joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412990
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
push esi
je 0x4129f4
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4129f4
mov edx, dword [esp + 0x14]
test edx, edx
je 0x4129f4
mov ecx, dword [esp + 0x1c]
xor eax, eax
test ecx, ecx
je 0x4129b6
mov dword [ecx], esi
mov ecx, dword [esp + 0x18]
cmp ecx, esi
jb 0x4129f6
push ebp
mov ebp, ecx
push edi
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop ebp
test esi, esi
jbe 0x4129ea
mov ecx, ebx
mov eax, edx
sub ecx, edx
mov dl, byte [ecx + eax]
xor dl, 0x54
mov byte [eax], dl
inc eax
dec esi
jne 0x4129de
pop esi
mov eax, 1
pop ebx
ret 0x14
xor eax, eax
pop esi
pop ebx
ret 0x14

Function at 0x412d30
Capabilities:
Get file size

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0xffffffff
jne 0x412da9
mov eax, dword [esi + 0x28]
test eax, eax
je 0x412d5c
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
jne 0x412d68
xor eax, eax
pop esi
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x500000
jbe 0x412d99
mov eax, dword [esi + 0x24]
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esi + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, 1
pop esi
ret
mov edx, dword [esi + 0x24]
push 2
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, 1
pop esi
ret

Function at 0x434080
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b82b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esp
xor eax, eax
push 0x4ea948
lea ecx, [esi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi + 0xc], esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x24], edi
call fcn.0049d265
mov eax, dword [ebp + 0xc]
lea ebx, [esi + 0x28]
push eax
mov ecx, ebx
call fcn.0049d265
mov ecx, ebx
call fcn.00496d1c
mov ecx, ebx
call fcn.00496c25
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x30]
test eax, eax
jne 0x434112
mov dword [esi + 0x2c], eax
mov dword [esi + 8], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
push 0
push edi
mov dword [esi + 0x2c], 1
mov dword [ebp - 4], 0
call fcn.004594c0
mov ecx, dword [esi + 4]
call fcn.004596b0
mov ecx, dword [esi + 4]
push 0
mov dword [esi + 8], eax
mov dword [ebp - 4], 0xffffffff
call fcn.00459de0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x436f00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x436f24
push 0x20019
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00436850
add esp, 0xc
mov ebx, eax
jmp 0x436f27
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4370de
call fcn.00451210
test eax, eax
je 0x437011
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x436f48
mov dword [ebp + 0x10], eax
jmp 0x436f7b
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.0041fce0
mov ecx, dword [ebp + 0x10]
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp + 0x10], edi
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 4]
push 0
push eax
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4370d0
mov eax, dword [ebp - 4]
cmp eax, 1
je 0x436fb5
cmp eax, 2
je 0x436fb5
cmp eax, 6
je 0x436fb5
cmp eax, 7
jne 0x4370d0
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.0049c3d1
mov esi, eax
mov eax, dword [ebp + 0xc]
mov edi, esi
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push esi
push 0
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push esi
jne 0x4370bb
mov ecx, dword [ebp + 0x14]
call fcn.0043f420
cmp ebx, dword [ebp + 8]
je 0x4370a3
jmp 0x43709a
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 4]
push 0
push eax
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4370d0
mov eax, dword [ebp - 4]
cmp eax, 1
je 0x43704b
cmp eax, 2
je 0x43704b
cmp eax, 6
je 0x43704b
cmp eax, 7
jne 0x4370d0
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.0049c3d1
mov esi, eax
mov eax, dword [ebp + 0xc]
mov edi, esi
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push esi
push 0
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push esi
jne 0x4370bb
mov ecx, dword [ebp + 0x14]
call fcn.0043f4f0
cmp ebx, dword [ebp + 8]
je 0x4370a3
push ebx
call fcn.004368a0
add esp, 4
push esi
call fcn.0049c3fa
add esp, 4
mov eax, 1
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0049c3fa
mov ecx, dword [ebp + 0x14]
add esp, 4
push 0x4ea948
call fcn.0043f4f0
cmp ebx, dword [ebp + 8]
je 0x4370de
push ebx
call fcn.004368a0
add esp, 4
lea esp, [ebp - 0x10]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437750
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
push esi
test eax, eax
push edi
je 0x437771
mov edi, dword [esp + 0xc]
push 0x20006
push eax
push edi
call fcn.004368e0
add esp, 0xc
mov esi, eax
jmp 0x437777
mov edi, dword [esp + 0xc]
mov esi, edi
test esi, esi
je 0x4377b8
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4377ab
cmp esi, edi
je 0x4377a3
push esi
call fcn.004368a0
add esp, 4
pop edi
mov eax, 1
pop esi
ret
cmp esi, edi
je 0x4377b8
push esi
call fcn.004368a0
add esp, 4
pop edi
xor eax, eax
pop esi
ret

Function at 0x437980
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b8648
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x4379b8
push 0x20006
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004368e0
add esp, 0xc
mov edi, eax
jmp 0x4379bb
mov edi, dword [ebp + 8]
test edi, edi
je 0x437aa7
call fcn.00451210
test eax, eax
je 0x437a3e
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x4379d7
xor ebx, ebx
jmp 0x437a07
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.0041fce0
mov ecx, dword [ebp + 0x10]
mov ebx, esp
push esi
push ebx
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [ebp + 0x14]
push esi
call fcn.0041fb58
add esp, 4
lea edx, [eax + eax + 2]
push edx
push esi
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x437a99
cmp edi, dword [ebp + 8]
je 0x437a37
push edi
call fcn.004368a0
add esp, 4
mov eax, 1
jmp 0x437aa9
mov eax, dword [ebp + 0x14]
lea ecx, [ebp + 0x14]
push eax
call fcn.00438fe0
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax - 8]
inc ecx
push ecx
mov ecx, dword [ebp + 0x10]
push eax
push 1
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x437a8a
cmp edi, dword [ebp + 8]
je 0x437a74
push edi
call fcn.004368a0
add esp, 4
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.004397e0
mov eax, 1
jmp 0x437aa9
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.004397e0
cmp edi, dword [ebp + 8]
je 0x437aa7
push edi
call fcn.004368a0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4385c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x20]
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push 0
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4386c9
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4386da
mov eax, dword [esp + 0x18]
cmp eax, 0x104
jae 0x438614
mov eax, 0x104
mov dword [esp + 0x18], eax
inc eax
push eax
call fcn.0049c3d1
mov esi, eax
add esp, 4
test esi, esi
je 0x4386c9
mov edx, dword [esp + 0x18]
xor eax, eax
mov edi, esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [edx + 1]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
inc eax
push eax
push esi
push 0
push ebx
call ebp
test eax, eax
jne 0x4386c0
push 0x2001f
push esi
push ebx
call fcn.00436850
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4386c0
push edi
call fcn.004385c0
add esp, 4
test eax, eax
push edi
je 0x4386e5
call fcn.004368a0
add esp, 4
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x4386c0
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x4386d1
mov ecx, dword [esp + 0x18]
xor eax, eax
inc ecx
mov edi, esi
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
inc eax
push eax
push esi
push 0
push ebx
call ebp
test eax, eax
je 0x438657
push esi
call fcn.0049c3fa
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push esi
call fcn.0049c3fa
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
call fcn.004368a0
push esi
call fcn.0049c3fa
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4389d0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x438a20
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x438b70
push 0
push 0
call fcn.00420e3d
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x438a20
mov ecx, dword [esi + 0x18]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x438a0f
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x438a50
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x438a5e
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x438a89
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [esi + 0xc], 0
mov eax, 1
pop esi
ret
Function at 0x43d630
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
push esi
mov esi, dword [esp + 0x10]
and ebp, 0xf
shr eax, 4
inc eax
push edi
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x43d689
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x43d689
xor edi, edi
xor ebx, ebx
mov bx, word [esi]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, edi
je 0x43d690
inc edi
lea esi, [esi + ebx*2]
cmp edi, 0x10
jl 0x43d66d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec eax
push eax
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x43d68b
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x443160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x4431b0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4431b0
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x4431b5
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x44319b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x4431c2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x451e60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 4
not eax
jb 0x451eda
push edi
mov edi, esi
shr edi, 2
mov ebx, dword [edx]
add edx, 4
xor eax, ebx
sub esi, 4
mov ecx, eax
mov ebx, eax
and ecx, 0xff
shr ebx, 8
mov eax, dword [ecx*4 + 0x4c2f7c]
xor eax, ebx
mov ecx, eax
and ecx, 0xff
shr eax, 8
mov ecx, dword [ecx*4 + 0x4c2f7c]
xor ecx, eax
mov eax, ecx
and eax, 0xff
shr ecx, 8
mov eax, dword [eax*4 + 0x4c2f7c]
xor eax, ecx
mov ecx, eax
and ecx, 0xff
shr eax, 8
mov ecx, dword [ecx*4 + 0x4c2f7c]
xor eax, ecx
dec edi
jne 0x451e7b
pop edi
mov ecx, esi
dec esi
test ecx, ecx
je 0x451f00
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x4c2f7c]
xor eax, ecx
inc edx
dec esi
jne 0x451ee2
pop esi
pop ebx
not eax
ret

Function at 0x454c30
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x108]
push edi
mov dword [esp + 0x14], ecx
xor edx, edx
xor eax, eax
mov al, byte [edx + str.80_]
mov ecx, eax
and eax, 7
sar ecx, 3
mov bl, byte [eax*2 + 0x4c338c]
mov cl, byte [ecx + esi]
test bl, cl
setne al
mov byte [esp + edx + 0x50], al
inc edx
cmp edx, 0x38
jl 0x454c47
mov eax, 0x1e
xor ebx, ebx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x110], 1
je 0x454c88
lea eax, [ebx + ebx]
lea edi, [esp + eax*4 + 0x8c]
lea ebp, [esp + eax*4 + 0x88]
xor eax, eax
xor ecx, ecx
mov cl, byte [ebx + 0x4c3434]
mov dword [edi], 0
mov esi, ecx
mov dword [ebp], 0
mov edx, esi
cmp edx, 0x1c
jge 0x454cbc
mov cl, byte [esp + edx + 0x50]
jmp 0x454cc0
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x1c
jl 0x454cb1
mov eax, 0x1c
lea edx, [esi + 0x1c]
cmp edx, 0x38
jge 0x454cde
mov cl, byte [esp + edx + 0x50]
jmp 0x454ce2
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x38
jl 0x454cd3
xor edx, edx
mov eax, 0x4c339c
xor ecx, ecx
mov cl, byte [edx + 0x4c3444]
cmp byte [esp + ecx + 0x18], 0
je 0x454d0d
mov ecx, dword [eax]
mov esi, dword [ebp]
or esi, ecx
mov dword [ebp], esi
xor ecx, ecx
mov cl, byte [edx + 0x4c345c]
cmp byte [esp + ecx + 0x18], 0
je 0x454d24
mov ecx, dword [eax]
mov esi, dword [edi]
or esi, ecx
mov dword [edi], esi
add eax, 4
inc edx
cmp eax, str.80_
jl 0x454cf4
mov eax, dword [esp + 0x10]
inc ebx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x454c7b
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x88]
push edx
call fcn.00454d70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf8
ret 8
Function at 0x4583b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0041fce0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x45847b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x45847b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x45842e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x458439
or bh, 8
and edi, 0x8000000
je 0x458454
mov eax, dword [0x4f12fc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x45847b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458850
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x45887b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x45889f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4588ba
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x4598d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, ecx
push edi
push ebp
lea edi, [esi + 0xec]
mov ecx, edi
call fcn.0045f510
test al, al
jne 0x4598f1
pop edi
pop esi
pop ebp
ret 4
lea ecx, [esi + 0x78]
call fcn.0045d980
cmp eax, 1
jne 0x459906
pop edi
pop esi
xor al, al
pop ebp
ret 4
mov al, byte [esi + 0xe8]
test al, al
je 0x459918
pop edi
pop esi
xor al, al
pop ebp
ret 4
lea ecx, [esi + 0x20]
call fcn.0045ea30
push ebp
mov ecx, edi
call fcn.0045f530
mov ecx, dword [esi + 0x114]
call fcn.0045d4a0
test al, al
je 0x4599cf
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x45994a
pop edi
pop esi
xor al, al
pop ebp
ret 4
mov dword [esi + 0x14], 0x12345678
mov dword [esi + 0x18], 0x23456789
mov dword [esi + 0x1c], 0x34567890
mov eax, dword [esi + 0x10]
xor edi, edi
test eax, eax
jbe 0x4599bb
mov eax, dword [esi + 0xc]
mov cl, byte [edi + eax]
mov eax, dword [esi + 0x14]
mov byte [esp + 0x10], cl
mov ecx, esi
mov edx, dword [esp + 0x10]
push edx
push eax
call fcn.0045c3d0
mov edx, dword [esi + 0x18]
mov dword [esi + 0x14], eax
and eax, 0xff
add eax, edx
mov edx, dword [esi + 0x1c]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x18], eax
shr eax, 0x18
mov byte [esp + 0x10], al
mov ecx, dword [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0045c3d0
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x10]
inc edi
cmp edi, eax
jb 0x459968
mov ecx, esi
call fcn.0045c150
test al, al
jne 0x4599cf
push 0xffffffffffffff94
mov ecx, esi
call fcn.00459570
mov eax, dword [esi + 0x114]
mov di, word [eax + 0xe]
test di, di
je 0x4599ed
cmp di, 8
je 0x4599f3
push 0xffffffffffffff9b
mov ecx, esi
call fcn.00459570
cmp di, 8
jne 0x459a2a
mov al, byte [esi + 4]
test al, al
je 0x459a02
lea eax, [esi + 0xcc]
jmp 0x459a04
xor eax, eax
push 0x38
push str.1.1.4
lea ecx, [esi + 0x28]
push 0xfffffffffffffff1
push ecx
mov dword [esi + 0x50], eax
call fcn.0048fe90
test eax, eax
je 0x459a2a
cmp eax, 2
je 0x459a2a
push eax
mov ecx, esi
call fcn.00459570
mov ecx, dword [esi + 0x114]
mov edx, dword [ecx + 0x18]
mov dword [esi + 0x64], edx
call fcn.0045d4a0
test al, al
je 0x459a43
add dword [esi + 0x64], 0xfffffff4
mov eax, dword [esi + 0x114]
pop edi
mov ecx, dword [eax + 0x1c]
mov dword [esi + 0x68], 0
mov dword [esi + 0x60], ecx
mov dword [esi + 0x3c], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0xe8], 0xff
pop esi
mov al, 1
pop ebp
ret 4