joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d00
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebx
push esi
add esp, 0xfffff7bc
mov ebx, eax
mov byte [esp], dl
lea esi, [esp + 0x408]
cmp byte [esp], 0
je 0x401d96
xor eax, eax
mov al, byte [ebx]
cmp eax, 0x22
jne 0x401d46
lea edx, [ebx + 1]
lea eax, [esp + 8]
call fcn.0040326c
lea eax, [esp + 8]
mov edx, 0x22
call fcn.004031fc
test eax, eax
je 0x401d66
mov byte [eax], 0
jmp 0x401d66
lea eax, [esp + 8]
mov edx, ebx
call fcn.0040326c
mov edx, 0x4071d1
lea eax, [esp + 8]
call fcn.00403240
test eax, eax
je 0x401d66
mov byte [eax], 0
lea ecx, [esp + 8]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x401d96
mov edx, str..exe
lea eax, [esp + 8]
call fcn.0040331c
lea ecx, [esp + 8]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x401eed
mov al, byte [0x408b18]
test al, al
je 0x401dc0
xor edx, edx
mov dl, al
cmp edx, 0x20
je 0x401db4
mov edx, 0x4071d2
mov eax, ebx
call fcn.0040331c
mov edx, 0x408b18
mov eax, ebx
call fcn.0040331c
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.004031a4
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x1c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x401de9
lea edx, [ebx + 1]
jmp 0x401deb
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x401e3c
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x401e14
jmp 0x401e0d
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x401e0d
mov byte [ebx + eax], 0x20
jmp 0x401e14
inc eax
cmp byte [ebx + eax], 0
jne 0x401dfd
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x401e29
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x401e3b
cmp edx, 0x20
jne 0x401e32
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x401e43
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x401df2
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x448]
push ecx
push 0x400
push dword [esi + 0x10]
call sub.KERNEL32.DLL_GetFullPathNameA
test eax, eax
je 0x401e6b
lea eax, [esp + 0x444]
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], 1
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x401e95
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x401eed
cmp byte [0x40703c], 0
jne 0x401ea8
cmp byte [esp], 0
je 0x401eb2
push 0xffffffffffffffff
push dword [esi + 0x38]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
cmp byte [0x40703c], 0
je 0x401ed5
cmp byte [esp], 0
jne 0x401ed5
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x401eed
cmp byte [esp], 0
je 0x401ee2
mov edx, 0xc8
jmp 0x401ee7
mov edx, 0x3e8
push edx
call sub.KERNEL32.DLL_Sleep
add esp, 0x844
pop esi
pop ebx
ret
Function at 0x401ef6
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffff7e0
lea eax, [esp + 0x400]
push eax
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x400]
call fcn.004031ec
mov ecx, eax
mov edx, esp
lea eax, [esp + 0x400]
call fcn.004032c0
test eax, eax
jne 0x401f8d
push 0x4071d9
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.004031ec
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x800]
mov ecx, 0x1e
xor edx, edx
call fcn.004031a4
mov dword [esp + 0x804], 3
mov word [esp + 0x810], 0x14
mov eax, esp
mov dword [esp + 0x808], eax
lea edx, [esp + 0x800]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x820
ret

Function at 0x402168
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret

Function at 0x40292c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
mov ebx, 0x408b18
call sub.KERNEL32.DLL_GetCommandLineA
test eax, eax
je 0x402957
xor edx, edx
mov dl, byte [eax]
cmp edx, 0x22
jne 0x402957
inc eax
jmp 0x402951
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
je 0x402957
inc eax
mov dl, byte [eax]
test dl, dl
jne 0x402947
test eax, eax
je 0x4029b8
xor edx, edx
jmp 0x40297c
xor ecx, ecx
mov cl, byte [eax + edx]
cmp ecx, 0x20
je 0x40296e
cmp ecx, 0x2f
jne 0x40297b
mov ecx, ebx
add edx, eax
mov eax, ecx
call fcn.0040326c
jmp 0x402982
inc edx
cmp byte [eax + edx], 0
jne 0x40295f
xor eax, eax
jmp 0x4029b2
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x2d
je 0x402995
cmp edx, 0x2f
jne 0x4029b1
xor edx, edx
mov dl, byte [ebx + eax + 1]
cmp edx, 0x73
je 0x4029a5
cmp edx, 0x53
jne 0x4029b1
mov dword [0x407048], 1
jmp 0x4029b8
inc eax
cmp byte [ebx + eax], 0
jne 0x402986
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
mov dword [0x407e54], ebx
push 0x64
push ebx
call sub.USER32.DLL_LoadIconA
mov dword [0x408f18], eax
push str.RICHED32.DLL
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
push 0x400
push 0x408718
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov edx, 0x408718
mov eax, 0x407e78
call fcn.00403454
call fcn.0040100c
cmp dword [0x407044], 0
jle 0x402a18
mov eax, dword [0x407040]
call fcn.00403000
push dword [0x408f18]
call sub.GDI32.DLL_DeleteObject
push ebx
call sub.KERNEL32.DLL_FreeLibrary
cmp dword [0x40704c], 0
jne 0x402a45
cmp dword [0x407e5c], 0
je 0x402a45
mov dword [0x40704c], 0xff
mov dword [0x407e5c], 2
push dword [0x40704c]
call sub.KERNEL32.DLL_ExitProcess
pop ebx
ret
Function at 0x4038c8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7b4
push ebx
push esi
push edi
mov edi, eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 0xc]
push eax
mov esi, edx
mov edx, dword [ebp - 4]
mov eax, edi
lea ecx, [ebp - 8]
call fcn.00403ab4
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.USER32.DLL_GetWindowRect
lea edx, [ebp - 0x3c]
push edx
push esi
call sub.USER32.DLL_GetClientRect
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x2c]
inc ecx
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
inc eax
sub eax, dword [ebp - 0x30]
test bl, bl
mov dword [ebp - 0x14], eax
je 0x40395f
cmp byte [ebp + 8], 0
jne 0x40395f
mov eax, dword [ebp - 0x34]
mov ecx, 0x64
imul dword [ebp - 8]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x30]
imul dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
add eax, dword [ebp - 0x14]
pop ecx
push 0x206
push eax
push ecx
push 0
push 0
push 0
push esi
call sub.USER32.DLL_SetWindowPos
cmp byte [ebp + 8], 0
jne 0x40399c
push 0x400
lea eax, [ebp - 0x43c]
push eax
push esi
call sub.USER32.DLL_GetWindowTextA
push 1
push dword [ebp - 4]
lea ecx, [ebp - 0x43c]
lea edx, [ebp - 0x43c]
mov eax, edi
call fcn.00403750
lea edx, [ebp - 0x43c]
push edx
push esi
call sub.USER32.DLL_SetWindowTextA
push 8
call sub.USER32.DLL_GetSystemMetrics
sub dword [ebp - 0x14], eax
push 5
push esi
call sub.USER32.DLL_GetWindow
mov esi, eax
test esi, esi
je 0x403aa9
push 0x400
lea ecx, [ebp - 0x83c]
push ecx
push esi
call sub.USER32.DLL_GetWindowTextA
cmp byte [ebp - 0x83c], 0
je 0x4039f8
push 1
push dword [ebp - 4]
lea ecx, [ebp - 0x83c]
lea edx, [ebp - 0x83c]
mov eax, edi
call fcn.00403750
lea eax, [ebp - 0x83c]
push eax
push esi
call sub.USER32.DLL_SetWindowTextA
test bl, bl
je 0x403a97
lea edx, [ebp - 0x84c]
push edx
push esi
call sub.USER32.DLL_GetWindowRect
mov eax, dword [ebp - 0x84c]
sub eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
sar edx, 1
jns 0x403a20
adc edx, 0
sub eax, edx
mov ecx, 0x64
imul dword [ebp - 8]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x848]
sub eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x14]
imul dword [ebp - 0xc]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x844]
sub eax, dword [ebp - 0x84c]
inc eax
imul dword [ebp - 8]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x840]
sub eax, dword [ebp - 0x848]
inc eax
imul dword [ebp - 0xc]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
push 0x204
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push ecx
push 0
push esi
call sub.USER32.DLL_SetWindowPos
push 2
push esi
call sub.USER32.DLL_GetWindow
mov esi, eax
test esi, esi
jne 0x4039b8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403c38
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 0x408f9c
push edi
push ebp
mov ebp, edx
cmp dword [esi + 4], 0
mov edi, ecx
mov ebx, eax
jne 0x403c52
call fcn.00403c00
mov eax, ebp
cmp edi, 8
jb 0x403cdd
xor ebx, dword [eax]
xor edx, edx
mov dl, bl
sub edi, 8
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
xor ebx, dword [eax + 4]
add eax, 8
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x403c5d
xor edx, edx
jmp 0x403cf7
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [esi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp edi, edx
ja 0x403ce1
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403f6c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.00403054
test eax, eax
jne 0x403f89
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
xor eax, eax
pop esi
pop ebx
ret
or eax, 0xffffffff
pop esi
pop ebx
ret

Function at 0x404028
Capabilities:
Set file attributes

Disassembly:
push dword [0x4093cc]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
ret

Function at 0x404078
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop ebx
ret
Function at 0x4063f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], eax
mov eax, 0x40f4d8
mov edx, dword [esp]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
xor edx, dword [0x40f5d8]
mov dword [esp + 4], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
xor edx, dword [0x40f5dc]
mov dword [esp + 8], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ecx, dword [ecx + 8]
mov ebx, dword [edx + 0xc]
xor ecx, dword [0x40f5e0]
xor ebx, dword [0x40f5e4]
xor esi, esi
mov edx, ebx
mov edi, ebx
shr edi, 0x15
shl edx, 0xb
or edx, edi
mov edi, esi
and edi, 3
add edx, ecx
xor edx, dword [edi*4 + 0x40f5d8]
mov ebp, edx
mov edi, edx
shr ebp, 8
and edi, 0xff
and ebp, 0xff
movzx edi, byte [eax + edi]
movzx ebp, byte [eax + ebp]
shl ebp, 8
or edi, ebp
mov ebp, edx
shr ebp, 0x10
shr edx, 0x18
and ebp, 0xff
and edx, 0xff
movzx ebp, byte [eax + ebp]
movzx edx, byte [eax + edx]
shl ebp, 0x10
shl edx, 0x18
or edi, ebp
or edi, edx
mov edx, ecx
xor edi, dword [esp + 4]
mov dword [esp + 0xc], edi
mov edi, ecx
shr edi, 0xf
shl edx, 0x11
or edx, edi
mov edi, esi
and edi, 3
xor edx, ebx
inc esi
add edx, dword [edi*4 + 0x40f5d8]
mov ebp, edx
mov edi, edx
shr ebp, 8
and edi, 0xff
and ebp, 0xff
movzx edi, byte [eax + edi]
movzx ebp, byte [eax + ebp]
shl ebp, 8
or edi, ebp
mov ebp, edx
shr ebp, 0x10
shr edx, 0x18
and ebp, 0xff
and edx, 0xff
movzx ebp, byte [eax + ebp]
movzx edx, byte [eax + edx]
shl ebp, 0x10
shl edx, 0x18
or edi, ebp
or edi, edx
xor edi, dword [esp + 8]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov edx, edi
mov ebx, edx
mov ecx, dword [esp + 0xc]
cmp esi, 0x20
jl 0x40644b
mov eax, dword [esp + 0x10]
xor ecx, dword [0x40f5d8]
mov dword [eax], ecx
xor ebx, dword [0x40f5dc]
mov edx, dword [esp + 0x10]
mov dword [edx + 4], ebx
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x10]
xor ecx, dword [0x40f5e0]
mov dword [eax + 8], ecx
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
xor edx, dword [0x40f5e4]
mov dword [ecx + 0xc], edx
mov eax, dword [esp]
call fcn.0040670c
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40657c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov edi, 0x40f4d8
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov ecx, dword [edx]
xor ecx, dword [0x40f5d8]
mov dword [esp], ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [edx + 4]
xor ecx, dword [0x40f5dc]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0xc]
mov ebx, dword [edx + 8]
mov edx, dword [esp + 0xc]
xor ebx, dword [0x40f5e0]
mov esi, dword [edx + 0xc]
lea edx, [esp + 0x10]
xor esi, dword [0x40f5e4]
mov ecx, edx
mov edx, 0x10
xchg ecx, eax
xchg ecx, edx
call fcn.004031b8
mov edx, 0x1f
mov eax, esi
mov ecx, esi
shr ecx, 0x15
shl eax, 0xb
or eax, ecx
mov ecx, edx
and ecx, 3
add eax, ebx
xor eax, dword [ecx*4 + 0x40f5d8]
mov ebp, eax
mov ecx, eax
shr ebp, 8
and ecx, 0xff
and ebp, 0xff
movzx ecx, byte [edi + ecx]
movzx ebp, byte [edi + ebp]
shl ebp, 8
or ecx, ebp
mov ebp, eax
shr ebp, 0x10
shr eax, 0x18
and ebp, 0xff
and eax, 0xff
movzx ebp, byte [edi + ebp]
movzx eax, byte [edi + eax]
shl ebp, 0x10
shl eax, 0x18
or ecx, ebp
or ecx, eax
mov eax, ebx
xor ecx, dword [esp]
mov dword [esp + 8], ecx
mov ecx, ebx
shr ecx, 0xf
shl eax, 0x11
or eax, ecx
mov ecx, edx
and ecx, 3
xor eax, esi
dec edx
add eax, dword [ecx*4 + 0x40f5d8]
mov ebp, eax
mov ecx, eax
shr ebp, 8
and ecx, 0xff
and ebp, 0xff
movzx ecx, byte [edi + ecx]
movzx ebp, byte [edi + ebp]
shl ebp, 8
or ecx, ebp
mov ebp, eax
shr ebp, 0x10
shr eax, 0x18
and ebp, 0xff
and eax, 0xff
movzx ebp, byte [edi + ebp]
movzx eax, byte [edi + eax]
shl ebp, 0x10
shl eax, 0x18
or ecx, ebp
or ecx, eax
xor ecx, dword [esp + 4]
mov dword [esp], ebx
mov dword [esp + 4], esi
mov eax, ecx
mov esi, eax
mov ebx, dword [esp + 8]
test edx, edx
jge 0x4065de
mov eax, dword [esp + 0xc]
xor ebx, dword [0x40f5d8]
mov dword [eax], ebx
xor esi, dword [0x40f5dc]
mov edx, dword [esp + 0xc]
mov dword [edx + 4], esi
mov ecx, dword [esp]
mov eax, dword [esp + 0xc]
xor ecx, dword [0x40f5e0]
mov dword [eax + 8], ecx
lea eax, [esp + 0x10]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0xc]
xor edx, dword [0x40f5e4]
mov dword [ecx + 0xc], edx
call fcn.0040670c
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40670c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ecx, 0x40f5d8
mov ebx, 0x408f9c
xor edx, edx
movzx esi, byte [eax + edx]
mov esi, dword [ebx + esi*4]
xor dword [ecx], esi
movzx esi, byte [eax + edx + 1]
mov esi, dword [ebx + esi*4]
xor dword [ecx + 4], esi
movzx esi, byte [eax + edx + 2]
mov esi, dword [ebx + esi*4]
xor dword [ecx + 8], esi
movzx esi, byte [eax + edx + 3]
mov esi, dword [ebx + esi*4]
xor dword [ecx + 0xc], esi
add edx, 4
cmp edx, 0x10
jl 0x40671a
pop esi
pop ebx
ret
Function at 0x11282
Capabilities:
Print debug messages

Disassembly:
cmp dword [0x130b0], 0
jne 0x112d8
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [eax + 8]
shl ecx, 2
push ecx
push dword [eax]
push 0
call dword [sym.imp.ntoskrnl.exe_MmCreateMdl]
mov dword [0x130b0], eax
test eax, eax
jne 0x112ad
xor al, al
ret
push eax
call dword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
mov eax, dword [0x130b0]
or word [eax + 6], 1
push 0
push dword [0x130b0]
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov dword [0x130ac], eax
push 0x116e8
jmp 0x112dd
push 0x116c8
call sub.ntoskrnl.exe_DbgPrint
mov al, 1
pop ecx
ret
Function at 0x401570
Capabilities:
Create thread

Disassembly:
sub esp, 0x4c
push ebp
push esi
push 0x7f02
mov esi, ecx
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ebp, dword [sym.imp.USER32.dll_SetCursor]
push eax
call ebp
push 0
push 0x40000000
push 3
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xe8]
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x74], eax
jne 0x4015ec
push 0
push 0x4040ac
push 0x40409c
mov ecx, esi
call sub.MFC42.DLL_CWnd::MessageBoxA
mov eax, dword [esi + 0xe4]
mov dword [esi + 0x94], eax
add esi, 0x80
push esi
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
pop esi
pop ebp
add esp, 0x4c
ret
push edi
push 0
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_SetupComm]
mov ecx, dword [esi + 0x74]
push 0xf
push ecx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
xor edx, edx
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x14], edx
mov eax, 0x3e8
mov dword [esp + 0x18], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x20], edx
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
push ecx
mov dword [esp + 0x24], edx
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov ecx, dword [esi + 0x74]
lea edx, [esp + 0x24]
lea eax, [esp + 0x24]
push edx
push eax
push ecx
mov dword [esp + 0x30], 0x34
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
lea edx, [esp + 0x24]
mov ecx, esi
push edx
call fcn.00401c80
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 0x74]
lea ecx, [esp + 0x24]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
mov edi, dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
test eax, eax
jne 0x4016bc
mov eax, dword [esi + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0x404078
call sub.MFC42.DLL_AfxMessageBox
mov ecx, dword [esi + 0xe4]
lea edx, [esi + 0x80]
push edx
push 1
mov dword [esi + 0x94], ecx
call edi
jmp 0x4016f0
mov eax, dword [esi + 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [esi + 0x7c]
push ecx
push 0
push esi
push 0x401780
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x78], eax
jne 0x4016f0
mov edx, dword [esi + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xe0]
mov dword [esi + 0x94], eax
add esi, 0x80
push esi
push 1
call edi
mov ecx, dword [esp + 0xc]
push ecx
call ebp
pop edi
pop esi
pop ebp
add esp, 0x4c
ret
Function at 0x401720
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x78]
push 0xbb8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x401752
mov edx, dword [esi + 0x78]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x74]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetCommMask]
mov ecx, dword [esi + 0x74]
push 0xf
push ecx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov edx, dword [esi + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret
Function at 0x402b48
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040480c
test esi, esi
jne 0x402b7e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004048fc
jmp 0x402b9c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a5c
mov edi, eax
test esi, esi
je 0x402b9c
cmp dword [ebx], 0
je 0x402b9c
dec esi
jmp 0x402b85
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4031b8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4c7008], 0x8088405
inc edx
mov dword [ebx + 0x4c7008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40384c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4c7024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4038e4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4038c4
xor eax, eax
push ebp
push 0x4038bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403900
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4038c4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4c7024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4c7024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404690
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4ca04c], 0
je 0x4046f1
cmp word [0x4ca220], 0xd7b2
jne 0x4046b9
cmp dword [0x4ca228], 0
jbe 0x4046b9
mov eax, 0x4ca21c
call dword [0x4ca238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4c7074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404718
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4c7034], 0
jne 0x40470d
push 0
push 0x4c706c
push 0x4c7074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret