joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cc28
Capabilities:
Accept command line arguments

Disassembly:
push edi
push edi
push edi
lea eax, [ebp - 0x44]
push eax
call ebx
test eax, eax
je 0x100c305
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x100867e
push 0x100c178
push dword [ebp - 0x20]
call edi
pop ecx
pop ecx
test eax, eax
je 0x100ead4
push 0x100c160
push dword [ebp - 0x20]
call edi
pop ecx
pop ecx
test eax, eax
je 0x100c12d
push 0x100c14c
push dword [ebp - 0x24]
call edi
pop ecx
pop ecx
test eax, eax
jne 0x100ea65
mov byte [ebp - 0x1a], 1
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.01001cdd
test ebx, ebx
jge 0x100eae6
mov eax, ebx
call fcn.01005b3a
ret
mov ecx, esi
call fcn.0100c32c
mov ebx, eax
cmp ebx, edi
jl 0x100eb14
push dword [0x102a0f8]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100eb14
push 0x100c954
push dword [ebp - 0x20]
call edi
jmp 0x100ea59
push 0x38
mov eax, 0x1023779
call fcn.01005b4e
mov esi, 0x100ccc4
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov byte [ebp - 0x19], 1
mov byte [ebp - 0x1a], bl
movsw word es:[edi], word [esi]
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.0100ca38
mov dword [ebp - 0x24], eax
mov esi, 0x102a0b0
test eax, eax
je 0x100eaf0
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
call fcn.01003d0c
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.01003cc7
mov ecx, eax
call fcn.01003c94
push eax
lea ecx, [ebp - 0x20]
call fcn.01002dc6
push 0x100ccac
push dword [ebp - 0x20]
call edi
jmp 0x100ea4d
mov ecx, esi
call 0x100c8cd
test al, al
je 0x100eb0a
cmp ebx, edi
jl 0x100eb14
push 5
push 4
mov ecx, esi
call fcn.0100cd20
mov ebx, eax
cmp ebx, edi
jl 0x100eb14
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov ebx, eax
cmp ebx, edi
jl 0x100eb14
cmp byte [ebp - 0x1a], 0
je 0x100c305
mov ebx, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x100867e
pop ecx
pop ecx
test eax, eax
jne 0x100c944
jmp 0x100ea8e
pop ecx
pop ecx
test eax, eax
jne 0x100c0f5
jmp 0x100eab5
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x24]
call fcn.0100ca38
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0
call fcn.01001cdd
cmp dword [ebp - 0x24], 0
je 0x100eaf0
jmp 0x100cc74
xor edi, edi
push edi
push edi
push 0x65
push esi
call fcn.01014859
mov ebx, eax
cmp ebx, edi
jl 0x100eaac
push edi
push 1
mov ecx, esi
call fcn.0101abbe
mov ebx, eax
mov byte [ebp - 0x19], 0
jmp 0x100c131
push 0
push 1
push 0x65
push esi
call fcn.01014859
mov ebx, eax
test ebx, ebx
jl 0x100eaac
push 0
push 1
mov ecx, esi
call fcn.0101ab52
jmp 0x100eaaa
call fcn.010200e5
mov ebx, eax
test ebx, ebx
setge byte [ebp - 0x19]
jmp 0x100c131
cmp byte [ebp - 0x19], 0
je 0x100c144
push 1
push 8
call fcn.01015034
mov ebx, eax
xor edi, edi
cmp ebx, edi
jge 0x100ccca
jmp 0x100c144
mov ebx, 0x80004005
jmp 0x100ccd9
push 0x1000000
call sub.DUI70.dll_UnInitProcessPriv
jmp 0x100c144
Function at 0x100d544
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x102a024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0100d615
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x100d5e6
cmp dword [ebp - 0x94], 5
jb 0x100d5b9
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x100d600
call fcn.0100d2ac
test eax, eax
jl 0x10113d4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01001bab
leave
ret
cmp dword [ebp - 0x88], 1
je 0x10113bc
jmp 0x100d5b9
cmp dword [ebp - 0x90], 0
jbe 0x100d5b9
jmp 0x100d5b5
cmp dword [ebp - 0x94], 4
ja 0x100d5b5
je 0x100d5f5
jmp 0x100d5b9
mov byte [0x102a604], 1
jmp 0x100d5d7
Function at 0x1012b6a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ebx, ecx
test esi, esi
jne 0x1012b85
push 0x80004005
call fcn.010128cb
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x1012b87
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10132aa
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x102a024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, ecx
mov ecx, dword [ebp + 8]
push 0x2001f
push ecx
push dword [eax]
xor esi, esi
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.01007b57
mov edi, eax
cmp edi, esi
je 0x101331c
lea ecx, [ebp - 0x214]
call fcn.01007440
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01001bab
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x101333a
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.010132aa
cmp eax, esi
jne 0x1013385
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], 0x100
call edi
test eax, eax
je 0x1013324
lea ecx, [ebp - 0x214]
call fcn.01007440
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x218]
call fcn.01012995
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.01007440
mov eax, esi
jmp 0x101330c
Function at 0x101464d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1022fe3
call fcn.01020774
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x10146a6
call fcn.01012923
mov esi, eax
jmp 0x10147af
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x10146bf
call fcn.01012923
jmp 0x10147a1
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x10146b5
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x420], edi
cmp eax, edi
jae 0x1014725
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x101470b
lea ecx, [ebp - 0x418]
call fcn.010131be
mov esi, 0x8007000e
lea ecx, [ebp - 0x424]
call fcn.01013133
mov eax, esi
call fcn.010207b4
ret 0x10
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.010138ba
mov dword [ebp - 4], 1
jmp 0x1014753
cmp dword [ebp - 0x418], esi
jne 0x1014762
mov esi, 0x8007000e
jmp 0x10147a3
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x10146b5
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.01014511
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1014710
lea ecx, [ebp - 0x418]
call fcn.010131be
jmp 0x1014710

Function at 0x101f8f8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x21c
mov eax, 0x1024462
call fcn.01005b4e
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], 0
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x224], 0
push 0x102a084
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x21c], eax
call fcn.01001e95
push ebx
push dword [ebp - 0x21c]
xor esi, esi
lea eax, [ebp - 0x220]
push 0x101f9e0
inc esi
push eax
mov dword [ebp - 4], esi
call fcn.010028ff
add esp, 0x10
mov ecx, edi
call fcn.01004b2b
mov dword [ebp - 0x224], esi
mov esi, dword [ebp - 0x220]
xor ebx, ebx
cmp dword [esi - 0xc], ebx
je 0x101f9ce
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push 2
push 0x1006b28
push esi
push 0x80000002
mov dword [ebp - 0x21c], 0x208
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp eax, ebx
jne 0x101f9ce
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.01002e50
lea ecx, [esi - 0x10]
call fcn.01001cdd
mov eax, edi
call fcn.01005b3a
ret 0xc
Function at 0x101fe61
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 8]
xor esi, esi
push 0x101fe98
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test eax, eax
jne 0x101fe8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01014bd1
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x101fea7
Capabilities:
Get keyboard layout

Disassembly:
push 0xc
mov eax, 0x1024665
call fcn.01001e50
xor ebx, ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x14]
push eax
push 0x101ffa4
push 0x17
push ebx
push 0x101ffc4
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, ebx
jl 0x101ff88
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx edi, ax
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0101fe30
mov esi, eax
cmp esi, ebx
jl 0x101ff61
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x101ff61
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx]
lea eax, [ebp - 0x10]
push eax
mov eax, 0x101ffb4
push eax
push ebx
push eax
push ecx
mov byte [ebp - 4], 2
call dword [edx + 0xc]
mov esi, eax
cmp esi, ebx
jl 0x101ff40
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x101ff40
mov ecx, dword [eax]
push edi
push 0xffffffffffffffff
push ebx
push eax
call dword [ecx + 0xc]
mov esi, eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x101ff50
mov dword [ebp - 0x10], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x101ff61
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, 0x80004002
jne 0x101ff78
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push edi
push 0xffffffffffffffff
push ebx
push eax
call dword [ecx + 0xc]
mov esi, eax
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x101ff88
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x101ff99
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.01001e37
ret
Function at 0x10200e5
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push 0x68
mov eax, 0x102471d
call fcn.01002309
mov esi, 0x102a084
push esi
lea ecx, [ebp - 0x14]
call fcn.01001e95
xor ebx, ebx
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.01001e95
mov dword [ebp - 0x18], ebx
push 0x1020270
lea eax, [ebp - 0x1c]
push 0x10202c0
push eax
mov byte [ebp - 4], 2
call fcn.010028ff
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push 0x20019
push ebx
push dword [ebp - 0x1c]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x1020150
mov esi, 0x8000ffff
jmp 0x1020220
mov eax, 0x20a
push eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 3
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov edi, eax
lea eax, [ebp - 0x20]
push eax
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 4], 2
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x102019d
mov esi, 0x8000ffff
jmp 0x10201a9
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.0101cb99
mov esi, eax
cmp edi, ebx
je 0x10201b4
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
cmp esi, ebx
jl 0x1020220
push 0x44
lea eax, [ebp - 0x74]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push 0x1020248
lea ecx, [ebp - 0x14]
stosd dword es:[edi], eax
call fcn.0101fd89
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push 8
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x14]
call fcn.01003625
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1020210
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01014bd1
mov esi, eax
jmp 0x1020220
push dword [ebp - 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x30]
call edi
lea ecx, [ebp - 0x18]
call fcn.0100a0ed
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.01001cdd
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.01001cdd
mov eax, esi
call fcn.01001e37
ret
Function at 0x1020f67
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x102a024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10210d8]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [0x10210dc]
push esi
push edi
mov dword [ebp - 0xc], eax
xor esi, esi
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
mov dword [ebp - 0x220], esi
cmp ebx, esi
jne 0x1020fac
or eax, 0xffffffff
jmp 0x1021063
lea eax, [ebp - 0x220]
push eax
push 0x20019
push esi
push 0x1021078
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1020fa4
cmp dword [ebp - 0x220], esi
je 0x1020fa4
push 0xa
lea eax, [ebp - 0xa]
push eax
lea edi, [esi + 1]
push edi
mov dword [ebp - 0x224], 0x20a
call dword [sym.imp.msvcrt.dll__itow]
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x228]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1021026
cmp eax, 0xea
je 0x102104e
jmp 0x1021055
cmp dword [ebp - 0x228], 1
jne 0x1021055
mov eax, dword [ebp - 0x224]
cmp eax, 2
jbe 0x102104e
shr eax, 1
dec eax
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov dword [ebx + esi*4], eax
mov esi, edi
cmp esi, 0x19
jl 0x1020fd5
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001bab
leave
ret 4

Function at 0x1022088
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10220f2
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x10220e6
cmp dword [ebp + 0xc], 4
jne 0x10220e6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10220f1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x1022712
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x102a024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x41c]
push eax
xor esi, esi
push 0x104
mov dword [ebp - 0x420], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1022775
call ebx
push eax
call fcn.01014bd1
mov esi, eax
test esi, esi
jl 0x102281d
lea eax, [ebp - 0x210]
push eax
push 0
push edi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x102279a
call ebx
push eax
call fcn.01014bd1
mov esi, eax
xor edi, edi
cmp esi, edi
jl 0x102281d
mov ecx, dword [ebp - 0x428]
lea eax, [ebp - 0x210]
push eax
call fcn.01002e50
push edi
push 0x2100
push 2
push edi
push edi
push 0x40000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x10227dc
call fcn.01012923
mov esi, eax
jmp 0x10227e4
mov dword [ebp - 0x420], eax
xor esi, esi
cmp esi, edi
jl 0x102280a
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x420]
push dword [ebp - 0x424]
call fcn.010062dd
lea ecx, [ebp - 0x420]
mov esi, eax
call fcn.010062c1
cmp dword [ebp - 0x420], edi
je 0x102281d
lea ecx, [ebp - 0x420]
call fcn.010062c1
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001bab
leave
ret 0x10
Function at 0x1022835
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x102a024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
xor ebx, ebx
push 1
push ebx
mov dword [ebp - 0x84], eax
push ebx
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x74], 0x80004005
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1022980
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1022976
push edi
mov byte [ebp - 0x18], bl
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi]
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x80], ebx
mov ecx, dword [eax - 0xc]
push ebx
add ecx, ecx
push ecx
push eax
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x102296c
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 4
pop eax
push ebx
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], eax
call edi
test eax, eax
je 0x102296c
push 0x14
pop esi
push ebx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x18]
push eax
push 2
push dword [ebp - 0x78]
mov dword [ebp - 0x70], esi
call edi
test eax, eax
je 0x102296c
cmp dword [ebp - 0x70], esi
jbe 0x1022910
mov dword [ebp - 0x70], esi
xor eax, eax
push 0x50
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor edi, edi
cmp dword [ebp - 0x70], ebx
jbe 0x102295a
mov dword [ebp - 0x74], ebx
lea esi, [ebp - 0x6c]
movzx eax, byte [ebp + edi - 0x18]
push eax
push 0x1022994
push 0x29
pop eax
sub eax, dword [ebp - 0x74]
push eax
push esi
call sub.msvcrt.dll_swprintf_s
add dword [ebp - 0x74], 2
add esp, 0x10
inc edi
add esi, 4
cmp edi, dword [ebp - 0x70]
jb 0x1022932
mov ecx, dword [ebp - 0x84]
lea eax, [ebp - 0x6c]
push eax
call fcn.01002e50
mov dword [ebp - 0x74], ebx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop edi
push ebx
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x74]
pop esi
xor ecx, ebp
pop ebx
call fcn.01001bab
leave
ret 8
Function at 0x402f70
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402fac
movzx eax, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402fcc
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004049fc
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x403264
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040478c
test esi, esi
jne 0x40329a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040487c
jmp 0x4032b8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403108
mov edi, eax
test esi, esi
je 0x4032b8
cmp dword [ebx], 0
je 0x4032b8
dec esi
jmp 0x4032a1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4032ec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x419008], 0x8088405
inc edx
mov dword [ebx + 0x419008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4038d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x419024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40396c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40394c
xor eax, eax
push ebp
push 0x403945
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403988
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40394c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x419024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x419024], ax
mov esp, ebp
pop ebp
ret

Function at 0x40460c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0xc50044], 0
je 0x40466d
cmp word [0xc50218], 0xd7b2
jne 0x404635
cmp dword [0xc50220], 0
jbe 0x404635
mov eax, 0xc50214
call dword [0xc50230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404694
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x419030], 0
jne 0x404689
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret