joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57870c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
call fcn.00407fac
push esi
push ebx
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00407c34
push eax
push 0
call sub.kernel32.dll_CreateProcessW
mov ebx, eax
test ebx, ebx
je 0x578761
push 0x1388
mov eax, dword [esi]
push eax
call sub.user32.dll_WaitForInputIdle
cmp eax, 0x102
jne 0x578765
xor eax, eax
jmp 0x578767
mov al, 1
neg al
sbb eax, eax
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x5a3e1c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5a3e9b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push esi
lea eax, [ebp - 0x20a]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x5a3e7b
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00407f5c
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.00574ef4
jmp 0x5a3e82
mov eax, ebx
call fcn.00574d74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a3ea2
lea eax, [ebp - 0x210]
call fcn.00407044
ret

Function at 0x5a409c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 5
push 0x5a40d0
mov eax, esi
call fcn.00407ea0
push eax
mov eax, ebx
call fcn.00407ea0
push eax
push 0x5a40d4
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
setae al
pop esi
pop ebx
ret

Function at 0x5a4198
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffd4c
mov eax, esp
xor ecx, ecx
mov edx, 0x2b4
call fcn.00404fec
push 0x4011
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
push 0x5a41d0
call sub.shell32.dll_SHGetFileInfoW
add esp, 0x2b4
ret

Function at 0x5a41bb
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffd4c
mov eax, esp
xor ecx, ecx
mov edx, 0x2b4
call fcn.00404fec
push 0x4011
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
push 0x5a41d0
call sub.shell32.dll_SHGetFileInfoW
add esp, 0x2b4
ret

Function at 0x5a45b8
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffd4c
push 0x4009
push 0x2b4
lea edx, [esp + 8]
push edx
push 0
mov eax, dword [eax + 0x10]
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [esp + 4]
add esp, 0x2b4
ret

Function at 0x5a7204
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a7289
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040a96c
mov ecx, eax
mov edx, 0x5a7294
mov eax, dword [ebx + 0x14]
call fcn.0042605c
test al, al
je 0x5a7273
xor eax, eax
push ebp
push 0x5a726c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10]
mov edx, dword [eax]
call dword [edx + 0x30]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a7273
lea eax, [ebp - 4]
call fcn.0040a96c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a7290
lea eax, [ebp - 4]
call fcn.0040a96c
ret
Function at 0x5bdd14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
mov eax, dword [ebp - 4]
test ecx, ecx
jne 0x5bdd2f
mov ecx, 0x5ed758
test edx, edx
jbe 0x5bdd51
mov esi, eax
shr esi, 0x18
and esi, 0xff
movzx edi, byte [ebx]
xor esi, edi
mov esi, dword [ecx + esi*4]
shl eax, 8
xor esi, eax
mov eax, esi
inc ebx
dec edx
jne 0x5bdd33
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x5bdd5c
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x5c
call fcn.00404fec
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x5bef68
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
test edx, edx
jle 0x5bef76
xor cl, byte [eax]
dec edx
inc eax
test edx, edx
jg 0x5bef6e
mov eax, ecx
ret

Function at 0x5bf028
Capabilities:
Encode data using xor

Disassembly:
push ebx
test ecx, ecx
jle 0x5bf03c
mov bl, 0xff
sub bl, byte [edx]
xor bl, byte [eax + 4]
mov byte [edx], bl
dec ecx
inc edx
test ecx, ecx
jg 0x5bf02d
pop ebx
ret

Function at 0x5c1944
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
xor ecx, ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c1a82
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x5c1976
cmp dword [ebp - 4], 0
jne 0x5c197a
xor ebx, ebx
jmp 0x5c197c
mov bl, 1
test bl, bl
je 0x5c1a69
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005c1c48
test al, al
je 0x5c1a69
xor edx, edx
push ebp
push 0x5c1a55
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
call fcn.005c18bc
test al, al
je 0x5c1a3f
mov ebx, dword [ebp - 0xc]
dec ebx
cmp ebx, 0
jl 0x5c1a3f
mov dword [ebp - 0x10], 0x40
lea eax, [ebp - 0x94]
xor ecx, ecx
mov edx, 0x80
call fcn.00404fec
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x94]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x5c1a39
lea eax, [ebp - 0x98]
lea edx, [ebp - 0x94]
mov ecx, 0x40
call fcn.00407f5c
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x14]
call fcn.005c1944
dec ebx
cmp ebx, 0xffffffff
jne 0x5c19db
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c1a5c
mov eax, dword [ebp - 0x14]
call fcn.005c1b20
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c1a89
lea eax, [ebp - 0x98]
call fcn.00407044
ret

Function at 0x5c1ac8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
test ebx, ebx
je 0x5c1b16
mov dword [esp + 8], 4
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
mov eax, esi
call fcn.00407ea0
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
call fcn.005c18bc
test al, al
je 0x5c1b11
cmp dword [esp + 4], 4
je 0x5c1b16
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x5c1b2c
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov ebp, edx
mov esi, eax
test esi, esi
setne al
test al, al
je 0x5c1b6f
mov ebx, edi
test ebx, ebx
je 0x5c1b4a
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, edi
call fcn.00407ea0
push eax
push 1
push 0
mov eax, ebp
call fcn.00407ea0
push eax
push esi
call sub.advapi32.dll_RegSetValueExW
call fcn.005c18bc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5c24fc
Capabilities:
Delete file
Move file

Disassembly:
push ebx
mov ebx, eax
push 4
push 0
mov eax, ebx
call fcn.00407ea0
push eax
call sub.kernel32.dll_MoveFileExW
pop ebx
ret

Function at 0x5c3dc0
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov edi, eax
xor eax, eax
push ebp
push 0x5c3ea2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x14]
call fcn.00578688
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov eax, edi
call fcn.005716c4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffff
lea eax, [ebp - 8]
push eax
push 2
push 0xa
push 0
call sub.NetApi32.dll_NetUserEnum
test eax, eax
jne 0x5c3e87
xor edx, edx
push ebp
push 0x5c3e80
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.005722e0
mov ebx, dword [ebp - 0xc]
dec ebx
test ebx, ebx
jl 0x5c3e62
inc ebx
push 0
lea eax, [ebp - 0x18]
mov edx, dword [esi]
call fcn.00407f08
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov eax, edi
call fcn.005716c4
add esi, 0x10
dec ebx
jne 0x5c3e44
mov eax, edi
call fcn.00571e88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c3e87
mov eax, dword [ebp - 8]
push eax
call sub.NetApi32.dll_NetApiBufferFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c3ea9
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004070a4
ret
Function at 0x5c6ea4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5c7007
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.00407f08
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + 0x10]
mov edx, 0x5c7020
call fcn.005bf864
test al, al
je 0x5c6ef6
mov byte [ebx + 0x30], 1
movzx eax, byte [0x5c703c]
mov byte [ebx + 0x31], al
jmp 0x5c6fdf
lea eax, [ebp - 8]
call fcn.00407044
mov ecx, eax
mov edx, 0x5c704c
mov eax, dword [ebp - 4]
call fcn.005767d0
test al, al
je 0x5c6fbd
mov byte [ebx + 0x30], 0
movzx eax, byte [0x5c7058]
mov byte [ebx + 0x31], al
cmp dword [ebp - 8], 0
jne 0x5c6f33
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x34]
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005c73f8
mov edx, 0x5c7068
mov eax, dword [ebp - 4]
call fcn.00576740
test al, al
je 0x5c6f91
mov eax, dword [ebx + 0x34]
mov edx, dword [eax]
call dword [edx + 8]
test al, al
jne 0x5c6fdf
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x34]
call fcn.005c9f34
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, 0x5c7084
mov dl, 1
mov eax, dword [0x418c1c]
call fcn.00424180
call fcn.00406740
jmp 0x5c6fdf
mov edx, 0x5c70cc
mov eax, dword [ebp - 4]
call fcn.00576740
test al, al
je 0x5c6fa6
or byte [ebx + 0x31], 2
mov edx, 0x5c70ec
mov eax, dword [ebp - 4]
call fcn.00576740
test al, al
je 0x5c6fdf
or byte [ebx + 0x31], 8
jmp 0x5c6fdf
mov byte [ebx + 0x30], 0
movzx eax, byte [0x5c70fc]
mov byte [ebx + 0x31], al
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x34]
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.005c73f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c700e
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004070a4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004070a4
ret
Function at 0x5ca928
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x5ca930
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x5ca320]
call fcn.004086f0
xor eax, eax
push ebp
push 0x5caa51
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
call fcn.005ca8e8
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [0x5ca320]
call fcn.004087c8
mov ecx, eax
mov edx, esi
mov eax, dword [0x5ca6f8]
call fcn.005cbdf8
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
mov ecx, 0
call fcn.00407b58
mov eax, dword [ebp - 0x24]
call fcn.00407a68
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
jne 0x5caa1b
cmp dword [0x604424], 0
jne 0x5ca9c1
mov dl, 1
mov eax, dword [0x56ec88]
call fcn.0040545c
mov dword [0x604424], eax
mov edx, esi
mov eax, dword [0x604424]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edi, eax
test edi, edi
jl 0x5ca9e3
mov edx, edi
mov eax, dword [0x604424]
call fcn.005721f8
mov dword [ebx], eax
jmp 0x5caa1b
lea eax, [ebp - 0x28]
mov edx, esi
mov ecx, 0
call fcn.00407b58
mov eax, dword [ebp - 0x28]
call fcn.00407a68
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x5caa1b
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx], eax
mov ecx, dword [ebx]
mov edx, esi
mov eax, dword [0x604424]
call fcn.00571730
cmp dword [ebx], 0xffffffff
setne al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5caa58
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004070d4
lea eax, [ebp - 0x20]
mov edx, dword [0x5ca320]
mov ecx, 2
call fcn.00408818
ret

Function at 0x5cc008
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov ebp, ecx
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.005cc0e0
xor eax, eax
mov dword [esi + 4], eax
xor ebx, ebx
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [esi + 8], eax
mov eax, esi
call fcn.005cc1e8
test al, al
je 0x5cc0cd
call fcn.005cbc68
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
push 4
lea eax, [esp + 8]
push eax
push 0x1006
push 0xffff
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_setsockopt
push 4
lea eax, [esp + 8]
push eax
push 0x1005
push 0xffff
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_setsockopt
mov edx, esp
mov eax, edi
call fcn.005ca928
test al, al
je 0x5cc0ba
mov word [esp + 8], 2
mov eax, dword [esp]
mov dword [esp + 0xc], eax
push ebp
call sub.wsock32.dll_htons
mov word [esp + 0xa], ax
push 0x10
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_connect
inc eax
setne bl
call sub.wsock32.dll_WSAGetLastError
mov dword [esi + 4], eax
test bl, bl
jne 0x5cc0cd
mov eax, esi
call fcn.005cc0e0
mov eax, esi
call fcn.005cc1e8
mov ebx, eax
mov eax, ebx
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5cc130
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebp, eax
mov eax, ebp
call fcn.005cc1e8
mov ebx, eax
test bl, bl
je 0x5cc196
xor esi, esi
cmp esi, dword [esp + 4]
jge 0x5cc196
push 0
mov eax, dword [esp + 8]
sub eax, esi
push eax
mov eax, dword [esp + 8]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.wsock32.dll_send
mov edi, eax
cmp edi, 0xffffffff
je 0x5cc177
test edi, edi
jne 0x5cc17b
xor ebx, ebx
jmp 0x5cc17d
mov bl, 1
test bl, bl
jne 0x5cc18b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp + 4], eax
jmp 0x5cc196
add esi, edi
add dword [esp], edi
cmp esi, dword [esp + 4]
jl 0x5cc155
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5e6578
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov eax, 0x5dce88
call fcn.0040b15c
xor eax, eax
push ebp
push 0x5e6716
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.005c685c
test al, al
je 0x5e66fb
mov eax, dword [0x5ee6c0]
mov eax, dword [eax]
cmp byte [eax + 0x30], 1
jne 0x5e6645
mov eax, 0x6045e0
call fcn.00407044
push eax
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00407f08
mov eax, dword [ebp - 0x14]
mov edx, 0x5e6730
pop ecx
call fcn.005767d0
test al, al
je 0x5e6602
mov eax, dword [0x5ee6c0]
mov eax, dword [eax]
mov edx, dword [0x6045e0]
call fcn.005c73f8
jmp 0x5e6645
lea eax, [ebp - 0x18]
call fcn.005759c4
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
call fcn.00574d74
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.005776ac
test al, al
je 0x5e663b
push 0x10
push 0x5e673c
push 0x5e6748
push 0
call sub.user32.dll_MessageBoxW
jmp 0x5e66fb
call fcn.005c2338
jmp 0x5e66fb
mov eax, dword [0x5ee4d4]
mov eax, dword [eax]
call fcn.005635bc
mov eax, dword [0x5ee4d4]
mov eax, dword [eax]
mov dl, 1
call fcn.005651b8
mov eax, dword [0x5ee4d4]
mov eax, dword [eax]
mov edx, 0x5e6784
call fcn.00562fb8
mov eax, dword [0x5ee6c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
call fcn.005c8878
mov eax, dword [0x5ee6c0]
mov eax, dword [eax]
test byte [eax + 0x31], 8
je 0x5e66d7
mov eax, dword [0x5ee6c0]
mov eax, dword [eax]
mov dl, 1
call fcn.005c7250
mov eax, dword [0x5ee6c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
call fcn.005721c0
test eax, eax
jle 0x5e66c9
lea edx, [ebp - 0x20]
mov eax, dword [0x5ee6c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
call fcn.005722b4
mov eax, dword [ebp - 0x20]
xor edx, edx
call fcn.005bd1d4
mov eax, dword [0x5ee6c0]
mov eax, dword [eax]
call fcn.005c6b58
jmp 0x5e66fb
mov ecx, dword [0x5ee0f8]
mov eax, dword [0x5ee4d4]
mov eax, dword [eax]
mov edx, dword [0x5dbdd4]
call fcn.005635d4
mov eax, dword [0x5ee4d4]
mov eax, dword [eax]
call fcn.00563738
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e671d
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004070a4
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2f0d23ba
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x32295495
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x403400
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00405998
test esi, esi
jne 0x403438
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00405ad4
jmp 0x403456
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403344
mov edi, eax
test esi, esi
je 0x403456
cmp dword [ebx], 0
je 0x403456
dec esi
jmp 0x40343f
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x403488
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4e7008], 0x8088405
inc edx
mov dword [ebx + 0x4e7008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403b5c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4e7024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403bf4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x403bd4
xor eax, eax
push ebp
push 0x403bcd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403c2c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403bd4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x4e7024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4e7024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404dc8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4ef054], 0
je 0x404e29
cmp word [0x4ef330], 0xd7b2
jne 0x404df1
cmp dword [0x4ef338], 0
jbe 0x404df1
mov eax, 0x4ef32c
call dword [0x4ef348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404e54
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4e7030], 0
jne 0x404e45
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404fc8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4e7034], 0
je 0x404fee
mov edx, esi
mov eax, ebx
call dword [0x4e7034]
jmp 0x404ffd
mov eax, 8
call fcn.0040308c
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4ef055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404f90
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc