joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4751b0
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
movzx eax, byte [esi + 0x17]
push edi
cmp eax, 3
ja case.default.0x4751c3
jmp dword [eax*4 + 0x475384]
mov eax, esi
call fcn.00401160
cmp dword [0x4c404c], 0
jne 0x47528f
cmp dword [esi + 0xc], 0
jne 0x47528f
mov edi, dword [esp + 0x14]
cmp dword [0x4c7718], esi
jne 0x4751f8
test edi, edi
jne 0x475255
mov ecx, dword [esi + 0x18]
push 0
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x475251
mov dword [0x4c7718], 0
test edi, edi
je 0x475249
mov eax, dword [0x4c402c]
test eax, eax
je 0x47523a
mov edx, dword [esi + 0x18]
push edx
push str.An_environment_variable_is_being_accessed__see_NoEnv.
push eax
push 0x4c6048
xor ecx, ecx
call fcn.0042fae0
mov ecx, dword [esi + 0x18]
call fcn.00473760
pop edi
pop esi
pop ebx
pop ecx
ret 4
dec eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
test edi, edi
je 0x475280
cmp byte [esi + 0x17], 0
jne 0x475260
mov eax, dword [esi + 0xc]
jmp 0x475262
mov eax, esi
test byte [eax + 0x15], 4
je 0x47526f
mov eax, esi
call fcn.0042fc10
xor eax, eax
mov word [edi], ax
mov dword [0x4c7718], eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov dword [0x4c7718], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esi + 0xc]
mov edi, dword [esp + 0x14]
mov ebx, eax
shr ebx, 1
test edi, edi
je 0x475310
test eax, eax
jne 0x4752c7
movzx eax, byte [esi + 0x17]
neg eax
sbb eax, eax
and eax, esi
test byte [eax + 0x15], 4
je 0x4752b9
mov eax, esi
call fcn.0042fc10
xor ecx, ecx
mov word [edi], cx
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov ecx, dword [esi + 8]
cmp edi, ecx
je 0x475310
cmp eax, 0x186a0
jae 0x4752ff
movzx eax, word [ecx]
test ax, ax
je 0x4752f1
lea ecx, [ecx]
add ecx, 2
mov word [edi], ax
movzx eax, word [ecx]
add edi, 2
test ax, ax
jne 0x4752e0
xor edx, edx
mov word [edi], dx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret 4
push eax
push ecx
push edi
call fcn.004935d0
add esp, 0xc
xor eax, eax
mov word [edi + ebx*2], ax
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, dword [esi + 0xc]
call fcn.004751b0
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov esi, dword [esp + 0x14]
mov ecx, esi
mov ebx, 0x4c6b48
call fcn.00403b00
cmp eax, 0xffffffff
jne 0x475344
xor eax, eax
test esi, esi
je 0x47537c
xor edx, edx
mov word [esi + eax*2], dx
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x475362
xor ecx, ecx
mov word [eax], cx
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov edx, dword [esi + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x10]
push edx
push eax
call ecx
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x475be0
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
test edi, edi
jne 0x475bef
pop edi
add esp, 0x10
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ebp
push esi
push 0
push edi
call ebx
mov ebp, eax
mov dword [esp + 0x1c], ebp
cmp ebp, dword [0x4c6004]
je 0x475c1a
mov esi, edi
call fcn.00476cc0
test al, al
jne 0x475db2
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
jne 0x475c34
push eax
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
cmp edi, esi
jne 0x475c42
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x10
ret
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x475c56
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x4c400a], 0
jne 0x475c70
push esi
call fcn.00475b80
add esp, 4
test eax, eax
jne 0x475db4
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test esi, esi
je 0x475ccd
push 0
push esi
call ebx
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x475ccd
cmp dword [0x4c6004], ebx
je 0x475cb4
call fcn.00476cc0
test al, al
jne 0x475cb4
mov eax, dword [0x4c6004]
push 1
push ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x12]
test ebp, ebp
je 0x475ccd
cmp ebx, ebp
je 0x475ccd
push 1
push ebp
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x13]
mov ebx, dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [esp + 0x14], 0
jmp 0x475ce0
push edi
call ebx
push 1
push 0xa
mov dword [0x4c03d4], 0
call fcn.00401290
add esp, 8
mov dword [0x4c03d4], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
cmp ebp, edi
jne 0x475d13
mov ebp, edi
jmp 0x475d24
cmp ebp, esi
je 0x475d28
push 4
push ebp
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x475d28
test ebp, ebp
jne 0x475d69
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 5
jl 0x475ce0
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040ee60
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040ee60
push esi
call fcn.00475b80
add esp, 0x34
mov ebp, eax
cmp byte [esp + 0x12], 0
je 0x475d84
mov ecx, dword [esp + 0x18]
mov edx, dword [0x4c6004]
push 0
push ecx
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [esp + 0x13], 0
je 0x475d9d
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ebp, ebp
je 0x475db2
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
xor eax, eax
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
Function at 0x475eb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [esp + 8], 0
je 0x475ec0
mov eax, esi
call fcn.00454840
jmp 0x475ecd
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 4]
test eax, eax
js 0x475f28
je 0x475f28
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
push 1
push 0x8000012f
mov edi, eax
call fcn.00401290
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call ebx
test eax, eax
je 0x475f25
add edi, dword [esp + 0x10]
call ebp
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x475f25
push 1
push 0x8000012f
call fcn.00401290
add esp, 8
push esi
call ebx
test eax, eax
jne 0x475f04
pop edi
pop ebp
pop ebx
mov eax, esi
ret
Function at 0x476110
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.00496a40
mov eax, dword [esp + 0x11c70]
push ebx
push ebp
mov ebp, dword [esp + 0x11c74]
push esi
mov esi, ecx
movzx ecx, word [edx]
xor ebx, ebx
cmp ecx, 0x41
je 0x47613c
cmp ecx, 0x61
jne 0x476191
cmp word [edx + 2], bx
jne 0x476191
cmp word [edi], bx
jne 0x476191
cmp word [eax], bx
jne 0x476191
cmp word [esi], bx
jne 0x476191
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x476172
cmp byte [ebp + 0xe6], bl
jne 0x476172
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x476172
xor esi, esi
cmp byte [esp + 0x11c84], bl
je 0x476185
cmp esi, ebx
je 0x476185
mov dword [ebp + 0xc0], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
cmp cx, bx
jne 0x4761b6
cmp word [edi], bx
jne 0x4761b6
cmp word [eax], bx
jne 0x4761b6
cmp word [esi], bx
jne 0x4761b6
mov eax, ebp
call fcn.00476310
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x102c], 0x49e828
mov byte [esp + 0x1849], bl
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1850], ebx
mov dword [esp + 0x1854], ebx
mov dword [esp + 0x1858], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov dword [esp + 0x186c], ebx
mov dword [esp + 0x1870], ebx
call fcn.00476e00
test eax, eax
je 0x4762c7
test byte [esp + 0x10], 2
mov al, byte [esp + 0x11c80]
mov ecx, dword [esp + 0x11c88]
mov edx, dword [esp + 0x11c8c]
mov byte [esp + 0x1839], al
mov dword [esp + 0x1848], ecx
mov dword [esp + 0x184c], edx
je 0x4762d3
mov eax, dword [esp + 0x102c]
cmp eax, 0xffff
je 0x47629f
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4762c7
cmp byte [ebp + 0xe6], bl
jne 0x476298
mov eax, dword [esp + 0x102c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x476298
mov ecx, dword [esp + 0x102c]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x4762c7
mov eax, dword [esp + 0x102c]
cmp dword [esp + 0x1860], eax
je 0x4762b8
lea esi, [esp + 0x10]
mov dword [esp + 0x1860], eax
call fcn.00477260
push ebx
lea edx, [esp + 0x14]
push edx
call fcn.00477320
test eax, eax
jne 0x4762e3
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
lea eax, [esp + 0x10]
push eax
push 0x476380
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x1840]
cmp byte [esp + 0x11c84], bl
je 0x4762fd
cmp eax, ebx
je 0x4762fd
mov dword [ebp + 0xc0], eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
Function at 0x477260
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0x1850]
test ecx, ecx
je 0x47731e
mov eax, dword [esi]
test eax, eax
je 0x47731e
push edi
test al, 1
jne 0x47728a
mov eax, dword [esi + 0x100c]
cmp word [eax], 0
je 0x4772a6
push 0x7fff
lea edi, [esi + 0x1858]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x4772a6
xor ecx, ecx
mov word [edi], cx
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x4772c1
mov eax, dword [esi + 0x1850]
lea edx, [esi + 0x1854]
push edx
push eax
call edi
test byte [esi], 0x20
je 0x4772ff
mov edx, dword [esi + 0x1850]
lea ecx, [esp + 4]
push ecx
push edx
call edi
test eax, eax
je 0x4772ff
movzx eax, byte [esi + 0x1828]
mov ecx, dword [esp + 4]
push eax
lea eax, [esi + 0x11a58]
call fcn.00450230
add esp, 4
test eax, eax
jne 0x4772ff
xor ecx, ecx
mov word [esi + 0x11a58], cx
test byte [esi], 8
pop edi
je 0x47731e
mov eax, dword [esi + 0x1850]
push 0x101
lea edx, [esi + 0x11856]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
pop ecx
ret

Function at 0x477aa0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c64
call fcn.00496a40
mov eax, dword [esp + 0x11c68]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x477b4d
mov dword [esp + 0x1848], eax
lea eax, [esp + 8]
push eax
push 0x4781d0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x101c], 0x49e828
mov byte [esp + 0x1839], bl
mov dword [esp + 0x183c], ebx
mov dword [esp + 0x1840], ebx
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov byte [esp + 0x1854], cl
mov dword [esp + 0x1858], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x1838], ebx
je 0x477b4d
mov ecx, dword [0x4c040c]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x477b4d
push 1
push eax
call fcn.00401290
add esp, 8
mov eax, 1
pop ebx
add esp, 0x11c64
ret 4
Function at 0x477b60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x477b7c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4c040c]
push eax
push esi
mov ecx, edi
call fcn.00478010
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x477bb3
test eax, eax
jne 0x477bb7
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.00477c70
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x477c36
test esi, esi
je 0x477c36
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.00401290
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x477c15
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x477c15
push 1
push 0x8000012f
call fcn.00401290
add esp, 8
push esi
call edi
test eax, eax
jne 0x477bf0
mov edx, dword [0x4c040c]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x477c2e
push 1
push eax
call fcn.00401290
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x477c50
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.00477c70
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.00477de0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x477de0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.00496a40
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x477f60
xor cl, cl
mov eax, edi
call fcn.00477f80
test eax, eax
jne 0x477e15
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4c040c]
push eax
push ebp
mov ecx, edi
call fcn.00478010
test eax, eax
je 0x477e38
xor eax, eax
mov dword [0x4c5ffc], eax
jmp 0x477e3d
mov eax, dword [0x4c5ffc]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1024], 0x49e828
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1864], ebx
mov dword [esp + 0x1868], ebx
cmp byte [esp + 0x11c7c], bl
je 0x477e83
mov byte [esp + 0x1841], bl
cmp eax, ebx
je 0x477e8b
mov byte [esp + 0x1841], 1
mov ecx, dword [0x4c5ff8]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1854], eax
lea eax, [esp + 0x18]
push eax
push 0x4780e0
mov dword [esp + 0x1858], ecx
mov dword [esp + 0x1860], edx
call esi
mov eax, dword [esp + 0x1848]
cmp eax, ebx
je 0x477f38
lea ecx, [esp + 0x10]
push ecx
push 0x476c10
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x477ef5
mov edx, dword [esp + 0x1848]
call fcn.00477730
mov dword [esp + 0x1848], esi
mov eax, dword [esp + 0x1848]
call fcn.00475be0
mov edx, dword [esp + 0x1848]
call fcn.00477730
mov edx, dword [0x4c040c]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x477f60
push 1
push eax
call fcn.00401290
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
mov eax, dword [0x4c5ffc]
cmp eax, ebx
je 0x477f60
cmp eax, 1
setg al
mov dword [0x4c5ffc], ebx
cmp al, bl
je 0x477f60
mov edx, ebp
call fcn.00477730
push ebx
mov ecx, edi
call fcn.00477de0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x11c68
ret 4
Function at 0x4918e6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bfd70]
jne 0x4918f0
repz ret
jmp fcn.0049646f

Function at 0x494800
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bfd70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048ed52
and dword [ebp - 0x14], 0
cmp dword [0x4c265c], 0
mov dword [ebp - 0x18], eax
jne 0x4948b3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x49495b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49dfb8
push ebx
call edi
test eax, eax
je 0x49495b
mov esi, dword [fcn.0048b130]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c265c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c2660], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c2664], eax
call edi
push eax
call esi
mov dword [0x4c266c], eax
test eax, eax
je 0x4948b3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c2668], eax
mov eax, dword [0x4c2668]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.0048b134]
cmp eax, ecx
je 0x49490c
cmp dword [0x4c266c], ecx
je 0x49490c
push eax
call esi
push dword [0x4c266c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x49490c
test ebx, ebx
je 0x49490c
call edi
test eax, eax
je 0x494903
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x494903
test byte [ebp - 8], 1
jne 0x49490c
or dword [ebp + 0x10], 0x200000
jmp 0x49493f
mov eax, dword [0x4c2660]
cmp eax, dword [ebp - 0x18]
je 0x49493f
push eax
call esi
test eax, eax
je 0x49493f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x49493f
mov eax, dword [0x4c2664]
cmp eax, dword [ebp - 0x18]
je 0x49493f
push eax
call esi
test eax, eax
je 0x49493f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c265c]
call esi
test eax, eax
je 0x49495b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x49495d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004918e6
leave
ret
Function at 0x4032fc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x500008], 0x8088405
inc edx
mov dword [ebx + 0x500008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403e68
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x500024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403f00
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x403ee0
xor eax, eax
push ebp
push 0x403ed9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403f38
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ee0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x500024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x500024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404ff4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x504054], 0
je 0x405055
cmp word [0x504330], 0xd7b2
jne 0x40501d
cmp dword [0x504338], 0
jbe 0x40501d
mov eax, 0x50432c
call dword [0x504348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405080
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x500030], 0
jne 0x405071
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405200
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x500034], 0
je 0x405226
mov edx, esi
mov eax, ebx
call dword [0x500034]
jmp 0x405235
mov eax, 8
call fcn.00403018
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x504055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4051c8
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x406f50
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x406f92
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x406fb2
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.00406640
add esp, 0x41c
pop esi
pop ebx
ret
Function at 0x40a940
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x506b68
push 0xa
push 0x40a9d4
mov eax, dword [0x506b50]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40a964
call fcn.004134d0
push ebx
mov eax, dword [0x506b50]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40a97b
call fcn.004134d0
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40a98d
call fcn.004134d0
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x506b6c], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x506b70], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x506b74], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x506b78], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x506b7c], ecx
add edx, dword [eax + 0x14]
mov dword [0x506b80], edx
pop esi
pop ebx
ret

Function at 0x40c00c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40c0b5
test eax, edx
je 0x40c0b8
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40c035
push edx
mov edx, eax
mov eax, esp
call fcn.0040665c
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40c04b
push eax
lea eax, [esp + 8]
call fcn.0040665c
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40c05a
movzx eax, word [eax]
sub eax, ecx
jmp 0x40c081
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40c09b
add ecx, 4
js 0x40c072
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40c098
push eax
mov eax, ecx
mov edx, 2
call fcn.004052a0
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40c07f
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40c081
xor eax, eax
ret
test eax, eax
je 0x40c0c8
test edx, edx
jne 0x40c01c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret