joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002130
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xac
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa8], eax
push esi
push edi
mov ecx, 6
mov esi, str.QMDRU_PCZPcegqrcp_nnLr42
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov byte [esp + 0x46], al
lea eax, [esp + 0x14]
pop edi
lea edx, [eax + 1]
pop esi
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002180
sub eax, edx
xor ecx, ecx
test eax, eax
jle 0x1000219a
nop
add byte [esp + ecx + 0xc], 2
inc ecx
cmp ecx, eax
jl 0x10002190
mov eax, dword [str.Pr_Kbq]
mov ecx, dword [0x100052a8]
mov edx, dword [0x100052ac]
push 0x57
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], eax
mov ax, word [0x100052b0]
lea ecx, [esp + 0x52]
push 0
push ecx
mov dword [esp + 0x54], edx
mov word [esp + 0x58], ax
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x4c]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100021e0
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x100021fb
add byte [esp + eax + 0x40], 3
inc eax
cmp eax, ecx
jl 0x100021f1
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
lea eax, [esp + 0x18]
push eax
push closesocket
mov dword [0x1001eef4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000226d
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x50]
push eax
push ecx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp]
cmp eax, 0xf4240
jbe 0x10002263
add eax, 0xbc614e
mov dword [0x1001eef4], eax
jmp 0x1000226d
mov dword [0x1001eef4], 0
mov eax, dword [esp + 4]
test eax, eax
je 0x1000227c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xa8]
xor ecx, esp
mov eax, 1
call fcn.10004226
add esp, 0xac
ret
Function at 0x100027c0
Capabilities:
Set registry value

Disassembly:
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100027c5
sub eax, edx
mov edx, eax
test edx, edx
jle 0x1000283b
push esi
mov esi, 0x1001ee94
mov eax, edi
sub esi, edi
mov edi, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x100027e0
xor eax, eax
test edx, edx
jle 0x1000280c
mov ecx, eax
and ecx, 0x80000001
jns 0x100027ff
dec ecx
or ecx, 0xfffffffe
inc ecx
add cl, al
add byte [eax + 0x1001ee94], cl
inc eax
cmp eax, edx
jl 0x100027f0
inc edx
push edx
mov edx, dword [0x1001eccc]
push 0x1001ee94
push 1
push 0
push 0x1001e6f0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, edi
jmp 0x10002830
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10002830
pop esi
ret

Function at 0x10002840
Capabilities:
Set registry value

Disassembly:
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002845
sub eax, edx
mov edx, eax
test edx, edx
jle 0x100028bb
push esi
mov esi, 0x1001eea4
mov eax, edi
sub esi, edi
mov edi, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10002860
xor eax, eax
test edx, edx
jle 0x1000288c
mov ecx, eax
and ecx, 0x80000001
jns 0x1000287f
dec ecx
or ecx, 0xfffffffe
inc ecx
add cl, al
add byte [eax + 0x1001eea4], cl
inc eax
cmp eax, edx
jl 0x10002870
inc edx
push edx
mov edx, dword [0x1001eccc]
push 0x1001eea4
push 1
push 0
push 0x1001e708
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, edi
jmp 0x100028b0
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x100028b0
pop esi
ret

Function at 0x100028c0
Capabilities:
Set registry value

Disassembly:
mov eax, 0x1000527c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100028c8
sub eax, edx
mov edx, eax
test edx, edx
jle 0x10002951
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x1000527c]
mov byte [eax + 0x1001eeb4], cl
inc eax
test cl, cl
jne 0x100028e0
xor eax, eax
test edx, edx
jle 0x1000291c
jmp 0x10002900
mov ecx, eax
and ecx, 0x80000001
jns 0x1000290f
dec ecx
or ecx, 0xfffffffe
inc ecx
add cl, al
add byte [eax + 0x1001eeb4], cl
inc eax
cmp eax, edx
jl 0x10002900
inc edx
push edx
mov edx, dword [0x1001eccc]
push 0x1001eeb4
push 1
push 0
push 0x1001e720
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
jmp 0x10002940
mov cl, byte [eax + 0x1000527c]
mov byte [eax + 0x1001eeb4], cl
inc eax
test cl, cl
jne 0x10002940
ret
Function at 0x10002960
Capabilities:
Set registry value

Disassembly:
mov eax, 0x1000527c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002968
sub eax, edx
mov edx, eax
test edx, edx
jle 0x100029f1
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x1000527c]
mov byte [eax + 0x1001eec4], cl
inc eax
test cl, cl
jne 0x10002980
xor eax, eax
test edx, edx
jle 0x100029bc
jmp 0x100029a0
mov ecx, eax
and ecx, 0x80000001
jns 0x100029af
dec ecx
or ecx, 0xfffffffe
inc ecx
add cl, al
add byte [eax + 0x1001eec4], cl
inc eax
cmp eax, edx
jl 0x100029a0
inc edx
push edx
mov edx, dword [0x1001eccc]
push 0x1001eec4
push 1
push 0
push 0x1001e738
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
jmp 0x100029e0
mov cl, byte [eax + 0x1000527c]
mov byte [eax + 0x1001eec4], cl
inc eax
test cl, cl
jne 0x100029e0
ret
Function at 0x10004120
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x30
mov eax, dword [0x1001ecdc]
push ebx
push ebp
push edi
push 0xffffffffffffffff
push eax
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov ebx, dword [sym.imp.WS2_32.dll_WSASend]
mov edi, eax
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
push 0
lea eax, [esp + 0x28]
push eax
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x28]
push edx
push esi
call ebx
cmp eax, 0xffffffff
jne 0x1000419f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x100041ee
push 0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x28]
push eax
push 1
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
cmp eax, 0xffffffff
je 0x100041ee
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x100041ee
mov eax, dword [esp + 0xc]
sub dword [esp + 0x14], eax
je 0x100041f0
add dword [esp + 0x18], eax
jmp 0x10004175
xor ebp, ebp
push edi
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov edx, dword [0x1001ecdc]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x30
ret

Function at 0x10004226
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10004230
repz ret
jmp fcn.100045e3
Function at 0x1000e5e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000e5f2
pop dword [ebp - 0x20]
mov eax, 0x740bb4b8
add eax, 0x9bf5313a
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x63c17712
add dword [ebp - 0x30], 0xea90ce39
mov dword [ebp - 0x2c], 0xc204f188
add dword [ebp - 0x2c], 0x702e5abd
mov dword [ebp - 0x28], 0x83dfdc67
sub dword [ebp - 0x28], 0x37939839
mov dword [ebp - 0x24], 0x48494cc4
add dword [ebp - 0x24], 0xb7b6b33c
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x5b59911e
add dword [ebp - 0x30], 0x1918d838
mov dword [ebp - 0x2c], 0x254834fe
sub dword [ebp - 0x2c], 0xe3dbd389
mov dword [ebp - 0x28], 0x7f2fa50b
add dword [ebp - 0x28], 0xe43fc761
mov dword [ebp - 0x24], 0x5ad37b8d
add dword [ebp - 0x24], 0xa52c8473
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xbdbf67fa
sub eax, 0xadbe3812
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x379b0
push 0
call eax
mov ecx, 0xb0fdc8b3
add ecx, 0x4f028378
xor esi, esi
add esi, eax
mov edx, 0x1b8c3123
add edx, 0xf47558dd
add edx, dword [ebp - 0x20]
mov ebx, 0x76aa1d0f
sub ebx, 0xcf08c432
sub dword [ebp - 0xc], 0x45cd4aa6
mov edi, dword [edx]
xor edi, ebx
add dword [ebp - 0xc], ebx
mov dword [esi], edi
xor dword [ebp - 0x14], ebx
add esi, 0xf86927cd
add esi, 0x796d837
add edx, 0x50cc084a
sub edx, 0x50cc0846
loop 0x1000e711
add eax, 0xd5076728
add eax, 0x2af9bc57
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x408a51
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x408a60
pop dword [ebp - 8]
mov eax, 0x408a60
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x86c95991
add dword [ebp - 0x18], 0xc788ebba
mov dword [ebp - 0x14], 0xb9586864
add dword [ebp - 0x14], 0x78dae3e1
mov dword [ebp - 0x10], 0x39feedb1
add dword [ebp - 0x10], 0x124d567d
mov dword [ebp - 0xc], 0x5fd26eb1
add dword [ebp - 0xc], 0xa02d914f
lea eax, [ebp - 0x18]
push eax
mov eax, 0xd0d4e0e6
add eax, 0x2f6bef6e
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xc066b866
add dword [ebp - 0x18], 0xb40bb0f0
mov dword [ebp - 0x14], 0x8cdfed82
add dword [ebp - 0x14], 0xb48c73f3
mov dword [ebp - 0x10], 0xa249b2d8
add dword [ebp - 0x10], 0xc125b994
mov dword [ebp - 0xc], 0x82acec30
sub dword [ebp - 0xc], 0x82acec30
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3ddcf
push 0
call eax
mov ecx, 0x5965
mov edx, eax
mov edi, 0x41b000
add edi, dword [ebp - 8]
mov esi, 0x715b5154
add esi, 0x369d621b
sub dword [ebp - 4], edi
mov ebx, dword [edi]
xor dword [ebp - 4], 0x59f6a5a8
xor ebx, esi
sub dword [ebp - 4], ebx
mov dword [edx], ebx
sub dword [ebp - 4], ebx
add edx, 4
add edi, 0x8fd697cf
add edi, 0x70296835
loop 0x408b6c
add eax, 0xb314e9b0
sub eax, 0xb3139149
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4418bf8d
add ecx, 0xbc274073
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x416d00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x416d22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x416d29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x416d18
mov eax, 1
add ebx, ebx
jne 0x416d3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x416d30
jne 0x416d4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416d30
xor ecx, ecx
sub eax, 3
jb 0x416d60
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x416dd2
mov ebp, eax
add ebx, ebx
jne 0x416d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x416d78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x416d9c
inc ecx
add ebx, ebx
jne 0x416d88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x416d7d
jne 0x416d99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416d7d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x416dbc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x416dad
jmp 0x416d1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x416dbc
add edi, ecx
jmp 0x416d1e
pop esi
mov edi, esi
mov ecx, 0x43
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x416dda
cmp byte [edi], 1
jne 0x416dda
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x416ddf
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x416e57
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x213cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x21408]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416e0c
mov ecx, edi
jns 0x416e3b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2140c]
or eax, eax
je 0x416e51
mov dword [ebx], eax
add ebx, 4
jmp 0x416e29
call dword [esi + 0x21414]
mov ebp, dword [esi + 0x21410]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x416e8b
sub esp, 0xffffff80
jmp 0x401594
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x401c66
pop dword [ebp - 0x28]
mov eax, 0x6c1b48f8
sub eax, 0x6bdb2c92
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x96655c76
sub dword [ebp - 0x38], 0x4813172b
mov dword [ebp - 0x34], 0xe6853d88
sub dword [ebp - 0x34], 0xb451f143
mov dword [ebp - 0x30], 0x6f2a64b5
sub dword [ebp - 0x30], 0x22de2087
mov dword [ebp - 0x2c], 0x2ffdab30
sub dword [ebp - 0x2c], 0x2ffdab30
lea eax, [ebp - 0x38]
push eax
mov eax, 0xe91d7c0
sub eax, 0xe51a76c
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xd5ed2a2b
sub dword [ebp - 0x38], 0x617ac0d5
mov dword [ebp - 0x34], 0xc21a35fe
add dword [ebp - 0x34], 0x7f522b77
mov dword [ebp - 0x30], 0xd0b4bc6f
sub dword [ebp - 0x30], 0x6d455003
mov dword [ebp - 0x2c], 0x35c4bb67
add dword [ebp - 0x2c], 0xca3b4499
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3a0fe
push 0
call eax
mov ecx, 0xe9d9f670
sub ecx, 0xe9d9a01d
xor ebx, ebx
add ebx, eax
mov edi, 0xb9e2c198
add edi, 0x465dae68
add edi, dword [ebp - 0x28]
mov edx, 0x2a226855
add dword [ebp - 0x1c], edx
mov esi, dword [edi]
add dword [ebp - 4], 0x211568a9
add esi, edx
xor dword [ebp - 0xc], 0x4a4f8b48
mov dword [ebx], esi
add dword [ebp - 0x24], 0xcdd83aba
add ebx, 4
add edi, 4
loop 0x401d7f
add eax, 0x2ba5760b
sub eax, 0x2ba429ec
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2d991ab5
add ecx, 0xd2a6e54b
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x407136
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x407151
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x10099c1
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1002910
call fcn.01009be4
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x10099fc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10099fc
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1009a14
cmp eax, 0x20b
je 0x1009a01
mov dword [ebp - 0x1c], edi
jmp 0x1009a28
cmp dword [ecx + 0x84], 0xe
jbe 0x10099fc
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1009a22
cmp dword [ecx + 0x74], 0xe
jbe 0x10099fc
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10226d0], 0xffffffff
or dword [0x10226d4], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1020f6c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1020f68]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10226d8], eax
call fcn.01009bdc
cmp dword [0x100ce00], edi
jne 0x1009a83
push fcn.01009bdc
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01009bc5
push 0x100b010
push 0x100b00c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1020f64]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1020f60]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x100b008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01004077
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x1009afa
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1009b2f
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01009c1f
ret

Function at 0x1000f4b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000f4c7
pop dword [ebp - 0x28]
mov eax, 0x1000f4c7
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3a8a4
push 0
mov eax, 0x81a80984
add eax, 0x8e58f6c0
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x2bead0e2
sub ecx, 0x2bea7af3
xor ebx, ebx
add ebx, eax
mov esi, 0x10019800
add esi, dword [ebp - 0x28]
mov edi, 0x33a48fff
sub dword [ebp - 0xc], 0xe41cd7f9
mov edx, dword [esi]
xor edx, edi
sub dword [ebp - 0x1c], ebx
mov dword [ebx], edx
xor dword [ebp - 4], ebx
add ebx, 0xcfc668a2
sub ebx, 0xcfc6689e
add esi, 0x725dc4c2
add esi, 0x8da23b42
loop 0x1000f517
add eax, 0xc8949956
add eax, 0x376cb139
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x116628a
sub ecx, 0xf116628a
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x402b70
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x454008], 0x8088405
inc edx
mov dword [ebx + 0x454008], edx
fld qword [ebx + 0x454068]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x402fd4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x454024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40306c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40304c
xor eax, eax
push ebp
push 0x403045
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403088
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40304c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x454024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x454024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403d30
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x456048], 0
je 0x403d91
cmp word [0x45621c], 0xd7b2
jne 0x403d59
cmp dword [0x456224], 0
jbe 0x403d59
mov eax, 0x456218
call dword [0x456234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x454078
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403db8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x454034], 0
jne 0x403dad
push 0
push 0x454070
push 0x454078
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405a34
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a9a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040411c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b98
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a84
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405aa1
lea eax, [ebp - 0x10]
call fcn.00403eac
ret

Function at 0x40aaa4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aadd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f9c
jmp 0x40aae6
mov eax, ebx
mov edx, esi
call fcn.00403f00
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aaf0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ab11
mov al, byte [esp]
jmp 0x40ab13
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b198
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b010
mov eax, dword [0x455080]
cmp byte [eax], 0
je 0x40b214
mov eax, dword [0x454ea0]
call fcn.004029dc
call fcn.00402834
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004082e0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b25c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b24a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x454e50]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x456664]
call fcn.00404f48
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret