joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f010
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x10
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0x1d0]
inc ecx
mov dword [eax + 0x1d0], ecx
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
lea edx, [ecx + 0xc4]
test byte [edx], al
mov edx, eax
mov dword [ecx + 0xc4], eax
lea eax, [edx + 0x88]
test byte [eax], al
mov eax, dword [edx + 0x18]
mov dword [edx + 0x88], eax
mov dword [esp], 0
lea eax, [0x63cde8]
mov dword [esp + 4], eax
call fcn.00425f20
test eax, eax
jne 0x43f10b
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x21c]
test byte [ecx], al
mov edx, dword [esp + 0x14]
mov dword [eax + 0x21c], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0x220], edx
lea edx, [esp + 0x1c]
mov dword [eax + 0x224], edx
mov edx, dword [0x75e2e8]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.004024a0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x228]
mov edx, dword [eax + 0x22c]
mov eax, dword [eax + 0x230]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
nop
call fcn.00426740
add esp, 0x10
ret
nop
call fcn.00426740
add esp, 0x10
ret
Function at 0x444240
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4442df
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0044c147
lea ecx, [0x449fd0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0044a5c0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0044a6e0
jmp fcn.00444240
Function at 0x44ba70
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x44bab0
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x7704a0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x44baeb
je 0x44bb3a
cmp ebx, 0x20
jbe 0x44bb40
cmp ebx, 0x40
jbe 0x44bb7e
jmp 0x44bc0f
test ebx, ebx
je 0x44bb30
add eax, 0x10
test ax, 0xff0
je 0x44bb1c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x65fd80]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x65fe80]
jmp 0x44bb08
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x44bb08
pxor xmm1, xmmword [0x7704b0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x7704b0]
pxor xmm2, xmmword [0x7704c0]
pxor xmm3, xmmword [0x7704d0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x7704b0]
pxor xmm2, xmmword [0x7704c0]
pxor xmm3, xmmword [0x7704d0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x44bc6e
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
Function at 0x44cb90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x238
mov dword [esp], esp
mov dword [esp + 4], 0x238
call fcn.0044c670
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.0044c670
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xb70
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44cc30
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xb70
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.0044b9d0
call fcn.0042afa0
ret
Function at 0x460ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x460e02
sub esp, 0x4c
mov eax, dword [esp + 0x64]
test eax, eax
jle 0x460dfb
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x40], ecx
mov eax, dword [0x75e404]
mov dword [esp], eax
call fcn.0045eac0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov dword [esp], eax
mov dword [esp + 4], 7
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.0043f230
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
test eax, eax
jne 0x460df5
test ecx, ecx
je 0x460de7
cmp ecx, 0x3e5
jne 0x460dbb
mov ecx, dword [0x75991c]
mov edx, dword [0x759918]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
lea eax, [0x65df90]
mov dword [esp], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
call fcn.0040bc10
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x38]
jmp 0x460dab
lea ecx, [0x65c298]
lea edx, [0x65df90]
jmp 0x460dab
xor edx, edx
mov ecx, edx
jmp 0x460dab
xor ecx, ecx
jmp 0x460d09
call fcn.0044a6e0
jmp fcn.00460ce0
Function at 0x463040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46312f
sub esp, 0x54
mov eax, dword [0x75e4e4]
mov dword [esp], eax
call fcn.0045eac0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 8
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
call fcn.0043f230
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x46310b
xor eax, eax
mov ecx, eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], eax
add esp, 0x54
ret
mov dword [esp + 0x38], eax
lea eax, [0x65df90]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040bc10
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
jmp 0x4630ff
call fcn.0044a6e0
jmp fcn.00463040

Function at 0x4635a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4636ac
sub esp, 0x4c
mov eax, dword [0x75e53c]
mov dword [esp], eax
call fcn.0045eac0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 9
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], eax
call fcn.0043f230
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
cmp eax, 0xffffffff
jne 0x4636a6
test ecx, ecx
je 0x463698
cmp ecx, 0x3e5
jne 0x463674
mov eax, dword [0x759918]
mov ecx, dword [0x75991c]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], ecx
lea eax, [0x65df90]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040bc10
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
jmp 0x463668
lea ecx, [0x65c22c]
lea eax, [0x65df90]
jmp 0x463668
xor ecx, ecx
mov eax, ecx
jmp 0x463668
call fcn.0044a6e0
jmp fcn.004635a0
Function at 0x4d9330
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d93d8
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x4d939f
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x4d9389
call fcn.0044a6e0
jmp fcn.004d9330
Function at 0x504210
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50442d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x5042c7
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x504340
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x5042a8
cmp ecx, 0xf
jne 0x5043b9
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x5042a8
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x5042a8
call fcn.0044a6e0
jmp fcn.00504210
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b004]
jne 0x40100a
repz ret
jmp fcn.00401388

Function at 0x407f4b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404911
and dword [ebp - 4], 0
cmp dword [0x4314dc], 0
mov ebx, eax
jne 0x407ffc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4080ad
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4080ad
push eax
call fcn.0040489f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4314dc], eax
call esi
push eax
call fcn.0040489f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4314e0], eax
call esi
push eax
call fcn.0040489f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4314e4], eax
call esi
push eax
call fcn.0040489f
pop ecx
mov dword [0x4314ec], eax
test eax, eax
je 0x407ffc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040489f
pop ecx
mov dword [0x4314e8], eax
mov eax, dword [0x4314e8]
cmp eax, ebx
je 0x408054
cmp dword [0x4314ec], ebx
je 0x408054
push eax
call fcn.0040491a
push dword [0x4314ec]
mov esi, eax
call fcn.0040491a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408054
test edi, edi
je 0x408054
call esi
test eax, eax
je 0x40804b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40804b
test byte [ebp - 0xc], 1
jne 0x408054
or dword [ebp + 0x10], 0x200000
jmp 0x40808d
mov eax, dword [0x4314e0]
cmp eax, ebx
je 0x40808d
push eax
call fcn.0040491a
pop ecx
test eax, eax
je 0x40808d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40808d
mov eax, dword [0x4314e4]
cmp eax, ebx
je 0x40808d
push eax
call fcn.0040491a
pop ecx
test eax, eax
je 0x40808d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4314dc]
call fcn.0040491a
pop ecx
test eax, eax
je 0x4080ad
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4080af
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005936
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10005945
pop dword [ebp - 0x30]
mov eax, 0x42b56fe1
sub eax, 0x32b5169c
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x231b4b15
sub dword [ebp - 0x40], 0xd4c905ca
mov dword [ebp - 0x3c], 0x1183c42a
add dword [ebp - 0x3c], 0x20af881b
mov dword [ebp - 0x38], 0xbd539ba7
add dword [ebp - 0x38], 0x8ef8a887
mov dword [ebp - 0x34], 0x54e7abf6
sub dword [ebp - 0x34], 0x54e7abf6
lea eax, [ebp - 0x40]
push eax
mov eax, 0x1239e73f
sub eax, 0x237e73b
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xee746761
sub dword [ebp - 0x40], 0x7a01fe0b
mov dword [ebp - 0x3c], 0xd80e1b59
sub dword [ebp - 0x3c], 0x96a1b9e4
mov dword [ebp - 0x38], 0xf0c02f8a
sub dword [ebp - 0x38], 0x8d50c31e
mov dword [ebp - 0x34], 0xe2077a27
add dword [ebp - 0x34], 0x1df885d9
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xcf5830e6
add eax, 0x40a9cf1a
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3cffd
push 0
call eax
mov ecx, 0xd50e8903
sub ecx, 0xd50e3f52
xor ebx, ebx
add ebx, eax
mov edi, 0xe66a1308
sub edi, 0xd6675708
add edi, dword [ebp - 0x30]
mov edx, 0x8aeb2130
add edx, 0x3cd82c62
sub dword [ebp - 0x18], 0xb37f90f2
mov esi, dword [edi]
xor dword [ebp - 0x2c], 0xfdd4b64
sub esi, edx
add dword [ebp - 4], edi
mov dword [ebx], esi
sub dword [ebp - 0x18], 0x3594ca6e
add ebx, 0x29c4b708
sub ebx, 0x29c4b704
add edi, 0x51ff4bcb
sub edi, 0x51ff4bc7
loop 0x10005a69
add eax, 0x11997
mov ebx, eax
add eax, 0xdb20e76e
sub eax, 0xdb20e769
mov ecx, 0xfffe7246
inc ecx
mov edx, 0x321d021
invalid
Function at 0x407585
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x40bd90], ebx
push esi
push edi
jne 0x407605
push 0x40a0a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x407640
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40a094
push edi
call esi
test eax, eax
mov dword [0x40bd90], eax
je 0x407640
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x40bd94], eax
call esi
cmp dword [0x40bbe0], 2
mov dword [0x40bd98], eax
jne 0x407605
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x40bda0], eax
je 0x407605
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x40bd9c], eax
mov eax, dword [0x40bd9c]
test eax, eax
je 0x40764a
call eax
test eax, eax
je 0x407631
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x40bda0]
test eax, eax
je 0x407631
test byte [ebp - 8], 1
jne 0x40764a
cmp dword [0x40bbec], 4
jb 0x407644
or byte [ebp + 0x12], 0x20
jmp 0x407669
xor eax, eax
jmp 0x407679
or byte [ebp + 0x12], 4
jmp 0x407669
mov eax, dword [0x40bd94]
test eax, eax
je 0x407669
call eax
mov ebx, eax
test ebx, ebx
je 0x407669
mov eax, dword [0x40bd98]
test eax, eax
je 0x407669
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x40bd90]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41aecd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x41aedc
pop dword [ebp - 0x14]
mov eax, 0x41aedc
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3c494
push 0
mov eax, 0x30e38c65
sub eax, 0x30a0cc39
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x4004bd52
sub ecx, 0x40046968
xor ebx, ebx
add ebx, eax
mov edx, 0xabb87
add edx, 0x38fc79
add edx, dword [ebp - 0x14]
mov edi, 0x39b01cf9
add edi, 0xaff6dd3e
add dword [ebp - 4], 0x3392cf8f
mov esi, dword [edx]
sub dword [ebp - 0x10], 0xa218bab8
xor esi, edi
mov dword [ebp - 0xc], 0xf76c721e
mov dword [ebx], esi
add dword [ebp - 4], 0xf2311020
add ebx, 0xbfc9b22e
add ebx, 0x40364dd6
add edx, 0x9fe7fbef
sub edx, 0x9fe7fbeb
loop 0x41af38
add eax, 0x4050f201
sub eax, 0x404faf86
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x421730
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d4
push esi
call dword [sym.imp.kernel32.dll_GetVersion]
cmp ax, 6
je 0x42176d
push str.SetDefaultDllDirectories
push 0x42c874
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x42176d
push 0xc00
call eax
test eax, eax
jne 0x421806
lea eax, [esp + 8]
push 0x106
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x421806
cmp eax, 0x104
ja 0x421806
cmp word [esp + eax*2 + 6], 0x5c
je 0x42179c
mov word [esp + eax*2 + 8], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x421806
push ebp
lea ecx, [esp + eax*2 + 0xc]
push edi
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esp + 0xc], ecx
mov ebp, 0x6c
mov cl, byte [esi]
mov eax, dword [esp + 0xc]
inc esi
test cl, cl
je 0x4217db
xor dx, dx
add eax, 2
mov dl, cl
inc esi
mov word [eax - 2], dx
mov cl, byte [esi - 1]
test cl, cl
jne 0x4217c7
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], bp
mov word [eax + 6], bp
mov word [eax + 8], 0
push 8
lea eax, [esp + 0x14]
push 0
push eax
call edi
cmp byte [esi], 0
jne 0x4217bc
pop edi
pop ebp
pop esi
add esp, 0x2d4
ret
Function at 0x403064
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4a3008], 0x8088405
inc edx
mov dword [ebx + 0x4a3008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403870
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4a3024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403908
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4038e8
xor eax, eax
push ebp
push 0x4038e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403924
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4038e8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x4a3024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4a3024], ax
mov esp, ebp
pop ebp
ret

Function at 0x40471c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x51104c], 0
je 0x40477d
cmp word [0x511220], 0xd7b2
jne 0x404745
cmp dword [0x511228], 0
jbe 0x404745
mov eax, 0x51121c
call dword [0x511238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4047a4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4a3030], 0
jne 0x404799
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret