joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4048df
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, str.SfxCfg
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
and dword [ebp - 4], 0
xor eax, eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
xor byte [ebp + eax - 0xc], 0xc9
inc eax
cmp eax, 6
jl 0x4048fb
lea eax, [ebp - 4]
push eax
push 0x20000
push 0x61a8
lea eax, [ebp - 0xc]
push 6
push eax
lea eax, [ebp + 8]
push eax
call fcn.00409798
add esp, 0x18
cmp eax, 0xffffffff
je 0x40493f
add eax, 6
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll__llseek]
push 1
pop eax
leave
ret
xor eax, eax
leave
ret

Function at 0x404f3c
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
lea eax, [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push eax
lea eax, [ebp - 8]
push 2
push eax
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call edi
test eax, eax
je 0x40501f
cmp dword [ebp - 4], 2
jne 0x40501f
mov edx, dword [ebp - 8]
mov esi, dword [ebp + 0x14]
mov eax, edx
mov cx, word [esi]
shl eax, 0xb
shr dx, 5
or eax, edx
xor eax, ecx
cmp ax, word [ebp + 0x10]
mov dword [ebp - 8], eax
ja 0x40501f
mov dx, cx
add ecx, ecx
movzx eax, ax
shr dx, 0xf
or edx, ecx
inc eax
mov word [esi], dx
lea ecx, [ebp - 4]
cdq
sub eax, edx
push ebx
sar eax, 1
shl eax, 1
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call edi
test eax, eax
je 0x40501f
movzx eax, word [ebp - 8]
inc eax
cdq
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
cmp dword [ebp - 4], ecx
jne 0x40501f
mov edi, dword [ebp + 0xc]
test eax, eax
jle 0x40500f
mov dx, word [edi]
mov cx, dx
shr cx, 7
shl edx, 9
or ecx, edx
mov word [edi], cx
xor cx, word [esi]
mov word [edi], cx
mov cx, word [esi]
mov dx, cx
shr dx, 0xe
shl ecx, 2
or edx, ecx
inc ebx
movzx ecx, bx
inc edi
mov word [esi], dx
inc edi
cmp ecx, eax
jl 0x404fdb
movzx eax, word [ebp - 8]
mov ecx, dword [ebp + 0xc]
push 1
and byte [eax + ecx], 0
pop eax
jmp 0x405021
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405026
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push 0
push eax
lea eax, [ebp + 8]
push 2
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405076
cmp dword [ebp - 4], 2
jne 0x405076
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, edx
shl eax, 0xb
mov cx, word [esi]
shr dx, 5
or eax, edx
mov dx, cx
xor eax, ecx
shr dx, 0xd
shl ecx, 3
or edx, ecx
mov word [esi], dx
pop esi
leave
ret
xor ax, ax
leave
ret
Function at 0x40507b
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call fcn.0040d330
lea eax, [ebp - 0x208]
push eax
call fcn.00404e6c
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push 0x4163b4
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x405180
test byte [ebp - 0x348], 0x10
je 0x40512f
cmp byte [ebp - 0x31c], 0x2e
jne 0x405102
cmp byte [ebp - 0x31b], 0
je 0x40515b
cmp byte [ebp - 0x31b], 0x2e
je 0x40515b
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push str._s_s_
push eax
call esi
lea eax, [ebp - 0x104]
push eax
call fcn.0040507b
add esp, 0x14
jmp 0x40515b
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push str._s_s
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x348]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4050d5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
or edi, 0xffffffff
jmp 0x4050d5
lea eax, [ebp - 0x208]
push eax
call fcn.00404e41
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0040d330
lea eax, [ebp - 0x104]
push eax
call fcn.00404d5a
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
leave
ret

Function at 0x40521e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push str._ProgramFiles_
mov dword [ebp - 4], edi
call fcn.0040e036
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
pop ecx
mov byte [esi], bl
je 0x40524e
push edi
push eax
push esi
call fcn.0040d780
add esp, 0xc
jmp 0x405297
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [ebp + 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405297
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push esi
push eax
push ebx
push str.ProgramFilesDir
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esi], bl
jne 0x4052b0
push esi
call fcn.004051e5
mov dword [esp], str.Program_Files
push esi
call fcn.0040d340
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4052b5
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
lea eax, [ebp - 0x284]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405349
push ebx
push edi
push 1
lea eax, [ebp - 0x144]
pop ebx
push eax
push dword [ebp + 0xc]
call esi
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, eax
cmp edi, 0xffffffff
je 0x405315
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
xor ebx, ebx
push edi
test eax, eax
setge bl
call esi
push dword [ebp - 4]
call esi
pop edi
test ebx, ebx
pop ebx
je 0x405344
mov eax, dword [ebp - 0x144]
test al, 1
je 0x405336
and al, 0xfe
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 1
pop eax
jmp 0x40534b
xor eax, eax
pop esi
leave
ret

Function at 0x40537d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, 0x414330
je 0x4053e1
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4053e1
mov eax, edi
test eax, eax
je 0x4053e1
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [edi], 0
je 0x4053e1
push dword [edi + 4]
call esi
push eax
mov dword [ebp + 0x10], eax
push dword [ebp + 8]
push dword [edi + 4]
call fcn.0040e160
add esp, 0xc
test eax, eax
je 0x4053e8
push dword [edi]
call esi
push eax
mov dword [ebp + 0x10], eax
push dword [ebp + 8]
push dword [edi]
call fcn.0040e160
add esp, 0xc
test eax, eax
je 0x4053e8
add edi, 0xc
jne 0x4053a3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov edi, dword [edi + 8]
test edi, edi
je 0x4053e1
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add eax, ecx
mov cl, byte [eax]
cmp cl, 0x5c
je 0x405403
cmp cl, 0x2f
jne 0x405404
inc eax
lea ecx, [ebp - 4]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4053e1
cmp dword [ebp - 4], eax
je 0x4053e1
cmp byte [ebx], 0x22
je 0x405433
push 4
pop esi
push ebx
mov dword [ebp + 8], esi
call fcn.0040e0d4
pop ecx
mov dword [ebp - 8], eax
lea edi, [ebp - 8]
jmp 0x405458
push ebx
call esi
and byte [eax + ebx - 1], 0
lea edi, [ebx + 1]
push edi
mov dword [ebp + 8], 1
call esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jb 0x405458
inc esi
push esi
push edi
push dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
pop eax
jmp 0x4053e3
Function at 0x405473
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push ebx
push esi
push edi
lea eax, [ebp - 0x168]
xor edi, edi
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
jbe 0x4055dc
cmp dword [ebp + 8], edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
je 0x4054b0
push dword [ebp + 8]
call esi
mov dword [ebp - 8], eax
jmp 0x4054b3
mov dword [ebp - 8], edi
cmp dword [ebp + 0xc], edi
je 0x4054c2
push dword [ebp + 0xc]
call esi
mov dword [ebp - 0xc], eax
jmp 0x4054c5
mov dword [ebp - 0xc], edi
lea eax, [ebp - 0x168]
test eax, eax
je 0x4054dc
lea eax, [ebp - 0x168]
push eax
call esi
mov ebx, eax
jmp 0x4054de
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
add eax, ebx
lea eax, [eax + ecx + 0xa]
push eax
call fcn.0040d56c
mov esi, eax
pop ecx
cmp esi, edi
mov dword [ebp - 4], esi
je 0x4055dc
mov edi, 0x416438
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x168]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push edi
push dword [ebp - 4]
call esi
cmp dword [ebp - 0xc], 0
mov edi, 0x41624c
jle 0x40553a
push edi
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 8]
push 4
pop ecx
cmp eax, ecx
jl 0x405548
cmp ebx, ecx
jge 0x405554
cmp eax, ebx
mov ecx, eax
jl 0x405550
mov ecx, ebx
test ecx, ecx
je 0x40556e
sub ebx, ecx
sub eax, ecx
add eax, dword [ebp + 8]
lea edx, [ebp + ebx - 0x168]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40557c
push edi
push dword [ebp - 4]
call esi
push dword [ebp + 8]
push dword [ebp - 4]
call esi
push 0x44
xor esi, esi
pop edi
lea eax, [ebp - 0x60]
push edi
push esi
push eax
call fcn.0040db60
push 0x10
lea eax, [ebp - 0x1c]
push esi
push eax
mov dword [ebp - 0x60], edi
call fcn.0040db60
add esp, 0x18
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4055d3
push dword [ebp - 0x1c]
call fcn.004056c0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x1c]
call esi
push dword [ebp - 4]
call fcn.0040d5f8
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x405a2c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4318c0]
push esi
push edi
mov esi, 0xc00000
mov ax, word [eax + 0x675c]
push 1
imul ax, ax, 0x3b
add eax, 0x50
lea ecx, [ebp - 0x14]
movzx eax, ax
push esi
push ecx
push 0x70
push eax
mov dword [ebp - 4], eax
call fcn.004038b9
mov eax, dword [0x417918]
mov edx, dword [ebp - 0xc]
add esp, 0x14
test eax, eax
je 0x405a7b
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
add edx, eax
mov dword [ebp - 0xc], edx
mov eax, dword [0x41791c]
mov ecx, dword [ebp - 8]
test eax, eax
je 0x405a92
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
add ecx, eax
mov dword [ebp - 8], ecx
push dword [ebp - 4]
mov eax, dword [0x4318c0]
sub ecx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x14]
push dword [0x4316b0]
push 0
push dword [eax]
add eax, 0x14cc
push ecx
push edx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push esi
push eax
push dword [0x416440]
push 1
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
mov edi, eax
mov eax, dword [0x4318c0]
push 0
push dword [eax]
call esi
push dword [ebp + 8]
push 0
push 0x400
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
push edi
call fcn.0040591c
pop ecx
mov dword [ebp + 8], eax
pop ecx
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x14]
push 1
mov dword [0x417918], eax
mov eax, dword [ebp - 0x10]
mov dword [0x41791c], eax
mov eax, dword [0x4318c0]
push dword [eax]
call esi
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x4318c0]
push dword [eax]
call dword [sym.imp.USER32.dll_SetActiveWindow]
cmp dword [ebp + 8], 0
pop edi
pop esi
jne 0x405b4e
xor eax, eax
leave
ret
cmp dword [ebp + 8], 0xffffffff
jne 0x405b5b
mov eax, 0x424
leave
ret
xor eax, eax
cmp dword [ebp + 8], 0xfffffffc
setne al
dec eax
and eax, 0x37a
add eax, 0xbe
leave
ret

Function at 0x405b71
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4318c0]
push esi
push edi
mov esi, 0xc80000
mov ax, word [eax + 0x675c]
push 1
imul ax, ax, 0x56
movzx edi, ax
lea eax, [ebp - 0x10]
push esi
push eax
push 0x78
push edi
call fcn.004038b9
add esp, 0x14
push edi
push dword [0x4316b0]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x4318c0]
push dword [ebp - 0xc]
add eax, 0x14cc
push dword [ebp - 0x10]
push esi
push eax
push dword [0x416444]
push 1
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [0x4318c0]
push 5
mov dword [ecx], eax
mov eax, dword [0x4318c0]
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4318c0]
push dword [eax]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
leave
ret
Function at 0x405c9b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4318c0]
push esi
push edi
mov esi, 0xc80000
mov ax, word [eax + 0x675c]
push 1
imul ax, ax, 0x3c
add eax, 0x50
push esi
movzx edi, ax
lea eax, [ebp - 0x10]
push eax
push 0x7f
push edi
call fcn.004038b9
add esp, 0x14
push edi
push dword [0x4316b0]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x4318c0]
push dword [ebp - 0xc]
add eax, 0x14cc
push dword [ebp - 0x10]
push esi
push eax
push dword [0x41643c]
push 1
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
push esi
call fcn.0040591c
pop ecx
mov edi, eax
pop ecx
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
test edi, edi
pop edi
pop esi
jne 0x405d7a
mov eax, dword [0x4318c0]
add eax, 0x1f2
push eax
call fcn.0040d420
test eax, eax
pop ecx
jle 0x405d76
mov ecx, dword [0x4318c0]
cmp byte [ecx + eax + 0x1f1], 0x5c
lea edx, [ecx + eax + 0x1f1]
jne 0x405d76
cmp eax, 3
jne 0x405d73
cmp byte [ecx + 0x1f3], 0x3a
je 0x405d76
and byte [edx], 0
xor eax, eax
leave
ret
mov eax, 0xbe
leave
ret

Function at 0x405e0e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x4318c0]
push ebx
push esi
push edi
mov eax, dword [ecx + 0x6760]
mov esi, 0xc80000
add eax, dword [ecx + 0x675c]
push 1
push esi
cdq
sub eax, edx
sar eax, 1
imul eax, eax, 0x21
add eax, 0x9d
movzx edi, ax
lea eax, [ebp - 0x10]
push eax
push 0xd6
push edi
call fcn.004038b9
mov eax, dword [0x417930]
mov ecx, dword [ebp - 8]
add esp, 0x14
test eax, eax
je 0x405e6a
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
add ecx, eax
mov dword [ebp - 8], ecx
mov edx, dword [0x417934]
mov eax, dword [ebp - 4]
test edx, edx
je 0x405e82
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], edx
add eax, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
sub eax, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
push edi
push dword [0x4316b0]
push 0
push ebx
push eax
mov eax, dword [0x4318c0]
push ecx
add eax, 0x14cc
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push esi
push eax
push dword [0x416448]
push 1
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push ebx
mov edi, eax
call esi
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
push edi
call fcn.0040591c
pop ecx
mov dword [ebp + 8], eax
pop ecx
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x10]
push 1
mov dword [0x417930], eax
mov eax, dword [ebp - 0xc]
push ebx
mov dword [0x417934], eax
call esi
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [ebp + 8]
pop edi
neg eax
sbb eax, eax
pop esi
and eax, 0xbe
pop ebx
leave
ret
Function at 0x4077db
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b4
mov eax, dword [0x4318c0]
add eax, 0x2f2
cmp byte [eax], 0
je 0x4078c4
lea ecx, [ebp - 0x22c]
push 0x4178cc
push ecx
push eax
call fcn.004049c2
add esp, 0xc
lea eax, [ebp - 0x3b4]
push 0x4000
push eax
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x4078c4
mov eax, dword [0x4318c0]
push str.notepad
add eax, 0x2f2
push eax
call fcn.0040d330
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [0x4318c0]
add eax, 0x2f2
push eax
call fcn.0040d340
mov eax, dword [0x4318c0]
add esp, 0x10
add eax, 0x2f2
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jb 0x4078c4
lea eax, [ebp - 0xc8]
push 0x4165f8
push eax
call fcn.0040d330
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x64]
push eax
mov eax, dword [0x4318c0]
push 0
add eax, 0x2fa
push 0
push eax
call fcn.0040de3e
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.0040d340
lea eax, [ebp - 0xc8]
push eax
call fcn.004079fb
add esp, 0x28
leave
ret

Function at 0x4079fb
Capabilities:
Enumerate gui resources

Disassembly:
push edi
mov edi, dword [esp + 8]
push edi
call fcn.0041327a
lea eax, [edi + 0x64]
push eax
call fcn.0041327a
pop ecx
pop ecx
and dword [0x4178f0], 0
push edi
push 0x407992
call dword [sym.imp.USER32.dll_EnumWindows]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4178f0], 0
jne 0x407a11
pop edi
ret

Function at 0x407b67
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push dword [0x417988]
call fcn.00407c89
push 0xc
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040e2f0
add esp, 0x10
xor edi, edi
lea esi, [ebp + edi - 0xc]
call fcn.00407c73
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.00407c14
inc edi
pop ecx
cmp edi, 0xc
jl 0x407b8d
mov eax, dword [0x416bc0]
movzx cx, byte [ebp - 1]
test byte [eax + 0x28], 2
je 0x407bc4
movzx eax, word [0x4293e6]
shr eax, 8
jmp 0x407bcc
mov eax, dword [0x4293ec]
shr eax, 0x18
movzx ecx, cx
cmp ecx, eax
je 0x407bd8
or eax, 0xffffffff
jmp 0x407c10
mov eax, dword [0x429388]
mov ecx, dword [0x418b64]
cmp eax, ecx
jle 0x407be9
mov eax, ecx
mov esi, dword [0x429460]
mov ecx, eax
dec eax
test ecx, ecx
je 0x407c0e
lea edi, [eax + 1]
call fcn.00407c73
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.00407c14
inc esi
dec edi
pop ecx
jne 0x407bf9
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x407c14
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [0x41797c]
mov edx, 0xff
mov eax, ecx
push esi
xor eax, dword [esp + 8]
shr ecx, 8
and eax, edx
mov eax, dword [eax*4 + 0x416634]
xor eax, ecx
mov ecx, dword [0x417984]
mov dword [0x41797c], eax
and eax, edx
add eax, dword [0x417980]
mov esi, ecx
and esi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [0x417980], eax
shr eax, 0x18
xor eax, esi
pop esi
shr ecx, 8
mov eax, dword [eax*4 + 0x416634]
xor eax, ecx
mov dword [0x417984], eax
mov eax, dword [esp + 4]
ret
Function at 0x408acc
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, 0x4294a0
push edi
push esi
call fcn.0040d20e
push esi
call fcn.0040d420
cmp byte [eax + 0x42949f], 0x5c
pop ecx
pop ecx
jne 0x408af8
push 2
pop eax
jmp 0x408b7b
push 0x429420
push esi
call fcn.0040e720
pop ecx
test eax, eax
pop ecx
jne 0x408b1f
test byte [0x429426], 0x80
jne 0x408b1f
push 0x180
push esi
call fcn.004133ae
pop ecx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call edi
test al, 2
je 0x408b3a
push esi
call edi
xor eax, 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
xor eax, eax
pop edi
lea ecx, [ebp - 0xc]
push eax
push 0x80
push 2
push ecx
push eax
push 0x40000000
push esi
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x4293b4], eax
jne 0x408b73
mov eax, edi
jmp 0x408b7b
mov dword [0x431660], edi
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x408bfb
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4187d0], 0
jne 0x408c89
push 1
push 0x2000
push dword [0x429384]
call fcn.004098cc
add esp, 0xc
cmp eax, 0xffffffff
mov dword [0x429388], eax
je 0x408c89
mov ecx, dword [0x416bc0]
push esi
mov esi, dword [0x429384]
mov dword [0x429460], esi
test byte [ecx + 0x28], 1
je 0x408c73
mov ecx, dword [0x418b64]
inc ecx
cmp eax, ecx
jg 0x408c4d
mov ecx, eax
mov edx, ecx
dec ecx
test edx, edx
je 0x408c73
push edi
lea edi, [ecx + 1]
call fcn.00407c73
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.00407c14
inc esi
dec edi
pop ecx
jne 0x408c58
mov eax, dword [0x429388]
pop edi
dec eax
pop esi
mov dword [0x429388], eax
mov eax, dword [0x429460]
movzx eax, byte [eax]
inc dword [0x429460]
ret
or eax, 0xffffffff
ret