joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a1b4
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x100fcc8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
mov dword [ebp - 0x314], eax
lea eax, [ebp - 0x30f]
push ebx
push eax
mov byte [ebp - 0x310], bl
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call sub.msvcrt.dll_memset
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor eax, eax
mov cl, byte [ebp + eax - 0x20c]
mov byte [ebp + eax - 0x310], cl
inc eax
cmp cl, bl
jne 0x100a22c
xor eax, eax
mov cl, byte [ebp + eax - 0x310]
mov byte [ebp + eax - 0x108], cl
inc eax
cmp cl, bl
jne 0x100a241
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100a25b
mov esi, 0x1004794
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100a271
mov eax, dword [ebp - 0x314]
push 0xe
pop ecx
mov esi, 0x1004758
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100a28c
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x100a29c
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x80
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.0100d57f
leave
ret 4
Function at 0x100d570
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x100ddf0
call fcn.0100da24
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x101033c
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100d31a
cmp eax, esi
jne 0x100d30d
xor esi, esi
inc esi
mov ebx, esi
jmp 0x100d31d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100d2f4
xor esi, esi
inc esi
mov eax, dword [0x1010338]
cmp eax, esi
jne 0x100d330
push 0x1f
call fcn.0114a000
pop ecx
jmp 0x100d35f
mov eax, dword [0x1010338]
test eax, eax
jne 0x100d359
mov dword [0x1010338], esi
push 0x100117c
push 0x1001170
call fcn.0100d259
pop ecx
pop ecx
test eax, eax
je 0x100d35f
jmp 0x100d487
mov dword [0x100fffc], esi
mov eax, dword [0x1010338]
cmp eax, esi
jne 0x100d383
push 0x100116c
push 0x1001164
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1010338], 2
test ebx, ebx
jne 0x100d38f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1010344], 0
je 0x100d3b3
push 0x1010344
call fcn.0100d99b
pop ecx
test eax, eax
je 0x100d3b3
push 0
push 2
push 0
call dword [0x1010344]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x100d40f
test al, al
je 0x100d3cd
cmp dword [ebp - 0x1c], 0
jne 0x100d40f
mov al, byte [esi]
test al, al
je 0x100d3dd
cmp al, 0x20
ja 0x100d3dd
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100d3cd
test byte [ebp - 0x3c], 1
je 0x100d3e9
movzx eax, word [ebp - 0x38]
jmp 0x100d3ec
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x100fff8], eax
cmp dword [0x100ffec], 0
jne 0x100d463
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x100d41e
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x100d431
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x100d3ba
cmp dword [0x100fffc], 0
jne 0x100d472
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100fff8]
jmp 0x100d493
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0100da69
ret
call fcn.0100db6e
jmp 0x100d2ba

Function at 0x100d910
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x100d923
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100d91f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret
Function at 0x100d950
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x100d98f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x100d985
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x100d991
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x100d975
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403680
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x140c
call fcn.0040e970
mov eax, dword [0x2ba0c04]
mov ecx, dword [0x2ba0b78]
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403791
mov edi, dword [sym.imp.KERNEL32.dll_SetHandleCount]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x2ba0c04], 0x959
jne 0x403777
push 0
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call ebx
push 0
push 0
call esi
push 0x402db8
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea ecx, [esp + 0x420]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea edx, [esp + 0xc1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0x402dfc
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0x402e04
push 0x402e38
call esi
push 0
push 0x402e94
push 0x402eac
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.004034c0
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x4036c4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140c
ret
Function at 0x4061fb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x446aac]
jne 0x406205
repz ret
jmp fcn.0040b07c

Function at 0x40bfdb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004089d8
and dword [ebp - 4], 0
cmp dword [0x44a0b0], 0
mov ebx, eax
jne 0x40c08c
push 0x401c2c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c13d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401c20
push edi
call esi
test eax, eax
je 0x40c13d
push eax
call fcn.00408966
mov dword [esp], 0x401c10
push edi
mov dword [0x44a0b0], eax
call esi
push eax
call fcn.00408966
mov dword [esp], 0x401bfc
push edi
mov dword [0x44a0b4], eax
call esi
push eax
call fcn.00408966
mov dword [esp], 0x401be0
push edi
mov dword [0x44a0b8], eax
call esi
push eax
call fcn.00408966
pop ecx
mov dword [0x44a0c0], eax
test eax, eax
je 0x40c08c
push 0x401bc8
push edi
call esi
push eax
call fcn.00408966
pop ecx
mov dword [0x44a0bc], eax
mov eax, dword [0x44a0bc]
cmp eax, ebx
je 0x40c0e4
cmp dword [0x44a0c0], ebx
je 0x40c0e4
push eax
call fcn.004089e1
push dword [0x44a0c0]
mov esi, eax
call fcn.004089e1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c0e4
test edi, edi
je 0x40c0e4
call esi
test eax, eax
je 0x40c0db
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c0db
test byte [ebp - 0xc], 1
jne 0x40c0e4
or dword [ebp + 0x10], 0x200000
jmp 0x40c11d
mov eax, dword [0x44a0b4]
cmp eax, ebx
je 0x40c11d
push eax
call fcn.004089e1
pop ecx
test eax, eax
je 0x40c11d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c11d
mov eax, dword [0x44a0b8]
cmp eax, ebx
je 0x40c11d
push eax
call fcn.004089e1
pop ecx
test eax, eax
je 0x40c11d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44a0b0]
call fcn.004089e1
pop ecx
test eax, eax
je 0x40c13d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c13f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401780
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
mov dword [ebp - 4], esi
call fcn.00401970
test eax, eax
js 0x40196b
push ebx
push edi
mov edi, dword [esi + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x4017f4
mov eax, dword [ebp - 4]
lea esi, [esi + edi*4]
add esi, 8
add eax, 8
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x4017b4
mov ebx, dword [ebp - 4]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x401967
lea esi, [ebx + 2]
jmp 0x401810
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x668490]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x667c90]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x667890]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x668090]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x668490]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x667c90]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x668090]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x667890]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x668490]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x667c90]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x668090]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x667890]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x668490]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x667c90]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x668090]
movzx eax, dl
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x667890]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x401810
pop edi
xor eax, eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401fa0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x634289
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x691fb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x5c
lea esi, [edi + 4]
mov dword [ebp - 0x3c], edi
push 0
push esi
call fcn.00603ea0
mov dword [esi], 0x67452301
add esp, 0xc
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [edi + 0xb4], 0xf
mov dword [edi + 0xb0], 0
mov byte [edi + 0xa0], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xcc], 0xf
mov dword [edi + 0xc8], 0
mov byte [edi + 0xb8], 0
mov byte [edi], 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.00417870
mov edx, eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp byte [edx], 0
jne 0x402063
xor ecx, ecx
jmp 0x402071
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402068
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004189e0
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x66a434
mov byte [ecx], 0
call fcn.004189e0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.00401e70
cmp dword [ebp - 0x14], 0x10
jb 0x4020bd
push dword [ebp - 0x28]
call fcn.004e129a
add esp, 4
mov dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x34]
mov dword [ebp - 0x18], 0
mov ecx, 4
mov byte [ebp - 0x28], 0
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x4020d7
mov edx, 8
lea ecx, [ebp - 0x30]
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec edx
jne 0x4020e8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0060052c
mov esp, ebp
pop ebp
ret

Function at 0x4068f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6349a5
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x691fb0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0
call fcn.0043ef10
mov ecx, eax
call fcn.0040b400
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, 0xd
lea ecx, [ebp - 0x48]
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec edx
jne 0x406946
mov ecx, 0x1a
lea eax, [ebp - 0x3a]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x406957
test esi, esi
je 0x4069a3
lea eax, [ebp - 0x20]
mov word [ebp - 0x20], 0x444d
push eax
push esi
mov word [ebp - 0x1a], 0x7461
mov word [ebp - 0x1d], 0x7055
mov byte [ebp - 0x1e], 0x35
mov byte [ebp - 0x1b], 0x64
mov word [ebp - 0x18], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40699c
push 0x400
push ebx
push edi
call eax
mov ecx, esi
call fcn.0040b600
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0060052c
mov esp, ebp
pop ebp
ret
Function at 0x40e950
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x635c21
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x691fb0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.0043ef10
mov ecx, eax
call fcn.0040b400
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov ecx, 0xd
lea eax, [ebp - 0x3c]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x40e9a3
mov ecx, 0x1a
lea eax, [ebp - 0x2e]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x40e9b4
test edi, edi
je 0x40ea1a
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], 1
call fcn.004a0bc0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e9eb
push ebx
push str.SeDebugPrivilege
push 0
call eax
mov esi, eax
mov ecx, edi
call fcn.0040b600
mov edx, 0x16
lea ecx, [ebp - 0x84]
lea ecx, [ecx]
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec edx
jne 0x40ea00
mov ecx, 0x2c
lea eax, [ebp - 0x6e]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x40ea11
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0060052c
mov esp, ebp
pop ebp
ret

Function at 0x40fa60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x40fb0a
cmp dword [esi + 4], 0xffffffff
jne 0x40fb0a
lea edi, [esi + 0x140]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fa92
sub ecx, edx
mov al, byte [ecx + esi + 0x13f]
cmp al, 0x5c
je 0x40fabf
cmp al, 0x2f
je 0x40fabf
push 0xffffffffffffffff
push 0x66a460
push 0x104
push edi
call fcn.006025e3
add esp, 0x10
push 0x20
call fcn.004e126d
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x18], ecx
mov ecx, eax
mov word [eax], 0x100
mov byte [eax + 0x10], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0xc], 0
call fcn.00410880
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
pop edi
pop esi
pop ecx
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
pop ecx
pop ebp
ret 0xc

Function at 0x411660
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
push esi
mov bl, dl
mov edx, ecx
push edi
mov edi, dword [edx + 8]
mov esi, edi
mov ecx, dword [edx]
and esi, 0xfffd
or esi, 2
mov eax, esi

Function at 0x4116f0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
and eax, 0xff
shr esi, 8
mov eax, dword [eax*4 + 0x668cb0]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x668cb0]
mov dword [edi + 8], eax
pop edi
pop esi
ret
Function at 0x411740
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x41174b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x411815
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x668cb0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x668cb0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x668cb0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x668cb0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x668cb0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x668cb0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x668cb0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x668cb0]
dec edi
jne 0x411760
pop edi
test esi, esi
je 0x41183a
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x668cb0]
dec esi
jne 0x411820
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x415ab0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6207c8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x691fb0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x48], 0
push 0x5c
push 0
push esi
mov dword [ebp - 4], 0
call fcn.00603ea0
push dword [ebp + 0x10]
mov edx, ebx
mov dword [esi], 0x67452301
mov ecx, esi
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.0061f560
mov eax, dword [ebp + 0x24]
add esp, 0x10
test eax, eax
je 0x415b42
cmp dword [ebp + 0x28], 0x10
lea edx, [ebp + 0x14]
push eax
cmovae edx, dword [ebp + 0x14]
mov ecx, esi
call fcn.0061f560
add esp, 4
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.004159c0
push 0x5c
push 0
push esi
mov byte [ebp - 4], 1
call fcn.00603ea0
cmp dword [ebp - 0x18], 0x10
lea edx, [ebp - 0x2c]
push 0x10
cmovae edx, dword [ebp - 0x2c]
mov ecx, esi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.0061f560
push dword [ebp + 0x10]
mov edx, ebx
mov ecx, esi
call fcn.0061f560
mov eax, dword [ebp + 0x24]
add esp, 0x14
test eax, eax
je 0x415bb6
cmp dword [ebp + 0x28], 0x10
lea edx, [ebp + 0x14]
push eax
cmovae edx, dword [ebp + 0x14]
mov ecx, esi
call fcn.0061f560
add esp, 4
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.004159c0
push eax
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 2
mov ecx, edi
call fcn.00415c80
add esp, 4
cmp dword [ebp - 0x30], 0x10
jb 0x415be4
push dword [ebp - 0x44]
call fcn.004e129a
add esp, 4
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
jb 0x415c07
push dword [ebp - 0x2c]
call fcn.004e129a
add esp, 4
cmp dword [ebp + 0x28], 0x10
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
jb 0x415c2a
push dword [ebp + 0x14]
call fcn.004e129a
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0060052c
mov esp, ebp
pop ebp
ret 0x24

Function at 0x4194e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4194f5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x419534
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x419530
lea ebx, [ebx]
cmp esi, edx
jae 0x419534
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x419520
cmp esi, edx
jb 0x419539
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4ea47d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4ea4c2
call fcn.004e2d9d
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4ea4c2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4ea4de
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004f718a
mov ebx, eax
test edi, edi
je 0x4ea4dc
test esi, esi
je 0x4ea4dc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4f5b6f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x691fb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4f5c01
test esi, esi
je 0x4f5c01
push esi
call fcn.00603800
push 0xff
mov ebx, eax
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x103]
push 0
push eax
call fcn.00603ea0
mov eax, 0x100
add esp, 0x10
cmp ebx, eax
ja 0x4f5be6
push eax
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, ebx
jne 0x4f5be6
push esi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4f5bee
push esi
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0060052c
mov esp, ebp
pop ebp
ret 8
call fcn.004e3de7
int3