joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5deba4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x5dec46
cmp dword [ebx + 0xac], 0
jne 0x5dec40
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5deae4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5dec40
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5dec06
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5dec40
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004acddc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5dec15
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5def88
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x614c6c]
cmp dword [eax + 0x190], 0
je 0x5df0f1
test bl, bl
jne 0x5df044
cmp dword [esi + 0xb4], 0
jne 0x5df039
mov eax, esi
call fcn.005e22ec
push eax
push 0x5dee88
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5df00a
mov eax, dword [0x614c6c]
cmp byte [eax + 0xeb], 0
je 0x5df00a
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5defeb
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5df00a
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5deff3
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5df039
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004acddc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5df019
inc dword [esi + 0xb4]
jmp 0x5df0f1
cmp dword [esi + 0xb4], 0
jle 0x5df0f1
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5df0f1
cmp dword [esi + 0x58], 0
je 0x5df0a6
mov eax, dword [0x614c6c]
cmp byte [eax + 0xeb], 0
je 0x5df0a6
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5df087
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5df0a6
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5df08f
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5df0d5
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004acddc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5df0b5
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5cf3d0]
call fcn.0040d1e8
pop edi
pop esi
pop ebx
ret
Function at 0x5dfee8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5dff45
cmp byte [ebx + 0xeb], 0
jne 0x5dff45
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a584
mov eax, dword [esi]
test eax, eax
je 0x5dff32
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5dff52
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a7dc
jmp 0x5dff52
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a7dc
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5e1b74
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5e1be5
mov eax, esi
call fcn.005520b0
test al, al
je 0x5e1be5
mov eax, dword [ebx + 0x98]
call fcn.00551c48
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5e1be5
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x5e1bd6
push 0
mov eax, dword [ebx + 0x98]
call fcn.00551c48
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00547e80
jmp 0x5e1be5
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005e1980
pop esi
pop ebx
ret
Function at 0x5e7700
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x94], 0
jne 0x5e7786
mov eax, dword [ebx + 8]
call fcn.00551c48
mov ecx, eax
mov dl, 1
mov eax, dword [0x55edfc]
call fcn.0054b72c
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
xor edx, edx
mov eax, esi
call fcn.00564454
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5e6fd0
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.00551c48
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.00551c48
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa4], 0
jne 0x5e7808
mov eax, dword [ebx + 8]
call fcn.00551c48
mov ecx, eax
mov dl, 1
mov eax, dword [0x55edfc]
call fcn.0054b72c
mov dword [ebx + 0xa4], eax
mov esi, dword [ebx + 0xa4]
mov dl, 1
mov eax, esi
call fcn.00564454
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5e701c
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa4]
call fcn.00551c48
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa4]
call fcn.00551c48
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5e7886
mov eax, dword [ebx + 8]
call fcn.00551c48
mov ecx, eax
mov dl, 1
mov eax, dword [0x55f8f0]
call fcn.0054b72c
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov byte [esi + 0x2b0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00551c48
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00551c48
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x2c9e4dc7
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x13546841
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x417e77
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [str.h_wy]
call fcn.00427c88
mov edi, dword [eax + 0x24]
test edi, edi
je 0x417f35
cmp dword [edi + 8], 1
je 0x417f35
mov edi, dword [edi + 0xc]
test edi, edi
je 0x417f35
mov al, byte [edi]
cmp al, 0x20
je 0x417eb0
cmp al, 9
jne 0x417eb3
inc edi
jmp 0x417ea6
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call esi
push dword [esp + 0x14]
mov ebx, eax
lea ecx, [ebx - 1]
push ecx
call fcn.00428b00
push ebx
mov ebp, eax
push ebp
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
test ebx, ebx
jle 0x417f04
push 9
pop edx
lea eax, [ebp - 2]
lea eax, [eax + ebx*2]
movzx ecx, word [eax]
push 0x20
pop esi
cmp cx, si
je 0x417f20
cmp cx, dx
je 0x417f20
pop edi
pop esi
pop ebp
pop ebx
ret 4
movzx ecx, word [eax]
cmp cx, si
je 0x417f18
cmp cx, dx
jne 0x417f24
xor ecx, ecx
mov word [eax], cx
sub eax, 2
cmp eax, ebp
jae 0x417f0b
push ebp
call sub.MSVCRT.dll_wcslen
pop ecx
sub ebx, eax
push ebx
call fcn.00428be0
jmp 0x417f04
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.00428de0
Function at 0x4038fc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408398]
jne 0x403906
repz ret
jmp fcn.00403dae

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x79ef633c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x58cf62e3
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.004014da

Function at 0x4014da
Capabilities:
Delete file
Encode data using base64 via winapi
Get common file path

Disassembly:
push ecx
push edx
enter 0x220, 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
sub eax, 0x41
leave
pop edx
pop ecx
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x218d1c2d
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..text_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x69c33f53
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x43ebb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x43ebce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x43ebc3
pop esi
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x56331278
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x43fb50eb
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401ea0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x40e458
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test eax, eax
je 0x401edf
push eax
lea eax, [esp + 8]
push 0x413034
push eax
jmp 0x401ef0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 8]
push 0x413034
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
add esp, 0xc
lea ecx, [esi + 0x1f0]
push edx
push eax
push ecx
call sub.MFC42.DLL_AfxFormatString1
mov edx, dword [esi + 0x21c]
lea ecx, [esi + 0x21c]
call dword [edx + 0x54]
mov eax, dword [esi + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 0x20]
push 0
push 1
push 0x8001
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.0040dbf4
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4043c0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e8c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
cmp byte [esi + 0xe4], 0xff
je 0x404404
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov al, byte [ebp + 0xc]
xor ebx, ebx
cmp al, bl
mov dword [ebp - 0x14], 1
jne 0x4044c9
cmp dword [esi + 0x60], ebx
jne 0x404439
mov ecx, esi
call fcn.00404100
mov ecx, dword [esi + 0x68]
mov edx, dword [eax + 0x14]
cmp ecx, edx
je 0x404440
push 0xffffffffffffff9a
mov ecx, esi
call fcn.00403d50
jmp 0x404440
mov dword [ebp - 0x14], 0xffffffff
mov ecx, esi
call fcn.00404100
cmp word [eax + 0xe], 8
jne 0x404457
lea edx, [esi + 0x28]
push edx
call fcn.004083c0
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x4044c9
lea eax, [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call sub.MFC42.DLL_CTime::GetTickCount
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
mov ecx, esi
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x11c], bl
call fcn.00404100
mov ecx, eax
call fcn.00407f00
mov edx, dword [eax]
lea eax, [ebp - 0x12c]
push eax
push edi
mov dword [ebp - 0x128], edx
call sub.MFC42.DLL_CFile::SetStatus
mov ecx, esi
call fcn.00404100
mov ecx, dword [eax + 0x24]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4044c2
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xe8]
call fcn.00406af0
lea ecx, [esi + 0x6c]
mov byte [esi + 0xe4], bl
call fcn.004062f0
mov ecx, esi
call fcn.00405340
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x404800
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x40e9a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_1
push 0x413178
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::TrimRight
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 8]
push ecx
push edx
call fcn.00404520
mov ecx, dword [esp + 0x24]
mov eax, dword [eax]
push ecx
push eax
mov byte [esp + 0x24], 1
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 0x10
or esi, 0xffffffff
test eax, eax
je 0x404882
mov edx, dword [esp + 0x1c]
push edx
call fcn.00404920
add esp, 4
cmp eax, esi
sete al
test al, al
jne 0x404882
xor bl, bl
jmp 0x404884
mov bl, 1
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call fcn.0040dbf4
test bl, bl
jne 0x4048fd
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00404520
mov eax, dword [eax]
mov byte [esp + 0x1c], 2
push eax
call fcn.00404800
add esp, 0xc
lea ecx, [esp + 8]
test al, al
sete bl
mov byte [esp + 0x14], 0
call fcn.0040dbf4
test bl, bl
jne 0x4048dd
mov edx, dword [esp + 0x1c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4048fd
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call fcn.0040dbf4
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call fcn.0040dbf4
mov ecx, dword [esp + 0xc]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x404920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40e9c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov esi, dword [esp + 0x30]
push 0
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x4049a6
push esi
call fcn.004049f0
add esp, 4
mov dword [esp + 0x28], 0xffffffff
test al, al
lea ecx, [esp + 4]
je 0x40498f
call fcn.0040dd7a
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
call fcn.0040dd7a
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
lea ecx, [esp + 4]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov eax, dword [esp + 4]
push 0x10
lea ecx, [esp + 8]
call dword [eax + 0x40]
neg eax
sbb eax, eax
lea ecx, [esp + 4]
and al, 0xfe
mov dword [esp + 0x28], 0xffffffff
inc eax
mov esi, eax
call fcn.0040dd7a
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x404f60
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
push ebx
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00404f90
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
lea ecx, [esp + 8]
sete bl
call fcn.0040dbf4
mov al, bl
pop ebx
ret

Function at 0x4050c0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
mov ecx, dword [esi + 0x14]
push ecx
mov ecx, esi
call fcn.00405220
mov edx, dword [esi + 0x18]
mov dword [esi + 0x14], eax
and eax, 0xff
mov ecx, esi
add eax, edx
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x18], eax
shr eax, 0x18
mov byte [esp + 8], al
mov eax, dword [esi + 0x1c]
mov edx, dword [esp + 8]
push edx
push eax
call fcn.00405220
mov dword [esi + 0x1c], eax
pop esi
ret 4

Function at 0x405a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40ec6e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebx
xor ebx, ebx
push esi
test eax, eax
mov esi, ecx
mov dword [esp + 8], ebx
jne 0x405ab6
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0x18]
push edx
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ebx, 1
mov dword [esp + 8], ebx
mov eax, dword [eax]
mov dword [esp + 0x28], ebx
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
test bl, 1
mov dword [esp + 0x28], 3
je 0x405add
and ebx, 0xfffffffe
lea ecx, [esp + 0x18]
mov dword [esp + 8], ebx
call fcn.0040dbf4
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.00404520
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
mov byte [esp + 0x38], 4
call fcn.004045f0
add esp, 0x10
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 5
call sub.MFC42.DLL_CString::CString
mov al, byte [esp + 0x34]
mov byte [esp + 0x28], 6
test al, al
je 0x405b2e
push 0x4132a0
lea ecx, [esp + 0x3c]
call fcn.0040dd56
jmp 0x405b44
mov ecx, dword [esi + 0x4c]
lea edx, [esp + 0x38]
push ecx
push str._.3d
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
call sub.MFC42.DLL_operator_1
push 0x413108
push eax
lea eax, [esp + 0x3c]
mov byte [esp + 0x30], 7
push eax
call sub.MFC42.DLL_operator_2
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x38]
push ecx
push eax
push esi
mov byte [esp + 0x34], 8
call sub.MFC42.DLL_operator_1
or ebx, 2
mov dword [esp + 8], ebx
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 7
call fcn.0040dbf4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 6
call fcn.0040dbf4
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 5
call fcn.0040dbf4
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.0040dbf4
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 3
call fcn.0040dbf4
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.0040dbf4
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x405ea0
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x40ece8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov ecx, dword [ecx + 0x1c]
lea edx, [esp + 4]
push ebx
push edx
mov eax, dword [ecx]
call dword [eax + 0x20]
mov eax, dword [eax]
mov dword [esp + 0x24], 0
push eax
lea eax, [esp + 8]
push eax
call fcn.00404f90
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
lea ecx, [esp + 4]
sete bl
call fcn.0040dbf4
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0040dbf4
test bl, bl
pop ebx
je 0x405f30
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x24
ret