joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408087
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x41eac0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
jne 0x4080cb
call esi
test eax, eax
je 0x4080b0
mov dword [0x41eac0], 1
jmp 0x4080d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4080c7
mov dword [0x41eac0], 2
jmp 0x4080d9
xor eax, eax
jmp 0x40812f
cmp eax, 1
jne 0x4080d4
call esi
jmp 0x40812f
cmp eax, 2
jne 0x4080c7
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push eax
push 1
push 0
mov dword [ebp - 8], eax
call esi
mov edi, eax
test edi, edi
je 0x40812c
push 2
push edi
call fcn.00407185
pop ecx
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x40812c
push edi
push eax
push 0xffffffffffffffff
push dword [ebp - 8]
push 1
push 0
call esi
test eax, eax
je 0x408123
mov eax, dword [ebp - 4]
jmp 0x40812e
push dword [ebp - 4]
call fcn.0040686f
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x4087b0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x4022ac
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x408802
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402318
push edi
call esi
push 0x40230c
push edi
mov dword [0x41eac4], eax
call esi
push 0x402300
push edi
mov dword [0x41eac8], eax
call esi
push 0x4022f8
push edi
mov dword [0x41eacc], eax
call esi
mov dword [0x41ead0], eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [0x41eac4], ebx
je 0x408828
cmp dword [0x41eac8], ebx
je 0x408828
cmp dword [0x41eacc], ebx
je 0x408828
cmp dword [0x41ead0], ebx
jne 0x40884c
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x41eac8], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x41eac4], 0x408474
mov dword [0x41eacc], esi
mov dword [0x41ead0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x41d18c], eax
cmp eax, 0xffffffff
je 0x4088bf
push dword [0x41eac8]
push eax
call esi
test eax, eax
je 0x4088bf
call fcn.00407772
push dword [0x41eac4]
call fcn.00408376
push dword [0x41eac8]
mov dword [0x41eac4], eax
call fcn.00408376
push dword [0x41eacc]
mov dword [0x41eac8], eax
call fcn.00408376
push dword [0x41ead0]
mov dword [0x41eacc], eax
call fcn.00408376
add esp, 0x10
mov dword [0x41ead0], eax
call fcn.0040dd40
test eax, eax
jne 0x4088c5
call fcn.004084b1
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x408660
push dword [0x41eac4]
call fcn.004083fc
pop ecx
call eax
mov dword [0x41d190], eax
cmp eax, 0xffffffff
je 0x4088ba
push 0x214
push 1
call fcn.0040f44b
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x4088ba
push esi
push dword [0x41d190]
push dword [0x41eacc]
call fcn.004083fc
pop ecx
call eax
test eax, eax
jne 0x408918
push esi
call fcn.0040686f
pop ecx
jmp 0x4088ba
push ebx
push esi
call fcn.004084f3
or dword [esi + 4], 0xffffffff
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x4088c1
Function at 0x40f16e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004083ee
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
cmp dword [0x41efbc], ebx
jne 0x40f247
push ebx
push ebx
push 0x402490
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
jne 0x40f1b2
xor eax, eax
jmp 0x40f30b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402484
push edi
call esi
cmp eax, ebx
je 0x40f1ab
push eax
call fcn.00408376
mov dword [esp], 0x402474
push edi
mov dword [0x41efbc], eax
call esi
push eax
call fcn.00408376
mov dword [esp], 0x402460
push edi
mov dword [0x41efc0], eax
call esi
push eax
call fcn.00408376
mov dword [0x41efc4], eax
lea eax, [ebp - 8]
push eax
call fcn.0040752d
pop ecx
pop ecx
test eax, eax
je 0x40f215
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00408b31
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40f247
push 0x402444
push edi
call esi
push eax
call fcn.00408376
pop ecx
mov dword [0x41efcc], eax
cmp eax, ebx
je 0x40f247
push 0x40242c
push edi
call esi
push eax
call fcn.00408376
pop ecx
mov dword [0x41efc8], eax
mov eax, dword [0x41efc8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40f2c0
cmp dword [0x41efcc], esi
je 0x40f2c0
push eax
call fcn.004083fc
pop ecx
call eax
cmp eax, ebx
je 0x40f28d
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x41efcc]
call fcn.004083fc
pop ecx
call eax
test eax, eax
je 0x40f28d
test byte [ebp - 0x18], 1
jne 0x40f2c0
lea eax, [ebp - 0xc]
push eax
call fcn.0040756e
pop ecx
test eax, eax
je 0x40f2a8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00408b31
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40f2b7
or dword [ebp + 0x10], 0x200000
jmp 0x40f2f1
or dword [ebp + 0x10], 0x40000
jmp 0x40f2f1
mov eax, dword [0x41efc0]
cmp eax, esi
je 0x40f2f1
push eax
call fcn.004083fc
pop ecx
call eax
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x40f2f1
mov eax, dword [0x41efc4]
cmp eax, esi
je 0x40f2f1
push dword [ebp - 4]
push eax
call fcn.004083fc
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x41efbc]
call fcn.004083fc
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419142
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x41f0b4]
push esi
mov esi, 0x4031b0
test eax, eax
je 0x41916e
push dword [ebp + 8]
push esi
push eax
call fcn.004197ae
push dword [0x41f0b4]
call fcn.00415beb
add esp, 0x10
cmp dword [0x41e444], 0
je 0x419180
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x41f0b0], 0
je 0x419194
push dword [ebp + 8]
push esi
call fcn.00419718
pop ecx
pop ecx
pop esi
pop ebp
ret 4
Function at 0x10008403
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10008412
pop dword [ebp - 0x1c]
mov eax, 0x10008412
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x6753d350
sub dword [ebp - 0x2c], 0x19018e05
mov dword [ebp - 0x28], 0x3a492e61
sub dword [ebp - 0x28], 0x815e21c
mov dword [ebp - 0x24], 0x1f310e9f
add dword [ebp - 0x24], 0x2d1b358f
mov dword [ebp - 0x20], 0xdf4fbe8f
add dword [ebp - 0x20], 0x20b04171
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xda234069
sub eax, 0xca228fed
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x115018c5
sub dword [ebp - 0x2c], 0x9cddaf6f
mov dword [ebp - 0x28], 0xb57a9c38
add dword [ebp - 0x28], 0x8bf1c53d
mov dword [ebp - 0x24], 0x60576707
sub dword [ebp - 0x24], 0xfce7fa9b
mov dword [ebp - 0x20], 0xe985f7b3
add dword [ebp - 0x20], 0x167a084d
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xde8b5024
add eax, 0x31756074
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ab70
push 0
call eax
mov ecx, 0x537f
xor esi, esi
add esi, eax
mov edx, 0x10019600
add edx, dword [ebp - 0x1c]
mov edi, 0x9aa8c91c
add dword [ebp - 0x10], edi
mov ebx, dword [edx]
add dword [ebp - 0x10], esi
add ebx, edi
add dword [ebp - 8], 0xdf36d37d
mov dword [esi], ebx
xor dword [ebp - 0xc], 0x43e41614
add esi, 4
add edx, 0x60f5b998
add edx, 0x9f0a466c
loop 0x1000851f
add eax, 0xf65d125e
add eax, 0x9a42e71
mov ebx, eax
add eax, 0xf08157c1
add eax, 0xf7ea844
mov ecx, 0x43395115
sub ecx, 0x33395115
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x100089c1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8

Function at 0x10008de5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push edi
mov edi, ecx
cmp eax, 0x1a
jl 0x10008e3e
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x10008e3e
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x18]
call ebx
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
push 0x10
sub edx, eax
push edx
mov edx, dword [esi + 8]
sub edx, ecx
push edx
push eax
push ecx
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.10008403
push 1
push dword [edi + 0x18]
call ebx
pop ebx
pop edi
pop esi
pop ebp
ret 4

Function at 0x10009710
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10014d34]
jne 0x1000971a
repz ret
jmp fcn.10009ea3
Function at 0x415349
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x415358
pop dword [ebp - 0x30]
mov eax, 0xf0f0d7f3
add eax, 0xf507b65
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3e192
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xd1e47c5f
sub ecx, 0xd1e43469
mov ebx, eax
mov edx, 0x256e37f
add edx, 0xfdec7081
add edx, dword [ebp - 0x30]
mov edi, 0xafb46ec5
sub edi, 0x1e5fdc9a
xor dword [ebp - 0x24], 0xc2d92a6c
mov esi, dword [edx]
add dword [ebp - 0x28], 0x8b86a449
sub esi, edi
sub dword [ebp - 0x14], edi
mov dword [ebx], esi
add dword [ebp - 0x2c], 0xd357003c
add ebx, 4
add edx, 0x3794e6af
sub edx, 0x3794e6ab
loop 0x4153b2
add eax, 0x96ae05ee
add eax, 0x69530cbd
xor ebx, ebx
add ebx, eax
add eax, 0x117688ef
sub eax, 0x117688ea
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x49a9f8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x49aa04
pop ebp
ret
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004a06f8

Function at 0x4a06d8
Capabilities:
Packed with generic packer

Disassembly:
in eax, 0x68
mov dh, 0x32
mov al, 0xab
enter 0xfffffffffffff83d, 0xffffffffffffff98
daa
dec esp
mov ecx, 0xdf7530e5
mov ecx, eax
fnstsw word [esi + 0x62]
jge 0x4a06bb
bound edi, qword [ebp + 0x58]
jg 0x4a0682
add ebx, eax
les ebp, [edx - 0x701c9e96]
push edx
inc ecx
fisub word [edi + 0x44]
jns 0x4a0660
xchg ecx, eax
push esp
or esp, 0xffffffac
adc edi, dword [esi]
lodsd eax, dword [esi]
pop es
dec edi
mov esp, 0xdf4bc90
jne 0x4a06c7
or eax, 0xe4404275
adc dword [edi - 0x3f], edi
inc eax
in al, 0x11
jg 0x4a064b
dec ebp
invalid
stosd dword es:[edi], eax
out dx, al
adc byte [ebx + 0x7d], dl
xor byte [0xc57dbf3d], bh
wait
and byte [ebx + 0x2420d28], dl
das
inc edx
add ch, byte [edi]
sahf
push ebp
jb 0x4a0726
lodsd eax, dword [esi]
jo 0x4a06ca
push eax
dec esp
jo 0x4a06fb
jbe 0x4a0737
insb byte es:[edi], dx
xor bl, byte [ecx + 0x36]
or eax, 0x2fe0bed0
lodsd eax, dword [esi]
xlatb
or dword [eax + eax*4], esi
sbb al, 0x42
xor byte [eax + 0x7c], dh
jo 0x4a0759
out dx, eax
and byte [ecx + 0x78], 0xe1
xor dword [esi + eax*4], esi
push ss
push ebx
jmp 0x4a066d
mov al, 0xdd
rcr byte [ebx + 0x76], 0x73
nop
dec ecx
jge 0x4a06a9
dec ecx
in eax, dx
push eax
fsub qword [eax]
inc edx
jmp 0x4a074b
jmp 0x9c49e7
in eax, 0x3f
fnstenv [esi + 0x1b90fb34]
cwde
pop edx
shr byte [esi], cl
push edi
pushfd
out dx, eax
jecxz 0x4a06db
loop 0x4a077f
mov dh, 0x3d
pop ss
pop ds
xor ebp, dword [esi + 4]
imul esi, dword [esi], 0x20032c18
dec esp
sub al, 3
and byte [ebp + esi*4 - 0x2c], cl
mov ch, 0xd4
xchg dword [ecx - 0x660f524a], ecx
in eax, dx
jecxz 0x4a074f
cmc
int 0xc5
lodsb al, byte [esi]
invalid
cdq
xchg ebp, eax
nop
xor dword [esp + eax*4 + 0x48], eax
rcl byte [eax + 0x7d]
pop esp
jge 0x4a072d
push edi
add ah, dl
push 0xffffffffffffffd1
jb 0x4a07c4
arpl word [ebp + 0x44], bx
popal
arpl word [ecx - 0x54], cx
test byte [ecx - 0x6fb2370f], dh
jp 0x4a07f3
mov al, byte [0x5f4d9d7c]
insb byte es:[edi], dx
sub eax, 0x5d18fc00
or byte [ecx + 0x2e], al
cdq
test al, 0xac
int1
push es
hlt
mov ebp, 0x4d6c8df8
and dword [ecx + esi*2 + 0x111100bd], esi
cmpsb byte [esi], byte es:[edi]
popal
mov esp, 0x9d2885a3
adc dword [ebp + 0x31a07e2b], ebp
xor byte [edx - 0x10], bh
rcr byte [edx - 0x33], cl
popal
invalid
retf
sbb edx, ebp
Function at 0x5cc458
Capabilities:
Encode data using xor

Disassembly:
xchg al, bl
push ecx
stosd dword es:[edi], eax
adc eax, 0x6abad76f
pop ecx
inc ecx
cmp dword [edi + 0xc], esi
inc ebp
inc edx
mov ecx, 0x6262610
cmc
fidiv word [edi + 0x67]
cdq
mov ebx, 0xca000704
jo 0x5cc4f8
xchg ebx, eax
jecxz 0x5cc4fb
mov edi, 0x3750538d
cmp al, 0x3a
pop esi
cwde
pushfd
and byte [esi + 0x622a0ff1], bh
cvtpi2ps xmm4, qword [edx + 0x1d]
rcl byte [esp + ebp*8], cl
shr dword [esi - 0x3f], 0x98
add ah, byte fs:[ebp - 0x31]

Function at 0x615f98
Capabilities:
Encode data using xor

Disassembly:
wait
mov bl, 0xe5
xchg ebx, eax
in eax, 0x93
xlatb
mov ebx, dword [ebx + 0x5c7bdd1b]
pop eax
jle 0x615f9a
outsb dx, byte [esi]
jg 0x615fc7
add byte [ebx + 0x580c0c9e], 0x35
pop edi
aad 0x3e
fsub st(6), st(0)
push esp
inc edi
jmp 0x615fef
push ds
lcall 0x8fbf, 0x958b9250
retf 0x8751
popal
das
test ebp, ebx
jmp 0x61601b
add bh, bh
sar edi, cl
mov edx, 0xc86aa5f6
invalid
Function at 0x40d9b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40d9d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40d9d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40d9c8
mov eax, 1
add ebx, ebx
jne 0x40d9eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40d9e0
jne 0x40d9fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d9e0
xor ecx, ecx
sub eax, 3
jb 0x40da10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40da82
mov ebp, eax
add ebx, ebx
jne 0x40da1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40da28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40da4c
inc ecx
add ebx, ebx
jne 0x40da38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40da2d
jne 0x40da49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40da2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40da6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40da5d
jmp 0x40d9ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40da6c
add edi, ecx
jmp 0x40d9ce
pop esi
mov edi, esi
mov ecx, 0x4a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40da8a
cmp byte [edi], 2
jne 0x40da8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40da8f
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40db07
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd8c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd904]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40dabc
mov ecx, edi
jns 0x40daeb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd908]
or eax, eax
je 0x40db01
mov dword [ebx], eax
add ebx, 4
jmp 0x40dad9
call dword [esi + 0xd910]
mov ebp, dword [esi + 0xd90c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40db3b
sub esp, 0xffffff80
jmp 0x4014a0
Function at 0x6791b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00679140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00679140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00679140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00679140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x679bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x679c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x68b87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x679c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x679c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x4ba839
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33d8
cmp edx, dword [eax]
je 0x4ba85b
add eax, 8
inc ecx
cmp eax, 0x4c3468
jl 0x4ba84c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33d8]
jne 0x4ba989
mov eax, dword [0x4c7d5c]
cmp eax, 1
je 0x4ba963
test eax, eax
jne 0x4ba88c
cmp dword [0x4c3300], 1
je 0x4ba963
cmp edx, 0xfc
je 0x4ba989
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba8c3
lea eax, [ebp - 0x1a4]
push 0x4bfa48
push eax
call fcn.004bb220
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb6b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba906
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb6b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfa44
push edi
call fcn.004bd580
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfa28
push eax
call fcn.004bb220
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb230
lea eax, [ebp - 0xa0]
push 0x4bfa24
push eax
call fcn.004bb230
push dword [esi + 0x4c33dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb230
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bf9fc
push eax
call fcn.004bd4f4
add esp, 0x2c
pop edi
jmp 0x4ba989
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33dc]
push 0
push eax
push dword [esi]
call fcn.004bb6b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x675008], 0x8088405
inc edx
mov dword [ebx + 0x675008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d1c0
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d1f1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d1d9
add dl, dl
jne 0x41d1fc
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d24d
xor eax, eax
add dl, dl
jne 0x41d209
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d2ea
add dl, dl
jne 0x41d218
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d223
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d22e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d239
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d243
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d1e8
mov eax, 1
add dl, dl
jne 0x41d25b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d266
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d252
sub eax, ebx
mov ebx, 1
jne 0x41d299
mov ecx, 1
add dl, dl
jne 0x41d27f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d28a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d276
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d1e8
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d2b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d2bb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d2a7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d1e8
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d30b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d1e8
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f31c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x65880a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f36b
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f38a
mov ecx, edx
add ecx, ebx
jmp 0x41f38a
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f38a
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f3fc
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f3e5
test esi, esi
jbe 0x41f3fc
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f3d7
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f3fc
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f3b4
jmp 0x41f3fc
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f3fc
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658811
ret