joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414ec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x7e9ff4]
sub esp, 0x484
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetDateFormatA]
mov ebp, 0x2443831
cmp eax, 0x47
jne 0x414f46
xor eax, eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x78]
push ecx
push 0x403770
mov dword [esp + 0x6c], 0
call esi
xor eax, eax
push eax
mov dword [esp + 0x56], eax
mov dword [esp + 0x5a], eax
mov dword [esp + 0x5e], eax
mov word [esp + 0x62], ax
lea eax, [esp + 0x94]
push eax
push 0x4037c4
xor edx, edx
lea ecx, [esp + 0x5c]
push ecx
push edx
push edx
mov word [esp + 0x68], dx
call edi
dec ebp
mov eax, dword [0x439bd0]
mov dword [0x7e9ff4], eax
jne 0x414ee5
mov dword [esp + 0x20], 0x764d11c7
mov dword [esp + 0x4c], 0x26b44f20
mov dword [esp + 0x24], 0x1f33c7de
mov dword [esp + 0x10], 0x2e56cff9
mov dword [esp + 0x28], 0x6cde8df8
mov dword [esp + 0x14], 0x796abd53
mov dword [esp + 0x34], 0x3ce56ad4
mov dword [esp + 0x1c], 0x581868fc
mov dword [esp + 0x18], 0xc596c70
mov dword [esp + 0x3c], 0x6d5e9115
mov dword [esp + 0x30], 0x22f372d9
mov dword [esp + 0x40], 0x2ad541d0
mov dword [esp + 0x38], 0x7a5f7c43
mov dword [esp + 0x2c], 0x28d520e
mov dword [esp + 0x48], 0x73f3bc07
mov dword [esp + 0x44], 0x51f578e1
add dword [esp + 0x4c], 0x73e38130
mov eax, 0x3a9c3a87
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x24], 0x6b053f58
add dword [esp + 0x20], 0x2818faf9
add dword [esp + 0x4c], 0x3ab2fc3
sub dword [esp + 0x20], 0x30ad2d47
sub dword [esp + 0x20], 0x4442fc9b
sub dword [esp + 0x28], 0x2285667
add dword [esp + 0x4c], 0x262c99c6
sub dword [esp + 0x14], 0x4dc74448
mov eax, 0x53cf4e1b
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x24], 0x1b067f32
mov eax, 0x67698c83
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
sub dword [esp + 0x28], 0x7674af1e
mov eax, 0x173863dd
mul dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, 0x3d786fdd
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, 0x38471b91
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, 0x45f07edf
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
add dword [esp + 0x18], 0x6fea1ecd
sub dword [esp + 0x34], 0x32f1f16e
add dword [esp + 0x34], 0x6e380599
sub dword [esp + 0x18], 0x3ca08c1e
add dword [esp + 0x30], 0x154e8e1
add dword [esp + 0x14], 0x53bb032d
sub dword [esp + 0x14], 0x11166d6c
sub dword [esp + 0x18], 0x2a6a1594
add dword [esp + 0x14], 0x4fb1fe05
mov eax, 0x4b3ce8e6
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x3c], 0x1bc84bb6
sub dword [esp + 0x30], 0x687c0c2b
add dword [esp + 0x48], 0x36e578c2
sub dword [esp + 0x10], 0x7b5e58ec
mov eax, 0x38d0a1fb
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x40], 0x15793cf4
mov edx, dword [0x439bc4]
mov dword [0x7ea408], edx
call fcn.00414af0
pop edi
xor eax, eax
pop esi
pop ebp
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405d20
Capabilities:
Accept command line arguments

Disassembly:
adc byte [edi + 0x60], bl
rcl byte [edx + ecx], 0x45
pop ebp
ret 0x10
push ebp
mov ebp, esp
xor dword [esi + 0x57], edx
call 0x6877e520
test eax, eax
loopne 0x405cb4
std
add byte [eax], al
mov al, 0xb6
adc al, 0xdc
or byte [ecx], al
push ebx
jl 0x1285e2e
mov eax, dword [0x3e03db]
test dword [edx + 0xf], edi
shl cl, 0
add byte [eax], al
mov dword [0x410384], 0x3b0001
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x405db3
mov eax, dword [0x3d41c558]
test eax, eax
jne 0x405d89
push eax
push 0xc874f410
push 4
call fcn.0040a940
add esp, 0xc
out dx, al
pop eax
add eax, dword [ecx - 0xd]
test eax, eax
paddusw mm5, qword [edi - 0x72f60000]
dec ebp
cld
lea ecx, [ebp - 4]
push ecx
push esi
dec dword [edx - 0x75]
invalid
or al, 0x56
mov dword [ecx], eax
pop ss
adc eax, sym.imp.KERNEL32.dll_GlobalFree
push ebx
call dword [fcn.00405754]
mov ebx, eax
push 0xffffffffffffffff
mov word [ebx], cs
xor byte [ecx + eax*8], ah
inc eax
add byte [eax - 0x18], dl
test dword [eax], eax
add byte [eax], al
mov ebx, esi
mov cl, 0x83
pop es
or al, 0x85
push dword [ebp + ebp + 0x6a]
sahf
rol dword [eax + eax], cl
add byte [esi + edx*2 - 1], bh
adc eax, 0x5240c15c
jmp 0x405da9
Function at 0x4096c0
Capabilities:
Write file on windows

Disassembly:
mov byte [eax + 0x37], 0x45
add byte [0xe8a50688], ch
dec esi
mov edi, 0xc0a73331
pop edi
pop esi
pop ebx
pop eax
in eax, 0x5d
ret 0x14
push ebp
call 0x222d1ab2
push esi
mov esi, dword [ebp + 0x49]
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x5d0000
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [0x40c05f]
test dword [ecx + 0x458b0f23], edx
enter 0x1bf6, 2
je 0x4096f2
xor eax, eax
pop esi
mov esp, ebp
lcall 0x5b85, 0x2a468b1c
je 0x4096d9
mov eax, dword [esi + 0x2a]
test dword [ebx + 0x74], ebx
loopne 0x4096a4
stosb byte es:[edi], al
lcall 0x8be9, 0x4e0008
push esi
or al, 0xc7
inc edx
or al, 0
aam 0x7d
add bl, al
inc esi
or al, 0x8b
xchg edx, eax
add al, 0x57
lea ecx, [ebp - 4]
push eax
push ecx
push 0
push 0xffffffffffffff9a
push 0
push 0
push 0x9009a
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409736
pop edi
xor eax, eax
sub dword [ebx - 0x743c2675], ecx
mov ebx, 0x40a498
mov edi, dword [ebx + 0x40a498]
pop ss
arpl word [edx - 0x40], sp
jne 0x409748
pop edi
pop esi
mov esp, ebp
pop ebp
sbb bh, bh
xlatb
call edi
add eax, 0xafc80
cmp eax, 0x97d565
jne 0xd2984a
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x4f]
mov edx, dword [eax + edx + 0x16b7c985]
jg 0x409770
clc
sal byte [esi + 0x10], 0x6a
add byte [eax - 0x18], ch
add eax, dword [eax]
add byte [ecx + 0x50], dl
push 0
push 0x3e8
push ecx
push eax
adc bl, byte es:[esi]
add byte [esi + 0x55], dl
or eax, 0xf883c123
push dword [ebp - 0x7c]
or ecx, dword [ebx + ebp*8 - 0x2b]
in al, dx
push 0x50
xor eax, 0x48de0c46
adc byte [ecx - 1], dl
xlatb
push ss
add byte [eax], 0x19
add byte [edi + 0x747685c2], ch
cdq
mov eax, dword [0x4105ec]
mov esi, edx
push ss
test eax, eax
jne 0x4097c6
push eax
push str.CancelIo
or eax, 0x1186e8
add byte [ebx - 0x135c633c], al
add eax, 0xc0850041
je 0x4097cb
push edi
call eax
jmp 0x4097d3
push eax
retf 0x94ff
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx + 4]
and byte [ebp - 4], dl
push 1
push edx
push eax
push ecx
dec dword [edx]
mov ah, 0x8b
mov edi, 0x7446e700
or byte [edi + 0x12], bl
rcr byte [eax], 0x8b
in eax, 0x5d
ret
Function at 0x40a340
Capabilities:
Terminate process

Disassembly:
mov cl, 0x74
xchg esp, eax
mov ebx, 0x75c0ca00
out dx, al
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
invalid
xor eax, eax
inc ebx
bound eax, qword [eax + eax]
mov eax, dword [eax + 8]
push 0xffffffffffffffff
aas
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40a2e7
cmp eax, 0xb6000080
inc ebx
jecxz 0x40a2a7
add ah, byte [ecx + 0x75560000]
or bh, byte [eax + 0xe1189]
pop esi
pop ebp
ret 0xf04
inc eax
add bh, bh
salc
test eax, eax
jne 0x40a2ed
pop esi
push ecx
je 0x40a32a
add byte [edi - 0x2a], bl
add eax, 0xa8fc80
pop esi
pop ebp
cmp ah, 0xa8
add byte [esi + 0x5d], bl
ret 4
push ebp
mov ecx, ebx
mov ecx, dword [ebp + 8]
push esi
call 0xc0c5a78d
jne 0x40a35f
mov ebx, 0xff5125c1
adc eax, 0x40902c
jmp 0x40a31a
cmp eax, 1
jne 0x40a370
mov eax, dword [ecx + 8]
push eax
invalid
sub dword [ebp - 0x741c8afe], 0xffffffe6
or byte [ecx - 1], dl
adc eax, 0x94408e34
test eax, eax
jne 0x40a358
mov esi, dword [0x40c03d]
call esi
test eax, eax
je 0x40a358
call esi
popfd
cmp ah, 0xa
add byte [esi + 0x5d], bl
ret 0xda

Function at 0x40a4b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jg 0x40a4ee
popal
test dword [eax + 0x52ffffff], esp

Function at 0x40a99a
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x56a2b5f0
push 0
push ebx
call ebp
in al, dx
adc al, 0x53
fist word [edi - 0x4d]
jge 0x40a9b8
mov edx, dword [edi]
test dword [0x75f85589], esp
push cs
or al, 0x5e
xor ebp, esi
out dx, al
sub byte [ebx + 0x10c25de5], cl
mov dl, 0x8b
push es
clc
mov edi, dword [edi + 0x14]
cmp dword [ecx], 0
je 0x40a9b5
invalid
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x12aee50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.DATA
lea edi, [esi - 0xb11000]
lea eax, [edi + 0xe5ac04]
push dword [eax]
mov dword [eax], 0x680c1b7
push eax
push edi
jmp 0x12aee7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x12aee81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12aee70
mov eax, 1
add ebx, ebx
jne 0x12aee93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x12aeea4
jne 0x12aeec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12aeec3
dec eax
add ebx, ebx
jne 0x12aeeb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x12aee88
add ebx, ebx
jne 0x12aeebf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x12aef15
xor ecx, ecx
sub eax, 3
jb 0x12aeedb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x12aef4a
sar eax, 1
mov ebp, eax
jmp 0x12aeee6
add ebx, ebx
jne 0x12aeee6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12aeeb4
inc ecx
add ebx, ebx
jne 0x12aeef4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12aeeb4
add ebx, ebx
jne 0x12aef01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x12aeef6
jne 0x12aef12
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x12aeef6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x12aef34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x12aef26
jmp 0x12aee76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x12aef34
add edi, ecx
jmp 0x12aee76
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x49161
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x12aef56
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x12aef5b
lea edi, [esi + 0xea4000]
mov eax, dword [edi]
or eax, eax
je 0x12aefcc
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xec659c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xec686c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x12aef81
mov ecx, edi
jns 0x12aefb0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xec6874]
or eax, eax
je 0x12aefc6
mov dword [ebx], eax
add ebx, 4
jmp 0x12aef9e
call dword [esi + 0xec6870]
mov ebp, dword [esi + 0xec6878]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x29f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x12af000
sub esp, 0xffffff80
jmp 0xd59747
Function at 0x4013b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor ecx, ecx
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x4013d7
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4013c6
pop edi
mov eax, edx
pop esi
pop ebp
ret

Function at 0x401a40
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x401a5b
mov edx, dword [esi + 0x74]
dec ecx
mov eax, dword [edx]
mov dword [esi + 0x70], ecx
lea ecx, [edx + 4]
mov dword [esi + 0x74], ecx
pop esi
ret
push str.Fossilize_ERROR:_Tried_to_parse_string__but_nothing_left_in_arguments._n
push 2
call fcn.004f2743
add esp, 4
push eax
call fcn.00401d60
push 2
call fcn.004f2743
push eax
call fcn.004f2b00
add esp, 0x10
push 1
call fcn.004eec9b
int3

Function at 0x401a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50dbcd
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x70], 0
je 0x401b79
mov eax, dword [edi + 0x74]
mov edx, dword [eax]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea esi, [ecx + 1]
mov dword [ebp - 0x18], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401ad8
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.004011f0
mov dword [ebp - 4], 0
call fcn.004ee969
cmp dword [ebp - 0x18], 0xf
lea esi, [ebp - 0x2c]
mov ebx, eax
lea eax, [ebp - 0x10]
cmova esi, dword [ebp - 0x2c]
push 0xa
push eax
push esi
mov dword [ebx], 0
call fcn.004f2627
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp esi, dword [ebp - 0x10]
je 0x401ba5
cmp dword [ebx], 0x22
je 0x401baf
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x401b61
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401b54
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401bb9
push ecx
push edx
call fcn.004e9693
mov eax, dword [ebp - 0x14]
add esp, 8
dec dword [edi + 0x70]
add dword [edi + 0x74], 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push str.Fossilize_ERROR:_Tried_to_parse_uint__but_nothing_left_in_arguments._n
push 2
call fcn.004f2743
add esp, 4
push eax
call fcn.00401d60
push 2
call fcn.004f2743
push eax
call fcn.004f2b00
add esp, 0x10
push 1
call fcn.004eec9b
push str.invalid_stoul_argument
call fcn.004e72b1
push str.stoul_argument_out_of_range
call fcn.004e72f1
call fcn.004ee89f
int3
Function at 0x401bc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x401ced
cmp byte [esi + 0x78], 0
jne 0x401ced
mov eax, dword [esi + 0x74]
mov edx, dword [eax]
add eax, 4
mov dword [esi + 0x74], eax
lea eax, [ecx - 1]
mov dword [esi + 0x70], eax
mov dword [ebp - 8], edx
cmp byte [edx], 0x2d
je 0x401c0c
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x401c0c
mov dword [ebp - 4], edx
lea edx, [ebp - 4]
push edx
jmp 0x401cdd
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401c25
sub eax, edi
lea ecx, [ebp - 0x28]
push eax
push edx
call fcn.004011f0
cmp dword [ebp - 0x14], 0xf
lea edi, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov edx, 0x811c9dc5
mov ebx, dword [ebp - 0x18]
cmova edi, eax
xor ecx, ecx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x401c67
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x401c56
push edx
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00401280
mov edi, dword [eax + 4]
test edi, edi
jne 0x401c81
mov edi, dword [esi + 4]
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x401cb7
mov edx, dword [ebp - 4]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x401cad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401d30
push ecx
push edx
call fcn.004e9693
add esp, 8
cmp edi, dword [esi + 4]
jne 0x401cd5
cmp byte [esi + 0x79], 0
je 0x401cf6
mov ecx, dword [esi + 0x6c]
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
test ecx, ecx
je 0x401d35
lea edx, [ebp - 8]
push edx
jmp 0x401cdd
mov ecx, dword [edi + 0x44]
test ecx, ecx
je 0x401d35
push esi
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [esi + 0x70]
test ecx, ecx
jne 0x401bd6
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
push str.Fossilize_ERROR:_Invalid_argument._n
push 2
call fcn.004f2743
add esp, 4
push eax
call fcn.00401d60
push 2
call fcn.004f2743
push eax
call fcn.004f2b00
mov ecx, dword [esi + 0x44]
add esp, 0x10
test ecx, ecx
je 0x401d27
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004ee89f
call fcn.004e7294
int3

Function at 0x404410
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
cmp dword [edx + 0x14], 0xf
mov edi, dword [edx + 0x10]
jbe 0x404423
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x404441
mov edi, edi
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x404430
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x401570
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x4015b1.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x4015b1.2
jmp dword [eax*4 + 0x40163c]
mov word [esp + 0x48], di
jmp 0x4015ea
mov word [esp + 0x48], 2
jmp 0x4015ea
mov word [esp + 0x48], 3
jmp 0x4015ea
mov word [esp + 0x48], 4
jmp 0x4015ea
mov word [esp + 0x48], 7
jmp 0x4015ea
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x401634
cmp dword [esp + 0x70], edi
je 0x401620
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret
Function at 0x40e5fc
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x1c], 0x281b2f18
mov dword [esp + 0x20], 0x131c2817
mov dword [esp + 0x24], 0xfffdd027
mov word [esp + 0x28], 0xfdfb
mov byte [esp + 0x2a], 0x86
mov word [esp + 0x2b], 0
mov byte [esp + 0x2d], 0
xor eax, eax
mov esi, dword [esp + 8]
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa5
xor cl, byte [esp + eax + 0x10]
add cl, 0xc7
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x1e
jne 0x40e629
add edx, dword [esp + 0xa8]
movzx eax, byte [esp + 0x10]
test al, al
je 0x40e664
lea ecx, [esp + 0x11]
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
add al, ah
dec esi
mov bh, 0xb6
add dword [ecx - 0x7c], eax
sal byte [ebp - 0xb], 0xc6
add al, byte [eax]
sub edx, esi
mov eax, dword [esp + 0xc]
add dword [eax + 0x60], edx
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x41138e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [esp + 0x90], 0x43d24505
mov dword [esp + 0x94], 0x7fea41d0
jg 0x41136c
test byte [eax + ebx*4], ah
add byte [eax], al
add cl, ah
jge 0x4113bf
invalid
mov dword [esp + 0x9c], 0x77e879e5
mov dword [esp + 0xa0], 0x73eb7503
mov dword [esp + 0xa4], 0x6f3d71fc
mov dword [esp + 0xa8], 0x6b256d21
mov dword [esp + 0xac], 0x67346923
invalid
invalid

Function at 0x4241db
Capabilities:
Encode data using xor

Disassembly:
and al, 0x20
and esi, dword [ebx + 0x44c7b123]
and al, 0x24
and ch, byte [edi + 0x44c7ad4e]
and al, 0x28
add dword [ebx + 0x44c7a931], ebp
and al, 0x2c
and al, 0xa7
sub ah, byte [ebp + 0x302444c7]
xor esp, dword [ebx + 0x44c7a130]
and al, 0x34
cmp dword [edi + 0x44c79d13], ebx
and al, 0x38
cmp byte [ebx - 0x36ce6666], bl
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xb3
xor dl, byte [esp + ecx + 8]
add dl, 0x81
mov byte [esp + ecx + 8], dl
inc ecx
cmp ecx, 0x34
jne 0x424218
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx + 4]
add al, ah
dec esi
mov bh, 0xb7
cmp cl, byte [ecx - 0x7a9917]
je 0x42425c
add edx, 2
mov ecx, ebp
nop
nop
nop
nop
mov word [ecx], di
add ecx, 2
movzx edi, word [edx]
add edx, 2
test di, di
jne 0x42424b
mov word [ecx], 0
movzx edx, word [esp + 8]
test dx, dx
je 0x42427c
mov word [ecx], dx
add ecx, 2
add al, ah
dec esi
mov bh, 0xb7
adc eax, dword [ebx - 0x7a99fd3d]
add ebx, 2
test dx, dx
jne 0x42426e
sal byte [ebp - 0x11], cl
mov word [ecx], 0
movzx edx, word [eax]
test dx, dx
mov dword [esp + 4], ebp
je 0x4242a0
loopne 0x4242e0
mov bh, 0x83
rol byte [edx], 0x90
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
add al, ah
dec esi
mov bh, 0xb7
adc byte [ebx - 0x7a99fd40], al
sal byte [ebp - 0x11], cl
mov word [ecx], 0
mov dword [esp + 8], 0x6331615f
mov dword [esp + 0xc], 0x671865ed
mov dword [esp + 0x10], 0x7b7a791b
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
mov ecx, 0xef33897
cmp bl, dh
push cs
add al, 0xeb
jp 0x424277
movzx ebx, byte [eax]
mov edx, ecx
or edx, ebx
and ebx, ecx
mov esi, ebx
not esi
lea ebp, [ebx + esi*2]
mov edi, 0xfffffffe
sub edi, ebp
lea esi, [ebx + esi*2]
inc esi
mov ebx, esi
and ebx, 0x525bdedf
and edi, 0xada42120
or edi, ebx
xor edi, edx
xor edi, 0xada42120
or edx, esi
not edx
or edx, edi
Function at 0x440fd7
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov eax, dword [esp + 4]
add eax, dword [esp + 0x44]
rol esi, 0xe
add dword [esi], ecx
add al, 0xeb
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x401a80
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406480
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4064a1
mov eax, 0xff
call fcn.00401a80
xor byte [esi], al
inc esi
dec ebx
jne 0x406491
pop esi
pop ebx
ret