joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1013c94
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x101647c]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push 0x20a
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1013d7c
push ebx
lea eax, [ebp - 0x210]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll__mbsrchr]
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
je 0x1013ce8
cmp byte [eax + 1], bl
jne 0x1013ce8
mov byte [eax], bl
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.01013a71
test eax, eax
jne 0x1013d07
push 1
lea eax, [ebp - 0x210]
push eax
call fcn.01013b49
cmp dword [ebp + 0xc], 0x104
jb 0x1013d28
push edi
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1013d78
xor eax, eax
jmp 0x1013d7b
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1013d4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1013d24
lea eax, [ebp - 0x41c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1013d53
sub eax, edx
lea ecx, [eax + 1]
cmp ecx, dword [ebp + 0xc]
ja 0x1013d24
mov eax, ecx
shr ecx, 2
lea esi, [ebp - 0x41c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01011c2a
leave
ret 0xc

Function at 0x4252a0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4252b8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x42535c
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x425357
mov ecx, dword [ebp - 8]
push ecx
call fcn.004257c0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x425316
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x425316
xor eax, eax
jmp 0x42535c
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x4252af
mov esp, ebp
pop ebp
ret
Function at 0x1013c94
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x101647c]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push 0x20a
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1013d7c
push ebx
lea eax, [ebp - 0x210]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll__mbsrchr]
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
je 0x1013ce8
cmp byte [eax + 1], bl
jne 0x1013ce8
mov byte [eax], bl
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.01013a71
test eax, eax
jne 0x1013d07
push 1
lea eax, [ebp - 0x210]
push eax
call fcn.01013b49
cmp dword [ebp + 0xc], 0x104
jb 0x1013d28
push edi
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1013d78
xor eax, eax
jmp 0x1013d7b
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1013d4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1013d24
lea eax, [ebp - 0x41c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1013d53
sub eax, edx
lea ecx, [eax + 1]
cmp ecx, dword [ebp + 0xc]
ja 0x1013d24
mov eax, ecx
shr ecx, 2
lea esi, [ebp - 0x41c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01011c2a
leave
ret 0xc

Function at 0x414de4
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], edi
add edx, 4
sub ebx, 0xb0d39393
or eax, ecx
sub ebx, ecx
cmp edx, esi
jne fcn.00414de4
mov ecx, ebx
add eax, eax
inc eax
ret
Function at 0x402d23
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
mov dword [ebp - 8], esi
jne 0x402d40
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
test edi, edi
mov ebx, edi
jne 0x402d4f
mov ebx, 0x40eca8
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402d64
mov ecx, dword [0x4243f8]
add ecx, eax
push ecx
call fcn.00402d0c
push 4
lea eax, [ebp + 0x14]
push eax
call fcn.00402cda
test eax, eax
je 0x402ecb
test byte [ebp + 0x17], 0x80
je 0x402eb4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x41ece8
mov dword [ebp - 0xc], eax
call fcn.00405e2f
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x402f16
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402db4
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x40aca8
push edi
call fcn.00402cda
test eax, eax
je 0x402ecb
sub dword [ebp + 0x14], esi
mov dword [0x41ed00], edi
mov dword [0x41ed04], esi
mov eax, dword [ebp - 8]
mov ecx, 0x41ece8
mov dword [0x41ed08], ebx
mov dword [0x41ed0c], eax
call fcn.00405e4f
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x402eac
mov esi, dword [0x41ed08]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x409034], 1
mov edi, eax
je 0x402e56
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x402e23
cmp dword [ebp + 0x14], 0
jne 0x402e56
push dword [ebp + 8]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.0040463c
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x402ea1
cmp dword [ebp + 0x10], eax
jne 0x402e7f
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402eb0
cmp dword [ebp - 0x10], esi
jne 0x402eb0
add dword [ebp - 4], esi
jmp 0x402e95
sub dword [ebp - 8], esi
add dword [ebp - 4], esi
cmp dword [ebp - 8], 1
mov ebx, dword [0x41ed08]
jl 0x402f16
cmp dword [ebp - 0x14], 1
jne 0x402dd7
jmp 0x402f16
cmp dword [ebp + 0x14], eax
jg 0x402da7
jmp 0x402f16
push 0xfffffffffffffffc
jmp 0x402ecd
push 0xfffffffffffffffe
jmp 0x402ecd
test edi, edi
je 0x402f0b
cmp dword [ebp + 0x14], esi
jge 0x402ec0
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00402cda
test eax, eax
jne 0x402f13
push 0xfffffffffffffffd
pop eax
jmp 0x402f19
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x402edb
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x40aca8
push edi
call fcn.00402cda
test eax, eax
je 0x402ecb
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402eb0
cmp esi, dword [ebp + 0x10]
jne 0x402eb0
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x402ed0
jmp 0x402f16
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4052b0
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x4219b8], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x4052d4
test al, 0x10
jne 0x4052d7
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x4219b8
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405302
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x40541a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405437
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x40543a
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405469
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4054ad
test edi, edi
jne 0x405474
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4054a7

Function at 0x4054b1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405515
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 8], 0x400
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405504
cmp dword [ebp + 0x14], 1
je 0x405506
cmp dword [ebp + 0x14], 2
je 0x405506
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x405768
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421a00
push esi
call fcn.004055bd
push esi
call fcn.004053ad
mov edi, eax
test edi, edi
jne 0x405789
xor eax, eax
jmp 0x4057e1
push edi
call fcn.004055df
test byte [0x424404], 0x80
je 0x4057a2
mov al, byte [edi]
test al, al
je 0x405785
cmp al, 0x5c
je 0x405785
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x4057c2
push esi
call fcn.0040567a
test eax, eax
je 0x4057bc
test byte [eax], 0x10
je 0x4057e6
push esi
call fcn.00405742
push esi
call ebx
cmp eax, edi
jg 0x4057ad
push esi
call fcn.00405715
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4057e0
Function at 0x405840
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push 0x407514
call fcn.004056b8
test eax, eax
mov esi, dword [esp + 0x18]
je 0x40586c
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x4059ac
test esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x421e00], 0x4c554e
mov edi, 0x400
mov ebp, 0x421e00
je 0x4058b0
push 1
push 0
push esi
call fcn.0040543a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4059b2
cmp eax, edi
jg 0x4059b2
push edi
mov esi, 0x422740
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4059b2
cmp eax, edi
jg 0x4059b2
push esi
push ebp
push str._s_s_r_n
push 0x422200
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x3f0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 4
push 0xc0000000
push esi
call fcn.0040543a
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x4059ac
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4059a5
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4059a5
cmp edi, dword [esp + 0x18]
jne 0x4059a5
push str._Rename__r_n
push esi
call fcn.004057ea
test eax, eax
jne 0x4059b9
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call fcn.004055bd
add edi, 0xa
mov eax, edi
push ebx
push 0x422200
add eax, esi
push eax
call fcn.004053fa
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x424430]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x4075c4
add eax, 0xa
push eax
call fcn.004057ea
test eax, eax
je 0x405970
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x4059e0
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x4059d5
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405972
Function at 0x405c08
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00405768
mov ecx, dword [ebp + 0xc]
test cl, 8
mov dword [ebp - 8], eax
je 0x405c3d
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x424428], eax
jmp 0x405dc1
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x405c58
test eax, eax
je 0x405d6c
test cl, 2
je 0x405d6c
push edi
push ebx
mov esi, 0x422b40
push esi
call fcn.004055bd
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405c7b
push str..
push esi
call edi
jmp 0x405c81
push ebx
call fcn.00405742
push 0x407280
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405d61
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.0040536a
cmp byte [eax], 0
je 0x405ccc
cmp byte [ebp - 0x18], 0
je 0x405ccc
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405ce2
mov al, byte [esi + 1]
test al, al
je 0x405d40
cmp al, 0x2e
jne 0x405ce2
cmp byte [esi + 2], 0
je 0x405d40
push esi
push edi
call fcn.004055bd
test byte [ebp - 0x148], 0x10
je 0x405d07
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405d40
push dword [ebp + 0xc]
push ebx
call fcn.00405c08
jmp 0x405d40
push ebx
call fcn.0040541a
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405d38
test byte [ebp + 0xc], 4
je 0x405d30
push ebx
push 0xfffffffffffffff1
call fcn.0040463c
push 0
push ebx
call fcn.00405840
jmp 0x405d40
inc dword [0x424428]
jmp 0x405d40
push ebx
push 0xfffffffffffffff2
call fcn.0040463c
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405cae
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405d6b
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405dc0
cmp dword [ebp - 8], esi
jne 0x405d80
inc dword [0x424428]
jmp 0x405dc0
push ebx
call fcn.0040567a
test eax, eax
je 0x405dc0
push ebx
call fcn.00405715
push ebx
call fcn.0040541a
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405db8
test byte [ebp + 0xc], 4
je 0x405d78
push ebx
push 0xfffffffffffffff1
call fcn.0040463c
push esi
push ebx
call fcn.00405840
jmp 0x405dc0
push ebx
push 0xffffffffffffffe5
call fcn.0040463c
pop esi
pop ebx
leave
ret 8
Function at 0x405dc6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422f44], 0
push esi
jne 0x405dfd
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dd7
mov dword [ecx*4 + 0x422f40], eax
inc ecx
cmp ecx, 0x100
jl 0x405dd2
mov esi, dword [esp + 0x10]
test esi, esi
mov eax, dword [esp + 8]
not eax
jbe 0x405e29
mov ecx, dword [esp + 0xc]
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x422f40]
inc ecx
dec esi
jne 0x405e0f
not eax
pop esi
ret 0xc
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403500
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41b008], 0x8088405
inc edx
mov dword [ebx + 0x41b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406de0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404580
xor eax, eax
push ebp
push 0x40624a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00404390
test eax, eax
jle 0x406e34
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
xor ecx, 0x6521458a
add ebx, ecx
mov ecx, ebx
shl ecx, 0xd
mov esi, ebx
shr esi, 0x13
or ecx, esi
sub ebx, ecx
inc edx
dec eax
jne 0x406e12
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406251
lea eax, [ebp - 4]
call fcn.004040e4
ret

Function at 0x40d0e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x40c609
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, esi
call fcn.0040cfcc
mov eax, dword [ebx]
call fcn.00404390
cmp eax, 4
jg 0x40d12b
mov eax, ebx
call fcn.004040e4
jmp 0x40d1ee
mov eax, dword [ebx]
call fcn.00404390
mov edi, eax
test edi, edi
jle 0x40d155
mov esi, 1
mov eax, ebx
call fcn.004045e8
mov edx, dword [ebx]
mov dl, byte [edx + esi - 1]
xor dl, 0x5c
mov byte [eax + esi - 1], dl
inc esi
dec edi
jne 0x40d13d
mov eax, dword [ebx]
movzx esi, byte [eax + 2]
mov eax, dword [ebx]
movzx edi, byte [eax + 3]
mov eax, ebx
mov ecx, 4
mov edx, 1
call fcn.00404630
mov eax, ebx
mov ecx, edi
mov edx, 1
call fcn.00404630
push ebx
mov eax, dword [ebx]
mov ecx, esi
mov edx, 1
call fcn.004045f0
cmp dword [ebx], 0
je 0x40d1ee
mov eax, dword [ebp - 8]
call fcn.00404390
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404390
add esi, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
mov ecx, esi
mov edx, 1
call fcn.004045f0
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004043dc
mov edx, dword [ebp - 0x10]
pop eax
call fcn.004044dc
je 0x40d1e0
mov eax, ebx
call fcn.004040e4
jmp 0x40d1ee
mov eax, ebx
mov ecx, esi
mov edx, 1
call fcn.00404630
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c610
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404108
ret
Function at 0x418b6c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404580
xor eax, eax
push ebp
push 0x4180e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004040e4
xor ebx, ebx
mov esi, 0x11
push esi
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x417f4c]
call fcn.004053a8
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [eax], 0x99935097
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0x2c89d95b
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0x6df8e950
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xc], 0xdf4eff82
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x10], 0xe8ead4ad
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0xbb07f9ad
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0xb746652e
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x1c], 0x7f612d05
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0xd7520332
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x24], 0x20278d52
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x28], 0xfe2bf75e
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x2c], 0xba2aac6b
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0xd1823480
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0x5ef1f8a2
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x38], 0x2ac162ac
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x3c], 0x6ea634c0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x40], 0xf10ecec6
dec esi
test esi, esi
jl 0x418c88
inc esi
xor edi, edi
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + edi*4]
mov eax, dword [ebp - 4]
call fcn.00418a80
mov ebx, eax
test ebx, ebx
jne 0x418c88
inc edi
dec esi
jne 0x418c70
test ebx, ebx
jne 0x418cb1
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x418100
call fcn.004043dc
mov eax, dword [ebp - 0x10]
mov ecx, 0x418120
xor edx, edx
call fcn.00419288
jmp 0x418cbb
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004189cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4180ee
lea eax, [ebp - 0x10]
call fcn.004040e4
lea eax, [ebp - 0xc]
mov edx, dword [0x417f4c]
call fcn.004053b4
lea eax, [ebp - 4]
call fcn.004040e4
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219