281b
call fcn.100029f0
push eax
lea ecx, [esi + 4]
call fcn.1000281b
call fcn.100029f0
push eax
lea ecx, [esi + 8]
call fcn.1000281b
jmp 0x1010e79f
mov esi, ebx
test esi, esi
je 0x1010e7f3
push edi
mov ecx, esi
call fcn.100026c3
push ebx
lea ecx, [esi + 4]
call fcn.100026c3
push dword [ebp + 8]
lea ecx, [esi + 8]
call fcn.100026c3
push ebx
push ebx
push esi
push 0x1010e52f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x1010e7dd
push ecx
mov ecx, esi
call fcn.100045af
xor ebx, ebx
test edi, edi
setne bl
test edi, edi
je 0x1010e7ef
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x1010e7f5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403918
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x693008], 0x8088405
inc edx
mov dword [ebx + 0x693008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd18
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd31
add dl, dl
jne 0x41cd54
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cda5
xor eax, eax
add dl, dl
jne 0x41cd61
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce42
add dl, dl
jne 0x41cd70
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd7b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd86
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd91
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cd9b
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd40
mov eax, 1
add dl, dl
jne 0x41cdb3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdbe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdaa
sub eax, ebx
mov ebx, 1
jne 0x41cdf1
mov ecx, 1
add dl, dl
jne 0x41cdd7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cde2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdce
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd40
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce08
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce13
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdff
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd40
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ce63
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd40
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41d970
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x41d983
add esp, 0xfffffff0
call fcn.00404100
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00403e7c
mov byte [ebx + 4], 0
cmp dword [esi + 0x5c], 0
jne 0x41d9a9
cmp dword [esi + 0x58], 0x40
jb 0x41db8f
jmp 0x41d9af
jl 0x41db8f
lea eax, [ebx + 0xc]
mov edx, 0x40
call fcn.004072d4
push 0
push 0
push 0
push 0x40
lea edx, [ebx + 0xc]
mov eax, esi
call fcn.0041d598
cmp word [ebx + 0xc], 0x5a4d
jne 0x41db8f
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jle 0x41db8f
cmp ecx, 0x10000
jge 0x41db8f
mov eax, ecx
add eax, 4
add eax, 0x14
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41da0a
cmp eax, dword [esi + 0x58]
ja 0x41db8f
jmp 0x41da10
jg 0x41db8f
lea eax, [ebx + 0x4c]
mov edx, 4
call fcn.004072d4
mov eax, dword [ebx + 0x48]
cdq
push edx
push eax
push 0
push 4
lea edx, [ebx + 0x4c]
mov eax, esi
call fcn.0041d598
cmp dword [ebx + 0x4c], 0x4550
jne 0x41db8f
lea eax, [ebx + 0x50]
mov edx, 0x14
call fcn.004072d4
mov eax, dword [ebx + 0x48]
add eax, 4
cdq
push edx
push eax
push 0
push 0x14
lea edx, [ebx + 0x50]
mov eax, esi
call fcn.0041d598
mov ax, word [ebx + 0x50]
cmp ax, 0x8664
jne 0x41dac7
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xf0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41da8b
cmp eax, dword [esi + 0x58]
ja 0x41db18
jmp 0x41da91
jg 0x41db18
lea eax, [ebx + 0x144]
mov edx, 0xf0
call fcn.004072d4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xf0
lea edx, [ebx + 0x144]
mov eax, esi
call fcn.0041d598
mov byte [ebx + 4], 1
jmp 0x41db18
cmp ax, 0x14c
jne 0x41db18
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xe0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41dae8
cmp eax, dword [esi + 0x58]
ja 0x41db18
jmp 0x41daea
jg 0x41db18
lea eax, [ebx + 0x64]
mov edx, 0xe0
call fcn.004072d4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xe0
lea edx, [ebx + 0x64]
mov eax, esi
call fcn.0041d598
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
je 0x41db8f
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
mov di, word [ebx + 0x52]
movzx edx, di
shl edx, 3
lea edx, [edx + edx*4]
add eax, edx
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41db49
cmp eax, dword [esi + 0x58]
ja 0x41db8f
jmp 0x41db4b
jg 0x41db8f
movzx eax, di
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x67e4b0]
call fcn.00405f20
add esp, 4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
cdq
push edx
push eax
movzx eax, word [ebx + 0x52]
shl eax, 3
lea eax, [eax + eax*4]
xor edx, edx
push edx
push eax
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.0041d598
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x41dba6
call fcn.00404158
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret