joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41813a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, 1
cmp dword [0x44872e], 1
jne 0x4181fc
push esi
push edi
mov esi, 0x441fd4
lea edi, [ebp - 0x28]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x1c
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.0042a1d4
add esp, 0xc
lea eax, [ebp - 7]
push eax
lea eax, [ebp - 6]
push eax
lea eax, [ebp - 5]
push eax
push esi
call fcn.00417b14
add esp, 0x10
xor eax, eax
mov al, byte [ebp + 0x14]
or eax, 0x300
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], edi
xor eax, eax
mov al, byte [ebp - 5]
shl eax, 8
xor edx, edx
mov dl, byte [ebp - 7]
or eax, edx
mov dword [ebp - 0x20], eax
xor eax, eax
mov al, byte [ebp - 6]
shl eax, 8
xor edx, edx
mov dl, byte [ebp + 8]
dec edx
or eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 1
push 0
lea eax, [ebp - 4]
push eax
push 0x1c
lea eax, [ebp - 0x28]
push eax
push 0x1c
lea eax, [ebp - 0x28]
push eax
push 4
push dword [0x441fd0]
call sub.KERNEL32.dll_DeviceIoControl
test eax, eax
je 0x4181f8
test byte [ebp - 0x10], 1
je 0x418242
xor ebx, ebx
jmp 0x418242
movzx eax, word [ebp + 0x14]
shl eax, 9
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x30], eax
shl esi, 9
mov dword [ebp - 0x34], esi
xor eax, eax
mov dword [ebp - 0x2c], eax
push 1
call sub.KERNEL32.dll_SetErrorMode
mov esi, eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push dword [0x441fd0]
call sub.KERNEL32.dll_WriteFile
test eax, eax
jne 0x41823c
xor ebx, ebx
push esi
call sub.KERNEL32.dll_SetErrorMode
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41824b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x18]
mov ebx, 1
movzx eax, si
shl eax, 9
cmp eax, dword [ebp + 0x10]
jle 0x41826e
xor eax, eax
jmp 0x41836f
cmp dword [0x44872e], 1
jne 0x418323
push esi
mov esi, 0x441ff0
lea edi, [ebp - 0x28]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
pop esi
push 0x1c
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.0042a1d4
add esp, 0xc
lea eax, [ebp - 7]
push eax
lea eax, [ebp - 6]
push eax
lea eax, [ebp - 5]
push eax
mov ax, word [ebp + 0x14]
push eax
call fcn.00417b14
add esp, 0x10
mov eax, esi
and eax, 0xff
or eax, 0x200
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
xor eax, eax
mov al, byte [ebp - 5]
shl eax, 8
xor edx, edx
mov dl, byte [ebp - 7]
or eax, edx
mov dword [ebp - 0x20], eax
xor eax, eax
mov al, byte [ebp - 6]
shl eax, 8
xor edx, edx
mov dl, byte [ebp + 8]
dec edx
or eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 1
push 0
lea eax, [ebp - 4]
push eax
push 0x1c
lea eax, [ebp - 0x28]
push eax
push 0x1c
lea eax, [ebp - 0x28]
push eax
push 4
push dword [0x441fd0]
call sub.KERNEL32.dll_DeviceIoControl
test eax, eax
je 0x41831f
test byte [ebp - 0x10], 1
je 0x41836d
xor ebx, ebx
jmp 0x41836d
movzx edi, si
shl edi, 9
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
shl eax, 9
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
push 1
call sub.KERNEL32.dll_SetErrorMode
mov esi, eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0xc]
push dword [0x441fd0]
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x418367
xor ebx, ebx
push esi
call sub.KERNEL32.dll_SetErrorMode
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4184c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
xor ebx, ebx
test esi, esi
je 0x418602
push 0x443efd
push esi
call fcn.0042c6fc
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41855c
xor eax, eax
jmp 0x418507
xor edx, edx
mov dl, al
cmp byte [esi + edx], 0x2e
je 0x418511
inc eax
xor edx, edx
mov dl, al
cmp byte [esi + edx], 0
jne 0x4184fc
and eax, 0xff
cmp byte [esi + eax], 0
jne 0x41855c
push 0xfa
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.0042a36c
add esp, 0xc
push 0x443f00
lea eax, [ebp - 0x108]
push eax
call fcn.0042a204
add esp, 8
push 0x443f05
lea eax, [ebp - 0x108]
push eax
call fcn.0042c6fc
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4185f9
push 0
push 0
push dword [ebp - 8]
call fcn.0042c9f8
add esp, 0xc
push 0x2000
call fcn.0042ec38
pop ecx
mov esi, eax
test esi, esi
je 0x4185e7
push dword [ebp - 8]
push 0x2000
push 1
push esi
call fcn.0042c968
add esp, 0x10
mov edx, eax
test edx, edx
je 0x4185ce
xor eax, eax
cmp edx, eax
jle 0x4185b5
mov cl, byte [esi + eax]
xor cl, byte [0x443efc]
add bl, cl
inc eax
cmp edx, eax
jg 0x4185a5
push dword [ebp - 8]
push 0x2000
push 1
push esi
call fcn.0042c968
add esp, 0x10
mov edx, eax
test edx, edx
jne 0x41859f
mov eax, dword [ebp - 8]
test byte [eax + 0x12], 0x10
je 0x4185de
mov dword [ebp - 4], 8
push esi
call fcn.0042eafc
pop ecx
jmp 0x4185ee
mov dword [ebp - 4], 7
push dword [ebp - 8]
call fcn.0042c3dc
pop ecx
jmp 0x418609
mov dword [ebp - 4], 9
jmp 0x418609
mov dword [ebp - 4], 0xa
test bl, bl
je 0x418614
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421609
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
cmp word [ebx + 0x14], 0xffff
je 0x421676
mov eax, dword [ebx + 0x14]
shr eax, 0x10
test ax, 0xffff
je 0x42162f
push dword [ebx + 0x14]
call fcn.0042efc0
pop ecx
push dword [ebx + 0x10]
call sub.USER32.dll_GetWindowTextLengthA
mov esi, eax
test esi, esi
jge 0x421651
push 0
push 0x44573e
call fcn.00429d7f
add esp, 8
mov dword [ebx + 0x14], eax
jmp 0x421676
lea eax, [esi + 1]
push eax
call fcn.0042f110
pop ecx
mov edi, eax
mov dword [ebx + 0x14], edi
mov byte [edi], 0
mov byte [edi + esi], 0
lea eax, [esi + 1]
mov edx, edi
push eax
push edx
push dword [ebx + 0x10]
call sub.USER32.dll_GetWindowTextA
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42478f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, 0x446559
call fcn.0042bfbc
cmp esi, dword [0x4459d4]
jne 0x4247c1
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x424946
push 0
push edi
call fcn.00420423
add esp, 8
mov dword [ebp - 0x28], eax
push 0
push 0x424ee1
push 0x4295e2
cmp dword [ebp - 0x28], 0
je 0x4247e9
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
jmp 0x4247eb
xor eax, eax
push eax
push dword [ebp - 0x28]
call fcn.0042be60
add esp, 0x14
mov ebx, eax
mov eax, dword [0x446424]
test eax, eax
je 0x424829
test ebx, ebx
jne 0x424829
cmp esi, 0x1f
je 0x424829
cmp esi, 0xa
je 0x424829
mov edx, dword [eax]
mov dword [edx + 0x10], edi
push edx
call fcn.0041f776
pop ecx
mov ebx, dword [0x446424]
xor eax, eax
mov dword [0x446424], eax
test ebx, ebx
jne 0x42483e
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x424946
cmp byte [0x4464d4], 0
jne 0x424876
inc byte [0x4464d4]
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
je 0x42486c
call sub.KERNEL32.dll_GetVersion
and eax, 0xff
cmp eax, 4
jae 0x42486c
xor eax, eax
jmp 0x424871
mov eax, 1
mov dword [0x4464d0], eax
cmp dword [0x4464d0], 0
je 0x42489f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push ebx
mov eax, dword [ebx + 0xc]
call dword [eax + 4]
add esp, 0x10
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x424946
mov word [ebp - 0x14], 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push ebx
mov eax, dword [ebx + 0xc]
call dword [eax + 4]
add esp, 0x10
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x424946
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4250d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, 0x446758
call fcn.0042bfbc
cmp dword [ebx + 8], 0
jne 0x425114
mov al, byte [ebx + 0x1e]
shl eax, 0x1e
sar eax, 0x1f
je 0x42510a
push dword [ebx]
call sub.KERNEL32.dll_LockResource
mov dword [ebx + 8], eax
jmp 0x425114
push dword [ebx]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
cmp dword [eax], 0xc
jne 0x425122
or byte [ebx + 0x1e], 1
jmp 0x425170
mov eax, dword [ebx + 8]
cmp dword [eax], 0x28
jne 0x425130
and byte [ebx + 0x1e], 0xfe
jmp 0x425170
push dword [ebx]
call sub.KERNEL32.dll_GlobalUnlock
push 0
push 0
push 0
push 1
push 0x425913
push 0
mov word [ebp - 0x1c], 8
push 0
push 0x7fdc
lea eax, [ebp - 0xc]
push eax
call fcn.0041c9f1
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x4258bb
call fcn.0042ad8c
add esp, 0x20
mov al, byte [ebx + 0x1e]
shl eax, 0x1f
sar eax, 0x1f
je 0x4251a7
mov eax, dword [ebx + 8]
mov ax, word [eax + 0xa]
push eax
call fcn.0041a2c8
pop ecx
mov esi, eax
mov dword [ebx + 0x10], esi
lea eax, [esi + esi*2]
mov edx, dword [ebx + 8]
movzx edx, word [edx + 4]
mov dword [ebx + 0x14], edx
mov edx, dword [ebx + 8]
movzx edx, word [edx + 6]
mov dword [ebx + 0x18], edx
jmp 0x4251d1
mov eax, dword [ebx + 8]
mov ax, word [eax + 0xe]
push eax
call fcn.0041a2c8
pop ecx
mov esi, eax
mov dword [ebx + 0x10], esi
mov eax, esi
shl eax, 2
mov edx, dword [ebx + 8]
mov edx, dword [edx + 4]
mov dword [ebx + 0x14], edx
mov edx, dword [ebx + 8]
mov edx, dword [edx + 8]
mov dword [ebx + 0x18], edx
mov edx, dword [ebx + 8]
add eax, dword [edx]
add eax, edx
mov dword [ebx + 0xc], eax
mov word [ebx + 0x1c], 0
mov eax, dword [ebp - 0x2c]
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425984
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, 0x4467cc
call fcn.0042bfbc
push ebx
call fcn.0041c88c
pop ecx
xor eax, eax
mov dword [ebx + 8], eax
xor eax, eax
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x18], eax
and byte [ebx + 0x1e], 0xfe
and byte [ebx + 0x1e], 0xfd
mov dword [ebp - 0x78], 0x28
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], edi
push dword [ebp + 0x14]
call fcn.0041a2fa
pop ecx
mov word [ebp - 0x6a], ax
mov word [ebp - 0x6c], 1
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58], eax
xor edx, edx
mov dword [ebp - 0x54], edx
xor edx, edx
mov dword [ebp - 0x68], edx
movzx edx, word [ebp - 0x6a]
imul edx, esi
add edx, 0x1f
test edx, edx
jns 0x425a13
add edx, 0x1f
sar edx, 5
shl edx, 2
imul edx, edi
mov dword [ebp - 0x64], edx
shl eax, 2
mov esi, dword [ebp - 0x78]
add esi, eax
add esi, edx
push esi
push 2
call sub.KERNEL32.dll_GlobalAlloc
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x425a69
push 0
push 0
push 0
push 1
push 0x425c61
push 0
mov word [ebp - 0x40], 8
lea eax, [ebp - 0xc]
push eax
call fcn.0041b85d
pop ecx
lea eax, [ebp - 0xc]
push eax
push 0x425c09
call fcn.0042ad8c
add esp, 0x20
push dword [ebx]
call sub.KERNEL32.dll_GlobalLock
mov esi, eax
mov dword [ebx + 8], esi
push esi
mov edi, esi
lea esi, [ebp - 0x78]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
pop esi
push ebx
call fcn.004250d8
pop ecx
mov ax, word [ebp + 0x18]
mov word [ebx + 0x1c], ax
cmp ax, 1
jne 0x425aaf
xor eax, eax
jmp 0x425aa5
mov ecx, dword [ebx + 8]
mov word [ecx + edx*2 + 0x28], ax
inc eax
movzx edx, ax
cmp edx, dword [ebp + 0x14]
jl 0x425a9c
jmp 0x425b1b
mov word [ebp - 0x40], 0x14
lea eax, [ebp - 0x30]
push eax
call fcn.00421e13
pop ecx
mov eax, dword [ebx + 8]
add eax, 0x28
push eax
push dword [ebp + 0x14]
push 0
push dword [ebp - 0x30]
call sub.GDI32.dll_GetSystemPaletteEntries
xor eax, eax
cmp eax, dword [ebp + 0x14]
jge 0x425b06
mov ecx, eax
shl ecx, 2
add ecx, dword [ebx + 8]
mov edx, ecx
add edx, 0x28
mov esi, ecx
add esi, 0x2a
mov cl, byte [edx]
xor byte [esi], cl
mov cl, byte [esi]
xor byte [edx], cl
mov dl, byte [edx]
xor byte [esi], dl
mov edx, dword [ebx + 8]
mov byte [edx + eax*4 + 0x2b], 0
inc eax
cmp eax, dword [ebp + 0x14]
jl 0x425ada
mov eax, dword [0x448a74]
dec dword [eax]
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.00421dc4
add esp, 8
mov eax, dword [0x448a74]
inc dword [eax]
mov eax, dword [ebp - 0x50]
mov dword fs:[0], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426552
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0xfffffffffffffff0
push dword [ebx + 0x10]
call sub.USER32.dll_GetWindowLongA
test al, 4
je 0x426578
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
je 0x4265a2
test esi, esi
jne 0x426587
push dword [ebx + 0x10]
call sub.USER32.dll_GetWindowTextLengthA
mov esi, eax
inc esi
push esi
call fcn.0042f110
pop ecx
mov edi, eax
mov eax, esi
mov edx, edi
push eax
push edx
push dword [ebx + 0x10]
call sub.USER32.dll_GetWindowTextA
mov eax, edi
jmp 0x4265cf
push 0
push 0
push 0xbd
push ebx
call fcn.00420260
add esp, 0x10
test esi, esi
je 0x4265c9
push 0x42
push esi
push eax
call sub.KERNEL32.dll_LocalReAlloc
test eax, eax
jne 0x4265c9
xor eax, eax
jmp 0x4265cf
push eax
call sub.KERNEL32.dll_LocalLock
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x428e2a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
shr eax, 4
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 6
push dword [ebp - 0xc]
push dword [esi + 0xc]
call sub.KERNEL32.dll_FindResourceA
mov edi, eax
test edi, edi
je 0x428ed9
mov dword [ebp - 0x10], edi
push dword [ebp - 0x10]
push dword [esi + 0xc]
call sub.KERNEL32.dll_LoadResource
mov dword [ebp - 4], eax
test eax, eax
je 0x428ed9
push dword [ebp - 4]
call sub.KERNEL32.dll_LockResource
mov edi, eax
test edi, edi
je 0x428ec9
mov eax, dword [ebp + 0xc]
and eax, 0xf
jmp 0x428e8a
add ebx, ebx
add edi, ebx
mov bx, word [edi]
add edi, 2
movzx ebx, bx
mov edx, eax
add eax, 0xffffffff
test edx, edx
jne 0x428e86
test ebx, ebx
je 0x428ec9
cmp ebx, dword [ebp + 0x14]
jb 0x428ea9
mov ebx, dword [ebp + 0x14]
dec ebx
mov eax, ebx
jmp 0x428eba
mov dl, byte [edi]
add edi, 2
mov ecx, dword [ebp + 0x10]
inc dword [ebp + 0x10]
mov byte [ecx], dl
mov edx, eax
add eax, 0xffffffff
test edx, edx
jne 0x428ead
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
push dword [ebp - 4]
call sub.KERNEL32.dll_FreeResource
test ebx, ebx
je 0x428ed9
mov eax, ebx
jmp 0x428f04
mov eax, dword [0x447154]
cmp esi, eax
je 0x428ef6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.00428e2a
add esp, 0x10
jmp 0x428f04
cmp dword [ebp + 0x14], 0
je 0x428f02
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428f0b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov eax, 0x446eb5
call fcn.0042bfbc
xor ebx, ebx
mov word [ebp - 0x14], 8
lea eax, [ebp - 4]
push eax
call fcn.00430008
pop ecx
mov eax, dword [ebp + 0x10]
shr eax, 4
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 6
push dword [ebp - 0x30]
push dword [esi + 0xc]
call sub.KERNEL32.dll_FindResourceA
mov edi, eax
test edi, edi
je 0x42902f
mov dword [ebp - 0x34], edi
push dword [ebp - 0x34]
push dword [esi + 0xc]
call sub.KERNEL32.dll_LoadResource
mov dword [ebp - 0x28], eax
test eax, eax
je 0x42902f
push dword [ebp - 0x28]
call sub.KERNEL32.dll_LockResource
mov edi, eax
test edi, edi
je 0x428fe9
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 0x38], eax
jmp 0x428f90
add ebx, ebx
add edi, ebx
mov bx, word [edi]
add edi, 2
movzx ebx, bx
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x38], 0xffffffff
test eax, eax
jne 0x428f8c
test ebx, ebx
je 0x428fe9
push ebx
lea eax, [ebp - 4]
push eax
call fcn.0043028c
add esp, 8
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ebx
jmp 0x428fde
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
lea eax, [ebp - 4]
push eax
call fcn.00430244
add esp, 8
mov dl, byte [edi]
add edi, 2
mov byte [eax], dl
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x38], 0xffffffff
test eax, eax
jne 0x428fbf
push dword [ebp - 0x28]
call sub.KERNEL32.dll_FreeResource
test ebx, ebx
je 0x42902f
mov word [ebp - 0x14], 0x14
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0043007c
add esp, 8
mov eax, dword [ebp + 8]
mov word [ebp - 0x14], 0x20
push eax
push 2
lea eax, [ebp - 4]
push eax
call fcn.004302dc
add esp, 8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4290ab
mov ebx, dword [0x447154]
cmp esi, ebx
je 0x429073
mov word [ebp - 0x14], 0x2c
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.00428f0b
add esp, 0xc
mov eax, dword [ebp + 8]
mov word [ebp - 0x14], 0x38
push eax
push 2
lea eax, [ebp - 4]
push eax
call fcn.004302dc
add esp, 8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4290ab
mov word [ebp - 0x14], 0x44
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0043007c
add esp, 8
mov eax, dword [ebp + 8]
mov word [ebp - 0x14], 0x50
push eax
push 2
lea eax, [ebp - 4]
push eax
call fcn.004302dc
add esp, 8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e33c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42e358
call fcn.0042e260
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x42e373
test bl, 1
je 0x42e373
mov dword [0x44822c], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x42e460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x42e47e
mov eax, dword [0x4479dc]
mov eax, dword [eax]
and eax, 0xc000
or dword [ebp + 0xc], eax
test byte [ebp + 0xd], 0x80
jne 0x42e48b
or dword [ebp + 0xc], 0x4000
mov eax, dword [ebp + 0xc]
and eax, 0x700
cmp eax, 0x500
jg 0x42e4b3
je 0x42e4c3
sub eax, 0x100
je 0x42e4d1
sub eax, 0x100
je 0x42e4d8
sub eax, 0x100
je 0x42e4ca
jmp 0x42e4df
sub eax, 0x600
je 0x42e4d8
sub eax, 0x100
je 0x42e4c3
jmp 0x42e4df
mov edi, 1
jmp 0x42e4e4
mov edi, 2
jmp 0x42e4e4
mov edi, 4
jmp 0x42e4e4
mov edi, 5
jmp 0x42e4e4
mov edi, 3
test byte [ebp + 0xd], 1
je 0x42e50b
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x447ed8]
test al, 0x80
je 0x42e504
mov ebx, 0x80
jmp 0x42e51d
mov ebx, 1
jmp 0x42e51d
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42e51d
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x42e52f
je 0x42e538
dec eax
je 0x42e541
jmp 0x42e54a
mov dword [ebp - 4], 0x80000000
jmp 0x42e559
mov dword [ebp - 4], 0x40000000
jmp 0x42e559
mov dword [ebp - 4], 0xc0000000
jmp 0x42e559
push 1
call fcn.0042e1fc
pop ecx
mov ebx, eax
jmp 0x42e647
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x42e575
sub eax, 0x10
je 0x42e57c
sub eax, 0x10
je 0x42e585
sub eax, 0x10
je 0x42e58e
jmp 0x42e58e
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x42e595
mov dword [ebp - 8], 1
jmp 0x42e595
mov dword [ebp - 8], 2
jmp 0x42e595
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb eax, eax
neg eax
mov dword [ebp - 0xc], eax
push 0
push ebx
push edi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x42e5fe
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x42e5f3
mov ebx, 0x50
test byte [ebp + 0xd], 1
jne 0x42e5f3
add ebx, 0xffffffb2
push ebx
call fcn.0042e1fc
pop ecx
mov ebx, eax
jmp 0x42e647
mov edi, esi
push edi
call fcn.0042e3b8
pop ecx
test eax, eax
je 0x42e612
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x42e61e
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0042df60
add esp, 8
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42e647
push 4
call fcn.0042e1fc
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f3d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
mov esi, dword [ebp + 8]
cmp byte [0x440069], 0
je 0x42f433
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea eax, [ebp - 0x54]
push eax
call fcn.0042a3bc
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x42f41e
push 0x3a
lea eax, [ebp - 0x54]
push eax
call fcn.0042a3bc
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x42f41e
lea ebx, [ebp - 0x54]
jmp 0x42f41f
inc ebx
call fcn.0042f388
or eax, 0x10
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x42f477
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x448250
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [ebp - 4]
push eax
push esi
call fcn.0042a29c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x448253
push ebx
call sub.KERNEL32.dll_WriteFile
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402db4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x5c7044], 0x8088405
inc edx
mov dword [0x5c7044], edx
mul edx
mov eax, edx
ret

Function at 0x41abbc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41abc2
ret