joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa3af90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0xa3affb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xa3b035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00a3ae00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0xa3afc5
mov edi, 0xa558b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xa3b035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00a3ae00
add edi, 4
add esp, 0xc
cmp edi, 0xa558c0
jb 0xa3b000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0xa3b070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00a41082
mov esi, eax
add esp, 8
test esi, esi
je 0xa3b107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0xa3b102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00a40946
add esp, 8
test eax, eax
je 0xa3b0e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0xa3b0e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00a40946
add esp, 8
test eax, eax
jne 0xa3b0c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0xa3b102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0xa3bf10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xa509fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xa3c002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00a3fdff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xa3c002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00a376e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00a4020b
push 0x10
call fcn.00a401d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xa3bfc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00a2c1c0
jmp 0xa3bfc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00a3bb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xa3bff0
mov ecx, edi
call fcn.00a2c2c0
push edi
call fcn.00a401c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xa3c021
inc ebx
cmp ebx, 0x20
jb 0xa3bf3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xa3d250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa51808
push 0xa41288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xa3d329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xa3d329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00a401d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xa3d329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xa3d329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xa3d32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00a3d351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa3dd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xa3dd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xa3dd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xa3dd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xa3dd94
push eax
push esi
call fcn.00a4020b
add esp, 8
pop esi
ret 0x10

Function at 0xa3dda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa3de22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xa3de15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xa56320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00a3fdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xa3ddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xa3de30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa3dec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xa3deb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xa56320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00a3fdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xa3deab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xa3de6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xa3e000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xa3e131
push esi
call fcn.00a41145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00a30080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xa3e131
push 0
push ebp
call fcn.00a303a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00a30260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xa3e08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00a302f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xa3e121
push 0xa56918
push edi
call fcn.00a3f3f0
push eax
push ebx
push esi
call fcn.00a3df60
push 0xa568f8
push edi
call fcn.00a3f3f0
push eax
push ebx
push esi
call fcn.00a3df60
push 0xa568d8
push edi
call fcn.00a3f3f0
push eax
push ebx
push esi
call fcn.00a3df60
push 0xa568c0
push edi
call fcn.00a3f3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00a3df60
push 0xa568a0
push edi
call fcn.00a3f3f0
push eax
push ebx
push esi
call fcn.00a3df60
push 0xa56888
push edi
call fcn.00a3f3f0
push eax
push ebx
push esi
call fcn.00a3df60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xa3f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00a3f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00a3f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00a3f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00a3f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xa3fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xa3fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xa5187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xa3fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xa3fc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x301c970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x301c97f
pop dword [ebp - 0x38]
mov eax, 0x301c97f
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x6c4d9
push 0
mov eax, 0xae42c9b7
add eax, 0x54bd4711
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x41acfed1
sub ecx, 0x41aca8f3
xor edx, edx
add edx, eax
mov edi, 0xe95aa941
add edi, 0x19b966bf
add edi, dword [ebp - 0x38]
mov esi, 0x41192e04
sub esi, 0x643e4859
add dword [ebp - 0x18], edx
mov ebx, dword [edi]
sub ebx, esi
xor dword [ebp - 4], ecx
mov dword [edx], ebx
add edx, 0xbb68462f
add edx, 0x4497b9d5
add edi, 0x77ddd3e8
sub edi, 0x77ddd3e4
loop 0x301c9db
add eax, 0x391039f2
sub eax, 0x390eefa7
mov ebx, eax
add eax, 0xd65b3c1e
sub eax, 0xd65b3c19
mov ecx, 0x2cbabb73
add ecx, 0xd645448d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x302d5b0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x302d5c7
push 0x57
call fcn.0301c970
jmp 0x302d624
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x302d5ea
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 8], eax
jae 0x302d622
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ecx + 0xc]
jb 0x302d617
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 0x10], ecx
jae 0x302d617
mov eax, dword [ebp - 4]
jmp 0x302d624
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
jmp 0x302d5e1
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x3037260
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x14], 0
jne 0x3037286
cmp dword [ebp + 0x18], 0
je 0x303727a
cmp dword [ebp + 0x1c], 0
jne 0x3037286
push 0x57
call fcn.0301c970
jmp 0x30373d5
mov eax, dword [ebp + 8]
push eax
call fcn.0301c970
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x30372a4
push 6
call fcn.0301c970
jmp 0x30373d5
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.0301c970
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x30372cc
push 0x7e
call fcn.0301c970
jmp 0x30373d5
mov dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
jne 0x303738b
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 0x14]
push ecx
call dword [0x31185fc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x303730e
push 0x57
call fcn.0301c970
jmp 0x30373d5
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebp + 0x1c], eax
cmp dword [ebp + 0x1c], 0
jne 0x3037339
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x57
call fcn.0301c970
jmp 0x30373d5
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.0301c970
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x303737f
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x303737f
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x1c]
je 0x303737f
mov ecx, dword [ebp - 4]
push ecx
call fcn.0301c970
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x30373b1
mov eax, dword [ebp + 0x1c]
push eax
call fcn.0301c970
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x30373b1
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x30373c0
push 0x57
call fcn.0301c970
jmp 0x30373d5
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0301c970
mov esp, ebp
pop ebp
ret 0x18
Function at 0x40598e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a01c]
jne 0x405998
repz ret
jmp fcn.00405d17
Function at 0x401cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop ebp
ret

Function at 0x401cf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x401000
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 0x7e1
push 0x4031d0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
xor ecx, ecx
nop word [eax + eax]
add edx, 1
lea eax, [ecx + 1]
cmovne eax, ecx
mov ecx, eax
cmp ecx, 3
jb 0x401030
xor eax, eax
mov edx, eax
and edx, 0x1f
movzx ecx, byte [edx + 0x4031d0]
xor byte [eax + 0x4031f0], cl
movzx ecx, byte [eax + 0x4031f0]
mov dl, byte [edx + 0x4031d0]
add dl, cl
xor dl, 0x7a
mov byte [eax + 0x4031f0], dl
inc eax
cmp eax, 0x7c1
jb 0x401042
mov eax, 0x4031f0
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401119
mov esp, ebp
pop ebp
ret

Function at 0x401090
Capabilities:
Get memory capacity
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x403004]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
lea eax, [esp + 8]
mov dword [esp + 8], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
shrd ecx, eax, 0x14
shr eax, 0x14
lea eax, [ecx - 0x200]
cmp eax, 0x1f200
ja 0x4010e1
call fcn.00401000
jmp 0x4010f6
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push str.The_US_president_says_he_hopes_there_will_be_a_ceasefire_by_next_week._Earlier_Monday__Hamas_dropped_some_key_demands_in_negotiations.A_diplomatic_source_familiar_with_the_discussions_confirmed_that_Hamas_softened_its_position_ahead_of_an_agreement_on_the_first_phase_of_a_deal._Though_it_is_expected_that_more_challenging_hurdles_will_emerge_later_when_complex_issues_like_Hamas_releasing_male_IDF_hostages_and_an_end_to_the_war_will_be_discussed.
push 0
call esi
push 0
push 0
push str.The_US_president_says_he_hopes_there_will_be_a_ceasefire_by_next_week._Earlier_Monday__Hamas_dropped_some_key_demands_in_negotiations.A_diplomatic_source_familiar_with_the_discussions_confirmed_that_Hamas_softened_its_position_ahead_of_an_agreement_on_the_first_phase_of_a_deal._Though_it_is_expected_that_more_challenging_hurdles_will_emerge_later_when_complex_issues_like_Hamas_releasing_male_IDF_hostages_and_an_end_to_the_war_will_be_discussed.
push 0
call esi
push 0
push 0
push 0x4031d0
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4039e0
Capabilities:
Encode data using xor

Disassembly:
rcl dword [ebx + 0x5f], cl
add esp, 0xfffffffc
mov esi, esp
mov dword [esi], edi
mov ebx, esp
add esp, 0xfffffffc
mov dword [esp], ebx
pop edi
mov edx, edi
mov ebx, edx
mov ecx, ebx
add esp, 0xfffffffc
mov dword [esp], ecx
mov edx, 0x31d5f80e
xor edx, 0x62c2edab
push edx
mov edx, 0x24ebf8ec
mov esi, 0x5a1cfb03
xor esi, edx
pop edi
xor esi, edi
mov edx, esi
push edx
mov edx, 0x47707008
xor edx, 0x72d1e6fd
mov esi, 0xe419674
mov ecx, 0x1600168b
xor ecx, esi
xor ecx, edx
pop ebx
xor ecx, ebx
push ecx
pop edi
mov edx, 4
sub esp, edx
mov dword [esp], edi
mov esi, 0x2a594f4c
mov edx, 0xb59554c
xor edx, esi
mov ecx, 0x3e4f747b
xor ecx, 0x3a2bf059
xor edx, ecx
mov esi, edx
push esi
mov ebx, 0x327f6f78
xor ebx, 0x5e760aa8
mov ecx, ebx
xor ecx, 0xffffffff
and ecx, 0x496d6ff2
and ebx, 0xb692900d
or ebx, ecx
pop edi
xor ebx, edi
add esp, 0xfffffffc
jmp 0x40374c

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x408898
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42b7a4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x4088b5
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x4088e3
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4088be
mov dword [ecx*4 + 0x42b7a0], eax
inc ecx
cmp ecx, 0x100
jne 0x4088b7
jmp 0x4088a9
cmp edx, ebx
je 0x4088fc
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x42b7a0]
jmp 0x4088e3
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x403afb
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
sub ebp, 0x82
mov esi, eax
mov edx, dword [0x406070]
mov ebx, eax
add edx, eax
mov eax, 0x406074
call fcn.00403a51
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x405ba4
push eax
sub edi, fcn.00405332
push edi
push fcn.00405332
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x403b6a
mov eax, fcn.00405332
mov ebx, esi
mov edx, edi
call fcn.00403a51
mov edx, 0x1c000
mov eax, 0x406074
mov ebx, esi
call fcn.00402219
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 1
call fcn.0040474d
mov eax, 0x406074
lea edi, [esi + 0x1c000]
xor edx, edx
or edi, esi
inc esi
div esi
lea ebx, [ebp - 2]
mov edx, edi
call fcn.00405332
lea esp, [ebp + 0x82]
jmp 0x403bc3
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret