joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x10]
push ebx
mov ebx, eax
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._GetUserNameExW_12
sub esp, 0xc
test al, al
jne 0x401078
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xea
jne 0x401078
mov eax, dword [ebp - 0x10]
add eax, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
test eax, eax
je 0x401078
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._GetUserNameExW_12
sub esp, 0xc
test al, al
jne 0x40107a
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
nop
lea esi, [esi]
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x38
cmp edx, 0xffffffff
je 0x4011d8
mov ebx, edx
mov edi, edx
mov eax, dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [esp], 0xfffffff5
mov dword [ebp - 0x14], eax
call eax
lea ecx, [ebp - 0x10]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x4010f0
mov edx, dword [ebp - 0x10]
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], ecx
call ecx
mov dword [esp + 0x1c], 0
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [ebp - 0x20], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x1c]
test eax, eax
mov edi, eax
je 0x4010e6
mov ecx, dword [ebp - 0x24]
call ecx
mov ecx, dword [ebp - 0x18]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
lea ebx, [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 8], esi
mov esi, dword [ebp - 0x20]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov esi, dword [ebp - 0x14]
sub esp, 0x20
mov dword [esp], 0xfffffff5
call esi
mov ecx, dword [ebp - 0x18]
sub esp, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp + 0x10], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x4010e3
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
mov edi, eax
mov ebx, eax
jmp 0x4010a8
Function at 0x401990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4019e8
cmp byte [esi + ebx - 1], 0xa
je 0x4019bc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x406084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x402010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x4021e8
mov edi, dword [0x406084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x4020f7
test byte [0x403018], 8
jne 0x402190
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x403028], 8
jne 0x402150
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x402099
cmp esi, 3
jbe 0x402108
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x4020aa
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4041ec]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x402099
mov dword [esp], 0x403028
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x402070
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x402070
mov dword [esp], 0x403018
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x40205b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x402063
mov eax, 0xffffffff
jmp 0x4020f7

Function at 0x402260
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x44a810
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x624
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, dword [esp + 0x63c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetStringTypeExW]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0xffffffffffffffff
push ebp
push 1
push edi
call ebx
push ebp
mov esi, dword [esp + 0x63c]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44a92d
push 0x2a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x44a87b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x624
ret 8
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x44a8b3
mov eax, dword [0x65b714]
push 0x65b448
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [esp + 0x14], eax
jne 0x44a92d
lea ecx, [esp + 0x42c]
push ecx
push 0xffffffffffffffff
push esi
push 1
push edi
call ebx
lea edx, [esp + 0x224]
push edx
push 0xffffffffffffffff
push esi
push 4
push edi
call ebx
lea eax, [esp + 0x1c]
push eax
push 0xffffffffffffffff
push ebp
push 1
push edi
call ebx
cmp word [esi], 0
je 0x44a91b
xor eax, eax
mov cl, 0x80
test byte [esp + eax + 0x224], cl
je 0x44a90f
mov dx, word [esp + eax + 0x42c]
cmp dx, word [esp + eax + 0x1c]
jne 0x44a92d
add esi, 2
add eax, 2
cmp word [esi], 0
jne 0x44a8f7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x624
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x624
ret 8

Function at 0x4c573e
Capabilities:
Encode data using xor

Disassembly:
pop ebp
neg dword [ebp + 6]
cmp ebx, esi
in eax, dx
and byte [ebp - 0x899fb79], bl
sti
insb byte es:[edi], dx
jg 0x4c575c
ljmp 0xfbd5:0x863e049e
lodsd eax, dword [esi]
cdq
push edx
jo 0x4c5730
mov edx, 0xedbccec7
fadd dword [edi - 0x56173d23]
invalid
Function at 0x618f84
Capabilities:
Encode data using xor

Disassembly:
invalid
outsb dx, byte [esi]
xor eax, 0xf79e95bb
fisub word [ebp + 0x5a]
sbb al, 0xbd
add eax, 0xf26ce22e
dec dword [edx]
sub eax, 0xfb6de32
cmp ecx, dword [edi + 0x6a]
mov edx, 0xd2043b1a
jge 0x618f64
adc eax, 0x819e7c2e
xor ebx, dword [edi - 0x26f14e56]
test byte [ecx + 0x61f36ea], 0xda
imul ecx, dword [edx + eax*8 + 0x1b], 0x3e9d02ba
or dword [ebp - 0x6a], esi
xor byte [eax], dh
jg 0x619039
pop edi
adc al, 0x65
xchg esp, eax
scasb al, byte es:[edi]
fisubr word [ebx]
mov esi, 0x978caeef
sub dl, byte [edx + eax + 0x21]
jp 0x618f83
cmpxchg byte [ecx - 0x496ebdcb], cl
cmp byte [eax + 0x67180f68], dh
xchg dword ss:[ecx + 0x6f5f079f], ecx
imul ebp, dword [ebp - 8], 0x4026e1d5
insd dword es:[edi], dx
clc
aad 0xe1
inc eax
sbb bh, byte ss:[ebx + 0x4b2a0ee1]
movsb byte es:[edi], byte [esi]
add al, 0xc3
sbb eax, 0x3c0cc4c2
outsb dx, byte [esi]
pop edx
popfd
aam 9
inc esp
mov ebp, 0xcea631bd
movsb byte es:[edi], byte [esi]
enter 0x1ed0, 0x62
fcmovu st(0), st(2)
push ds
insd dword es:[edi], dx
mov al, 0xfa
xor byte [esi], dl
dec esp
in al, 0x7f
sbb eax, 0xd44e0a21
mov cl, 0x6a
jle 0x618fec
invalid
sahf
add al, 0xb4
xor eax, dword [edx]
salc
dec esi
shr bl, 1
wait
mov ds, word [ebx]
int1
or bh, byte [edi]
xchg esi, eax
cwde
ret 0x7ec4

Function at 0x65047e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6582f0
cmp edx, dword [eax]
je 0x6504a0
add eax, 8
inc ecx
cmp eax, 0x658380
jl 0x650491
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6582f0]
jne 0x6505ce
mov eax, dword [0xa5b934]
cmp eax, 1
je 0x6505a8
test eax, eax
jne 0x6504d1
cmp dword [0x658234], 1
je 0x6505a8
cmp edx, 0xfc
je 0x6505ce
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x650508
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00650b90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00650dc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x65054b
lea eax, [ebp - 0x1a4]
push eax
call fcn.00650dc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x654b78
push edi
call fcn.00652590
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00650b90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00650ba0
lea eax, [ebp - 0xa0]
push 0x654b58
push eax
call fcn.00650ba0
push dword [esi + 0x6582f4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00650ba0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00652504
add esp, 0x2c
pop edi
jmp 0x6505ce
lea eax, [ebp + 8]
lea esi, [esi + 0x6582f4]
push 0
push eax
push dword [esi]
call fcn.00650dc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x420860
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x124
push ebx
push ebp
push esi
push edi
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x3c]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov ecx, 0xa
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x138]
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x18], ebx
xor esi, esi
call fcn.00420cd0
add eax, 4
movsx edx, word [esp + 0x50]
jo 0x4209b6
add eax, 0x14
jo 0x4209b6
add eax, edx
jo 0x4209b6
mov edi, eax
mov ax, word [esp + 0x42]
sub ax, 1
jo 0x4209b6
movsx ebp, ax
cmp ebp, ebx
jl 0x4209a7
lea ecx, [esp + 0x14]
push ecx
call fcn.004210b0
push 0x28
push edi
push eax
call fcn.00421000
mov eax, dword [esp + 0x38]
test eax, 0x20000000
je 0x42091e
test eax, 0x40000000
je 0x42090d
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x20
jmp 0x420943
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x70
add eax, 0x10
jmp 0x420943
test eax, 0x40000000
je 0x420936
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 2
add eax, 2
jmp 0x420943
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 7
inc eax
lea edx, [esp + 0x10]
mov esi, eax
push edx
call fcn.004210b0
push eax
push esi
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x140]
mov eax, dword [esp + 0x24]
add ecx, esi
push eax
jo 0x4209b6
push ecx
call fcn.00420fe0
test eax, eax
je 0x420990
add edi, 0x28
jo 0x4209b6
add ebx, 1
jo 0x4209b6
cmp ebx, ebp
jle 0x4208d7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x124
ret 4
mov esi, 4
call dword [sym.imp.KERNEL32.DLL_SetFileApisToANSI]
call dword [sym.imp.KERNEL32.DLL_SetFileApisToOEM]
call dword [sym.imp.USER32.DLL_WaitMessage]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x4056c0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x48c008], 0x8088405
inc edx
mov dword [ebx + 0x48c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cae4
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cb15
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cafd
add dl, dl
jne 0x41cb20
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cb71
xor eax, eax
add dl, dl
jne 0x41cb2d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc0e
add dl, dl
jne 0x41cb3c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cb47
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cb52
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cb5d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cb67
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cb0c
mov eax, 1
add dl, dl
jne 0x41cb7f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cb8a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cb76
sub eax, ebx
mov ebx, 1
jne 0x41cbbd
mov ecx, 1
add dl, dl
jne 0x41cba3
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cbae
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cb9a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cb0c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cbd4
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cbdf
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cbcb
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cb0c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cc2f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cb0c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41d7a8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x41d7bb
add esp, 0xfffffff0
call fcn.00403da8
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00403b30
mov byte [ebx + 4], 0
cmp dword [esi + 0x5c], 0
jne 0x41d7e1
cmp dword [esi + 0x58], 0x40
jb 0x41d9c7
jmp 0x41d7e7
jl 0x41d9c7
lea eax, [ebx + 0xc]
mov edx, 0x40
call fcn.00406e80
push 0
push 0
push 0
push 0x40
lea edx, [ebx + 0xc]
mov eax, esi
call fcn.0041d364
cmp word [ebx + 0xc], 0x5a4d
jne 0x41d9c7
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jle 0x41d9c7
cmp ecx, 0x10000
jge 0x41d9c7
mov eax, ecx
add eax, 4
add eax, 0x14
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d842
cmp eax, dword [esi + 0x58]
ja 0x41d9c7
jmp 0x41d848
jg 0x41d9c7
lea eax, [ebx + 0x4c]
mov edx, 4
call fcn.00406e80
mov eax, dword [ebx + 0x48]
cdq
push edx
push eax
push 0
push 4
lea edx, [ebx + 0x4c]
mov eax, esi
call fcn.0041d364
cmp dword [ebx + 0x4c], 0x4550
jne 0x41d9c7
lea eax, [ebx + 0x50]
mov edx, 0x14
call fcn.00406e80
mov eax, dword [ebx + 0x48]
add eax, 4
cdq
push edx
push eax
push 0
push 0x14
lea edx, [ebx + 0x50]
mov eax, esi
call fcn.0041d364
mov ax, word [ebx + 0x50]
cmp ax, 0x8664
jne 0x41d8ff
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xf0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d8c3
cmp eax, dword [esi + 0x58]
ja 0x41d950
jmp 0x41d8c9
jg 0x41d950
lea eax, [ebx + 0x144]
mov edx, 0xf0
call fcn.00406e80
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xf0
lea edx, [ebx + 0x144]
mov eax, esi
call fcn.0041d364
mov byte [ebx + 4], 1
jmp 0x41d950
cmp ax, 0x14c
jne 0x41d950
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xe0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d920
cmp eax, dword [esi + 0x58]
ja 0x41d950
jmp 0x41d922
jg 0x41d950
lea eax, [ebx + 0x64]
mov edx, 0xe0
call fcn.00406e80
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xe0
lea edx, [ebx + 0x64]
mov eax, esi
call fcn.0041d364
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
je 0x41d9c7
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
mov di, word [ebx + 0x52]
movzx edx, di
shl edx, 3
lea edx, [edx + edx*4]
add eax, edx
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d981
cmp eax, dword [esi + 0x58]
ja 0x41d9c7
jmp 0x41d983
jg 0x41d9c7
movzx eax, di
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x47627c]
call fcn.00405b74
add esp, 4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
cdq
push edx
push eax
movzx eax, word [ebx + 0x52]
shl eax, 3
lea eax, [eax + eax*4]
xor edx, edx
push edx
push eax
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.0041d364
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x41d9de
call fcn.00403e00
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret