joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f7c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 0x304
push ebx
push esi
mov esi, dword [ebp + 8]
shl esi, 0x10
xor esi, dword [ebp + 8]
xor esi, 0xa245dd63
mov eax, esi
shr eax, 0x15
push edi
cmp eax, ecx
ja 0x405ff5
je 0x405fee
sub eax, 0x25
je 0x405fe7
sub eax, 0x64
je 0x405fe0
sub eax, 0x32
je 0x405fd9
sub eax, 0xc3
je 0x405fd2
sub eax, 0x6d
je 0x405fcb
sub eax, 0x29
jne 0x406024
mov eax, 0x4060bd
jmp 0x40604a
mov eax, 0x4061a1
jmp 0x40604a
mov eax, 0x406168
jmp 0x40604a
mov eax, 0x4060f6
jmp 0x40604a
mov eax, 0x40612f
jmp 0x40604a
mov eax, 0x405dd5
jmp 0x40604a
mov eax, 0x405e47
jmp 0x40604a
sub eax, 0x33a
je 0x406045
sub eax, 0x297
je 0x40603e
sub eax, 0x9c
je 0x406037
sub eax, 0x24
je 0x406030
sub eax, 0x96
je 0x406029
sub eax, 0xca
jne 0x406024
mov eax, 0x405d9c
jmp 0x40604a
mov eax, dword [ebp + 8]
jmp 0x40604a
mov eax, 0x405ec8
jmp 0x40604a
mov eax, 0x405e0e
jmp 0x40604a
mov eax, 0x405e8b
jmp 0x40604a
mov eax, 0x405e53
jmp 0x40604a
mov eax, fcn.00405e97
call eax
mov edi, eax
test edi, edi
je 0x4060a3
mov ecx, dword [edi + 0x3c]
and esi, 0x1fffff
xor ebx, ebx
mov ecx, dword [ecx + edi + 0x78]
add ecx, edi
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, edi
mov dword [ebp - 8], eax
add edx, edi
mov eax, dword [ecx + 0x1c]
add eax, edi
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp + 8], eax
test eax, eax
je 0x4060a3
mov eax, dword [edx + ebx*4]
add eax, edi
push eax
call fcn.00405c6c
and eax, 0x1fffff
pop ecx
cmp eax, esi
je 0x4060ac
mov edx, dword [ebp - 4]
inc ebx
cmp ebx, dword [ebp + 8]
jb 0x406085
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edi
jmp 0x4060a5

Function at 0x40666e
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x20
push esi
call fcn.00405946
pop ecx
pop ecx
test eax, eax
je 0x406693
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
xor eax, eax
inc eax
pop esi
pop ebp
ret
Function at 0x4066b1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x406755
push ebx
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp - 0x44]
mov eax, ebx
sub eax, ecx
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
sub eax, ecx
push edi
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x44]
xor edi, edi
push eax
call fcn.00406817
mov eax, dword [ebp + 8]
pop ecx
pop ecx
add dword [eax + 0x20], 1
jne 0x4066f6
inc dword [eax + 0x24]
cmp esi, 0x40
jbe 0x40672d
mov ebx, dword [ebp - 4]
mov edx, edi
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x44]
add ecx, edx
push 0x40
mov al, byte [ebx + ecx]
xor al, byte [ecx]
inc edx
mov byte [edi + ecx], al
pop eax
cmp edx, eax
jb 0x406703
mov ebx, dword [ebp + 0x10]
sub esi, eax
add dword [ebp + 0x14], eax
add ebx, eax
add dword [ebp + 0xc], eax
add dword [ebp - 4], eax
mov dword [ebp + 0x10], ebx
jmp 0x4066da
test esi, esi
je 0x406753
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x44]
sub eax, ecx
sub ebx, ecx
mov dword [ebp + 0xc], eax
lea ecx, [ebp - 0x44]
add ecx, edi
mov al, byte [eax + ecx]
xor al, byte [ecx]
inc edi
mov byte [ebx + ecx], al
mov eax, dword [ebp + 0xc]
cmp edi, esi
jb 0x40673e
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406779
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0x100
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
mov eax, dword [ecx]
mov dword [edx + 4], eax
mov eax, dword [ecx + 4]
mov dword [edx + 8], eax
mov eax, dword [ecx + 8]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x10], eax
jne 0x4067ad
add ecx, 0x10
mov esi, str.expand_32_byte_kexpand_16_byte_k
jmp 0x4067b2
mov esi, 0x40ce30
mov eax, dword [ecx]
mov dword [edx + 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [edx + 0x30], eax
mov eax, dword [ecx + 8]
mov dword [edx + 0x34], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x38], eax
mov eax, dword [esi]
mov dword [edx], eax
mov eax, dword [esi + 4]
mov dword [edx + 0x14], eax
mov eax, dword [esi + 8]
mov dword [edx + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [0x410f34], esi
mov dword [edx + 0x3c], eax
pop esi
pop ebp
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
mov ecx, 0x575f0e13
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x72397901
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x403320
Capabilities:
Get disk information

Disassembly:
sub esp, 0x844
mov eax, dword [esp + 0x848]
mov ecx, dword [eax]
mov edx, dword [0x4433fc]
push ebx
push ebp
push esi
mov esi, dword [eax + 4]
mov eax, dword [0x4433f8]
push edi
xor edi, edi
mov dword [esp + 0x40], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x38], 0x9e3779b9
mov dword [esp + 0x3c], edx
call fcn.004032f0
mov eax, dword [0x443400]
mov edx, dword [0x443404]
add dword [esp + 0x10], 0x23f
mov ebx, dword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [esp + 0x34], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x30], 0x20
mov dword [esp + 0x24], 2
add dword [esp + 0x24], 3
mov eax, dword [0x828264]
shl ecx, 4
add ecx, dword [esp + 0x34]
mov dword [esp + 0x14], ecx
cmp eax, 0xfa9
jne 0x4033c3
mov dword [0x828260], 0xedeb2e40
jmp 0x4033d0
cmp eax, 0x3eb
jne 0x4033d0
mov dword [0x825168], edi
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
shr eax, 5
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x18]
mov dword [0x82825c], 0xf4ea3dee
call fcn.00403300
mov eax, dword [esp + 0x20]
xor dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
xor dword [esp + 0x18], eax
cmp dword [0x828264], 0x213
jne 0x403469
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x34]
push eax
push edi
push edi
push edi
mov dword [esp + 0x44], edi
call ebx
lea ecx, [esp + 0x54]
push ecx
push edi
call ebp
push edi
push 0x402d60
push 0x402d24
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
lea edx, [esp + 0x4c]
push edx
push 0x402de8
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
sub esi, dword [esp + 0x18]
lea ecx, [esp + 0x14]
mov eax, esi
mov dword [esp + 0x2c], esi
call fcn.004032e0
mov eax, dword [esp + 0x40]
add dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x10]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
nop
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov ecx, esi
shr ecx, 5
add ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
xor dword [esp + 0x14], eax
cmp dword [0x828264], 0x121
jne 0x4034cf
push edi
push edi
lea edx, [esp + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
mov ecx, dword [esp + 0x14]
xor ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
mov dword [esp + 0x14], ecx
call fcn.00403310
mov eax, dword [esp + 0x38]
sub dword [esp + 0x10], eax
sub dword [esp + 0x30], 1
mov ecx, dword [esp + 0x28]
jne 0x403393
mov eax, dword [esp + 0x858]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x844
ret 4
Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442c38]
jne 0x40a3da
repz ret
jmp fcn.0040e622

Function at 0x40be9c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407f24
and dword [ebp - 4], 0
cmp dword [0x445208], 0
mov ebx, eax
jne 0x40bf4d
push 0x401b00
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bffe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401af4
push edi
call esi
test eax, eax
je 0x40bffe
push eax
call fcn.00407eb2
mov dword [esp], 0x401ae4
push edi
mov dword [0x445208], eax
call esi
push eax
call fcn.00407eb2
mov dword [esp], 0x401ad0
push edi
mov dword [0x44520c], eax
call esi
push eax
call fcn.00407eb2
mov dword [esp], 0x401ab4
push edi
mov dword [0x445210], eax
call esi
push eax
call fcn.00407eb2
pop ecx
mov dword [0x445218], eax
test eax, eax
je 0x40bf4d
push 0x401a9c
push edi
call esi
push eax
call fcn.00407eb2
pop ecx
mov dword [0x445214], eax
mov eax, dword [0x445214]
cmp eax, ebx
je 0x40bfa5
cmp dword [0x445218], ebx
je 0x40bfa5
push eax
call fcn.00407f2d
push dword [0x445218]
mov esi, eax
call fcn.00407f2d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bfa5
test edi, edi
je 0x40bfa5
call esi
test eax, eax
je 0x40bf9c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bf9c
test byte [ebp - 0xc], 1
jne 0x40bfa5
or dword [ebp + 0x10], 0x200000
jmp 0x40bfde
mov eax, dword [0x44520c]
cmp eax, ebx
je 0x40bfde
push eax
call fcn.00407f2d
pop ecx
test eax, eax
je 0x40bfde
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bfde
mov eax, dword [0x445210]
cmp eax, ebx
je 0x40bfde
push eax
call fcn.00407f2d
pop ecx
test eax, eax
je 0x40bfde
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x445208]
call fcn.00407f2d
pop ecx
test eax, eax
je 0x40bffe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c000
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406784
xor eax, eax
test eax, eax
je 0x406797
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406797
xor ecx, ecx
jmp 0x40679a
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4068bd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dac], 0
push esi
jne 0x4068f4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4068ce
mov dword [ecx*4 + 0x427da8], eax
inc ecx
cmp ecx, 0x100
jl 0x4068c9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406925
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427da8]
xor eax, esi
inc ecx
dec edx
jne 0x406907
pop edi
not eax
pop esi
ret 0xc

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x6678d87e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x6678d8e2
jmp 0x6678d935
jmp 0x6678d988
jmp 0x6678d9db
jmp 0x6678da2e
jmp 0x6678da81
jmp 0x6678dad4
jmp 0x6678db27
jmp 0x6678db7a
jmp 0x6678dbcd
jmp 0x6678dc20
jmp 0x6678dc73
jmp 0x6678dcc6
jmp 0x6678dd19
jmp 0x6678dd6c
jmp 0x6678ddbf
jmp 0x6678de12
jmp 0x6678de65
jmp 0x6678deb8
jmp 0x6678df0b
jmp 0x6678df5e
jmp 0x6678dfb1
jmp 0x6678e004
jmp 0x6678e057
jmp 0x6678e0aa
jmp 0x6678e0fd
jmp 0x6678e150
jmp 0x6678e1a3
jmp 0x6678e1f6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x6678e24f
jmp 0x6678e2a2
jmp 0x6678e2f5
jmp 0x6678e348
jmp 0x6678e39b
jmp 0x6678e3ee
jmp 0x6678e441
jmp 0x6678e494
jmp 0x6678e4e7
jmp 0x6678e53a
jmp 0x6678e58d
jmp 0x6678e5e0
jmp 0x6678e633
jmp 0x6678e686
jmp 0x6678e6d9
jmp 0x6678e72c
jmp 0x6678e77f
jmp 0x6678e7d2
jmp 0x6678e825
jmp 0x6678e878
jmp 0x6678e8cb
jmp 0x6678e91e
jmp 0x6678e971
jmp 0x6678e9c4
jmp 0x6678ea17
jmp 0x6678ea6a
jmp 0x6678eabd
jmp 0x6678eb10
jmp 0x6678eb63
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x6678ebd0
jmp 0x6678ec23
jmp 0x6678ec76
jmp 0x6678ecc9
jmp 0x6678ed1c
jmp 0x6678ed6f
jmp 0x6678edc2
jmp 0x6678ee15
jmp 0x6678ee68
jmp 0x6678eebb
jmp 0x6678ef0e
jmp 0x6678ef61
jmp 0x6678efb4
jmp 0x6678f007
jmp 0x6678f05a
jmp 0x6678f0ad
jmp 0x6678f100
jmp 0x6678f153
jmp 0x6678f1a6
jmp 0x6678f1f9
jmp 0x6678f24c
jmp 0x6678f29f
jmp 0x6678f2f2
jmp 0x6678f345
jmp 0x6678f398
jmp 0x6678f3eb
jmp 0x6678f43e
jmp 0x6678f491
jmp 0x6678f4e4
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x6678f540
jmp 0x6678f593
jmp 0x6678f5e6
jmp 0x6678f639
jmp 0x6678f68c
jmp 0x6678f6df
jmp 0x6678f732
jmp 0x6678f785
jmp 0x6678f7d8
jmp 0x6678f82b
jmp 0x6678f87e
jmp 0x6678f8d1
jmp 0x6678f924
jmp 0x6678f977
jmp 0x6678f9ca
jmp 0x6678fa1d
jmp 0x6678fa70
jmp 0x6678fac3
jmp 0x6678fb16
jmp 0x6678fb69
jmp 0x6678fbbc
jmp 0x6678fc0f
jmp 0x6678fc62
jmp 0x6678fcb5
jmp 0x6678fd08
jmp 0x6678fd5b
jmp 0x6678fdae
jmp 0x6678fe01
jmp 0x6678fe54
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x6678fec0
jmp 0x6678ff13
jmp 0x6678ff66
jmp 0x6678ffb9
jmp 0x6679000c
jmp 0x6679005f
jmp 0x667900b2
jmp 0x66790105
jmp 0x66790158
jmp 0x667901ab
jmp 0x667901fe
jmp 0x66790251
jmp 0x667902a4
Function at 0x667a8e33
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x67187018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x67187018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x667a8ea6
jmp 0x667a8ef9
jmp 0x667a8f4c
jmp 0x667a8f9f
jmp 0x667a8ff2
jmp 0x667a9045
jmp 0x667a9098
jmp 0x667a90eb
jmp 0x667a913e
jmp 0x667a9191
jmp 0x667a91e4
jmp 0x667a9237
jmp 0x667a928a
jmp 0x667a92dd
jmp 0x667a9330
jmp 0x667a9383
jmp 0x667a93d6
jmp 0x667a9429
jmp 0x667a947c
jmp 0x667a94cf
jmp 0x667a9522
jmp 0x667a9575
jmp 0x667a95c8
jmp 0x667a961b
jmp 0x667a966e
jmp 0x667a96c1
jmp 0x667a9714
jmp 0x667a9767
jmp 0x667a97ba
mov dword [ebp - 0x14], 0
jmp 0x667a9814
jmp 0x667a9867
jmp 0x667a98ba
jmp 0x667a990d
jmp 0x667a9960
jmp 0x667a99b3
jmp 0x667a9a06
jmp 0x667a9a59
jmp 0x667a9aac
jmp 0x667a9aff
jmp 0x667a9b52
jmp 0x667a9ba5
jmp 0x667a9bf8
jmp 0x667a9c4b
jmp 0x667a9c9e
jmp 0x667a9cf1
jmp 0x667a9d44
jmp 0x667a9d97
jmp 0x667a9dea
jmp 0x667a9e3d
jmp 0x667a9e90
jmp 0x667a9ee3
jmp 0x667a9f36
jmp 0x667a9f89
jmp 0x667a9fdc
jmp 0x667aa02f
jmp 0x667aa082
jmp 0x667aa0d5
jmp 0x667aa128
mov dword [ebp - 0x18], 0
jmp 0x667aa182
jmp 0x667aa1d5
jmp 0x667aa228
jmp 0x667aa27b
jmp 0x667aa2ce
jmp 0x667aa321
jmp 0x667aa374
jmp 0x667aa3c7
jmp 0x667aa41a
jmp 0x667aa46d
jmp 0x667aa4c0
jmp 0x667aa513
jmp 0x667aa566
jmp 0x667aa5b9
jmp 0x667aa60c
jmp 0x667aa65f
jmp 0x667aa6b2
jmp 0x667aa705
jmp 0x667aa758
jmp 0x667aa7ab
jmp 0x667aa7fe
jmp 0x667aa851
jmp 0x667aa8a4
jmp 0x667aa8f7
jmp 0x667aa94a
jmp 0x667aa99d
jmp 0x667aa9f0
jmp 0x667aaa43
jmp 0x667aaa96
mov dword [ebp - 0x10], 0
jmp 0x667aaaf0
jmp 0x667aab43
jmp 0x667aab96
jmp 0x667aabe9
jmp 0x667aac3c
jmp 0x667aac8f
jmp 0x667aace2
jmp 0x667aad35
jmp 0x667aad88
jmp 0x667aaddb
jmp 0x667aae2e
jmp 0x667aae81
jmp 0x667aaed4
jmp 0x667aaf27
jmp 0x667aaf7a
jmp 0x667aafcd
jmp 0x667ab020
jmp 0x667ab073
jmp 0x667ab0c6
jmp 0x667ab119
jmp 0x667ab16c
jmp 0x667ab1bf
jmp 0x667ab212
jmp 0x667ab265
jmp 0x667ab2b8
jmp 0x667ab30b
jmp 0x667ab35e
jmp 0x667ab3b1
jmp 0x667ab404
mov dword [ebp - 0x10], 0
jmp 0x667ae35b
jmp 0x667ab463
jmp 0x667ab4b6
jmp 0x667ab509
jmp 0x667ab55c
jmp 0x667ab5af
jmp 0x667ab602
jmp 0x667ab655
jmp 0x667ab6a8
jmp 0x667ab6fb
jmp 0x667ab74e
jmp fcn.667ab7a1
mov eax, dword [0x67187018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x667ab410
nop
leave
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x4298bc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x405008], 0x8088405
inc edx
mov dword [ebx + 0x405008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x401195
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4011ee
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4011ee
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4011dd
cmp esi, ecx
jae 0x4011ee
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x4011cb
cmp esi, ecx
jae 0x4011ee
cmp word [esi], 0
je 0x4011ee
lfence
mov eax, esi
jmp 0x4011f0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401822
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x425018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor ebx, ebx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
call fcn.0040132b
push eax
lea ecx, [ebp - 0xc]
call fcn.00403531
push str.installsource
lea eax, [ebp - 0xc]
push 0x422460
push eax
call fcn.0040162b
mov esi, dword [ebp - 0xc]
xor edi, edi
inc edi
add esp, 0xc
cmp dword [ebp - 8], edi
jle 0x4018bd
mov eax, dword [ebp - 0x10]
push esi
push dword [eax + edi*4]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x4018b1
mov ecx, dword [ebp - 8]
lea eax, [edi + 1]
cmp eax, ecx
jge 0x4018b4
mov eax, dword [ebp - 0x10]
push 0x422540
push dword [eax + edi*4 + 4]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x4018bb
mov ecx, dword [ebp - 8]
inc edi
cmp edi, ecx
jl 0x401880
jmp 0x4018bd
mov bl, 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esi - 0x10]
call fcn.00401302
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408525
leave
ret

Function at 0x401ced
Capabilities:
Delete directory
Delete file

Disassembly:
push ebx
mov ebx, ecx
push esi
xor esi, esi
push edi
cmp dword [ebx + 0x18], esi
je 0x401d14
test esi, esi
js 0x401d30
cmp esi, dword [ebx + 0x18]
jge 0x401d30
mov eax, dword [ebx + 0x14]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, dword [ebx + 0x18]
jne 0x401cf9
lea ecx, [ebx + 0x14]
call fcn.00402e1e
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
lea ecx, [ebx + 0x20]
pop ebx
jmp fcn.0040317b
push 1
push 0xc000008c
call fcn.004010aa
int3
Function at 0x401f2d
Capabilities:
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x425018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x420f4c
mov dword [ebp - 0x14], ebx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jns 0x401f5c
xor al, al
jmp 0x401f90
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x401f75
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0xc], ebx
ja 0x401f8c
cmp dword [ebp - 0x10], 0x40000000
jb 0x401f8e
mov bl, 1
mov al, bl
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00408525
leave
ret

Function at 0x401fa0
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x425018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
mov edi, ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401fd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401fd7
xor al, al
jmp 0x40204b
mov dword [ebp - 8], ebx
call fcn.0040132b
push eax
lea ecx, [ebp - 8]
call fcn.00403531
push 0x104
lea ecx, [ebp - 8]
call fcn.00403115
push eax
push ebx
push 0x4227e0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 8]
mov esi, eax
call fcn.004030e9
test esi, esi
je 0x40203e
cmp esi, 0x6f
je 0x40203e
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40203e
lea eax, [ebp - 8]
push eax
lea ecx, [edi + 0x20]
call fcn.00403012
mov bl, 1
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00401302
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408525
leave
ret 4