joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
push 0x67
push dword [0x40d55c]
call sub.USER32.DLL_GetDlgItem
mov esi, eax
cmp byte [0x40c018], 0
jne 0x402fdf
mov eax, dword [0x40e63c]
call fcn.00404358
push 5
push esi
call sub.USER32.DLL_ShowWindow
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
push 0x40c095
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
mov byte [0x40c018], 1
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
mov dword [ebp - 0x3c], 0x3c
lea edx, [ebp - 0x3c]
push edx
push 0
push 0x43a
push esi
call sub.USER32.DLL_SendMessageA
mov byte [ebp - 0x23], 0
mov dword [ebp - 0x38], 1
test bl, bl
je 0x403034
and dword [ebp - 0x34], 0xbfffffff
or dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 0xa0
or dword [ebp - 0x38], 0x40000000
lea ecx, [ebp - 0x3c]
push ecx
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push edi
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
test bl, bl
je 0x403088
or dword [ebp - 0x34], 0x40000000
and dword [ebp - 0x34], 0xfffffffe
lea eax, [ebp - 0x3c]
push eax
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push 0x40c0bc
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403790
Capabilities:
Accept command line arguments
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
mov eax, 0x40ee50
push ebx
call fcn.00406d14
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
test ebx, ebx
je 0x4037be
mov eax, ebx
call fcn.00403938
push ebx
push str.sfxcmd
call sub.KERNEL32.DLL_SetEnvironmentVariableA
push 0x400
push 0x40de34
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x40de34
push str.sfxname
call sub.KERNEL32.DLL_SetEnvironmentVariableA
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
mov dword [0x40d58c], eax
push 0x64
push ebx
call sub.USER32.DLL_LoadIconA
mov dword [0x40e234], eax
push 0x65
push dword [0x40d58c]
call sub.USER32.DLL_LoadBitmapA
mov dword [0x40e238], eax
lea eax, [ebp - 8]
call fcn.0040552c
mov edx, 0x40de34
mov eax, 0x40d594
call fcn.00404c70
lea eax, [ebp - 0x20]
call fcn.004041c4
lea eax, [ebp - 0x38]
call fcn.004041c4
push 0
push 0x4010a3
lea edx, [ebp - 0x20]
push 0
mov dword [0x40e63c], edx
lea ecx, [ebp - 0x38]
push str.STARTDLG
push ebx
mov dword [0x40e640], ecx
call sub.USER32.DLL_DialogBoxParamA
xor eax, eax
xor edx, edx
mov dword [0x40d55c], eax
mov dword [0x40e640], edx
mov dword [0x40e63c], edx
mov edx, 2
lea eax, [ebp - 0x38]
call fcn.004041e8
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004041e8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004055a8
cmp byte [0x40ccd0], 0
je 0x4038a2
call fcn.00402814
mov eax, 0x40dda8
mov ecx, 0x80
xor edx, edx
call fcn.00406fbc
cmp dword [0x40c054], 0
jle 0x4038c6
mov eax, dword [0x40c048]
call fcn.00406dd4
push dword [0x40e234]
call sub.GDI32.DLL_DeleteObject
cmp dword [0x40e238], 0
je 0x4038e5
push dword [0x40e238]
call sub.GDI32.DLL_DeleteObject
cmp dword [0x40d580], 0
jne 0x403906
cmp dword [0x40d564], 0
je 0x403906
mov eax, 0x40d580
mov edx, 0xff
call fcn.00406bbc
mov dword [0x40d564], 2
cmp dword [0x40c05c], 0
je 0x403923
mov eax, dword [0x40c05c]
call fcn.004027e4
push dword [0x40d580]
call sub.KERNEL32.DLL_ExitProcess
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403ae0
Capabilities:
Hide graphical window

Disassembly:
mov dword [0x40d574], 1
cmp dword [0x40d55c], 0
je 0x403b0b
mov eax, 0x7d
call fcn.00402adc
push eax
push 1
push dword [0x40d55c]
call sub.USER32.DLL_SetDlgItemTextA
xor edx, edx
mov dword [0x40d578], edx
mov dword [0x40d57c], 1
cmp dword [0x40d55c], 0
je 0x403b69
push 1
push dword [0x40d55c]
call sub.USER32.DLL_ShowWindow
cmp dword [0x40c054], 0
jne 0x403b60
cmp byte [0x40c018], 0
jne 0x403b60
push 0
push 1
push 0x111
push dword [0x40d55c]
call sub.USER32.DLL_SendMessageA
jmp 0x403b60
call fcn.00402b58
cmp dword [0x40d564], 2
jne 0x403b5b
cmp byte [0x40ccd0], 0
je 0x403b77
call fcn.00402814
ret
Function at 0x404210
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
cmp byte [ebx + 0x14], 0
mov edi, edx
mov esi, ecx
jne 0x404235
push 0
call sub.OLE32.DLL_OleInitialize
call sub.COMCTL32.DLL_InitCommonControls
mov byte [ebx + 0x14], 1
mov byte [ebx + 0x15], 0
push 0
push esi
call sub.USER32.DLL_ShowWindow
mov edx, edi
mov eax, ebx
call fcn.00404370
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebx + 0x10], ecx
push eax
push esi
call sub.USER32.DLL_GetWindowRect
push 2
lea edx, [ebp - 0x10]
push edx
push esi
call sub.USER32.DLL_GetParent
push eax
push 0
call sub.USER32.DLL_MapWindowPoints
cmp dword [ebx + 4], 0
je 0x40427c
push dword [ebx + 4]
call sub.USER32.DLL_DestroyWindow
push ebx
push dword [ebx]
push 0
push esi
call sub.USER32.DLL_GetParent
push eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
add eax, 0xfffffffe
push eax
push dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
inc edx
push edx
push 0x40000000
push 0
push str.RarHtmlClassName
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [ebx + 4], eax
cmp dword [ebx + 4], 0
je 0x4042cf
push 5
push dword [ebx + 4]
call sub.USER32.DLL_ShowWindow
push dword [ebx + 4]
call sub.USER32.DLL_UpdateWindow
cmp byte [ebx + 0x15], 0
jne 0x40434d
cmp dword [ebx + 4], 0
je 0x4042e8
push dword [ebx + 4]
call sub.USER32.DLL_DestroyWindow
xor ecx, ecx
mov dword [ebx + 4], ecx
push 5
push esi
call sub.USER32.DLL_ShowWindow
mov eax, dword [ebp + 8]
call fcn.00407010
add eax, eax
lea eax, [eax + eax*2]
add eax, 0x100
call fcn.00406dc0
mov edi, eax
mov edx, dword [ebp + 8]
mov eax, edi
call fcn.0040708c
mov edx, edi
mov eax, ebx
call fcn.004049b4
test al, al
jne 0x404329
mov edx, edi
mov eax, ebx
call fcn.004049ec
mov edx, edi
mov eax, ebx
call fcn.00404824
mov ebx, eax
mov eax, edi
call fcn.00406dd4
test ebx, ebx
je 0x40434d
push ebx
push esi
call sub.USER32.DLL_SetWindowTextA
mov eax, ebx
call fcn.00406dd4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40456c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
jmp 0x4045d0
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x2710
ja 0x4045e4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call sub.USER32.DLL_PeekMessageA
test eax, eax
je 0x4045d0
push 0
push 0
push 0
lea edx, [ebp - 0x24]
push edx
call sub.USER32.DLL_GetMessageA
lea ecx, [ebp - 0x24]
push ecx
call sub.USER32.DLL_TranslateMessage
lea eax, [ebp - 0x24]
push eax
call sub.USER32.DLL_DispatchMessageA
lea edx, [ebp - 4]
push edx
push esi
mov ecx, dword [esi]
call dword [ecx + 0x48]
test eax, eax
jl 0x40458c
cmp dword [ebp - 4], 0
je 0x40458c
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x404629
lea eax, [ebp - 8]
push eax
push 0x40cc60
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x404629
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x20]
test eax, eax
jl 0x404620
push edi
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
test eax, eax
setge bl
and ebx, 1
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405150
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ac
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov esi, edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.0040534c
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
push esi
call sub.USER32.DLL_GetWindowRect
lea edx, [ebp - 0x44]
push edx
push esi
call sub.USER32.DLL_GetClientRect
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x34]
inc ecx
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
inc eax
sub eax, dword [ebp - 0x38]
test bl, bl
mov dword [ebp - 0x18], eax
je 0x4051e7
cmp byte [ebp + 8], 0
jne 0x4051e7
mov eax, dword [ebp - 0x3c]
mov ecx, 0x64
imul dword [ebp - 0xc]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x38]
imul dword [ebp - 0x10]
cdq
mov edi, 0x64
idiv edi
add ecx, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0x206
push eax
push ecx
push 0
push 0
push 0
push esi
call sub.USER32.DLL_SetWindowPos
cmp byte [ebp + 8], 0
jne 0x405225
push 0x400
lea eax, [ebp - 0x444]
push eax
push esi
call sub.USER32.DLL_GetWindowTextA
push 1
push dword [ebp - 8]
lea ecx, [ebp - 0x444]
lea edx, [ebp - 0x444]
mov eax, dword [ebp - 4]
call fcn.00404fd8
lea edx, [ebp - 0x444]
push edx
push esi
call sub.USER32.DLL_SetWindowTextA
push 8
call sub.USER32.DLL_GetSystemMetrics
sub dword [ebp - 0x18], eax
push 5
push esi
call sub.USER32.DLL_GetWindow
mov edi, eax
mov dword [ebp - 0x1c], edi
xor esi, esi
jmp 0x405333
push 0x400
lea eax, [ebp - 0x844]
push eax
push edi
call sub.USER32.DLL_GetWindowTextA
cmp byte [ebp - 0x844], 0
je 0x405284
push 1
push dword [ebp - 8]
lea ecx, [ebp - 0x844]
lea edx, [ebp - 0x844]
mov eax, dword [ebp - 4]
call fcn.00404fd8
lea edx, [ebp - 0x844]
push edx
push edi
call sub.USER32.DLL_SetWindowTextA
test bl, bl
je 0x405323
lea ecx, [ebp - 0x854]
push ecx
push edi
call sub.USER32.DLL_GetWindowRect
mov eax, dword [ebp - 0x854]
sub eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x14]
sar edx, 1
jns 0x4052ac
adc edx, 0
sub eax, edx
mov ecx, 0x64
imul dword [ebp - 0xc]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x850]
sub eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x18]
imul dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x84c]
sub eax, dword [ebp - 0x854]
inc eax
imul dword [ebp - 0xc]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x848]
sub eax, dword [ebp - 0x850]
inc eax
imul dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
push 0x204
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ecx
push 0
push edi
call sub.USER32.DLL_SetWindowPos
push 2
push edi
call sub.USER32.DLL_GetWindow
mov edi, eax
cmp edi, dword [ebp - 0x1c]
je 0x405343
inc esi
test edi, edi
je 0x405343
cmp esi, 0x200
jl 0x405243
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405f48
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.004053f0
test eax, eax
je 0x405f6e
test ebx, ebx
je 0x405f6e
cmp word [ebx], 0
je 0x405f6e
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x405f76
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x405f89
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.00406194
xor eax, eax
jmp 0x405fa4
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x405f98
cmp eax, 3
jne 0x405f9f
mov eax, 2
jmp 0x405fa4
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x406140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.004053f0
test eax, eax
je 0x40616b
test ebx, ebx
je 0x40616b
cmp word [ebx], 0
je 0x40616b
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x406194
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.004053f0
test eax, eax
je 0x4061c1
test ebx, ebx
je 0x4061c1
cmp word [ebx], 0
je 0x4061c1
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x4061d0
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x4062e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, 0x40e64c
mov dword [ebp - 4], edx
mov esi, ecx
cmp dword [edi + 4], 0
mov ebx, eax
jne 0x406308
call fcn.004062b0
mov eax, dword [ebp - 4]
jmp 0x406321
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x406329
test al, 7
jne 0x40630d
cmp esi, 8
jb 0x4063b2
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x406332
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x4063d4
mov ecx, dword [ebp - 8]
mov edx, ebx
shr ebx, 8
xor dl, byte [eax + ecx]
and edx, 0xff
mov ecx, dword [edi + edx*4]
xor ecx, ebx
mov ebx, ecx
inc dword [ebp - 8]
cmp esi, dword [ebp - 8]
ja 0x4063b9
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x406478
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x40649b
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x4064ac
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x4064bb
or dword [ebp - 8], 2
xor eax, eax
cmp byte [ebx + 0x15], 0
jne 0x4064c8
add eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.004053f0
test eax, eax
je 0x4064f5
test esi, esi
je 0x4064f5
cmp word [esi], 0
je 0x4064f5
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x40650c
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x406525
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x406525
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x40658f
mov dword [ebx + 4], edi
test esi, esi
je 0x40655a
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.00406c8c
jmp 0x406563
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x406576
lea eax, [ebx + 0x17]
mov edx, dword [ebp - 4]
call fcn.0040708c
jmp 0x406585
lea edx, [ebx + 0x17]
mov ecx, 0x1000000
mov eax, esi
call fcn.00406c30
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.0040664c
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40680c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push esi
push edi
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x406836
cmp esi, 0x4e20
jle 0x40682c
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x406886
mov eax, ebx
call fcn.004069f0
test al, al
je 0x40686d
cmp esi, 0x4e20
jle 0x40686d
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.0040680c
jmp 0x406889
cmp dword [ebx + 0xc], 1
jne 0x406881
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x406881
xor eax, eax
jmp 0x406889
or eax, 0xffffffff
jmp 0x406889
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4072b8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00407214
mov esi, eax
mov eax, dword [0x41b6ec]
call fcn.00406f00
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push 0x41b704
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
mov eax, dword [0x40f5ec]
mov eax, dword [eax + 0x10]
test al, 0x5f
je 0x407312
and eax, 0x7f
push eax
push 0x41b704
call sub.KERNEL32.DLL_SetFileAttributesA
cmp ebx, 0xffffffff
je 0x407359
test esi, esi
je 0x407353
test esi, 1
je 0x407328
lea eax, [ebp - 8]
jmp 0x40732a
xor eax, eax
test esi, 2
je 0x407337
lea edx, [ebp - 0x10]
jmp 0x407339
xor edx, edx
test esi, 4
je 0x407346
lea ecx, [ebp - 0x18]
jmp 0x407348
xor ecx, ecx
mov esi, ecx
push eax
push edx
push esi
push ebx
call sub.KERNEL32.DLL_SetFileTime
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409a04
Capabilities:
Set file attributes

Disassembly:
mov edx, 0x40c7de
mov eax, 0x41b704
call fcn.00406ea4
mov dword [0x41b6ec], eax
test eax, eax
jne 0x409a6d
push 0
push 0x41b704
call sub.KERNEL32.DLL_SetFileAttributesA
mov edx, 0x40c7de
mov eax, 0x41b704
call fcn.00406ea4
mov dword [0x41b6ec], eax
test eax, eax
jne 0x409a6d
mov eax, 0x40d580
mov edx, 9
call fcn.00406bbc
push 0x41b704
mov eax, 0x6e
call fcn.00402adc
push eax
call fcn.004030a4
add esp, 8
mov eax, 1
ret
xor eax, eax
ret

Function at 0x409c14
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
cmp dword [0x40efc8], 0
jg 0x409c32
dec dword [0x40efc8]
xor eax, eax
mov dword [0x41b600], eax
or eax, 0xffffffff
pop esi
pop ebx
ret
cmp dword [0x41b600], 0
jg 0x409c87
push dword [0x41b61c]
mov ecx, 0x2000
mov edx, 1
mov eax, dword [0x41b5f8]
call fcn.00406f4c
mov dword [0x41b600], eax
test eax, eax
jne 0x409c6c
xor edx, edx
or eax, 0xffffffff
mov dword [0x41b600], edx
pop esi
pop ebx
ret
add dword [0x41b624], 0x2000
mov edx, dword [0x41b5f8]
mov dword [0x41b5fc], edx
call fcn.00409acc
mov ecx, dword [0x40f5ec]
test byte [ecx + 0x14], 1
je 0x409cbe
mov esi, dword [0x41b600]
mov ebx, dword [0x41b5fc]
jmp 0x409cb5
call fcn.0040aeb8
xor byte [ebx], al
mov al, byte [ebx]
and eax, 0xff
call fcn.0040aedc
inc ebx
mov edx, esi
add esi, 0xffffffff
test edx, edx
jne 0x409ca1
dec dword [0x41b600]
mov ecx, dword [0x41b5fc]
inc dword [0x41b5fc]
xor eax, eax
mov al, byte [ecx]
pop esi
pop ebx
ret

Function at 0x409d88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x409d97
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x40adfa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, eax
mov eax, edx
call fcn.0040af58
lea eax, [ebp - 0xc]
mov ecx, 0xc
mov edx, ebx
call fcn.00406fd0
xor ebx, ebx
call fcn.0040aeb8
xor byte [ebp + ebx - 0xc], al
mov al, byte [ebp + ebx - 0xc]
and eax, 0xff
call fcn.0040aedc
inc ebx
cmp ebx, 0xc
jl 0x40ae1c
mov edx, dword [0x40f5ec]
xor eax, eax
mov al, byte [ebp - 1]
test byte [edx + 0x14], 2
je 0x40ae56
movzx ecx, word [0x41b64a]
sar ecx, 8
jmp 0x40ae62
mov ecx, dword [0x41b650]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x40ae6e
or eax, 0xffffffff
jmp 0x40aeb1
mov edx, dword [0x41b600]
cmp edx, dword [0x40efc8]
jle 0x40ae84
mov ebx, dword [0x40efc8]
jmp 0x40ae8a
mov ebx, dword [0x41b600]
mov esi, dword [0x41b5fc]
jmp 0x40aea6
call fcn.0040aeb8
xor byte [esi], al
mov al, byte [esi]
and eax, 0xff
call fcn.0040aedc
inc esi
mov edx, ebx
add ebx, 0xffffffff
test edx, edx
jne 0x40ae92
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aedc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x41b810]
xor edx, eax
and edx, 0xff
mov ecx, dword [0x41b5f0]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x41b810]
shr ecx, 8
xor edx, ecx
mov dword [0x41b810], edx
mov edx, dword [0x41b810]
and edx, 0xff
add dword [0x41b814], edx
imul ecx, dword [0x41b814], 0x8088405
inc ecx
mov dword [0x41b814], ecx
mov edx, dword [0x41b814]
shr edx, 0x18
xor edx, dword [0x41b818]
and edx, 0xff
mov ecx, dword [0x41b5f0]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x41b818]
shr ecx, 8
xor edx, ecx
mov dword [0x41b818], edx
ret

Function at 0x40b13c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
jne 0x40b150
xor eax, eax
jmp 0x40b248
call fcn.0040b134
xor ebx, 0xffffffff
cmp edi, 8
jb 0x40b225
xor edx, edx
sub edi, 8
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x40b161
test edi, edi
je 0x40b243
xor edx, edx
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
dec edi
mov ebx, ecx
jne 0x40b229
mov eax, ebx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret