joyce8/EMBER2024-capa huggingface dataset:
Function at 0x86e000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x86e131
push esi
call fcn.00871145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00860080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x86e131
push 0
push ebp
call fcn.008603a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00860260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x86e08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.008602f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x86e121
push 0x886918
push edi
call fcn.0086f3f0
push eax
push ebx
push esi
call fcn.0086df60
push 0x8868f8
push edi
call fcn.0086f3f0
push eax
push ebx
push esi
call fcn.0086df60
push 0x8868d8
push edi
call fcn.0086f3f0
push eax
push ebx
push esi
call fcn.0086df60
push 0x8868c0
push edi
call fcn.0086f3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0086df60
push 0x8868a0
push edi
call fcn.0086f3f0
push eax
push ebx
push esi
call fcn.0086df60
push 0x886888
push edi
call fcn.0086f3f0
push eax
push ebx
push esi
call fcn.0086df60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x86f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0086f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0086f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0086f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0086f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x86fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x86fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x88187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x86fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x86fc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x40147d
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 0x11c]
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x116]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x11c], 0xa
mov byte [ebp - 0x10c], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
movsx eax, byte [ebp - 0x116]
sub esp, 0x14
leave
sub eax, 0x41
ret

Function at 0x4014d9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xa0
mov dword [ebp - 0x88], 0
call fcn.0040147d
mov dword [esp], 0x4015b0
mov dword [ebp - 0x8c], 0
mov ebx, eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0xc], eax
mov eax, ebx
or eax, 0x40
mov dword [esp + 8], eax
mov eax, 0x402012
sub eax, 0x4015b0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x40157a
mov dword [esp], ebx
lea esi, [ebp - 0x88]
call fcn.004013a1
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.00401404
lea eax, [ebx + 0x1b800]
test ebx, ebx
lea edx, [eax + eax]
mov ecx, 0x40300c
mov dword [esp + 8], esi
cmovne eax, edx
sar ebx, cl
sub ecx, ebx
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00401d15
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x380d0701
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x15ae283b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4a9961
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4de034]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4a99ac
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004a9e23
test al, al
jne 0x4a99a6
sub edx, 2
cmp edx, edi
jne 0x4a998c
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4a99ce
lea eax, [edi + 2]
cmp edx, eax
je 0x4a99ce
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004a955a
add esp, 0x10
jmp 0x4a9ac8
push esi
lea ecx, [ebp - 0x255]
call fcn.004a9e23
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a9a11
push dword [ebp - 0x25c]
jmp 0x4a99be
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4a9a4e
cmp word [ebp - 0x226], 0
je 0x4a9a6f
cmp word [ebp - 0x226], ax
jne 0x4a9a4e
cmp word [ebp - 0x224], 0
je 0x4a9a6f
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004a955a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4a9abb
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4a9a28
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4a9aa3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4a9ac8
push 0x4a8f42
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00405bd7
add esp, 0x10
jmp 0x4a9a98
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040335a
leave
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x2da54910
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x34c85328
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40f3fa
Capabilities:
Encode data using xor

Disassembly:
dec esp
invalid
pop ss
ficom dword [ebx]
adc al, 0x97
push esp
add dword [eax], 0x484a9087
jne 0x40f38b
pop ebx
mov cl, 0x93
test al, 0xf2
and edi, edi
lea esp, [edx]
add byte [edi], dh
imul esp, dword [edx + 0x14], 0x73
lock xor dh, byte [ebx + eax*2]
sub eax, dword [ebx]
sub eax, 0x16e4444
jb 0x40f408
rol byte [edx - 0x4f], 0x6a
pushal
or dl, bl
test esi, esi
push esp
adc ebp, edi
xchg ebx, ecx
jle 0x40f45d
jmp 0xe638e574
push edi
inc edx
jmp 0x40f3f5

Function at 0x417483
Capabilities:
Encode data using xor

Disassembly:
jl 0x4174f1
ret
xchg ecx, eax
pop ecx
xchg byte [edx + esi*8], bl
stosb byte es:[edi], al
dec edi
lodsb al, byte [esi]
popal
in eax, dx
int 0x57
stc
movsb byte es:[edi], byte cs:[esi]
test eax, 0x872b91e9
mov ch, ah
push es
sub byte [edi + ebx*8], bl
mov esi, 0xdf4531bc
pop eax
rol dword [ebp - 0x80], 0x79
pop esi
mov es, word [edi]
test byte [ebx - 0xc], dl
inc ecx
test eax, 0xf68f47b
loope 0x4174cd
adc dl, ch
cmp ch, byte [ebp + ecx*8 + 0x12cac3a4]
stc
into
adc al, 0xcb
js 0x4174f1
ret
scasd eax, dword es:[edi]
iretd
dec esi
mov al, byte [0xcf5723a7]
jo 0x417494
adc byte [ebx + 0x2b], 0xf4
mov byte [0x276e9e3e], al
sahf
outsb dx, byte [esi]
daa
mov eax, 0x49d705db
dec ecx
dec edx
insd dword es:[edi], dx
xchg dl, dl
jle 0x4174e3
inc esi
sal byte [esi + ebp*8 + 0x1bc783ef], cl
add dword ss:[esi - 0x7b141d69], ecx
or al, 0x1b
xchg edi, eax
loop 0x4174f9
test byte [ebx + ebx], cl
stosb byte es:[edi], al
dec esp
or cl, byte [ebx]
movsd dword es:[edi], dword [esi]
xor byte [ebp - 0xc], 0x2a
leave
arpl sp, bx
cli
add ebp, ebp
xchg esi, eax
jae 0x41750b
lodsd eax, dword [esi]
wait
xor byte [ebp - 0x4a88665f], al
xlatb
sbb al, 0xf4
invalid

Function at 0x4f40e3
Capabilities:
Encode data using xor

Disassembly:
mul ebx
xor bl, byte [ebp - 0x34]
push ebx
sbb byte [ebx + 0x5a], 0xeb
push ss
mov bh, 0xc8
jno 0x4f4167
cld
mov edx, ds
and esi, ebx
lodsb al, byte [esi]
cli
int1
inc esi
sub bh, byte [esi + 0x43f0bec2]
movsd dword es:[edi], dword [esi]
ret
add eax, 0x22a24cd3
add al, 0xa3
inc edx
sbb cl, ah
stosd dword es:[edi], eax
adc eax, 0x126fea94
in eax, dx
aaa
imul edi, esi, 0x7d
lodsb al, byte [esi]
scasb al, byte es:[edi]
pop ebp
inc ebx
fst st(1)
adc eax, dword [edx]
cld
adc eax, 0x8253a1a3
invalid
Function at 0x50322a
Capabilities:
Encode data using xor

Disassembly:
push ebx
pushal
test eax, 0x7417489a
fdivr qword [esi]
and byte [ecx + eax*2 - 0x28ed1034], ah
push edx
xlatb
sub al, 0xf3
push ebx
nop
out 0x10, al
jb 0x5031c0
jmp 0xb952b282
pop ebp
fsub dword [0x87772613]
fild dword [edi]
inc ebx
insb byte es:[edi], dx
adc esi, dword [edx]
xor ch, byte [ebp - 0x61]
jge 0x50321f
push ebx
pop esp
loope 0x5031ae
mov esp, 0x6fce3816
dec ebx
mov esp, 0xa0278eba
mov esi, 0x61a6e39a
insb byte es:[edi], dx
pop ebp
xor dword [ebx + 0x5a44ca20], edi
xlatb
jae 0x5031e2
out dx, eax
jecxz 0x5031f0
xlatb
xchg ebx, eax
push ss
into
or al, 0x5b
xchg dword [esi - 0x43], ebp
xor byte [ebx + 0x7c], dl
jb 0x503173
add dword [ebp + 0x78a59861], ebp
ret
and dl, al
mov al, 0
adc dl, dl
imul edi, edx, 0xd6a47f73
salc
salc
push ss
inc ecx
jo 0x5031b8
and bl, byte [edx - 0x49a9ff6a]
cmp sp, word [edi + 0x6bf2ef4b]
push ebx
adc esi, dword [edi + 0x9568246]
xlatb
mov ah, 0xf2
pop es
xor ecx, ebx
pushfd
jbe 0xc8736989
push esp
stosd dword es:[edi], eax
mov dh, 0xf
jbe 0x503247
retf 0xe2d2

Function at 0x60d735
Capabilities:
Encode data using xor

Disassembly:
dec esp
popal
push 0xfd4eab16
outsd dx, dword [esi]
outsb dx, byte [esi]
test dword [ecx], edx
out dx, eax
popfd
dec ebp
invalid
push ecx
dec ecx
call 0x8816ea2e
xchg esi, ecx
xchg esi, ecx
mov edx, 0x5f9dde5e
std
in eax, 0xc3
loope 0x60d706
invalid
push esi
inc esi
xor bh, byte [ecx + 0x32]
jne 0x60d7be
pop ebp
inc edi
inc edi
cmpsd dword [esi], dword es:[edi]
adc byte [edi - 0x443cb969], al
xchg esi, eax
in eax, dx
mov edx, 0xe7922316
add al, 4
or byte [ecx + 0x1166663b], dh
movsb byte es:[edi], byte [esi]
fcmovbe st(0), st(3)
pop es
jne 0x60d72f
out 4, eax
add al, 8
mov cl, 0x3b
adc word [edx + ebx*8 - 0x388af82d], sp
and ecx, esi
cmp eax, 0x58476ba6
bound esi, qword [esi + ecx*4]
cmpsd dword [esi], dword es:[edi]
push es
jnp 0x60d759
mov ah, 0x4f
jle 0x60d7ee
into
jle 0x60d7ce
push ss
adc al, 0x24
invalid
cmpsb byte [esi], byte es:[edi]
invalid
outsd dx, dword [esi]
popfd
bound esi, qword [esi + 0x78]
push eax
rcl dword [edi - 0x640f0a5d], 0x66
xchg edi, eax
mov dword [0x669bf0f5], eax
push es
fisttp word [ebx]
leave
jo 0x60d795
xchg ah, bl
inc edx
std
xlatb
leave
rol byte [esp + ebp + 0x13], cl
jne 0x60d83f
jo 0x60d844
je 0x60d7cc
sti
je 0x60d7ab
mov edx, dword [eax - 0x4c5bf680]
xchg esp, eax
xchg edi, eax
and edi, dword [ebp + esi*8 - 0x47220b6a]
stosd dword es:[edi], eax
adc al, 0x45
invalid
and esi, dword [ebp - 0x4aed0cd9]
pop ebp
mov ah, 0x63
int3
loop 0x60d7b4
and ah, byte [edx - 0x31adc747]
xor edx, dword [edi + esi*2 - 0xd]
mov ebx, 0xa5c41ae9
dec ebx
cmpsb byte [esi], byte es:[edi]
lock sub dword [eax], 0x5523ae9a
xchg edx, eax
add ebp, dword [eax]
cmp esp, dword [ebx + ecx - 3]
wait
adc al, 0x6b
pushfd
cdq
pop esi
popal
pop edi
add edi, dword [esi - 6]
sal al, cl
xchg ebp, eax
ljmp 0x6bc6
and cl, byte [edx - 0x408c6e78]
jae 0x60d805
int3
Function at 0x416be3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4213dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040f9ce
and dword [ebp - 0x14], 0
cmp dword [0x438514], 0
mov dword [ebp - 0x18], eax
jne 0x416c96
push 0x403ff0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x416d3e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403fe4
push ebx
call edi
test eax, eax
je 0x416d3e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403fd4
push ebx
mov dword [0x438514], eax
call edi
push eax
call esi
push 0x403fc0
push ebx
mov dword [0x438518], eax
call edi
push eax
call esi
push 0x403fa4
push ebx
mov dword [0x43851c], eax
call edi
push eax
call esi
mov dword [0x438524], eax
test eax, eax
je 0x416c96
push 0x403f8c
push ebx
call edi
push eax
call esi
mov dword [0x438520], eax
mov eax, dword [0x438520]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x416cef
cmp dword [0x438524], ecx
je 0x416cef
push eax
call esi
push dword [0x438524]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x416cef
test ebx, ebx
je 0x416cef
call edi
test eax, eax
je 0x416ce6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x416ce6
test byte [ebp - 8], 1
jne 0x416cef
or dword [ebp + 0x10], 0x200000
jmp 0x416d22
mov eax, dword [0x438518]
cmp eax, dword [ebp - 0x18]
je 0x416d22
push eax
call esi
test eax, eax
je 0x416d22
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x416d22
mov eax, dword [0x43851c]
cmp eax, dword [ebp - 0x18]
je 0x416d22
push eax
call esi
test eax, eax
je 0x416d22
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x438514]
call esi
test eax, eax
je 0x416d3e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x416d40
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b54e
leave
ret
Function at 0x403720
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4236a8
push eax
mov dword fs:[0], esp
sub esp, 0x448
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_SetDeviceGammaRamp]
xor esi, esi
cmp esi, 0x2710
jge 0x40375b
lea eax, [ebp - 0x454]
push eax
push 0
call edi
inc esi
cmp esi, 0x1ff49ccc
jl 0x403748
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov ebx, dword [ebp - 0x10]
xor esi, esi
call edi
cmp esi, 0x2b259d
jle 0x403782
cmp ebx, 0x785074d5
jne 0x40378b
inc esi
cmp esi, 0x1c1b
jl 0x403770
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
lea esp, [esp]
push 0
call edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, 0x206d47
jg 0x4037bd
inc esi
cmp esi, 0x4f6a4
jl 0x4037a0
cmp dword [0x845080], 0x400
jne 0x403800
push 0
lea ecx, [ebp - 0x454]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
lea eax, [ebp - 0x30]
call fcn.00403890
push 0
mov dword [ebp - 4], 0
call fcn.00403bc4
add esp, 4
lea esi, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004038b0
mov edx, dword [0x42613c]
mov eax, dword [0x426110]
mov dword [0x845080], edx
mov dword [0x845084], eax
call fcn.004033e0
mov ebx, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
xor esi, esi
push 0
call edi
cmp esi, 0x2b259d
jle 0x40383a
cmp ebx, 0x785074d5
jne 0x403843
inc esi
cmp esi, 0x11915
jl 0x403826
mov esi, dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edi, 0x3078f
pop ebx
nop
cmp dword [0x845080], 0x51f
jne 0x403862
lea ecx, [ebp - 0x54]
push ecx
call esi
sub edi, 1
jne 0x403850
mov eax, dword [0x843fd4]
mov dword [0x844614], eax
call eax
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404530
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4250c8]
jne 0x40453a
repz ret
jmp fcn.00406c9e
Function at 0x4068bf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004045b1
and dword [ebp - 4], 0
cmp dword [0x426a10], 0
mov ebx, eax
jne 0x406970
push 0x4019f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406a21
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4019ec
push edi
call esi
test eax, eax
je 0x406a21
push eax
call fcn.0040453f
mov dword [esp], 0x4019dc
push edi
mov dword [0x426a10], eax
call esi
push eax
call fcn.0040453f
mov dword [esp], 0x4019c8
push edi
mov dword [0x426a14], eax
call esi
push eax
call fcn.0040453f
mov dword [esp], 0x4019ac
push edi
mov dword [0x426a18], eax
call esi
push eax
call fcn.0040453f
pop ecx
mov dword [0x426a20], eax
test eax, eax
je 0x406970
push 0x401994
push edi
call esi
push eax
call fcn.0040453f
pop ecx
mov dword [0x426a1c], eax
mov eax, dword [0x426a1c]
cmp eax, ebx
je 0x4069c8
cmp dword [0x426a20], ebx
je 0x4069c8
push eax
call fcn.004045ba
push dword [0x426a20]
mov esi, eax
call fcn.004045ba
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4069c8
test edi, edi
je 0x4069c8
call esi
test eax, eax
je 0x4069bf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4069bf
test byte [ebp - 0xc], 1
jne 0x4069c8
or dword [ebp + 0x10], 0x200000
jmp 0x406a01
mov eax, dword [0x426a14]
cmp eax, ebx
je 0x406a01
push eax
call fcn.004045ba
pop ecx
test eax, eax
je 0x406a01
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406a01
mov eax, dword [0x426a18]
cmp eax, ebx
je 0x406a01
push eax
call fcn.004045ba
pop ecx
test eax, eax
je 0x406a01
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x426a10]
call fcn.004045ba
pop ecx
test eax, eax
je 0x406a21
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406a23
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6f2e04
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x734008], 0x8088405
inc edx
mov dword [ebx + 0x734008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x6fc1dc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x7987b4
mov eax, ebx
mov edx, 8
test al, 1
je 0x6fc1f8
shr eax, 1
xor eax, 0xedb88320
jmp 0x6fc1fa
shr eax, 1
dec edx
jne 0x6fc1eb
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x6fc1e4
pop ebx
ret

Function at 0x6fd3e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, dword [esp]
inc eax
cmp eax, 5
jge 0x6fd3fd
xor eax, eax
jmp 0x6fd485
mov cl, byte [esi]
and cl, 0xff
and ecx, 0xff
mov eax, ecx
mov ebx, 9
cdq
idiv ebx
mov dword [esp + 4], edx
mov eax, ecx
mov ecx, 9
cdq
idiv ecx
mov ecx, eax
mov eax, ecx
mov ebx, 5
cdq
idiv ebx
mov dword [esp + 8], edx
mov eax, ecx
mov ecx, 5
cdq
idiv ecx
mov dword [esp + 0xc], eax
xor ebx, ebx
xor eax, eax
mov ecx, eax
shl ecx, 3
lea edx, [eax + 1]
mov dl, byte [esi + edx]
and dl, 0xff
and edx, 0xff
shl edx, cl
add ebx, edx
inc eax
cmp eax, 4
jne 0x6fd442
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edi
call fcn.006fcfa4
test al, al
jne 0x6fd47c
xor eax, eax
jmp 0x6fd485
mov edx, ebx
mov eax, edi
call fcn.006fcf54
add esp, 0x10
pop edi
pop esi
pop ebx
ret