joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4413e0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x441413
push esi
call fcn.0044f7a0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44140c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x441499
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x441482
mov eax, dword [esi + 8]
test eax, eax
je 0x441437
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44147e
cmp eax, 2
je 0x441482
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44142a
cmp eax, 3
je 0x44145d
cmp eax, 1
jne 0x44142a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44142a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44142a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004414c0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4414a8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004414c0
add esp, 4
pop esi
ret

Function at 0x441d40
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x441d61
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x441d61
mov eax, dword [eax + 0x44]
test eax, eax
je 0x441d61
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x46fe9a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46fed2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046df51
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046df29
jmp 0x46fede
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47158b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4715cd
call fcn.00477044
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4715cd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4715c4
xor eax, eax
jmp 0x4715d5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004715db
pop edi
pop esi
pop ebx
ret 4
Function at 0x477574
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4775a2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4775c0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004774da
jmp 0x4775c0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4775c0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004774da
test edi, edi
mov eax, edi
jne 0x4775aa
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0xd62470
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0xd9dc60]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.00d7b750
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0xd6253f
mov eax, 0xd965bc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0xd624b5
sub eax, edx
sar eax, 1
je 0xd6253f
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [fcn.00d91238]
push 0xd965bc
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.00d7a33a
push 0xd965b4
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00d79de1
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0xd6253f
push eax
push 1
push 0x200
push esi
call fcn.00d7a657
mov eax, dword [esp + 0x14]
push eax
call fcn.00d7a08f
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00d79b65
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.00d79b65
add esp, 0x214
ret

Function at 0xd62720
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0x3e8
mov dword [esp + 0x10], 0
call dword [0xd91250]
push 0xd965b4
lea eax, [esp + 0x10]
push 0xdc2960
push eax
call fcn.00d79de1
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0xd62851
push 2
push 0
push eax
call fcn.00d7aacf
mov ecx, dword [esp + 0x18]
add esp, 0xc
push ecx
call fcn.00d7acf1
mov esi, eax
add esp, 4
push esi
call fcn.00d6f800
mov edx, dword [esp + 0x10]
add esp, 4
push 0
push 0
push edx
mov edi, eax
call fcn.00d7aacf
mov eax, dword [esp + 0x18]
add esp, 0xc
push eax
push esi
push 1
push edi
call fcn.00d7a657
add esp, 0x10
cmp esi, eax
jne 0xd62833
call dword [0xd9123c]
push eax
call fcn.00d7aa11
add esp, 4
call fcn.00d7aa23
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0xd987a0]
fmul qword [0xd98798]
fadd qword [0xd98790]
call fcn.00d7c7a0
cmp esi, eax
jl 0xd62833
mov ebx, edi
sub ebx, eax
add ebx, esi
call fcn.00d626d0
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00d7a08f
add esp, 4
push 0xdc2960
call dword [0xd91230]
push 0xd962c4
lea edx, [esp + 0x10]
push 0xdc2960
push edx
call fcn.00d79de1
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0xd62851
push eax
push esi
push 1
push edi
call fcn.00d79f96
add esp, 0x10
mov eax, dword [esp + 0xc]
test eax, eax
je 0xd62844
push eax
call fcn.00d7a08f
add esp, 4
test edi, edi
je 0xd62851
push edi
call fcn.00d6f7f5
add esp, 4
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0xd64710
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
xor ebp, ebp
push esi
mov ebx, ecx
push edi
mov edi, eax
mov dword [esp + 0x10], ebp
cmp ebx, ebp
je 0xd64801
cmp edi, 0xa
jb 0xd64801
lea eax, [edi*4]
mov dword [esp + 0x14], eax
inc eax
push eax
call fcn.00d79bc3
add esp, 4
mov esi, eax
push esi
push ebx
lea edx, [esp + 0x1c]
mov ecx, edi
call fcn.00d64590
add esp, 8
test eax, eax
je 0xd647fa
mov eax, dword [esp + 0x1c]
push 0xd962c4
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00d79de1
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
jne 0xd64785
lea ebp, [eax - 2]
jmp 0xd647b0
mov edi, dword [esp + 0x14]
push eax
push edi
push 1
push esi
call fcn.00d79f96
add esp, 0x10
cmp eax, edi
je 0xd647c7
mov ebp, 0xfffffffe
mov eax, dword [esp + 0x10]
test eax, eax
je 0xd647b0
push eax
call fcn.00d7a08f
add esp, 4
test esi, esi
je 0xd647bd
push esi
call fcn.00d79c8d
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [0xd9123c]
call edi
xor edx, edx
mov ecx, 0x1f4
div ecx
mov ebx, edx
call edi
xor edx, edx
mov ecx, 0x3e8
div ecx
mov eax, dword [esp + 0x10]
push eax
push ebx
push 1
add edx, esi
push edx
call fcn.00d79f96
add esp, 0x10
jmp 0xd6479f
mov ebp, 0xfffffffd
jmp 0xd6479f
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret
Function at 0xd66580
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0xd66587
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0xd66664
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xd98130]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0xd98130]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0xd98130]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xd98130]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xd98130]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xd98130]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xd98130]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xd98130]
inc ecx
sub edx, 8
sub esi, 1
jne 0xd665a0
pop edi
test edx, edx
je 0xd6668b
jmp 0xd66670
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0xd98130]
inc ecx
sub edx, 1
jne 0xd66670
not eax
pop esi
ret

Function at 0xd66690
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0xd98130]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0xd98130]
mov dword [edx + 8], ecx
ret

Function at 0xd666e0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0xd98130]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0xd98130]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0xd67ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0xd67afe
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0xd67af2
cmp dword [edi + 0x7c], ebx
je 0xd67b0d
call fcn.00d67ec0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00d67850
add esp, 0xc
test eax, eax
je 0xd67b34
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x7e
call fcn.00d79bc3
mov esi, eax
add esp, 4
cmp esi, ebx
je 0xd67b72
push 0x4000
call fcn.00d79bc3
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0xd67b7f
push esi
call fcn.00d79c8d
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0xd67bc7
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00d669a0
test eax, eax
jne 0xd67bc7
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0xd67bee
mov cl, byte [edi + 0x39]
mov byte [esi + 0x7d], cl
jmp 0xd67bf4
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x7d], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x6d]
mov dword [esi + 0x79], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x71], 0x23456789
mov dword [esi + 0x75], 0x34567890
cmp ebp, ebx
je 0xd67c31
lea ecx, [ecx]
mov cl, byte [ebp]
cmp cl, bl
je 0xd67c31
call fcn.00d66690
add ebp, 1
jne 0xd67c20
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41696a
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x448778]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4169cd
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
test eax, eax
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
pop ebx
call fcn.00425434
leave
ret

Function at 0x4169dd
Capabilities:
Get common file path

Disassembly:
push 0x60
mov eax, 0x43a226
call fcn.004254d8
mov ebx, dword [ebp + 8]
push 0x208
call fcn.004253f6
mov edi, eax
pop ecx
mov dword [ebp - 0x6c], edi
lea esi, [edi + 0x208]
push esi
push edi
mov dword [ebp - 0x64], esi
call fcn.00401489
mov dword [ebp - 0x68], esi
and dword [ebp - 4], 0
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x416a2a
xor ebx, ebx
jmp 0x416ae0
and dword [ebp - 0x28], 0
xor eax, eax
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.004014a7
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004014a7
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004118b1
lea ecx, [ebp - 0x40]
call fcn.00401a66
lea ecx, [ebp - 0x58]
call fcn.00401a66
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
jb 0x416a8a
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0x14]
mov ebx, eax
cmp ecx, 8
jb 0x416acf
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edx
cmp ecx, 0x1000
jb 0x416ac6
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004019a9
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x60]
push ecx
push edx
call fcn.00425426
pop ecx
pop ecx
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test edi, edi
je 0x416af0
sub esi, edi
and esi, 0xfffffffe
push esi
push edi
call fcn.004012a7
mov eax, ebx
call fcn.00425487
ret 4
Function at 0x41df66
Capabilities:
Hide graphical window

Disassembly:
push 0x38
mov eax, 0x43a678
call fcn.004254d8
mov ebx, ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov al, byte [ebp + 0x18]
push 0
push edi
mov dword [ebp - 0x3c], edi
mov dword [ebx + 8], edi
mov byte [ebx + 0x42], al
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
mov ecx, ebx
call fcn.0041dc84
cmp dword [ebx + 0x20], 0
je 0x41dfb2
push dword [ebx + 0x20]
call fcn.0042cd87
pop ecx
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x41dfc0
push eax
call fcn.0042e243
pop ecx
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x41dfd1
push eax
call fcn.0042e243
pop ecx
mov dword [ebx + 0x24], eax
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
cmp dword [ebx + 4], 0
je 0x41e004
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
push ebx
push dword [ebx]
sub esi, eax
lea edi, [eax + 1]
push 0
push dword [ebp - 0x3c]
sub esi, 2
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
push eax
push esi
push dword [ebp - 0x34]
push edi
push 0x40000000
xor edi, edi
push edi
push 0x43c854
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp byte [ebx + 0x1c], 0
mov dword [ebx + 4], eax
jne 0x41e08e
cmp dword [ebx + 0x10], edi
jne 0x41e08e
mov esi, dword [ebp - 0x3c]
test esi, esi
je 0x41e0a4
cmp dword [ebx + 0x24], edi
jne 0x41e0a4
cmp dword [ebx + 0x20], edi
je 0x41e0a4
push dword [ebx + 0x20]
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.0041dd7e
push 5
push esi
mov dword [ebp - 4], edi
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.00401e05
lea ecx, [ebp - 0x28]
call fcn.00401a66
jmp 0x41e0a4
test eax, eax
je 0x41e0a4
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.00425487
ret 0x14

Function at 0x41e82d
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x448778]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00426ef0
add esp, 0xc
mov dword [ebp - 0x44], 0x40
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
shrd eax, ecx, 0x1e
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425434
leave
ret
Function at 0x41e8d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ecx
push esi
push edi
push 0x43ca70
push dword [esp + 0x18]
push dword [0x44b080]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41e9ec
push esi
push dword [0x44b080]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x41e9ec
push esi
push dword [0x44b080]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41e9ec
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41e9ec
push ebx
push ebp
push edi
xor ebp, ebp
push 2
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x41e9e4
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x41e9dd
push edi
push esi
push eax
call fcn.00426970
add esp, 0xc
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x41e9d6
push ebp
push dword [esp + 0x14]
call fcn.0041e806
mov ecx, dword [esp + 0x10]
mov edi, eax
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x43b280]
call esi
test edi, edi
je 0x41e9d6
mov eax, dword [edi + 8]
mov dword [edi + 8], ebp
test eax, eax
jne 0x41e9c4
push 0xffffff
lea eax, [esp + 0x18]
push eax
push dword [edi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x41e9c4
mov dword [edi + 8], eax
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x43b280]
mov ecx, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
jmp 0x41e9ee
xor eax, eax
pop edi
pop esi
pop ecx
pop ecx
ret 4

Function at 0x41fa34
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x448778]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x448724], 0
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, 0x400
push edi
mov edi, dword [ebp + 0x14]
jne 0x41fa8f
push 0x64
lea eax, [ebp - 0x130]
push eax
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x130]
mov word [0x452854], ax
xor eax, eax
mov word [0x452856], ax
mov dword [0x448724], 0x452854
push 0x32
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00416517
push edi
push esi
xor eax, eax
push 0x448714
mov word [esi], ax
lea eax, [ebp - 0x68]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [esi + edi*2 - 2], ax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00425434
leave
ret 0x10
Function at 0x423919
Capabilities:
Hide graphical window

Disassembly:
and dword [0x45287c], 0
push 1
push dword [esp + 8]
mov byte [0x452871], 1
mov byte [0x452872], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.00401cc4
cmp dword [0x4486c0], 0
jne 0x423959
cmp byte [0x45287b], 0
je 0x423962
cmp dword [0x452874], 0
jne 0x423975
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4
Function at 0x402a30
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004040ec
test esi, esi
jne 0x402a66
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004041dc
jmp 0x402a84
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402944
mov edi, eax
test esi, esi
je 0x402a84
cmp dword [ebx], 0
je 0x402a84
dec esi
jmp 0x402a6d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402d38
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x482008], 0x8088405
inc edx
mov dword [ebx + 0x482008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x482024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403228
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403208
xor eax, eax
push ebp
push 0x403201
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403244
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403208
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x482024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x482024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403eec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x485048], 0
je 0x403f4d
cmp word [0x48521c], 0xd7b2
jne 0x403f15
cmp dword [0x485224], 0
jbe 0x403f15
mov eax, 0x485218
call dword [0x485234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x482070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f74
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x482034], 0
jne 0x403f69
push 0
push 0x482068
push 0x482070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4040a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004026fc
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x485049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404068
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc