joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452deb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x473eb8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x452e8d
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x452f8f
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x452f3d
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocString
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x452f90
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x452f32
cmp dword [ebp - 0x24], 1
jne 0x452f32
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x463314
push eax
call fcn.00439a09
add esp, 0xc
cmp eax, 1
jne 0x452f32
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x452f90
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x452f90
lea ecx, [ebp - 0x18]
push ecx
push 0x452dd5
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x452f90
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x452fb6
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.00452d56
cmp eax, ebx
pop ecx
pop ecx
jne 0x452fb8
inc edi
cmp edi, esi
jl 0x452f9f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004375fb
leave
ret 4
Function at 0x45343c
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x45734e
call fcn.0043a8e0
sub esp, 0x11c
mov eax, dword [0x473eb8]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x453535
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x453509
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.0040b170
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0045343c
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401ac0
test bl, bl
jne 0x453509
or dword [ebp - 4], 0xffffffff
jmp 0x45347a
cmp esi, 0x103
je 0x453519
cmp esi, 0x3f2
jne 0x453529
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.004375fb
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4539e4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x453a19
cmp edi, dword [esi + 0xc]
jge 0x453a19
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x453a19
cmp edi, dword [eax + 8]
jge 0x453a19
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x453a1b
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x453b1f
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x453b53
jmp fcn.00448397
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret
Function at 0x453bc4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x453cbd
cmp eax, dword [edi + 0xc]
jge 0x453cbd
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x453c15
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x453ca6
cmp dword [ebp + 0xc], ebx
je 0x453ca6
jmp 0x453c3f
push 0x10
call fcn.004538b0
cmp eax, ebx
je 0x453c2b
mov ecx, eax
call fcn.00453b16
mov esi, eax
jmp 0x453c2d
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x453c56
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x453c66
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x453c78
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00448397
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.004380a0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x453cb8
cmp ecx, dword [esi + 8]
jge 0x453cb8
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x453cbe
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x453d7d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x453dab
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x453dc9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00453ce7
jmp 0x453dc9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x453dc9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00453ce7
test edi, edi
mov eax, edi
jne 0x453db3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4771d4]
test ecx, ecx
je 0x453e7c
jmp 0x453d7c
ret 8
Function at 0x401020
Capabilities:
Get disk information

Disassembly:
sub esp, 0x254
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x250], eax
mov eax, dword [esp + 0x258]
push esi
push eax
call fcn.004016c7
mov ecx, eax
add esp, 4
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x401050
sub ecx, esi
sar ecx, 1
cmp word [eax + ecx*2 - 2], 0x5c
jne 0x40106c
mov word [eax + ecx*2 - 2], dx
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x401071
sub ecx, esi
sar ecx, 1
cmp ecx, 2
pop esi
jne 0x401096
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x4010c6
test eax, eax
jmp 0x4010aa
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4010c6
test byte [esp], 0x10
je 0x4010c6
mov eax, 1
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.0040171a
add esp, 0x254
ret
mov ecx, dword [esp + 0x250]
xor ecx, esp
xor eax, eax
call fcn.0040171a
add esp, 0x254
ret

Function at 0x4010e0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.pmetprv_
push 0x104
push esi
call fcn.004017c1
push esi
call fcn.00401020
add esp, 0x10
test eax, eax
jne 0x401134
push esi
call fcn.00401795
push esi
call fcn.00401020
add esp, 8
test eax, eax
jne 0x401134
push 0x40b198
push 0x104
push esi
call fcn.00401729
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x401360
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
movzx eax, word [esp + 4]
mov ecx, dword [0x40ef60]
push esi
push str.RT_RCDATA
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x401412
mov edx, dword [0x40ef60]
push ebx
push ebp
push edi
push esi
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov eax, dword [0x40ef60]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, dword [esp + 0x18]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push ebp
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
push 0
jne 0x4013e0
push str.__err_copy_res_to_file
push ebp
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret
lea ecx, [esp + 0x18]
push ecx
push edi
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [esp + 0x14], edi
pop edi
pop ebp
pop ebx
sete al
pop esi
ret
push 0
push 0x40b1d4
push str.res_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
ret
Function at 0x4014d0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1834
call fcn.00401b40
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1830], eax
lea eax, [esp + 0x820]
push 0x104
push eax
call fcn.00401000
lea ecx, [esp + 0xe30]
push 0x104
push ecx
call fcn.00401430
push 0x206
lea edx, [esp + 0x16]
push 0
push edx
mov word [esp + 0x1c], 0
call fcn.00401b70
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00401c06
lea eax, [esp + 0x61c]
push 0x104
push eax
call fcn.004010e0
call fcn.00401c13
push eax
lea ecx, [esp + 0x628]
push ecx
push str._sv_d_
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.00401bea
lea eax, [esp + 0x20]
push eax
call fcn.00401330
add esp, 0x24
test eax, eax
jne 0x40158f
push eax
push 0x40b1d4
push str.Cant_create_path_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4016ae
lea ecx, [esp]
push ecx
lea edx, [esp + 0x20c]
push 0x104
push edx
call fcn.00401729
push str.unrar.exe
lea eax, [esp + 0x218]
push 0x104
push eax
call fcn.004017c1
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x42c]
push 0x104
push edx
call fcn.00401729
push 0x40b294
lea eax, [esp + 0x438]
push 0x104
push eax
call fcn.004017c1
lea ecx, [esp + 0x238]
push ecx
push 0x97
call fcn.00401360
add esp, 0x38
test eax, eax
jne 0x40161a
push eax
push 0x40b1d4
push str.unrar.exe_not_in_res
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4016ae
lea edx, [esp + 0x410]
push edx
push 0x96
call fcn.00401360
add esp, 8
test eax, eax
jne 0x401647
push eax
push 0x40b1d4
push str.unrar.dll_not_in_res
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4016ae
lea eax, [esp + 0x820]
push eax
lea ecx, [esp + 0x20c]
push ecx
push str._s___s_
lea edx, [esp + 0x103c]
push 0x400
push edx
call fcn.00401bea
add esp, 0x14
push 0
push 0
push 0x3ff
lea eax, [esp + 0xa34]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x1044]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 5
lea edx, [esp + 0xa2c]
push edx
mov byte [esp + 0xe2f], 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x1830]
xor ecx, esp
xor eax, eax
call fcn.0040171a
add esp, 0x1834
ret 0x10

Function at 0x40171a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401724
repz ret
jmp fcn.00402120
Function at 0x4030e8
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x40e198]
je 0x403103
inc edi
cmp edi, 0x17
jb 0x4030f4
cmp edi, 0x17
jae 0x403283
push ebp
push 3
call fcn.00407a5e
cmp eax, 1
pop ecx
je 0x40324f
push 3
call fcn.00407a5e
test eax, eax
pop ecx
jne 0x403137
cmp dword [0x40e010], 1
je 0x40324f
cmp ebx, 0xfc
je 0x403282
push 0x40b920
mov ebx, 0x314
push ebx
mov ebp, 0x40f2f8
push ebp
call fcn.004079f9
add esp, 0xc
test eax, eax
je 0x40316d
push esi
push esi
push esi
push esi
push esi
call fcn.00401e8d
add esp, 0x14
push 0x104
mov esi, 0x40f311
push esi
push 0
mov byte [0x40f415], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4031b1
push 0x40b908
push 0x2fb
push esi
call fcn.004079f9
add esp, 0xc
test eax, eax
je 0x4031b1
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00401e8d
add esp, 0x14
push esi
call fcn.00406480
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4031f6
push esi
call fcn.00406480
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x40f60c
push 0x40b904
sub ecx, eax
push ecx
push eax
call fcn.00407946
add esp, 0x14
test eax, eax
je 0x4031f6
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00401e8d
add esp, 0x14
jmp 0x4031f8
xor esi, esi
push 0x40b900
push ebx
push ebp
call fcn.004078d5
add esp, 0xc
test eax, eax
je 0x403218
push esi
push esi
push esi
push esi
push esi
call fcn.00401e8d
add esp, 0x14
push dword [edi*8 + 0x40e19c]
push ebx
push ebp
call fcn.004078d5
add esp, 0xc
test eax, eax
je 0x40323a
push esi
push esi
push esi
push esi
push esi
call fcn.00401e8d
add esp, 0x14
push 0x12010
push 0x40b8d8
push ebp
call fcn.00407718
add esp, 0xc
jmp 0x403282
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x403282
cmp ebp, 0xffffffff
je 0x403282
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x40e19c]
push dword [esi]
call fcn.00406480
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x407718
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040289f
xor ebx, ebx
cmp dword [0x40f9fc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4077ee
push 0x40bad0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4078ce
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40bac4
push edi
call esi
cmp eax, ebx
je 0x4078ce
push eax
call fcn.00402831
mov dword [esp], 0x40bab4
push edi
mov dword [0x40f9fc], eax
call esi
push eax
call fcn.00402831
mov dword [esp], 0x40baa0
push edi
mov dword [0x40fa00], eax
call esi
push eax
call fcn.00402831
mov dword [0x40fa04], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00402e75
test eax, eax
pop ecx
pop ecx
je 0x4077bc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00401e8d
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4077ee
push 0x40ba84
push edi
call esi
push eax
call fcn.00402831
cmp eax, ebx
pop ecx
mov dword [0x40fa0c], eax
je 0x4077ee
push 0x40ba6c
push edi
call esi
push eax
call fcn.00402831
pop ecx
mov dword [0x40fa08], eax
mov eax, dword [0x40fa08]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x407873
cmp dword [0x40fa0c], ecx
je 0x407873
push eax
call fcn.004028a8
push dword [0x40fa0c]
mov esi, eax
call fcn.004028a8
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x407873
cmp edi, ebx
je 0x407873
call esi
cmp eax, ebx
je 0x407840
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407840
test byte [ebp - 0x18], 1
jne 0x407873
lea eax, [ebp - 0x10]
push eax
call fcn.00402eac
test eax, eax
pop ecx
je 0x40785b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00401e8d
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x40786a
or dword [ebp + 0x10], 0x200000
jmp 0x4078ae
or dword [ebp + 0x10], 0x40000
jmp 0x4078ae
mov eax, dword [0x40fa00]
cmp eax, dword [ebp - 8]
je 0x4078ae
push eax
call fcn.004028a8
cmp eax, ebx
pop ecx
je 0x4078ae
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4078ae
mov eax, dword [0x40fa04]
cmp eax, dword [ebp - 8]
je 0x4078ae
push eax
call fcn.004028a8
cmp eax, ebx
pop ecx
je 0x4078ae
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40f9fc]
call fcn.004028a8
cmp eax, ebx
pop ecx
je 0x4078ce
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4078d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403594
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x105c008], 0x8088405
inc edx
mov dword [ebx + 0x105c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41c674
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41c6a5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c68d
add dl, dl
jne 0x41c6b0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c701
xor eax, eax
add dl, dl
jne 0x41c6bd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c79e
add dl, dl
jne 0x41c6cc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c6d7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c6e2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c6ed
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41c6f7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41c69c
mov eax, 1
add dl, dl
jne 0x41c70f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c71a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c706
sub eax, ebx
mov ebx, 1
jne 0x41c74d
mov ecx, 1
add dl, dl
jne 0x41c733
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41c73e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c72a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41c69c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41c764
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41c76f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c75b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41c69c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41c7bf
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41c69c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41d33c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x41d34f
add esp, 0xfffffff0
call fcn.00403d6c
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00403af4
mov byte [ebx + 4], 0
cmp dword [esi + 0x5c], 0
jne 0x41d375
cmp dword [esi + 0x58], 0x40
jb 0x41d55b
jmp 0x41d37b
jl 0x41d55b
lea eax, [ebx + 0xc]
mov edx, 0x40
call fcn.00406e44
push 0
push 0
push 0
push 0x40
lea edx, [ebx + 0xc]
mov eax, esi
call fcn.0041cef4
cmp word [ebx + 0xc], 0x5a4d
jne 0x41d55b
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jle 0x41d55b
cmp ecx, 0x10000
jge 0x41d55b
mov eax, ecx
add eax, 4
add eax, 0x14
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d3d6
cmp eax, dword [esi + 0x58]
ja 0x41d55b
jmp 0x41d3dc
jg 0x41d55b
lea eax, [ebx + 0x4c]
mov edx, 4
call fcn.00406e44
mov eax, dword [ebx + 0x48]
cdq
push edx
push eax
push 0
push 4
lea edx, [ebx + 0x4c]
mov eax, esi
call fcn.0041cef4
cmp dword [ebx + 0x4c], 0x4550
jne 0x41d55b
lea eax, [ebx + 0x50]
mov edx, 0x14
call fcn.00406e44
mov eax, dword [ebx + 0x48]
add eax, 4
cdq
push edx
push eax
push 0
push 0x14
lea edx, [ebx + 0x50]
mov eax, esi
call fcn.0041cef4
mov ax, word [ebx + 0x50]
cmp ax, 0x8664
jne 0x41d493
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xf0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d457
cmp eax, dword [esi + 0x58]
ja 0x41d4e4
jmp 0x41d45d
jg 0x41d4e4
lea eax, [ebx + 0x144]
mov edx, 0xf0
call fcn.00406e44
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xf0
lea edx, [ebx + 0x144]
mov eax, esi
call fcn.0041cef4
mov byte [ebx + 4], 1
jmp 0x41d4e4
cmp ax, 0x14c
jne 0x41d4e4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xe0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d4b4
cmp eax, dword [esi + 0x58]
ja 0x41d4e4
jmp 0x41d4b6
jg 0x41d4e4
lea eax, [ebx + 0x64]
mov edx, 0xe0
call fcn.00406e44
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xe0
lea edx, [ebx + 0x64]
mov eax, esi
call fcn.0041cef4
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
je 0x41d55b
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
mov di, word [ebx + 0x52]
movzx edx, di
shl edx, 3
lea edx, [edx + edx*4]
add eax, edx
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d515
cmp eax, dword [esi + 0x58]
ja 0x41d55b
jmp 0x41d517
jg 0x41d55b
movzx eax, di
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x1046e0c]
call fcn.00405b38
add esp, 4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
cdq
push edx
push eax
movzx eax, word [ebx + 0x52]
shl eax, 3
lea eax, [eax + eax*4]
xor edx, edx
push edx
push eax
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.0041cef4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x41d572
call fcn.00403dc4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret