joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e361
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41e3fe
push ebx
push esi
call fcn.0041e32a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041d10b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41e3ab
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41e3fd
push edi
push eax
call fcn.004175af
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41e3cb
call fcn.004167ab
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41e3fc
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041d10b
add esp, 0x20
test eax, eax
jne 0x41e3ea
push edi
call fcn.004167ab
jmp 0x41e3f2
push ebx
call fcn.004167ab
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4230a6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x46fdb8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4230e6
cmp byte [ebx], 0xa
jne 0x4230e6
or byte [eax + edi + 0x28], 4
jmp 0x4230eb
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4231e9
mov al, byte [edx]
cmp al, 0x1a
je 0x4231cb
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x42311a
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x42313f
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x423149
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4230fc
jmp 0x4231e9
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4231c6
cmp dword [ebp - 0xc], 0
je 0x4231c6
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x46fdb8]
test byte [eax + edi + 0x28], 0x48
je 0x4231a0
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x42318b
mov byte [esi], dl
jmp 0x42319c
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x46fdb8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4231e9
cmp byte [ebp - 1], 0xa
jne 0x4231af
cmp esi, ebx
jne 0x4231af
mov byte [esi], 0xa
jmp 0x4231e8
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041b1a1
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4231e9
mov byte [esi], 0xd
jmp 0x4231e8
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x46fdb8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4231e5
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4231e9
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4231f2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x46fdb8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x423235
cmp word [esi], dx
jne 0x423235
or byte [edi + eax + 0x28], 4
jmp 0x42323a
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x42338d
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x42336d
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x42327c
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4232b2
cmp eax, edx
jae 0x4232be
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x423254
jmp 0x42338d
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x423369
cmp dword [ebp - 0x14], 0
je 0x423369
mov eax, dword [ebx*4 + 0x46fdb8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x423341
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x42330a
mov word [esi], cx
jmp 0x42333d
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x46fdb8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x46fdb8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x46fdb8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x42338d
pop ebx
cmp word [ebp - 4], bx
jne 0x423352
cmp esi, dword [ebp + 0xc]
jne 0x423352
mov word [esi], bx
jmp 0x42338a
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041b1a1
add esp, 0x10
cmp word [ebp - 4], bx
je 0x42338d
push 0xd
jmp 0x423386
mov ecx, dword [ebx*4 + 0x46fdb8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x423384
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x42338d
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x425db0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x425ddd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x425ddd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4010b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
call fcn.00401300
push dword [section..data]
push str.CFInjector_v__s_n_n
push 0x410ec8
call fcn.0040211b
push 0
push 0x410ec8
call fcn.004012e0
mov edi, dword [ebp + 8]
add esp, 0x14
cmp edi, 2
jge 0x401147
push str.CFInjector_requires_at_least_one_parameter_to_work__n
call fcn.0040206f
push str.CFInjector.exe__module_name___executable_path__n
call fcn.0040206f
push str._____module_name____name_of_the_module_to_look_for__sr.dll_can_be_used_for_Wizardry_8___n
call fcn.0040206f
push str._____executable_path____program_to_start__optional__n_n
call fcn.0040206f
push str.Examples:_n
call fcn.0040206f
push str.____CFInjector.exe__C:WizardriesW8Wiz8_v124_nocd.exe___C:WizardriesW8Wiz8_v124_nocd.exe__n
call fcn.0040206f
push str.____CFInjector.exe_sr.dll_n
call fcn.0040206f
push str.____CFInjector.exe_sr.dll_c:wizardriesWiz8_v124_nocd.exe_n
call fcn.0040206f
push str.____CFInjector.exe_sr.dll__c:Program_FilesSirtechWizardry_8Wiz8_v124_nocd.exe__n
call fcn.0040206f
add esp, 0x24
xor eax, eax
pop edi
pop ebp
ret
call fcn.00401710
test eax, eax
jne 0x401164
push eax
push str.libInit_FAILED_
call fcn.004012e0
add esp, 8
or eax, 0xffffffff
pop edi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov eax, dword [ebx + 4]
push eax
mov dword [0x410004], eax
call fcn.00401da4
add esp, 4
call fcn.00401310
call fcn.004013e0
mov esi, eax
test esi, esi
jne 0x401286
cmp edi, 2
jle 0x40123b
mov esi, dword [ebx + 8]
push esi
push str._nLaunching__s_n
push 0x410ec8
call fcn.0040211b
push 0
push 0x410ec8
call fcn.004012e0
mov edx, 0x410dc0
add esp, 0x14
mov ecx, esi
sub edx, esi
mov al, byte [ecx]
mov byte [edx + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x4011c2
push 0x5c
push 0x410dc0
call fcn.00401e40
add esp, 8
test eax, eax
je 0x4011e4
mov byte [eax], 0
push 0xa
push 0x410dc0
push 0x40a3dd
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x401219
push eax
push esi
push str.FAILED_to_execute__s:__i_n
push 0x410ec8
call fcn.0040211b
add esp, 0x10
jmp 0x40122c
push esi
push str.Successfully_executed__s_n
push 0x410ec8
call fcn.0040211b
add esp, 0xc
push 0
push 0x410ec8
call fcn.004012e0
add esp, 8
push dword [0x410004]
push str._nLooking_for_the_process_with_module__s_n
push 0x410ec8
call fcn.0040211b
push 0
push 0x410ec8
call fcn.004012e0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x14
push 0x3e8
call edi
push 0
push 0x40a44c
call fcn.004012e0
add esp, 8
call fcn.004013e0
mov esi, eax
test esi, esi
je 0x401265
push 0
push 0x40a450
call fcn.004012e0
push esi
call fcn.00401000
push dword [section..data]
push str.CFInjector_v__s_Exiting..._n
push 0x410ec8
call fcn.0040211b
push 0
push 0x410ec8
call fcn.004012e0
mov eax, dword [0x4116c8]
add esp, 0x20
pop esi
pop ebx
test eax, eax
je 0x4012d0
push eax
call fcn.00401fe3
add esp, 4
xor eax, eax
pop edi
pop ebp
ret
Function at 0x401310
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x410010]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
push str.Adjusting_priveleges..._n
call fcn.004012e0
add esp, 8
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40139e
lea eax, [ebp - 0x10]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x401390
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4013c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.main:_AdjustTokenPrivileges_has_FAILED_with__d_n
jmp 0x4013aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.main:_LookupPrivilegeValue_has_FAILED_with__d_n
jmp 0x4013aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.main:_OpenProcessToken_has_FAILED_with__d_n
push 0x410ec8
call fcn.0040211b
push 0
push 0x410ec8
call fcn.004012e0
add esp, 0x14
push 1
push str.Finished_adjusting_priveleges_n_n
call fcn.004012e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
call fcn.00402403
mov esp, ebp
pop ebp
ret
Function at 0x4013e0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 1
push str._n_Enumerating_Processes__n
call fcn.004012e0
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x1000
push 0x4116f0
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x401437
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FindProcess:_EnumProcesses_has_FAILED_with__d_n
push 0x410ec8
call fcn.0040211b
push 0
push 0x410ec8
call fcn.004012e0
add esp, 0x14
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push ebx
push esi
push edi
shr eax, 2
push eax
push str.FindProcess:_found__i_processes._n
push 0x410ec8
call fcn.0040211b
push 1
push 0x410ec8
call fcn.004012e0
mov eax, dword [ebp - 4]
shr eax, 2
mov edi, 0x4116f0
lea eax, [eax*4 + 0x4116f0]
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x4015f3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
test eax, eax
jne 0x40149c
push 1
push str.FindProcess:_Process_ID_is_0__n
call fcn.004012e0
add esp, 8
jmp 0x4015e7
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x4014d8
call esi
push eax
push dword [edi]
push str.FindProcess:_OpenProcess_for_process__d_has_FAILED_with__d_n
push 0x410ec8
call fcn.0040211b
push 1
push 0x410ec8
call fcn.004012e0
add esp, 0x18
jmp 0x4015e7
lea eax, [ebp - 4]
push eax
push 0x1000
push 0x4126f0
push ebx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x4014fc
call esi
push eax
push dword [edi]
push str.FindProcess:_EnumProcessModules_for_process__d_has_FAILED_with__d_n
jmp 0x4014ba
push dword [edi]
mov eax, dword [ebp - 4]
shr eax, 2
push eax
push str.FindProcess:_found__i_modules_for_process__d__n
push 0x410ec8
call fcn.0040211b
push 1
push 0x410ec8
call fcn.004012e0
mov eax, dword [ebp - 4]
shr eax, 2
mov esi, 0x4126f0
lea eax, [eax*4 + 0x4126f0]
add esp, 0x18
mov dword [ebp - 8], eax
cmp eax, esi
je 0x4015da
push 0x104
push 0x410dc0
push dword [esi]
push ebx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x4015ac
push 0x410dc0
call fcn.00401da4
push dword [0x410004]
push 0x410dc0
call fcn.004021a0
add esp, 0xc
test eax, eax
je 0x4015ce
push 0x410dc0
push dword [edi]
push str.FindProcess:_FOUND_CF_PROCESS__d__with_name__s_n
push 0x410ec8
call fcn.0040211b
push 1
push 0x410ec8
call fcn.004012e0
add esp, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi]
push dword [edi]
push str.FindProcess:_GetModuleFileNameEx:_FAILED_for_process__d__module_0x_.8X__n
push 0x410ec8
call fcn.0040211b
push 1
push 0x410ec8
call fcn.004012e0
add esp, 0x18
add esi, 4
cmp esi, dword [ebp - 8]
jne 0x401540
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add edi, 4
cmp edi, dword [ebp - 0xc]
jne 0x401482
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401930
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.LoadLibraryA
push str.Kernel32.dll
call fcn.00401690
add esp, 8
test eax, eax
jne 0x40194e
mov esp, ebp
pop ebp
ret
cmp dword [0x410008], 0x3c
mov dword [ebp - 4], 0
push 0
jb 0x4019b1
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
call dword [0x4116cc]
mov ecx, eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4019f3
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.libInjectDll:_pRtlCreateUserThread_FAILED_with_0x_.8X__status__i_n
push 0x410ec8
call fcn.0040211b
push 0
push 0x410ec8
call fcn.004012e0
mov eax, dword [ebp - 4]
add esp, 0x18
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp + 0xc]
push eax
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4019f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.libInjectDll:_Error:_CreateRemoteThread_FAILED_with_0x_.8X_n
push 0x410ec8
call fcn.0040211b
push 0
push 0x410ec8
call fcn.004012e0
mov eax, dword [ebp - 4]
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x408d3a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00406096
mov dword [ebp - 0x14], eax
cmp dword [0x414460], edi
jne 0x408e2b
push 0x800
push edi
push 0x40e6ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x408db8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x408f0b
push 0x40e6ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x408f0b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x408f0b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x414460], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x414464], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x414468], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x414470], eax
test eax, eax
je 0x408e28
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41446c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x408e50
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x408e43
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x408e65
push 4
pop eax
jmp 0x408f0d
cmp dword [ebp - 0x14], edi
je 0x408e65
push dword [0x414460]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x408e4a
mov eax, dword [0x41446c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x408ec3
cmp dword [0x414470], esi
je 0x408ec3
push eax
call ebx
push dword [0x414470]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x408ec3
test eax, eax
je 0x408ec3
call ecx
test eax, eax
je 0x408eb8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x408eb8
test byte [ebp - 8], 1
jne 0x408ec3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x408ef3
mov eax, dword [0x414464]
cmp eax, esi
je 0x408ef0
push eax
call ebx
test eax, eax
je 0x408ef0
call eax
mov edi, eax
test edi, edi
je 0x408ef0
mov eax, dword [0x414468]
cmp eax, esi
je 0x408ef0
push eax
call ebx
test eax, eax
je 0x408ef0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x414460]
call ebx
test eax, eax
je 0x408f0b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x408f0d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402403
leave
ret
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405d6a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x405d79
pop dword [ebp - 0x1c]
mov eax, 0x405d79
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x85c4ad76
add dword [ebp - 0x2c], 0xc88d97d5
mov dword [ebp - 0x28], 0x24c20294
add dword [ebp - 0x28], 0xd7149b1
mov dword [ebp - 0x24], 0x7d229799
sub dword [ebp - 0x24], 0x30d6536b
mov dword [ebp - 0x20], 0x20cad3bf
sub dword [ebp - 0x20], 0x20cad3bf
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xd14e8ef7
add dword [ebp - 0x2c], 0xa323da5f
mov dword [ebp - 0x28], 0x1e33315e
add dword [ebp - 0x28], 0x23393017
mov dword [ebp - 0x24], 0xce959844
add dword [ebp - 0x24], 0x94d9d428
mov dword [ebp - 0x20], 0xdb96d562
add dword [ebp - 0x20], 0x24692a9e
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x1d310230
sub eax, 0x1cf09210
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x37a8b
push 0
call eax
mov ecx, 0x47c7
xor esi, esi
add esi, eax
mov edi, 0x40c800
add edi, dword [ebp - 0x1c]
mov ebx, 0x5aba092e
add ebx, 0x3871161
xor dword [ebp - 8], ecx
mov edx, dword [edi]
xor dword [ebp - 0x14], edi
add edx, ebx
mov dword [esi], edx
xor dword [ebp - 0x10], ecx
add esi, 4
add edi, 0xafbdb949
sub edi, 0xafbdb945
loop 0x405e87
add eax, 0xe9c83f17
add eax, 0x1638d2d8
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x4013fc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
push edx
pop ebx
push eax
pop esi
push ebx
pop eax
call fcn.004020d0
or esi, esi
jne 0x401432
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
push eax
pop ecx
push esp
pop edx
push ebx
pop eax
call fcn.004021bc
jmp 0x401450
call sub.kernel32.dll_GetCommandLineA
push eax
pop edi
mov edx, ebx
push edi
pop eax
call fcn.00401310
mov edi, eax
or esi, esi
je 0x401450
cmp dword [ebx], 0
je 0x401450
dec esi
jmp 0x401439
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4018d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x406008], 0x8088405
inc edx
mov dword [ebx + 0x406008], edx
mul edx
push edx
pop eax
pop ebx
ret

Function at 0x403390
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub ecx, ecx
nop
push 5
nop
pop edx
call fcn.004018b0
mov eax, dword [ebp - 0xc]
inc eax
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00402448
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
sete byte [ebp - 0xd]
mov eax, dword [ebp - 0x14]
call fcn.00402fb0
mov edx, dword [ebp - 0xc]
mov byte [edx], al
mov al, byte [ebp - 0xd]
push ebp
pop esp
pop ebp
ret

Function at 0x40350c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
call fcn.00402f60
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00402448
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x40355d
mov ecx, dword [ebp - 8]
mov edx, 0x40356c
mov eax, dword [ebp - 4]
call fcn.00403088
push ebp
pop esp
pop ebp
ret 8

Function at 0x40358c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00402448
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4035d7
mov ecx, dword [ebp - 8]
mov edx, 0x4035fc
mov eax, dword [ebp - 4]
call fcn.00403088
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
call fcn.00402fb0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8