joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408a10
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x408a95
mov dword [esp + 4], 0x2f
mov dword [esp], ebx
call sub.msys_2.0.dll_strrchr
test eax, eax
je 0x408a80
lea ebp, [eax + 1]
mov ecx, ebp
sub ecx, ebx
cmp ecx, 6
jle 0x408a80
lea esi, [eax - 6]
mov ecx, 7
mov edi, str._.libs_
repe cmpsb byte [esi], byte es:[edi]
seta cl
mov esi, ecx
setb cl
mov edx, esi
cmp dl, cl
jne 0x408a80
mov ecx, 3
mov edi, 0x4155d0
mov esi, ebp
repe cmpsb byte [esi], byte es:[edi]
mov ebx, ebp
seta dl
setb cl
cmp dl, cl
jne 0x408a80
lea ebx, [eax + 4]
mov eax, dword [sym.imp.msys_2.0.dll_program_invocation_short_name]
mov dword [eax], ebx
mov eax, dword [sym.imp.msys_2.0.dll_program_invocation_name]
mov dword [0x41c548], ebx
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msys_2.0.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x37
mov dword [esp + 4], 1
mov dword [esp], str.A_NULL_argv_0__was_passed_through_an_exec_system_call._n
mov dword [esp + 0xc], eax
call sub.msys_2.0.dll_fwrite
call sub.msys_2.0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x40d750
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0
call sub.msys_2.0.dll_nl_langinfo
test eax, eax
je 0x40d8f1
mov edi, str.US_ASCII
mov ecx, 9
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
mov ebp, eax
je 0x40d800
mov ebx, dword [0x41c6b4]
test ebx, ebx
je 0x40d870
movzx esi, byte [ebx]
mov eax, esi
test al, al
jne 0x40d7b9
jmp 0x40d7e3
lea ebx, [ebx + edi + 1]
mov dword [esp], ebx
call sub.msys_2.0.dll_strlen
lea ebx, [ebx + eax + 1]
movzx esi, byte [ebx]
mov eax, esi
test al, al
je 0x40d7e3
mov dword [esp], ebx
call sub.msys_2.0.dll_strlen
mov edi, eax
mov dword [esp + 4], ebx
mov dword [esp], ebp
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x40d7df
mov eax, esi
cmp al, 0x2a
jne 0x40d7a0
cmp byte [ebx + 1], 0
jne 0x40d7a0
lea ebp, [ebx + edi + 1]
cmp byte [ebp], 0
mov eax, str.ASCII
cmove ebp, eax
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LC_ALL
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x40d815
cmp byte [eax], 0
jne 0x40d890
mov dword [esp], str.LC_CTYPE
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x40d82a
cmp byte [eax], 0
jne 0x40d890
mov dword [esp], str.LANG
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x40d83f
cmp byte [eax], 0
jne 0x40d890
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [esp + 4], str.CP_u
mov dword [esp + 8], eax
mov ebp, 0x41c6a4
mov dword [esp], 0x41c6a4
call sub.msys_2.0.dll_sprintf
mov ebx, dword [0x41c6b4]
test ebx, ebx
jne 0x40d78f
mov dword [0x41c6b4], str.CP936
mov edi, 5
mov esi, 0x43
mov ebx, str.CP936
jmp 0x40d7c3
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call sub.msys_2.0.dll_strchr
test eax, eax
je 0x40d83f
lea ebp, [eax + 1]
mov dword [esp + 4], 0x40
mov dword [esp], ebp
call sub.msys_2.0.dll_strchr
test eax, eax
je 0x40d7ef
sub eax, ebp
cmp eax, 0xc
mov ebx, eax
ja 0x40d83f
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov ebp, 0x41c6a4
mov dword [esp], 0x41c6a4
call sub.msys_2.0.dll_memcpy
mov byte [ebx + 0x41c6a4], 0
jmp 0x40d7ef
mov ebp, 0x416444
jmp 0x40d781
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x409d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x409d2f
pop dword [ebp - 0x20]
mov eax, 0xb3738aca
sub eax, 0xb332ed9b
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x34d16
push 0
mov eax, 0x6b7d3be7
add eax, 0x94c3a4f1
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x3675
mov esi, eax
mov edi, 0x206e79b8
add edi, 0xdfd2c20c
add edi, dword [ebp - 0x20]
mov edx, 0x52d20633
sub edx, 0xcfe6445c
xor dword [ebp - 4], 0x94ea4ba9
mov ebx, dword [edi]
sub dword [ebp - 0x14], 0x1224f242
add ebx, edx
add dword [ebp - 0x10], 0x189f3c3f
mov dword [esi], ebx
mov dword [ebp - 0x18], 0xc0e0b1d8
add esi, 0x3db9a9be
add esi, 0xc2465646
add edi, 0xbd12bcfe
sub edi, 0xbd12bcfa
loop 0x409d88
add eax, 0xb965aa72
add eax, 0x469b2235
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4d5142df
sub ecx, 0x4d1142df
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0xe060b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00e06200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xe060d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe060c2
add dl, dl
jne 0xe060e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe06134
xor eax, eax
add dl, dl
jne 0xe060ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe061d5
add dl, dl
jne 0xe060fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe06108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe06113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0611e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xe0612a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xe060cd
mov eax, 1
add dl, dl
jne 0xe06142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0614d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe06139
sub eax, ebx
mov ebx, 1
jne 0xe06180
mov ecx, 1
add dl, dl
jne 0xe06166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe06171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe0615d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe060cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xe06197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe061a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe0618e
cmp eax, 0x7d00
jae 0xe061c5
cmp eax, 0x500
jb 0xe061c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe060cd
cmp eax, 0x7f
ja 0xe061c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe060cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xe061f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xe060cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x41ae1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x41ae2e
pop dword [ebp - 8]
mov eax, 0x88d13017
sub eax, 0x888f81e9
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3f9bc
push 0
mov eax, 0x7aa998f7
add eax, 0x85985919
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x6ea94738
sub ecx, 0x6ea8f953
xor ebx, ebx
add ebx, eax
mov edx, 0x438200
add edx, dword [ebp - 8]
mov edi, 0xa6efa5f1
sub edi, 0xbb194337
xor dword [ebp - 4], edi
mov esi, dword [edx]
mov dword [ebp - 4], 0x1fa8521e
xor esi, edi
mov dword [ebx], esi
xor dword [ebp - 4], eax
add ebx, 4
add edx, 4
loop 0x41ae89
add eax, 0x12a67
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x80be6573
add ecx, 0x7f819a8d
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x402c00
pop dword [ebp - 0x28]
mov eax, 0x9cb1fa47
sub eax, 0x9c71ce47
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x981cba04
add dword [ebp - 0x38], 0xb6358b47
mov dword [ebp - 0x34], 0xe8fcbff2
sub dword [ebp - 0x34], 0xb6c973ad
mov dword [ebp - 0x30], 0xd49c3bd4
sub dword [ebp - 0x30], 0x884ff7a6
mov dword [ebp - 0x2c], 0x272ea5a0
add dword [ebp - 0x2c], 0xd8d15a60
lea eax, [ebp - 0x38]
push eax
mov eax, 0xd6077a6a
add eax, 0x2a390622
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xb9c9dc39
sub dword [ebp - 0x38], 0x455772e3
mov dword [ebp - 0x34], 0x3b8cfb44
sub dword [ebp - 0x34], 0xfa2099cf
mov dword [ebp - 0x30], 0xeec0638c
add dword [ebp - 0x30], 0x74af08e0
mov dword [ebp - 0x2c], 0x8b15e468
add dword [ebp - 0x2c], 0x74ea1b98
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x39296
push 0
call eax
mov ecx, 0x34438b15
sub ecx, 0x34433931
mov edx, eax
mov esi, 0x411000
add esi, dword [ebp - 0x28]
mov ebx, 0xd3661795
xor dword [ebp - 0x1c], edx
mov edi, dword [esi]
sub dword [ebp - 0x18], 0xab7c84b9
sub edi, ebx
mov dword [ebp - 0x14], 0x4d0d721c
mov dword [edx], edi
add dword [ebp - 0x18], 0xc70a2cf3
add edx, 0x90dfe6a8
add edx, 0x6f20195c
add esi, 4
loop 0x402d11
add eax, 0x13a63
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xed14584d
sub ecx, 0xecd4584d
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x428458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x428467
pop dword [ebp - 8]
mov eax, 0xf10520c6
add eax, 0xf3d63a1
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x53194
push 0
mov eax, 0x736b22f6
add eax, 0x8cd98fb2
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x7f7b9af5
sub ecx, 0x7f7b468e
xor edx, edx
add edx, eax
mov esi, 0xfc117166
sub esi, 0xfbca0366
add esi, dword [ebp - 8]
mov ebx, 0x831aa220
add ebx, 0x5cd15481
sub dword [ebp - 4], ebx
mov edi, dword [esi]
add dword [ebp - 4], 0x4c011c03
xor edi, ebx
mov dword [edx], edi
add dword [ebp - 4], eax
add edx, 0xac830c6d
add edx, 0x537cf397
add esi, 0x3d97a808
add esi, 0xc26857fc
loop 0x4284c8
add eax, 0x5047eb0f
sub eax, 0x5046a6a0
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x256cb6bd
sub ecx, 0x252cb6bd
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x43fbad
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5e8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fbf0
push str.SystemFunction040
push dword [0x46b5e8]
call edi
push str.SystemFunction041
push dword [0x46b5e8]
mov dword [0x46b5f0], eax
call edi
mov dword [0x46b5f4], eax
jmp 0x43fbf5
mov eax, dword [0x46b5f4]
cmp dword [0x46b5f0], 0
je 0x43fc06
test eax, eax
jne 0x43fcad
push 0x46b5ec
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fcb7
push str.CryptProtectMemory
push dword [0x46b5ec]
call edi
cmp dword [0x46b5f0], 0
mov dword [0x46b5f8], eax
jne 0x43fc6b
test eax, eax
jne 0x43fc6b
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x28
push str.cryputil.cpp
call fcn.004037d3
jmp 0x43fcb7
push str.CryptUnprotectMemory
push dword [0x46b5ec]
call edi
cmp dword [0x46b5f4], 0
mov dword [0x46b5fc], eax
jne 0x43fcad
test eax, eax
jne 0x43fcad
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x2d
jmp 0x43fc5f
mov dword [0x46b600], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x1000f564
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000f573
pop dword [ebp - 0x10]
mov eax, 0x1000f573
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x4beb9102
sub dword [ebp - 0x20], 0xfd994bb7
mov dword [ebp - 0x1c], 0x24b1cdd1
add dword [ebp - 0x1c], 0xd817e74
mov dword [ebp - 0x18], 0x2a77a7b
add dword [ebp - 0x18], 0x49a4c9b3
mov dword [ebp - 0x14], 0x9b2f6d25
add dword [ebp - 0x14], 0x64d092db
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x28156068
add dword [ebp - 0x20], 0x4c5d08ee
mov dword [ebp - 0x1c], 0x189ca7e2
sub dword [ebp - 0x1c], 0xd730466d
mov dword [ebp - 0x18], 0x68fa628e
add dword [ebp - 0x18], 0xfa7509de
mov dword [ebp - 0x14], 0x43cc936b
sub dword [ebp - 0x14], 0x43cc936b
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xdf5ebde1
add eax, 0x30a15343
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x404ef
push 0
call eax
mov ecx, 0xc4877ec4
add ecx, 0x3b78c5f6
xor edi, edi
add edi, eax
mov esi, 0x898a4bbd
sub esi, 0x79852dbd
add esi, dword [ebp - 0x10]
mov ebx, 0xfee3f132
add ebx, 0x4289f16d
xor dword [ebp - 0xc], 0x125b350
mov edx, dword [esi]
sub dword [ebp - 8], 0x7e62f0
sub edx, ebx
xor dword [ebp - 0xc], edx
mov dword [edi], edx
sub dword [ebp - 0xc], edx
add edi, 0xd664ef1b
add edi, 0x299b10e9
add esi, 0x1c6ec4e2
add esi, 0xe3913b22
loop 0x1000f68d
add eax, 0x399588b5
add eax, 0xc66b7d06
mov ebx, eax
add eax, 0x9afc8905
add eax, 0x65037700
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x100100e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x10040d67
call fcn.1004053e
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10010145
call fcn.1000d37a
mov esi, eax
jmp 0x10010228
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10010163
call fcn.1000d37a
jmp 0x1001021f
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x10010159
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x10010196
mov esi, 0x8007000e
jmp 0x10010221
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000f564
mov dword [ebp - 4], 1
jmp 0x100101d5
cmp dword [ebp - 0x418], 0
je 0x1001018c
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x428]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10010159
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.1000f564
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10010241
lea ecx, [ebp - 0x418]
call fcn.10010357
lea ecx, [ebp - 0x420]
call fcn.1000d2ec
mov eax, esi
call fcn.10040597
ret 0x10
Function at 0x1003eed2
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x10043494
call fcn.1004049f
xor esi, esi
push 0x1004a9c4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.1000f564
mov dword [ebp - 4], esi
cmp dword [0x1004a9bc], esi
je 0x1003ef1a
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
jmp 0x1003ef8a
push 1
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call fcn.1000f564
test eax, eax
jns 0x1003ef32
push 8
pop edi
jmp 0x1003ef7c
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x1003ef62
cmp edi, 2
jbe 0x1003ef43
cmp edi, 7
jne 0x1003ef62
push 1
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
call fcn.1000f564
mov esi, dword [ebp - 0x10]
test eax, eax
js 0x1003ef2d
mov eax, dword [ebp + 0x1c]
mov ecx, esi
shr eax, 1
jmp 0x1003ef68
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push eax
push ecx
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
push dword [ebp - 0x14]
call fcn.1000f564
push esi
call fcn.1000f564
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100311d4
mov eax, edi
call fcn.10040577
ret 0x18

Function at 0x1003f1a6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x10043494
call fcn.1004049f
xor ebx, ebx
push 0x1004a9c4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
mov esi, ebx
call fcn.1000f564
mov dword [ebp - 4], ebx
cmp dword [0x1004a9bc], ebx
je 0x1003f1f0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
jmp 0x1003f295
push 1
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call fcn.1000f564
test eax, eax
jns 0x1003f208
push 8
pop edi
jmp 0x1003f285
mov ebx, dword [ebp + 0x1c]
mov edx, dword [ebx]
mov eax, dword [0x1004a9c0]
shr edx, 1
push edx
mov dword [ebp - 0x10], edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp dword [ebp - 0x10], 0
mov esi, eax
jbe 0x1003f229
mov byte [esi], 0
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1003f25d
mov ecx, dword [ebx]
shr ecx, 1
je 0x1003f25d
dec ecx
dec eax
cmp ecx, eax
cmovae ecx, eax
mov byte [ecx + esi], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 0
jbe 0x1003f285
cmp dword [ecx], 2
jbe 0x1003f26f
cmp dword [ecx], 7
jne 0x1003f285
push eax
lea eax, [ebp + 0x18]
push eax
push esi
call fcn.1000f564
test eax, eax
js 0x1003f203
mov eax, dword [ebp - 0x10]
add eax, eax
mov dword [ebx], eax
push dword [ebp - 0x14]
call fcn.1000f564
push esi
call fcn.1000f564
mov esi, edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100311d4
mov eax, esi
call fcn.10040577
ret 0x18
Function at 0x1003f61b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10005a98]
jne 0x10040393
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1004ab58], eax
mov dword [0x1004ab54], ecx
mov dword [0x1004ab50], edx
mov dword [0x1004ab4c], ebx
mov dword [0x1004ab48], esi
mov dword [0x1004ab44], edi
mov word [0x1004ab70], ss
mov word [0x1004ab64], cs
mov word [0x1004ab40], ds
mov word [0x1004ab3c], es
mov word [0x1004ab38], fs
mov word [0x1004ab34], gs
pushfd
pop dword [0x1004ab68]
mov eax, dword [ebp]
mov dword [0x1004ab5c], eax
mov eax, dword [ebp + 4]
mov dword [0x1004ab60], eax
lea eax, [ebp + 8]
mov dword [0x1004ab6c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1004aaa8], 0x10001
mov eax, dword [0x1004ab60]
mov dword [0x1004aa5c], eax
mov dword [0x1004aa50], 0xc0000409
mov dword [0x1004aa54], 1
mov eax, dword [0x10005a98]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1004a8d0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1004aaa0], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10005cb8
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1004aaa0], 0
jne 0x1004047f
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x11a3008], 0x8088405
inc edx
mov dword [ebx + 0x11a3008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret