joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c95b
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1040
call fcn.00401200
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp word [esi], bx
je 0x40cb92
push esi
call fcn.0040aee2
cmp eax, 0x3f6
jae 0x40cb92
push edi
push 0x3c
pop edi
push edi
push ebx
lea eax, [ebp - 0x40]
push eax
call fcn.0040abb3
movzx ecx, word [esi]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], 0x5c0
cmp cx, 0x22
jne 0x40c9b2
lea eax, [esi + 2]
mov dword [ebp - 0x30], eax
jmp 0x40c9b5
mov dword [ebp - 0x30], esi
xor eax, eax
cmp cx, bx
je 0x40ca0b
mov ecx, esi
cmp word [ecx], 0x22
jne 0x40c9dd
jmp 0x40c9cd
cmp word [esi + eax*2], 0x22
je 0x40c9d6
inc eax
cmp word [esi + eax*2], bx
jne 0x40c9c6
jmp 0x40c9dd
push 0x20
pop ecx
mov word [esi + eax*2], cx
cmp word [esi + eax*2], 0x20
je 0x40c9f7
cmp word [esi + eax*2 + 2], 0x2f
je 0x40c9f7
inc eax
lea ecx, [esi + eax*2]
cmp word [ecx], bx
jne 0x40c9be
jmp 0x40ca0b
lea eax, [esi + eax*2]
cmp word [eax], 0x20
jne 0x40ca05
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov dword [ebp - 0x2c], eax
cmp byte [ebp + 8], bl
jne 0x40ca20
cmp word [0x41ca12], bx
je 0x40ca20
mov dword [ebp - 0x2c], 0x41ca12
push dword [ebp - 0x30]
mov dword [ebp - 0x24], 1
call fcn.00407e29
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x40ca4c
push str..inf
push eax
call fcn.0040f111
test eax, eax
jne 0x40ca4c
mov dword [ebp - 0x34], 0x413840
push dword [ebp - 0x30]
call fcn.00405d2b
mov bl, al
test bl, bl
je 0x40ca72
lea eax, [ebp - 0x1040]
push eax
push dword [ebp - 0x30]
call fcn.00407968
lea eax, [ebp - 0x1040]
mov dword [ebp - 0x30], eax
cmp byte [ebp + 8], 0
je 0x40cab0
test bl, bl
jne 0x40cab0
push dword [ebp - 0x30]
lea eax, [ebp - 0x840]
push eax
call fcn.0040af0c
push str..exe
lea eax, [ebp - 0x840]
push eax
call fcn.0040af79
lea eax, [ebp - 0x840]
push eax
call fcn.00405d2b
test al, al
je 0x40cb91
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 0x40]
push eax
call edi
test eax, eax
setne al
test al, al
jne 0x40cae2
and dword [ebp - 0x3c], 0xfffffbff
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x30], esi
call edi
test eax, eax
setne al
test al, al
je 0x40cb91
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
xor bl, bl
cmp byte [0x41c208], bl
jne 0x40caf7
cmp byte [ebp + 8], bl
je 0x40cb2d
mov eax, dword [0x41c200]
test eax, eax
je 0x40cb17
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40cb17
push 0
push dword [0x41c200]
call esi
mov bl, 1
push 0x7d0
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 8]
call fcn.0040c24b
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x40cb4d
push str..exe
push dword [ebp - 4]
call fcn.0040f111
test eax, eax
je 0x40cb7d
cmp byte [0x41c208], 0
je 0x40cb63
cmp byte [ebp + 8], 0
jne 0x40cb63
push 0x1b58
jmp 0x40cb77
xor eax, eax
cmp byte [ebp + 8], al
sete al
dec eax
and eax, 0xfffffce0
add eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x40cb91
cmp byte [ebp + 8], 0
je 0x40cb91
push 1
push dword [0x41c200]
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x405eab
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x42c55c], esi
push edi
jne 0x405ee5
mov ecx, 0x42c558
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405ec1
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x42c958
jl 0x405ebc
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405f1a
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c558]
xor eax, esi
inc ecx
dec edx
jne 0x405efd
pop edi
pop esi
not eax
ret 0xc

Function at 0x41f450
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401c06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401a68
mov eax, dword [0x426af0]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
jne 0x41f49d
push 0x426af0
push 0x40ba50
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov esi, dword [0x426af0]
lea ecx, [ebp - 0x1c]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0x14]
cmp eax, edi
fnclex
jge 0x41f4c2
push 0x14
push 0x40ba40
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push ecx
push eax
mov edx, dword [eax]
mov esi, eax
call dword [edx + 0x50]
cmp eax, edi
fnclex
jge 0x41f4e6
push 0x50
push 0x40ba60
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov edx, dword [ebp - 0x14]
push edx
push 0x40e6f4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 1
push 0x40e6e0
push 0x40e680
push 0x80000002
call fcn.0041ee30
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
push 0x41f558
jmp 0x41f557
ret
Function at 0x4039b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4039c5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403a04
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403a00
lea ebx, [ebx]
cmp esi, edx
jae 0x403a04
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4039f0
cmp esi, edx
jb 0x403a09
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x403b80
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5484e8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5b39c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b4ee0], 0
mov dword [ebp - 4], 1
je 0x403bfc
push dword [0x5b4ee4]
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x10], esp
mov esi, esp
push eax
call fcn.00401200
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov esi, esp
push eax
mov byte [ebp - 4], 2
call fcn.00401200
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [ebp - 4], 1
call dword [0x5b4ee0]
add esp, 0xc
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00401200
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.004041e0
add esp, 4
cmp eax, 1
jne 0x403c56
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00401200
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00404b00
add esp, 4
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x403c61
or esi, 0xffffffff
jmp 0x403c82
test eax, eax
jns 0x403c3f
mov esi, 0xfffffffe
jmp 0x403c82
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00401200
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00404b00
add esp, 4
xor esi, esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x403ca5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp + 0xc]
add ebx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x403cc6
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404070
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5485c0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5b39c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp - 4], 0
call fcn.00401200
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00404b00
add esp, 4
cmp dword [0x5b4ee8], 0
je 0x404104
push dword [0x5b4eec]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x559d00
call fcn.00402210
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov byte [ebp - 4], 1
call fcn.00401200
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [ebp - 4], 0
call dword [0x5b4ee8]
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp + 8]
neg eax
sbb esi, esi
add edi, 0xfffffff0
neg esi
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404137
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [esi - 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404150
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
call edi
cmp eax, 0xffffffff
jne 0x404199
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, edi
call ebx
cmp eax, 2
je 0x4041b2
cmp eax, 3
je 0x4041b2
cmp eax, 5
jne 0x4041ab
cmp esi, 0x14
jge 0x4041a4
push 0x32
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
je 0x404170
test al, 0x10
je 0x4041b6
mov esi, 1
jmp 0x4041b9
mov esi, 0xffffff9e
jmp 0x4041b9
mov esi, 0xffffff9d
jmp 0x4041b9
xor esi, esi
jmp 0x4041b9
or esi, 0xffffffff
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4041d6
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x4041e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
call edi
cmp eax, 0xffffffff
jne 0x404229
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, edi
call ebx
cmp eax, 2
je 0x404240
cmp eax, 3
je 0x404240
cmp eax, 5
jne 0x404239
cmp esi, 0x14
jge 0x404232
push 0x32
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
je 0x404200
test al, 0x10
je 0x404244
or esi, 0xffffffff
jmp 0x404249
mov esi, 0xffffff9e
jmp 0x404249
mov esi, 0xffffff9d
jmp 0x404249
xor esi, esi
jmp 0x404249
mov esi, 1
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404266
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x404560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x548676
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x5b39c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x248], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x238], ax
lea eax, [ebp - 0x236]
push eax
call fcn.0052fc00
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4045ea
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052db16
mov esp, ebp
pop ebp
ret
xor ebx, ebx
lea esp, [esp]
push ebx
lea eax, [ebp - 0x30]
push str.temp_04x
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x244], esp
push eax
call fcn.00402210
push ecx
lea eax, [ebp - 0x238]
mov ecx, esp
push eax
mov dword [ebp - 4], 0
call fcn.00402210
lea eax, [ebp - 0x23c]
push eax
mov dword [ebp - 4], 0xffffffff
call fcn.00403a20
mov esi, dword [ebp - 0x23c]
add esp, 8
mov ecx, dword [esi - 0x10]
mov dword [ebp - 4], 1
mov eax, dword [ecx]
mov dword [ebp - 0x244], esp
call dword [eax + 0x10]
cmp dword [esi - 4], 0
lea edx, [esi - 4]
mov ecx, eax
jl 0x404679
cmp ecx, dword [esi - 0x10]
jne 0x404679
lea edi, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x4046b2
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x404778
mov ecx, dword [esi - 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [esi - 0xc]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ecx*2 + 2]
push esi
push eax
lea eax, [edi + 0x10]
push eax
call fcn.0052d99d
add esp, 0x10
mov ecx, dword [ebp - 0x244]
lea eax, [edi + 0x10]
mov dword [ecx], eax
call fcn.00404150
add esp, 4
test eax, eax
je 0x404707
mov edx, dword [ebp - 0x23c]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4046f0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
inc ebx
cmp ebx, 0x10000
jl 0x4045f0
mov eax, 0xfffffffe
jmp 0x4045ce
mov eax, dword [ebp - 0x23c]
push 0
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00401200
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00404340
add esp, 8
test eax, eax
jns 0x404736
mov edi, 0xfffffff5
jmp 0x40474a
mov ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x23c]
push eax
call fcn.00401110
xor edi, edi
mov esi, dword [ebp - 0x23c]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404771
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
jmp 0x4045ce
call fcn.00403870
int3
Function at 0x404b00
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404b36
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
pop ebp
ret

Function at 0x405480
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0041b152

Function at 0x405910
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54894b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
push esi
mov eax, dword [0x5b39c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
call fcn.0041de68
add esp, 4
mov ecx, esi
call fcn.00405820
test eax, eax
jne 0x4059ca
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x405988
push 0
push ecx
mov ecx, esp
push 0x55a62c
call fcn.00402210
call fcn.00404ec0
add esp, 8
cmp eax, 6
jne 0x405988
mov dword [esi + 0xcc], 1
push str.Bunkei
mov ecx, esi
call fcn.0041d4de
push 0
lea ecx, [ebp - 0x23c]
call fcn.00405a50
lea eax, [ebp - 0x23c]
mov ecx, eax
mov dword [ebp - 4], 0
mov dword [esi + 0x20], eax
call fcn.0041b4bb
lea ecx, [ebp - 0x23c]
mov dword [ebp - 4], 0xffffffff
call fcn.00405700
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4063f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.00406260
mov eax, dword [ebp + 8]
push 0
push 4
push 0
push 0
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
push esi
push 0x406870
mov dword [esi + 0xc], eax
call fcn.00418a27
mov dword [esi + 4], eax
test eax, eax
jne 0x406429
or eax, 0xffffffff
pop esi
pop ebp
ret 8
mov dword [eax + 0x28], 0
mov eax, dword [esi + 4]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x409630
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, ecx
xor eax, dword [ebp + 0x10]
shr ecx, 8
and eax, 0xff
mov eax, dword [edx + eax*4]
xor eax, ecx
mov ecx, dword [edi + 8]
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [edx + eax*4]
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], ecx
pop edi
pop ebp
ret

Function at 0x4097d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x548f08
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5b39c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x40980b
mov esi, dword [ecx]
jmp 0x40980d
mov esi, ecx
mov al, byte [esi]
test al, al
je 0x409907
cmp al, 0x5c
jne 0x4098ec
call fcn.0040a3a0
mov ecx, 0xf
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp eax, esi
je 0x40984c
mov ecx, esi
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a2a0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
cmp byte [edx], 0
mov dword [ebp - 4], 0
jne 0x409878
xor eax, eax
jmp 0x409889
mov eax, edx
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409880
sub eax, edi
push eax
push edx
lea ecx, [ebp - 0x40]
call fcn.0040a2a0
lea eax, [ebp - 0x40]
push eax
call fcn.00409940
add esp, 4
test al, al
sete bl
cmp dword [ebp - 0x2c], 0x10
jb 0x4098b5
push dword [ebp - 0x40]
call fcn.0040cf72
add esp, 4
test bl, bl
je 0x4098d1
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x409925
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 4], 0xffffffff
jb 0x4098e9
push dword [ebp - 0x28]
call fcn.0040cf72
add esp, 4
mov ecx, dword [ebp - 0x44]
mov al, byte [esi]
xor al, 0x20
add al, 0x5f
mov dl, 0x3b
cmp dl, al
sbb eax, eax
add eax, 2
add esi, eax
mov al, byte [esi]
test al, al
jne 0x409817
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052db16
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x14], 0x10
jb 0x409936
push dword [ebp - 0x28]
call fcn.0040cf72
add esp, 4
xor al, al
jmp 0x409909

Function at 0x409940
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x40994e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret
Function at 0x409a70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x548f86
mov eax, dword fs:[0]
push eax
mov eax, 0x2288
call fcn.0052ff20
mov eax, dword [0x5b39c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp dword [eax + 0x14], 0x10
jb 0x409ab0
mov eax, dword [eax]
push eax
call fcn.004086c0
mov edi, eax
add esp, 4
test edi, edi
jne 0x409ac6
xor al, al
jmp 0x409cdb
push 0
push 0
push 0
push 0
push 0x200
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x2290]
push eax
push edi
call fcn.004085c0
add esp, 0x20
test eax, eax
jne 0x409cd0
lea eax, [ebp - 0x210]
lea edx, [eax + 1]
jmp 0x409b00
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409b00
sub eax, edx
xor ecx, ecx
test eax, eax
jle 0x409b27
nop
cmp byte [ebp + ecx - 0x210], 0x2f
jne 0x409b22
mov byte [ebp + ecx - 0x210], 0x5c
inc ecx
cmp ecx, eax
jl 0x409b10
cmp eax, 2
jl 0x409b90
mov cl, byte [ebp + eax - 0x212]
xor cl, 0x20
add cl, 0x5f
cmp cl, 0x3b
jbe 0x409b90
cmp byte [ebp + eax - 0x211], 0x5c
jne 0x409b90
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x2228]
push ebx
push eax
call fcn.00409680
push eax
mov dword [ebp - 4], 0
call fcn.004097d0
add esp, 0x10
cmp dword [ebp - 0x2214], 0x10
mov dword [ebp - 4], 0xffffffff
jb 0x409cbe
push dword [ebp - 0x2228]
call fcn.0040cf72
jmp 0x409cbb
push edi
call fcn.00408940
add esp, 4
test eax, eax
jne 0x409cd0
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x2228]
push ebx
push eax
call fcn.00409680
push eax
mov dword [ebp - 4], 1
call fcn.004097d0
add esp, 0x10
cmp dword [ebp - 0x2214], 0x10
mov dword [ebp - 4], 0xffffffff
jb 0x409be3
push dword [ebp - 0x2228]
call fcn.0040cf72
add esp, 4
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x2240]
push ebx
push eax
call fcn.00409680
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x409c02
mov eax, dword [eax]
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp dword [ebp - 0x222c], 0x10
mov esi, eax
jb 0x409c31
push dword [ebp - 0x2240]
call fcn.0040cf72
add esp, 4
push 0x2000
lea eax, [ebp - 0x2210]
push eax
push edi
mov dword [ebp - 0x222c], 0xf
mov dword [ebp - 0x2230], 0
mov byte [ebp - 0x2240], 0
call fcn.00408c30
add esp, 0xc
mov dword [ebp - 0x2294], eax
test eax, eax
je 0x409ca7
jmp 0x409c70
push 0
lea ecx, [ebp - 0x2294]
push ecx
push eax
lea eax, [ebp - 0x2210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2000
lea eax, [ebp - 0x2210]
push eax
push edi
call fcn.00408c30
add esp, 0xc
mov dword [ebp - 0x2294], eax
test eax, eax
jne 0x409c70
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00408530
add esp, 4
push edi
call fcn.00408640
add esp, 4
cmp eax, 0xffffff9c
jne 0x409ac6
push edi
call fcn.004084f0
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052db16
mov esp, ebp
pop ebp
ret