joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479586
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49b354
push 0x49b34c
push str.FlsAlloc
push 0x1f
call fcn.004793b1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4795ba
push dword [ebp + 8]
mov ecx, esi
call dword [0x489384]
call esi
jmp 0x4795c0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x479604
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49b364
push 0x49b35c
push str.FlsGetValue
push 0x21
call fcn.004793b1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x47963b
push dword [ebp + 8]
mov ecx, esi
call dword [0x489384]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x479643
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49b36c
push 0x49b364
push str.FlsSetValue
push 0x22
call fcn.004793b1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x47967d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x489384]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x47d3e1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0047d35d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x47d550
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x47d550
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x47d505
jg 0x47d43d
test eax, eax
je 0x47d4fb
push 1
push 0x1000
call fcn.00479075
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x47d460
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x47d4f2
push 0x8000
push ebx
call fcn.00474f8f
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x47d489
jg 0x47d484
cmp ecx, 0x1000
jb 0x47d489
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00478725
add esp, 0x10
cmp eax, 0xffffffff
je 0x47d4ce
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x47d484
jl 0x47d4b5
test ecx, ecx
jne 0x47d476
push dword [ebp - 0xc]
push ebx
call fcn.00474f8f
push esi
call fcn.004790d2
add esp, 0xc
xor ebx, ebx
jmp 0x47d55e
cmp byte [edi + 0x24], 0
je 0x47d4e5
cmp dword [edi + 0x20], 5
jne 0x47d4e5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x47d4f0
mov ebx, dword [edi + 0x18]
jmp 0x47d4f2
xor ebx, ebx
push esi
call fcn.004790d2
pop ecx
jmp 0x47d55e
test ecx, ecx
jg 0x47d4c7
jl 0x47d505
test eax, eax
jae 0x47d4c7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0047218e
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x47d525
cmp byte [edi + 0x1c], 0
je 0x47d4c7
jmp 0x47d556
push ebx
call fcn.0047d2f3
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x47d4c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x47d55e
cmp byte [edi + 0x1c], 0
je 0x47d55b
mov ebx, dword [edi + 0x18]
jmp 0x47d55e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0047218e
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4803f2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x48048f
push ebx
push esi
call fcn.004803bb
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0047cc6d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x48043c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x48048e
push edi
push eax
call fcn.00479cbe
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x48045c
call fcn.004790d2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x48048d
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0047cc6d
add esp, 0x20
test eax, eax
jne 0x48047b
push edi
call fcn.004790d2
jmp 0x480483
push ebx
call fcn.004790d2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x480492
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4804a3
pop esi
ret
push ebx
push edi
push esi
call fcn.004803bb
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00479cbe
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4804cb
push ebx
push esi
push edi
call fcn.00460620
add esp, 0xc
push 0
call fcn.004790d2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x480c25
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00480740

Function at 0x482ba7
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0047b070
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x482c16
cmp esi, dword [ebp - 4]
je 0x482c11
cmp dword [ebp + 0xc], 0
je 0x482c11
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x482bee
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.004826f9
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x482c18
xor eax, eax
inc eax
jmp 0x482c18
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x482c7d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4a4440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0047b070
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0047b070
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x482cf4
cmp word [ecx], dx
je 0x482cf4
mov eax, dword [0x49bd44]
push edi
dec eax
push eax
push 0x49bc30
call fcn.00482c1c
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x482d67
cmp word [eax], dx
je 0x482d67
mov eax, dword [edi]
test eax, eax
je 0x482d18
cmp word [eax], dx
je 0x482d18
lea eax, [ebp - 0x10]
push eax
call fcn.004825ff
jmp 0x482d21
lea eax, [ebp - 0x10]
push eax
call fcn.0048269a
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x482d91
mov eax, dword [0x49bc2c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x49b920
call fcn.00482c1c
add esp, 0xc
test al, al
je 0x482d91
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x482d5c
cmp word [eax], di
je 0x482d5c
lea eax, [ebp - 0x10]
push eax
call fcn.004825ff
pop ecx
jmp 0x482d93
lea eax, [ebp - 0x10]
push eax
call fcn.0048269a
jmp 0x482d59
mov eax, dword [edi]
test eax, eax
je 0x482d7e
cmp word [eax], dx
je 0x482d7e
lea eax, [ebp - 0x10]
push eax
call fcn.004825b4
pop ecx
jmp 0x482d91
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x482e5c
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00482aa1
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x482e5c
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x482e5c
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x482e5c
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x482de9
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0047981f
test ebx, ebx
je 0x482e57
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0047981f
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x482e5c
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x482e5c
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0048674a
add esp, 0x10
xor eax, eax
inc eax
jmp 0x482e5e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045ea49
leave
ret
Function at 0x4862a3
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4a4440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x4862e6
call fcn.004699c9
mov dword [eax], 0xf
call fcn.004699dc
mov dword [eax], 0xd
call fcn.00467a6a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045ea49
leave
ret
test eax, eax
jne 0x4862ed
inc eax
jmp 0x4862da
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x4862d8
xor eax, eax
cmp ecx, 1
setne al
jmp 0x4862da

Function at 0x488140
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48816d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48816d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40b600
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40b687
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40b687
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40b687
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.00402180
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov ecx, dword [ebp + 0x14]
call fcn.004021c0
push eax
call fcn.00404470
add esp, 0xc
mov al, 1
jmp 0x40b689
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4a1b10
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x99000]
push edi
mov ebp, esp
lea ebx, [esp - 0x3e80]
xor eax, eax
push eax
cmp esp, ebx
jne 0x4a1b28
inc esi
inc esi
push ebx
push 0x9fd0c
push edi
add ebx, 4
push ebx
push 0x7b05
push esi
add ebx, 4
push ebx
push eax
mov dword [ebx], 0x20003
push ebp
push edi
push esi
push ebx
sub esp, 0x7c
mov edx, dword [esp + 0x90]
mov dword [esp + 0x74], 0
mov byte [esp + 0x73], 0
mov ebp, dword [esp + 0x9c]
lea eax, [edx + 4]
mov dword [esp + 0x78], eax
mov eax, 1
movzx ecx, byte [edx + 2]
mov ebx, eax
shl ebx, cl
mov ecx, ebx
dec ecx
mov dword [esp + 0x6c], ecx
movzx ecx, byte [edx + 1]
shl eax, cl
dec eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0xa8]
movzx esi, byte [edx]
mov dword [ebp], 0
mov dword [esp + 0x60], 0
mov dword [eax], 0
mov eax, 0x300
mov dword [esp + 0x64], esi
mov dword [esp + 0x5c], 1
mov dword [esp + 0x58], 1
mov dword [esp + 0x54], 1
mov dword [esp + 0x50], 1
movzx ecx, byte [edx + 1]
add ecx, esi
shl eax, cl
lea ecx, [eax + 0x736]
cmp dword [esp + 0x74], ecx
jae 0x4a1bfd
mov eax, dword [esp + 0x78]
mov word [eax], 0x400
add eax, 2
loop 0x4a1bf3
mov ebx, dword [esp + 0x94]
xor edi, edi
mov dword [esp + 0x48], 0xffffffff
mov edx, ebx
add edx, dword [esp + 0x98]
mov dword [esp + 0x4c], edx
xor edx, edx
cmp ebx, dword [esp + 0x4c]
je 0x4a25a3
movzx eax, byte [ebx]
shl edi, 8
inc edx
inc ebx
or edi, eax
cmp edx, 4
jle 0x4a1c1d
mov ecx, dword [esp + 0xa4]
cmp dword [esp + 0x74], ecx
jae 0x4a25ab
Function at 0x401a80
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406480
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4064a1
mov eax, 0xff
call fcn.00401a80
xor byte [esi], al
inc esi
dec ebx
jne 0x406491
pop esi
pop ebx
ret

Function at 0x40f944
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareInstallShieldISWI7.0SetupExeLog
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f99b
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push 0x440a1c
push 0
push 0
push str.SetupLogFileName
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40f992
mov byte [0x441a1c], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x40fb6c
Capabilities:
Hide graphical window

Disassembly:
push dword [0x441a2c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40fb98
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x441a2c]
call esi
push 0
push dword [0x441a20]
call esi
pop esi
ret
Function at 0x41f22d
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push str.KERNEL32
mov dword [ebp - 4], ebx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x41f330
push edi
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x41f2bf
push dword [ebp + 8]
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x82c]
push eax
call fcn.0041f743
test eax, eax
je 0x41f297
lea eax, [ebp - 0x82c]
push eax
call fcn.0041f534
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x82c]
push eax
call edi
test eax, eax
je 0x41f326
cmp dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x1c]
je 0x41f31d
mov eax, SysReAllocString
jmp 0x41f31d
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp + 0xc], ebx
mov cl, byte [eax]
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x42c], cl
mov cl, byte [eax + 1]
mov al, byte [eax + 2]
mov byte [ebp - 0x42b], cl
mov byte [ebp - 0x42a], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x42c]
push eax
mov byte [ebp - 0x429], bl
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x41f326
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp - 8]
imul eax, dword [ebp - 0xc]
shr eax, 0xa
mov dword [esi], eax
mov dword [ebp - 4], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret

Function at 0x41f384
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push dword [0x43c8cc]
lea eax, [ebp - 0x400]
push dword [ebp + 8]
push eax
call fcn.0041f68d
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
lea eax, [ebp - 0x400]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x41f3c9
xor eax, eax
leave
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
pop eax
leave
ret

Function at 0x41f629
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
push dword [ebp + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
call fcn.0041f5ff
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
pop edi
je 0x41f687
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x41f682
cmp eax, 5
jne 0x41f687
push 1
pop eax
jmp 0x41f689
xor eax, eax
leave
ret 4
Function at 0x41f7a5
Capabilities:
Create directory

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + 0x14], 1
call edi
inc eax
inc eax
push eax
call fcn.00425de7
pop ecx
mov esi, eax
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x43c004
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
mov ebx, esi
call edi
mov edi, eax
xor ebp, ebp
test edi, edi
jbe 0x41f81f
cmp byte [ebx], 0x5c
jne 0x41f812
and byte [ebx], 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41f80f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41f81a
mov byte [ebx], 0x5c
inc ebx
inc ebp
cmp ebp, edi
jb 0x41f7ed
jmp 0x41f81f
and dword [esp + 0x10], 0
push esi
call fcn.0042541c
mov eax, dword [esp + 0x14]
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x41f832
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41f84a
test al, 0x10
jne 0x41f84a
push 1
pop eax
jmp 0x41f84c
xor eax, eax
ret 4

Function at 0x41f8a6
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.0041f832
test eax, eax
jne 0x41f8ba
push 1
pop eax
jmp 0x41f8f7
push ebx
push esi
xor ebx, ebx
call fcn.0041f8fb
test eax, eax
jne 0x41f8f4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
call edi
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x41f8ef
push 1
pop ebx
push 0
call edi
pop edi
mov eax, ebx
pop ebx
pop esi
ret 4
Function at 0x4033c0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x543008], 0x8088405
inc edx
mov dword [ebx + 0x543008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x42dff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x42e0da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404f5c
dec eax
jle 0x42e059
mov edx, dword [ebp - 4]
mov eax, 0x42e0f0
call fcn.004052a0
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404f5c
dec eax
cmp ebx, eax
jne 0x42e059
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f5c
mov ecx, eax
sub ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004051bc
mov eax, dword [ebp - 4]
call fcn.00404f5c
mov ebx, eax
test ebx, ebx
jle 0x42e090
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
call fcn.004051b4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov cl, byte [ecx + edi - 1]
xor cl, 0x62
mov byte [eax + edx - 1], cl
inc dword [ebp - 8]
dec ebx
jne 0x42e06e
mov eax, dword [ebp - 4]
call fcn.00404f5c
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov ecx, 4
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [ebp - 8], 0
jle 0x42e0c4
lea eax, [ebp - 4]
call fcn.004051b4
mov edx, eax
mov ecx, dword [ebp - 8]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e0e1
lea eax, [ebp - 4]
call fcn.00404c80
ret

Function at 0x42e680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edx, [ebp - 4]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004052e8
cmp dword [ebp - 4], 0
jle 0x42e6bd
mov eax, ebx
call fcn.004051b4
mov edx, eax
mov ecx, dword [ebp - 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx]
call fcn.00404f5c
mov esi, eax
test esi, esi
jle 0x42e6f1
mov dword [ebp - 4], 1
mov eax, ebx
call fcn.004051b4
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov edi, dword [ebp - 4]
mov cl, byte [ecx + edi - 1]
xor cl, 0x62
mov byte [eax + edx - 1], cl
inc dword [ebp - 4]
dec esi
jne 0x42e6d1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x432ab0
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call fcn.004078ec
test eax, eax
jne 0x432aef
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x432aef
cmp dword [eax + 0x3c], 0
je 0x432aef
mov esi, dword [eax + 0x3c]
add esi, ebx
push 0xf8
push esi
call fcn.004078ec
test eax, eax
jne 0x432aed
cmp dword [esi], 0x4550
je 0x432aef
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x435df0
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
mov edx, 0x40
mov eax, ebx
call fcn.0042cc9c
test al, al
je 0x435e34
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x435e34
cmp dword [eax + 0x3c], 0
je 0x435e34
mov esi, dword [eax + 0x3c]
add esi, ebx
mov edx, 0xf8
mov eax, esi
call fcn.0042cc9c
test al, al
je 0x435e32
cmp dword [esi], 0x4550
je 0x435e34
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4384c4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
mov ebx, dword [eax]
mov esi, ebx
xor esi, ecx
and esi, 0xff
shr ebx, 8
mov esi, dword [edx + esi*4]
xor esi, ebx
mov dword [eax], esi
and esi, 0xff
add dword [eax + 4], esi
imul ebx, dword [eax + 4], 0x8088405
inc ebx
mov dword [eax + 4], ebx
shr ebx, 0x18
mov esi, dword [eax + 8]
xor ebx, esi
and ebx, 0xff
shr esi, 8
mov edx, dword [edx + ebx*4]
xor edx, esi
mov dword [eax + 8], edx
mov eax, ecx
pop esi
pop ebx
ret