joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e880
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor eax, eax
push ecx
push eax
push edi
mov word [edi + esi*2], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x41e8c4
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret 8
dec esi
js 0x41e8ec
cmp word [edi + esi*2], 0x5c
je 0x41e8e8
dec esi
jns 0x41e8c7
pop edi
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret 8
test esi, esi
jns 0x41e903
pop edi
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret 8
push ebx
push esi
xor edx, edx
push edi
mov word [edi + esi*2], dx
call fcn.0041e880
mov ebx, eax
mov eax, 0x5c
mov word [edi + esi*2], ax
test ebx, ebx
js 0x41e940
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41e940
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x41e940
mov ebx, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, ebx
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret 8

Function at 0x420627
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434040]
jne 0x420631
repz ret
jmp fcn.00421aa6
Function at 0x4237be
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4341e8]
je 0x4237d9
inc edi
cmp edi, 0x17
jb 0x4237ca
cmp edi, 0x17
jae 0x423959
push ebp
push 3
call fcn.0042a5bc
cmp eax, 1
pop ecx
je 0x423925
push 3
call fcn.0042a5bc
test eax, eax
pop ecx
jne 0x42380d
cmp dword [0x43403c], 1
je 0x423925
cmp ebx, 0xfc
je 0x423958
push 0x401a98
mov ebx, 0x314
push ebx
mov ebp, 0x435948
push ebp
call fcn.004288e7
add esp, 0xc
test eax, eax
je 0x423843
push esi
push esi
push esi
push esi
push esi
call fcn.00421d3f
add esp, 0x14
push 0x104
mov esi, 0x435961
push esi
push 0
mov byte [0x435a65], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x423887
push 0x401a80
push 0x2fb
push esi
call fcn.004288e7
add esp, 0xc
test eax, eax
je 0x423887
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00421d3f
add esp, 0x14
push esi
call fcn.00425b90
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4238cc
push esi
call fcn.00425b90
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x435c5c
push 0x401a7c
sub ecx, eax
push ecx
push eax
call fcn.0042a504
add esp, 0x14
test eax, eax
je 0x4238cc
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00421d3f
add esp, 0x14
jmp 0x4238ce
xor esi, esi
push 0x401a78
push ebx
push ebp
call fcn.0042a48e
add esp, 0xc
test eax, eax
je 0x4238ee
push esi
push esi
push esi
push esi
push esi
call fcn.00421d3f
add esp, 0x14
push dword [edi*8 + 0x4341ec]
push ebx
push ebp
call fcn.0042a48e
add esp, 0xc
test eax, eax
je 0x423910
push esi
push esi
push esi
push esi
push esi
call fcn.00421d3f
add esp, 0x14
push 0x12010
push 0x401a50
push ebp
call fcn.0042a2cc
add esp, 0xc
jmp 0x423958
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x423958
cmp ebp, 0xffffffff
je 0x423958
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4341ec]
push dword [esi]
call fcn.00425b90
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x42a2cc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00421fe0
xor ebx, ebx
cmp dword [0x435f48], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x42a3a2
push 0x401ca0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x42a482
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401c94
push edi
call esi
cmp eax, ebx
je 0x42a482
push eax
call fcn.00421f6d
mov dword [esp], 0x401c84
push edi
mov dword [0x435f48], eax
call esi
push eax
call fcn.00421f6d
mov dword [esp], 0x401c70
push edi
mov dword [0x435f4c], eax
call esi
push eax
call fcn.00421f6d
mov dword [0x435f50], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042279f
test eax, eax
pop ecx
pop ecx
je 0x42a370
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00421d3f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x42a3a2
push 0x401c54
push edi
call esi
push eax
call fcn.00421f6d
cmp eax, ebx
pop ecx
mov dword [0x435f58], eax
je 0x42a3a2
push 0x401c3c
push edi
call esi
push eax
call fcn.00421f6d
pop ecx
mov dword [0x435f54], eax
mov eax, dword [0x435f54]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x42a427
cmp dword [0x435f58], ecx
je 0x42a427
push eax
call fcn.00421fee
push dword [0x435f58]
mov esi, eax
call fcn.00421fee
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x42a427
cmp edi, ebx
je 0x42a427
call esi
cmp eax, ebx
je 0x42a3f4
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42a3f4
test byte [ebp - 0x18], 1
jne 0x42a427
lea eax, [ebp - 0x10]
push eax
call fcn.004227db
test eax, eax
pop ecx
je 0x42a40f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00421d3f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x42a41e
or dword [ebp + 0x10], 0x200000
jmp 0x42a462
or dword [ebp + 0x10], 0x40000
jmp 0x42a462
mov eax, dword [0x435f4c]
cmp eax, dword [ebp - 8]
je 0x42a462
push eax
call fcn.00421fee
cmp eax, ebx
pop ecx
je 0x42a462
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42a462
mov eax, dword [0x435f50]
cmp eax, dword [ebp - 8]
je 0x42a462
push eax
call fcn.00421fee
cmp eax, ebx
pop ecx
je 0x42a462
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435f48]
call fcn.00421fee
cmp eax, ebx
pop ecx
je 0x42a482
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42a484
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x427eaa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4540d0]
jne 0x427eb4
repz ret
jmp fcn.00429e94

Function at 0x428d61
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x428d70
pop dword [ebp - 0x44]
mov eax, 0x428d70
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x4bb66
push 0
mov eax, 0x60568e4b
sub eax, 0x6012ec47
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x90e6d53e
sub ecx, 0x90e68c6c
xor esi, esi
add esi, eax
mov edx, 0x4e13774c
add edx, 0xb232acb4
add edx, dword [ebp - 0x44]
mov edi, 0x87ce15d9
sub edi, 0x5a97362
add dword [ebp - 0x24], 0xd96dfc27
mov ebx, dword [edx]
add dword [ebp - 0x2c], 0x641596
xor ebx, edi
add dword [ebp - 0x3c], 0xdabc5b88
mov dword [esi], ebx
add esi, 0x81b9eb24
sub esi, 0x81b9eb20
add edx, 0x44f9e20c
add edx, 0xbb061df8
loop 0x428dcc
add eax, 0x1161b
mov ebx, eax
add eax, 5
mov ecx, 0xffe0bc32
add ecx, 0x5f43ce
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x42bc0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4540d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004296a2
and dword [ebp - 0x14], 0
cmp dword [0x455cfc], 0
mov dword [ebp - 0x18], eax
jne 0x42bcbe
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x42bd66
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x44f7cc
push ebx
call edi
test eax, eax
je 0x42bd66
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x455cfc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x455d00], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x455d04], eax
call edi
push eax
call esi
mov dword [0x455d0c], eax
test eax, eax
je 0x42bcbe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x455d08], eax
mov eax, dword [0x455d08]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x42bd17
cmp dword [0x455d0c], ecx
je 0x42bd17
push eax
call esi
push dword [0x455d0c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x42bd17
test ebx, ebx
je 0x42bd17
call edi
test eax, eax
je 0x42bd0e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42bd0e
test byte [ebp - 8], 1
jne 0x42bd17
or dword [ebp + 0x10], 0x200000
jmp 0x42bd4a
mov eax, dword [0x455d00]
cmp eax, dword [ebp - 0x18]
je 0x42bd4a
push eax
call esi
test eax, eax
je 0x42bd4a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42bd4a
mov eax, dword [0x455d04]
cmp eax, dword [ebp - 0x18]
je 0x42bd4a
push eax
call esi
test eax, eax
je 0x42bd4a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x455cfc]
call esi
test eax, eax
je 0x42bd66
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42bd68
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427eaa
leave
ret
Function at 0x10007faf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10007fbe
pop dword [ebp - 0x2c]
mov eax, 0x9437bbaf
add eax, 0x7bc8c40f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xa964f150
sub dword [ebp - 0x3c], 0x5b12ac05
mov dword [ebp - 0x38], 0x815fe229
sub dword [ebp - 0x38], 0x4f2c95e4
mov dword [ebp - 0x34], 0x5ce95fd2
sub dword [ebp - 0x34], 0x109d1ba4
mov dword [ebp - 0x30], 0x47485e57
sub dword [ebp - 0x30], 0x47485e57
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xe7dba406
add dword [ebp - 0x3c], 0x8c96c550
mov dword [ebp - 0x38], 0x17304729
sub dword [ebp - 0x38], 0xd5c3e5b4
mov dword [ebp - 0x34], 0xaf47255c
add dword [ebp - 0x34], 0xb4284710
mov dword [ebp - 0x30], 0x4664d450
add dword [ebp - 0x30], 0xb99b2bb0
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x36803
push 0
call eax
mov ecx, 0x460bdbad
sub ecx, 0x460b97a9
mov edi, eax
mov esi, 0x32096b68
add esi, 0xddf8fc98
add esi, dword [ebp - 0x2c]
mov ebx, 0xea8bc053
add dword [ebp - 4], ebx
mov edx, dword [esi]
add dword [ebp - 8], edx
xor edx, ebx
add dword [ebp - 0x1c], 0x9a75c31b
mov dword [edi], edx
xor dword [ebp - 0x20], ecx
add edi, 4
add esi, 0xc9b1f2c3
sub esi, 0xc9b1f2bf
loop 0x100080d0
add eax, 0xbe637a8c
sub eax, 0xbe6277a9
xor ebx, ebx
add ebx, eax
add eax, 0x18e8f8bd
add eax, 0xe7170748
mov ecx, 0xde647d30
add ecx, 0x319b82d0
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x10008fc4
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1000
mov dword [esp + 0x14], ebp
call sub.glib_lite.dll_Ordinal_406
mov esi, dword [esp + 0x1c]
mov edi, eax
mov ebx, dword [esp + 0x20]
pop ecx
mov dword [ebx], ebp
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x11c]
sbb ecx, dword [esi + 0x114]
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, ebp
ja 0x1000901f
jb 0x10009011
cmp eax, 0xffe
ja 0x1000901f
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
jmp 0x10009024
mov eax, 0x1000
test edi, edi
je 0x1000909a
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009093
push sub.glib_lite.dll_Ordinal_109
push edi
push dword [esp + 0x18]
push ebp
push 0x1000
push edi
push ebp
call sub.gstreamer_lite.dll_Ordinal_25
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x10009072
mov ecx, dword [esi + 0x110]
mov dword [eax + 0x40], ecx
mov ecx, dword [esi + 0x114]
mov dword [eax + 0x44], ecx
mov eax, dword [esp + 0x10]
add eax, dword [esi + 0x110]
push 0
pop edx
adc edx, dword [esi + 0x114]
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edx
jmp 0x1000909e
push edi
call sub.glib_lite.dll_Ordinal_109
pop ecx
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10004400
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d070
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x10028fc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [0x10028d98]
lea eax, [ebp - 0x110]
push 0xff
push eax
push 0x1001e3a8
push dword [0x100283c8]
push dword [0x10028d9c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x12c]
call fcn.10004320
mov dword [ebp - 4], 0
call fcn.100105de
cmp dword [ebp - 0x118], 0xf
lea esi, [ebp - 0x12c]
mov edi, eax
lea eax, [ebp - 0x114]
cmova esi, dword [ebp - 0x12c]
push 0xa
push eax
push esi
mov dword [edi], 0
call fcn.1001088f
add esp, 0xc
cmp esi, dword [ebp - 0x114]
je 0x10004507
cmp dword [edi], 0x22
je 0x10004511
mov ecx, dword [ebp - 0x118]
mov dword [0x1002e258], eax
cmp ecx, 0xf
jbe 0x100044ea
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100044e0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000451b
push ecx
push edx
call fcn.1000b534
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000b9e5
mov esp, ebp
pop ebp
ret
push str.invalid_stoi_argument
call fcn.1000b3b0
push str.stoi_argument_out_of_range
call fcn.1000b3f0
call fcn.1000e92f
int3

Function at 0x10006ad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, 0x1103
movzx ecx, word [eax]
cmp cx, dx
jne 0x10006af8
cmp dword [eax + 0x18], 0x38324535
jne 0x10006b90
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x1fe
cmp cx, ax
jne 0x10006b90
mov ecx, dword [0x1002e7ac]
movups xmm0, xmmword [ecx + 2]
movups xmmword [0x1002e6e0], xmm0
movups xmm0, xmmword [ecx + 0x12]
movups xmmword [0x1002e6f0], xmm0
movups xmm0, xmmword [ecx + 0x22]
movups xmmword [0x1002e700], xmm0
movzx eax, byte [ecx + 0x32]
mov byte [0x1002e710], al
movups xmm0, xmmword [ecx + 0x34]
movups xmmword [0x1002e748], xmm0
movups xmm0, xmmword [ecx + 0x44]
movups xmmword [0x1002e758], xmm0
movups xmm0, xmmword [ecx + 0x54]
movups xmmword [0x1002e768], xmm0
movzx eax, byte [ecx + 0x64]
mov byte [0x1002e778], al
movups xmm0, xmmword [ecx + 0x66]
movups xmmword [0x1002e7b0], xmm0
movups xmm0, xmmword [ecx + 0x76]
movups xmmword [0x1002e7c0], xmm0
movups xmm0, xmmword [ecx + 0x86]
movups xmmword [0x1002e7d0], xmm0
movzx eax, byte [ecx + 0x96]
mov byte [0x1002e7e0], al
pop ebp
ret
Function at 0x1000a6b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d0b5
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
mov eax, dword [0x10028fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [0x10028d98]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x10
push 0x10035fc8
push 0x1001e3a8
push dword [0x10028e08]
push dword [0x10028d9c]
call esi
push 0x10035fc8
lea ecx, [ebp - 0x24]
call fcn.10004320
push 0xa
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.1000a8a0
mov ecx, dword [ebp - 0x10]
add esp, 0xc
mov dword [0x10036134], eax
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x1000a760
mov edx, dword [ebp - 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000a756
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a809
push ecx
push edx
call fcn.1000b534
add esp, 8
push dword [0x10028d98]
push 0x10
push 0x10035fc8
push 0x1001e3a8
push dword [0x10028e0c]
push dword [0x10028d9c]
call esi
push 0x10035fc8
lea ecx, [ebp - 0x3c]
call fcn.10004320
push 0xa
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.1000a8a0
mov ecx, dword [ebp - 0x28]
add esp, 0xc
mov dword [0x10036138], eax
cmp ecx, 0xf
jbe 0x1000a7d9
mov edx, dword [ebp - 0x3c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000a7cf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a80e
push ecx
push edx
call fcn.1000b534
add esp, 8
push dword [0x10028d98]
push 0x10
push 0x10035fc8
push 0x1001e3a8
push dword [0x10028e04]
push dword [0x10028d9c]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1000e92f
call fcn.1000e92f
int3

Function at 0x10010aed
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10010b2c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10010b2c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10010b2c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10010b2c
cmp dword [ecx + 0x74], 0xe
jbe 0x10010b2c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10014f06
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10014fa3
push ebx
push esi
call fcn.10014ecf
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10014e63
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10014f50
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10014fa2
push edi
push eax
call fcn.10012271
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10014f70
call fcn.10012237
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10014fa1
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10014e63
add esp, 0x20
test eax, eax
jne 0x10014f8f
push edi
call fcn.10012237
jmp 0x10014f97
push ebx
call fcn.10012237
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10015210
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10020b78
push 0x10020b70
push str.FlsAlloc
push 0x1f
call fcn.1001512c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10015244
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001e144]
call esi
jmp 0x1001524a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001528e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10020b88
push 0x10020b80
push str.FlsGetValue
push 0x21
call fcn.1001512c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100152c5
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001e144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100152cd
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10020b90
push 0x10020b88
push str.FlsSetValue
push 0x22
call fcn.1001512c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10015307
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001e144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001ca20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001ca4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001ca4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402ec8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402f21
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.KERNEL32.DLL_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402d64
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402d64
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402f0b
inc ebx
jmp 0x402ef4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402f28
lea eax, [ebp - 8]
call fcn.00404a98
ret

Function at 0x402f30
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404a98
test esi, esi
jne 0x402f67
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404b88
jmp 0x402f88
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d64
mov dword [esp], eax
test esi, esi
je 0x402f88
cmp dword [ebx], 0
je 0x402f88
dec esi
jmp 0x402f6f
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x40357c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x477008], 0x8088405
inc edx
mov dword [ebx + 0x477008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403af4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x477024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403b8c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x403b6c
xor eax, eax
push ebp
push 0x403b65
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403ba8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403b6c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [0x477024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x477024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404890
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47904c], 0
je 0x4048f1
cmp word [0x479220], 0xd7b2
jne 0x4048b9
cmp dword [0x479228], 0
jbe 0x4048b9
mov eax, 0x47921c
call dword [0x479238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x477094
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404918
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x477034], 0
jne 0x40490d
push 0
push 0x47708c
push 0x477094
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret
Function at 0x404a4c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402af8
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x47904d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404a14
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread_1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc