joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1000e938
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x10003297
cmp byte [edi + 0x45], 0
je 0x10003297
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10003170
xor al, al
jmp 0x10003299
sub esp, 8
lea ecx, [esp + 0x20]
call fcn.10002e20
mov dword [esp + 0x40], 0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x1c]
cmp ebx, 0x10
lea ecx, [esp + 0x1c]
cmovae ecx, dword [esp + 0x1c]
cmovae edx, dword [esp + 0x1c]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
lea eax, [edi + 0x48]
push eax
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x100031cf
dec eax
je 0x100031d3
sub eax, 2
je 0x1000327d
xor bl, bl
jmp 0x1000327f
mov byte [edi + 0x45], 0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp ebx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, ecx
sub esi, eax
je 0x1000320b
push dword [edi + 0x50]
cmp ebx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x100031c8
cmp byte [edi + 0x45], 0
je 0x1000327d
test esi, esi
jne 0x10003184
mov ecx, dword [esp + 0x28]
or eax, 0xffffffff
sub eax, ecx
cmp eax, 8
jbe 0x10003272
lea esi, [ecx + 8]
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.10003460
test al, al
je 0x10003184
cmp dword [esp + 0x2c], 0x10
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x28]
xorps xmm0, xmm0
cmovae ecx, dword [esp + 0x18]
movq qword [ecx + eax], xmm0
lea eax, [esp + 0x18]
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x28], esi
cmovae eax, dword [esp + 0x18]
mov byte [eax + esi], 0
jmp 0x10003184
push str.string_too_long
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xlength_error_char_const__]
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x10003293
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
jmp 0x10003299
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1000dd30
mov esp, ebp
pop ebp
ret
Function at 0x100039e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100248e4]
push esi
mov esi, ecx
test al, 1
jne 0x10003a1b
or eax, 1
mov dword [0x100248e0], 0x1000fd38
push 0x1000edb0
mov dword [0x100248e4], eax
call fcn.1000df04
add esp, 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
add esi, 0x400
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10003a51
lea eax, [ebp - 8]
mov dword [esi], 5
push eax
push dword [ebp - 8]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000dd30
mov esp, ebp
pop ebp
ret 4

Function at 0x10003a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100248e4]
push esi
mov esi, ecx
test al, 1
jne 0x10003aab
or eax, 1
mov dword [0x100248e0], 0x1000fd38
push 0x1000edb0
mov dword [0x100248e4], eax
call fcn.1000df04
add esp, 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
add esi, 0x1fc
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10003ae1
lea eax, [ebp - 8]
mov dword [esi], 0
push eax
push dword [ebp - 8]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000dd30
mov esp, ebp
pop ebp
ret
Function at 0x10005260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x10005282
lea eax, [ebp - 8]
push eax
push 4
push 0x1cc000
push 0x401000
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 4
push 0x18000
push 0x5cd000
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x1002757c]
test al, 1
jne 0x100052d6
or eax, 1
mov dword [0x10027580], 0x1000fdcc
push 0x1000edd0
mov dword [0x1002757c], eax
call fcn.1000df04
add esp, 4
call fcn.100053f0
test al, al
jne 0x100052ef
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000dd30
mov esp, ebp
pop ebp
ret
mov eax, dword [0x10027574]
test al, 1
jne 0x10005317
or eax, 1
mov dword [0x10027578], 0x1000fdb4
push 0x1000edc0
mov dword [0x10027574], eax
call fcn.1000df04
add esp, 4
call fcn.10009ce0
test al, al
je 0x100052df
mov byte [0x100248fa], 1
call fcn.10007320
test al, al
je 0x10005338
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.10007400
test al, al
je 0x10005349
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.1000dd30
mov esp, ebp
pop ebp
ret

Function at 0x10005360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 0x1d
push 0x44b828
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100053db
mov eax, 0x44b828
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov dword [eax + 8], 0x90909090
mov dword [eax + 0xc], 0x90909090
mov dword [eax + 0x10], 0x90909090
mov dword [eax + 0x14], 0x90909090
mov dword [eax + 0x18], 0x90909090
mov byte [eax + 0x1c], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x1d
push 0x44b828
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000dd30
mov esp, ebp
pop ebp
ret 8
Function at 0x10005e60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100248e4]
test al, 1
jne 0x10005e98
or eax, 1
mov dword [0x100248e0], 0x1000fd38
push 0x1000edb0
mov dword [0x100248e4], eax
call fcn.1000df04
add esp, 4
push ebx
push esi
push edi
push 0x100245a5
push 5
mov dword [ebp - 8], 0
call fcn.1000df7c
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
add esp, 8
test esi, esi
je 0x10005f20
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x10006070
push 5
sub ecx, 0x4e0546
push 0x4e0541
mov dword [esi + 1], ecx
call edi
test eax, eax
je 0x10005f20
mov eax, dword [esi]
mov ecx, 0x4e0541
mov dword [ecx], eax
mov al, byte [esi + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push ecx
call edi
test eax, eax
je 0x10005f20
push 5
push 0x4e0541
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
push 0x100245a5
push 6
mov dword [ebp - 8], 0
call fcn.1000df7c
mov esi, eax
add esp, 8
test esi, esi
je 0x10005f9f
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x100060a0
sub ecx, 0x50d979
push 6
mov dword [esi + 1], ecx
push 0x50d974
mov byte [esi + 5], 0x90
call edi
test eax, eax
je 0x10005f9f
mov eax, dword [esi]
mov ecx, 0x50d974
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
test eax, eax
je 0x10005f9f
push 6
push 0x50d974
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
push 0x100245a5
push 6
mov dword [ebp - 8], 0
call fcn.1000df7c
mov esi, eax
add esp, 8
test esi, esi
je 0x1000601e
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x100060d0
sub ecx, 0x4df308
push 6
mov dword [esi + 1], ecx
push 0x4df303
mov byte [esi + 5], 0x90
call edi
test eax, eax
je 0x1000601e
mov eax, dword [esi]
mov ecx, 0x4df303
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
test eax, eax
je 0x1000601e
push 6
push 0x4df303
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000dd30
mov esp, ebp
pop ebp
ret
Function at 0x10006200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000eb0b
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x12c
lea eax, [ebp - 0x140]
push 0
push eax
call sub.MSVCR120.dll_memset
sub esp, 0xc
lea ecx, [ebp - 0x140]
call fcn.1000d260
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x13c]
test eax, eax
je 0x10006283
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [ebp - 0x13c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push dword [ebp - 0x128]
call dword [sym.imp.USER32.dll_UnregisterClassA]
lea ecx, [ebp - 0x140]
call fcn.1000d360
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10006560
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x100066a2
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10001490
push 0
push 0
mov dword [0x100248f0], esi
call edi
push 0
push 0
push 0
push 0x10006160
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10006410
push 0
push 0
call edi
push 0
push 0
push 0
push 0x100061a0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x100062b0
push 0
push 0
mov dword [0x100248f4], eax
call edi
call fcn.100013c0
push 0
push 0
push 0
push 0x10001a10
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10001c10
push 0
push 0
call edi
call fcn.10001e90
push 0
push 0
push 0
push 0x100021a0
push 0
push 0
call edi
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.shell32.dll
call esi
push str.xProtect.dll
call esi
push str.music.dll
call esi
push 0
push 0
push 0
push 0x10006b00
push 0
push 0
call edi
pop edi
cmp dword [ebp + 0x10], 0
pop esi
jne 0x1000669c
mov eax, dword [0x10027584]
test al, 1
jne 0x1000667a
or eax, 1
mov dword [0x10027588], 0x1000fde0
push 0x1000ede0
mov dword [0x10027584], eax
call fcn.1000df04
add esp, 4
mov ecx, 0x10027588
call fcn.10005260
test al, al
jne 0x100066b9
push 0
push str.Erro:_ClientPatch.dll
push 0x1000fe50
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebp
ret 0xc
test eax, eax
jne 0x1000669c
cmp dword [ebp + 0x10], eax
je 0x1000669c
call fcn.100066d0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop ebp
ret 0xc
Function at 0x10006700
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x6bdaf0]
push esi
mov esi, ecx
push 0x44d
mov ecx, dword [eax + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x48]
cmp esi, 1
jne 0x1000673e
push 0x3e8
push 0x3e8
push str.UIList1.txt
jmp 0x1000686f
cmp esi, 2
jne 0x10006757
push 0x3e8
push 0x3e8
push str.UIList2.txt
jmp 0x1000686f
cmp esi, 3
jne 0x10006770
push 0x3e8
push 0x3e8
push str.UIList3.txt
jmp 0x1000686f
cmp esi, 4
jne 0x10006789
push 0x3e8
push 0x3e8
push str.UIList4.txt
jmp 0x1000686f
cmp esi, 5
jne 0x100067a2
push 0x3e8
push 0x3e8
push str.UIList5.txt
jmp 0x1000686f
cmp esi, 6
jne 0x100067bb
push 0x3e8
push 0x3e8
push str.UIList6.txt
jmp 0x1000686f
cmp esi, 7
jne 0x100067d4
push 0x3e8
push 0x3e8
push str.UIList7.txt
jmp 0x1000686f
cmp esi, 8
jne 0x100067ed
push 0x3e8
push 0x3e8
push str.UIList8.txt
jmp 0x1000686f
cmp esi, 9
jne 0x10006803
push 0x3e8
push 0x3e8
push str.UIList9.txt
jmp 0x1000686f
cmp esi, 0xa
jne 0x10006819
push 0x3e8
push 0x3e8
push str.UIList10.txt
jmp 0x1000686f
cmp esi, 0xb
jne 0x1000682f
push 0x3e8
push 0x3e8
push str.UIList11.txt
jmp 0x1000686f
cmp esi, 0xc
jne 0x10006845
push 0x3e8
push 0x3e8
push str.UIList12.txt
jmp 0x1000686f
cmp esi, 0xd
jne 0x1000685b
push 0x3e8
push 0x3e8
push str.UIList13.txt
jmp 0x1000686f
cmp esi, 0xe
jne 0x10006879
push 0x3e8
push 0x3e8
push str.UIList14.txt
push eax
mov ecx, eax
mov edx, 0x4aa153
call edx
mov eax, dword [0x6bdaf0]
push 0x2711
mov ecx, dword [eax + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x48]
mov ecx, dword [0x100248e4]
mov esi, eax
test cl, 1
jne 0x100068b8
or ecx, 1
mov dword [0x100248e0], 0x1000fd38
push 0x1000edb0
mov dword [0x100248e4], ecx
call fcn.1000df04
add esp, 4
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0
push eax
push 0x40
push 4
add esi, 0x1fc
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100068ee
lea eax, [ebp - 0x58]
mov dword [esi], 0
push eax
push dword [ebp - 0x58]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
lea eax, [ebp - 0x54]
push 0x1000fda0
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
mov eax, dword [0x6bdaf0]
add esp, 0xc
mov ecx, dword [eax + 0x28]
push 0x578
mov eax, dword [ecx]
call dword [eax + 0x48]
pop esi
test eax, eax
je 0x10006929
mov edx, dword [eax]
lea ecx, [ebp - 0x54]
push 0
push ecx
mov ecx, eax
call dword [edx + 0x80]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000dd30
mov esp, ebp
pop ebp
ret
Function at 0x100071a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edx
push eax
push 0x40
push 4
push 0x49b50a
mov esi, ecx
mov dword [ebp - 8], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x49b50b], esi
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10023f70]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000dd30
mov esp, ebp
pop ebp
ret
Function at 0x1000c970
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1000ca2a
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
mov eax, dword [ebp - 0x134]
lea ecx, [ebp - 0x10c]
lea esp, [esp]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1000c9f0
test dl, dl
je 0x1000c9ec
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1000c9f0
add ecx, 2
add eax, 2
test dl, dl
jne 0x1000c9d0
xor eax, eax
jmp 0x1000c9f5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000ca10
push dword [ebp - 0x128]
push eax
push 0x1f0fff
call ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x130]
push eax
push esi
call edi
test eax, eax
jne 0x1000c9c0
cmp esi, 0xffffffff
je 0x1000ca2a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000dd30
mov esp, ebp
pop ebp
ret

Function at 0x1000ca40
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp dword [ebp + 0x1c], 0x10
jb 0x1000ca67
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
pop ebp
ret
Function at 0x1000cf70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
mov esi, dword [ebp + 8]
jmp 0x1000cf9a
cmp dword [ebp + 0x10], 0
jne 0x1000d05f
movsx eax, word [esi + 4]
add eax, 0x1f4
cmp eax, 0x401
jne 0x1000d05f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
movzx eax, byte [esp + 0x1f]
xorps xmm0, xmm0
push eax
movzx eax, byte [esp + 0x22]
push eax
movzx eax, byte [esp + 0x25]
push eax
movzx eax, byte [esp + 0x28]
push eax
movzx eax, byte [esp + 0x2b]
push eax
movzx eax, byte [esp + 0x2e]
push eax
lea eax, [esp + 0x38]
movdqa xmmword [esp + 0x38], xmm0
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
mov word [esp + 0x50], 0
call dword [sym.imp.MSVCR120.dll_sprintf]
lea ecx, [esp + 0x40]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d011
sub ecx, edx
cmp ecx, 0xc
jge 0x1000d027
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [esi + 0x42]
xorps xmm0, xmm0
lea eax, [esp + 0x20]
movdqu xmmword [edx], xmm0
mov ecx, eax
mov word [edx + 0x10], 0
sub edx, ecx
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1000d040
mov eax, 0x9ca
mov word [esi + 0x54], ax
mov eax, 0x1d5e
mov word [esi + 0x5c], ax
jmp 0x1000d071
mov ecx, dword [esp + 0x4c]
pop esi
xor ecx, esp
call fcn.1000dd30
mov esp, ebp
pop ebp
ret
Function at 0x403144
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00405064
test esi, esi
jne 0x40317a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00405154
jmp 0x403198
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403048
mov edi, eax
test esi, esi
je 0x403198
cmp dword [ebx], 0
je 0x403198
dec esi
jmp 0x403181
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4031cc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x49a008], 0x8088405
inc edx
mov dword [ebx + 0x49a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x404034
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x49a024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4040cc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4040ac
xor eax, eax
push ebp
push 0x4040a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4040e8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4040ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x49a024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x49a024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404ec8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x58a04c], 0
je 0x404f29
cmp word [0x58a220], 0xd7b2
jne 0x404ef1
cmp dword [0x58a228], 0
jbe 0x404ef1
mov eax, 0x58a21c
call dword [0x58a238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x49a784
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404f50
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x49a030], 0
jne 0x404f45
push 0
push 0x49a77c
push 0x49a784
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4093cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x40945c
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x40945c
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x40940f
test edx, 3
jne 0x4093fe
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x409409
jmp 0x40940f
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x40940f
cmp dword [ecx - 8], 1
je 0x409419
mov edx, ebx
or edx, 3
call fcn.004057b4
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40942b
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00405064

Function at 0x409468
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4094f8
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4094f8
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x4094ab
test edx, 3
jne 0x40949a
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x4094a5
jmp 0x4094ab
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x4094ab
cmp dword [ecx - 8], 1
je 0x4094b5
mov edx, ebx
or edx, 3
call fcn.004057b4
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4094c7
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00405064

Function at 0x40a240
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405528
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40a259
test al, 0x10
je 0x40a25d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40d708
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d741
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00405154
jmp 0x40d74a
mov eax, ebx
mov edx, esi
call fcn.004050b8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40d754
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d776
movzx eax, byte [esp]
jmp 0x40d778
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret