joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40879a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00415be0
and dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 0x17ae
je 0x4087c1
inc dword [ebp - 4]
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4087ea
lea eax, [ebp - 0x2004]
push eax
mov eax, esi
call fcn.0040337d
jmp 0x4087f8
and dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov eax, esi
leave
ret

Function at 0x4087fc
Capabilities:
Delete directory

Disassembly:
mov eax, 0x4176b0
call fcn.00416288
sub esp, 0x3c
push ebx
xor ebx, ebx
cmp dword [0x420550], ebx
je 0x4088ae
push esi
push edi
lea eax, [ebp - 0x20]
call fcn.0040bb6b
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040bd70
mov ecx, dword [eax]
cmp ecx, ebx
jne 0x408836
xor ecx, ecx
jmp 0x408838
mov ecx, dword [ecx]
mov eax, dword [eax + 8]
mov edx, dword [ecx + 8]
cmp edx, eax
ja 0x408844
sub eax, edx
mov ecx, dword [ecx + 4]
push dword [ecx + eax*4]
lea esi, [ebp - 0x48]
call fcn.004071fc
mov dword [ebp - 4], ebx
call fcn.0040b9e7
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 0x17b4
mov dword [ebp - 0x10], ebx
jmp 0x408875
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 2
jl 0x408869
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x408889
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
or dword [ebp - 4], 0xffffffff
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.00403438
cmp dword [0x420550], ebx
jne 0x40881a
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4088bb
Capabilities:
Check for time delay via gettickcount
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x4175df
call fcn.00416288
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
mov byte [ebp - 0x10], 0
lea edi, [ebp - 0xf]
stosb byte es:[edi], al
mov al, byte [0x41aac9]
cmp dword [esi + 0x14], 0x10
mov byte [ebp - 0x10], al
jb 0x4088ea
mov eax, dword [esi]
jmp 0x4088ec
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x408a0c
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x14]
je 0x40891b
push str.windows6072XP
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x40891b
mov dword [ebp - 0x14], edi
mov eax, esi
call fcn.0040b337
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0x17b9
mov ebx, eax
mov dword [ebp - 0x14], edi
jmp 0x40893f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 2
jl 0x408933
cmp ebx, 0xffffffff
je 0x4089a8
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x14]
add eax, 0x17ba
je 0x40895c
inc dword [ebp - 0x14]
push ebx
push edi
push esi
lea esi, [ebp - 0x34]
call fcn.0040630a
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push eax
call fcn.004088bb
pop ecx
mov bl, al
pop ecx
neg bl
sbb bl, bl
or dword [ebp - 4], 0xffffffff
push 1
xor edi, edi
call fcn.00403438
inc bl
je 0x408993
xor al, al
jmp 0x408a6c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x14]
add eax, 0x17bb
je 0x4089a6
inc dword [ebp - 0x14]
xor edi, edi
cmp dword [esi + 0x14], 0x10
jb 0x4089b2
mov eax, dword [esi]
jmp 0x4089b4
mov eax, esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40898c
mov dword [ebp + 8], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x4089df
push str.windows6076XP
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x4089df
mov dword [ebp + 8], edi
push esi
call fcn.0040b714
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov dword [ebp + 8], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x408a6a
push str.windows6078XP
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x408a6a
mov dword [ebp + 8], edi
jmp 0x408a6a
test eax, 0x410
je 0x40898c
call fcn.0040d480
cdq
mov ecx, 0x39fd3c1
idiv ecx
mov dword [ebp + 8], edx
call fcn.0040d480
cdq
mov ecx, 0x17c0
idiv ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
imul eax, ecx
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov dword [ebp + 8], 0
call esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x408a6a
call esi
mov dword [ebp + 8], eax
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x408cc1
Capabilities:
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
push esi
mov dword [ebp - 0x10], 0x17fd
mov esi, eax
mov dword [ebp - 0xc], ebx
jmp 0x408cea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, 2
jl 0x408cde
or edx, 0xffffffff
cmp dword [ebp + 8], ebx
jbe 0x408d54
push edi
dec dword [ebp + 8]
xor eax, eax
mov byte [ebp - 4], bl
lea edi, [ebp - 3]
stosb byte es:[edi], al
mov al, byte [0x41ab39]
mov byte [ebp - 4], al
movzx eax, byte [esi]
movzx ecx, dl
xor ecx, eax
inc esi
mov dword [ebp - 0xc], 8
xor eax, eax
mov byte [ebp - 8], bl
lea edi, [ebp - 7]
stosb byte es:[edi], al
mov al, byte [0x41ab45]
mov byte [ebp - 8], al
test cl, 1
je 0x408d3f
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x408d41
shr ecx, 1
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jg 0x408d1f
shr edx, 8
xor edx, ecx
cmp dword [ebp + 8], ebx
ja 0x408cfb
pop edi
mov eax, edx
pop esi
not eax
pop ebx
leave
ret
Function at 0x409b0a
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
mov dword [ebp - 4], ebx
call esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x409b30
call esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x409b52
push str.windows6328XP
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x409b52
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x14], 0x500
call fcn.0040d480
cdq
mov ecx, 0x3c5d34a
idiv ecx
mov dword [ebp - 4], edx
call fcn.0040d480
cdq
mov ecx, 0x18b9
idiv ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
imul eax, ecx
mov dword [ebp - 4], eax
call fcn.0040d480
cdq
mov ecx, 0x18bb
idiv ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0x3c6216c
mov eax, dword [ebp - 4]
test eax, eax
mov eax, dword [ebp - 0x10]
jne 0x409bae
mov eax, dword [ebp - 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x409c4e
call fcn.0040d480
cdq
mov ecx, 0x3c6487d
idiv ecx
mov dword [ebp - 4], edx
call fcn.0040d480
cdq
mov ecx, 0x18bc
idiv ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
imul eax, ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x409c16
mov dword [ebp - 8], ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
call fcn.0040d480
cdq
mov ecx, 0x3c6969f
idiv ecx
mov dword [ebp - 4], edx
call fcn.0040d480
cdq
mov ecx, 0x18be
idiv ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
imul eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], ebx
pop esi
setne al
pop ebx
leave
ret
Function at 0x409edd
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x417641
call fcn.00416288
sub esp, 0x180
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
push esi
push edi
mov byte [ebp - 0x18], bl
xor eax, eax
lea edi, [ebp - 0x17]
stosb byte es:[edi], al
mov al, byte [0x41ac9d]
mov byte [ebp - 0x18], al
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
mov dword [ebp - 4], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], ebx
call edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x409f34
call edi
mov dword [ebp - 0x10], eax
call fcn.0040d480
cdq
mov ecx, 0x3ca4037
idiv ecx
mov dword [ebp - 0x10], edx
call fcn.0040d480
cdq
mov ecx, 0x18d6
idiv ecx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
imul eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 0x18d7
mov dword [ebp - 0x10], ebx
jmp 0x409f7a
call edi
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 2
jl 0x409f72
mov eax, dword [ebp + 0xc]
sub eax, 0x1a
je 0x409ff4
dec eax
dec eax
je 0x409fd1
sub eax, 0xa
je 0x409fa9
lea ecx, [ebp - 0x44]
call fcn.0040d151
push 0x41b64c
lea eax, [ebp - 0x44]
push eax
call fcn.00410998
mov esi, str._ProgramFiles_
push esi
call fcn.0040d2b0
pop ecx
mov ecx, esi
lea esi, [ebp - 0x38]
call fcn.00403470
mov dword [ebp + 0xc], ebx
mov eax, dword [ebp + 0xc]
add eax, 0x18de
je 0x40a030
inc dword [ebp + 0xc]
jmp 0x40a030
lea eax, [ebp - 0x6c]
push str.Local_AppData
push eax
call fcn.00409c58
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 3
call fcn.004033e8
lea esi, [ebp - 0x6c]
jmp 0x40a01b
lea eax, [ebp - 0x88]
push str.AppData
push eax
call fcn.00409c58
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.004033e8
lea esi, [ebp - 0x88]
push 1
xor edi, edi
mov byte [ebp - 4], 1
call fcn.00403438
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
mov dword [ebp + 0xc], ebx
call edi
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40a044
call edi
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x24], 0x10
mov eax, dword [ebp - 0x38]
jae 0x40a050
lea eax, [ebp - 0x38]
push 0x104
lea ecx, [ebp - 0x18c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x40a09c
lea eax, [ebp - 0x18c]
push eax
mov eax, dword [ebp + 8]
call fcn.0040337d
xor eax, eax
inc eax
push eax
xor edi, edi
lea esi, [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], bl
call fcn.00403438
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x14], 0x18e3
mov dword [ebp + 0xc], ebx
jmp 0x40a0b3
call edi
mov dword [ebp - 0x14], eax
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, 2
jl 0x40a0ab
lea ecx, [ebp - 0x50]
call fcn.0040d151
push 0x41b64c
lea eax, [ebp - 0x50]
jmp 0x409fa3
Function at 0x40b062
Capabilities:
Check for vm using instruction vpcext
Reference the vmware io port

Disassembly:
push 0x14
push 0x41b6a8
call fcn.00415d30
call fcn.0040d480
cdq
mov ecx, 0x3e6a291
idiv ecx
mov dword [ebp - 0x20], edx
call fcn.0040d480
cdq
mov ecx, 0x1990
idiv ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
imul eax, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
xor ebx, ebx
mov ecx, 0x14
mov edx, 0x5658
in eax, dx
cmp eax, 0x20
jl 0x40b0d1
cmp eax, 0x4000
jg 0x40b0d1
mov eax, 2
or dword [ebp - 0x1c], eax
pop ebx
pop ecx
pop edx
jmp 0x40b0dd
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 1
push ebx
xor eax, eax
xor ebx, ebx
inc eax
invalid

Function at 0x413c9c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41eba8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040fddd
and dword [ebp - 0x14], 0
cmp dword [0x4201a8], 0
mov dword [ebp - 0x18], eax
jne 0x413d4f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x413df7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x413df7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4201a8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4201ac], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4201b0], eax
call edi
push eax
call esi
mov dword [0x4201b8], eax
test eax, eax
je 0x413d4f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4201b4], eax
mov eax, dword [0x4201b4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x413da8
cmp dword [0x4201b8], ecx
je 0x413da8
push eax
call esi
push dword [0x4201b8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x413da8
test ebx, ebx
je 0x413da8
call edi
test eax, eax
je 0x413d9f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x413d9f
test byte [ebp - 8], 1
jne 0x413da8
or dword [ebp + 0x10], 0x200000
jmp 0x413ddb
mov eax, dword [0x4201ac]
cmp eax, dword [ebp - 0x18]
je 0x413ddb
push eax
call esi
test eax, eax
je 0x413ddb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x413ddb
mov eax, dword [0x4201b0]
cmp eax, dword [ebp - 0x18]
je 0x413ddb
push eax
call esi
test eax, eax
je 0x413ddb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4201a8]
call esi
test eax, eax
je 0x413df7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x413df9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413fec
leave
ret
Function at 0x413fec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41eba8]
jne 0x413ff6
repz ret
jmp fcn.0041595c

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4058c4
Capabilities:
Encode data using xor

Disassembly:
jl 0x4058b7
invalid
push cs
sbb byte [ecx - 0x7f], cl
test byte [ebp + 8], 8
enter 0xfffffffffffff231, 0x31
test byte [ecx], 0xc6
add esi, eax
Function at 0x406064
Capabilities:
Encode data using xor

Disassembly:
sub byte [edx], ch
and byte [ecx + ebp], ah
push ebp
mov ebp, esp
sub esp, 0x40
push edi
push esi
push ebx
mov dword [ebp - 4], eax
mov edi, edx
mov ebx, ecx
mov ecx, 2
cmp bl, 0
je 0x406030
mov eax, dword [edi]
or eax, dword [edi + 4]
je 0x406042
mov ecx, dword [edi + 4]
shr ecx, 0x1f
jmp 0x406042
movzx eax, word [edi + 8]
or eax, dword [edi]
or eax, dword [edi + 4]
je 0x406042
movzx ecx, word [edi + 8]
shr ecx, 0xf
call fcn.004060d3
je 0x406095
call 0x40610e
mov eax, dword [ebp - 0x14]
mov edx, 0x270f
cmp byte [ebp - 0xc], 0
jne 0x406066
sub eax, dword [ebp - 0x18]
mov edx, eax
mov eax, 0x77460012
inc ebp
call 0x12f930ee
add byte [esi + 0x77], al
xor byte [edx + 0x52], dl
je 0x40605d
mov edi, dword [edx + 0x76208b40]
push 0x7d
retf 0x8b7e
jle 0x406002
mov edi, 0x52f86f8b
mov word [edx - 0x7adadae], ss
call 0xe938b37f
mov word [edx + 0x52], ss
push edx
xchg edx, eax
dec ecx
mov edi, dword [ebp + ebx*2 - 0x75]
push ebp
sbb al, 0xaf
inc esp
sub eax, 0x52f81c7c
mov edi, dword [esp + ebx + 0x49]
mov edi, dword [ebp + ebx*2 - 0x75]
push ebp
push 0xffffffffffffffaf
scasd eax, dword es:[edi]
inc esp
mov ebp, dword [edx - 8]
push ebp
mov word [edx - 0x53], ss
push edx
push edx
jle 0x4060a9
push edx
mov edi, dword [ebp + ebx*2 - 0x75]
push ebp
mov esp, 0xe82d44af
mov edx, dword [ecx + 0x52f852f8]
retf 0x7c8b
in al, dx
push edx
push edx
mov byte [0xe8536a53], al
sub eax, 0x52f86a53
adc dword [edx + ebp*2 + 0x49], edi
mov edi, dword [edx + ebp*2 + 0x49]
jge 0x406075
jl 0x406108
dec ecx
mov edi, dword [ebp + ebx*2 - 0x75]
push ebp
and byte [edi + 0x6a648b44], ch
call 0x8eb3cb09
mov edi, dword [edx + ebp*2 - 0x18]
or esp, dword [edx - 0x74feac96]
cmp eax, 0x7c2d0be5
push 0xfffffffffffffff8
push edx
in eax, 0xb
sub eax, 0x52f86a7c
adc dword [edx + ebp*2 + 0x49], edi
mov edi, dword [edx + ebp*2 + 0x49]
jge 0x4060a4
jl 0x406137
dec ecx
mov edi, dword [ebp + ebx*2 - 0x75]
push ebp
and byte [edi - 0x6f4506bc], ch
lodsd eax, dword [esi]
call 0xd28cb91
push 0x76
push ebx
push 0x52
push edi
pushal
mov byte [0x8baa849e], al
jl 0x406157
stosb byte es:[edi], al
mov edi, dword [esp + ebx + 0x49]
dec ecx
mov edi, dword [ebp + ebx*2 - 0x75]
push ebp
add ebp, dword [edi - 0x5bf474bc]
pop ecx
sbb byte [esi + 0x5e], bl
or al, 0xa7
pushal
push edx
mov edi, dword [edx - 0x77df74c0]
jge 0x406121
sub eax, 0xf9501c40
sub dword [ebp - 0x73], eax
adc cl, byte [ebx + 0x27e00e44]
call 0xeb3a7dce
push ecx
bound edx, qword [ebp + 0x50]
mov bl, 0x59
sbb byte [esi + 0xc], bl
sbb eax, 0xd335ddd3
cmp dword [ebx + 0x27], edi
push edx
mov edi, dword [edx - 0x6a2c22f6]
nop
shr ecx, cl
aam 0x39
sar dword [esi + 0x52], cl
adc dword [ebp + 0x52], edx
js 0x406166
sbb al, 0xfa
ljmp 0xb364
nop
jmp 0x7e139b6d
Function at 0x10013324
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001335a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10013358
push 0x11ae
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10013381
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.10015597
mov esp, ebp
pop ebp
ret

Function at 0x1001412c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10014218
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
sub eax, dword [ecx]
mov ecx, dword [ebp - 8]
imul eax, dword [ecx]
test eax, eax
jne 0x10014185
mov eax, 0xffff
test eax, eax
jne 0x10014185
and dword [ebp - 0xc], 0
jmp 0x1001418c
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
je 0x1001419f
mov dword [ebp - 0x28], 1
jmp 0x100141a3
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jne 0x100141b8
mov dword [ebp - 0x10], 1
jmp 0x100141bc
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
neg eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
sub ecx, dword [ebp - 0x10]
imul ecx, ecx, 0xe071
cmp eax, ecx
jl 0x100141de
mov dword [ebp - 0x14], 1
jmp 0x100141e2
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
add eax, 0x13d0
je 0x100141fe
mov eax, 0x94d0f4f2
test eax, eax
je 0x100141fe
mov dword [ebp - 0x18], 1
jmp 0x10014202
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
sub ecx, dword [ebp - 0x18]
sub eax, ecx
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
jmp 0x1001422a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001422a
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov esp, ebp
pop ebp
ret
Function at 0x1001a52f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001a557
push 0x11ae
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1001a56e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001a56e
push 0x24c6
call dword [sym.imp.USER32.dll_GetSysColor]
mov esp, ebp
pop ebp
ret