joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4086c0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, ecx
push esi
mov dword [esp + 0x1c], edi
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4086e4
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 4
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push ebx
mov ebx, dword [esi + 8]
push ebp
mov ebp, dword [esi + 0xc]
xor esi, esi
mov dword [esp + 0x10], eax
cmp eax, esi
mov dword [esp + 0x2c], ecx
jge 0x408705
mov dword [esp + 0x10], esi
mov eax, esi
cmp ecx, esi
jge 0x40870f
mov dword [esp + 0x2c], esi
mov ecx, esi
mov edx, dword [edi + 0x34]
cmp ebx, edx
jle 0x408718
mov ebx, edx
mov edx, dword [edi + 0x38]
cmp ebp, edx
jle 0x408721
mov ebp, edx
push esi
push esi
push esi
push str.DISPLAY
sub ebx, eax
sub ebp, ecx
call dword [sym.imp.GDI32.dll_CreateDCW]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
mov dword [esp + 0x1c], esi
je 0x408810
push ebp
push ebx
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
push 0xcc0020
push eax
push ecx
push edi
push ebp
push ebx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
je 0x4087f9
push ebp
push ebx
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
push 0xcc0020
push edx
push eax
push ecx
push ebp
push ebx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x14]
push edx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov esi, dword [esp + 0x20]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4087f2
cmp eax, dword [esp + 0x18]
je 0x4087f2
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x18]
mov dword [esi + 0x40], eax
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0x24]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x18
ret 4

Function at 0x408910
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x408944
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, esi
call fcn.00408830
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4126ec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418888
push 0x40ffc4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
mov eax, dword [0x41ea88]
test eax, eax
je 0x412734
mov dword [ebp - 4], 1
call eax
jmp 0x412730
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
call 0x41273d
jmp 0x414998
push 0xa
call fcn.0041420d
push 0x16
call fcn.0041623a
pop ecx
pop ecx
push 3
call fcn.00413142

Function at 0x412742
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4188a0
push 0x40ffc4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
mov eax, dword [fcn.004126ec]
test eax, eax
je 0x41278a
mov dword [ebp - 4], 1
call eax
jmp 0x412786
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
call 0x412793
jmp fcn.004126ec
Function at 0x4012a7
Capabilities:
Set current directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.004041c2
pop ecx
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea edi, [eax - 1]
neg edi
sbb edi, edi
neg edi
test esi, esi
je 0x4012d6
push dword [esp + 0xc]
call fcn.004020c1
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x401bd3
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [0x425db4]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401c00
push edi
mov edi, dword [esp + 0xc]
movzx ecx, byte [edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4253a0]
inc edi
sub esi, 1
jne 0x401be7
pop edi
mov dword [0x425db4], edx
pop esi
ret
Function at 0x403041
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push 0x105
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x403064
cmp byte [esi], 0
je 0x403064
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x4030b2
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4221a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xc]
push eax
call fcn.0040b7d0
pop ecx
cmp eax, 8
jae 0x403175
push esi
xor esi, esi
lea eax, [ebp - 0x2c]
push esi
push esi
push esi
push esi
push esi
push 0x20
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x403115
mov eax, 0xffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00407f02
mov esp, ebp
pop ebp
ret 4
push 7
lea eax, [ebp - 0x2c]
push str.PKBACK
push eax
call fcn.0040375e
add esp, 0xc
test eax, eax
jne 0x4030ff
mov cl, byte [ebp - 0x2c]
lea eax, [ebp - 0x2c]
jmp 0x403141
cmp cl, 0x2e
je 0x403145
cmp cl, 0x20
je 0x403145
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x403134
cmp byte [eax], 0
je 0x4030ff
mov cl, byte [eax]
cmp cl, 0x30
jb 0x403156
cmp cl, 0x39
jbe 0x40316a
inc eax
jmp 0x40314a
movzx ecx, cl
sub ecx, 0x30
imul esi, esi, 0xa
cmp ecx, 9
ja 0x403170
add esi, ecx
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x403159
mov ax, si
jmp 0x403104
push 0x416
push str.sfxhead.c
call fcn.00404457
int3

Function at 0x40395f
Capabilities:
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
push esi
push 8
add edx, edx
pop esi
sar edx, 1
mov eax, ecx
xor eax, edx
shr ecx, 1
test al, 1
je 0x40397d
xor ecx, 0xedb88320
dec esi
test esi, esi
jg 0x40396b
mov eax, ecx
pop esi
ret 4
Function at 0x404220
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x4221a4]
xor eax, ebp
mov dword [ebp + 0x398], eax
push edi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x404318
lea eax, [ebp - 0x80]
mov edi, 0x209
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], edi
push eax
push str.winzip_shellopencommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x404318
push esi
lea esi, [ebp - 0x7c]
cmp word [ebp - 0x7c], ax
je 0x40429f
push ebx
xor ebx, ebx
push 4
push str.___1
push esi
call fcn.0040b5a8
add esp, 0xc
test eax, eax
je 0x40429e
add esi, 2
cmp word [esi], bx
jne 0x404282
pop ebx
lea ecx, [ebp - 0x7c]
mov eax, esi
sub eax, ecx
add eax, 2
push 0x425a80
sar eax, 1
sub edi, eax
lea eax, [esi + 2]
push str.__s_
push edi
push eax
call fcn.0040458a
mov eax, dword [0x422040]
add esp, 0x10
pop esi
test eax, 0x1000
je 0x4042fd
test eax, 0x8000
jne 0x4042fd
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x7a
pop ecx
push 0x69
lea eax, [ebp + eax*2 - 0x84]
mov word [eax], cx
pop ecx
mov word [eax + 2], cx
push 0x70
pop ecx
mov word [eax + 4], cx
push 0xffffffffffffffff
lea eax, [ebp - 0x7c]
push 0x41a350
push eax
call fcn.004045a6
add esp, 0xc
neg eax
sbb eax, eax
neg eax
jmp 0x40433e
push 0
push 0x7d0
call fcn.004037d9
push eax
push 0x40e
call fcn.004037d9
push eax
push dword [0x425378]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
pop edi
call fcn.00407f02
lea esp, [ebp + 0x39c]
pop ebp
ret
Function at 0x404457
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x11c]
sub esp, 0x19c
mov eax, dword [0x4221a4]
xor eax, ebp
mov dword [ebp + 0x118], eax
mov eax, dword [0x422b88]
mov ecx, eax
mov edx, dword [ebp + 0x124]
inc eax
mov dword [0x422b88], eax
push esi
test ecx, ecx
je 0x404492
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x128]
push edx
push 0x7d4
call fcn.004037d9
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x30
push 0x7d0
call fcn.004037d9
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x425378]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push str.WZSFX32.RPT
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40448a
push 0x41a3b8
lea eax, [ebp - 0x7c]
push 0x191
push eax
call fcn.0040b761
add esp, 0xc
lea eax, [ebp - 0x80]
push 0
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040b7d0
pop ecx
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.00403bdc
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WZSFX32.RPT
push 0x7d1
call fcn.004037d9
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x30
push 0x7d0
call fcn.004037d9
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x425378]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40448a
Function at 0x4045a6
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xfe8
mov eax, dword [0x4221a4]
xor eax, esp
mov dword [esp + 0xfe4], eax
push ebx
mov ebx, dword [esp + 0xff0]
lea eax, [esp + 0xa20]
push ebp
mov ebp, dword [esp + 0xffc]
push esi
mov esi, dword [esp + 0xffc]
push edi
push ebx
push 0x2e3
push eax
call fcn.0040b4c1
xor edi, edi
add esp, 0xc
cmp word [esi], di
je 0x40461d
push 0x41a2f0
lea eax, [esp + 0xa30]
push 0x2e3
push eax
call fcn.0040b4c1
push esi
lea eax, [esp + 0xa3c]
push 0x2e3
push eax
call fcn.0040b44c
add esp, 0x18
cmp ebp, 0xffffffff
jne 0x404675
push 0x10
lea eax, [esp + 0x14]
push edi
push eax
call fcn.004037ab
push 0x44
pop edi
push edi
xor ecx, ecx
lea eax, [esp + 0x30]
push ecx
push eax
call fcn.004037ab
add esp, 0x18
mov dword [esp + 0x20], edi
lea eax, [esp + 0x10]
xor edi, edi
push eax
lea eax, [esp + 0x24]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0xa4c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404675
mov eax, dword [esp + 0x10]
jmp 0x4047ad
lea eax, [esp + 0x464]
push eax
push edi
push ebx
call dword [sym.imp.SHELL32.dll_FindExecutableW]
mov edi, eax
cmp edi, 0x1f
jne 0x4046ec
mov ebp, 0x100
lea eax, [esp + 0x64]
push ebp
push eax
push 0xffffffffffffffff
push 0x427
call fcn.004037d9
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edi, edi
push eax
push edi
push edi
call esi
push ebx
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x46c]
push 0x2e3
push eax
call fcn.0040458a
add esp, 0x10
lea eax, [esp + 0x264]
push ebp
push eax
push 0xffffffffffffffff
push 0x7d0
call fcn.004037d9
push eax
push edi
push edi
call esi
push 0x10
jmp 0x40478f
cmp edi, 0x20
jbe 0x404732
xor eax, eax
xor ecx, ecx
cmp word [esi], cx
push 1
cmovne eax, esi
push ecx
push eax
mov eax, dword [0x422040]
and eax, 0x20000
neg eax
push ebx
sbb eax, eax
and eax, 0x41a2f4
push eax
push dword [0x425378]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
test ebp, ebp
je 0x404729
mov dword [ebp], edi
cmp edi, 0x20
jbe 0x404732
mov eax, edi
jmp 0x4047ad
mov ebp, 0x100
lea eax, [esp + 0x64]
push ebp
push eax
push 0xffffffffffffffff
push 0x400
call fcn.004037d9
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
xor eax, eax
push eax
push eax
call esi
push ebx
push edi
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x470]
push 0x2e3
push eax
call fcn.0040458a
add esp, 0x14
lea eax, [esp + 0x264]
push ebp
push eax
push 0xffffffffffffffff
push 0x7d0
call fcn.004037d9
push eax
xor ebx, ebx
push ebx
push ebx
call esi
push ebx
lea eax, [esp + 0x268]
push eax
lea eax, [esp + 0x46c]
push eax
push dword [0x425378]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0xff4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00407f02
add esp, 0xfe8
ret
Function at 0x40489f
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
sub esp, 0x220
lea ebp, [esp - 4]
mov eax, dword [0x4221a4]
xor eax, ebp
mov dword [ebp + 0x220], eax
push 0x140
mov eax, 0x419d33
call fcn.00407fc7
mov esi, dword [ebp + 0x22c]
lea eax, [ebp + 0x18]
push 0x104
push 0
push eax
call fcn.004037ab
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x4048e9
mov eax, dword [esi]
jmp 0x4048eb
mov eax, esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push 0x41a3bc
push eax
lea eax, [ebp + 0x18]
push eax
call ebx
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4049fd
push 0x104
lea eax, [ebp + 0x11c]
push 0
push eax
call fcn.004037ab
add esp, 0xc
test byte [ebp - 0x14c], 0x10
je 0x4049b6
lea eax, [ebp - 0x120]
push 0x41a380
push eax
call fcn.0040dd80
pop ecx
pop ecx
test eax, eax
je 0x4049e0
lea eax, [ebp - 0x120]
push 0x41a3c0
push eax
call fcn.0040dd80
pop ecx
pop ecx
test eax, eax
je 0x4049e0
cmp dword [esi + 0x14], 0x10
jb 0x404974
mov eax, dword [esi]
jmp 0x404976
mov eax, esi
lea ecx, [ebp - 0x120]
push ecx
push eax
lea eax, [ebp + 0x11c]
push eax
call ebx
lea eax, [ebp + 0x11c]
push eax
lea ecx, [ebp]
call fcn.00404868
and dword [ebp - 4], 0
lea eax, [ebp]
push eax
call fcn.0040489f
or dword [ebp - 4], 0xffffffff
pop ecx
push 0
push 1
lea ecx, [ebp]
call fcn.00404fe1
jmp 0x4049e0
cmp dword [esi + 0x14], 0x10
jb 0x4049c0
mov eax, dword [esi]
jmp 0x4049c2
mov eax, esi
lea ecx, [ebp - 0x120]
push ecx
push eax
lea eax, [ebp + 0x11c]
push eax
call ebx
lea eax, [ebp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x14c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404919
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esi + 0x14], 0x10
jb 0x404a05
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x220]
xor ecx, ebp
call fcn.00407f02
lea esp, [ebp + 0x224]
pop ebp
ret
Function at 0x404a35
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0xa8]
sub esp, 0x128
mov eax, dword [0x4221a4]
xor eax, ebp
mov dword [ebp + 0xa4], eax
push esi
mov esi, dword [ebp + 0xb0]
cmp dword [esi + 0x14], 0x10
jb 0x404a61
mov eax, dword [esi]
jmp 0x404a63
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x404af8
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
push edi
lea eax, [ebp + 0x84]
push 0x41a3c4
push eax
call fcn.0040482e
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x404a9a
mov eax, dword [esi]
jmp 0x404a9c
mov eax, esi
lea ecx, [ebp + 0x84]
push ecx
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x404ac9
inc edi
jmp 0x404a7b
xor edi, edi
lea eax, [ebp - 0x80]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp byte [ebp - 0x80], 0
je 0x404ae8
lea eax, [ebp - 0x80]
push eax
call fcn.0040b7d0
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x80]
mov ecx, esi
push eax
call fcn.0040523f
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp + 0xa4]
xor ecx, ebp
pop esi
call fcn.00407f02
lea esp, [ebp + 0xa8]
pop ebp
ret

Function at 0x404b0e
Capabilities:
Accept command line arguments

Disassembly:
push 0x20
mov eax, 0x419d66
call fcn.00407ffb
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp - 0x2c]
mov ebx, 0x41a3c8
push ecx
push ebx
push eax
jmp 0x404b61
push eax
lea ecx, [ebp - 0x28]
call fcn.00404868
lea eax, [ebp - 0x28]
mov dword [ebp - 4], edi
push eax
mov ecx, esi
call fcn.00405377
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push edi
push 1
call fcn.00404fe1
lea eax, [ebp - 0x2c]
push eax
push ebx
push edi
call fcn.0040dd33
add esp, 0xc
test eax, eax
jne 0x404b35
call fcn.00407fb6
ret

Function at 0x404b73
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x4221a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x103
jb 0x404ba7
xor eax, eax
jmp 0x404c20
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x208
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
je 0x404bf4
cmp byte [ebp - 0x310], 0
jne 0x404bde
xor eax, eax
jmp 0x404beb
lea eax, [ebp - 0x310]
push eax
call fcn.0040b7d0
pop ecx
push eax
lea eax, [ebp - 0x310]
jmp 0x404c15
cmp byte [ebp - 0x108], 0
jne 0x404c01
xor eax, eax
jmp 0x404c0e
lea eax, [ebp - 0x108]
push eax
call fcn.0040b7d0
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.0040523f
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00407f02
mov esp, ebp
pop ebp
ret
Function at 0x4056fc
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [0x425a4e]
test edi, edi
jg 0x405712
and dword [0x425da8], 0
xor eax, eax
pop edi
ret
mov eax, 0x800
cmp edi, eax
push esi
cmova edi, eax
push edi
push dword [0x425db0]
push dword [0x422b60]
call dword [sym.imp.KERNEL32.dll__lread]
cmp dword [0x422b80], 0
mov esi, eax
mov dword [0x425da8], esi
je 0x405790
cmp esi, 0xffffffff
je 0x405790
cmp esi, edi
je 0x4057a1
test esi, esi
js 0x405790
mov ax, word [0x422060]
push dword [0x422b84]
inc ax
movzx eax, ax
push eax
call fcn.004039a6
mov esi, dword [0x425da8]
test esi, esi
jne 0x40578a
push edi
push dword [0x425db0]
push dword [0x422b60]
call dword [sym.imp.KERNEL32.dll__lread]
mov esi, eax
mov dword [0x425da8], esi
cmp esi, 0xffffffff
cmovne edi, esi
cmp esi, edi
je 0x4057a1
push 2
call fcn.00401988
mov esi, dword [0x425da8]
sub dword [0x425a4e], esi
cmp dword [0x422b70], 0
mov edi, dword [0x425db0]
mov dword [0x425dac], edi
je 0x4057dd
test esi, esi
je 0x4057dd
call fcn.004075f4
xor byte [edi], al
movzx eax, byte [edi]
push eax
call fcn.004076ce
inc edi
pop ecx
sub esi, 1
jne 0x4057c0
mov esi, dword [0x425da8]
mov eax, esi
dec esi
mov dword [0x425da8], esi
pop esi
pop edi
ret
Function at 0x407646
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4221a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x422b7c]
mov esi, dword [ebp + 8]
call fcn.0040760e
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00403787
add esp, 0x10
xor esi, esi
call fcn.004075f4
movzx ecx, byte [ebp + esi - 0x10]
xor eax, ecx
mov byte [ebp + esi - 0x10], al
movzx eax, al
push eax
call fcn.004076ce
inc esi
pop ecx
cmp esi, 0xc
jl 0x407676
cmp dword [0x422b78], 0
movzx ecx, byte [ebp - 5]
pop esi
je 0x4076b5
movzx eax, byte [0x425a47]
cmp cx, ax
je 0x4076be
or eax, 0xffffffff
jmp 0x4076c0
movzx eax, byte [0x425a4d]
jmp 0x4076ab
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407f02
mov esp, ebp
pop ebp
ret

Function at 0x4076ce
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [0x425350]
mov eax, ecx
xor eax, dword [esp + 4]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x4253a0]
movzx eax, cl
add eax, dword [0x425354]
imul eax, eax, 0x8088405
mov dword [0x425350], ecx
mov ecx, dword [0x425358]
inc eax
mov dword [0x425354], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4253a0]
mov dword [0x425358], ecx
ret
Function at 0x414838
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x425798], 1
jae 0x4148be
mov byte [0x4215f0], 2
mov dword [0x4251e8], 0x4205bc
mov dword [0x4251ec], 0x4205d4
mov byte [0x425226], 2
mov dword [0x4251d4], 0x413954
call fcn.004120f8
test al, al
je 0x41487b
call fcn.00412128
call fcn.004121ec
mov word [0x42522c], 0xd7b0
mov word [0x4253f8], 0xd7b0
mov word [0x4255c4], 0xd7b0
call fcn.00413848
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x425218], eax
call fcn.00410164
mov dword [0x425214], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x42520c], eax
ret

Function at 0x41a750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x41a7b2
call fcn.0041a700
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004154e4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004154e4
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x41a830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4233c4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x41a90a
cmp dword [0x4233c0], 0
jne 0x41a90a
cmp dword [0x4235a4], 0
je 0x41a8c4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0041a600
add esp, 8
mov ebx, eax
test eax, eax
jne 0x41a8aa
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0041a600
add esp, 8
mov ebx, eax
test eax, eax
jne 0x41a8aa
lea ebx, [ebp - 0x84]
jmp 0x41a8ab
inc ebx
call fcn.0041a7ec
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x41a945
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4233c8
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004154e4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4233cb
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x41a945
cmp dword [0x4233c0], 0
je 0x41a924
cmp dword [0x4233c0], 0xffffffff
je 0x41a945
push esi
call dword [0x4233c0]
pop ecx
mov eax, dword [0x4233c4]
test eax, eax
je 0x41a945
cmp dword [0x4233c4], 0xffffffff
je 0x41a945
cmp byte [eax], 0
je 0x41a945
push esi
push eax
call fcn.0041a750
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret