joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428880
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f228
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xd4], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xd8], 0
call int.004280d0
mov byte [ebp - 0x47], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xd0], 0x67452301
mov dword [ebp - 0xcc], 0xefcdab89
mov dword [ebp - 0xc8], 0x98badcfe
mov dword [ebp - 0xc4], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x428913
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0xd0]
call fcn.004062c0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x428935
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407760
call fcn.00436160
test al, al
je 0x42894e
imul ebx, edi, 0x4c9733fc
wait
mul byte [edi - 0x3e7d1e53]
pushal
popal
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xd0]
call fcn.00406d70
mov edx, eax
mov dword [ebp - 4], 0
mov ecx, ebx
call fcn.00427e50
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x428982
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.00407760
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret

Function at 0x42a320
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f3d0
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xc0], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xb4]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x2b], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xb4], 0x67452301
mov dword [ebp - 0xb0], 0xefcdab89
mov dword [ebp - 0xac], 0x98badcfe
mov dword [ebp - 0xa8], 0x10325476
call fcn.004062c0
call fcn.00435ec0
test al, al
je 0x42a3e8
xchg esp, eax
or byte [ebx], bh
mov al, byte [0x98500172]
sbb al, 0xb0
mov ebx, 0x5b1402f5
inc esi
jne 0x42a3f7
mov ebx, dword [ebp - 0xb8]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb4]
call fcn.00406d70
mov edx, eax
mov byte [ebp - 4], 1
mov ecx, ebx
call fcn.00427e50
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x42a419
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407760
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp ecx, 0x10
jb 0x42a440
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00407760
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x42a460
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f408
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa8], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xa0]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x17], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0xa0], 0x67452301
mov dword [ebp - 0x9c], 0xefcdab89
mov dword [ebp - 0x98], 0x98badcfe
mov dword [ebp - 0x94], 0x10325476
call fcn.004062c0
call fcn.00436860
test al, al
je 0x42a525
cmp ebx, ecx
iretd
call fcn.004365c0
test al, al
je 0x42a543
iretd
call fcn.004367f0
test al, al
je 0x42a55e
movsb byte es:[edi], byte [esi]
pushal
add bh, byte [ebx]
adc al, 0x7c
jnp 0x42a566
cmp esi, edi
ftst
mov esi, 0xa908d39a
push ebx
lea ecx, [ebp - 0xa0]
call fcn.00406d70
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x42a57f
push es
enter 0xfffffffffffffffd, 0xffffffffffffff8b
dec ebp
sbb al, 0x83
stc
adc byte [edx + 0xd], dh
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00407760
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret

Function at 0x42a5a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbc
mov eax, dword [0x627a40]
xor eax, esp
mov dword [esp + 0xb8], eax
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
call int.004280d0
mov byte [esp + 0xb1], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], 0x98badcfe
mov dword [esp + 0x34], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x42a615
mov eax, dword [eax]
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.004062c0
mov eax, dword [esp + 0x24]
cmp eax, 0x10
jb 0x42a638
inc eax
lea ecx, [esp + 0x10]
push eax
push dword [esp + 0x14]
call fcn.00407760
push esi
lea ecx, [esp + 0x2c]
call fcn.00406d70
mov ecx, dword [esp + 0xbc]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x42a660
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f438
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xd0], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xd4], 0
call int.004280d0
mov byte [ebp - 0x43], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xcc], 0x67452301
mov dword [ebp - 0xc8], 0xefcdab89
stosd dword es:[edi], eax
int 0xef
mov dword [ebp - 0xc4], 0x98badcfe
mov dword [ebp - 0xc0], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x42a6f3
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0xcc]
call fcn.004062c0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x42a715
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407760
call fcn.00436160
test al, al
je 0x42a72e
int1
jecxz 0x42a6d1
lea eax, [edi + 0xc920dc8]
fidiv word [ebx + 0x49]
push ebx
invalid
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xcc]
call fcn.00406d70
mov edx, eax
mov dword [ebp - 4], 0
mov ecx, ebx
call fcn.00427e50
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x42a762
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.00407760
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x42bbb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x11c
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00576f50
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.00436860
test al, al
je 0x42bc26
push 0x7c1b0b11
scasd eax, dword es:[edi]
loopne 0x42bc25
xchg ebx, eax
mov eax, dword [0xc94fd2cb]
nop
aaa
scasd eax, dword es:[edi]
sbb eax, 0xa1d4b7c7
dec esi
fld qword [edi - 0x1709b9d0]
imul al
call fcn.00435f30
test al, al
je 0x42bc4d
add eax, 0x840000a3
sal byte [esi + ebx - 0x6a], 0x10
jne 0x42bbe0
xchg esi, eax
adc byte [ebp - 0x53], dh
retf
mov edi, dword [ebp - 0x124]
mov esi, dword [ebp - 0x120]
call fcn.00436390
test al, al
je 0x42bc81
mov edi, 0x6c52c315
cld
mov esi, 0x7d135806
mov cl, 0x6e
mov ah, 0xfc
invalid
cmp edi, 5
jg 0x42bca1
cmp esi, 2
jg 0x42bca1
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x42c370
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f67c
mov eax, dword fs:[0]
push eax
sub esp, 0x640
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x206
lea eax, [ebp - 0x216]
push 0
push eax
call fcn.00576f50
movups xmm0, xmmword [0x619710]
mov eax, dword [0x619720]
lea ecx, [ebp - 0x218]
add esp, 0xc
mov dword [ebp - 0x208], eax
movups xmmword [ebp - 0x218], xmm0
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x42c3d5
mov eax, dword [0x61c5c4]
mov dword [ecx], eax
mov ax, word [0x61c5c8]
mov word [ecx + 4], ax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x64c]
call fcn.00407e90
mov dword [ebp - 4], 0
call fcn.00435ec0
test al, al
je 0x42c425
ror byte [edi + 0x52], 0xcd
push ecx
lahf
cwde
dec ebx
mov ah, byte [edi]
or esp, dword [ebx]
jne 0x42c43f
pop es
xchg esi, eax
fiadd word [ebx - 0x64743]
inc dword [eax]
cmp dword [ebp - 0x648], 0
jne 0x42c4c8
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00576f50
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00576f50
add esp, 0x18
lea eax, [ebp - 0x628]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x61c5d4
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push str.__s___s
push eax
call fcn.00408f60
add esp, 0x10
lea eax, [ebp - 0x644]
push 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42c4f9
push 0x61c5dc
push 0
call fcn.004223f0
add esp, 8
xor esi, esi
lea ecx, [ebp - 0x64c]
mov dword [ebp - 4], 4
call fcn.00407fd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
push 0x61c600
lea ecx, [ebp - 0x640]
call fcn.004039f0
push 2
push 0x61c5f8
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 3
call fcn.0040be00
lea edx, [ebp - 0x420]
lea ecx, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x42c530
sub edx, ecx
lea ecx, [ebp - 0x640]
sar edx, 1
cmp dword [ebp - 0x62c], 8
cmovae ecx, dword [ebp - 0x640]
lea eax, [edx*2 + 2]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
push ecx
push dword [ebp - 0x644]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x644]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x61c614
push 0
call fcn.004223f0
mov eax, dword [ebp - 0x62c]
add esp, 8
mov esi, 1
cmp eax, 8
jb 0x42c5b1
inc eax
lea ecx, [ebp - 0x640]
push eax
push dword [ebp - 0x640]
call fcn.00404090
xor eax, eax
mov dword [ebp - 0x62c], 7
mov dword [ebp - 0x630], 0
mov word [ebp - 0x640], ax
jmp 0x42c4ca
Function at 0x574650
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
sub esp, 8
test eax, eax
je 0x57468e
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 4
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x57468e
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x590aa4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00590923

Function at 0x5952b4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00594f74

Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748
Function at 0x4028ec
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x402945
mov dword [ebx + 0xe4], eax
mov dword [ebx + 0xec], 0
mov dword [ebx + 0xe8], 0
call fcn.00402c99
jb 0x402945
mov dword [ebx + 0xe8], eax
mov dword [eax + 0x4c], 8
call 0x402939
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x402953
push ebx
jb 0x4029a0
add byte [esi - 4], bl
mov ecx, 0xe
lea edi, [eax + 0x2c]
rep movsb byte es:[edi], byte [esi]
ret
call dword [sym.imp.KERNEL32.DLL_TlsFree]
ret
mov edi, 0x8d02e6c1
dec esp
xor eax, 0x15ff5100
sub al, 0x72
inc eax
add bl, ch
scasd eax, dword es:[edi]
add byte [edx], cl
add byte [esi], cl
add byte [eax + eax - 0x1f], ah
call [edi - 0x75]
pop edi
mov esp, ebp
pop ebp

Function at 0x402a4f
Capabilities:
Get system information on windows

Disassembly:
mov word [ebx + 0xf8], 0
mov ah, byte [ebx + 0x298]
mov al, byte [ebx + 0x29c]
mov word [ebx + 0xfa], ax
mov eax, dword [ebx + 0x2a4]
test al, 1
jne 0x402a7f
test al, 2
je 0x402aa7
mov ax, 0x400
jmp 0x402aa0
mov dx, word [ebx + 0x2a0]
cmp dx, 0x3b6
mov ax, pe_nt_image_headers32
je 0x402aa0
cmp dx, 0x457
mov ax, 0x100
je 0x402aa0
mov ax, 0x200
or word [ebx + 0xf8], ax
sub esp, 0x24
push esp
cld
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov byte [ebx + 0xfc], 3
test word [ebx + 0xf8], 0x380
jne 0x402ae6
test word [ebx + 0xf8], 0x400
je 0x402b1f
cmp word [esp], 0
jne 0x402b1f
mov al, byte [esp + 0x20]
cmp al, 3
jb 0x402b1f
cmp al, 5
jbe 0x402afc
mov al, 5
jmp 0x402afc
mov eax, dword [esp + 0x18]
cmp eax, 0x182
jbe 0x402b1f
cmp eax, 0x24a
mov al, 5
jae 0x402afc
mov al, 4
mov byte [ebx + 0xfc], al
cmp al, 5
jb 0x402b1f
mov eax, 1
push ebx
cpuid
pop ebx
test edx, 0x800000
je 0x402b1f
or word [ebx + 0xf8], 0x40
add esp, 0x24
push esp
push esp
push 0x20019
push 0
call 0x402b63
dec eax
inc ecx
push edx
inc esp
push edi
inc ecx
push edx
inc ebp
pop esp
inc esp
inc ebp
push ebx
inc ebx
push edx
dec ecx
push eax
push esp
dec ecx
dec edi
dec esi
pop esp
push ebx
jns 0x402bbb
je 0x402baf
insd dword es:[edi], dx
pop esp
inc esi
insb byte es:[edi], dx
outsd dx, dword [esi]
popal
je 0x402bbb
outsb dx, byte [esi]
push eax
outsd dx, dword [esi]
imul ebp, dword [esi + 0x74], 0x636f7250
jae 0x402bd3
outsd dx, dword [esi]
jb 0x402b63
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
pop edx
jne 0x402b85
mov ax, 2
or word [0x4060f8], ax
push edx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
ret
add byte [ebx], dh
sar byte [ecx + 0xcc], 0x8d
jnp 0x402bca
stosb byte es:[edi], al
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
or al, al
jne 0x402bcb
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402b74
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x43b008], 0x8088405
inc edx
mov dword [ebx + 0x43b008], edx
fld qword [ebx + 0x43b05c]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x403008
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x43b01c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4030a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403080
xor eax, eax
push ebp
push 0x403079
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4030bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403080
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x43b01c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x43b01c], ax
mov esp, ebp
pop ebp
ret

Function at 0x403988
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x447044], 0
je 0x4039e9
cmp word [0x447218], 0xd7b2
jne 0x4039b1
cmp dword [0x447220], 0
jbe 0x4039b1
mov eax, 0x447214
call dword [0x447230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x43b06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403a10
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x43b028], 0
jne 0x403a05
push 0
push 0x43b064
push 0x43b06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406a10
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406acf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0040c338
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push edi
call sub.advapi32.dll_RegQueryInfoKeyA_1
test eax, eax
jne 0x406ab9
cmp dword [ebp - 8], 0
jbe 0x406ab7
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00402888
mov ebx, eax
xor esi, esi
jmp 0x406a95
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403ce8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040c328
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push edi
call sub.advapi32.dll_RegEnumKeyExA_1
cmp eax, 0x103
jne 0x406a78
mov eax, ebx
call fcn.004028b8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ad6
lea eax, [ebp - 0x10]
call fcn.00403b0c
ret

Function at 0x406af0
Capabilities:
Create thread

Disassembly:
push ebx
mov byte [0x447045], 1
mov edx, dword [0x405808]
xor eax, eax
call fcn.0040a260
mov ebx, eax
mov byte [ebx + 0x18], 1
lea eax, [ebx + 0x1e]
push eax
push 4
push ebx
push 0x406ae0
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebx + 0x1a], eax
mov eax, ebx
pop ebx
ret

Function at 0x406c08
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jbe 0x406c23
mov byte [ebx + 0x18], 1
pop ebx
ret
cmp word [ebx + 0x2c], 0
je 0x406c32
mov edx, ebx
mov eax, dword [ebx + 0x2e]
call dword [ebx + 0x2a]
pop ebx
ret

Function at 0x406c34
Capabilities:
Suspend thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 1
cmp word [ebx + 0x24], 0
je 0x406c4f
push dword [ebx + 0x26]
push dword [ebx + 0x22]
mov eax, ebx
call fcn.00406c5c
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_SuspendThread
pop ebx
ret

Function at 0x406c90
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [ebx + 0x19], 1
pop ebx
ret