joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d2d
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
xor esi, esi
push esi
call fcn.01001905
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
push esi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp eax, esi
je 0x1001e64
cmp dword [ebp - 4], esi
je 0x1001e64
mov ecx, dword [ebp + 8]
push ebx
push edi
cmp ecx, esi
jne 0x1001d7b
xor ecx, ecx
jmp 0x1001d8f
lea edi, [ecx + 2]
mov dx, word [ecx]
inc ecx
inc ecx
cmp dx, si
jne 0x1001d7e
sub ecx, edi
sar ecx, 1
add ecx, 2
lea edi, [ecx + eax + 1]
lea eax, [edi + edi]
push eax
call fcn.01001b24
mov ebx, eax
cmp ebx, esi
je 0x1001e59
push dword [ebp - 4]
cmp dword [ebp + 8], esi
je 0x1001dc7
push 0x1001320
push dword [ebp + 8]
push 0x1001310
push edi
push ebx
call fcn.01001bd9
add esp, 0x18
jmp 0x1001dce
push edi
push ebx
call fcn.01001b6a
test eax, eax
jge 0x1001dd7
xor eax, eax
mov word [ebx], ax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
cmp dword [0x100b634], esi
je 0x1001dfb
lea ecx, [ebp - 0x18]
push ecx
push eax
push ebx
push dword [0x100b644]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1001e53
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
inc eax
push eax
push ebx
push esi
push 1
mov dword [ebp - 0x14], eax
call edi
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x1001e53
push eax
call fcn.01001b24
mov dword [ebp - 8], eax
cmp eax, esi
je 0x1001e53
push esi
push esi
push dword [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
push esi
push 1
call edi
cmp eax, esi
je 0x1001e4b
push esi
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 8]
push dword [0x100b644]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 8]
call fcn.01001b44
push ebx
call fcn.01001b44
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop ebx
pop esi
leave
ret
Function at 0x100288d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x80000000
xor esi, esi
push esi
push 0x1001418
push 0x80000001
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, esi
jne 0x100292a
push edi
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, 0x10013f8
push edi
push dword [ebp - 4]
call esi
mov ebx, eax
test ebx, ebx
jne 0x1002929
cmp dword [ebp - 0x10], 3
je 0x10028eb
push 0xd
jmp 0x10028fc
push dword [ebp - 0xc]
call fcn.01001b24
mov dword [ebp - 8], eax
test eax, eax
jne 0x10028ff
push 8
pop ebx
jmp 0x1002929
lea ecx, [ebp - 0xc]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push dword [ebp - 4]
call esi
mov ebx, eax
test ebx, ebx
jne 0x1002929
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
and dword [ebp - 8], ebx
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
pop edi
cmp dword [ebp - 4], 0
je 0x1002939
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x1002947
push dword [ebp - 8]
call fcn.01001b44
pop esi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x1002954
Capabilities:
Get hostname
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1009024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x24]
xor esi, esi
push eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x38], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1002990
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1002a53
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x80000000
push esi
push 0x1001418
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, esi
jne 0x1002a50
push edi
lea eax, [ebp - 0x2c]
push eax
push esi
lea eax, [ebp - 0x34]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, 0x10013f8
push edi
push dword [ebp - 0x28]
call esi
mov ebx, eax
test ebx, ebx
jne 0x1002a46
push dword [ebp - 0x2c]
call fcn.01001b24
mov dword [ebp - 0x30], eax
test eax, eax
je 0x1002a43
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push edi
push dword [ebp - 0x28]
call esi
mov ebx, eax
test ebx, ebx
jne 0x1002a39
mov eax, dword [ebp - 0x2c]
inc eax
shr eax, 1
imul eax, eax, 0xa
inc eax
inc eax
push eax
call fcn.01001b24
mov esi, eax
test esi, esi
je 0x1002a36
push esi
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.01002786
push esi
lea eax, [ebp - 0x24]
push eax
push 0x1f
call fcn.01001cd8
add esp, 0xc
push esi
call fcn.01001b44
jmp 0x1002a39
push 8
pop ebx
push dword [ebp - 0x30]
call fcn.01001b44
jmp 0x1002a46
push 8
pop ebx
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100741c
leave
ret
Function at 0x1002be8
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1009024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push 4
push 0x1000
push eax
push ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], ebx
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x30], eax
cmp eax, ebx
jne 0x1002c44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
jmp 0x1002d32
cmp edi, ebx
je 0x1002c60
movzx ecx, byte [edi]
push dword [ebp + 0xc]
push ecx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov byte [esi + 0x10], bl
jmp 0x1002d18
push 3
push 0x20
lea eax, [ebp - 0x24]
push eax
push ebx
mov byte [esi + 0x10], 1
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, ebx
jge 0x1002c7f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x1002c3c
push ebx
push ebx
push 0x10013e0
lea eax, [ebp - 0x2c]
push eax
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
cmp eax, ebx
jl 0x1002c76
push ebx
lea eax, [ebp - 0x40]
push eax
push 4
lea eax, [ebp - 0x3c]
push eax
push 0x10014ac
push dword [ebp - 0x2c]
call sub.bcrypt.dll_BCryptGetProperty
cmp eax, ebx
jl 0x1002c76
push ebx
lea eax, [ebp - 0x40]
push eax
push 4
lea eax, [ebp - 0x44]
push eax
push 0x1001494
push dword [ebp - 0x2c]
call sub.bcrypt.dll_BCryptGetProperty
cmp eax, ebx
jl 0x1002c76
push dword [ebp - 0x3c]
call fcn.01001b24
mov dword [ebp - 0x38], eax
cmp eax, ebx
jne 0x1002ce3
mov dword [ebp - 0x28], 0xe
jmp 0x1002d32
push ebx
push 0x20
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x2c]
call sub.bcrypt.dll_BCryptGenerateSymmetricKey
cmp eax, ebx
jl 0x1002c76
push 2
push dword [esi + 0xc]
push dword [ebp - 0x30]
push ebx
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, ebx
jl 0x1002c76
mov eax, dword [ebp - 0x30]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x34]
mov dword [esi], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [esi + 4], eax
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x34], ebx
je 0x1002d3f
push dword [ebp - 0x34]
call sub.bcrypt.dll_BCryptDestroyKey
cmp dword [ebp - 0x38], ebx
je 0x1002d4c
push dword [ebp - 0x38]
call fcn.01001b44
cmp dword [ebp - 0x2c], ebx
je 0x1002d5a
push ebx
push dword [ebp - 0x2c]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
cmp dword [ebp - 0x30], ebx
je 0x1002d6e
push 0x8000
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x20
pop ecx
lea eax, [ebp - 0x24]
mov byte [eax], bl
inc eax
dec ecx
jne 0x1002d74
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100741c
leave
ret 0xc
Function at 0x1002d93
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp byte [eax + 0x10], bl
je 0x1002dbe
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
push esi
push ebx
lea esi, [ebp + 8]
push esi
push ecx
push edx
push ebx
push ebx
push ebx
push ecx
push edx
push dword [eax]
call sub.bcrypt.dll_BCryptEncrypt
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10033fb
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
xor ebx, ebx
mov dword [ebp - 8], edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x1003416
mov esi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
push edi
push edi
sub eax, ecx
lea ecx, [ebp - 8]
push ecx
push edi
push 8
sar eax, 1
push eax
push dword [ebp + 8]
call esi
test eax, eax
jne 0x100344b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x1003528
push dword [ebp - 8]
call fcn.01001b24
mov dword [ebp - 0xc], eax
cmp eax, edi
jne 0x1003466
mov dword [ebp - 4], 8
jmp 0x1003504
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x100346c
push edi
push edi
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0xc]
sub eax, edx
push 8
sar eax, 1
push eax
push dword [ebp + 8]
call esi
test eax, eax
jne 0x100349a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x1003504
push 8
pop esi
push esi
call fcn.01001b24
mov ebx, eax
cmp ebx, edi
jne 0x10034ae
mov dword [ebp - 4], esi
jmp 0x1003504
push dword [ebp - 8]
call fcn.01001b24
mov dword [ebx + 4], eax
cmp eax, edi
je 0x10034a9
push dword [ebp - 8]
push dword [ebp - 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 8]
add esp, 0xc
push 0x14
mov dword [ebx], eax
call fcn.01001b24
cmp eax, edi
je 0x10034a9
lea ecx, [eax + 4]
mov dword [eax], ecx
mov dword [ecx], 0x10
mov ecx, dword [eax]
mov dword [ecx + 8], ebx
mov ecx, dword [eax]
mov dword [ecx + 4], edi
mov ecx, dword [eax]
mov dword [ecx + 0xc], edi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 1
mov dword [ecx + 4], eax
xor ebx, ebx
cmp dword [ebp - 0xc], edi
je 0x1003511
push dword [ebp - 0xc]
call fcn.01001b44
cmp ebx, edi
je 0x1003528
mov eax, dword [ebx + 4]
cmp eax, edi
je 0x1003522
push eax
call fcn.01001b44
push ebx
call fcn.01001b44
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10037cc
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], 0x1001518
mov dword [ebp - 0x10], 0x10014fc
mov dword [ebp - 0xc], 0x10014e4
cmp dword [ebp + 0xc], ebx
je 0x1003827
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xe
push 2
push dword [ebp + 0xc]
push 1
call dword [sym.imp.CRYPT32.dll_CryptQueryObject]
test eax, eax
jne 0x10038e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1003900
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x10038a0
mov eax, edi
mov dword [ebp + 0xc], ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1003836
mov esi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
push ebx
push ebx
lea ecx, [ebp + 0xc]
push ecx
push ebx
sub eax, edx
push 8
sar eax, 1
push eax
push edi
call esi
test eax, eax
je 0x100381a
push dword [ebp + 0xc]
call fcn.01001b24
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x1003872
push 8
pop esi
jmp 0x10038f3
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1003877
push ebx
push ebx
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp - 4]
sub eax, edx
push 8
sar eax, 1
push eax
push edi
call esi
test eax, eax
jne 0x10038b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10038f1
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0100288d
mov esi, eax
cmp esi, ebx
jne 0x10038f3
xor eax, eax
cmp byte [ebp + 0x14], bl
setne al
dec eax
and eax, 0x10000
or eax, 0x1000
mov edi, eax
cmp dword [ebp + 0x10], ebx
je 0x1003917
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
push edi
push dword [ebp + 0x10]
call fcn.01003335
mov esi, eax
cmp esi, ebx
jne 0x10038f3
push dword [ebp + 0x18]
push dword [ebp - 8]
call fcn.010035f3
mov esi, eax
cmp dword [ebp - 4], ebx
je 0x1003900
push dword [ebp - 4]
call fcn.01001b44
cmp dword [ebp - 8], ebx
je 0x100390e
push dword [ebp - 8]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
xor esi, esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
push edi
push dword [ebp + esi*4 - 0x14]
call fcn.01003335
test eax, eax
je 0x1003937
inc esi
cmp esi, 3
jb 0x1003919
cmp dword [ebp - 8], ebx
jne 0x10038e6
mov esi, 0x80092004
jmp 0x10038f3
Function at 0x1004488
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1009024]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
movzx esi, word [ebp - 0x210]
mov ecx, dword [ebx + esi*4]
test ecx, ecx
je 0x1004563
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10044e7
test dx, dx
je 0x10044e3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10044e7
add eax, 4
add ecx, 4
test dx, dx
jne 0x10044c1
xor eax, eax
jmp 0x10044ec
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100458a
push 0x1001558
push dword [ebp + 0xc]
lea eax, [edi + 0x60]
push eax
call fcn.01001b6a
test eax, eax
jl 0x1004577
lea esi, [ebx + esi*4 + 0x68]
cmp dword [esi], 0
je 0x1004563
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1004563
mov esi, dword [esi]
lea eax, [ebp - 0x20c]
mov cx, word [eax]
cmp cx, word [esi]
jne 0x100455a
test cx, cx
je 0x1004556
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x100455a
add eax, 4
add esi, 4
test cx, cx
jne 0x1004534
xor eax, eax
jmp 0x100455f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100458a
inc dword [ebp - 0x210]
cmp word [ebp - 0x210], 0x1a
jb 0x10044ad
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100741c
leave
ret 0xc
push 0x1001550
push dword [ebp + 0xc]
push edi
call fcn.01001b6a
mov eax, dword [ebp - 0x210]
add eax, 0x41
mov word [edi], ax
xor eax, eax
inc eax
jmp 0x1004579
Function at 0x100544d
Capabilities:
Get volume information via ioctl
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
push edi
xor edi, edi
push edi
lea eax, [ebp - 0xc]
push eax
push 0x60
lea eax, [ebp - 0x78]
push eax
push edi
push edi
push 0x90064
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1005485
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10055a5
push ebx
push edi
push dword [ebp - 0x48]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.010074c0
cmp edx, edi
mov ebx, eax
mov dword [ebp - 0x18], ebx
jl 0x10054b0
jg 0x10054a8
cmp ebx, 0x3fffffff
jbe 0x10054b0
push 0x57
pop eax
jmp 0x10055a4
push esi
mov esi, ebx
shl esi, 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp + 0xc], eax
cmp eax, edi
jne 0x10054d4
push 8
pop eax
jmp 0x10055a3
push esi
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 8], edi
cmp ebx, edi
jbe 0x100556c
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0100528b
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x100555b
xor ebx, ebx
test dword [ebp - 0x48], 0xfffffff8
jbe 0x100552b
push edi
lea eax, [ebp - 0x10]
push eax
push 8
push dword [0x100b628]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100552b
mov eax, dword [ebp - 0x48]
inc ebx
shr eax, 3
cmp ebx, eax
jb 0x1005507
mov ebx, dword [ebp - 8]
cmp ebx, edi
je 0x100554d
xor edx, edx
mov eax, ebx
mov ecx, 0xc8
div ecx
test edx, edx
jne 0x100554d
push 0x10014c8
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
inc ebx
add esi, 4
mov dword [ebp - 8], ebx
cmp ebx, dword [ebp - 0x18]
jb 0x10054ed
jmp 0x100556c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp eax, 0x70
jne 0x100556c
mov dword [ebp - 4], edi
xor esi, esi
cmp dword [ebp - 0x18], edi
jbe 0x100558f
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + esi*4]
cmp eax, 0xffffffff
je 0x1005589
cmp eax, edi
je 0x1005589
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 0x18]
jb 0x1005573
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop edi
leave
ret 8
Function at 0x100740d
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1007b08
call fcn.01007774
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100b658
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1007222
cmp eax, esi
jne 0x1007215
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1007225
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10071fc
xor esi, esi
inc esi
mov eax, dword [0x100b654]
cmp eax, esi
jne 0x1007238
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1007273
mov eax, dword [0x100b654]
test eax, eax
jne 0x100726d
mov dword [0x100b654], esi
push 0x1001290
push 0x1001284
call fcn.01007179
pop ecx
pop ecx
test eax, eax
je 0x1007273
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100733d
mov dword [0x1009094], esi
mov eax, dword [0x100b654]
cmp eax, esi
jne 0x1007297
push 0x1001280
push 0x1001278
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100b654], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10072a4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100b65c], ebx
je 0x10072c5
push 0x100b65c
call fcn.010076e9
pop ecx
test eax, eax
je 0x10072c5
push ebx
push 2
push ebx
call dword [0x100b65c]
push dword [0x100907c]
push dword [0x1009080]
push dword [0x1009078]
call fcn.010060dd
add esp, 0xc
mov dword [0x1009090], eax
cmp dword [0x1009084], ebx
jne 0x1007323
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1009094], ebx
jne 0x1007331
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1009090]
call fcn.010077b9
ret
call fcn.010078c1
jmp 0x10071da

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x401a6a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x40b074]
test eax, eax
je 0x401aa9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401aa9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401aa9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401aa9
cmp dword [ecx + 0x74], 0xe
jbe 0x401aa9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40ab80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40abad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40abad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403918
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x8c2008], 0x8088405
inc edx
mov dword [ebx + 0x8c2008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd18
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd31
add dl, dl
jne 0x41cd54
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cda5
xor eax, eax
add dl, dl
jne 0x41cd61
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce42
add dl, dl
jne 0x41cd70
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd7b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd86
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd91
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cd9b
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd40
mov eax, 1
add dl, dl
jne 0x41cdb3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdbe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdaa
sub eax, ebx
mov ebx, 1
jne 0x41cdf1
mov ecx, 1
add dl, dl
jne 0x41cdd7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cde2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdce
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd40
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce08
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce13
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdff
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd40
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ce63
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd40
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret