joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10071680
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x114]
mov dword [esp + 0xc], 1
test ecx, ecx
mov dword [esp + 0x10], esi
jne 0x100716b3
push ecx
lea eax, [esp + 0x10]
push ecx
push eax
push ecx
lea ecx, [esi + 1]
push ecx
jmp 0x1007170b
cmp ecx, 0xffffffff
jne 0x100716ca
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x100716f9
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
lea edx, [esi + 1]
push 0
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x1007171f
or eax, 0xffffffff
pop esi
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x10071758
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x120]
push 0x10
push ecx
push 0
push edx
push eax
push esi
call sub.WS2_32.dll_sendto
pop esi
add esp, 0x10c
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x10c
ret

Function at 0x100717e0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
lea eax, [esp + 4]
push esi
push 0x100
push eax
call sub.WS2_32.dll_gethostname
test eax, eax
jge 0x10071804
xor eax, eax
pop esi
add esp, 0x104
ret
lea ecx, [esp + 8]
push ecx
call sub.WS2_32.dll_gethostbyname
mov esi, eax
test esi, esi
mov dword [esp + 4], esi
jne 0x10071820
pop esi
add esp, 0x104
ret
push ebx
push ebp
mov ebp, dword [esp + 0x114]
push edi
xor ebx, ebx
jmp 0x10071832
mov esi, dword [esp + 0x10]
mov edx, dword [esi + 0xc]
cmp dword [edx + ebx*4], 0
je 0x10071881
push 0x100
call fcn.10075167
mov dword [ebp + ebx*4], eax
mov eax, dword [esi + 0xc]
add esp, 4
mov ecx, dword [eax + ebx*4]
mov edx, dword [ecx]
push edx
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + ebx*4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
cmp ebx, 0xa
rep movsb byte es:[edi], byte [esi]
jl 0x1007182e
pop edi
mov eax, ebx
pop ebp
pop ebx
pop esi
add esp, 0x104
ret

Function at 0x10071910
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push edx
mov dword [esp + 0xc], 0x10
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x10071946
mov eax, dword [esp + 6]
push eax
call sub.WS2_32.dll_ntohs
and eax, 0xffff
add esp, 0x14
ret
or eax, 0xffffffff
add esp, 0x14
ret
Function at 0x10086fa2
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10086fda
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.10085059
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.10085031
jmp 0x10086fe6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x10088695
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x100886d7
call fcn.1008e5ad
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x100886d7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x100886ce
xor eax, eax
jmp 0x100886df
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.100886e5
pop edi
pop esi
pop ebx
ret 4
Function at 0x42f5b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42f5b6
ret

Function at 0x440bcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x440d7d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.0040544c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x440d94
call fcn.004050a8
mov eax, ebx
call fcn.0042cd6c
mov edi, eax
dec edi
test edi, edi
jl 0x440c84
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0042cd40
mov edx, dword [0x47afc0]
call fcn.00404004
test al, al
je 0x440c80
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0042cd40
lea edx, [ebp - 0x14]
call fcn.0048bd8c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.0040544c
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040511c
inc esi
dec edi
jne 0x440c32
mov al, byte [0x440d98]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x440da4
mov eax, dword [ebp - 0xc]
call fcn.004102cc
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404e24
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0048bd8c
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x440d94
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0048bd8c
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x440d94
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x440d94
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x440db0
call fcn.0040ba70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440d84
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404db0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404db0
lea eax, [ebp - 0x14]
call fcn.00404d8c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404db0
ret
Function at 0x5c5b13
Capabilities:
Encode data using xor

Disassembly:
add byte [eax + 0x27], cl
dec eax
daa
dec ecx
shl dl, 1
pop esp
dec ecx
add byte [ecx + eax*2], cl
dec ecx
add byte [eax - 0x77ffb6c2], ah
inc eax
dec ecx
add byte [eax - 0x63ffb6c0], dh
cmp eax, 0x5d660049
inc edx
call 0xd8a4b9cd
rcr byte [ecx + ecx*2 - 0x14], cl
xor ebx, dword [ebp + 0x42]
lodsb al, byte [esi]
jno 0x5c5b9f
inc edx
inc esp
xor eax, 0xd22c425d
dec edi
dec eax
push eax
ror byte [edi + 0x48], cl
fcom qword [ebx]
pop ebp
inc edx
pushal
inc ebx
pop ebp
inc edx
push esp
inc ebx
pop ebp
inc edx
je 0x5c5b14
pop ebp
inc edx
or byte [ecx], al
pop ebp
inc edx
fdiv dword [ecx + 0x5d]
dec eax
pop eax
xchg edi, eax
pop ebx
xor byte gs:[edx - 0x747bb7a5], cl
pop ebx
dec eax
pop esp
adc al, 0x5d
dec eax
enter 0x5e44, 0x48
adc al, 0x97
xchg edi, eax
pop esi
dec eax
xor al, 0x97
pop esi
dec eax
xor ebx, dword fs:[ebp + 0x42]
je 0x5c5b7c
add eax, 0x5d792c2b
inc edx
cwde
inc ebx
pop ebp
inc edx
add al, 0x3b
pop ebp
dec eax
pop eax
cmp ebx, dword [ebp + 0x48]
insb byte es:[edi], dx
aas
pop ebp
dec eax
les ebp, [edx + 0x5d]
dec eax
invalid
Function at 0x624dac
Capabilities:
Encode data using xor

Disassembly:
les ecx, [esi - 0x5e]
jmp 0x624da0
add byte [eax], al
add byte [ecx], 0
add byte [eax], al
add byte [eax + eax], ah
add byte [eax], al
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
mov dword [ebp - 4], eax
push ebp
call 0xd663f44
add byte [eax], al
add byte [ebx], dl
dec ecx
add byte [ecx], al
add byte [eax], al
add byte [ebx + eax*4 - 0x3c], ah
cwde
push ebx
mov dword [ebp - 4], eax
push ebp
call 0xd663f5c
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax], al
push 0
push 0
dec ecx
jne 0x624e00
invalid
jae 0x624e68
add byte [eax], al
push 0
push 0
dec ecx
jne 0x624e0c
inc esi
inc ecx
dec esp
push edx
jae 0x624e79
add byte [eax - 0x3d000000], al
nop
push 0
dec ecx
jne 0x624e2f
arpl word [edi + edx*2 + 0x46], bp
or byte [0x61724454], cl
ja 0x624e80
popal
add byte [eax + 1], al
add dword [eax], eax
add byte [eax], al
add bh, bh
invalid
add byte [eax], al
add byte [ebx - 0x76ac673c], al
add byte [ebp - 4], al
cld
sub dword [ecx], ecx
or eax, 0x46576c63
insb byte es:[edi], dx
push edi
inc esi
push esp
js 0x624ef4
add byte [eax], al
add byte [eax], al
add byte [eax], al
add ah, al
add byte [ebp - 4], al
cld
sub dword [ecx], ecx
or eax, 0x46576c63
push esp
js 0x624f0c
add byte [eax], al
add byte [ebx - 0x80], dl
add dword [eax], eax
add byte [eax], al
push dword [ebx - 1]
or byte [eax], al
add byte [edx], cl
arpl word [edi + edx*2 + 0x46], bp
push esp
js 0x624f24
add byte [eax + 5], al
jae 0x624eb7
dec dword [eax]
add byte [eax], al
or al, 0x63
or byte [eax], al
add byte [ebx], cl
insb byte es:[edi], dx
push edi
inc esi
push esp
js 0x624f38
add byte [eax], al
add byte [eax], al
add byte [eax], al
enter 0x44, 1
add byte [ecx], dl
add byte [eax], al
add byte [esp + edx*2 + 0x65], ah
js 0x624f45
outsb dx, byte [esi]
push eax
dec ecx
outsb dx, byte [esi]
arpl word [ebp + esi*2 + 0x64], bp
dec esi
outsd dx, dword [esi]
add byte [eax], al
add byte [ebx + 0x24], dl
add dword [edx + 0x43882404], ecx
pop eax
mov al, byte [esp]
add al, 0x24
mov byte [ebx + 0x58], al
cmp al, 0x83
jnp 0x624eee
je 0x624f79
sub al, 9
movsb byte es:[edi], byte [esi]
inc ebp
xor eax, eax
mov dword [0xe4558d8b], esp
mov ecx, dword [eax]
call [0x8ff3346]
dec dword [eax]
or bh, dl
xlatb
mov eax, dword [ebx + 0x3c]
add al, 0x24
add byte [edx + 0x70d0d304], cl
xor al, 0
add byte [edx - 0x7b], bl
push es
add bl, ch
xor byte [edi + 0x4e], al
dec esi
jne 0x624f0d
inc ecx
add al, ch
inc esp
xor al, byte [eax]
jl 0x624eef
invalid
sbb byte [ebx], bh
inc esi
push esp
jne 0x624f41
mov dword [esi + 0x54], edx
mov dword [esi + 0x34], edx
mov byte [esi + 0x38], 0
inc esi
cmp byte [eax], al
add byte [eax + eax*8 - 0x2874f68c], al
mov eax, esi
pop esi
ret
or dword [ebx + 0x5ec68bd7], ecx
ret

Function at 0x7778b8
Capabilities:
Get number of processors

Disassembly:
add byte [eax + eax*8 - 0x447ff68c], al
salc
pop es
rcl byte [ebx + 0x56], 0x21
cmp byte [eax + 0x40], 0x1c
jne 0x7778e6
mov eax, ebx
call fcn.004cb694
mov eax, ebx
add dword [eax + 0x36], ebx
invalid
mov eax, dword [ebp - 8]
invalid
Function at 0x85b624
Capabilities:
Encode data using xor

Disassembly:
or ecx, dword [ebx - 0x39ffff3d]
cmp bl, 7
ja 0x85b636
and ebx, 0x7f
bts dword [eax + 0x1d], ebx
or ecx, dword [ebx - 0x173fff3d]
and al, 0x34
xor eax, eax
mov dword [ebx - 0x17], eax
invalid

Function at 0x8aabb5
Capabilities:
Get number of processors

Disassembly:
sbb al, 0x9a
dec edx
add byte [ebx + ecx*4 - 0x28], bh
jmp 0x8aabb3
mov eax, eax
push ebp
mov ebp, esp
call fcn.0040ef84
mov dx, word [ebx]
imul eax, dword [esi], 0x64
push dword [eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], esi
mov esp, dword [edi + edi*8 + 0x30]
mov dword fs:[eax], esp
mov eax, dword [ecx]
in al, dx
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 4]
mov ecx, edi
mov ebx, dword [ebx + 8]
push 0xff080843
aam 0x8d
add byte [eax], 0
push 0xffffffffffffffb0
mov al, byte [eax]
fadd qword [ecx]
add byte [ebx], dh
ror byte [edx + 0x1345443], 0x22
sbb eax, 0xdb840f55
add dword [eax], eax
add byte [ebx + 0xf5d1c7b], al
mov ss, ecx
cld
mov eax, dword [eax + 0x4a1c538b]
pop ebx
pop es
push esi
sbb byte [esp + edi*8 - 0x1bb2e182], 0xb5
dec esi
push ebp
push esi
invalid

Function at 0x9d1677
Capabilities:
Encode data using xor

Disassembly:
sbb byte [eax], al
add byte [edx], bh
push eax
push eax
je 0x9d1669
mov byte [eax + 0x50], dl
test dl, dl
setne dl
call fcn.009d1654
pushal
nop
js 0x9d16c3
add byte [edx], bh
push esi
push ecx
je 0x9d1680
mov byte [esi + 0x51], dl
add byte [ebp - 0x75], dl
in al, dx
add esp, 0xffffffb8
add byte [ecx + 0x59], bl
pop esi
xor edx, dword [eax - 0x7c277401]
js 0x9d1681
add byte [ebx + 0x43], dh
xor byte [ebp + 5], al
push dword fs:[edx]
mov dword fs:[ebx], esi
shr byte [ebx + eax*8], cl
push 0x3c
or bl, byte [ebp]
call dword [edx + 0x64]
xor eax, eax
push ecx
invalid
or ebx, eax
fsubr dword [edx + 1]
dec dword [ebx + 0x685a2404]
inc ebx
and bh, bh
jne 0x9d1730
mov eax, dword [ebp - 0x10]
jmp 0x9d16f8
les ebp, [eax]
pop ebp
pop edi
sub byte [ebp + 0x5f], bl
pop esi
pop ebx
je 0x9d1741
mov eax, dword [eax]
xor al, 0xa
pop ebp
add byte [eax + 0x8ffccb8], al
add byte [eax], al
add byte [ecx], dh
jecxz 0x9d178e
aaa
or al, 3
call 0x1c52b32
add byte [eax], al
mov edx, esi
mov eax, dword [0x14244433]
cmp edi, ebp
jg 0x9d16f9
test bl, bl
je 0x9d172e
or ebp, 0xffffffff
mov eax, ebp
add esp, 0x28
pop ebp
pop eax
je 0x9d1760
sbb byte [eax + 0x50], al
mov eax, dword [esp + ebp*8]
mov ebx, edx
mov ecx, dword [ebx + 0x50]
push 0x838b1c48
shr al, 0x50
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
pushfd
push ebp
mov dword [edx + 0xc], eax
pop ebp
loopne 0x9d1702
push ebp
mov dword [edx + 0xc], eax
pop ebp
fcomp qword [ebp + edx*2 + 0x408a4289]
fild dword [ebp + 0x53]
mov eax, dword [ebp + 8]
push eax
inc eax
cld
mov al, byte [eax + 0x50]
push eax
mov eax, dword [ebp + 8]
push eax
inc eax
cld
mov al, byte [eax + 0x51]
inc ebx
or eax, 0x408b0800
cld
add ah, ch
adc dword [ebx], ebx
add byte [ebp + 8], dl
ret
Function at 0x43b634
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
sub ebx, 0x3cfcb302
call fcn.0043b674
mov ebx, 0x4aee02a6
xor dword [ecx], eax
sub edi, 1
inc ecx
sub ebx, ebx
or ebx, edi
sub ebx, 0x2f1b0f0d
cmp ecx, edx
jne fcn.0043b634
add ebx, 0x213b76ba
add edi, edi
sub edi, 0x722aaabe
ret
Function at 0x401e70
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401ee0
xor eax, eax
jmp 0x401fc1
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
jne 0x401ef8
xor eax, eax
jmp 0x401fc1
push ebp
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
call fcn.004018c0
mov esp, ebp
pop ebp
ret

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
loop 0x401e92
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
js 0x401e31
js 0x401e9d
xlatb
jne 0x401e56
les ecx, [ebp + 0x786a8845]
push eax
push esi
call fcn.004086e0
mov ecx, dword [ebp + 8]
fcom qword [sym.imp.MSVCRT.dll__iob]
add byte [ebx + 0x15dc084d], cl
enter 0x40c0, 0
push ecx
and edx, eax
int3
test eax, eax
mov ch, 0xf
push eax
push 0x1b40d254
adc dh, byte [esi + 0x64]
test byte [eax], al
add esp, 0xffffffc5
push ecx
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
add byte [esi - 0x70], bl
nop
nop
nop
iretd
nop
nop
nop
or byte [ebx + 0x14ec83ec], 0x53
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x53], eax
call 0x8a6a00
mov dword [0x410bd9], eax
test eax, 0xc30bb315
add byte [ebx + 0x14468bd8], cl
test eax, eax
mov edi, edx
cwde
inc eax
arpl word [esi + 4], cx
push 0
cwde
add byte [ecx - 0x18], dl
xchg esi, eax
insd dword es:[edi], dx
add byte [ebx], al
mov dword [esi + 0x7a000853], ebx
mov dword [esi + 0x3c], eax
or byte [eax], al
dec eax
mov dword [esi + 0x18], 0
sbb eax, 0x41636e15
jo 0x401e79
add al, 0x14
leave
pushal
insb byte es:[edi], dx
inc ecx
test eax, eax
je 0x401f3a
iretd
jl 0x401f3a
cmp ebx, ecx
ja 0x66402015
mov edx, dword [esi + 0x18]
mov ebx, dword [0x401730]
mov eax, dword [esi + 4]
lea eax, [eax]
or byte [ebx], al
rcl dword [ecx + 0x52], cl
push eax
call 0xaa408b48
test dword [edx - 0x77c968c], ebx
inc ecx
je 0x401f8a
cmp eax, 0xafd68
cwde
daa
cmp eax, 0xc20afcd9
and eax, 0xfd573d20
or al, byte [eax]
je 0x401f30
cmp eax, 0x72fd3b
je 0x401f8a
cmp eax, 0xafca1
je 0x401f8a
cmp eax, 0xd823b3
jne 0x5d402030
mov eax, dword [ebp + 8]
mov ebx, dword [0x4102a0]
fmul qword [edi]
movsb byte es:[edi], byte [esi]
add al, byte [ecx + 0x4f]
add ebx, eax
adc edi, 0
mov dword [0x240ba0], ebx
mov dword [esp - 0x74ff7efe], esp
jp 0x401fc5
mov ecx, dword [esi + 0x14]
add edx, dword [ecx + 0x5689602b]
sbb byte [ecx - 0x7af5ebb2], cl
in al, dx
invalid
xchg ecx, eax
call 0x6b6a00
mov dword [0x410ba0], eax
mov dword [0xe80ba4], edx
mov edx, dword [esi - 0x2b]
mov dword [esi + 0x840], eax
mov ecx, dword [0xfabe2d]
mov eax, 1
mov eax, ecx
invalid
Function at 0x402c0c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4a9008], 0x8088405
inc edx
mov dword [ebx + 0x4a9008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403064
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4a9024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4030fc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4030dc
xor eax, eax
push ebp
push 0x4030d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403118
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4030dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4a9024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4a9024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e08
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4ac048], 0
je 0x403e69
cmp word [0x4ac21c], 0xd7b2
jne 0x403e31
cmp dword [0x4ac224], 0
jbe 0x403e31
mov eax, 0x4ac218
call dword [0x4ac234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4a9070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e90
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4a9034], 0
jne 0x403e85
push 0
push 0x4a9068
push 0x4a9070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405444
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405674
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4054c7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405674
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4054c7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405690
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405550
xor eax, eax
push ebp
push 0x405549
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0040528c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40552e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4056b0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40552e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405550
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40566a
cmp byte [ebp - 0xd], 0
jne 0x405597
cmp byte [ebp - 0x12], 0
je 0x40566a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4055b0
dec ebx
cmp byte [ebx], 0x2e
je 0x4055bf
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4055af
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40566a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4055fc
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40566a
cmp byte [ebp - 0xd], 0
je 0x40566a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40566a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret