joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418d90
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4c1d6b
mov eax, dword fs:[0]
push eax
mov eax, 0x1654
call fcn.004af840
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x1650], eax
push ebx
push esi
push edi
mov eax, dword [0x4d8620]
xor eax, esp
push eax
lea eax, [esp + 0x1664]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1674]
cmp byte [esi + 0x8ed5], 0
mov edi, dword [esp + 0x167c]
mov eax, dword [esi + 0x13d8]
je 0x418f75
cmp byte [eax + 0x3971], 0
jne 0x418f75
cmp byte [esi + 0x8ed0], 0
jne 0x418f75
push esi
lea ecx, [esp + 0x14]
call fcn.004681f0
mov dword [esp + 0x166c], 0
movzx eax, word [esi + 0x67e4]
push 0
push 1
cdq
push 0
push edx
push eax
call fcn.004afe90
mov ecx, dword [esi + 0x67e8]
xor ebx, ebx
add eax, ecx
adc edx, ebx
push edx
push eax
mov ecx, esi
call fcn.004319b0
mov ecx, esi
call fcn.0040f9d0
mov ebx, dword [esp + 0x1678]
test bl, bl
je 0x418e88
mov eax, dword [0x526d84]
push 0x200
lea edx, [esp + 0x1264]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x34a
call fcn.00466160
push eax
call fcn.0048b460
call fcn.0048bb70
push 0x1238
lea ecx, [esp + 0x2c]
push 0
push ecx
call fcn.004af870
mov eax, dword [esi + 0x67b4]
add esp, 0xc
sub eax, 0x76
je 0x418eeb
sub eax, 3
je 0x418edd
sub eax, 1
jne 0x418f00
push 0x4c59b0
lea ecx, [esi + 0x7500]
call fcn.0040b720
test al, al
je 0x418ed3
lea edx, [esp + 0x28]
push edx
push ebx
push esi
call fcn.004185b0
jmp 0x418f00
mov byte [esp + 0x125e], 1
jmp 0x418f00
lea eax, [esp + 0x28]
push eax
push ebx
push esi
call fcn.00417df0
jmp 0x418f00
test byte [esi + 0x67e0], 0x20
je 0x418f61
lea ecx, [esp + 0x28]
push ecx
push ebx
push esi
call fcn.00418260
test bl, bl
je 0x418f16
lea edx, [esp + 0x1260]
push edx
call fcn.0048b460
call fcn.0048bb70
test edi, edi
je 0x418f2d
push 0x1238
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.004af8f0
add esp, 0xc
cmp byte [esp + 0x125e], 0
jmp 0x418f61
mov dword [esp + 0x166c], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00468220
mov ecx, dword [esp + 0x1664]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1650]
xor ecx, esp
call fcn.004af00b
add esp, 0x1660
ret 0xc

Function at 0x41ef70
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
mov ebx, eax
mov byte [esp + 0x17], 1
call fcn.0041c380
mov esi, eax
test esi, esi
je 0x41efed
push edi
jmp 0x41efa0
cmp byte [esp + 0x13], 0
mov edi, dword [esp + 0x14]
je 0x41efaf
mov bl, 1
jmp 0x41efb9
push edi
mov ecx, ebp
call fcn.0041ecc0
mov bl, al
mov eax, dword [esp + 0x18]
push eax
call fcn.004af1b0
push edi
call fcn.004af1b0
add esp, 8
test bl, bl
je 0x41efec
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ebx, esi
mov byte [esp + 0x1b], 0
call fcn.0041c380
mov esi, eax
test esi, esi
jne 0x41efa0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x4aeb10
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4aeb39
and eax, 0xffffffdf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4aeb39
mov eax, 1
pop esi
ret 4
push esi
push 0x4bf
call fcn.00466160
push eax
mov eax, dword [0x513954]
push eax
call fcn.00498e30
add esp, 0xc
xor eax, eax
pop esi
ret 4

Function at 0x4af00b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d8620]
jne 0x4af015
repz ret
jmp fcn.004b4efc

Function at 0x4be6e0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004b7bbb
and dword [ebp - 4], 0
cmp dword [0x572dc8], 0
mov ebx, eax
jne 0x4be791
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4be842
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4be842
push eax
call fcn.004b7b49
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x572dc8], eax
call esi
push eax
call fcn.004b7b49
mov dword [esp], 0x4cec98
push edi
mov dword [0x572dcc], eax
call esi
push eax
call fcn.004b7b49
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x572dd0], eax
call esi
push eax
call fcn.004b7b49
pop ecx
mov dword [0x572dd8], eax
test eax, eax
je 0x4be791
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004b7b49
pop ecx
mov dword [0x572dd4], eax
mov eax, dword [0x572dd4]
cmp eax, ebx
je 0x4be7e9
cmp dword [0x572dd8], ebx
je 0x4be7e9
push eax
call fcn.004b7bc4
push dword [0x572dd8]
mov esi, eax
call fcn.004b7bc4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4be7e9
test edi, edi
je 0x4be7e9
call esi
test eax, eax
je 0x4be7e0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4be7e0
test byte [ebp - 0xc], 1
jne 0x4be7e9
or dword [ebp + 0x10], 0x200000
jmp 0x4be822
mov eax, dword [0x572dcc]
cmp eax, ebx
je 0x4be822
push eax
call fcn.004b7bc4
pop ecx
test eax, eax
je 0x4be822
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4be822
mov eax, dword [0x572dd0]
cmp eax, ebx
je 0x4be822
push eax
call fcn.004b7bc4
pop ecx
test eax, eax
je 0x4be822
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x572dc8]
call fcn.004b7bc4
pop ecx
test eax, eax
je 0x4be842
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4be844
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x79b610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x7a14cc]
cmp dword [eax + 0x28], 0
jne 0x79b628
xor eax, eax
jmp 0x79b757
mov ecx, dword [0x7a143c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x7a1430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x7a142c], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x7a1430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x7a142c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x7a14b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x79f680
push 0x79f6d0
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x7a1428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.0079b550
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x79b5e0
mov edx, dword [0x7a14cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x7a1434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x79b757
cmp dword [ebp - 0x38], 0x12
jne 0x79b74b
mov dword [0x7a1444], 0
call fcn.0079b760
xor eax, eax
jmp 0x79b757
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x79b71c
mov esp, ebp
pop ebp
ret 4

Function at 0x79cb30
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x79d6cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x79f168
sub eax, eax
test esi, esi
je 0x79d7a4
sub eax, 1
test ecx, ecx
je 0x79d7a2
test esi, 3
je 0x79d70a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x79d6ef
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x79d789
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x79d714
mov ecx, edx
test ecx, ecx
je 0x79d7a2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x79d78f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x79d7ac
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0079d82f
jae 0x79d7ba
xor ecx, ecx
call fcn.0079d82f
jae 0x79d7e9
xor eax, eax
call fcn.0079d82f
jae 0x79d7f9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0079d82f
adc al, al
jae 0x79d7db
jne 0x79d825
stosb byte es:[edi], al
jmp 0x79d7bd
call fcn.0079d83b
sub ecx, ebx
jne 0x79d802
call fcn.0079d839
jmp 0x79d821
lodsb al, byte [esi]
shr eax, 1
je 0x79d84b
adc ecx, ecx
jmp 0x79d81e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0079d839
cmp eax, 0x7d00
jae 0x79d81e
cmp ah, 5
jae 0x79d81f
cmp eax, 0x7f
ja 0x79d820
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x79d7bd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x79e17c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x7a1000]
jne 0x79e186
repz ret
jmp fcn.0079e42d
Function at 0xb6b80b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
jmp 0xb6b7f4

Function at 0xb6b8dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, byte [esp]
call fcn.00b6b865
bswap esi
rcr ax, cl
dec bx
mov cx, bx
xchg dword [esp], esi
jmp 0xb6b899
Function at 0xb7f2e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, cl
mov dword [esp], eax
mov dh, byte [esp]
not eax
lea edx, [ecx + ebp]
push ecx
jmp 0xb574d7
setle dh
lea edx, reloc.MSVCRT.dll_malloc
lea edx, [ecx + edx]
pushfd
xchg word [esp + 1], dx
mov dh, ch
jmp 0xb57481
pop ecx
lea edx, [esi + edi]
mov edx, dword [esp]
lea edx, [eax*4]
rdtsc
sets al
jmp 0xb5751d
mov ax, word [esp]
lea ecx, [ebp*4]
mov eax, edx
setle ch
mov eax, 0xf4bda5ab
mov ah, byte [esp]
jmp 0xb574bd
push edx
jmp 0xb574a7
rdtsc
pop eax
mov dh, 0x73
mov dl, 0xc8
mov edx, esp
pop edx
jmp 0xb80ea9
jmp 0xb57500
jmp 0xb7f325
jmp 0xb5759e

Function at 0xcba508
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], dh
rdtsc
mov word [esp + 3], di
jmp 0xcba4f2

Function at 0xcba7cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp], dl
push dword [esp + 3]
jmp 0xcba7dc
pop bp
lea edx, [esi + ebp]
mov bp, word [esp + 2]
mov dx, word [esp + 3]
pop eax
mov word [esp], di
jmp 0xcba821
pop dx
mov eax, 0x48e7d7c7
mov dh, bh
bswap eax
lea ebp, reloc.MSVCRT.dll_malloc
rdtsc
jmp 0xcba80b

Function at 0xcbab24
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 3]
mov ah, byte [esp + 0xa]
jmp 0xcbab6b
mov ax, sp
pop eax
not ax
mov eax, dword [esp + 0xe]
setg ah
mov word [esp + 2], bx
jmp 0xcbac8f
mov ebp, dword [esp + 0x10]
mov al, byte [esp + 0xe]
push dword [esp + 0x12]
mov ax, dx
mov byte [esp + 0x27], bh
xchg byte [esp + 0x15], dl
jmp 0xcbac14
xchg word [esp + 0xd], dx
rdtsc
pop dword [esp + 0xf]
rdtsc
add dh, bh
pop dx
jmp 0xcbabd9
mov eax, dword [esp + 0x22]
push dword [esp + 0x20]
cld
xchg dword [esp + 0x11], edx
pop bp
bswap edx
jmp 0xcbac67
add esp, 2
bsf edx, ecx
and eax, 0x1e76a4f1
mov eax, dword [esp]
xchg edx, ebp
jmp 0xcbac51
pop dx
cld
bt edx, eax
mov byte [esp + 0xb], dh
mov word [esp + 0x21], cx
mov bp, di
jmp 0xcbac01
mov byte [esp], al
mov edx, 0xed856e8c
lea edx, [ebx*4]
jmp 0xcbacdf
pop eax
rdtsc
xchg word [esp + 0x1f], bp
lea esp, [esp + 0x25]
neg dx
mov ax, word [esp + 2]
jmp 0xcbac27
mov byte [esp + 5], bh
mov dx, 0x38a3
bswap eax
inc ax
sub esp, 0x1d
mov al, 0xf3
jmp 0xcbac3d
pushal
shl dl, 7
sub esp, 0x18
mov dh, 0xcf
pop bp
xchg dl, ah
jmp 0xcbacf3
mov dx, sp
lea esp, [esp]
mov bp, 0xf0eb
mov dx, 0xdc71
setp ah
bsf ax, cx
jmp 0xcbaca2
not eax
neg ax
neg bp
lea eax, [ecx + edi]
setbe ah
bsf bp, si
jmp 0xcbacb8
lea ebp, [edx + ebp]
push ebp
xchg ah, dl
push edi
setg dh
mov ah, byte [esp + 0x21]
jmp 0xcbad39
int1
invalid
sub esp, 9
lea esp, [esp + 0x48]
not dh
mov dl, 0x3b
sub esp, 0xc
pushfd
call fcn.00cbad23
cmc
ja 0xcbad37
xor byte [ecx - 0x32], 0xed
push 0xdb6899fe
add eax, 0x59cea7b4
Function at 0xd1e004
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, 0x44
sbb al, 0x9f
neg eax
add esp, 6
mov word [esp], bp
jmp 0xd1e03a
mov dl, byte [esp + 1]
xchg word [esp], bp
inc dh
lea edx, [edi + ebp]
lea edx, [esi*4]
rdtsc
jmp 0xd1e024

Function at 0xd1e1ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ah, dl
mov eax, 0xc3198a71
push dword [esp + 7]
mov byte [esp + 8], bh
jmp 0xd1e1b8
rdtsc
lea ebp, reloc.MSVCRT.dll_malloc
jmp 0xd1e198
add esp, 0x11
cld
rdtsc
lea eax, [ebx*4]
not al
mov eax, ebp
jmp 0xd1e203
lea esp, [esp + 3]
lea ebp, [esi*4]
bsr eax, edx
mov ax, sp
pushal
pop edx
jmp 0xd1e1ed

Function at 0xd1eaf9
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], edx
rdtsc
std
push dword [esp + 5]
mov dx, 0x3cdf
dec dh
jmp 0xd1dc5d
mov byte [esp + 0xb], al
mov dword [esp + 7], esp
lea esp, [esp + 1]
lea ebp, [edi*4]
jmp 0xd1dc47
cld
xchg ebp, eax
cld
dec eax
add esp, 3
xchg byte [esp + 6], dh
jmp 0xd1dc0f
lea esp, [esp + 0x15]
mov ebp, 0x33ab3a19
xchg dword [esp + 4], edx
mov bp, di
jmp 0xd1dcab
mov dl, byte [esp + 4]
setns dl
mov ax, word [esp + 0xd]
mov bp, word [esp + 2]
mov dl, byte [esp + 0xb]
jmp 0xd1dc21
xchg word [esp + 8], dx
mov dword [esp + 6], ecx
xchg word [esp + 7], dx
xchg dword [esp + 0x11], ebp
mov eax, dword [esp + 7]
mov eax, ebp
jmp 0xd1dc3a
btr eax, eax
pop edx
neg dx
btc bp, di
mov byte [esp + 0xa], ch
jmp 0xd1dcc1
dec ebp
push dword [esp + 7]
lea edx, [ebx*4]
add esp, 6
bt dx, bp
pushal
jmp 0xd1dc93
mov ax, word [esp + 7]
ror eax, cl
mov byte [esp + 0xe], ah
lea ebp, [ecx + edx]
mov al, 0xa0
push esp
jmp 0xd1dd15
mov ah, al
btr bp, di
xchg byte [esp + 0xf], al
neg eax
xchg al, dh
mov ebp, dword [esp + 0x13]
jmp 0xd1dc79
mov dx, word [esp + 0xe]
pop bp
adc bp, 0xf866
call fcn.00d1dd2d
sub ah, byte [eax + 0x27a05136]
push esp
fisttp qword [ebp + 0x14]
out 0x62, eax
lodsb al, byte [esi]
mov edi, 0x33303186
add esp, 0x12
mov al, byte [esp + 0xb]
push dword [esp + 0xd]
mov dx, bp
bsf bp, sp
pop dword [esp + 9]
jmp 0xd1dcf2
push cx
add esp, 9
lea ebp, [eax*4]
sub esp, 3
mov ebp, 0x19f257de
add dl, bl
jmp 0xd1dcde
mov edx, dword [esp]
pop eax
rdtsc
pop word [esp]
setne al
pushal
jmp 0xd1dd4a
mov byte [esp + 5], al
jmp 0xd1e3cd

Function at 0xd1ff49
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x48], ebp
push esp
mov word [esp + 1], cx
mov dword [esp], edi
mov dword [esp + 0x48], esi
jmp 0xd1ffa2
mov edx, eax
lea edx, [edx + 0xc]
mov eax, dword [edx]
pop edx
jmp 0xd1ff6d
mov dword [esp + 0x44], edi
lea esp, [esp + 0x44]
mov eax, dword fs:[0x30]
push edx
jmp 0xd1ff83

Function at 0xd20072
Capabilities:
Parse pe header

Disassembly:
call fcn.00d1f034
mov dword [esp + 0x48], esp
call fcn.00d1ff49
mov eax, dword [eax + 0x1c]
jmp 0xd1ffb3
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xd1f02f
mov byte [esp + 1], bh
mov dword [esp], eax
mov byte [esp], al
pop word [esp]
push sp
push dword [esp + 3]
jmp 0xd1ff64
pushal
push dword [esp + 0xc]
mov dword [esp + 0x10], esi
mov dword [esp + 0x44], ebx
push ebx
jmp 0xd1ffce
Function at 0x4060ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406112
xor eax, eax
test eax, eax
je 0x406124
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406124
xor ecx, ecx
jmp 0x406127
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4061d1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42cdfc], 0
push esi
jne 0x406208
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4061e2
mov dword [ecx*4 + 0x42cdf8], eax
inc ecx
cmp ecx, 0x100
jl 0x4061dd
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406239
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42cdf8]
xor eax, esi
inc ecx
dec edx
jne 0x40621b
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x1f8c515b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x78a555ec
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x402adc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004048c8
test esi, esi
jne 0x402b12
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004049b8
jmp 0x402b30
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029f0
mov edi, eax
test esi, esi
je 0x402b30
cmp dword [ebx], 0
je 0x402b30
dec esi
jmp 0x402b19
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403190
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x497008], 0x8088405
inc edx
mov dword [ebx + 0x497008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403944
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x497024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4039dc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4039bc
xor eax, eax
push ebp
push 0x4039b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4039f8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4039bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x497024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x497024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4046a8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49a04c], 0
je 0x404709
cmp word [0x49a220], 0xd7b2
jne 0x4046d1
cmp dword [0x49a228], 0
jbe 0x4046d1
mov eax, 0x49a21c
call dword [0x49a238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x497074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404730
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x497034], 0
jne 0x404725
push 0
push 0x49706c
push 0x497074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40487c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027b4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x49a04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404844
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4068f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40695a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404b38
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040337c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406944
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406961
lea eax, [ebp - 0x10]
call fcn.004048c8
ret

Function at 0x40cfb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cfe9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004049b8
jmp 0x40cff2
mov eax, ebx
mov edx, esi
call fcn.0040491c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40cffc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d01d
mov al, byte [esp]
jmp 0x40d01f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40d6a4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40d51c
mov eax, dword [0x499398]
cmp byte [eax], 0
je 0x40d720
mov eax, dword [0x49900c]
call fcn.00402f7c
call fcn.0040291c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409968
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40d768
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40d756
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x498f78]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x49a668]
call fcn.00405dec
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret