joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005f000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087058
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
call fcn.10021470
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x1005f04a
push 0x80004005
call fcn.10021340
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._exec___s___s
push eax
call fcn.1003f740
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push esi
push str.Elevation:__s
push eax
call fcn.1003a800
add esp, 0x1c
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x14]
call fcn.100394f0
mov byte [ebp - 4], 3
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1005f0b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [0x100af300]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov ecx, ebx
or ecx, 1
push ecx
push dword [0x100af300]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 1
push dword [ebp + 0x10]
push esi
push dword [0x100b2cfc]
push 0x10095a3c
push 0
call dword [0x100b10e4]
push ebx
push dword [0x100af300]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
add esi, 0xfffffff0
mov byte [ebp - 4], 2
or ebx, 0xffffffff
mov edx, ebx
lea ecx, [esi + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1005f11a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov ecx, ebx
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005f13a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov ecx, ebx
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005f15a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x1005f17b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10060c40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082e68
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea eax, [ebp - 0x10]
push str._FatalDllLoad:__s
push eax
call fcn.1003a800
add esp, 0xc
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
call fcn.100394f0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10060caa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100626a0
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087510
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.10021470
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100626e4
push 0x80004005
call fcn.10021340
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push dword [0x100b2ce4]
mov dword [ebp - 0x10], 0
push str.SoftwareVOS_s
push eax
call fcn.1003f740
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
add esp, 0xc
push eax
push esi
call fcn.1002b060
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100627b2
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 4
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 4
push eax
push 0
push 0x100a1860
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100627a9
mov ecx, dword [ebp - 0x18]
mov dword [0x100b1920], ecx
test ecx, 0x100
je 0x100627a0
push ecx
mov ecx, esp
push 0x100b10f8
call fcn.10022bb0
call fcn.100275e0
mov ecx, dword [0x100b1920]
xor edx, edx
add esp, 4
test eax, eax
cmove ecx, edx
mov dword [0x100b1920], ecx
test ecx, 0x200
je 0x100627a9
int3
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10022bb0
push 6
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1c]
call fcn.100292c0
mov ecx, str._debug
mov eax, dword [eax]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10062806
test dx, dx
je 0x10062802
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10062806
add eax, 4
add ecx, 4
test dx, dx
jne 0x100627e0
xor eax, eax
jmp 0x1006280b
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 0x24]
test eax, eax
sete bl
add edx, 0xfffffff0
or edi, 0xffffffff
mov eax, edi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1006282f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x100b1920]
mov ecx, 3
test bl, bl
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
cmovne eax, ecx
add edx, 0xfffffff0
mov dword [0x100b1920], eax
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10062863
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x10062881
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100637d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push edi
push esi
push str.ExecInjected_Im_RunDll32:__hs_
push eax
call fcn.1003a800
mov edx, dword [ebp - 4]
add esp, 0xc
call fcn.100394f0
mov edx, dword [ebp - 4]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10063815
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
lea ecx, [ebp + 0x10]
call fcn.10043540
push 0x1009ca58
push 0x1009ca58
lea ecx, [ebp + 0x10]
call fcn.1003f240
mov ecx, eax
call fcn.1003ecb0
mov esi, dword [ebp + 0x10]
add esi, 0xfffffff0
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, esi
je 0x10063885
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x10063879
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x10063879
call fcn.100236e0
mov dword [ebp - 4], eax
lock xadd dword [ebx], edi
dec edi
test edi, edi
jg 0x10063871
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 4]
add eax, 0x10
mov dword [ebp + 0x10], eax
jmp 0x10063885
push dword [edx - 0xc]
lea ecx, [ebp + 0x10]
push edx
call fcn.10023530
push ecx
mov ecx, esp
push str.CAMEYO_EXECINJECTED_ARGS
call fcn.10022bb0
mov edx, 0x104
lea ecx, [ebp - 8]
call fcn.1003dc20
add esp, 4
push 0
push ecx
mov ecx, esp
push str.open
call fcn.10022bb0
push ecx
mov ecx, dword [ebp - 8]
mov esi, esp
add ecx, 0xfffffff0
call fcn.100236e0
add eax, 0x10
push ecx
mov dword [esi], eax
mov esi, esp
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.100236e0
xor edx, edx
add eax, 0x10
mov dword [esi], eax
lea ecx, [edx + 1]
call fcn.10039fc0
xor ecx, ecx
add esp, 0x10
test eax, eax
setne cl
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10069d10
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087e40
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
lea ecx, [ebp - 0x14]
mov edx, edi
call fcn.1003e450
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push str.CopyFileToRepository:_copying__s_into_repository:_result_s
push eax
call fcn.1003a800
add esp, 0x10
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x10]
call fcn.100394f0
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, esi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10069da1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov ecx, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10069dc1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov ecx, esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10069de1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x10069e02
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49aa1766
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea eax, [eax + 0xc]
mov edx, eax
cmp edx, eax
je 0x49aa17c0
push eax
push 0x49aa02ca
call fcn.49aa17fe
push 7
push 0x49bb00bc
push dword [eax + 0x30]
call fcn.49aa1b57
cmp eax, 0
jne 0x49aa179a
inc eax
jmp 0x49aa17c2
push 0x49aa02e2
call fcn.49aa17fe
push 7
push 0x49bb00bc
push dword [eax + 0x30]
call fcn.49aa1b57
cmp eax, 0
jne 0x49aa17bb
inc eax
jmp 0x49aa17c2
pop eax
mov eax, dword [eax]
jmp 0x49aa1774
xor eax, eax
ret

Function at 0x49aa17d8
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 0x68]
and al, 0x70
cmp al, 0x70
sete al
movzx eax, al
ret

Function at 0x49aa17ec
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
setne al
movzx eax, al
ret

Function at 0x49aa17fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x49bb00bc]
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
xor ax, 0xdc
stosw word es:[edi], ax
cmp ax, 0
jne 0x49aa180c
pop edi
pop esi
leave
ret 4

Function at 0x49aa1820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x49bb00bc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, 0xdc
stosb byte es:[edi], al
cmp al, 0
jne 0x49aa182e
pop edi
pop esi
leave
ret 4

Function at 0x49aa1a62
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov edi, dword [edx + ebx]
test edi, edi
je 0x49aa1ab3
add edi, ebx
xchg esi, eax
push ecx
xor eax, eax
lea ecx, [eax - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg esi, eax
mov esi, dword [ebp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
pop ecx
jne 0x49aa1ab3
sub ecx, dword [eax + 0x18]
neg ecx
mov edx, dword [eax + 0x24]
add edx, ebx
movzx edx, word [edx + ecx*2]
mov eax, dword [eax + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x49aa1aba
add edx, 4
loop 0x49aa1a7a
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x49aa1ac1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea ebp, [eax + 0xc]
mov eax, dword [ebp]
mov esi, dword [eax + 0x30]
movzx ecx, word [eax + 0x2e]
mov edi, dword [esp + 0x10]
mov dx, word [esi]
cmp dx, word [edi]
je 0x49aa1b0d
cmp dx, 0x41
jb 0x49aa1af2
cmp dx, 0x5a
jbe 0x49aa1af8
cmp dx, 0x61
jb 0x49aa1b04
cmp dx, 0x7a
ja 0x49aa1b04
xor dx, 0x20
jmp 0x49aa1b06
jmp 0x49aa1b20
cmp dx, word [edi]
je 0x49aa1b0d
jmp 0x49aa1b20
add edi, 2
add esi, 2
sub ecx, 2
cmp ecx, 0
jne 0x49aa1ade
mov eax, dword [eax + 0x18]
jmp 0x49aa1b28
mov eax, dword [eax]
cmp ebp, eax
jne 0x49aa1ad3
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x412678
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x412687
pop dword [ebp - 0x4c]
mov eax, 0x8eecb0fc
sub eax, 0x8eab8a75
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x373c2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4973
xor esi, esi
add esi, eax
mov edi, 0x446800
add edi, dword [ebp - 0x4c]
mov ebx, 0x30465bc6
add ebx, 0x20d3c6a6
add dword [ebp - 0xc], 0x7e8fdd8
mov edx, dword [edi]
xor edx, ebx
mov dword [esi], edx
xor dword [ebp - 0x44], 0x238c2402
add esi, 4
add edi, 0x81cc6626
sub edi, 0x81cc6622
loop 0x4126d7
add eax, 0x44acd890
sub eax, 0x44abbff1
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x194a7abb
add ecx, 0xe6f58545
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x404de5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x404e07
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x404df8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x404f35
mov eax, dword [0x408a48]
cmp eax, 1
je 0x404f0f
test eax, eax
jne 0x404e38
cmp dword [0x4085d4], 1
je 0x404f0f
cmp edx, 0xfc
je 0x404f35
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404e6f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004032f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004033f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404eb2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004033f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.00405720
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004032f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403300
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.00403300
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403300
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405697
add esp, 0x2c
pop edi
jmp 0x404f35
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.004033f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x100
push 0
push 0x40e3d8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e3dc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40e3d8], eax
call section..text
call fcn.0040ab10
call fcn.0040a9bc
call fcn.00408ee3
call fcn.00408a13
call fcn.004083c0
call fcn.00408049
call fcn.00407e90
call fcn.00407e72
call fcn.00407de9
call fcn.00407551
call fcn.00406580
call fcn.00405791
call fcn.00405529
call fcn.00404bf5
call fcn.0040486d
push dword [0x40e4d0]
call fcn.00405548
push 7
push 0x40d278
lea eax, [0x40e4d0]
push eax
push 8
call fcn.00405497
push 0x40e4c8
push 0x40d280
push 7
push 0x401
push 8
call fcn.0040a8bd
mov edx, str.Continue_
lea ecx, [0x40e3f0]
call fcn.00404068
mov edx, str.Error_
lea ecx, [0x40e4b4]
call fcn.00404068
mov edx, str.Can_not_create_some_of_your_include_files.
lea ecx, [0x40e41c]
call fcn.00404068
mov edx, str.Can_not_allocate_the_memory.
lea ecx, [0x40e460]
call fcn.00404068
mov edx, str.Wrong_password.
lea ecx, [0x40e488]
call fcn.00404068
mov edx, 0x40d025
lea ecx, [0x40e464]
call fcn.00404068
mov edx, str.The_file
lea ecx, [0x40e3f4]
call fcn.00404068
mov edx, str._already_exists_in_the_current_directory._Overwrite_
lea ecx, [0x40e408]
call fcn.00404068
mov edx, str.An_unknown_error_occured._The_program_will_be_terminated.
lea ecx, [0x40e45c]
call fcn.00404068
mov edx, str.This_program_is_not_supported_on_your_operating_system.
lea ecx, [0x40e49c]
call fcn.00404068
mov edx, str.Choose_a_location_to_save_the_files.
lea ecx, [0x40e484]
call fcn.00404068
mov edx, str.Password
lea ecx, [0x40e4a0]
call fcn.00404068
mov edx, str.Please_enter_the_password.
lea ecx, [0x40e434]
call fcn.00404068
call fcn.0040633f
mov ebx, eax
cmp ebx, 0x32
jge 0x4011ca
push 0x10
push dword [0x40e49c]
push dword [0x40e4b4]
call fcn.004048a4
jmp 0x401fd0
lea eax, [0x403274]
push eax
jmp loc.00410000
push 0
call 0x401fef
call fcn.0040ab60
push dword [0x40e3d8]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00405480
call fcn.00405801
call fcn.00406569
call fcn.004075df
call fcn.00407ddd
call fcn.004082ea
call fcn.004083b0
call fcn.00408dde
call fcn.00407eb0
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0xb455fc
call fcn.0040121c
mov edi, 0x94
mov eax, edi
call fcn.004011dc
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0xb455fc], ecx
mov eax, dword [esi + 4]
mov dword [0xb45600], eax
mov edx, dword [esi + 8]
mov dword [0xb45604], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0xb45608], esi
cmp ecx, 2
je 0x401060
or esi, 0x8000
mov dword [0xb4560c], esi
shl eax, 8
add eax, edx
mov dword [0xb455fc], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40109b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40109b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4010b3
cmp eax, 0x20b
je 0x4010a0
mov dword [ebp - 0x1c], esi
jmp 0x4010c7
cmp dword [ecx + 0x84], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4010c1
cmp dword [ecx + 0x74], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00401224
pop ecx
test eax, eax
jne 0x4010f3
cmp dword [0xb455fc], 1
jne 0x4010e0
call fcn.00401224
push 0x1c
call fcn.00401224
push 0xff
call fcn.00401224
pop ecx
pop ecx
call fcn.00401224
mov dword [ebp - 4], esi
call fcn.00401224
test eax, eax
jge 0x40110c
push 0x1b
call fcn.00401224
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0xb455fc], eax
call fcn.00401224
mov dword [0xb45600], eax
call fcn.00401224
test eax, eax
jge 0x401132
push 8
call fcn.00401224
pop ecx
call fcn.00401224
test eax, eax
jge 0x401143
push 9
call fcn.00401224
pop ecx
push 1
call fcn.00401224
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x401159
push eax
call fcn.00401224
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401224
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40117a
movzx eax, word [ebp - 0x40]
jmp 0x40117d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401228
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40119b
push edi
call fcn.00401220
call fcn.00401224
jmp 0x4011cd
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00401224
ret

Function at 0x401228
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x35c000
push section..rdata
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401252
push 0x7ea3a0
jmp 0x40125e
pop ebx
pop edi
pop esi
leave
ret 0x14
ret
Function at 0x4028fc
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402939
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402959
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004045f0
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402f2c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x470008], 0x8088405
inc edx
mov dword [ebx + 0x470008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40348c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x470010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403524
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403504
xor eax, eax
push ebp
push 0x4034fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403540
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403504
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x470010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x470010], ax
mov esp, ebp
pop ebp
ret

Function at 0x40420c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x472048], 0
je 0x40426d
cmp word [0x47221c], 0xd7b2
jne 0x404235
cmp dword [0x472224], 0
jbe 0x404235
mov eax, 0x472218
call dword [0x472234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x470058
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404294
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x470020], 0
jne 0x404289
push 0
push 0x470078
push 0x470058
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret