joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a15f
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
movsx edx, byte [ebp + 0xc]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x44f720]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x44f720]
pop esi
mov dword [ecx + 8], eax
pop ebp
ret

Function at 0x42a22b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
je 0x42a2a0
mov eax, dword [esi + 0x3c]
xor ebx, ebx
cmp eax, ebx
je 0x42a257
cmp dword [esi + 0x40], edi
jae 0x42a257
push eax
call fcn.0042c58d
pop ecx
mov dword [esi + 0x3c], ebx
cmp dword [esi + 0x3c], ebx
jne 0x42a26c
lea eax, [edi + edi]
push eax
call fcn.0042b2f1
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x3c]
call fcn.0042b3b0
add esp, 0xc
test edi, edi
je 0x42a29d
mov eax, dword [esi + 0x3c]
movzx eax, byte [ebx + eax]
push eax
lea eax, [esi + 0x30]
push eax
call fcn.0042a1cc
pop ecx
pop ecx
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jb 0x42a27f
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42a2cf
mov eax, dword [esi + 0x24]
lea ebx, [eax + edi]
cmp ebx, dword [esi + 0x28]
jb 0x42a2bb
mov dword [esi + 0x14], 0x30000
jmp 0x42a2f1
push edi
push edx
add eax, ecx
push eax
call fcn.0042b3b0
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
jmp 0x42a2f3
mov eax, dword [esi + 4]
test eax, eax
je 0x42a2ea
push 0
lea ecx, [ebp + 8]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x42a2f3
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42a48e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x45c2c0]
xor eax, ebp
mov dword [ebp - 4], eax
inc dword [0x45ea70]
push esi
push dword [0x45ea70]
mov esi, dword [ebp + 8]
push ecx
lea eax, [ebp - 0x204]
push str._ld_ld
push eax
call fcn.0042d27b
add esp, 0x10
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x204]
push eax
push esi
call fcn.0042c22c
push 0x44fb24
push esi
call fcn.0042c22c
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop esi
call fcn.0042bd88
leave
ret 4
Function at 0x42a54a
Capabilities:
Check if file exists
Delete file
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x45c2c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
and dword [ebp - 0x214], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x21c], eax
test ebx, ebx
je 0x42a654
cmp dword [ebp + 0xc], 0
je 0x42a654
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc eax
neg eax
sbb eax, eax
inc eax
jne 0x42a5ae
push esi
call edi
test eax, eax
je 0x42a653
mov ecx, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call fcn.0042a48e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
neg eax
sbb eax, eax
inc eax
jne 0x42a5e2
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
je 0x42a638
lea eax, [ebp - 0x20c]
push 0x454b38
push eax
call fcn.0042cd1d
pop ecx
pop ecx
mov dword [ebp - 0x210], eax
test eax, eax
je 0x42a638
push eax
push dword [ebp + 0xc]
push 1
push ebx
call fcn.0042cbe5
push dword [ebp - 0x210]
call fcn.0042ca1a
mov ecx, dword [ebp - 0x218]
add esp, 0x14
push dword [ebp - 0x21c]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0042a4fc
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42a653
lea eax, [ebp - 0x20c]
push eax
call edi
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042bd88
leave
ret 0x10

Function at 0x42bd88
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45c2c0]
jne 0x42bd92
repz ret
jmp fcn.0043384c
Function at 0x441c9d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45c2c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004332f7
and dword [ebp - 0x14], 0
cmp dword [0x45fa00], 0
mov dword [ebp - 0x18], eax
jne 0x441d50
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x441df8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4529ec
push ebx
call edi
test eax, eax
je 0x441df8
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x45fa00], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x45fa04], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x45fa08], eax
call edi
push eax
call esi
mov dword [0x45fa10], eax
test eax, eax
je 0x441d50
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x45fa0c], eax
mov eax, dword [0x45fa0c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x441da9
cmp dword [0x45fa10], ecx
je 0x441da9
push eax
call esi
push dword [0x45fa10]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x441da9
test ebx, ebx
je 0x441da9
call edi
test eax, eax
je 0x441da0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x441da0
test byte [ebp - 8], 1
jne 0x441da9
or dword [ebp + 0x10], 0x200000
jmp 0x441ddc
mov eax, dword [0x45fa04]
cmp eax, dword [ebp - 0x18]
je 0x441ddc
push eax
call esi
test eax, eax
je 0x441ddc
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x441ddc
mov eax, dword [0x45fa08]
cmp eax, dword [ebp - 0x18]
je 0x441ddc
push eax
call esi
test eax, eax
je 0x441ddc
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x45fa00]
call esi
test eax, eax
je 0x441df8
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x441dfa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042bd88
leave
ret
Function at 0x421acb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041f645
and dword [ebp - 0x14], 0
cmp dword [0x42f0dc], 0
mov dword [ebp - 0x18], eax
jne 0x421b7e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x421c26
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x421c26
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42f0dc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42f0e0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42f0e4], eax
call edi
push eax
call esi
mov dword [0x42f0ec], eax
test eax, eax
je 0x421b7e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42f0e8], eax
mov eax, dword [0x42f0e8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x421bd7
cmp dword [0x42f0ec], ecx
je 0x421bd7
push eax
call esi
push dword [0x42f0ec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x421bd7
test ebx, ebx
je 0x421bd7
call edi
test eax, eax
je 0x421bce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x421bce
test byte [ebp - 8], 1
jne 0x421bd7
or dword [ebp + 0x10], 0x200000
jmp 0x421c0a
mov eax, dword [0x42f0e0]
cmp eax, dword [ebp - 0x18]
je 0x421c0a
push eax
call esi
test eax, eax
je 0x421c0a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x421c0a
mov eax, dword [0x42f0e4]
cmp eax, dword [ebp - 0x18]
je 0x421c0a
push eax
call esi
test eax, eax
je 0x421c0a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42f0dc]
call esi
test eax, eax
je 0x421c26
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x421c28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420dfd
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x10024ea4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10024eb3
pop dword [ebp - 0x38]
mov eax, 0x10024eb3
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3b298
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x48e3
xor esi, esi
add esi, eax
mov edi, 0x1003da00
add edi, dword [ebp - 0x38]
mov ebx, 0x3089707f
xor dword [ebp - 0x24], ebx
mov edx, dword [edi]
add dword [ebp - 0x24], edx
xor edx, ebx
sub dword [ebp - 0x30], 0xf17cb625
mov dword [esi], edx
add dword [ebp - 0x28], edx
add esi, 4
add edi, 0xce525c68
add edi, 0x31ada39c
loop 0x10024ef8
add eax, 0xf57fc25a
sub eax, 0xf57eabfb
mov ebx, eax
add eax, 0x1a329ef9
sub eax, 0x1a329ef4
mov ecx, 0xef3784ac
add ecx, 0x20c87b54
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401930
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x114], str.777ll
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp - 0x114]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x40199f
cmp dword [ebp - 0x118], 0
je 0x40199f
jmp 0x401a03
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x401a03
mov dword [ebp - 0x11c], 0x7dc35
mov edx, dword [ebp + 8]
add edx, 8
mov dword [0x440d34], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [0x440d50], ecx
mov dword [ebp - 0x11c], 0x7dc35
mov dword [ebp - 0x11c], 0x7dc35
call fcn.004011b0
mov edx, dword [ebp + 8]
mov dword [0x440d4c], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
call fcn.00401300
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x40199f
mov esp, ebp
pop ebp
ret

Function at 0x401aa0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x440d40], 0x24e1
mov eax, dword [0x440d40]
sub eax, 0x24e1
mov dword [0x440d40], eax
mov ecx, 1
test ecx, ecx
je 0x401b4b
mov edx, dword [0x440d40]
cmp edx, dword [ebp + 0xc]
jb 0x401ad7
jmp 0x401b4b
cmp dword [0x440d40], 0
jne 0x401af5
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401af5
xor eax, eax
jmp 0x401b4b
mov eax, dword [ebp + 8]
add eax, dword [0x440d40]
mov ecx, dword [eax]
add ecx, dword [0x440d40]
mov edx, dword [ebp + 8]
add edx, dword [0x440d40]
mov dword [edx], ecx
mov dword [ebp - 4], 0x15
mov eax, dword [0x440d40]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x440d40]
push eax
call fcn.004011c0
add esp, 8
mov ecx, dword [0x440d40]
add ecx, 4
mov dword [0x440d40], ecx
jmp 0x401abd
mov esp, ebp
pop ebp
ret
Function at 0x1000692d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1000693c
pop dword [ebp - 0x48]
mov eax, 0x1000693c
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xc380ee49
sub dword [ebp - 0x58], 0x752ea8fe
mov dword [ebp - 0x54], 0xc8525c1f
add dword [ebp - 0x54], 0x69e0f026
mov dword [ebp - 0x50], 0x327f99f0
add dword [ebp - 0x50], 0x19ccaa3e
mov dword [ebp - 0x4c], 0x86cc846
sub dword [ebp - 0x4c], 0x86cc846
lea eax, [ebp - 0x58]
push eax
mov eax, 0xc66bf6c3
add eax, 0x4995a945
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xfa3caf4
add dword [ebp - 0x58], 0x64ce9e62
mov dword [ebp - 0x54], 0xe9141012
sub dword [ebp - 0x54], 0xa7a7ae9d
mov dword [ebp - 0x50], 0xe799f2c8
sub dword [ebp - 0x50], 0x842a865c
mov dword [ebp - 0x4c], 0x5749ec8c
sub dword [ebp - 0x4c], 0x5749ec8c
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x400a4
push 0
call eax
mov ecx, 0x81945bce
add ecx, 0x7e6bfd9c
mov ebx, eax
mov esi, 0xc441cb6b
add esi, 0x4bc07e95
add esi, dword [ebp - 0x48]
mov edi, 0x903099bd
add edi, 0xd9c1e386
add dword [ebp - 0x1c], esi
mov edx, dword [esi]
xor dword [ebp - 0x3c], esi
add edx, edi
mov dword [ebp - 0x14], 0xdd18c892
mov dword [ebx], edx
sub dword [ebp - 0x1c], 0xae9e0ecc
add ebx, 0xb11c529f
add ebx, 0x4ee3ad65
add esi, 4
loop 0x10006a54
add eax, 0x1587b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5279dca
add ecx, 0xad86236
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50c40
call fcn.00402fc0
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x50c20], 0
push eax
push eax
push eax
mov word [ebp - 0x50c0c], ax
lea eax, [ebp - 0x50c1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50c20]
mov dword [ebp - 0x50c1c], 0x10001
push eax
mov dword [ebp - 0x50c18], 0x2b11
mov dword [ebp - 0x50c14], 0x2b11
mov dword [ebp - 0x50c10], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50bfe
lea eax, [ebp - 0x50c08]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
mov ecx, eax
shr edx, 0xa
xor dl, 1
shr ecx, 0xe
and dl, 5
and cl, 3
add dl, 3
add cl, 5
movsx edx, dl
movsx ecx, cl
imul edx, ecx
movsx ecx, al
movsx edx, dl
imul edx, ecx
mov byte [ebp + eax - 0x50c08], dl
inc eax
cmp eax, 0x50bfe
jb 0x401d83
lea eax, [ebp - 0x50c08]
mov dword [ebp - 0x50c3c], 0x50bfe
mov dword [ebp - 0x50c40], eax
lea eax, [ebp - 0x50c40]
push 0x20
push eax
push dword [ebp - 0x50c20]
mov dword [ebp - 0x50c38], 0
mov dword [ebp - 0x50c34], 0
mov dword [ebp - 0x50c30], 0
mov dword [ebp - 0x50c2c], 0
mov dword [ebp - 0x50c28], 0
mov dword [ebp - 0x50c24], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402313
mov esp, ebp
pop ebp
ret
Function at 0x401e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00402fc0
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
test al, 0xf
mov ecx, eax
sete dl
shr ecx, 9
lea edx, [edx*4 + 2]
and dl, cl
movsx ecx, al
inc dl
movsx edx, dl
imul edx, ecx
mov ecx, eax
shr ecx, 6
xor cl, al
add dl, cl
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x401ef3
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402313
mov esp, ebp
pop ebp
ret
Function at 0x402170
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push 0x34
push 0x403180
push str.The_software_you_just_executed_is_considered_malware._This_malware_will_harm_your_computer_and_makes_it_unusable._If_you_are_seeing_this_message_without_knowing_what_you_just_executed__simply_press_No_and_nothing_will_happen._If_you_know_what_this_malware_does_and_are_using_a_safe_environment_to_test__press_Yes_to_start_it._Do_you_want_to_execute_this_malware__resulting_in_an_unusable_machine_
push 0
call esi
cmp eax, 7
je 0x40230a
push 0x34
push 0x403180
push str.This_is_the_last_warning__The_creator_is_not_responsible_for_any_damage_made_using_this_malware__Still_execute_it_
push 0
call esi
cmp eax, 7
je 0x40230a
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push section..text
push 0
push 0
call edi
mov esi, eax
call fcn.00401b90
push 0x7530
call ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
call ebx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x401130
push 0
push 0
call edi
push 0
push 0
push 0
push 0x401330
push 0
mov edi, eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
call eax
mov esi, eax
call fcn.00401d00
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call ebx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401460
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4018c0
push 0
push 0
mov edi, eax
call esi
mov esi, eax
call fcn.00401e70
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call ebx
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401a70
push 0
push 0
call eax
call fcn.00401fe0
push 0x7530
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x402b49
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402b88
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402b88
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402b88
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402b88
cmp dword [ecx + 0x74], 0xe
jbe 0x402b88
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4032fc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x502008], 0x8088405
inc edx
mov dword [ebx + 0x502008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40c0f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40c1a1
test eax, edx
je 0x40c1a4
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40c121
push edx
mov edx, eax
mov eax, esp
call fcn.0040665c
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40c137
push eax
lea eax, [esp + 8]
call fcn.0040665c
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40c146
movzx eax, word [eax]
sub eax, ecx
jmp 0x40c16d
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40c187
add ecx, 4
js 0x40c15e
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40c184
push eax
mov eax, ecx
mov edx, 2
call fcn.004052a0
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40c16b
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40c16d
xor eax, eax
ret
test eax, eax
je 0x40c1b4
test edx, edx
jne 0x40c108
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4133eb
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040565c
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.0040977c
mov edi, eax
cmp edi, 0x104
jbe 0x41340e
mov eax, edi
add eax, eax
call fcn.00403018
mov esi, eax
jmp 0x413410
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.0040977c
push edi
push esi
call fcn.00409b84
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x413449
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x413433
mov eax, esp
cmp esi, eax
je 0x413456
mov eax, esi
call fcn.00403034
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x413490
cmp bl, 0
je 0x41348c
cmp bl, 0x41
jl 0x413487
cmp bl, 0x5a
jg 0x413487
or bl, 0x20
xor al, bl
inc esi
jmp 0x41346b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4133d0

Function at 0x42fb24
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42fb2a
ret
Function at 0x481afc
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret