joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45eee8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45eeff
add esp, 0xfffffff0
call fcn.00404464
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041f23c
mov eax, dword [0x48fcf4]
cmp word [eax + 2], 0
jne 0x45ef27
mov eax, dword [0x48fcf4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00460918
mov eax, dword [0x48fdb0]
cmp word [eax + 2], 0
jne 0x45ef41
mov eax, dword [0x48fdb0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00460b24
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x416cc8]
call fcn.00404110
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x416cc8]
call fcn.00404110
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x416cc8]
call fcn.00404110
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x423a18]
call fcn.0042b02c
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x45f0f8
mov eax, dword [0x48fc08]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042b400
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4611e4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x48fc08]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d934
test eax, eax
je 0x45f048
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409ab4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d968
test eax, eax
je 0x45f05c
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004051fc
mov byte [ebx + 0xd4], 0
push ebx
push 0x4604f8
call fcn.004203b8
mov dword [ebx + 0xc8], eax
mov eax, dword [0x48fadc]
cmp byte [eax], 0
jne 0x45f0ad
mov eax, ebx
call fcn.0045f23c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004613c0
mov eax, ebx
call fcn.00461f20
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45f0ed
call fcn.004044bc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f4bc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x493584]
cmp dword [eax + 0x30], 0
je 0x45f566
cmp dword [ebx + 0x94], 0
jne 0x45f560
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45f44c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45f560
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45f526
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45f560
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004190fc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45f535
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x460280
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4602b5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040507c
jmp 0x4602c2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404fe0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4615a4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x461612
mov eax, esi
call fcn.0044bcd0
test al, al
je 0x461612
mov eax, dword [ebx + 0x84]
call fcn.0044b930
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x461612
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x461606
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044b930
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00443d50
jmp 0x461612
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004613e0
pop esi
pop ebx
ret

Function at 0x488d38
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x488dd4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [0x48fa88]
call fcn.00409294
mov edx, dword [ebp - 4]
mov eax, 0x49372c
call fcn.0040573c
call fcn.00403ba4
call fcn.00402e48
mov eax, 0x49372c
call fcn.004035b0
call fcn.00402e48
push 1
lea eax, [ebp - 8]
call fcn.00409a6c
mov eax, dword [ebp - 8]
call fcn.00405450
push eax
push 0x488de0
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00403150
mov eax, dword [ebp - 0xc]
call fcn.00405450
push eax
push 0x488df0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488ddb
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404fb0
ret
Function at 0x489330
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x489339
mov eax, dword [ebp - 4]
add esp, 0xffffff94
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405440
mov eax, dword [ebp - 8]
call fcn.00405440
mov eax, dword [ebp - 0xc]
call fcn.00405440
mov eax, dword [ebp + 0x10]
call fcn.00405440
mov eax, dword [ebp + 0xc]
call fcn.00405440
mov eax, dword [ebp + 8]
call fcn.00405440
xor eax, eax
push ebp
push 0x489581
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x8070]
xor ecx, ecx
mov edx, 0xc
call fcn.00403750
mov dword [ebp - 0x8070], 0xc
xor eax, eax
mov dword [ebp - 0x806c], eax
mov dword [ebp - 0x8068], 0xffffffff
cmp dword [ebp - 8], 0
je 0x4893dd
push dword [ebp - 4]
push 0x48959c
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405310
lea eax, [ebp - 0x8010]
mov edx, dword [ebp - 4]
call fcn.00409b20
cmp dword [ebp - 0xc], 0
jne 0x4893f5
xor ebx, ebx
jmp 0x4893ff
mov eax, dword [ebp - 0xc]
call fcn.00405450
mov ebx, eax
lea eax, [ebp - 0x8054]
xor ecx, ecx
mov edx, 0x44
call fcn.00403750
mov dword [ebp - 0x8054], 0x44
cmp dword [ebp + 0x10], 0
jne 0x489430
mov dword [ebp - 0x8028], 1
jmp 0x4894bb
mov dword [ebp - 0x8028], 0x101
push 0
push 0x80
push 2
lea eax, [ebp - 0x8070]
push eax
push 3
push 0xc0000000
mov eax, dword [ebp + 0x10]
call fcn.00405450
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x801c], eax
push 0
push 0x80
push 2
lea eax, [ebp - 0x8070]
push eax
push 3
push 0xc0000000
mov eax, dword [ebp + 0xc]
call fcn.00405450
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x8018], eax
push 0
push 0x80
push 2
lea eax, [ebp - 0x8070]
push eax
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
call fcn.00405450
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x8014], eax
movzx eax, word [ebp + 0x14]
mov word [ebp - 0x8024], ax
lea eax, [ebp - 0x8064]
push eax
lea eax, [ebp - 0x8054]
push eax
push ebx
push 0
push 0x30
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x8010]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4894f6
or ebx, 0xffffffff
jmp 0x48952f
push 0xffffffffffffffff
mov eax, dword [ebp - 0x8064]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x8064]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x8064]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x8060]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp + 0x10], 0
je 0x489559
mov eax, dword [ebp - 0x801c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x8018]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x8014]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489588
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404fb0
lea eax, [ebp + 8]
mov edx, 3
call fcn.00404fb0
ret
Function at 0x4895a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x489627
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov ecx, eax
lea edx, [ebp - 0x104]
mov eax, ebx
call fcn.0040507c
cmp dword [ebx], 0
jne 0x48960e
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x108]
call fcn.0040c2cc
mov ecx, dword [ebp - 0x108]
mov dl, 1
mov eax, dword [0x407fc4]
call fcn.0040cae0
call fcn.004049b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48962e
lea eax, [ebp - 0x108]
call fcn.00404f8c
ret
Function at 0x489688
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x489876
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48982b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x108]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 4]
call fcn.0040507c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409784
test al, al
jne 0x489821
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405450
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x489821
lea eax, [ebp - 0x110]
call fcn.004895a0
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.00489634
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 4]
mov ecx, 0x48988c
call fcn.0040529c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409784
test al, al
jne 0x489821
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x489821
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409884
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 4]
mov ecx, 0x48989c
call fcn.0040529c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409784
test al, al
jne 0x489821
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x489821
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409884
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 4]
mov ecx, 0x4898ac
call fcn.0040529c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409784
test al, al
jne 0x489821
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x489821
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x11c]
call fcn.0040c2cc
mov ecx, dword [ebp - 0x11c]
mov dl, 1
mov eax, dword [0x407fc4]
call fcn.0040cae0
call fcn.004049b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x489842
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48987d
lea eax, [ebp - 0x11c]
mov edx, 3
call fcn.00404fb0
lea eax, [ebp - 0x110]
call fcn.00404f8c
lea eax, [ebp - 0x10c]
call fcn.00404f8c
ret
Function at 0x4898b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x489967
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0
push 0x489974
lea eax, [ebp - 0x108]
call fcn.00489688
mov eax, dword [ebp - 0x108]
call fcn.00405450
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
jne 0x489931
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x10c]
call fcn.0040c2cc
mov ecx, dword [ebp - 0x10c]
mov dl, 1
mov eax, dword [0x407fc4]
call fcn.0040cae0
call fcn.004049b4
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.004051fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48996e
lea eax, [ebp - 0x10c]
call fcn.00404f8c
lea eax, [ebp - 0x108]
call fcn.00404f8c
ret

Function at 0x48a424
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, eax
mov eax, edi
call fcn.0048a2e4
mov ebp, eax
xor ebx, ebx
test ebp, ebp
je 0x48a465
mov bl, 1
push ebp
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, edi
call fcn.0048a2e4
mov ebp, eax
test ebp, ebp
jne 0x48a439
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48ac60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x48acdf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x48acf4
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405174
push dword [ebp - 8]
push 0x48ad08
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405310
mov eax, dword [ebp - 4]
call fcn.00409760
test al, al
je 0x48acb6
mov eax, dword [ebp - 4]
call fcn.00405450
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
call fcn.0048ac40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ace6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404fb0
ret
Function at 0x48ad10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48ae06
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00404f8c
mov eax, 0x48ae1c
call fcn.00409784
test al, al
jne 0x48ad4c
push 0
push 0x48ae24
call sub.kernel32.dll_CreateDirectoryA
mov eax, 0x48ae34
call fcn.00409760
test al, al
je 0x48ad67
lea edx, [ebp - 8]
mov eax, 0x48ae34
call fcn.00483b18
mov eax, dword [ebp - 8]
test eax, eax
je 0x48ad73
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x24
jge 0x48ad9d
push ebp
mov al, 0x30
call fcn.0048ac60
pop ecx
lea eax, [ebp - 8]
mov edx, 0x48ae54
call fcn.00405024
mov edx, dword [ebp - 8]
mov eax, 0x48ae34
call fcn.00483ba4
jmp 0x48adeb
push ebp
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
call fcn.0048ac60
pop ecx
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x23
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.004054b0
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
movzx edx, byte [edx]
call fcn.00405174
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
pop edx
call fcn.0040529c
mov edx, dword [ebp - 8]
mov eax, 0x48ae34
call fcn.00483ba4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ae0d
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404fb0
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40633c
pop dword [ebp - 0x28]
mov eax, 0xd4a27c2
sub eax, 0xd09c486
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x29a44602
add dword [ebp - 0x38], 0x24adff49
mov dword [ebp - 0x34], 0x680e818b
add dword [ebp - 0x34], 0xca24caba
mov dword [ebp - 0x30], 0x736550a
sub dword [ebp - 0x30], 0xbaea10dc
mov dword [ebp - 0x2c], 0x595ed60c
sub dword [ebp - 0x2c], 0x595ed60c
lea eax, [ebp - 0x38]
push eax
mov eax, 0xc9813911
add eax, 0x36bf374f
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x45683f01
add dword [ebp - 0x38], 0x2f0a2a55
mov dword [ebp - 0x34], 0x79e478b0
add dword [ebp - 0x34], 0xc787e8c5
mov dword [ebp - 0x30], 0xef915e91
add dword [ebp - 0x30], 0x73de0ddb
mov dword [ebp - 0x2c], 0x4465c5da
add dword [ebp - 0x2c], 0xbb9a3a26
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xf999e660
add eax, 0x6a68aa0
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x37e45
push 0
call eax
mov ecx, 0x23adf7e9
add ecx, 0xdc52552f
xor esi, esi
add esi, eax
mov edx, 0x410000
add edx, dword [ebp - 0x28]
mov ebx, 0xc772592
sub ebx, 0xff332806
xor dword [ebp - 0xc], 0x85501208
mov edi, dword [edx]
add dword [ebp - 0x1c], edi
add edi, ebx
add dword [ebp - 0x18], 0xf2bf6636
mov dword [esi], edi
sub dword [ebp - 0x10], 0xd21e35d5
add esi, 4
add edx, 4
loop 0x40645a
add eax, 0x12733
mov ebx, eax
add eax, 0xe854676c
sub eax, 0xe8546767
mov ecx, 0xc4030c8e
sub ecx, 0xc3c30c8e
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x40349c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.0040625c
test esi, esi
jne 0x4034d4
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406398
jmp 0x4034f2
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403380
mov edi, eax
test esi, esi
je 0x4034f2
cmp dword [ebx], 0
je 0x4034f2
dec esi
jmp 0x4034db
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x403528
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x532008], 0x8088405
inc edx
mov dword [ebx + 0x532008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x404270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x532024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x404308
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4042e8
xor eax, eax
push ebp
push 0x4042e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x404340
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4042e8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x532024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x532024], ax
mov esp, ebp
pop ebp
ret

Function at 0x405470
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x53a054], 0
je 0x4054d1
cmp word [0x53a330], 0xd7b2
jne 0x405499
cmp dword [0x53a338], 0
jbe 0x405499
mov eax, 0x53a32c
call dword [0x53a348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4054fc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x532034], 0
jne 0x4054ed
push 0
push 0x532790
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40569c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x53203c], 0
je 0x4056c2
mov edx, esi
mov eax, ebx
call dword [0x53203c]
jmp 0x4056d1
mov eax, 8
call fcn.004030c8
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x53a055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405664
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x408d70
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x40a98c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x53cb60
push 0xa
push 0x40aa20
mov eax, dword [0x53cb50]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40a9b0
call fcn.00413d98
push ebx
mov eax, dword [0x53cb50]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40a9c7
call fcn.00413d98
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40a9d9
call fcn.00413d98
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x53cb64], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x53cb68], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x53cb6c], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x53cb70], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x53cb74], ecx
add edx, dword [eax + 0x14]
mov dword [0x53cb78], edx
pop esi
pop ebx
ret

Function at 0x40c458
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40c501
test eax, edx
je 0x40c504
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40c481
push edx
mov edx, eax
mov eax, esp
call fcn.00406478
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40c497
push eax
lea eax, [esp + 8]
call fcn.00406478
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40c4a6
movzx eax, word [eax]
sub eax, ecx
jmp 0x40c4cd
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40c4e7
add ecx, 4
js 0x40c4be
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40c4e4
push eax
mov eax, ecx
mov edx, 2
call fcn.0040573c
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40c4cb
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40c4cd
xor eax, eax
ret
test eax, eax
je 0x40c514
test edx, edx
jne 0x40c468
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40d424
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.004062e8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40d442
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x40d463
cmp ebx, 3
je 0x40d463
cmp ebx, 0x7b
je 0x40d463
mov eax, esi
call fcn.0040d3e4
test al, al
jne 0x40d467
xor eax, eax
jmp 0x40d469
mov al, 1
pop esi
pop ebx
ret

Function at 0x40d46c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004062e8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40d485
test al, 0x10
jne 0x40d489
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret