joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b381b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x100e93e0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], 3
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x18], 1
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push 0x100d18f8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100b3878
jmp 0x100b39cb
push dword [ebp + 8]
push 0x100d1948
push 0x103
lea eax, [ebp - 0x128]
push eax
call fcn.10007e2d
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100b38bd
jmp 0x100b39c2
mov dword [ebp - 0x18], 4
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x100d1958
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100b38f5
jmp 0x100b39b9
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 0x103
push 0x104
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.100738a0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x100d1968
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100b3940
jmp 0x100b39b9
cmp dword [ebp - 0x10], 1
jne 0x100b3970
push 0x100d18f4
call fcn.10070b80
pop ecx
push eax
push 0x100d1978
lea eax, [ebp - 0x128]
push eax
call fcn.10072a9f
add esp, 0xc
test eax, eax
jne 0x100b3970
and dword [ebp - 8], 0
jmp 0x100b39b9
cmp dword [ebp - 0x10], 1
jne 0x100b39a3
push 0x100d197c
call fcn.10070b80
pop ecx
push eax
push 0x100d1980
lea eax, [ebp - 0x128]
push eax
call fcn.10072a9f
add esp, 0xc
test eax, eax
je 0x100b39a3
mov dword [ebp - 8], 2
jmp 0x100b39b9
cmp dword [ebp - 0x10], 2
jne 0x100b39b2
mov dword [ebp - 8], 1
jmp 0x100b39b9
mov dword [ebp - 8], 3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10070c21
leave
ret
Function at 0x100b3d99
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 0x20], eax
and dword [ebp - 8], 0
jmp 0x100b3dc9
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x100b3de7
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x18], eax
jmp 0x100b3dc2
mov dword [ebp - 0x1c], 0xe3779b90
and dword [ebp - 8], 0
jmp 0x100b3dfb
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x100b3e56
mov eax, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 4]
shr ecx, 5
add ecx, dword [ebp - 0xc]
xor eax, ecx
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
shl eax, 4
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor eax, ecx
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x1c]
add eax, 0x61c88647
mov dword [ebp - 0x1c], eax
jmp 0x100b3df4
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
leave
ret
Function at 0x100b3e75
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 0x20], eax
and dword [ebp - 8], 0
jmp 0x100b3ea5
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x100b3ec3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x18], eax
jmp 0x100b3e9e
and dword [ebp - 0x1c], 0
and dword [ebp - 8], 0
jmp 0x100b3ed4
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x100b3f2b
mov eax, dword [ebp - 0x1c]
sub eax, 0x61c88647
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
shl eax, 4
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor eax, ecx
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 4]
shr ecx, 5
add ecx, dword [ebp - 0xc]
xor eax, ecx
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
jmp 0x100b3ecd
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
leave
ret

Function at 0x100b4de1
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x5c
push 0
push dword [ebp + 8]
call fcn.100738a0
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp + 8]
and dword [eax + 0x10], 0
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
mov eax, dword [ebp + 8]
and dword [eax + 0x58], 0
pop ebp
ret
Function at 0x100b754f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bbc31
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x100e93e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x25c], 0
lea ecx, [ebp - 0x2c]
call fcn.100016d3
and dword [ebp - 4], 0
mov byte [ebp - 0x2d], 0
push 0x208
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.100738a0
add esp, 0xc
push 1
movzx eax, byte [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0xfffffff7
add eax, 0x23
push eax
lea eax, [ebp - 0x23c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100b7669
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x258]
call fcn.100016fc
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x264], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x264]
lea ecx, [ebp - 0x2c]
call fcn.10001795
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x258]
call fcn.1000176a
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100b762b
push 0x100d199c
lea ecx, [ebp - 0x2c]
call fcn.10004d8f
jmp 0x100b7638
push 0x100d19c4
lea ecx, [ebp - 0x2c]
call fcn.10004d8f
lea eax, [ebp - 0x2c]
push eax
call fcn.100b61cd
pop ecx
movzx eax, al
test eax, eax
jne 0x100b7658
lea eax, [ebp - 0x2c]
push eax
call fcn.100b7104
pop ecx
mov byte [ebp - 0x2d], al
jmp 0x100b765c
mov byte [ebp - 0x2d], 1
push 0x100d19e8
lea ecx, [ebp - 0x2c]
call fcn.10004d8f
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
call fcn.10001732
mov eax, dword [ebp - 0x25c]
or eax, 1
mov dword [ebp - 0x25c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.1000176a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10070c21
leave
ret
Function at 0x100b76aa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bbc61
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100e93e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
mov byte [ebp - 0x31], 0
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.100b754f
pop ecx
pop ecx
and dword [ebp - 4], 0
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x30]
call fcn.10004e3f
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x100b7747
push 1
lea eax, [ebp - 0x50]
push eax
call fcn.100b754f
pop ecx
pop ecx
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x50]
call fcn.10004e3f
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x50]
call fcn.1000176a
cmp dword [ebp - 0x10], 0xffffffff
je 0x100b7778
push 0
lea eax, [ebp - 0x54]
push eax
push 0x10
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100b776f
cmp dword [ebp - 0x54], 0x10
jne 0x100b776f
mov byte [ebp - 0x31], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x31]
mov byte [ebp - 0x55], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1000176a
mov al, byte [ebp - 0x55]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10070c21
leave
ret 4
Function at 0x100b77a6
Capabilities:
Copy file
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bbc8e
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100e93e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], ecx
mov byte [ebp - 0x31], 0
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.100b754f
pop ecx
pop ecx
and dword [ebp - 4], 0
or dword [ebp - 0x10], 0xffffffff
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x30]
call fcn.10004e3f
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x100b789a
push 1
lea eax, [ebp - 0x50]
push eax
call fcn.100b754f
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
call fcn.100b4e31
pop ecx
movzx eax, al
test eax, eax
jne 0x100b7871
lea eax, [ebp - 0x50]
push eax
call fcn.100b4e31
pop ecx
movzx eax, al
test eax, eax
je 0x100b7871
push 0
lea ecx, [ebp - 0x30]
call fcn.10004e3f
push eax
lea ecx, [ebp - 0x50]
call fcn.10004e3f
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100b7871
lea ecx, [ebp - 0x50]
call fcn.10004e3f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x50]
call fcn.10004e3f
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x50]
call fcn.1000176a
cmp dword [ebp - 0x10], 0xffffffff
je 0x100b78e8
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x10
jb 0x100b78df
cmp dword [ebp - 0x54], 0xffffffff
je 0x100b78df
push 0
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x54]
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b78df
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x54]
jne 0x100b78df
mov byte [ebp - 0x31], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x31]
mov byte [ebp - 0x59], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1000176a
mov al, byte [ebp - 0x59]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10070c21
leave
ret 4
Function at 0x100b7f71
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100e93e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x21c], 0
mov eax, dword [0x10105850]
and eax, 1
jne 0x100b7fb7
mov eax, dword [0x10105850]
or eax, 1
mov dword [0x10105850], eax
mov ecx, 0x1010584c
call fcn.10003c04
push 0x100c1caf
call fcn.1007118b
pop ecx
mov ecx, 0x1010584c
call fcn.10003bee
movzx eax, al
test eax, eax
je 0x100b800a
and word [ebp - 0x218], 0
push 0x20a
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.100738a0
add esp, 0xc
push 1
push 0x24
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x1010584c
call fcn.10003cbb
push 0x1010584c
mov ecx, dword [ebp + 8]
call fcn.10003c1e
mov eax, dword [ebp - 0x21c]
or eax, 1
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10070c21
leave
ret

Function at 0x100b8035
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100e93e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x21c], 0
mov eax, dword [0x10105858]
and eax, 1
jne 0x100b807b
mov eax, dword [0x10105858]
or eax, 1
mov dword [0x10105858], eax
mov ecx, 0x10105854
call fcn.10003c04
push 0x100c1ca0
call fcn.1007118b
pop ecx
mov ecx, 0x10105854
call fcn.10003bee
movzx eax, al
test eax, eax
je 0x100b80ce
and word [ebp - 0x218], 0
push 0x20a
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.100738a0
add esp, 0xc
push 1
push 0x25
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x10105854
call fcn.10003cbb
push 0x10105854
mov ecx, dword [ebp + 8]
call fcn.10003c1e
mov eax, dword [ebp - 0x21c]
or eax, 1
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10070c21
leave
ret
Function at 0x100b84f4
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.100018a0
movzx eax, al
test eax, eax
jne 0x100b8523
push 4
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.10004e3f
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
leave
ret 4
Function at 0x102c53ff
Capabilities:
Encode data using xor

Disassembly:
push 0x370360d2
pushfd
mov dword [esp + 4], 0x4e20
jmp 0x102c4263
push dword [ebp - 0x20]
pop dword [esp]
pushal
push ebp
mov word [esp], cx
mov dword [esp + 0x20], 0x102d36aa
push dword [esp + 0xc]
call fcn.102c7091
jmp 0x102cb098
pushal
lea esp, [esp + 0x2c]
jne 0x102d0800
stc
push ebp
cmp ebp, 0x6756425d
cmp dword [ebp - 0x20], 0
pushal
mov byte [esp], bl
pushfd
lea esp, [esp + 0x28]
je 0x102d0800
pushal
push 0x4d6ddbd8
mov dword [esp + 0x20], 0
push edi
pushal
push eax
push dword [esp + 4]
push dword [ebp - 0x20]
pop dword [esp + 0x48]
mov dword [esp], 0x89a0292e
pushfd
push 0x8a055045
mov dword [esp + 0x4c], 0x102d0800
call fcn.102ca66a
mov ah, 0xa4
xor cl, byte [ebx - 0x2b]
in eax, dx
add byte [esp - 0x122ab4ce], dh
dec edx
xor ebx, eax
fild word [edi + 0x619b32ed]
out 0xf, eax
jne 0x102c545a
shl byte [ebx], cl
lcall 0x2f10, 0x85d7190e
cmovbe esi, dword [edx + ebp - 0xc2c12ee]
push 0x38930c46
rol byte [ecx], cl
inc esp
push ebx
sbb dword [0x2d10e34c], eax
mov ah, byte [edi + 0x1d340770]
adc al, 0x65
xor eax, dword [ebx - 0x66]
lodsd eax, dword [esi]
nop
wait
out dx, eax
xor eax, 0x4527c9ba
movsd dword es:[edi], dword [esi]
sbb dword [esi], ecx
clc
std
or ebp, dword [ebx]
mov dh, bh
push edx
outsd dx, dword [esi]
clc
call [edi]
xchg esp, eax
hlt
push dword [esp]
pushal
mov byte [ebp - 4], 2
call fcn.102d3e77
push esi
setns ch
mov dword [ebp - 0x24], eax
not cx
jmp 0x102c9598
push eax
jmp 0x102d42d1
bt si, di
cmp dword [ebp - 0x20], 0
jmp 0x102d6684
lea esp, [esp + 4]
je 0x102d43f9
pushfd
lea esp, [esp + 4]
jp 0x102c39ba
push 0x4e20
push edx
call fcn.102d1c69

Function at 0x102cab30
Capabilities:
Packed with generic packer

Disassembly:
cmp ax, 0x5c
push dword [esp]
mov dword [esp], esi
lea esp, [esp + 0xc]
je 0x102c5312
pushal
pushal
mov dword [esp + 0x3c], 0x5c
bswap cx
mov ecx, ebx
push esp
jmp 0x102cb98c
pushfd
lea esp, [esp + 0x44]
call fcn.10003cd4
adc ebx, 0xffffffff
movzx cx, al
lea ecx, [ebp*8 + 0x5c7feb53]
mov cl, 0x4b
push str.drivers_
pushfd
pushfd
pop ecx
lea ecx, [ebp - 0x49c]
call fcn.102c51ec
fimul dword [edx]
pushfd
cmpsb byte [esi], byte es:[edi]
aad 0xed
clc
popal
mov edx, 0xfc54ed88
cld
rol dh, 0xae
cmc
fucom st(2)
push 0x3a
cmpsd dword [esi], dword es:[edi]
cmc
cmp edx, ebx
sub al, 0x32
test dword [eax + edi + 0xd370d47], edi
lodsd eax, dword [esi]
shl byte [ecx + 0x2f], 0x34
test eax, esi
jae 0x102cb993
out dx, eax
sub al, 0x80
sar byte [ecx], 1
add ecx, ecx
jge 0x102cb9c2
shr eax, cl
or eax, 0xf92110cd
std
sbb ebp, dword [esi + edx*2 - 0x768d3243]
stc
in eax, dx
inc edx
xchg esi, eax
jge 0x102cba34
or edx, eax
xchg esi, eax
iretd
sti
fdivp st(7)
Function at 0x4027a4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40f008], 0x8088405
inc edx
mov dword [ebx + 0x40f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402c2c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40f018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402cc4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ca4
xor eax, eax
push ebp
push 0x402c9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ce0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ca4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40f018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40f018], ax
mov esp, ebp
pop ebp
ret

Function at 0x403570
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x411044], 0
je 0x4035d1
cmp word [0x411218], 0xd7b2
jne 0x403599
cmp dword [0x411220], 0
jbe 0x403599
mov eax, 0x411214
call dword [0x411230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40f060
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4035f8
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x40f024], 0
jne 0x4035ed
push 0
push 0x40f058
push 0x40f060
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret
Function at 0x40410c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40433c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40418f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40433c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40418f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404358
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404218
xor eax, eax
push ebp
push 0x404211
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00403f54
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4041f6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404378
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4041f6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404218
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale_1
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404332
cmp byte [ebp - 0xd], 0
jne 0x40425f
cmp byte [ebp - 0x12], 0
je 0x404332
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404278
dec ebx
cmp byte [ebx], 0x2e
je 0x404287
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404277
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404332
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4042c4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404332
cmp byte [ebp - 0xd], 0
je 0x404332
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404332
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret