joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae8dc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4160f0]
call fcn.004051b4
xor eax, eax
push ebp
push 0x4aea20
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c4f3c], 0
jne 0x4ae92f
mov ecx, dword [0x4c5dd0]
mov dl, 1
mov eax, dword [0x407fe0]
call fcn.0040cac8
call fcn.004040d8
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403140
mov eax, ebx
call fcn.00404f6c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4aea30
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406230
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404f7c
test eax, eax
jle 0x4ae9c7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4ae9c0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404944
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040492c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408e20
test eax, eax
jne 0x4ae9c0
mov ebx, 0x15
jmp 0x4ae9cc
mov ebx, 0x10
jmp 0x4ae9cc
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4c4f3c]
call fcn.004ae834
mov eax, dword [ebp - 8]
call fcn.004ae834
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406248
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aea27
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004046e0
lea eax, [ebp - 0x10]
mov edx, dword [0x4160f0]
call fcn.00405284
ret
Function at 0x4b6018
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4c50ac]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4c50ac]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4c50ac]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4c50ac]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4c5030]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4b6043
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4b6110
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4c50ac]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4c50ac]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4c50ac]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4c50ac]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4c5030]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x4b614b
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4b622c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4c50ac]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4c50ac]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4c50ac]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4c50ac]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4c5030]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
xor ecx, ecx
mov cl, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x4c50ac]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4c50ac]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4c50ac]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4c50ac]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x4b6277
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4bb9fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b6c
xor eax, eax
push ebp
push 0x4bba9e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4bbab4
lea edx, [ebp - 0x14]
mov eax, dword [0x4c60e4]
mov eax, dword [eax]
call fcn.0046c124
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004097c4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004097c4
push dword [ebp - 0xc]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404a3c
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404b7c
push eax
push 0x4bbab8
push 0x4bbac4
mov eax, dword [0x4c60e4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bbaa5
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004046e0
ret

Function at 0x4bbacc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bbb75
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
call fcn.00409b54
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404710
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebx]
call fcn.0040497c
mov edx, eax
mov eax, dword [ebx]
mov ecx, 1
call fcn.00404bdc
mov eax, dword [ebp - 0x108]
mov edx, 0x4bbb8c
call fcn.00404ac8
je 0x4bbb54
mov eax, ebx
mov edx, 0x4bbb8c
call fcn.00404984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bbb7c
lea eax, [ebp - 0x108]
call fcn.004046bc
lea eax, [ebp - 4]
call fcn.004046bc
ret

Function at 0x4bbb90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4bbc38
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
push edx
and eax, 0x7f
mov eax, dword [eax*4 + 0x4c5cac]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.00409b54
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebx]
call fcn.0040497c
mov edx, eax
mov eax, dword [ebx]
mov ecx, 1
call fcn.00404bdc
mov eax, dword [ebp - 0x110]
mov edx, 0x4bbc4c
call fcn.00404ac8
je 0x4bbc1f
mov eax, ebx
mov edx, 0x4bbc4c
call fcn.00404984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bbc3f
lea eax, [ebp - 0x110]
call fcn.004046bc
ret
Function at 0x4bc7e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x4bc877
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004046bc
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x4bc814
bt esi, eax
jae 0x4bc856
lea eax, [ebp - 4]
lea edx, [ebx + 0x41]
call fcn.004048a4
lea eax, [ebp - 4]
mov edx, 0x4bc890
call fcn.00404984
mov eax, dword [ebp - 4]
call fcn.00404b7c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4bc856
lea eax, [ebp - 8]
lea edx, [ebx + 0x41]
call fcn.004048a4
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00404984
inc ebx
cmp ebx, 0x1a
jne 0x4bc80a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc87e
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046e0
ret

Function at 0x4bc894
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x4bc92f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004046bc
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x4bc8c8
bt esi, eax
jae 0x4bc90e
lea eax, [ebp - 4]
lea edx, [ebx + 0x41]
call fcn.004048a4
lea eax, [ebp - 4]
mov edx, 0x4bc948
call fcn.00404984
mov eax, dword [ebp - 4]
call fcn.00404b7c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x4bc90e
test ebx, ebx
je 0x4bc90e
lea eax, [ebp - 8]
lea edx, [ebx + 0x41]
call fcn.004048a4
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00404984
inc ebx
cmp ebx, 0x1a
jne 0x4bc8be
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc936
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046e0
ret
Function at 0x4bd9f4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b6c
xor eax, eax
push ebp
push 0x4bdaef
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417110]
call fcn.00403858
mov edi, eax
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x4bda3b
bt esi, eax
jae 0x4bdac8
lea eax, [ebp - 8]
lea edx, [ebx + 0x41]
call fcn.004048a4
lea eax, [ebp - 8]
mov edx, 0x4bdb08
call fcn.00404984
mov eax, dword [ebp - 8]
call fcn.00404b7c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x4bda70
test ebx, ebx
jne 0x4bda9b
lea eax, [ebp - 0xc]
lea edx, [ebx + 0x41]
call fcn.004048a4
lea eax, [ebp - 0xc]
mov edx, 0x4bdb08
call fcn.00404984
mov eax, dword [ebp - 0xc]
call fcn.00404b7c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4bdac8
lea eax, [ebp - 0x14]
lea edx, [ebx + 0x41]
call fcn.004048a4
push dword [ebp - 0x14]
push 0x4bdb08
push dword [ebp - 4]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404a3c
mov edx, dword [ebp - 0x10]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp ebx, 0x1a
jne 0x4bda31
mov ebx, edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bdaf6
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004046e0
ret
Function at 0x4be7f8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4be99c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417110]
call fcn.00403858
mov dword [ebp - 0x10], eax
xor edx, edx
mov eax, 2
call fcn.004ae2ac
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x13c], 0x128
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 0xc]
call fcn.004ae2cc
mov dword [ebp - 8], eax
jmp 0x4be952
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4be941
inc ebx
xor esi, esi
lea ecx, [ebp - 0x144]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408c40
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x150]
mov eax, dword [ebp - 0x134]
call fcn.004ae34c
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
call fcn.00404944
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00408c40
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404cc0
test eax, eax
je 0x4be939
push 0
mov eax, dword [ebp - 0x134]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4be939
lea ecx, [ebp - 0x154]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x154]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4be88f
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 0xc]
call fcn.004ae2ec
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4be879
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be9a3
lea eax, [ebp - 0x154]
call fcn.004046bc
lea eax, [ebp - 0x150]
call fcn.00404df0
lea eax, [ebp - 0x14c]
mov edx, 4
call fcn.004046e0
ret
Function at 0x4bf7d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b6c
xor eax, eax
push ebp
push 0x4bf86f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004bdde0
test al, al
je 0x4bf859
mov dl, 1
mov eax, dword [0x417110]
call fcn.00403858
mov ebx, eax
mov dl, 1
mov eax, dword [0x417110]
call fcn.00403858
mov eax, dword [ebp - 4]
call fcn.004bdfd8
mov esi, eax
mov eax, esi
call fcn.004bf24c
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, ebx
call fcn.004bd944
mov ebx, eax
push 1
push 0x4bf880
push 0x4bf880
mov eax, dword [ebp - 4]
call fcn.00404b7c
push eax
push 0x4bf884
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf876
lea eax, [ebp - 4]
call fcn.004046bc
ret

Function at 0x4c1128
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4c11b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433540]
call fcn.00433640
mov esi, eax
mov edx, 0x80000002
mov eax, esi
call fcn.004336e0
xor ecx, ecx
mov edx, 0x4c11d0
mov eax, esi
call fcn.00433824
lea edx, [ebp - 8]
mov eax, dword [0x4c60e4]
mov eax, dword [eax]
call fcn.0046c124
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004097f8
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00433e1c
mov ebx, eax
mov eax, esi
call fcn.004336b0
mov eax, esi
call fcn.00403888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c11bd
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046e0
ret
Function at 0x4023f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x408ee3
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x40e018]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
xor eax, eax
or edx, 0xffffffff
mov dword [edi + 8], edx
mov dword [edi + 4], edx
mov dword [edi + 0xc], eax
mov dword [edi + 0x20], 0x40e588
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [esp + 0x18], eax
lea ecx, [edi + 0x34]
mov dword [edi], vtable.TiXmlDocument.0
mov dword [ecx], 0x40e588
mov byte [esp + 0x18], 1
mov dword [edi + 0x40], edx
mov dword [edi + 0x3c], edx
push ecx
xor esi, esi
mov ebx, 0x40a674
mov dword [edi + 0x38], 4
mov byte [edi + 0x44], al
mov byte [edi + 0x2c], al
mov dword [edi + 0x30], eax
call fcn.00401130
xor eax, eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x3c], eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x405a80
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x130
mov eax, dword [0x40e018]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
lea ecx, [esp + 0x2c]
push ecx
push str.TGame.exe
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x405ae4
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.00407ec8
mov esp, ebp
pop ebp
ret
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405b1f
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea esp, [esp]
lea eax, [esp + 0x2c]
push eax
push str.TGame.exe
call edi
test eax, eax
je 0x405ace
lea ecx, [esp + 8]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405b00
mov ecx, dword [esp + 0x134]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.00407ec8
mov esp, ebp
pop ebp
ret
Function at 0x407ec8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e018]
jne 0x407ed2
repz ret
jmp fcn.00408266
Function at 0x402bf0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x517008], 0x8088405
inc edx
mov dword [ebx + 0x517008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x404464
Capabilities:
Packed with generic packer

Disassembly:
test edx, edx
je 0x4044c9
test ecx, ecx
je fcn.0040419c
cmp edx, dword [eax]
je 0x4044d0
cmp ecx, dword [eax]
je 0x404486
push eax
push ecx
call fcn.0040419c
pop edx
pop eax
jmp fcn.00404420
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
push eax
mov eax, dword [ebx - 4]
add eax, dword [esi - 4]
call fcn.0040420c
mov edi, eax
mov edx, eax
mov eax, ebx
mov ecx, dword [ebx - 4]
call fcn.0040293c
mov edx, edi
mov eax, esi
mov ecx, dword [esi - 4]
add edx, dword [ebx - 4]
call fcn.0040293c
pop eax
mov edx, edi
test edi, edi
je 0x4044c0
dec dword [edi - 8]
call fcn.0040419c
pop edi
pop esi
pop ebx
ret
mov edx, ecx
jmp fcn.0040419c
mov edx, ecx
jmp fcn.00404420

Function at 0x42f7c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42f7f1
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x42f7e2
and ecx, 3
je 0x42f809
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x42f7f6
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x42f814
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x42f84d
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x42f835
pop esi
and esi, 3
je 0x42f872
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x42f853
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x42f87c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42f8a8
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x42f899
and ecx, 3
je 0x42f8c0
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x42f8ad
pop esi
pop edi
pop ebx
pop ebp
ret 4