joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4037e0
Capabilities:
Accept command line arguments
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
mov eax, 0x40ee50
push ebx
call fcn.00406ca0
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
test ebx, ebx
je 0x40380e
mov eax, ebx
call fcn.00403980
push ebx
push str.sfxcmd
call sub.KERNEL32.DLL_SetEnvironmentVariableA
push 0x400
push 0x40de34
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x40de34
push str.sfxname
call sub.KERNEL32.DLL_SetEnvironmentVariableA
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
mov dword [0x40d58c], eax
push 0x64
push ebx
call sub.USER32.DLL_LoadIconA
mov dword [0x40e234], eax
push 0x65
push dword [0x40d58c]
call sub.USER32.DLL_LoadBitmapA
mov dword [0x40e238], eax
lea eax, [ebp - 8]
call fcn.004054f4
mov edx, 0x40de34
mov eax, 0x40d594
call fcn.00404c58
lea eax, [ebp - 0x20]
call fcn.004041c0
lea eax, [ebp - 0x38]
call fcn.004041c0
push 0
push 0x4010a3
lea edx, [ebp - 0x20]
push 0
mov dword [0x40e63c], edx
lea ecx, [ebp - 0x38]
push str.STARTDLG
push ebx
mov dword [0x40e640], ecx
call sub.USER32.DLL_DialogBoxParamA
xor eax, eax
xor edx, edx
mov dword [0x40d55c], eax
mov dword [0x40e640], edx
mov dword [0x40e63c], edx
mov edx, 2
lea eax, [ebp - 0x38]
call fcn.004041e4
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004041e4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405568
cmp byte [0x40ccd0], 0
je 0x4038f2
call fcn.0040289a
mov eax, 0x40dda8
mov ecx, 0x80
xor edx, edx
call fcn.00406f50
cmp dword [0x40c054], 0
jle 0x403916
mov eax, dword [0x40c048]
call fcn.00406d68
push dword [0x40e234]
call sub.GDI32.DLL_DeleteObject
mov eax, dword [0x40e238]
test eax, eax
je 0x403930
push eax
call sub.GDI32.DLL_DeleteObject
cmp dword [0x40d580], 0
jne 0x403951
cmp dword [0x40d564], 0
je 0x403951
mov eax, 0x40d580
mov edx, 0xff
call fcn.00406b48
mov dword [0x40d564], 2
mov eax, dword [0x40c05c]
test eax, eax
je 0x403969
call fcn.0040286c
push dword [0x40d580]
call sub.KERNEL32.DLL_ExitProcess
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403af8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov dword [0x40d574], 1
mov ebx, dword [0x40d55c]
test ebx, ebx
je 0x403b20
mov eax, 0x7d
call fcn.00402b38
push eax
push 1
push ebx
call sub.USER32.DLL_SetDlgItemTextA
xor edx, edx
mov dword [0x40d578], edx
mov dword [0x40d57c], 1
mov eax, dword [0x40d55c]
test eax, eax
je 0x403b79
push 1
push eax
call sub.USER32.DLL_ShowWindow
cmp dword [0x40c054], 0
jne 0x403b70
cmp byte [0x40c018], 0
jne 0x403b70
push 0
push 1
push 0x111
push dword [0x40d55c]
call sub.USER32.DLL_SendMessageA
jmp 0x403b70
call fcn.00402bb4
cmp dword [0x40d564], 2
jne 0x403b6b
cmp byte [0x40ccd0], 0
je 0x403b87
call fcn.0040289a
pop ebx
ret
Function at 0x40420c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
cmp byte [ebx + 0x14], 0
mov edi, edx
mov esi, ecx
jne 0x404231
push 0
call sub.OLE32.DLL_OleInitialize
call sub.COMCTL32.DLL_InitCommonControls
mov byte [ebx + 0x14], 1
mov byte [ebx + 0x15], 0
push 0
push esi
call sub.USER32.DLL_ShowWindow
mov edx, edi
mov eax, ebx
call fcn.00404368
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebx + 0x10], ecx
push eax
push esi
call sub.USER32.DLL_GetWindowRect
push 2
lea edx, [ebp - 0x10]
push edx
push esi
call sub.USER32.DLL_GetParent
push eax
push 0
call sub.USER32.DLL_MapWindowPoints
mov eax, dword [ebx + 4]
test eax, eax
je 0x404277
push eax
call sub.USER32.DLL_DestroyWindow
push ebx
push dword [ebx]
push 0
push esi
call sub.USER32.DLL_GetParent
push eax
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
add ecx, 0xfffffffe
push ecx
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0x40000000
push 0
push str.RarHtmlClassName
push 0
call sub.USER32.DLL_CreateWindowExA
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
je 0x4042c8
push 5
push edi
call sub.USER32.DLL_ShowWindow
push dword [ebx + 4]
call sub.USER32.DLL_UpdateWindow
cmp byte [ebx + 0x15], 0
jne 0x404345
mov eax, dword [ebx + 4]
test eax, eax
je 0x4042e0
push eax
call sub.USER32.DLL_DestroyWindow
xor edx, edx
mov dword [ebx + 4], edx
push 5
push esi
call sub.USER32.DLL_ShowWindow
mov eax, dword [ebp + 8]
call fcn.00406fac
add eax, eax
lea eax, [eax + eax*2]
add eax, 0x100
call fcn.00406d54
mov edi, eax
mov edx, dword [ebp + 8]
mov eax, edi
call fcn.0040702c
mov edx, edi
mov eax, ebx
call fcn.004049a4
test al, al
jne 0x404321
mov edx, edi
mov eax, ebx
call fcn.004049dc
mov edx, edi
mov eax, ebx
call fcn.0040481c
mov ebx, eax
mov eax, edi
call fcn.00406d68
test ebx, ebx
je 0x404345
push ebx
push esi
call sub.USER32.DLL_SetWindowTextA
mov eax, ebx
call fcn.00406d68
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40455c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [esp], eax
xor edx, edx
mov dword [esp + 4], edx
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
jmp 0x4045c2
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x2710
ja 0x4045d3
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
call sub.USER32.DLL_PeekMessageA
test eax, eax
je 0x4045c2
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
call sub.USER32.DLL_GetMessageA
lea ecx, [esp + 8]
push ecx
call sub.USER32.DLL_TranslateMessage
lea eax, [esp + 8]
push eax
call sub.USER32.DLL_DispatchMessageA
push esp
push esi
mov edx, dword [esi]
call dword [edx + 0x48]
test eax, eax
jl 0x40457a
cmp dword [esp], 0
je 0x40457a
xor ebx, ebx
cmp dword [esp], 0
je 0x40461d
lea eax, [esp + 4]
push eax
push 0x40cc60
mov edx, dword [esp + 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x40461d
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x20]
test eax, eax
jl 0x404613
push edi
mov ecx, dword [esp + 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
test eax, eax
setge bl
and ebx, 1
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, ebx
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x405128
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ac
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov esi, edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.00405324
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
push esi
call sub.USER32.DLL_GetWindowRect
lea edx, [ebp - 0x44]
push edx
push esi
call sub.USER32.DLL_GetClientRect
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x34]
inc ecx
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
inc eax
sub eax, dword [ebp - 0x38]
test bl, bl
mov dword [ebp - 0x18], eax
je 0x4051bf
cmp byte [ebp + 8], 0
jne 0x4051bf
mov eax, dword [ebp - 0x3c]
mov ecx, 0x64
imul dword [ebp - 0xc]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x38]
imul dword [ebp - 0x10]
cdq
mov edi, 0x64
idiv edi
add ecx, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0x206
push eax
push ecx
push 0
push 0
push 0
push esi
call sub.USER32.DLL_SetWindowPos
cmp byte [ebp + 8], 0
jne 0x4051fd
push 0x400
lea eax, [ebp - 0x444]
push eax
push esi
call sub.USER32.DLL_GetWindowTextA
push 1
push dword [ebp - 8]
lea ecx, [ebp - 0x444]
lea edx, [ebp - 0x444]
mov eax, dword [ebp - 4]
call fcn.00404fac
lea edx, [ebp - 0x444]
push edx
push esi
call sub.USER32.DLL_SetWindowTextA
push 8
call sub.USER32.DLL_GetSystemMetrics
sub dword [ebp - 0x18], eax
push 5
push esi
call sub.USER32.DLL_GetWindow
mov edi, eax
mov dword [ebp - 0x1c], edi
xor esi, esi
jmp 0x40530b
push 0x400
lea eax, [ebp - 0x844]
push eax
push edi
call sub.USER32.DLL_GetWindowTextA
cmp byte [ebp - 0x844], 0
je 0x40525c
push 1
push dword [ebp - 8]
lea ecx, [ebp - 0x844]
lea edx, [ebp - 0x844]
mov eax, dword [ebp - 4]
call fcn.00404fac
lea edx, [ebp - 0x844]
push edx
push edi
call sub.USER32.DLL_SetWindowTextA
test bl, bl
je 0x4052fb
lea ecx, [ebp - 0x854]
push ecx
push edi
call sub.USER32.DLL_GetWindowRect
mov eax, dword [ebp - 0x854]
sub eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x14]
sar edx, 1
jns 0x405284
adc edx, 0
sub eax, edx
mov ecx, 0x64
imul dword [ebp - 0xc]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x850]
sub eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x18]
imul dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x84c]
sub eax, dword [ebp - 0x854]
inc eax
imul dword [ebp - 0xc]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x848]
sub eax, dword [ebp - 0x850]
inc eax
imul dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
push 0x204
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ecx
push 0
push edi
call sub.USER32.DLL_SetWindowPos
push 2
push edi
call sub.USER32.DLL_GetWindow
mov edi, eax
cmp edi, dword [ebp - 0x1c]
je 0x40531b
inc esi
test edi, edi
je 0x40531b
cmp esi, 0x200
jl 0x40521b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405ef0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.004053c8
test eax, eax
je 0x405f16
test ebx, ebx
je 0x405f16
cmp word [ebx], 0
je 0x405f16
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x405f1e
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x405f31
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.00406148
xor eax, eax
jmp 0x405f4c
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x405f40
cmp eax, 3
jne 0x405f47
mov eax, 2
jmp 0x405f4c
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x4060f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.004053c8
test eax, eax
je 0x40611f
test ebx, ebx
je 0x40611f
cmp word [ebx], 0
je 0x40611f
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x406148
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.004053c8
test eax, eax
je 0x406175
test ebx, ebx
je 0x406175
cmp word [ebx], 0
je 0x406175
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x406184
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x406298
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, 0x40e64c
push ebp
mov ebp, edx
cmp dword [edi + 4], 0
mov esi, ecx
mov ebx, eax
jne 0x4062b2
call fcn.00406260
mov eax, ebp
jmp 0x4062ca
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x4062d2
test al, 7
jne 0x4062b6
cmp esi, 8
jb 0x40635b
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x4062db
xor edx, edx
jmp 0x406375
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [edi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp esi, edx
ja 0x40635f
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406414
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x406437
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x406448
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x406457
or dword [ebp - 8], 2
xor eax, eax
cmp byte [ebx + 0x15], 0
jne 0x406464
add eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.004053c8
test eax, eax
je 0x406491
test esi, esi
je 0x406491
cmp word [esi], 0
je 0x406491
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x4064a8
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x4064c1
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x4064c1
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x40652b
mov dword [ebx + 4], edi
test esi, esi
je 0x4064f6
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.00406c18
jmp 0x4064ff
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x406512
lea eax, [ebx + 0x17]
mov edx, dword [ebp - 4]
call fcn.0040702c
jmp 0x406521
lea edx, [ebx + 0x17]
mov ecx, 0x1000000
mov eax, esi
call fcn.00406bbc
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.004065e8
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4067a4
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x4067cb
cmp esi, 0x4e20
jle 0x4067c1
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40681c
mov eax, ebx
call fcn.00406984
test al, al
je 0x406803
cmp esi, 0x4e20
jle 0x406803
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.004067a4
jmp 0x40681f
cmp dword [ebx + 0xc], 1
jne 0x406817
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x406817
xor eax, eax
jmp 0x40681f
or eax, 0xffffffff
jmp 0x40681f
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40725c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
add esp, 0xffffffe8
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
mov eax, esp
call fcn.004071c0
mov esi, eax
mov eax, dword [0x41b6ec]
call fcn.00406e94
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push 0x41b704
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
mov eax, dword [0x40f5ec]
mov eax, dword [eax + 0x10]
test al, 0x5f
je 0x4072b4
and eax, 0x7f
push eax
push 0x41b704
call sub.KERNEL32.DLL_SetFileAttributesA
cmp ebx, 0xffffffff
je 0x4072fc
test esi, esi
je 0x4072f6
test esi, 1
je 0x4072c9
mov eax, esp
jmp 0x4072cb
xor eax, eax
test esi, 2
je 0x4072d9
lea edx, [esp + 8]
jmp 0x4072db
xor edx, edx
test esi, 4
je 0x4072e9
lea ecx, [esp + 0x10]
jmp 0x4072eb
xor ecx, ecx
mov esi, ecx
push eax
push edx
push esi
push ebx
call sub.KERNEL32.DLL_SetFileTime
push ebx
call sub.KERNEL32.DLL_CloseHandle
add esp, 0x18
pop esi
pop ebx
ret
Function at 0x4098f0
Capabilities:
Set file attributes

Disassembly:
mov edx, 0x40c7de
mov eax, 0x41b704
call fcn.00406e38
mov dword [0x41b6ec], eax
test eax, eax
jne 0x409959
push 0
push 0x41b704
call sub.KERNEL32.DLL_SetFileAttributesA
mov edx, 0x40c7de
mov eax, 0x41b704
call fcn.00406e38
mov dword [0x41b6ec], eax
test eax, eax
jne 0x409959
mov eax, 0x40d580
mov edx, 9
call fcn.00406b48
push 0x41b704
mov eax, 0x6e
call fcn.00402b38
push eax
call fcn.004030f0
add esp, 8
mov eax, 1
ret
xor eax, eax
ret

Function at 0x409ae8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
cmp dword [0x40efc8], 0
jg 0x409b06
dec dword [0x40efc8]
xor eax, eax
mov dword [0x41b600], eax
or eax, 0xffffffff
pop esi
pop ebx
ret
cmp dword [0x41b600], 0
jg 0x409b5b
push dword [0x41b61c]
mov ecx, 0x2000
mov edx, 1
mov eax, dword [0x41b5f8]
call fcn.00406ee0
mov dword [0x41b600], eax
test eax, eax
jne 0x409b40
xor edx, edx
or eax, 0xffffffff
mov dword [0x41b600], edx
pop esi
pop ebx
ret
add dword [0x41b624], 0x2000
mov edx, dword [0x41b5f8]
mov dword [0x41b5fc], edx
call fcn.004099ac
mov ecx, dword [0x40f5ec]
test byte [ecx + 0x14], 1
je 0x409b92
mov esi, dword [0x41b600]
mov ebx, dword [0x41b5fc]
jmp 0x409b89
call fcn.0040ad4c
xor byte [ebx], al
mov al, byte [ebx]
and eax, 0xff
call fcn.0040ad70
inc ebx
mov edx, esi
add esi, 0xffffffff
test edx, edx
jne 0x409b75
dec dword [0x41b600]
mov ecx, dword [0x41b5fc]
inc dword [0x41b5fc]
xor eax, eax
mov al, byte [ecx]
pop esi
pop ebx
ret

Function at 0x409c5c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x409c6b
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x40ac92
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, eax
mov eax, edx
call fcn.0040addc
mov eax, esp
mov ecx, 0xc
mov edx, ebx
call fcn.00406f64
xor ebx, ebx
call fcn.0040ad4c
xor byte [esp + ebx], al
mov al, byte [esp + ebx]
and eax, 0xff
call fcn.0040ad70
inc ebx
cmp ebx, 0xc
jl 0x40acb0
mov edx, dword [0x40f5ec]
xor eax, eax
mov al, byte [esp + 0xb]
test byte [edx + 0x14], 2
je 0x40ace9
movzx ecx, word [0x41b64a]
sar ecx, 8
jmp 0x40acf5
mov ecx, dword [0x41b650]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x40ad01
or eax, 0xffffffff
jmp 0x40ad44
mov edx, dword [0x41b600]
cmp edx, dword [0x40efc8]
jle 0x40ad17
mov ebx, dword [0x40efc8]
jmp 0x40ad1d
mov ebx, dword [0x41b600]
mov esi, dword [0x41b5fc]
jmp 0x40ad39
call fcn.0040ad4c
xor byte [esi], al
mov al, byte [esi]
and eax, 0xff
call fcn.0040ad70
inc esi
mov edx, ebx
add ebx, 0xffffffff
test edx, edx
jne 0x40ad25
xor eax, eax
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x40ad70
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x41b810]
push ebx
mov ecx, edx
mov ebx, dword [0x41b5f0]
xor ecx, eax
and ecx, 0xff
shr edx, 8
mov ecx, dword [ebx + ecx*4]
xor ecx, edx
mov dword [0x41b810], ecx
and ecx, 0xff
add dword [0x41b814], ecx
imul edx, dword [0x41b814], 0x8088405
inc edx
mov dword [0x41b814], edx
shr edx, 0x18
mov ecx, dword [0x41b818]
xor edx, ecx
mov ebx, dword [0x41b5f0]
and edx, 0xff
shr ecx, 8
mov edx, dword [ebx + edx*4]
xor edx, ecx
mov dword [0x41b818], edx
pop ebx
ret

Function at 0x40afb8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
jne 0x40afcc
xor eax, eax
jmp 0x40b0c4
call fcn.0040afb0
xor ebx, 0xffffffff
cmp edi, 8
jb 0x40b0a1
xor edx, edx
sub edi, 8
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x40afdd
test edi, edi
je 0x40b0bf
xor edx, edx
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
dec edi
mov ebx, ecx
jne 0x40b0a5
mov eax, ebx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
Function at 0x10001190
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x421c
call fcn.10007b80
mov eax, dword [0x10020170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20a]
push edx
mov dword [ebp - 0x421c], eax
mov word [ebp - 0x20c], cx
call fcn.10007bb0
xor eax, eax
push 0x3ffe
push eax
lea ecx, [ebp - 0x420a]
push ecx
mov word [ebp - 0x420c], ax
call fcn.10007bb0
mov eax, esi
add esp, 0x18
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001200
sub eax, edx
sar eax, 1
cmp eax, 0xb
jne 0x10001384
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x1001b1a8
lea edx, [ebp - 0x20c]
push 0x1001b1f4
push edx
call esi
add esp, 0x10
lea eax, [ebp - 0x4210]
push eax
push 1
push 0
lea ecx, [ebp - 0x20c]
push ecx
push 0x80000002
mov dword [ebp - 0x4218], 0x104
mov dword [ebp - 0x4214], 1
mov dword [ebp - 0x4210], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100012a8
mov eax, dword [ebp - 0x4210]
test eax, eax
je 0x100012a8
lea edx, [ebp - 0x4218]
push edx
push edi
lea ecx, [ebp - 0x4214]
push ecx
push 0
push 0x1001b200
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x4210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100012b0
sub eax, edx
sar eax, 1
je 0x10001384
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10007bb0
push ebx
push edi
lea ecx, [ebp - 0x20c]
push 0x1001b214
push ecx
call esi
add esp, 0x1c
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10001384
push edi
push edi
push 0x1001b220
lea eax, [ebp - 0x420c]
push 0x2000
push eax
call fcn.10007b5c
mov eax, dword [ebp - 0x421c]
add esp, 0x14
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001324
lea edi, [ebp - 0x420c]
sub eax, edx
add edi, 0xfffffffe
lea ebx, [ebx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10001340
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x420c]
push ecx
push str.Path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007b4d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10007b4d
mov esp, ebp
pop ebp
ret