joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e83fa
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
movdqa xmm1, xmmword [eax]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
movdqa xmm0, xmmword [edi]
pxor xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
pxor xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
pxor xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pxor xmm1, xmm0
movdqa xmmword [esi], xmm1
cmp ebx, 1
jbe 0x4e849e
add edi, 0x10
dec ebx
lea esp, [esp]
movdqa xmm0, xmmword [edi]
movdqa xmm1, xmmword [eax]
aesenc xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenc xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenc xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
add edi, 0x10
dec ebx
aesenc xmm1, xmm0
movdqa xmmword [esi], xmm1
jne 0x4e845a
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
movdqa xmm1, xmmword [eax]
add ebx, ebx
movdqa xmm0, xmmword [edi + ebx*8]
aesenclast xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenclast xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenclast xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pop edi
aesenclast xmm1, xmm0
movdqa xmmword [esi], xmm1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5b683a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.005015ed
call fcn.004efec1
cmp eax, esi
pop esi
jne 0x5b6856
mov ecx, 0x10196b60
jmp fcn.004fa6ec
ret
Function at 0x73051f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
jmp 0x730557
add ebp, dword [esi]
mov dl, byte [esp]
bt ebx, ebx
jns 0x7305ef
js 0x7305ac
jl 0x7305a2
salc
inc ecx
ret
lea esp, [esp + 0x14]
dec ebp
lea edx, [eax + ecx]
lea edx, [esi + esi]
xchg dh, bl
jmp 0x730541
dec edx
mov dword [edx - 0x11], ebp
mov bx, cx
jmp fcn.0073058e
mov bx, cx
call fcn.00730a91
loope 0x7305fb
fdecstp
salc

Function at 0x730be9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
call 0x730abd
mov ax, word [esp]
lea edx, [edi + 0xbe60]
bswap edx
btr edx, edi
jmp 0x730f81
pushfd
pop ax
pop ax
jmp 0x730c38
inc bl
mov edx, esp
not ax
setl dh
pushal
jmp 0x730cdd
pop ax
jmp 0x730c38
neg bl
pushfd
xchg al, dl
mov ax, 0x477
xchg byte [esp], dl
jmp 0x730c8d
mov eax, dword [esp]
rdtsc
mov edx, dword [esp]
pushfd
lea esp, [esp + 4]
jmp 0x730c52
sub esi, 4
sub esp, 1
js 0x730cb1
bsr dx, si
jmp 0x730c98
and ebx, 0x3c
xchg dx, ax
rdtsc
mov ah, 0x9d
jmp 0x730c77
lea esp, [esp]
lea esp, [esp + 1]
jmp 0x730cbc
bsr dx, si
lea esp, [esp]
lea esp, [esp + 1]
mov eax, dword [ebx + edi]
lea ebx, [ebx*4]
jmp 0x730d2b
xchg byte [esp + 2], al
lea esp, [esp + 0x20]
dec bl
mov dh, byte [esp]
mov ah, 0x12
jmp 0x730c68
lea esp, [esp + 3]
jmp 0x730d14
lea ebx, [esi*4]
mov bl, byte [esp + 0xc]
jmp 0x730cf1
mov dword [esi], eax
setbe bl
push cx
inc bx
js 0x730e32
bswap ebx
jmp 0x730d57
sub esp, 0x1f
jg 0x730d07
lea ebx, [esi*4]
mov bl, byte [esp + 0xc]
lea esp, [esp + 3]
jmp 0x730d14
lea esp, [esp + 2]
jmp fcn.00730d41
bswap ebx
lea esp, [esp + 2]
jmp fcn.00730d41
jmp 0x730da5
je 0x730c0f
pushfd
pop ax
jmp 0x730c4e

Function at 0x731992
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
jmp 0x7319c5
add bl, cl
pushal
push dx
bsr ax, si
jo 0x7319af
setge al
lea esp, [esp + 2]
jmp 0x731a0e

Function at 0x731a36
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0x7318f9
jne 0x7318f9
pop es
test dword [0xb73d8f7c], edx
movsb byte es:[edi], byte ss:[esi]
ret
mov esp, ebx
pushfd
jmp 0x73198a
pop ecx
jmp 0x731934
mov ecx, edx
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x731901
pop edi
pop esi
popfd
jmp 0x73191e
push ecx
mov esi, eax
mov edi, ebx
jmp 0x731917
lea edi, [edx + ebx - 0x40]
push esi
push edi
jmp 0x731955
lea esp, [esp + 2]
sub ebx, edx
cmc
jmp 0x7318e3

Function at 0x731a42
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror dx, cl
jae 0x731a7d
push dword [esp]
mov dx, 0x2bae
jmp 0x731a7f
jmp 0x731a67

Function at 0x731ca4
Capabilities:
Execute anti-debugging instructions

Disassembly:
and bl, 0xfc
push bp
call fcn.00731a36
lea ebx, [esi - 0x80]
jmp 0x731c53
Function at 0x73221b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
jmp 0x73222a
rol bl, cl
jp 0x732202
push word [esp + 1]
jmp 0x733258
mov edx, ebx
lea esp, [esp + 2]
jmp 0x73309a
cmc
mov edx, dword [esp]
add bl, cl
jmp 0x73228b
sub esp, 0xe
jp 0x732264
mov ax, word [esp + 6]
lea eax, [eax - 0xf47c]
jmp 0x7322c7
rdtsc
jmp 0x732240
mov ax, word [esp + 6]
lea eax, [eax - 0xf47c]
jmp 0x732275
bsf eax, ebx
setno al
neg ax
lea esp, [esp + 2]
jmp 0x73232a
mov eax, ebx
xchg edx, eax
mov ax, cx
mov dl, bl
mov eax, dword [esp]
jmp 0x732248
bsf eax, ebx
setno al
neg ax
call fcn.007322ae
sbb esi, ebp
neg al
bts ax, si
xchg dword [esp + 4], edx
jmp 0x732350
lea edx, [ecx + 0x96]
jmp 0x732491
mov ah, byte [esp]
mov eax, dword [esp]
stc
jmp 0x732335
lea esp, [esp + 0xc]
inc dl
cmc
jge 0x732314
jl 0x73237b
add dl, 0x47
lea eax, [esp + esi]
mov al, byte [esp]
mov ax, 0xa04d
mov eax, ebx
jmp 0x732365
mov eax, 0xec487f87
xchg ah, al
mov ax, word [esp]
bt eax, esi
push dword [esp + 4]
ret 8
mov ax, bp
push esp
xchg al, ah
call fcn.00732384
mov ah, byte [esp]
mov eax, dword [esp]
stc
jmp 0x732335
mov dl, bl
rol dx, cl
lea edx, [esp + eax]
jmp 0x732309
movzx ebx, byte [eax]
mov dl, bl
rol dx, cl
lea edx, [esp + eax]
lea edx, [ecx + 0x96]
xchg dx, ax
bsf dx, dx
jg 0x732260
rdtsc
cmc
mov edx, dword [esp]
jmp 0x732244
add eax, 0xffffffff
jno 0x732480
movzx ebx, byte [eax]
jmp 0x7323cf
mov eax, ebp
jmp 0x73262d
mov edx, ebx
lea esp, [esp + 2]
jmp 0x73309a

Function at 0x73799b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x1b], eax
mov byte [esp + 0x18], ch
lea ebp, [ebp + 1]
push ecx
mov byte [esp + 2], al
jmp 0x7379c3
mov byte [esp], dl
xchg dword [esp + 4], ebp
pushal
mov byte [esp + 0x1e], bl
mov dword [esp + 0x12], ecx
jmp 0x737985
xchg dword [esp + 0x28], ebp
pushal
call fcn.007379ad
lea ecx, [ecx + edx]
xchg bp, si
jmp 0x7379f1
mov bp, ax
jmp 0x737a9e
btc ax, sp
mov ebp, dword [esp + 0x2c]
lea esi, [ebx*4]
stc
je 0x737a24
jne 0x737a0e

Function at 0x737a09
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0073799b
btc ax, sp
call fcn.00737a6d
mov esp, 0x7c43552
or byte [ecx + 0x388b7819], cl
test al, 0x66
btc eax, esp
jmp 0x737acc
lea edi, [esp]
call fcn.00737ab6

Function at 0x737ad4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, 0xdb
mov ebx, 0xbaded1e3
rdtsc
mov eax, dword [esp]
xchg dword [esp], ebp
jmp 0x737b00
rdtsc
xchg cx, si
lea esi, [ecx*4]
call fcn.00737c80
add al, 0x8e
sbb al, 0x7b
xchg esi, eax
and byte [esi + 0x25d6b323], dl
xchg ebx, eax
out 0x11, al
nop

Function at 0x75825c
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jmp 0x7583c8
cmp cl, 0x3d
call 0x7582f0

Function at 0x7582f0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x403
jmp 0x757bbb
xor ebx, ebx
jmp 0x7582c2
push bp
lea esp, [esp]
lea esp, [esp]
jmp 0x7588d7
jmp 0x7582d8
mov dword [edi], 1
jmp 0x757b04
lea esp, [esp + 4]
jne 0x757b4c
je 0x758297
imul byte [edx - 8]
lahf
push 0xffffffffffffffa8
or esp, dword [edx + 0x63f2cdd]
lea esp, [esp + 4]
je 0x723377
jne 0x723237
lea esp, [esp + 2]
jmp 0x7588f7
Function at 0x409270
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4092ca
inc esi
xor edi, edi
cmp edi, 1
jne 0x409296
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4092a4
cmp edi, 1
jle 0x4092a4
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408d54
test eax, eax
jne 0x4092ca
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x4092ca
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x4092ca
inc edi
dec esi
jne 0x409286
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4096f8
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4097cb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4097e4
push ebx
push 0x4097f0
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040336c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409778
mov al, 0x62
call fcn.004092d4
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004096cc
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409781
call fcn.004096cc
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4097d2
lea eax, [ebp - 4]
call fcn.00403150
ret
Function at 0x409864
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409918
jmp 0x40990d
cmp dword [esi + 0x10], 0x1000
jne 0x4098f9
test byte [esi + 0x15], 1
jne 0x4098f9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x4098b8
cmp eax, 2
je 0x4098b8
cmp eax, 0x10
je 0x4098b8
cmp eax, 0x20
jne 0x4098cd
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4098cd
mov bl, 1
xor ebp, ebp
jmp 0x4098de
mov eax, dword [esi]
add eax, ebp
call fcn.0040985c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x4098d1
test bl, bl
je 0x4098f9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409918
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409890
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10014a6
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
push 0x57
xor ebx, ebx
pop edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp eax, ebx
je 0x100155e
push esi
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, ebx
jne 0x10014e2
push 0xe
jmp 0x1001504
cmp dword [ebp - 0xc], 4
jne 0x1001546
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
push 2
push 0
mov dword [ebp - 0x14], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
je 0x1001507
push 5
pop edi
jmp 0x1001546
lea eax, [ebp - 4]
push eax
push 0x1001140
push edi
mov dword [ebp - 8], 1
call sub.msvcrt.dll_swscanf_s
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1001530
and dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 1
push dword [ebp - 0x14]
push ebx
push dword [ebp - 4]
call fcn.01001335
mov edi, eax
test esi, esi
je 0x1001551
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], 0
pop esi
je 0x100155e
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop ebx
leave
ret 0x10
Function at 0x1001874
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1001d38
call fcn.01001a34
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1003378
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100162f
cmp eax, esi
jne 0x1001622
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1001632
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001609
xor esi, esi
inc esi
mov eax, dword [0x1003374]
cmp eax, esi
jne 0x1001645
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1001674
mov eax, dword [0x1003374]
test eax, eax
jne 0x100166e
mov dword [0x1003374], esi
push 0x10010fc
push 0x10010f0
call fcn.0100156b
pop ecx
pop ecx
test eax, eax
je 0x1001674
jmp 0x1001798
mov dword [0x1003038], esi
mov eax, dword [0x1003374]
cmp eax, esi
jne 0x1001698
push 0x10010ec
push 0x10010e4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1003374], 2
cmp dword [ebp - 0x20], ebx
jne 0x10016a5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100337c], ebx
je 0x10016c6
push 0x100337c
call fcn.010019a9
pop ecx
test eax, eax
je 0x10016c6
push ebx
push 2
push ebx
call dword [0x100337c]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1001798
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1001730
cmp cx, bx
je 0x10016eb
cmp dword [ebp - 0x1c], ebx
jne 0x1001730
movzx ecx, word [eax]
cmp cx, bx
je 0x1001700
cmp cx, 0x20
ja 0x1001700
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x10016eb
test byte [ebp - 0x40], 1
je 0x100170c
movzx ecx, word [ebp - 0x3c]
jmp 0x100170f
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1003034], eax
cmp dword [0x1003028], ebx
jne 0x1001775
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1001741
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x10016d5
cmp dword [0x1003038], ebx
jne 0x1001783
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1003034]
jmp 0x10017a4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01001a79
ret
call fcn.01001b81
jmp 0x10015cc
Function at 0x103080
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x1030bd
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x1030dd
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.001052ec
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x1032bc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x103315
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00103158
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00103158
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x1032ff
inc ebx
jmp 0x1032e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10331c
lea eax, [ebp - 8]
call fcn.0010507c
ret

Function at 0x103324
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0010507c
test esi, esi
jne 0x10335b
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.0010516c
jmp 0x10337c
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00103158
mov dword [esp], eax
test esi, esi
je 0x10337c
cmp dword [ebx], 0
je 0x10337c
dec esi
jmp 0x103363
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x1039c0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x26e008], 0x8088405
inc edx
mov dword [ebx + 0x26e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x104078
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x26e024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x104110
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x1040f0
xor eax, eax
push ebp
push 0x1040e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x10412c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1040f0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x26e024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x26e024], ax
mov esp, ebp
pop ebp
ret
Function at 0x104e54
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x271048], 0
je 0x104eb5
cmp word [0x27121c], 0xd7b2
jne 0x104e7d
cmp dword [0x271224], 0
jbe 0x104e7d
mov eax, 0x271218
call dword [0x271234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x26e074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x104edc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x26e034], 0
jne 0x104ed1
push 0
push 0x26e06c
push 0x26e074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x105030
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00102de0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x271049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x104ff8
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1070e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x10714e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.001052ec
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00103a3c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x107138
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x107155
lea eax, [ebp - 0x10]
call fcn.0010507c
ret

Function at 0x10c7b4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00105558
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x10c7cd
test al, 0x10
jne 0x10c7d1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x10c8b8
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00105558
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x10c8cc
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00105558
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x10c8ee
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x10fc20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x10fc59
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0010516c
jmp 0x10fc62
mov eax, ebx
mov edx, esi
call fcn.001050d0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x110324
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x11018c
mov eax, dword [0x2705f0]
cmp byte [eax], 0
je 0x1103a0
mov eax, dword [0x270318]
call fcn.001037e4
call fcn.00102fd4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0010d140
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x1103e8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x1103d6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x270294]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x271664]
call fcn.00106514
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret