joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bc60
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x44666c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
push esi
push edi
lea ebx, [ecx + 1]
mov ecx, 7
mov esi, edx
lea edi, [ebp - 0x90]
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + 0x1c]
mov ecx, 7
lea edi, [ebp - 0xac]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov byte [ebp - 0x3c], 0
mov dword [ebp - 0x3b], eax
mov dword [ebp - 0x37], eax
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov word [ebp - 0x23], ax
mov byte [ebp - 0x21], al
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov dword [ebp - 0xb0], edi
jmp 0x41bce6
mov edi, dword [ebp - 0xb0]
movsx esi, byte [edi + 0x43e450]
mov eax, 0x1c
sub eax, esi
push eax
lea ecx, [ebp + esi - 0x90]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.0041f8d0
push esi
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x20]
push eax
sub ecx, esi
push ecx
call fcn.0041f8d0
movsx esi, byte [edi + 0x43e450]
mov edx, 0x1c
sub edx, esi
push edx
lea eax, [ebp + esi - 0xac]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.0041f8d0
push esi
lea edx, [ebp - 0xac]
lea eax, [ebp - 4]
push edx
sub eax, esi
push eax
call fcn.0041f8d0
push 0x37
lea ecx, [ebp - 0x73]
push 0
push ecx
call fcn.004256b0
mov ecx, 7
lea esi, [ebp - 0x3c]
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
mov ecx, 7
lea esi, [ebp - 0x20]
lea edi, [ebp - 0x58]
add esp, 0x3c
rep movsd dword es:[edi], dword [esi]
xor eax, eax
jmp 0x41bd80
movsx edx, byte [eax + 0x43e420]
movzx ecx, byte [ebp + edx - 0x75]
mov byte [ebx + eax - 1], cl
movsx edx, byte [eax + 0x43e421]
movzx ecx, byte [ebp + edx - 0x75]
mov byte [ebx + eax], cl
movsx edx, byte [eax + 0x43e422]
movzx ecx, byte [ebp + edx - 0x75]
mov byte [ebx + eax + 1], cl
movsx edx, byte [eax + 0x43e423]
movzx ecx, byte [ebp + edx - 0x75]
mov byte [ebx + eax + 2], cl
movsx edx, byte [eax + 0x43e424]
movzx ecx, byte [ebp + edx - 0x75]
mov byte [ebx + eax + 3], cl
movsx edx, byte [eax + 0x43e425]
movzx ecx, byte [ebp + edx - 0x75]
mov byte [ebx + eax + 4], cl
add eax, 6
cmp eax, 0x30
jl 0x41bd80
mov eax, dword [ebp - 0xb0]
mov ecx, 7
lea esi, [ebp - 0x3c]
lea edi, [ebp - 0x90]
rep movsd dword es:[edi], dword [esi]
inc eax
mov ecx, 7
lea esi, [ebp - 0x20]
lea edi, [ebp - 0xac]
add ebx, 0x30
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb0], eax
cmp eax, 0x10
jl 0x41bce0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d129
mov esp, ebp
pop ebp
ret
Function at 0x41be40
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x44666c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x3f
mov esi, ecx
lea ecx, [ebp - 0x43]
push ebx
push ecx
mov dword [ebp - 0xe8], eax
mov byte [ebp - 0x44], bl
call fcn.004256b0
push 0x3f
lea edx, [ebp - 0xe3]
push ebx
push edx
mov byte [ebp - 0xe4], bl
call fcn.004256b0
push 0x3f
lea eax, [ebp - 0x83]
push ebx
push eax
call fcn.004256b0
add esp, 0x24
xor eax, eax
jmp 0x41bea0
mov ecx, eax
shr ecx, 3
movsx edx, byte [ecx + esi]
mov ecx, eax
and ecx, 7
shl edx, cl
inc eax
sar edx, 7
and dl, 1
mov byte [ebp + eax - 0x45], dl
cmp eax, 0x40
jb 0x41bea0
lea eax, [ebp - 0xe4]
lea ecx, [ebp - 0x44]
call fcn.0041c220
mov ecx, 8
lea esi, [ebp - 0xe4]
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [ebp - 0xc4]
lea edi, [ebp - 0xa4]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edx, dword [ebp - 0xe8]
lea eax, [ebp - 0xa4]
push eax
mov ecx, esi
lea ebx, [ebp - 0x24]
call fcn.0041bfc0
inc esi
cmp esi, 0x10
jl 0x41bef3
mov ecx, 8
lea esi, [ebp - 0xa4]
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
mov esi, ebx
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movsx ecx, byte [eax + 0x43e6f0]
movzx edx, byte [ebp + ecx - 0x85]
mov ecx, dword [ebp - 0xe8]
mov byte [ecx + eax + 0x600], dl
movsx edx, byte [eax + 0x43e6f1]
movzx edx, byte [ebp + edx - 0x85]
mov byte [ecx + eax + 0x601], dl
movsx edx, byte [eax + 0x43e6f2]
movzx edx, byte [ebp + edx - 0x85]
mov byte [ecx + eax + 0x602], dl
movsx edx, byte [eax + 0x43e6f3]
movzx edx, byte [ebp + edx - 0x85]
mov byte [ecx + eax + 0x603], dl
add eax, 4
cmp eax, 0x40
jl 0x41bf31
mov eax, ecx
lea edi, [eax + 0x600]
lea esi, [eax + 0x680]
call fcn.0041c4a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d129
mov esp, ebp
pop ebp
ret 4
Function at 0x41c220
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, str.:2_
mov edi, 0x43e461
mov edx, 0x43e462
mov ebx, 0x43e463
sub esi, eax
sub edi, eax
sub edx, eax
sub ebx, eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 0x10
nop
movsx ebx, byte [esi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax], bl
movsx ebx, byte [edi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 1], bl
movsx ebx, byte [edx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 2], bl
mov ebx, dword [ebp - 8]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 3], bl
add eax, 4
dec dword [ebp - 4]
jne 0x41c250
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c2a0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, 0x43e4a3
sub ebx, eax
mov dword [ebp - 8], ebx
push esi
mov ebx, 0x43e4a4
sub ebx, eax
push edi
mov dword [ebp - 0xc], ebx
mov esi, 0x43e4a0
mov edi, 0x43e4a1
mov edx, 0x43e4a2
mov ebx, 0x43e4a5
sub esi, eax
sub edi, eax
sub edx, eax
sub ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 8
movsx ebx, byte [esi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax], bl
movsx ebx, byte [edi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 1], bl
movsx ebx, byte [edx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 2], bl
mov ebx, dword [ebp - 8]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 3], bl
mov ebx, dword [ebp - 0xc]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 4], bl
mov ebx, dword [ebp - 0x10]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 5], bl
add eax, 6
dec dword [ebp - 4]
jne 0x41c2e3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c420
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, 0x43e6d0
mov edi, 0x43e6d1
mov edx, 0x43e6d2
mov ebx, 0x43e6d3
sub esi, eax
sub edi, eax
sub edx, eax
sub ebx, eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 8
nop
movsx ebx, byte [esi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax], bl
movsx ebx, byte [edi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 1], bl
movsx ebx, byte [edx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 2], bl
mov ebx, dword [ebp - 8]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 3], bl
add eax, 4
dec dword [ebp - 4]
jne 0x41c450
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41d129
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44666c]
jne 0x41d133
repz ret
jmp fcn.004220da
Function at 0x42f594
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44666c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004224cb
and dword [ebp - 0x14], 0
cmp dword [0x449210], 0
mov dword [ebp - 0x18], eax
jne 0x42f647
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x42f6ef
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x42f6ef
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x449210], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x449214], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x449218], eax
call edi
push eax
call esi
mov dword [0x449220], eax
test eax, eax
je 0x42f647
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44921c], eax
mov eax, dword [0x44921c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x42f6a0
cmp dword [0x449220], ecx
je 0x42f6a0
push eax
call esi
push dword [0x449220]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x42f6a0
test ebx, ebx
je 0x42f6a0
call edi
test eax, eax
je 0x42f697
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42f697
test byte [ebp - 8], 1
jne 0x42f6a0
or dword [ebp + 0x10], 0x200000
jmp 0x42f6d3
mov eax, dword [0x449214]
cmp eax, dword [ebp - 0x18]
je 0x42f6d3
push eax
call esi
test eax, eax
je 0x42f6d3
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42f6d3
mov eax, dword [0x449218]
cmp eax, dword [ebp - 0x18]
je 0x42f6d3
push eax
call esi
test eax, eax
je 0x42f6d3
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x449210]
call esi
test eax, eax
je 0x42f6ef
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42f6f1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d129
leave
ret
Function at 0x101815e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x38]
jne 0x101434cd
cmp ecx, 0x47979116
cmc
mov ecx, edi
rol esi, 0x16
add si, 0x5cf2
sub ecx, ebx
stc
jmp 0x10143662
mov word [esp + 8], bx
mov esi, dword [eax + 0x3c]
cmc
add esi, eax
inc edx
sbb dl, cl
mov edx, dword [esi + 0x78]
stc
clc
clc
test ah, bh
test edx, edx
pushal
push dword [esp]
push 0x118c4407
lea esp, [esp + 0x28]
je 0x101434cd
bsr ecx, esi
add edx, eax
bts cx, bp
mov ecx, dword [esi + 0x7c]
stc
clc
clc
push edx
add ecx, edx
pushal
pushal
cmc
mov dword [esp + 0x44], ecx
lea ecx, [ebp - 0x36373fb4]
test bh, 0xa2
mov ecx, dword [ebp + 4]
jmp 0x1012f5ca
pushal
lea esp, [esp + 0x20]
je 0x101434cd
jmp 0x1017c84b
mov word [esp], bp
lea esp, [esp + 4]
js 0x1017e069
je 0x101434cd
call 0x101815fd
setae dl
mov esi, dword [eax + 0x3c]
add dh, bh
btr edx, 8
lea edx, [esi - 0x44b3a932]
add esi, eax
bswap dx
mov edx, dword [esi + 0x78]
push eax
stc
cmp bh, cl
bt edx, 0x1f
test edx, edx
call fcn.1012eb1e
pushfd
pushfd
repne scasb al, byte es:[edi]
push 0xfe980e2d
jmp 0x1012b74a
Function at 0x63d6f2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x63d74f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x63d749
mov edx, dword [0x67ea08]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x63d73d
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x63d722
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x63d74b
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x63f200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x63f26c
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x63f2b5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00655060
add esp, 8
test eax, eax
jne 0x63f2b3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x63f2b7
jmp 0x63f263
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x647b67
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.006418d7
add esp, 4
and eax, 0xff
test eax, eax
je 0x647bf0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.00652970
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x647bee
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0x647bee
jmp 0x647bf0
jmp 0x647b70
mov esp, ebp
pop ebp
ret

Function at 0x647ed3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [0x67f5ec]
test eax, eax
jne 0x647ee7
call fcn.00647e04
xor ecx, ecx
mov cl, byte [0x67f5e9]
test ecx, ecx
jne 0x647f6e
xor edx, edx
mov dl, byte [0x67f5e8]
test edx, edx
jne 0x647f6e
cmp dword [0x67f7f4], 0
je 0x647f49
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x180
mov ecx, dword [0x67f7f4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 4]
push edx
push 0x186
mov eax, dword [0x67f7f4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x67f7f4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x647f6e
push 0x10001
push 0x67f5ec
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x647f6e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x64b0ea
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x64b0fa
xor eax, eax
jmp 0x64b2c3
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x64b27b
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x67cf8c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x67cf8c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x67cf8c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x67cf8c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x67cf8c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x67cf8c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x67cf8c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x67cf8c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x64b103
cmp dword [ebp + 0x10], 0
je 0x64b2bd
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x67cf8c]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x64b281
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x655baf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x67a698
cmp edx, dword [eax]
je 0x655bd1
add eax, 8
inc ecx
cmp eax, 0x67a728
jl 0x655bc2
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x67a698]
jne 0x655cff
mov eax, dword [0x67f870]
cmp eax, 1
je 0x655cd9
test eax, eax
jne 0x655c02
cmp dword [0x67a318], 1
je 0x655cd9
cmp edx, 0xfc
je 0x655cff
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x655c39
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00652ad0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00652c80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x655c7c
lea eax, [ebp - 0x1a4]
push eax
call fcn.00652c80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x67e518
push edi
call fcn.00652d00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00652ad0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00652ae0
lea eax, [ebp - 0xa0]
push 0x67e4f8
push eax
call fcn.00652ae0
push dword [esi + 0x67a69c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00652ae0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00657de8
add esp, 0x2c
pop edi
jmp 0x655cff
lea eax, [ebp + 8]
lea esi, [esi + 0x67a69c]
push 0
push eax
push dword [esi]
call fcn.00652c80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x402aec
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004047a0
test esi, esi
jne 0x402b22
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404890
jmp 0x402b40
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029a0
mov edi, eax
test esi, esi
je 0x402b40
cmp dword [ebx], 0
je 0x402b40
dec esi
jmp 0x402b29
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4031d4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x48a008], 0x8088405
inc edx
mov dword [ebx + 0x48a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403354
Capabilities:
Clear file content

Disassembly:
movzx edx, word [eax + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x403372
push dword [eax]
call sub.kernel32.dll_SetEndOfFile
dec eax
je 0x40337c
jmp fcn.004028c4
mov eax, 0x67
jmp fcn.004028b4
ret

Function at 0x4038c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48a024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403958
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403938
xor eax, eax
push ebp
push 0x403931
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403974
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403938
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x48a024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48a024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404624
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48c04c], 0
je 0x404685
cmp word [0x48c220], 0xd7b2
jne 0x40464d
cmp dword [0x48c228], 0
jbe 0x40464d
mov eax, 0x48c21c
call dword [0x48c238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x48a09c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4046ac
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48a034], 0
jne 0x4046a1
push 0
push 0x48a094
push 0x48a09c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret