joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448690
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x480963
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00473dbb
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x7e6578
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x7e5078
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x48210c]
push eax
mov ecx, edi
call fcn.00479454
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0047a970
test eax, eax
je 0x4487ac
mov ecx, dword [esp + 0x3c]
call fcn.00479481
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4825d0]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x448770
push edi
mov ecx, esi
call fcn.00476aea
mov ecx, esi
call fcn.00448910
cmp dword [esp + 0x38], 1
jne 0x4487a5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00476c25
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x44b1b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44b1e3
push esi
call fcn.0044e2a0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44b1dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44b269
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44b252
mov eax, dword [esi + 8]
test eax, eax
je 0x44b207
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44b24e
cmp eax, 2
je 0x44b252
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44b1fa
cmp eax, 3
je 0x44b22d
cmp eax, 1
jne 0x44b1fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44b1fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44b1fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044b290
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44b278
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044b290
add esp, 4
pop esi
ret
Function at 0x45a370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4810d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
push eax
call dword [0x482400]
mov esi, dword [esp + 0x30]
test esi, esi
je 0x45a3b3
mov eax, dword [esi]
jmp 0x45a3b5
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x38]
push edx
push eax
push edi
call dword [ecx + 0x74]
test eax, eax
jge 0x45a3d6
push 0x7fd5b0
push edi
push eax
call fcn.0046ff21
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, edi
test esi, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov word [esp + 0xc], 0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
je 0x45a436
lea eax, [esi + 8]
push eax
call dword [0x482258]
test eax, eax
jne 0x45a436
mov eax, dword [esi]
test eax, eax
je 0x45a41d
push eax
call dword [0x4823dc]
mov eax, dword [esi + 4]
test eax, eax
je 0x45a42d
push eax
call fcn.0047254d
add esp, 4
push esi
call fcn.0047254d
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x45c7d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
cmp di, 0x76d
jb 0x45c925
cmp di, 0x801
ja 0x45c925
mov ebx, dword [esp + 0x28]
cmp bx, 1
jb 0x45c925
cmp bx, 0xc
ja 0x45c925
mov al, byte [esp + 0x30]
test al, al
je 0x45c824
push edi
call fcn.0045cd60
add esp, 4
cmp ax, bx
je 0x45c824
mov byte [esp + 0x30], 0
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x13]
lea ecx, [esp + 0x14]
mov word [esi], di
mov edi, dword [esp + 0x38]
push eax
lea edx, [esp + 0x1c]
mov word [edi], bx
mov ebx, dword [esp + 0x30]
push ecx
lea eax, [esp + 0x24]
mov word [ebp], bx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ebx
push ecx
push edx
call fcn.0045c930
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x30]
push ebx
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
call fcn.0045c750
add esp, 0x34
mov ebx, eax
xor eax, eax
inc eax
cmp eax, 0x64
mov dword [esp + 0x34], eax
jg 0x45c925
test ebx, ebx
jne 0x45c8b9
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x30]
cmp al, cl
je 0x45c91b
test al, al
je 0x45c8ac
push 0xffffffffffffffe1
jmp 0x45c8ae
push 0x1f
push ebp
push edi
push esi
call fcn.0045c700
add esp, 0x10
neg ebx
push ebx
push ebp
push edi
push esi
call fcn.0045c700
lea edx, [esp + 0x23]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
mov ax, word [ebp]
lea edx, [esp + 0x34]
push ecx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ecx
push edx
call fcn.0045c930
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
push edx
call fcn.0045c750
mov ebx, eax
mov eax, dword [esp + 0x78]
add esp, 0x44
jmp 0x45c886
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
Function at 0x45dfb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x481408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push 0x81e2b8
lea ecx, [esp + 4]
call fcn.00472851
push 0x80418c
lea ecx, [esp + 8]
mov dword [esp + 0x40], 0
call fcn.00472851
push 0x804188
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 1
call fcn.00472851
push 0x804184
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 2
call fcn.00472851
push 0x804180
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 3
call fcn.00472851
push 0x80417c
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 4
call fcn.00472851
push 0x804178
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 5
call fcn.00472851
push 0x804174
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 6
call fcn.00472851
push 0x804170
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 7
call fcn.00472851
push 0x80416c
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], 8
call fcn.00472851
push 0x804168
lea ecx, [esp + 0x2c]
mov byte [esp + 0x40], 9
call fcn.00472851
push 0x804164
lea ecx, [esp + 0x30]
mov byte [esp + 0x40], 0xa
call fcn.00472851
push 0x804160
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 0xb
call fcn.00472851
mov eax, dword [esp + 0x44]
mov byte [esp + 0x3c], 0xc
cmp eax, 1
jge 0x45e0e0
cmp eax, 0xc
jle 0x45e0e0
mov ecx, dword [esp + 0x48]
push 0x81e2b8
call fcn.00472920
jmp 0x45e0ee
mov ecx, dword [esp + 0x48]
lea eax, [esp + eax*4]
push eax
call fcn.004728d0
lea ecx, [esp + 0x30]
mov byte [esp + 0x3c], 0xb
call fcn.004727e3
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3c], 0xa
call fcn.004727e3
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 9
call fcn.004727e3
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 8
call fcn.004727e3
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 7
call fcn.004727e3
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 6
call fcn.004727e3
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 5
call fcn.004727e3
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 4
call fcn.004727e3
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 3
call fcn.004727e3
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 2
call fcn.004727e3
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call fcn.004727e3
lea ecx, [esp + 4]
mov byte [esp + 0x3c], 0
call fcn.004727e3
lea ecx, [esp]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004727e3
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x15031
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not eax
lahf
pushal
shld ax, bp, cl
mov dword [esp + 0x1c], ebp
test esp, ecx
rol bp, 6
test dh, 0x5e
lea ebp, [esp + 0x1c]
bswap ax
rol ah, 3
pushal
sub esp, 0xffffffdc
shld eax, esi, 0x14
shrd ax, di, cl
adc ax, 0xc150
push esi
sbb ah, ah
push edi
push ebx
clc
mov dword [esp], ebx
inc ax
stc
shr ah, cl
push edx
btc ax, ax
aaa
mov ah, ch
cmc
mov eax, dword [ebp + 8]
jmp 0x191e1
je 0x166fe
cmp bl, 1
sar si, 0xe
sbb si, ax
mov esi, dword [eax + 0x3c]
bsr dx, di
bsf edx, ebp
lea edx, [edi + 0x73da04]
rol dh, 7
add esi, eax
bswap dx
mov edx, dword [esi + 0x78]
cmp dx, bp
test edx, edx
pushfd
push 0x6c8aa0e2
lea esp, [esp + 8]
je 0x166fe
dec cl
add ch, al
btc cx, 1
call fcn.000199ef
push dword [esp + 4]
stc
cmp eax, edx
push ebp
lea esp, [esp + 0x28]
jb 0x1670b
cmc
jmp 0x19bc9
test eax, eax
jmp 0x1911b
Function at 0x40b5aa
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [ecx]
jne 0x40b5d8
mov eax, dword [ecx + 8]
mov edx, dword [eax]
call fcn.0040ac5f
inc ebp
push dword [ebx + edx - 0x73]
dec edx
add al, 0x6a
adc byte [ebp - 0x3d1707ab], cl
jmp 0x45cbdc12
xor eax, eax
leave
inc ebp
clc
add dword [eax], eax
add byte [eax], al
inc eax
xor bl, ch
sbb al, 0x8b
inc eax
jne 0x40b5bd
or al, ch
fld dword [eax]
call 0xdd9207d0
sbb al, 0x24
call 0x6c42f9d3
enter 0xc75, 0xffffffffffffff83
les ecx, [eax]
mov ecx, esi
fstp qword [ebp - 8]
call 0x3340cfb3
fld qword [ebp - 8]
xor eax, eax
fstp qword [esi]
mov dword [esi + 0x72], 0x940003
pop esi
add dword [eax], esi
or bh, al
add eax, 0x51189c
inc eax
xor bl, ch
sbb al, 0x8b
inc eax
jne 0x40b5fd
or al, ch
cdq
add al, ch
ficom word [ecx + 0x51]
fstp qword [esp]
call 0x6c42fb03
enter 0xc75, 0xffffffffffffff83
les ecx, [eax]
mov ecx, esi
fstp qword [ebp - 8]
call 0x3340cfb3
fld qword [ebp - 8]
xor eax, eax
fstp qword [esi]
mov dword [esi + 0x72], 0x940003
pop esi
add dword [eax], esi
or bh, al
Function at 0x469713
Capabilities:
Encode data using xor

Disassembly:
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl fcn.00469713
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x471f9f
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub dword [0x4d06e0], 1
jne 0x471fad
call fcn.00472089
mov eax, dword [0x4d2ff4]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4d2ff4], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x471fe5
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
sub dword [0x4d06e0], 1
jne 0x471ff8
call fcn.00472089
mov eax, dword [0x4d2ff4]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4d2ff4], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x47203b
fadd qword [0x4c81c0]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4c8190]
leave
ret

Function at 0x472049
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4d2630], ecx
inc esi
mov edx, esi
mov eax, dword [edx*4 + 0x4d262c]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [edx*4 + 0x4d2630], eax
inc edx
cmp edx, 0xd880270
jl 0x472055
mov dword [0x4d06e0], esi
mov dword [0x4d2ff0], esi
pop esi
ret

Function at 0x472089
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4d2ff0], 0
push esi
push edi
mov esi, 0x4d2630
jne 0x4720ac
push 0
call fcn.0042e52b
pop ecx
mov ecx, eax
call 0x8a472049
mov dword [0x4d06e0], 0xd880270
mov edx, 0xe3
mov dword [0x4d2ff4], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ecx, eax
and al, 1
and ecx, 0x7f2c24fe
movzx eax, al
xor ecx, dword [esi]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi + 0xd880634]
mov dword [esi], ecx
add esi, 4
sub edx, 1
jne 0x4720c1
mov eax, dword [esi]
mov dword [ebp - 4], 0xd445018c
mov edi, dword [esi + 4]
mov ecx, eax
xor ecx, edi
and ecx, 0x7f2c24fe
xor ecx, eax
mov eax, edi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edi
xor ecx, dword [esi - 0x38c]
sub dword [ebp - 4], 1
mov dword [esi], ecx
lea esi, [esi + 4]
jne 0x4720fb
mov eax, dword [0x4d2630]
mov ecx, edi
xor ecx, eax
and al, 1
and ecx, 0x7f2c24fe
movzx eax, al
xor ecx, edi
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
leave
ret
Function at 0x49b55f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
xor edx, edx
inc edx
movzx ebx, word [edi]
mov ecx, ebx
and ecx, edx
mov dword [ebp - 8], ecx
cmp esi, 0x50120100
jae 0x49b5d2
mov eax, ebx
and eax, 2
test bl, 4
jne 0x49b5b0
jmp 0x4a2b19
jmp 0x4a2a3e
push 2
pop ecx
add edi, ecx
and bl, cl
je 0x49b5de
add edi, 0x20
movzx ebx, word [edi]
test bx, bx
je 0x1563b6e0
mov eax, esi
mov dword [ebp - 0xc], 0x151a0080
cdq
idiv dword [ebp - 0xc]
mov dword [ebp - 0x18], 0xd8803
mov dword [ebp - 0x14], edx
xor edx, edx
mov dword [ebp - 0x10], eax
inc edx
add edi, ecx
movzx eax, word [edi]
mov ecx, eax
cmp bx, dx
jne 0x49b64f
add edi, 2
cmp dword [ebp + 8], 0
je 0x49b642
and eax, 0xdfc00
cmp eax, 0xdd800
jne 0x49b642
movzx eax, word [edi]
mov ebx, 0x3ff
and ecx, ebx
and eax, ebx
shl ecx, 0xa
or ecx, eax
add ecx, 0x50010000
add edi, 2
cmp esi, ecx
je 0x8851b943
jmp 0x8851b6d1
push 2
pop eax
cmp bx, ax
jne 0x1563b6e8
add edi, eax
cmp dword [ebp + 8], 0
je 0x49b6bd
mov eax, ecx
and eax, 0x8808fc00
push 2
pop ebx
cmp eax, 0xdd800
jne 0x49b68d
movzx eax, word [edi]
mov edx, 0x3ff
and ecx, edx
and eax, edx
shl ecx, 0xa
or ecx, eax
add ecx, 0x50010000
add edi, ebx
movzx edx, word [edi]
add edi, ebx
mov eax, edx
and eax, 0xdfc00
cmp eax, 0xdd800
jne 0x49b6c2
movzx eax, word [edi]
and edx, 0x3ff
shl edx, 0xa
and eax, 0x3ff
or edx, eax
add edx, 0x50010000
add edi, ebx
jmp 0x49b6c2
movzx edx, word [edi]
add edi, eax
cmp esi, ecx
jb 0x49b6ce
cmp esi, edx
jbe 0x49b940
xor edx, edx
inc edx
movzx ebx, word [edi]
push 2
pop ecx
test bx, bx
jne 0x49b607
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
xor edx, edx
inc edx
mov eax, dword [ebp - 8]
xor eax, edx
jmp 0x49b6e3
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x1003680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x1008080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x10080a1
mov eax, 0xff
call fcn.01003680
xor byte [esi], al
inc esi
dec ebx
jne 0x1008091
pop esi
pop ebx
ret
Function at 0x40737c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040a5dc
test esi, esi
jne 0x4073b2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040a774
jmp 0x4073d0
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004072c0
mov edi, eax
test esi, esi
je 0x4073d0
cmp dword [ebx], 0
je 0x4073d0
dec esi
jmp 0x4073b9
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x409224
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004096e4
mov byte [esp], al
cmp byte [esp], 0
jne 0x4093ad
test edi, edi
je 0x4093ad
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4092ed
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4092c8
cmp edi, 0xffffffff
je 0x409289
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409289
mov byte [esp], 0
jmp 0x4093ad
cmp dword [esi], 1
jg 0x4092c8
cmp dword [esi], 0
jne 0x4092ba
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4092ba
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4093ad
lea eax, [esp + 0xc]
call fcn.00408ed4
dec ebp
test ebp, ebp
jg 0x40926e
cmp edi, 0xffffffff
je 0x4092ed
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4092eb
mov byte [esp], 0
jmp 0x4093ad
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x409232
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4092ed
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00409428
mov edx, eax
mov ebx, dword [0x61f8fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x409351
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40934f
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x409351
xor edi, edi
cmp byte [esp], 0
je 0x409377
mov ebx, dword [esi]
test bl, 1
jne 0x40938d
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409357
mov byte [esp + 1], 1
jmp 0x40938d
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409377
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x409304
cmp byte [esp], 0
je 0x4093ad
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40a274
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x61f05c], 0
je 0x40a2db
cmp word [0x61f348], 0xd7b2
jne 0x40a29d
cmp dword [0x61f350], 0
jbe 0x40a29d
mov eax, 0x61f344
call dword [0x61f360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40a308
call fcn.0040adf4
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x619036], 0
jne 0x40a2f7
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40a49c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x619038], 0
je 0x40a4c7
mov edx, edi
mov eax, esi
call dword [0x619038]
mov ebx, eax
jmp 0x40a4d8
mov eax, 8
call fcn.00406fec
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x61f05d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40a464
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40a508
mov eax, ebx
call fcn.00407008
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc