joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10092090
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x100920c1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.100308d0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100921cc
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [ebx + 0xc]
imul edi, edi, 0x1000193
and edi, dword [ebx + 0x18]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x1009214f
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100921c2
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x10092189
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10092181
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x100921bf
cmp edi, edx
je 0x1009219c
nop dword [eax]
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x100921d5
cmp edi, edx
jne 0x10092190
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x10092100
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100921bf

Function at 0x100938a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100938cb
push 0
push 0
push 0
push 0x1002df80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100938cb
mov eax, 1
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x1009d8a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c0c7b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x100d0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100f86dc]
mov dword [ebp - 0x38], ecx
test al, 1
jne 0x1009d9fe
or eax, 1
mov dword [0x100f86dc], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100c6260]
xorps xmm0, xmmword [0x100c5f30]
mov dword [ebp - 0x24], 0x9d8dfe9d
mov dword [ebp - 0x20], 0x8c9dfb8d
mov dword [ebp - 0x1c], 0x8b859d8c
mov byte [ebp - 0x18], 0xbd
movups xmmword [ebp - 0x34], xmm0
nop dword [eax + eax]
xor byte [ebp + eax - 0x34], 0xbd
inc eax
cmp eax, 0x1d
jb 0x1009d930
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x3c], 0
movups xmmword [ebp - 0x50], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1009d956
sub ecx, edx
lea eax, [ebp - 0x34]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.10026800
mov byte [ebp - 4], 1
mov edx, dword [0x100f33cc]
test edx, edx
je 0x1009d97f
mov edx, dword [edx + 0x50]
jmp 0x1009d981
xor edx, edx
mov eax, dword [0x100f33c4]
test eax, eax
je 0x1009d98f
mov eax, dword [eax + 0x18]
jmp 0x1009d991
xor eax, eax
lea ecx, [ebp - 0x50]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.100206c0
mov eax, dword [ebp - 0x14]
add esp, 8
test eax, eax
je 0x1009d9b8
mov ecx, dword [eax + 1]
test ecx, ecx
jne 0x1009d9b3
xor eax, eax
jmp 0x1009d9b8
add eax, 5
add eax, ecx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x3c]
mov dword [0x100f86e0], eax
cmp ecx, 0xf
jbe 0x1009d9f7
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1009d9ed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1009d9ed
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100b8bd7
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [0x100f86e0], 0
je 0x1009da1c
push 0
mov ecx, dword [ebp - 0x38]
movss xmm1, dword [ebx + 0xc]
movss xmm2, dword [ebx + 8]
call dword [0x100f86e0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100a6e80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100a7011
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x280]
call eax
test al, al
je 0x100a7011
mov eax, dword [0x100f3478]
cmp dword [eax + 0x174], 0xffffffff
je 0x100a7011
mov eax, dword [0x100f3708]
add eax, 0xffffff91
xor eax, 0xacc6f41b
cmp dword [eax + ebx], 0
mov eax, dword [0x100f36d0]
setle cl
add eax, 0xffffff9f
xor eax, 0xacc6f40d
xor edi, edi
mov byte [eax + ebx], cl
mov eax, dword [0x100f36c4]
add eax, 0xffffffa2
xor eax, 0xacc6f40a
mov dword [eax + ebx + 0xc], 0
mov eax, dword [0x100f36c8]
add eax, 0xffffffa1
xor eax, 0xacc6f40b
mov dword [eax + ebx + 0xc], 0
mov ecx, dword [0x100f36cc]
lea eax, [ecx - 0x60]
xor eax, 0xacc6f40c
mov edx, dword [eax + ebx + 0xc]
mov dword [ebp - 4], edx
test edx, edx
je 0x100a6f6e
lea eax, [ecx - 0x60]
xor eax, 0xacc6f40c
mov eax, dword [eax + ebx]
mov esi, dword [eax + edi*4]
lea ebx, [eax + edi*4]
test esi, esi
je 0x100a6f66
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x100a6f5a
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 4]
call eax
test al, al
je 0x100a6f57
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov edx, dword [ebp - 4]
mov dword [ebx], 0
mov ecx, dword [0x100f36cc]
mov ebx, dword [ebp + 8]
inc edi
cmp edi, edx
jb 0x100a6f23
lea eax, [ecx - 0x60]
xor eax, 0xacc6f40c
lea ecx, [ebx + 8]
push 0
mov dword [eax + ebx + 0xc], 0
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [0x100f348c]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x100a7002
nop dword [eax]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x100a6fc6
xor edx, edx
test ecx, ecx
je 0x100a6fec
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100a6fd3
cmp edi, 0x79705c5e
je 0x100a6ff7
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x100a7002
mov ecx, dword [ebp - 4]
jmp 0x100a6fb0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + ebx*4]
jmp 0x100a7004
xor ecx, ecx
push 0
push dword [ebp + 8]
push 0
call dword [0x100f3560]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100aca90
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c135d
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100d0040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x100f3478]
mov edi, dword [esi + 0x174]
test edi, edi
setg byte [ebp - 0x14]
cmp dword [0x100d0148], 4
jne 0x100acaf9
mov edx, dword [esi + 0x4cb0]
add edx, dword [esi + 0x4cac]
mov ecx, dword [0x100f3420]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push dword [ebp - 0x14]
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x100f86f4], 0
jne 0x100acc2f
movaps xmm0, xmmword [0x100c5ff0]
xor eax, eax
movaps xmm2, xmmword [0x100c6260]
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x1c], 0xfefb
movaps xmm0, xmmword [0x100c6190]
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0x1a], 0xbd
nop
movups xmm0, xmmword [ebp + eax - 0x3c]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x3c], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100acb30
cmp eax, 0x23
jae 0x100acb5b
nop dword [eax]
xor byte [ebp + eax - 0x3c], 0xbd
inc eax
cmp eax, 0x23
jb 0x100acb50
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x40], 0
movups xmmword [ebp - 0x54], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100acb76
sub ecx, edx
lea eax, [ebp - 0x3c]
push ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.10026800
mov dword [ebp - 4], 0
mov edx, dword [0x100f33d8]
test edx, edx
je 0x100acba2
mov edx, dword [edx + 0x50]
jmp 0x100acba4
xor edx, edx
mov eax, dword [0x100f33d0]
test eax, eax
je 0x100acbb2
mov eax, dword [eax + 0x18]
jmp 0x100acbb4
xor eax, eax
lea ecx, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.10045b70
mov edi, dword [ebp - 0x18]
add esp, 8
mov ecx, dword [ebp - 0x40]
inc edi
cmp ecx, 0xf
jbe 0x100acbfe
mov edx, dword [ebp - 0x54]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100acbf4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100acbf4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100b8bd7
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x14], 0
call esi
lea eax, [ebp - 0x14]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x14]
push 4
push edi
call esi
mov byte [0x100f86f4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b875c
mov esp, ebp
pop ebp
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x41061c5c
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x1bd161e8
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401224
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0xc
call fcn.00406200
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
push 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x401286
push 6
call fcn.0040620c
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x64
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4012b0
push 6
call fcn.0040620c
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x102
jne 0x40130e
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4012e2
push 6
call fcn.0040620c
add esp, 4
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x401304
push 6
call fcn.0040620c
add esp, 4
mov eax, 1
jmp 0x401318
mov eax, 0
jmp 0x401318
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.00406206
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x402a11
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push 0
push 0x416262
push 0x416262
push 1
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.WININET.dll_InternetOpenA]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x402a6e
push 6
call fcn.0040620c
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push 0
push SysReAllocString
push 0
push 0x416262
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x402aac
push 6
call fcn.0040620c
add esp, 4
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x800
push 1
mov ebx, 0x184
call fcn.00407510
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402ae4
push ebx
call fcn.00406206
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0
mov ebx, 0x350
call fcn.00407190
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402b0d
mov eax, 0x416262
push eax
push 1
mov ebx, 0x130
call fcn.00406c10
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetReadFile]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x402b4f
push 6
call fcn.0040620c
add esp, 4
push 0x80000301
push 0
push dword [ebp - 0xc]
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402b6c
mov eax, 0x416262
push eax
push 2
mov ebx, 0x134
call fcn.00406c30
add esp, 0x1c
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
mov ecx, 2
call fcn.00401397
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x402ba8
push ebx
call fcn.00406206
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x402bbc
push ebx
call fcn.00406206
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
jne 0x402ae8
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x402be6
push eax
mov ebx, eax
call fcn.0040132c
inc eax
push eax
call fcn.00406200
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x402beb
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402bfc
push ebx
call fcn.00406206
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x402c0c
push ebx
call fcn.00406206
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x406710
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret
Function at 0x406730
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x406771.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x406771.2
jmp dword [eax*4 + 0x4067fc]
mov word [esp + 0x48], di
jmp 0x4067aa
mov word [esp + 0x48], 2
jmp 0x4067aa
mov word [esp + 0x48], 3
jmp 0x4067aa
mov word [esp + 0x48], 4
jmp 0x4067aa
mov word [esp + 0x48], 7
jmp 0x4067aa
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x4067f4
cmp dword [esp + 0x70], edi
je 0x4067e0
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x406ca0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x406cbe
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x406cb3
pop esi
ret

Function at 0x4077d0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4077f8
pop edi
or eax, eax
pop esi
ret
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], 0xffffffff
jne 0x40781a
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, edi
pop edi
pop esi
ret
Function at 0x407960
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x407973
xor eax, eax
pop esi
add esp, 8
ret
push esi
call fcn.004097d0
add esp, 4
test eax, eax
jne 0x407985
pop esi
add esp, 8
ret
mov eax, dword [esi]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push edi
mov dword [esp + 0x10], 0
jne 0x4079fc
mov eax, dword [esp + 0x1c]
mov edi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x407a2e
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x4079e8
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4079b8
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
pop edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 8
ret
cmp eax, 2
jne 0x407a2e
mov eax, dword [esp + 0x1c]
mov esi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x407a2e
lea edi, [esp + 0x2c]
lea ebx, [eax - 1]
mov eax, dword [edi]
mov edx, dword [esi]
mov ecx, dword [eax + 4]
add eax, 8
push ecx
push eax
mov ecx, esi
call dword [edx + 0x24]
add edi, 0xc
dec ebx
jne 0x407a17
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret

Function at 0x407a50
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x407ab9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00406390
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x407ac0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x407b52
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x407b44
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x407b3c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x407b05
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x407b60
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret
Function at 0x4029ac
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4029db
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403d84
jmp 0x4029f9
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402934
mov edi, eax
test ebx, ebx
je 0x4029f9
cmp dword [esi], 0
je 0x4029f9
dec ebx
jmp 0x4029e2
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402bd0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x498044], 0x8088405
inc edx
mov dword [0x498044], edx
mul edx
mov eax, edx
ret

Function at 0x402dc8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402e60
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402e40
xor eax, eax
push ebp
push 0x402e39
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402e7c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e40
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403c50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402798
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x498049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403c18
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc