joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005b98e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x100d8a08
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1005b9b7
xor eax, eax
leave
ret
push esi
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret
Function at 0x1005bc6e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
test byte [0x10107880], 1
push esi
mov esi, 0x1010787c
jne 0x1005bcb0
or dword [0x10107880], 1
mov ecx, esi
call fcn.10010322
push 0x100c303c
call fcn.1007133b
pop ecx
mov ecx, esi
call fcn.10003a8c
test al, al
je 0x1005bcfa
and word [ebp - 0x210], 0
push 0x20a
lea eax, [ebp - 0x20e]
push 0
push eax
call fcn.10073a50
add esp, 0xc
push 1
push 0x25
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call fcn.10003b3f
push esi
mov ecx, ebx
call fcn.10003aa2
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, ebx
pop esi
call fcn.10070dd1
leave
ret
Function at 0x1005f7b7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
mov esi, edx
jne 0x1005f7c2
xor eax, eax
pop esi
ret
cmp eax, 8
push ebx
not esi
mov edx, 0xff
jb 0x1005f874
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cc360]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cc360]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cc360]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cc360]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cc360]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cc360]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cc360]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cc360]
inc ecx
sub eax, 8
dec edi
jne 0x1005f7d9
pop edi
test eax, eax
je 0x1005f88d
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cc360]
inc ecx
dec eax
jne 0x1005f878
mov eax, esi
pop ebx
not eax
pop esi
ret

Function at 0x1005f894
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x100cc360]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x100cc360]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x1005ffc8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x1005fff8
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1005fff3
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x10060030
xor eax, eax
mov ecx, edi
add ecx, dword [esi + 0x28]
adc eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x24]
jl 0x10060014
jg 0x1006000e
cmp ecx, dword [esi + 0x20]
jbe 0x10060014
mov edi, dword [esi + 0x20]
sub edi, dword [esi + 0x28]
mov eax, dword [esi + 0x1c]
add eax, dword [esi + 0x28]
push edi
push eax
push dword [ebp + 8]
call fcn.10073ad0
add esp, 0xc
add dword [esi + 0x28], edi
mov eax, edi
adc dword [esi + 0x2c], 0
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret
Function at 0x10060118
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push edi
mov edi, eax
xor eax, eax
cmp edi, eax
mov esi, ecx
je 0x100601a6
push 2
push eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
neg eax
push eax
push dword [esi + 4]
call ebx
and dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
push eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10060172
or eax, 0xffffffff
jmp 0x1006028f
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
push edx
push eax
xor ecx, ecx
mov eax, esi
call fcn.1005ff2c
test eax, eax
pop ecx
pop ecx
jne 0x1006016a
cmp byte [esi], al
je 0x100601b6
cmp byte [esi + 1], al
je 0x100601ad
push 1
push eax
push eax
push dword [esi + 4]
call ebx
mov ebx, eax
sub ebx, dword [esi + 0x10]
mov dword [ebp - 4], ebx
jmp 0x100601be
push eax
push eax
push 2
pop ecx
jmp 0x1006017d
and dword [ebp - 4], 0
mov ebx, dword [ebp - 4]
jmp 0x100601be
mov eax, dword [esi + 0x28]
mov dword [ebp - 4], eax
mov ebx, eax
mov eax, 0xffff
cmp ebx, eax
mov dword [ebp - 8], eax
jae 0x100601cd
mov dword [ebp - 8], ebx
push 0x404
call fcn.10073163
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
je 0x1006016a
or dword [ebp - 0x14], 0xffffffff
push 4
pop eax
cmp dword [ebp - 8], eax
jbe 0x10060283
jmp 0x100601f7
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add eax, 0x400
cmp eax, ecx
mov dword [ebp - 0xc], ecx
ja 0x10060209
mov dword [ebp - 0xc], eax
mov edi, ebx
sub edi, dword [ebp - 0xc]
mov eax, ebx
sub eax, edi
mov ebx, 0x404
cmp eax, ebx
ja 0x1006021d
mov ebx, eax
push 0
push edi
xor ecx, ecx
mov eax, esi
call fcn.1005ff2c
test eax, eax
pop ecx
pop ecx
jne 0x10060283
push 1
push ebx
push dword [ebp - 0x10]
call fcn.1005ffc8
add esp, 0xc
cmp eax, 1
jne 0x10060283
lea eax, [ebx - 3]
jmp 0x10060266
mov ecx, dword [ebp - 0x10]
dec eax
cmp byte [eax + ecx], 0x50
jne 0x10060266
cmp byte [eax + ecx + 1], 0x4b
jne 0x10060266
cmp byte [eax + ecx + 2], 5
jne 0x10060266
cmp byte [eax + ecx + 3], 6
je 0x1006026c
test eax, eax
jg 0x10060247
jmp 0x10060271
add eax, edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10060283
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], eax
jb 0x100601f1
push dword [ebp - 0x10]
call fcn.100732dd
mov eax, dword [ebp - 0x14]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10060cdf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi], 0
jne 0x10060d6e
cmp dword [esi + 4], 0xffffffff
jne 0x10060d6e
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.10070dbb
movzx eax, word [esi + eax*2 + 0x242]
cmp ax, 0x5c
pop ecx
je 0x10060d3b
cmp ax, 0x2f
je 0x10060d3b
push edi
call fcn.10070dbb
mov ecx, 0x103
sub ecx, eax
push ecx
push 0x100d6bdc
push edi
call fcn.10077f31
add esp, 0x10
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.1005fe7b
test eax, eax
pop ecx
pop ecx
pop edi
jne 0x10060d53
mov eax, dword [ebp + 8]
jmp 0x10060d73
push dword [ebp + 0xc]
call fcn.10060294
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x10060d73
mov eax, 0x1000000
pop ebp
ret 8

Function at 0x100612d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
je 0x10061304
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10061304
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx ecx, word [esi]
test cx, cx
je 0x100613c6
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x10061323
cmp cx, 0x5c
jne 0x10061325
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x10061317
cmp eax, esi
push edi
je 0x10061363
sub eax, esi
sar eax, 1
add eax, eax
mov edi, eax
push edi
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.10073ad0
and word [ebp + edi - 0x414], 0
lea eax, [ebp - 0x414]
push eax
push ebx
call fcn.100612d0
add esp, 0x14
and word [ebp - 0x20c], 0
test ebx, ebx
mov edi, 0x103
je 0x10061385
push edi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.100740c3
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call fcn.10070dbb
sub edi, eax
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.10077f31
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
pop edi
jne 0x100613c6
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10070dd1
leave
ret
Function at 0x10061e75
Capabilities:
Create directory
Get file attributes

Disassembly:
push 0x14
mov eax, 0x100c0324
call fcn.10078eed
mov edi, ecx
and dword [ebp - 0x18], 0
lea esi, [ebp - 0x10]
call fcn.10061975
and dword [ebp - 4], 0
mov eax, dword [0x101061ec]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
je 0x10061fb7
mov edi, dword [ebp - 0x10]
mov eax, dword [edi - 8]
movzx eax, word [edi + eax*2 - 2]
cmp ax, 0x5c
mov esi, 0x100d6bdc
je 0x10061ed9
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x10]
call fcn.10061cc6
mov edi, dword [ebp - 0x10]
mov eax, dword [edi - 8]
test eax, eax
jl 0x10061eed
push esi
push edi
call fcn.10071571
test eax, eax
pop ecx
pop ecx
jne 0x10061ef2
or eax, 0xffffffff
jmp 0x10061ef6
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
je 0x10061fb7
lea ecx, [eax + 1]
lea eax, [ebp - 0x1c]
push eax
lea ebx, [ebp - 0x10]
mov dword [ebp - 0x20], ecx
call fcn.10061a01
mov byte [ebp - 4], 2
mov eax, dword [eax]
push eax
mov eax, dword [eax - 8]
lea ecx, [ebp - 0x14]
call fcn.10061cc6
lea esi, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.10061bcb
mov ebx, dword [ebp - 0x20]
test ebx, ebx
mov esi, dword [edi - 8]
jle 0x10061f71
test esi, esi
jle 0x10061f71
cmp ebx, esi
jle 0x10061f43
mov ebx, esi
lea eax, [ebp - 0x10]
call fcn.10061d4d
mov edi, dword [ebp - 0x10]
mov eax, esi
sub eax, ebx
lea eax, [eax + eax + 2]
push eax
lea eax, [edi + ebx*2]
push eax
mov eax, dword [edi - 4]
lea eax, [eax + eax + 2]
push eax
push edi
call fcn.1002413f
add esp, 0x10
sub esi, ebx
mov dword [edi - 8], esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or esi, 0xffffffff
cmp eax, esi
jne 0x10061f90
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10061fbe
cmp dword [edi - 8], 0
jl 0x10061fa7
push 0x100d6bdc
push edi
call fcn.10071571
test eax, eax
pop ecx
pop ecx
jne 0x10061fab
mov eax, esi
jmp 0x10061faf
sub eax, edi
sar eax, 1
cmp eax, esi
jne 0x10061eff
mov dword [ebp - 0x18], 1
lea esi, [ebp - 0x14]
call fcn.10061bcb
lea esi, [ebp - 0x10]
call fcn.10061bcb
mov eax, dword [ebp - 0x18]
call fcn.10078f8c
ret
Function at 0x100623ed
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes

Disassembly:
push 0x60
mov eax, 0x100c18bc
call fcn.10078f56
mov esi, ecx
lea ebx, [ebp - 0x48]
mov dword [ebp - 0x50], esi
mov byte [ebp - 0x49], 0
call fcn.1006a54f
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.100016b4
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.1000189b
test al, al
je 0x1006244b
mov eax, ebx
push eax
lea ecx, [ebp - 0x6c]
call fcn.1006a295
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.10001760
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.1000174b
jmp 0x10062454
push esi
lea ecx, [ebp - 0x2c]
call fcn.10001760
lea esi, [ebp - 0x2c]
call fcn.1006a348
push 0x100d8de0
lea ecx, [ebp - 0x6c]
call fcn.100016dd
lea ebx, [ebp - 0x6c]
mov edi, esi
mov byte [ebp - 4], 3
call fcn.1006a45b
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.1000174b
mov ecx, esi
call fcn.10004cd2
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x50]
je 0x100624a3
and dword [eax + 0x1c], 0
jmp 0x10062564
lea esi, [ebp - 0x48]
mov dword [eax + 0x1c], 1
call fcn.1006a1ab
push 0x100d8df8
lea ecx, [ebp - 0x6c]
call fcn.100016dd
lea esi, [ebp - 0x6c]
lea edi, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.1006a3e7
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.1000174b
mov ecx, edi
call fcn.10004cd2
push eax
call ebx
cmp eax, 0xffffffff
je 0x100624fb
mov ecx, dword [ebp - 0x50]
mov eax, edi
push eax
add ecx, 0x80
call fcn.10001760
jmp 0x10062560
push str.SKIN
push str.QMUIRES.dat
push dword [0x10107028]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x10062564
push esi
push dword [0x10107028]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10062564
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x10062564
push esi
push dword [0x10107028]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, dword [ebp - 0x50]
mov edi, eax
add esi, 0xb0
mov eax, esi
call fcn.10065f69
push edi
push ebx
push dword [esi]
call fcn.10073ad0
add esp, 0xc
mov byte [ebp - 0x49], 1
lea ecx, [ebp - 0x2c]
call fcn.1000174b
lea ecx, [ebp - 0x48]
call fcn.1000174b
mov al, byte [ebp - 0x49]
call fcn.10078fa0
ret
Function at 0x100629a4
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x50
mov eax, 0x100c186f
call fcn.10078f56
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x2d], 0
call fcn.1000189b
test al, al
jne 0x10062ac6
push esi
lea ecx, [ebp - 0x2c]
call fcn.10001713
and dword [ebp - 4], 0
lea esi, [ebp - 0x2c]
call fcn.1006a348
call fcn.100202bf
mov ecx, edi
mov ebx, eax
call fcn.100014aa
mov edi, eax
test edi, edi
je 0x10062a0c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x10062a10
xor eax, eax
jmp 0x10062a23
lea eax, [esi + esi]
call fcn.10082f90
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1003455f
push eax
lea ecx, [ebp - 0x5c]
call fcn.100016dd
lea ebx, [ebp - 0x5c]
lea edi, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.1006a45b
xor ebx, ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], bl
call fcn.1000174b
mov ecx, edi
call fcn.10004cd2
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x38], eax
je 0x10062abe
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
je 0x10062ab5
lea eax, [esi + 1]
push eax
mov dword [ebp - 0x34], ebx
call fcn.10070158
mov edi, dword [ebp - 0x3c]
pop ecx
push ebx
lea ecx, [ebp - 0x34]
push ecx
push esi
push eax
push dword [ebp - 0x38]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10062ab5
cmp dword [ebp - 0x34], esi
jne 0x10062ab5
mov eax, dword [ebp - 0x40]
mov dword [eax], esi
mov eax, dword [edi]
mov byte [esi + eax], bl
mov byte [ebp - 0x2d], 1
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.1000174b
mov al, byte [ebp - 0x2d]
lea esp, [ebp - 0x6c]
call fcn.10078fa0
ret 8
Function at 0x100639cf
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 8
mov eax, 0x100c0f6b
call fcn.10078eed
mov eax, dword [ebp + 0x41c]
mov esi, 0x206
xor edi, edi
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20a]
push edi
push eax
mov word [ebp + 0x208], di
call fcn.10073a50
push esi
lea eax, [ebp + 2]
push edi
push eax
mov word [ebp], di
call fcn.10073a50
add esp, 0x18
push edi
push 0x1a
lea eax, [ebp + 0x208]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.kingsoftkclear_temp
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [0x101061ec]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x208]
shr eax, 0x10
test ax, ax
lea eax, [ebp + 0x208]
jne 0x10063a77
movzx eax, ax
push eax
lea ecx, [ebp - 0x10]
call fcn.10061a73
jmp 0x10063aac
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
cmp esi, edi
je 0x10063aac
push esi
lea eax, [ebp - 0x10]
push eax
call fcn.10061bf3
test eax, eax
je 0x10063aac
lea eax, [esi + esi]
push eax
lea ecx, [ebp + 0x208]
push ecx
add eax, 2
push eax
push dword [ebp - 0x10]
call fcn.1002045a
add esp, 0x10
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.10061e75
lea esi, [ebp - 0x10]
mov ebx, eax
call fcn.10061bcb
cmp ebx, edi
je 0x10063b21
lea eax, [ebp]
push eax
push edi
push 0x100d8f00
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp]
push 0x100d8f08
push eax
call fcn.1007611e
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x10063b21
push esi
push dword [ebp + 0x420]
push 1
push dword [ebp - 0x14]
call fcn.10076321
push esi
call fcn.100766da
add esp, 0x14
push 0x10
push 0x20
push 0x20
push 1
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, eax
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.10070dd1
add ebp, 0x414
leave
ret

Function at 0x10069283
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, dword [esp + 4]
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edi + edx*4]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edi + edx*4]
pop esi
mov dword [ecx + 8], eax
mov eax, dword [esp + 4]
ret
Function at 0x1006c8a0
Capabilities:
Parse pe header

Disassembly:
cmp edi, 0x40
jae 0x1006c8a8
xor eax, eax
ret
cmp word [ecx], 0x5a4d
jne 0x1006c8a5
mov eax, dword [ecx + 0x3c]
lea edx, [eax + 0xf8]
cmp edi, edx
jb 0x1006c8a5
cmp dword [eax + ecx], 0x4550
jne 0x1006c8a5
test byte [eax + ecx + 0x16], 2
je 0x1006c8a5
cmp word [eax + ecx + 0x14], 0xe0
jne 0x1006c8a5
push esi
lea esi, [eax + ecx + 0xf8]
movzx eax, word [eax + ecx + 6]
xor edx, edx
test eax, eax
jle 0x1006c903
lea ecx, [esi + 0x10]
jmp 0x1006c8f0
mov esi, dword [ecx + 4]
add esi, dword [ecx]
cmp esi, edi
ja 0x1006c90a
add edx, 1
add ecx, 0x28
cmp edx, eax
jl 0x1006c8f0
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1006d950
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100de900
push 0x10078870
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x100eb3e0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov dword [ebp - 0x80], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x60], ecx
test eax, eax
mov esi, 0x10000
je 0x1006d9a0
lea esi, [eax + 0x10000]
xor eax, eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ecx]
push 0x1c
lea edx, [ebp - 0x7c]
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x1006d9ee
mov eax, dword [ebp - 0x70]
mov ecx, eax
and ecx, 0xfff
cmp ecx, 0xfff
je 0x1006d9ee
mov edx, dword [ebp - 0x7c]
add eax, edx
cmp eax, esi
jae 0x1006da0e
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10070dd1
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 0x6c], 0x1000
jne 0x1006dae3
mov eax, dword [ebp - 0x68]
cmp al, 1
je 0x1006dae3
test eax, 0x100
jne 0x1006dae3
mov dword [ebp - 4], 0
push 0
push 0x40
lea eax, [ebp - 0x5c]
push eax
push esi
push edi
call ebx
test eax, eax
jne 0x1006da5d
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x7c]
lea esi, [eax + ecx]
jmp 0x1006d9c0
cmp word [ebp - 0x5c], 0x5a4d
jne 0x1006da48
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x70]
ja 0x1006da48
cmp eax, 0x40
jb 0x1006da48
push 0
push 0xf8
mov ecx, dword [ebp - 0x60]
push ecx
add eax, esi
push eax
push edi
call ebx
test eax, eax
jne 0x1006da9c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x7c]
lea esi, [eax + ecx]
jmp 0x1006d9c0
mov edx, dword [ebp - 0x60]
cmp dword [edx], 0x4550
je 0x1006dabc
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x7c]
lea esi, [eax + ecx]
jmp 0x1006d9c0
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x1006d9f0
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x7c]
lea esi, [eax + ecx]
jmp 0x1006d9c0