joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49efd0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x12c6c70]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x12311a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004971a0
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004983c8
mov eax, dword [esi]
call fcn.00485ca0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x49f042
mov eax, dword [esi]
call fcn.00485ca0
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.00485cac
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x49f066
mov eax, dword [esi]
call fcn.00485cac
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00485c94
cmp eax, dword [ebp - 0x18]
jle 0x49f07c
mov eax, dword [esi]
call fcn.00485c94
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00485c88
cmp eax, dword [ebp - 0xc]
jle 0x49f092
mov eax, dword [esi]
call fcn.00485c88
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.0049d958
push eax
call fcn.004078d4
call fcn.00406e14
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x49f159
mov eax, ebx
call fcn.00404534
cmp eax, 0x64
jge 0x49f159
cmp dword [0x12b426c], 0
je 0x49f159
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call fcn.00407924
cmp dword [ebp - 8], 0
je 0x49f159
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call fcn.00407924
cmp dword [ebp - 8], 0
je 0x49f11c
mov bl, 2
jmp 0x49f137
lea edx, [ebp - 0x20]
mov eax, dword [0x12ce830]
call fcn.004a2268
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x49f135
xor ebx, ebx
jmp 0x49f137
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x12b4374]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.0049d958
push eax
call dword [0x12b426c]
mov eax, dword [0x12c6a7c]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call fcn.0049b08c
push 4
mov eax, dword [ebp - 4]
call fcn.0049d958
push eax
call fcn.0040791c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x12311b0
call fcn.00406e14
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x4d31c4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x4d31d7
add esp, 0xfffffff0
call fcn.004036f0
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0040335c
mov byte [ebx + 4], 0
cmp dword [esi + 0x5c], 0
jne 0x4d31fd
cmp dword [esi + 0x58], 0x40
jb 0x4d33e3
jmp 0x4d3203
jl 0x4d33e3
lea eax, [ebx + 0xc]
mov edx, 0x40
call fcn.004079c8
push 0
push 0
push 0
push 0x40
lea edx, [ebx + 0xc]
mov eax, esi
call fcn.004d2ac8
cmp word [ebx + 0xc], 0x5a4d
jne 0x4d33e3
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jle 0x4d33e3
cmp ecx, 0x10000
jge 0x4d33e3
mov eax, ecx
add eax, 4
add eax, 0x14
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d325e
cmp eax, dword [esi + 0x58]
ja 0x4d33e3
jmp 0x4d3264
jg 0x4d33e3
lea eax, [ebx + 0x4c]
mov edx, 4
call fcn.004079c8
mov eax, dword [ebx + 0x48]
cdq
push edx
push eax
push 0
push 4
lea edx, [ebx + 0x4c]
mov eax, esi
call fcn.004d2ac8
cmp dword [ebx + 0x4c], 0x4550
jne 0x4d33e3
lea eax, [ebx + 0x50]
mov edx, 0x14
call fcn.004079c8
mov eax, dword [ebx + 0x48]
add eax, 4
cdq
push edx
push eax
push 0
push 0x14
lea edx, [ebx + 0x50]
mov eax, esi
call fcn.004d2ac8
mov ax, word [ebx + 0x50]
cmp ax, 0x8664
jne 0x4d331b
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xf0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d32df
cmp eax, dword [esi + 0x58]
ja 0x4d336c
jmp 0x4d32e5
jg 0x4d336c
lea eax, [ebx + 0x144]
mov edx, 0xf0
call fcn.004079c8
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xf0
lea edx, [ebx + 0x144]
mov eax, esi
call fcn.004d2ac8
mov byte [ebx + 4], 1
jmp 0x4d336c
cmp ax, 0x14c
jne 0x4d336c
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xe0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d333c
cmp eax, dword [esi + 0x58]
ja 0x4d336c
jmp 0x4d333e
jg 0x4d336c
lea eax, [ebx + 0x64]
mov edx, 0xe0
call fcn.004079c8
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xe0
lea edx, [ebx + 0x64]
mov eax, esi
call fcn.004d2ac8
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
je 0x4d33e3
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
mov di, word [ebx + 0x52]
movzx edx, di
shl edx, 3
lea edx, [edx + edx*4]
add eax, edx
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d339d
cmp eax, dword [esi + 0x58]
ja 0x4d33e3
jmp 0x4d339f
jg 0x4d33e3
movzx eax, di
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x1264550]
call fcn.0040599c
add esp, 4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
cdq
push edx
push eax
movzx eax, word [ebx + 0x52]
shl eax, 3
lea eax, [eax + eax*4]
xor edx, edx
push edx
push eax
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.004d2ac8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4d33fa
call fcn.00403748
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4d40e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x126619f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x4d4191
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x4d417a
test esi, esi
jbe 0x4d4191
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a644
test eax, eax
jne 0x4d416c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x4d4191
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x4d4149
jmp 0x4d4191
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x4d4191
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x12661a6
ret
Function at 0x4d4bc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x1266d6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404980
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4d4bfb
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4d4c14
lea eax, [ebp - 0x10]
mov edx, dword [0x12c6c48]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.004049e0
jmp 0x4d4c27
lea eax, [ebp - 0x10]
mov edx, dword [0x12c6c48]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.004049e0
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4d4c33
adc edx, 0
mov edx, dword [edx*4 + 0x12b48ac]
call fcn.00404bec
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404bd0
push eax
call fcn.00406b4c
mov esi, eax
cmp esi, 0xffffffff
je 0x4d4d41
mov eax, 0x40
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4d34
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4d4d34
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406fcc
mov eax, edi
call fcn.00402734
mov eax, 0x18
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4d34
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4d4d34
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x4d4d34
cmp dx, 0x150
ja 0x4d4d34
mov eax, edi
call fcn.00402734
mov eax, 0xe0
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4d34
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x4d4d34
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.004049bc
mov eax, edi
call fcn.00402734
push esi
call fcn.00406b04
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404cf8
jne 0x4d4d59
inc ebx
cmp ebx, 0x19
jne 0x4d4bed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1266d76
lea eax, [ebp - 0x10]
call fcn.00404980
ret
Function at 0x509568
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x12d3594
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x50958a
shr eax, 1
xor eax, 0xedb88320
jmp 0x50958c
shr eax, 1
dec edx
jne 0x509578
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x509571
mov byte [0x12d3994], 1
pop esi
pop ebx
ret

Function at 0x5095a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x12d3994], 0
jne 0x5095bf
call fcn.00509568
mov eax, edi
dec eax
test eax, eax
jl 0x5095e8
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x12d3594]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5095c9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x11354
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp esi, 0x100000
jge 0x1136a
mov esi, 0x100000
jmp 0x11376
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 1
push 0x2000
push esi
push 0
call sub.KERNEL32.DLL_LoadLibraryA
mov edi, eax
mov dword [ebx], edi
test edi, edi
je 0x113b3
mov edx, ebx
mov eax, 0x1f440
call fcn.00011208
test al, al
jne 0x113b3
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_ReadFile
xor eax, eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x113b8
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov esi, edx
mov ebp, eax
mov dword [ebx + 4], 0x100000
push 4
push 0x2000
push 0x100000
push ebp
call sub.KERNEL32.DLL_LoadLibraryA
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x11402
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 4
push 0x2000
push esi
push ebp
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x1142a
mov edx, ebx
mov eax, 0x1f440
call fcn.00011208
test al, al
jne 0x1142a
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_ReadFile
xor eax, eax
mov dword [ebx], eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x11430
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], 0xffffffff
xor edx, edx
mov dword [esp + 0xc], edx
mov ebp, eax
mov eax, dword [esp]
add eax, ebp
mov dword [esp + 0x10], eax
mov ebx, dword [0x1f440]
jmp 0x114b0
mov edi, dword [ebx]
mov esi, dword [ebx + 8]
cmp ebp, esi
ja 0x114ae
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0x10]
ja 0x114ae
cmp esi, dword [esp + 8]
jae 0x1147d
mov dword [esp + 8], esi
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0xc]
jbe 0x1148c
mov dword [esp + 0xc], eax
push 0x8000
push 0
push esi
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x114a7
mov dword [0x1f41c], 1
mov eax, ebx
call fcn.00011238
mov ebx, edi
cmp ebx, 0x1f440
jne 0x1145f
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
cmp dword [esp + 0xc], 0
je 0x114e0
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1157c
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov esi, ebx
add esi, 0xfff
and esi, 0xfffff000
mov dword [esp], esi
mov ebp, ebx
add ebp, edx
and ebp, 0xfffff000
mov eax, dword [esp]
mov dword [ecx], eax
mov eax, ebp
sub eax, dword [esp]
mov dword [ecx + 4], eax
mov esi, dword [0x1f440]
jmp 0x115eb
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
add edi, ebx
cmp ebx, dword [esp]
jae 0x115c3
mov ebx, dword [esp]
cmp ebp, edi
jae 0x115c9
mov edi, ebp
cmp edi, ebx
jbe 0x115e9
push 0x4000
sub edi, ebx
push edi
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x115e9
mov dword [0x1f41c], 2
mov esi, dword [esi]
cmp esi, 0x1f440
jne 0x115b3
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x11f10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x1f418], 0
jne 0x11f37
call fcn.0001183c
test al, al
jne 0x11f37
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x1208b
xor ecx, ecx
push ebp
push 0x12084
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x1f031], 0
je 0x11f58
push 0x1f420
call sub.KERNEL32.DLL_WriteFile
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x11f68
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x12007
mov eax, ebx
test eax, eax
jns 0x11f7d
add eax, 3
sar eax, 2
mov edx, dword [0x1f478]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x12007
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x11fb8
mov eax, ebx
test eax, eax
jns 0x11fa7
add eax, 3
sar eax, 2
mov ecx, dword [0x1f478]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x11fde
mov ecx, ebx
test ecx, ecx
jns 0x11fc1
add ecx, 3
sar ecx, 2
mov edi, dword [0x1f478]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x1f40c]
sub ebx, 4
add dword [0x1f410], ebx
call fcn.00012b90
jmp 0x1208b
cmp ebx, dword [0x1f470]
jg 0x12059
sub dword [0x1f470], ebx
cmp dword [0x1f470], 0xc
jge 0x1202b
add ebx, dword [0x1f470]
xor eax, eax
mov dword [0x1f470], eax
mov eax, dword [0x1f474]
add dword [0x1f474], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x1f40c]
sub ebx, 4
add dword [0x1f410], ebx
call fcn.00012b90
jmp 0x1208b
mov eax, ebx
call fcn.00011e1c
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1208b
cmp byte [0x1f031], 0
je 0x12083
push 0x1f420
call sub.KERNEL32.DLL_lstrcatA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x12098
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x1f41c], eax
cmp byte [0x1f418], 0
jne 0x120d0
call fcn.0001183c
test al, al
jne 0x120d0
mov dword [0x1f41c], 8
mov dword [ebp - 4], 8
jmp 0x12231
xor ecx, ecx
push ebp
push 0x1222a
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x1f031], 0
je 0x120f1
push 0x1f420
call sub.KERNEL32.DLL_WriteFile
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x1210c
mov dword [0x1f41c], 9
jmp 0x12201
dec dword [0x1f40c]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x1f410], eax
test bl, 1
je 0x1216c
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x1213c
test edx, 0x80000003
je 0x1214b
mov dword [0x1f41c], 0xa
jmp 0x12201
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x12163
mov dword [0x1f41c], 0xa
jmp 0x12201
add ebx, edx
mov esi, eax
call fcn.000119e0
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x1f474]
jne 0x121ac
sub dword [0x1f474], ebx
add dword [0x1f470], ebx
cmp dword [0x1f470], 0x3c00
jle 0x1219d
call fcn.00011cb8
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00012b90
jmp 0x12231
mov edx, dword [eax]
test dl, 2
je 0x121cf
and edx, 0x7ffffffc
cmp edx, 4
jge 0x121ca
mov dword [0x1f41c], 0xb
jmp 0x12201
or dword [eax], 1
jmp 0x121f8
mov eax, edi
cmp dword [eax + 4], 0
je 0x121e2
cmp dword [eax], 0
je 0x121e2
cmp dword [eax + 8], 0xc
jge 0x121ee
mov dword [0x1f41c], 0xb
jmp 0x12201
mov edx, dword [eax + 8]
add ebx, edx
call fcn.000119e0
mov edx, ebx
mov eax, esi
call fcn.00011c30
mov eax, dword [0x1f41c]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x12231
cmp byte [0x1f031], 0
je 0x12229
push 0x1f420
call sub.KERNEL32.DLL_lstrcatA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x124d0
Capabilities:
Set thread local storage value

Disassembly:
test eax, eax
je 0x124de
call dword [0x1e018]
or eax, eax
je 0x124df
ret
mov al, 1
jmp fcn.00012550

Function at 0x124e8
Capabilities:
Set thread local storage value

Disassembly:
test eax, eax
je 0x124f6
call dword [0x1e01c]
or eax, eax
jne 0x124f7
ret
mov al, 2
jmp fcn.00012550

Function at 0x12500
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x12538
test edx, edx
je 0x12522
push eax
mov eax, ecx
call dword [0x1e020]
pop ecx
or eax, eax
je 0x12531
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00012550
mov dword [eax], edx
mov eax, ecx
call dword [0x1e01c]
or eax, eax
jne 0x1251b
ret
mov al, 1
jmp fcn.00012550
test edx, edx
je 0x1254c
push eax
mov eax, edx
call dword [0x1e018]
pop ecx
or eax, eax
je 0x12531
mov dword [ecx], eax
ret

Function at 0x1265c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x1f02c], 0x8088405
inc edx
mov dword [0x1f02c], edx
mul edx
mov eax, edx
ret

Function at 0x12fd8
Capabilities:
Set thread local storage value

Disassembly:
mov dword [0x1f020], eax
jmp fcn.00012eac
pop dword [0x1f028]
jmp 0x12fcc
Function at 0x1366c
Capabilities:
Set thread local storage value

Disassembly:
mov al, 1
jmp fcn.00012550
test ecx, ecx
je fcn.000135ac
push eax
push ecx
push edx
call sub.user32.dll_MessageBoxA
test eax, eax
je 0x135a4
pop edx
push dword [edx]
mov dword [edx], eax
call sub.user32.dll_MoveWindow
ret

Function at 0x136dc
Capabilities:
Set thread local storage value

Disassembly:
cmp ecx, 0
je 0x137c2
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x1372c
cmp al, 0xb
je 0x13746
cmp al, 0xc
je 0x1375d
cmp al, 0xd
je 0x1376c
cmp al, 0xe
je 0x1378a
cmp al, 0xf
je 0x137a0
cmp al, 0x11
je 0x137af
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00012550
cmp ecx, 1
mov eax, ebx
jg 0x1373d
call fcn.00012fe4
jmp 0x137be
mov edx, ecx
call fcn.00013008
jmp 0x137be
cmp ecx, 1
mov eax, ebx
jg 0x13754
call fcn.000135ac
jmp 0x137be
mov edx, ecx
call fcn.000135c4
jmp 0x137be
mov eax, ebx
add ebx, 0x10
call fcn.00013824
dec edi
jg 0x1375d
jmp 0x137be
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.000136dc
dec edi
jg 0x1376f
pop ebp
jmp 0x137be
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.000136b0
dec edi
jg 0x1378d
pop ebp
jmp 0x137be
mov eax, ebx
add ebx, 4
call fcn.00013d24
dec edi
jg 0x137a0
jmp 0x137be
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.0001382c
dec edi
jg 0x137af
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x137c4
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, 1
jmp fcn.000136dc
Function at 0x138a4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x13a28
call sub.KERNEL32.DLL_FileTimeToLocalFileTime
mov ebx, eax
test ebx, ebx
je 0x13909
push 0x13a38
push ebx
call sub.KERNEL32.DLL_FileTimeToSystemTime
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x13909
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [ebp - 0xc]
test eax, eax
je 0x13909
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetLastError
jmp 0x13a1e
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x13949
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x13a1e
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00013890
mov ebx, eax
cmp byte [ebx], 0
je 0x13a1e
lea eax, [ebx + 1]
call fcn.00013890
mov ebx, eax
cmp byte [ebx], 0
je 0x13a1e
jmp 0x1394f
mov ebx, dword [ebp - 4]
add ebx, 2
mov esi, ebx
sub esi, dword [ebp - 4]
lea eax, [esi + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GetLocalTime
jmp 0x13a05
lea eax, [ebx + 1]
call fcn.00013890
mov edi, eax
mov eax, edi
sub eax, ebx
mov edx, eax
add edx, esi
inc edx
cmp edx, 0x105
jg 0x13a1e
inc eax
push eax
push ebx
lea eax, [ebp - 0x24f]
add eax, esi
push eax
call sub.KERNEL32.DLL_GetLocalTime
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
cmp ebx, 0xffffffff
je 0x13a1e
push ebx
call sub.KERNEL32.DLL_LocalAlloc
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea edx, [esi + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x13a1e
mov byte [ebp + esi - 0x24f], 0x5c
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, esi
inc eax
push eax
call sub.KERNEL32.DLL_GetLastError
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
inc eax
add esi, eax
mov ebx, edi
cmp byte [ebx], 0
jne 0x1396d
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetLastError
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret