joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64dae4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, edx
mov esi, eax
mov eax, dword [esi]
call dword [eax + 0x18]
mov ebx, eax
mov eax, ebx
shr eax, 2
mov dword [esp + 4], eax
mov eax, dword [esi + 0xc]
add eax, ebx
mov dword [esp + 8], eax
mov eax, ebx
add eax, eax
mov edx, dword [esi + 0xc]
lea eax, [edx + eax]
mov dword [esp + 0xc], eax
mov eax, dword [esp]
cdq
idiv ebx
mov ebp, eax
dec ebp
test ebp, ebp
jl 0x64db67
inc ebp
push ebx
mov ecx, dword [esp + 0x10]
mov edx, edi
mov eax, dword [esi + 0xc]
call fcn.0064b0f4
mov edx, dword [esi + 0xc]
mov eax, dword [esp + 8]
mov ecx, ebx
call fcn.0064b0c8
mov edx, dword [esp + 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x48]
push ebx
mov ecx, edi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
call fcn.0064b1cc
lea eax, [edi + ebx]
mov edi, eax
dec ebp
jne 0x64db27
mov eax, dword [esp]
cdq
idiv ebx
mov ebp, edx
test ebp, ebp
jle 0x64dba3
mov edx, dword [esp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 4]
call fcn.0064b1ac
mov edx, dword [esi + 0xc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec ebp
test ebp, ebp
jl 0x64dba3
inc ebp
xor eax, eax
mov edx, dword [esi + 0xc]
movzx edx, byte [edx + eax]
xor byte [edi + eax], dl
inc eax
dec ebp
jne 0x64db95
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x64dbac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov ebx, edx
mov edi, eax
mov eax, dword [edi]
call dword [eax + 0x18]
mov ebp, eax
mov eax, ebp
shr eax, 2
mov dword [esp + 4], eax
mov eax, dword [esp]
cdq
idiv ebp
mov esi, eax
mov eax, dword [edi + 0xc]
dec esi
test esi, esi
jl 0x64dbfb
inc esi
mov edx, eax
mov eax, ebx
mov ecx, dword [esp + 4]
call fcn.0064b1ac
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, ebx
lea edx, [ebx + ebp]
mov ebx, edx
dec esi
jne 0x64dbdb
mov edx, dword [edi + 0xc]
mov ecx, ebp
call fcn.004068d4
mov eax, dword [esp]
cdq
idiv ebp
mov esi, edx
test esi, esi
jle 0x64dc31
mov edx, dword [edi + 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec esi
test esi, esi
jl 0x64dc31
inc esi
xor eax, eax
mov edx, dword [edi + 0xc]
movzx edx, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec esi
jne 0x64dc23
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x662550
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x6625df
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x6b75ec], 0
jne 0x6625b8
mov edx, dword [ebx]
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.00409dd8
push ebx
mov eax, dword [ebp - 4]
call fcn.00409ca4
push eax
call sub.advapi32.dll_GetUserNameA
mov esi, eax
test esi, esi
je 0x6625c1
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040a198
mov eax, dword [ebp - 8]
call fcn.0040a0c0
mov edx, eax
mov ecx, dword [ebx]
add ecx, ecx
mov eax, edi
call fcn.004126fc
jmp 0x6625c1
push ebx
push edi
call sub.advapi32.dll_GetUserNameW
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6625e6
lea eax, [ebp - 8]
call fcn.0040927c
lea eax, [ebp - 4]
call fcn.004092a0
ret

Function at 0x6625f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x66267f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x6b75ec], 0
jne 0x662658
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, ebx
call fcn.00409dd8
mov eax, dword [ebp - 4]
call fcn.00409ca4
push eax
push ebx
call sub.kernel32.dll_GetCurrentDirectoryA
mov esi, eax
test esi, esi
je 0x662661
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040a198
mov eax, dword [ebp - 8]
call fcn.0040a0c0
mov edx, eax
mov ecx, ebx
add ecx, ecx
mov eax, edi
call fcn.004126fc
jmp 0x662661
push edi
push ebx
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x662686
lea eax, [ebp - 8]
call fcn.0040927c
lea eax, [ebp - 4]
call fcn.004092a0
ret

Function at 0x662b84
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x662be9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x6b75ec], 0
jne 0x662bc2
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.00409e50
mov eax, dword [ebp - 4]
call fcn.00409ca4
push eax
call sub.kernel32.dll_GetFileAttributesA
jmp 0x662bcf
mov eax, ebx
call fcn.0040a0c0
push eax
call sub.kernel32.dll_GetFileAttributesW
inc eax
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x662bf0
lea eax, [ebp - 4]
call fcn.004092a0
ret
Function at 0x662bf8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc5c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3a4], ecx
mov dword [ebp - 0x3a0], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x662d6e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0066281c
cmp dword [ebp - 0xc], 0
je 0x662c5c
mov eax, dword [ebp - 0xc]
call fcn.0040976c
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 2], 0x5c
je 0x662c5c
lea eax, [ebp - 0xc]
mov edx, 0x662d88
call fcn.0040a2d4
cmp byte [0x6b75ec], 0
jne 0x662cd8
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.00409e50
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.00409ca4
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x662d3b
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.0040a164
mov ecx, dword [ebp - 0x3a0]
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0040a32c
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.006785bc
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x662c94
jmp 0x662d35
lea eax, [ebp - 0x39c]
push eax
mov eax, ebx
call fcn.0040a0c0
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x662d3b
lea eax, [ebp - 0x3a4]
lea edx, [ebp - 0x370]
mov ecx, 0x104
call fcn.0040a17c
mov ecx, dword [ebp - 0x3a4]
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0040a32c
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.006785bc
lea eax, [ebp - 0x39c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x662cf3
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x662d75
lea eax, [ebp - 0x3a4]
mov edx, 2
call fcn.004092dc
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004092dc
lea eax, [ebp - 4]
call fcn.004092a0
ret

Function at 0x6676fc
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
push 6
push 1
push 2
call sub.ws2_32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x66771a
mov eax, esi
call fcn.00667aa4
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 1
push 0xffff
push ebx
call sub.ws2_32.dll_setsockopt
mov eax, ebx
pop edx
pop esi
pop ebx
ret
Function at 0x66773c
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov esi, edx
mov edi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
mov edx, 0x10
call fcn.00412704
mov word [ebx], 2
movzx eax, word [ebp - 2]
push eax
call sub.ws2_32.dll_htons
mov word [ebx + 2], ax
mov eax, esi
call fcn.00409ca4
push eax
call sub.ws2_32.dll_inet_addr
cmp eax, 0xffffffff
je 0x667784
mov dword [ebx + 4], eax
jmp 0x6677cd
mov eax, esi
call fcn.00409ca4
push eax
call sub.ws2_32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x66779e
mov eax, edi
call fcn.00667aa4
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax]
mov byte [ebx + 4], al
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 1]
mov byte [ebx + 5], al
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 2]
mov byte [ebx + 6], al
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 3]
mov byte [ebx + 7], al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x667908
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x194], ebx
test dl, dl
je 0x667928
add esp, 0xfffffff0
call fcn.00407c04
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x6679b4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18f]
push eax
mov dl, 2
mov al, 2
call fcn.004126e4
push eax
call sub.ws2_32.dll_WSAStartup
mov esi, eax
test esi, esi
je 0x66797d
lea edx, [ebp - 0x194]
mov eax, esi
call fcn.00426cb0
mov ecx, dword [ebp - 0x194]
mov dl, 1
mov eax, dword [0x64e6f4]
call fcn.00427c14
call fcn.00408948
movzx eax, word [ebp + 8]
mov word [ebx + 0x14], ax
lea eax, [ebx + 0x10]
mov edx, edi
call fcn.004096f8
mov dword [ebx + 8], 0xffffffff
xor eax, eax
mov dword [ebx + 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6679bb
lea eax, [ebp - 0x194]
call fcn.0040927c
ret

Function at 0x667a20
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.006677d8
xor edx, edx
push ebp
push 0x667a96
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x10
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.ws2_32.dll_connect
inc eax
jne 0x667a7b
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x667a6d
mov eax, dword [ebp - 4]
call fcn.00667aa4
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00667f44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x667a9d
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.006677d8
ret
Function at 0x667af8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
jne 0x667b28
mov ecx, 0x667bb4
mov dl, 1
mov eax, dword [0x64e6f4]
call fcn.00427c14
call fcn.00408948
xor ebx, ebx
mov dword [ebp - 0xc], edi
xor eax, eax
push ebp
push 0x667b87
push dword fs:[eax]
mov dword fs:[eax], esp
cmp edi, ebx
jle 0x667b7d
mov eax, dword [ebp - 8]
add eax, ebx
mov dword [ebp - 0x10], eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.ws2_32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
jne 0x667b6c
mov eax, dword [ebp - 4]
call fcn.00667aa4
test esi, esi
je 0x667b7d
add ebx, esi
mov eax, edi
sub eax, ebx
mov dword [ebp - 0xc], eax
cmp edi, ebx
jg 0x667b3f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x667b9e
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x667d34
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
jne 0x667d64
mov ecx, 0x667dec
mov dl, 1
mov eax, dword [0x64e6f4]
call fcn.00427c14
call fcn.00408948
xor ebx, ebx
mov dword [ebp - 0xc], edi
xor eax, eax
push ebp
push 0x667dbf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp edi, ebx
jle 0x667db5
mov eax, dword [ebp - 8]
add eax, ebx
mov dword [ebp - 0x10], eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.ws2_32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x667da8
mov eax, dword [ebp - 4]
call fcn.00667aa4
add ebx, esi
mov eax, edi
sub eax, ebx
mov dword [ebp - 0xc], eax
cmp edi, ebx
jg 0x667d7b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x667dd6
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x667ea4
Capabilities:
Set socket configuration

Disassembly:
push ebx
push ecx
mov dword [esp], edx
mov ebx, eax
cmp dword [ebx + 8], 0xffffffff
jne 0x667ec7
mov ecx, 0x667f18
mov dl, 1
mov eax, dword [0x64e6f4]
call fcn.00427c14
call fcn.00408948
mov eax, dword [ebx + 0xc]
cmp eax, dword [esp]
je 0x667f09
mov eax, dword [esp]
mov dword [ebx + 0xc], eax
push 4
lea eax, [esp + 4]
push eax
push 0x1006
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.ws2_32.dll_setsockopt
push 4
lea eax, [esp + 4]
push eax
push 0x1005
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.ws2_32.dll_setsockopt
pop edx
pop ebx
ret
Function at 0x667f44
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x324], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6680ea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x118]
call fcn.0064e6d4
lea edx, [ebp - 0x118]
mov eax, ebx
call fcn.0064e6c4
push esi
lea esi, [ebp - 0x118]
lea edi, [ebp - 0x21c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x118]
lea edi, [ebp - 0x320]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop esi
test esi, esi
jle 0x667ff4
cmp esi, 0x3e8
jl 0x667fe1
mov eax, esi
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, edx
mov eax, esi
sub eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [ebp - 0x14], eax
imul eax, ecx, 0x3e8
mov dword [ebp - 0x10], eax
jmp 0x667fef
xor eax, eax
mov dword [ebp - 0x14], eax
imul eax, esi, 0x3e8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
jmp 0x667ff6
xor eax, eax
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebx + 1]
push eax
call sub.ws2_32.dll_select
test eax, eax
jne 0x66802f
mov ecx, 0x668104
mov dl, 1
mov eax, dword [0x64e6f4]
call fcn.00427c14
call fcn.00408948
inc eax
jne 0x66803a
mov eax, dword [ebp - 4]
call fcn.00667aa4
lea edx, [ebp - 0x118]
mov eax, ebx
call fcn.0064e6ac
test al, al
jne 0x66806d
lea edx, [ebp - 0x21c]
mov eax, ebx
call fcn.0064e6ac
test al, al
jne 0x66806d
lea edx, [ebp - 0x320]
mov eax, ebx
call fcn.0064e6ac
test al, al
je 0x6680c9
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x1007
push 0xffff
push ebx
call sub.ws2_32.dll_getsockopt
inc eax
jne 0x66809c
mov eax, dword [ebp - 4]
call fcn.00667aa4
cmp dword [ebp - 8], 0
je 0x6680d1
lea edx, [ebp - 0x324]
mov eax, dword [ebp - 8]
call fcn.00426cb0
mov ecx, dword [ebp - 0x324]
mov dl, 1
mov eax, dword [0x64e6f4]
call fcn.00427c14
call fcn.00408948
jmp 0x6680d1
mov eax, dword [ebp - 4]
call fcn.00667aa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6680f1
lea eax, [ebp - 0x324]
call fcn.0040927c
ret
Function at 0x6682ec
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x668306
add esp, 0xfffffff0
call fcn.00407c04
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x6683df
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [edi + 0x59], 0
mov byte [edi + 0x58], 2
mov dl, 1
mov eax, dword [0x43d1ac]
call fcn.0043daec
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x43d1ac]
call fcn.0043daec
mov dword [edi + 0x10], eax
mov dl, 1
mov eax, dword [0x5195a8]
call fcn.00519d84
mov dword [edi + 8], eax
lea eax, [edi + 0x20]
mov edx, esi
call fcn.0040965c
mov byte [edi + 0x1c], 0
mov dword [ebp - 8], 0x10
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a254
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a0c0
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x66839d
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a254
lea eax, [edi + 0x24]
mov edx, dword [ebp - 4]
call fcn.0040965c
jmp 0x6683a7
lea eax, [edi + 0x24]
xor edx, edx
call fcn.0040a254
mov dl, 1
mov eax, dword [0x660d64]
call fcn.006795c4
mov dword [edi + 0xc], eax
mov byte [edi + 0x5a], 0
mov dl, 1
mov eax, dword [0x651288]
call fcn.0067b2e4
mov dword [edi + 0x5c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6683e6
lea eax, [ebp - 4]
call fcn.0040927c
ret

Function at 0x66e60c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x66e6fe
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [ebp + 0x10]
push eax
movzx ecx, byte [ebp + 0x14]
mov dl, 1
mov eax, dword [0x652868]
call fcn.00662ff0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x66e6e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0x18]
mov eax, dword [ebp - 8]
fstp qword [eax + 0x30]
wait
mov eax, dword [ebp - 8]
mov byte [eax + 0xc], bl
mov eax, dword [ebp - 8]
add eax, 0x48
mov edx, dword [ebp - 4]
call fcn.0040965c
cmp esi, 0xff000005
jne 0x66e68b
mov eax, dword [ebp - 8]
mov dword [eax + 0x4c], esi
jmp 0x66e69d
mov eax, esi
call fcn.0050dc80
and eax, 0xffffff
mov edx, dword [ebp - 8]
mov dword [edx + 0x4c], eax
lea edx, [ebp - 0xc]
mov eax, edi
call fcn.00669d4c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
add eax, 0x44
call fcn.0040965c
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
call fcn.00663100
mov eax, dword [edi + 0x1c]
mov edx, dword [ebp - 8]
call fcn.00668fc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66e6e8
mov eax, dword [ebp - 8]
call fcn.00662f68
ret
Function at 0x66e790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
movzx ecx, byte [ebp + 8]
mov dl, 1
mov eax, dword [0x652e8c]
call fcn.006632c4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x66e80f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0x18]
mov eax, dword [ebp - 4]
fstp qword [eax + 0x38]
wait
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], bl
mov eax, dword [ebp - 4]
add eax, 0x34
mov edx, edi
call fcn.0040965c
mov eax, dword [ebp - 4]
add eax, 0x30
mov edx, dword [ebp + 0xc]
call fcn.0040965c
mov eax, dword [esi + 0x1c]
mov edx, dword [ebp - 4]
call fcn.00669120
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66e816
mov eax, dword [ebp - 4]
call fcn.00662f68
ret

Function at 0x66f9ec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x1c]
cmp byte [eax + 0x1c], 0
je 0x66fae6
cmp byte [esi + 0x20], 0
je 0x66fae6
cmp bl, byte [esi + 0x22]
jb 0x66fae6
cmp bl, byte [eax + 0x59]
jb 0x66fae6
cmp dword [ebp + 0xc], 0
jne 0x66fa3f
mov edx, 0x66fafc
mov eax, esi
call fcn.0066b90c
jmp 0x66fae6
mov dl, 1
mov eax, dword [0x50c064]
call fcn.00515264
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x66fadf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi]
sub eax, dword [edi + 8]
cdq
xor eax, edx
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
cdq
xor eax, edx
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x24]
mov dword [ebp - 0xc], eax
push edi
mov eax, dword [ebp - 8]
call fcn.00515b98
lea edx, [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
call fcn.0050f728
mov eax, dword [ebp - 8]
push eax
mov edx, ebx
mov ecx, dword [ebp - 4]
mov eax, esi
call fcn.0066d5d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66fae6
mov eax, dword [ebp - 8]
call fcn.00407600
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x671154
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x6712e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x1c]
cmp byte [eax + 0x1c], 0
je 0x6712c8
cmp byte [esi + 0x20], 0
je 0x6712c8
cmp bl, byte [esi + 0x22]
jb 0x6712c8
cmp bl, byte [eax + 0x59]
jb 0x6712c8
lea eax, [ebp - 0x24]
mov edx, 0x20
call fcn.00412704
mov dword [ebp - 0x24], 0x20
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov dl, 1
mov eax, dword [0x6565c0]
call fcn.00663fe8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6712c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x20]
mov edx, 0x671300
mov eax, dword [ebp - 4]
call fcn.00663db8
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
call fcn.00670ff0
mov ecx, dword [ebp - 0x28]
mov edx, 0x671318
mov eax, dword [ebp - 4]
call fcn.00663cac
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
call fcn.00670ff0
mov ecx, dword [ebp - 0x2c]
mov edx, 0x671344
mov eax, dword [ebp - 4]
call fcn.00663cac
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x14]
call fcn.00670ff0
mov ecx, dword [ebp - 0x30]
mov edx, 0x67136c
mov eax, dword [ebp - 4]
call fcn.00663cac
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x10]
call fcn.00670ff0
mov ecx, dword [ebp - 0x34]
mov edx, 0x671398
mov eax, dword [ebp - 4]
call fcn.00663cac
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00670ff0
mov ecx, dword [ebp - 0x38]
mov edx, 0x6713c0
mov eax, dword [ebp - 4]
call fcn.00663cac
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 8]
call fcn.00670ff0
mov ecx, dword [ebp - 0x3c]
mov edx, 0x6713e8
mov eax, dword [ebp - 4]
call fcn.00663cac
push 0x17
mov eax, dword [ebp - 4]
push eax
mov edx, ebx
mov ecx, edi
mov eax, esi
call fcn.0066e548
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6712c8
mov eax, dword [ebp - 4]
call fcn.00407600
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6712ea
lea eax, [ebp - 0x3c]
mov edx, 6
call fcn.004092dc
ret
Function at 0x4027d4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402803
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_2
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403698
jmp 0x402821
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402708
mov edi, eax
test ebx, ebx
je 0x402821
cmp dword [esi], 0
je 0x402821
dec ebx
jmp 0x40280a
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4029c4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x43e03c], 0x8088405
inc edx
mov dword [0x43e03c], edx
mul edx
mov eax, edx
ret

Function at 0x402b28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402bc0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ba0
xor eax, eax
push ebp
push 0x402b99
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402bdc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ba0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret