joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001000
Capabilities:
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jmp 0x10002b3c

Function at 0x10012ee7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001d01c]
jne 0x10012ef1
repz ret
jmp fcn.10013175

Function at 0x10015119
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100135e8
and dword [ebp - 4], 0
cmp dword [0x1003f638], 0
mov ebx, eax
jne 0x100151ca
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001527b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001a870
push edi
call esi
test eax, eax
je 0x1001527b
push eax
call fcn.10013576
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1003f638], eax
call esi
push eax
call fcn.10013576
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1003f63c], eax
call esi
push eax
call fcn.10013576
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1003f640], eax
call esi
push eax
call fcn.10013576
pop ecx
mov dword [0x1003f648], eax
test eax, eax
je 0x100151ca
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10013576
pop ecx
mov dword [0x1003f644], eax
mov eax, dword [0x1003f644]
cmp eax, ebx
je 0x10015222
cmp dword [0x1003f648], ebx
je 0x10015222
push eax
call fcn.100135f1
push dword [0x1003f648]
mov esi, eax
call fcn.100135f1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10015222
test edi, edi
je 0x10015222
call esi
test eax, eax
je 0x10015219
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10015219
test byte [ebp - 0xc], 1
jne 0x10015222
or dword [ebp + 0x10], 0x200000
jmp 0x1001525b
mov eax, dword [0x1003f63c]
cmp eax, ebx
je 0x1001525b
push eax
call fcn.100135f1
pop ecx
test eax, eax
je 0x1001525b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001525b
mov eax, dword [0x1003f640]
cmp eax, ebx
je 0x1001525b
push eax
call fcn.100135f1
pop ecx
test eax, eax
je 0x1001525b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1003f638]
call fcn.100135f1
pop ecx
test eax, eax
je 0x1001527b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001527d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xbc04f4f
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
push edi
mov dword [ebp - 0x100], eax
call dword [0xbc0c0d4]
xor ebx, ebx
lea esi, [eax + eax + 2]
mov dword [ebp - 0xf8], 0x67452301
mov dword [ebp - 0xf4], 0xefcdab89
mov dword [ebp - 0xf0], 0x98badcfe
mov dword [ebp - 0xec], 0x10325476
mov dword [ebp - 0xe8], 0xc3d2e1f0
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xe4], ebx
cmp esi, ebx
jbe 0xbc04fd7
lea eax, [ebx + edi]
push eax
xor eax, eax
inc eax
lea ecx, [ebp - 0xf8]
call fcn.0bc08768
inc ebx
pop ecx
cmp ebx, esi
jb 0xbc04fbf
lea eax, [ebp - 0x1c]
push eax
lea esi, [ebp - 0xf8]
call fcn.0bc087fe
pop ecx
push 0x80
push 0
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 8], 0
call fcn.0bc08d5e
and dword [ebp - 0x104], 0
mov esi, dword [0xbc0c160]
mov edi, dword [0xbc0c074]
mov byte [ebp - 0xf9], 0
mov ebx, 0xbc0df68
mov eax, dword [ebp - 0x104]
mov al, byte [ebp + eax - 0x1c]
add byte [ebp - 0xf9], al
movzx eax, al
push eax
push dword [ebp - 0x100]
lea eax, [ebp - 0x9c]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x9c]
push eax
push dword [ebp - 0x100]
call edi
inc dword [ebp - 0x104]
cmp dword [ebp - 0x104], 0x14
jl 0xbc0501d
movzx eax, byte [ebp - 0xf9]
push eax
push dword [ebp - 0x100]
lea eax, [ebp - 0x9c]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x9c]
push eax
push dword [ebp - 0x100]
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call int.0bc09fdc
leave
ret

Function at 0xbc088c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x44], 0x595f486a
mov dword [ebp - 0x40], 0x4e4a7843
mov dword [ebp - 0x3c], 0x74424b2d
mov dword [ebp - 0x38], 0x63495250
mov dword [ebp - 0x34], 0x64683331
mov dword [ebp - 0x30], 0x566e457a
mov dword [ebp - 0x2c], 0x44716151
mov dword [ebp - 0x28], 0x76366f53
mov dword [ebp - 0x24], 0x4f6b6d57
mov dword [ebp - 0x20], 0x41707572
mov dword [ebp - 0x1c], 0x67377334
mov dword [ebp - 0x18], 0x38473530
mov dword [ebp - 0x14], 0x4c6c6946
mov dword [ebp - 0x10], 0x55665862
mov dword [ebp - 0xc], 0x4d795a32
mov dword [ebp - 8], 0x65395477
call dword [0xbc0c10c]
add eax, 4
push eax
push 0x40
call dword [0xbc0c078]
mov esi, eax
push edi
push esi
call dword [0xbc0c074]
cmp byte [esi], 0
je 0xbc08992
mov eax, esi
mov dl, byte [eax]
xor ecx, ecx
cmp dl, byte [ebp + ecx - 0x44]
je 0xbc08980
inc ecx
cmp ecx, 0x40
jb 0xbc08972
jmp 0xbc0898c
add ecx, 0xfffffffe
and ecx, 0x3f
mov cl, byte [ebp + ecx - 0x44]
mov byte [eax], cl
inc eax
cmp byte [eax], 0
jne 0xbc0896e
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call int.0bc09fdc
leave
ret

Function at 0xbc08f95
Capabilities:
Encode data using xor

Disassembly:
not dword [eax + 0x4aeb764b]
cmp eax, 0xaa7b5831
inc esi
sub ch, byte [ebp + 0x34bb36a3]
add ecx, dword [edi]
jp 0xbc08fac
push ebp
push ebp
dec ebx
dec eax
xor dword [eax - 0xc], edx
jae 0xbc08fae
push esi
sti
Function at 0xbc08ff4
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0xfb
cwde
jae 0xbc0901c
add eax, 0x30964030
cmp al, cl
xor edx, dword [ebx + 0x3f03dfd1]
enter 0xffffffffffff9333, 0xffffffffffffffd1
fild word [ebx]
aas
add esi, dword [eax + 0x77]
sbb eax, 0x62200a66
jb 0xbc08fff
or ah, byte [eax]
bound esi, qword [edx - 0x11]
mov byte [esi], al
insd dword es:[edi], dx
lea esi, [0x63b4a919]
out dx, al
stosb byte es:[edi], al
test eax, 0x8c9eec7a
push ebp
push 0x5c
jp 0xbc0900a
sahf
mov word [ebp + 0x6a], ss
pop esp
mov ah, 0xcb
and ah, byte es:[ebx]
invalid
Function at 0x4071c6
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push edi
lea edi, [ebp - 0x190]
push 0x64
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x41f01c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20
pop ecx
mov esi, 0x4186c0
lea edi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
and dword [ebp - 0x98], 0
and dword [ebp - 0xa4], 0
cmp dword [ebp - 0xa4], 8
jae 0x40737f
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xa4]
movzx eax, byte [eax]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 8
jae 0x407262
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xa4]
movzx eax, byte [eax]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
jmp 0x407269
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xa4], 8
jae 0x40729f
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xa4]
movzx eax, byte [eax]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
jmp 0x4072a6
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xb0]
shr eax, 2
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp + 0xc]
mov ax, word [ebp + eax*2 - 0x8c]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xbc]
shr eax, 4
mov ecx, dword [ebp - 0xb0]
and ecx, 3
shl ecx, 4
or eax, ecx
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp + 0xc]
mov ax, word [ebp + eax*2 - 0x8c]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xc8]
shr eax, 6
mov ecx, dword [ebp - 0xbc]
and ecx, 0xf
shl ecx, 2
or eax, ecx
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp + 0xc]
mov ax, word [ebp + eax*2 - 0x8c]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xc8]
and eax, 0x3f
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp + 0xc]
mov ax, word [ebp + eax*2 - 0x8c]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
jmp 0x40720c
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
push 0x3d
pop eax
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp + 0xc]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
xor eax, eax
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp + 0xc]
mov word [edx + ecx*2], ax
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x4073de]
call fcn.00413f70
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413feb
mov esp, ebp
pop ebp
ret
Function at 0x414020
Capabilities:
Encode data using xor

Disassembly:
or al, 0x2d
sub ebp, dword [ebp - 0x5e]
les edi, [esi - 0x45]
les esp, [0x802472b]
jl 0x414079
scasb al, byte es:[edi]
adc esi, dword [esi + 0x42427ce1]
sub dh, al
sbb byte [esi - 0x31], dl
inc ecx
xor al, 0xb6
pop bp
mov dh, 0x74
jnp 0x41403a
push esi
iretd
push esi
xor esp, dword [edx]
das
and dh, byte [esi]
mov dl, 0x4b
mov byte [0xf5d8954a], al
cmpsb byte [esi], byte es:[edi]
mov ss, word [edx + 0x31]
add byte [edx], 0x4d
xor byte [edx + 0x1024902], al
add dword [eax], esi
add dword [esi + 0xb317230], 0x3060930
push ebp
add al, 6
adc eax, dword [edx]
push ebp
push ebx
xor dword [0x3061330], edx
push ebp
add al, 0xa
adc ecx, dword [esp + eax*2]
imul esp, dword [edi + 0x69], 0x74726543
and byte [ecx + 0x6e], cl
arpl word [ecx], si
sbb dword [eax], esi
pop ss
push es
add edx, dword [ebp + 4]
or edx, dword [ebx]
adc byte [edi + 0x77], dh
ja 0x4140c6
imul esp, dword fs:[edi + 0x69], 0x74726563
arpl word cs:[edi + 0x6d], bp
xor dword [ecx], esi
xor byte [edi], ch
push es
add edx, dword [ebp + 4]
add edx, dword [ebx]
sub byte [ecx + ebp*2 + 0x67], al
imul eax, dword [ebx + 0x65], 0x53207472
dec eax
inc ecx
xor ah, byte [eax]
inc ecx
jae 0x414133
jne 0x414134
and byte fs:[ecx + 0x44], cl
inc esp
and byte [ecx + ebp*2 + 0x6d], dl
jae 0x414142
popal
insd dword es:[edi], dx
jo fcn.0041413b
outsb dx, byte [esi]
and byte [bp + di + 0x41], al
add dl, byte [eax]
or eax, 0xbee04a42
cmp cl, byte [eax + 0x214060ff]
into
adc al, 0
invalid
xor al, 0x5a
pop edx
xor byte [ebx], ch
add cl, byte [ecx + esi]
Function at 0x101e5b64
Capabilities:
Encode data using xor

Disassembly:
call fcn.10188b54
bsf bx, si
btc bx, sp
add dword [ebp - 4], ecx
stc
sub ecx, 8
rol di, 1
xor bh, 0xbc
shr ecx, 1
shr di, 0xd
mov edi, dword [esi]
shr bh, 3
add edi, dword [ebp + 0x10]
test ah, 0x10
add esi, 8
shl bl, 5
stc
bsf bx, bx
rol bh, 1
mov bx, word [esi]
cmp ebp, 0xb12db1ed
pushal
pushfd
cmc
shr ebx, 0xc
bt eax, 1
test dh, ah
cmp ebx, 1
mov word [esp], 0x18f5
lea esp, [esp + 0x24]
je 0x101e6833
bt dx, 1
clc
cmp ebx, 2
pushfd
jmp 0x101e5c5f
mov byte [esp], 0x5b
pushal
lea esp, [esp + 0x40]
call fcn.101dca6d
push 0xe3c33a70
jmp 0x101dc46c
jmp 0x1018630e
call fcn.1019da0c
add byte [eax], al
push ebx
je 0x10188bde
jb 0x10188bf3
push eax
popal
push eax
jb 0x10188bef
outsb dx, byte [esi]
je 0x10188bee
jb 0x10188b8b
mov word [esp + 4], 0x37cf
mov dword [esp + 0x20], ebx
jmp 0x1018774b
out 0x43, al
jmp 0x10188c0f
jb 0x10188c10
and byte [edx], ch
or eax, 0xaf73b56a
sub cl, byte [0xaf73b56a]
mov ch, 0x73
scasd eax, dword es:[edi]
invalid
xor al, 0x1b
pop ecx
mov ah, byte ds:[ecx + 0x7ae829e2]
sbb ebx, dword [ecx + 0x3e]
mov ah, byte [ecx + 0x7ae829e2]
mov word [edi], cs
jbe 0x10188c67
push eax
stosb byte es:[edi], al
jb 0x10188bf0
pop ecx
lds ecx, [ebx + ebx - 0x7a]
add byte [edx], ch
test byte [ecx - 0x1d152572], al
test ebp, 0x76449395
add dword [ebp - 0x732e3f81], ebx
pop edi
mov al, 0x39
sbb ebx, dword [edi]
mov ebx, 0xd850a307
and dh, ah
stosd dword es:[edi], eax
dec ebp
adc esp, eax
test eax, 0x5f376ac8
sub ah, dl
mov esp, 0xb5e69482
dec ebx
sub ecx, ebp
mov bl, byte [edx - 0x46]
invalid
cmp al, 0xbc
out 0x54, al
fistp dword [ebp - 0x23]
xchg ebx, eax
fldenv [edi]
push ecx
les ebx, [esi]
cwde
jmp 0x10188cac
ret 0x5aae
lea esp, [esp + 0x24]
je 0x1019eea3
rol di, 8
jmp 0x1011dc72
cmp ebx, 3
mov byte [esp + 4], ch
lea esp, [esp + 8]
je 0x1011d6ba
push 0x973165dd
push ebx
lea esp, [esp + 8]
jmp 0x10188b73
pushal
jmp 0x101db75e
push esp
jmp 0x101e7b3d
test bl, bl
sal bl, 5
btc bx, 8
mov bx, word [esi]
cmp bl, 0x67
and ebx, 0xfff
cmp dh, 0x7e
stc
stc
add word [ebx + edi], ax
push 0x1153840d
mov word [esp], sp
push ebp
pushal
lea esp, [esp + 0x28]
jmp 0x10188b73
pushfd
pushal
movsx bx, cl
lea esp, [esp + 8]
je 0x101e6f61
push edi
push edi
jmp 0x101e289b
Function at 0x10003200
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10019154]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push str.Shell32.dll
mov dword [ebp - 0x210], eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10003284
push str.SHGetKnownFolderPath
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003279
lea ecx, [ebp - 0x214]
push ecx
push edi
push edi
push ebx
call eax
test eax, eax
jne 0x10003279
mov edx, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x210]
push edx
call fcn.100031b0
mov eax, dword [ebp - 0x214]
push eax
mov edi, 1
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
jne 0x100032e8
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x20c]
push ecx
push 1
push 0
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x100032e8
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
jmp 0x100032b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100032b0
mov ecx, dword [ebp - 0x210]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.100029a0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100074e7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100074e7
mov esp, ebp
pop ebp
ret
Function at 0x10004980
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0x5c
lea esi, [ecx + 4]
push 0
push esi
call fcn.10006920
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
xor eax, eax
pop esi
ret
Function at 0x10006870
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x70
push 0
push ebx
mov dword [ebp - 0x20], 0x6a09e667
mov dword [ebp - 0x1c], 0xbb67ae85
mov dword [ebp - 0x18], 0x3c6ef372
mov dword [ebp - 0x14], 0xa54ff53a
mov dword [ebp - 0x10], 0x510e527f
mov dword [ebp - 0xc], 0x9b05688c
mov dword [ebp - 8], 0x1f83d9ab
mov dword [ebp - 4], 0x5be0cd19
call fcn.10007510
add esp, 0xc
mov edi, ebx
mov ecx, 8
lea esi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov byte [ebx + 0x6c], 0x20
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100074e7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10019154]
jne 0x100074f1
repz ret
jmp fcn.1000b33f

Function at 0x1000ee81
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10019154]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000bd3c
and dword [ebp - 0x14], 0
cmp dword [0x1001ae40], 0
mov dword [ebp - 0x18], eax
jne 0x1000ef34
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000efdc
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000efdc
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1001ae40], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1001ae44], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1001ae48], eax
call edi
push eax
call esi
mov dword [0x1001ae50], eax
test eax, eax
je 0x1000ef34
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1001ae4c], eax
mov eax, dword [0x1001ae4c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000ef8d
cmp dword [0x1001ae50], ecx
je 0x1000ef8d
push eax
call esi
push dword [0x1001ae50]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000ef8d
test ebx, ebx
je 0x1000ef8d
call edi
test eax, eax
je 0x1000ef84
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000ef84
test byte [ebp - 8], 1
jne 0x1000ef8d
or dword [ebp + 0x10], 0x200000
jmp 0x1000efc0
mov eax, dword [0x1001ae44]
cmp eax, dword [ebp - 0x18]
je 0x1000efc0
push eax
call esi
test eax, eax
je 0x1000efc0
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000efc0
mov eax, dword [0x1001ae48]
cmp eax, dword [ebp - 0x18]
je 0x1000efc0
push eax
call esi
test eax, eax
je 0x1000efc0
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1001ae40]
call esi
test eax, eax
je 0x1000efdc
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000efde
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100074e7
leave
ret
Function at 0x9a2400
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x37f000]
mov dword [edi + 0x41c5a8], 0x321b10cb
push edi
jmp 0x9a242a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9a2431
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9a2420
mov eax, 1
add ebx, ebx
jne 0x9a2443
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9a2454
jne 0x9a2473
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9a2473
dec eax
add ebx, ebx
jne 0x9a2460
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9a2438
add ebx, ebx
jne 0x9a246f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x9a24c5
xor ecx, ecx
sub eax, 3
jb 0x9a248b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9a24fa
sar eax, 1
mov ebp, eax
jmp 0x9a2496
add ebx, ebx
jne 0x9a2496
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9a2464
inc ecx
add ebx, ebx
jne 0x9a24a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9a2464
add ebx, ebx
jne 0x9a24b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9a24a6
jne 0x9a24c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9a24a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9a24e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9a24d6
jmp 0x9a2426
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9a24e4
add edi, ecx
jmp 0x9a2426
pop esi
mov edi, esi
mov ecx, 0x197b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9a2502
cmp byte [edi], 0x82
jne 0x9a2502
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9a2507
lea edi, [esi + 0x59d000]
mov eax, dword [edi]
or eax, eax
je 0x9a257f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5c09c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5c0b98]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9a2534
mov ecx, edi
jns 0x9a2563
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5c0ba0]
or eax, eax
je 0x9a2579
mov dword [ebx], eax
add ebx, 4
jmp 0x9a2551
call dword [esi + 0x5c0b9c]
mov ebp, dword [esi + 0x5c0ba4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x287]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9a25b3
sub esp, 0xffffff80
jmp 0x68aae5
Function at 0x402c78
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402cb5
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402cd5
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004045ac
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402fc4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x463008], 0x8088405
inc edx
mov dword [ebx + 0x463008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40341c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x463024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4034b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403494
xor eax, eax
push ebp
push 0x40348d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4034d0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403494
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x463024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x463024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4041b8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46704c], 0
je 0x404219
cmp word [0x467220], 0xd7b2
jne 0x4041e1
cmp dword [0x467228], 0
jbe 0x4041e1
mov eax, 0x46721c
call dword [0x467238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x463070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404240
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x463034], 0
jne 0x404235
push 0
push 0x463068
push 0x463070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret