joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55d470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll__errno]
test eax, 0xffff7fff
jne 0x55d554
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x55d4ed
call ebx
cmp eax, 3
jne 0x55d4d3
push ebp
call fcn.0055d7a0
mov esi, eax
add esp, 4
test esi, esi
jne 0x55d4c7
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x55d4ed
call ebx
push eax
call fcn.0055d3b0
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x55d548
push 0
push 0x2000001
push 3
push 0
push 0
push 0
test esi, esi
je 0x55d50d
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x55d514
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
cmp edi, 0xffffffff
jne 0x55d537
call ebx
push eax
call fcn.0055d3b0
add esp, 4
or eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push edi
call dword [sym.imp.MSVCRT.dll__open_osfhandle]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
test esi, esi
jne 0x55d5eb
mov eax, dword [esp + 0x18]
push dword [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x55d679
call edi
cmp dword [eax], 0xd
jne 0x55d5c1
test dword [esp + 0x18], 0x100
je 0x55d5c1
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x55d59d
call ebx
push eax
call fcn.0055d3b0
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x55d5b1
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0x15
or eax, 0xffffffff
pop ebx
ret
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0xd
or eax, 0xffffffff
pop ebx
ret
call edi
cmp dword [eax], 2
jne 0x55d679
push ebp
call fcn.0055d7a0
mov esi, eax
add esp, 4
test esi, esi
jne 0x55d5eb
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push dword [esp + 0x1c]
mov ebp, dword [esp + 0x1c]
push ebp
push esi
call dword [sym.imp.MSVCRT.dll__wopen]
add esp, 0xc
mov dword [esp + 0x18], eax
test eax, eax
jns 0x55d666
call edi
cmp dword [eax], 0xd
jne 0x55d666
test ebp, 0x100
je 0x55d666
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x55d63f
call ebx
push eax
call fcn.0055d3b0
add esp, 4
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x55d65e
call edi
push esi
mov dword [eax], 0x15
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
call edi
mov dword [eax], 0xd
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x55d680
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x55d698
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
cmp dword [esp + 0xc], 0
jne 0x55d6a2
xor eax, eax
ret
push eax
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
add esp, 4
lea ecx, [esp + 4]
push 0
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x55d70a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x55d6e3
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0xb
or eax, 0xffffffff
ret
cmp eax, 0x6d
je 0x55d69f
cmp eax, 5
jne 0x55d6fd
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.0055d3b0
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x55d9d0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x55d9e8
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x55da34
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x55da27
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.0055d3b0
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x55dd20
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x55dd5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x55dd87
push 8
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
je 0x55dd87
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, esi
je 0x55dd87
xor eax, eax
pop esi
pop ecx
ret
mov eax, 0xffffffe7
pop esi
pop ecx
ret
Function at 0x586320
Capabilities:
Encode data using xor

Disassembly:
push edi
call fcn.00586360
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
not eax
test edi, edi
je 0x586359
push esi
mov esi, dword [esp + 0xc]
lea esp, [esp]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x6c814c]
dec edi
jne 0x586340
pop esi
not eax
pop edi
ret
Function at 0x587a80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x6c7660], 0
push ebx
push esi
push edi
jne 0x587b9e
mov byte [0x6c7660], 1
xor esi, esi
lea esp, [esp]
mov ecx, esi
xor eax, eax
and ecx, 1
mov edx, esi
or ecx, eax
je 0x587ac0
shrd edx, eax, 1
shr eax, 1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
jmp 0x587ac6
shrd edx, eax, 1
shr eax, 1
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x587ae1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x587afc
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x587b17
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x587b32
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x587b4d
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x587b68
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x587b83
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov dword [esi*8 + 0x6c7668], edx
mov dword [esi*8 + 0x6c766c], eax
inc esi
cmp esi, 0x100
jb 0x587aa0
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
not ebx
mov edi, dword [esp + 0x14]
not edx
test edi, edi
je 0x587bd9
mov esi, dword [esp + 0x10]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
shrd ebx, edx, 8
xor ecx, eax
shr edx, 8
xor ebx, dword [ecx*8 + 0x6c7668]
xor edx, dword [ecx*8 + 0x6c766c]
dec edi
jne 0x587bb6
pop edi
not ebx
not edx
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x588b00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ecx, 8
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov edx, dword [edi + 0xaa4]
lea ebp, [edi + 0xaac]
mov eax, dword [edi + 0xaa8]
sub ecx, edx
and eax, dword [esp + 0x18]
shr esi, cl
mov ecx, edx
shl eax, cl
add esi, eax
imul eax, esi, 0x600
add ebp, eax
cmp byte [esp + 0x20], bl
jne 0x588b55
push dword [esp + 0x28]
push 8
push ebp
call fcn.0058a130
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [esp + 0x28]
mov esi, 0x100
mov edi, dword [esp + 0x24]
add edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
shr eax, 8
add ecx, esi
add eax, ecx
movzx ecx, word [ebp + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor ecx, eax
movzx eax, byte [ecx + 0x5f15d0]
mov ecx, edi
xor ecx, edx
add ebx, eax
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x588b64
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x58a130
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 0xc]
push esi
push edi
xor edi, edi
add ecx, eax
mov eax, dword [esp + 0xc]
lea esp, [esp]
mov esi, ecx
shr ecx, 1
and esi, 1
neg esi
shr esi, 4
movzx edx, word [eax + ecx*2]
and esi, 0x7f
shr edx, 4
xor edx, esi
movzx edx, byte [edx + 0x5f15d0]
add edi, edx
cmp ecx, 1
jne 0x58a150
mov eax, edi
pop edi
pop esi
ret
Function at 0x59c4e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x59c500
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x59c500
mov eax, dword [eax + 0x44]
test eax, eax
je 0x59c500
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x5ad340
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x5ad36f
push esi
call fcn.005ad520
add esp, 4
cmp byte [esi + 0x40], 0
je 0x5ad368
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x5ad3f2
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x5ad3dd
mov eax, dword [esi + 8]
test eax, eax
je 0x5ad395
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x5ad3d8
cmp eax, 2
je 0x5ad3dd
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5ad386
cmp eax, 3
je 0x5ad3bd
cmp eax, 1
jne 0x5ad386
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x5ad386
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x5ad386
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.005ad420
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x5ad414
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.005ad420
add esp, 4
pop edi
pop esi
ret

Function at 0x5ad420
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x5ad44c
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x5ad4d2
lea ebx, [esi + 0x78]
jmp 0x5ad460
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x5ad4a6
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5ad485
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x5ad4e8
cmp eax, dword [esi + 0x60]
jb 0x5ad467
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x5ad460
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x5ae660
Capabilities:
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov dword [edi + 4], 0
call fcn.005ba880
push 0x54
push edi
mov dword [esp + 0x14], eax
call fcn.005ba850
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x5ae6a7
push edi
call fcn.005ba890
mov ecx, dword [edi]
push edi
mov dword [ecx + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], esi
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 8
mov dword [esi], fcn.005ae2f0
mov dword [esi + 4], fcn.005ae180
mov dword [esi + 8], fcn.005ae250
mov dword [esi + 0xc], fcn.005ae0d0
mov dword [esi + 0x10], 0x5ae9c0
mov dword [esi + 0x14], 0x5ae950
mov dword [esi + 0x18], 0x5ae7b0
mov dword [esi + 0x1c], 0x5adf80
mov dword [esi + 0x20], 0x5ade30
mov dword [esi + 0x24], 0x5ae560
mov dword [esi + 0x28], 0x5aea30
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x5ae78a
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], 0x78
push ecx
lea ecx, [esp + 0xc]
push ecx
push str._ld_c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x5ae78a
mov al, byte [esp + 0x10]
cmp al, 0x6d
je 0x5ae779
cmp al, 0x4d
mov eax, dword [esp + 8]
jne 0x5ae781
imul eax, dword [esp + 8], 0x3e8
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ecx
ret
Function at 0x5b1f50
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
cmp dword [ebp + 0x4c], 1
mov ebx, dword [ebp + 0x1c0]
mov dword [esp + 0x1c], ebx
jne 0x5b1f75
mov esi, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x5b1f7b
xor esi, esi
mov byte [ebx + 0x1c], 0
push dword [ebp + 0x64]
mov ecx, dword [ebp + 4]
lea eax, [esi + 0x100]
push eax
push 1
push ebp
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], esi
call eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0x64], ecx
jle 0x5b2090
push edi
lea ecx, [ecx]
mov edi, dword [ebx + ecx*4 + 0x20]
cdq
idiv edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
test esi, esi
je 0x5b1fcd
mov eax, dword [ebx + 0x18]
add dword [eax + ecx*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi*2 - 2]
cdq
idiv ecx
xor esi, esi
mov edx, eax
lea esp, [esp]
cmp esi, edx
jle 0x5b2026
mov ecx, dword [esp + 0x10]
lea edi, [edi*2 - 2]
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
lea ecx, [ecx]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x5b2010
mov edi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0xff
jle 0x5b1ff0
mov esi, dword [esp + 0x14]
test esi, esi
je 0x5b2071
mov ecx, 1
lea edx, [ebp - 1]
jmp 0x5b2050
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x5b2050
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [eax + 0x64]
mov eax, dword [esp + 0x1c]
jl 0x5b1fb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401bd7
pop dword [ebp - 0x2c]
mov eax, 0xdcee79db
add eax, 0x2351a1fc
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x539c50d2
add dword [ebp - 0x3c], 0xfab5f479
mov dword [ebp - 0x38], 0x6fe34943
sub dword [ebp - 0x38], 0x3daffcfe
mov dword [ebp - 0x34], 0x8886059d
sub dword [ebp - 0x34], 0x3c39c16f
mov dword [ebp - 0x30], 0x8fc2de3f
sub dword [ebp - 0x30], 0x8fc2de3f
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x11df6aac
sub eax, 0x119efa4c
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xca5a2c66
add dword [ebp - 0x3c], 0xaa183cf0
mov dword [ebp - 0x38], 0x1ebdf1e
sub dword [ebp - 0x38], 0xc07f7da9
mov dword [ebp - 0x34], 0x71d57bce
sub dword [ebp - 0x34], 0xe660f62
mov dword [ebp - 0x30], 0x12859902
add dword [ebp - 0x30], 0xed7a66fe
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3acc3
push 0
call eax
mov ecx, 0x58e4
mov ebx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x2c]
mov edx, 0x3a158c87
sub edx, 0x5605ebda
sub dword [ebp - 0x28], ebx
mov edi, dword [esi]
xor dword [ebp - 0x1c], 0xdf794a09
xor edi, edx
sub dword [ebp - 0x18], 0xbd737fbe
mov dword [ebx], edi
sub dword [ebp - 0x10], esi
add ebx, 0x5011526a
sub ebx, 0x50115266
add esi, 0xc3811791
add esi, 0x3c7ee873
loop 0x401ce8
add eax, 0x15663
mov ebx, eax
add eax, 5
mov ecx, 0xcf69e95c
add ecx, 0x30d616a4
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x402fc4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x45c008], 0x8088405
inc edx
mov dword [ebx + 0x45c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4036ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45c024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403744
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403724
xor eax, eax
push ebp
push 0x40371d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403760
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403724
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x45c024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45c024], ax
mov esp, ebp
pop ebp
ret

Function at 0x40455c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x5c504c], 0
je 0x4045bd
cmp word [0x5c5220], 0xd7b2
jne 0x404585
cmp dword [0x5c5228], 0
jbe 0x404585
mov eax, 0x5c521c
call dword [0x5c5238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4045e4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45c030], 0
jne 0x4045d9
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x408320
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4083b0
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4083b0
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408363
test edx, 3
jne 0x408352
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x40835d
jmp 0x408363
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408363
cmp dword [ecx - 8], 1
je 0x40836d
mov edx, ebx
or edx, 3
call fcn.00404e28
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40837f
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004046dc

Function at 0x4083bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x40844c
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x40844c
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x4083ff
test edx, 3
jne 0x4083ee
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x4083f9
jmp 0x4083ff
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x4083ff
cmp dword [ecx - 8], 1
je 0x408409
mov edx, ebx
or edx, 3
call fcn.00404e28
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40841b
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004046dc

Function at 0x40b688
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b6c1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004047cc
jmp 0x40b6ca
mov eax, ebx
mov edx, esi
call fcn.00404730
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b6d4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b6f6
movzx eax, byte [esp]
jmp 0x40b6f8
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret