joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a11c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45a1cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x208]
cmp eax, 1
je 0x45a14c
mov dword [ebp - 4], eax
jmp 0x45a1b7
mov edi, dword [ebx + 0x61c]
lea eax, [ebp - 8]
push eax
xor ecx, ecx
or edx, 0xffffffff
mov eax, edi
call fcn.00453540
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00403d0c
mov eax, ebx
call fcn.0045a2bc
xor al, 1
mov edi, eax
and edi, 0x7f
mov dword [ebx + 0x208], edi
mov dword [ebp - 4], edi
cmp byte [ebx + 4], 1
jne 0x45a1b7
mov eax, dword [esi]
call fcn.00403f34
mov edi, eax
test edi, edi
jle 0x45a1b7
mov ebx, 1
mov eax, esi
call fcn.00404104
mov edx, dword [esi]
movzx edx, byte [edx + ebx - 1]
xor edx, 0xf3
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x45a19b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a1d4
lea eax, [ebp - 8]
call fcn.00403cb8
ret

Function at 0x45a1e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45a2a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x208]
cmp eax, 1
je 0x45a219
mov dword [ebp - 8], eax
jmp 0x45a290
mov edi, dword [ebx + 0x61c]
lea eax, [ebp - 0x10c]
push eax
xor ecx, ecx
or edx, 0xffffffff
mov eax, edi
call fcn.00453540
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
mov ecx, 0xff
call fcn.00403f10
lea edx, [ebp - 0x108]
mov eax, esi
mov ecx, dword [ebp - 4]
call fcn.00402c34
mov eax, ebx
call fcn.0045a2bc
xor al, 1
mov edi, eax
and edi, 0x7f
mov dword [ebx + 0x208], edi
mov dword [ebp - 8], edi
cmp byte [ebx + 4], 1
jne 0x45a290
xor edx, edx
mov dl, byte [esi]
test edx, edx
jle 0x45a290
lea eax, [esi + 1]
xor ecx, ecx
mov cl, byte [eax]
xor ecx, 0xf3
mov byte [eax], cl
inc eax
dec edx
jne 0x45a280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a2b0
lea eax, [ebp - 0x10c]
call fcn.00403cb8
ret

Function at 0x45e388
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004040f8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x45e3a1
test al, 0x10
jne 0x45e3a5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x467cdc
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
xor edx, edx
mov dword [eax + 0x1c], edx
ret
Function at 0x47387c
Capabilities:
Get session user name

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov dword [esp], 0x400
mov eax, dword [esp]
call fcn.004026fc
mov ebx, eax
push esp
push ebx
call sub.advapi32.dll_GetUserNameA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x4738bb
mov edx, 0x4738e4
xor eax, eax
call fcn.00453298
mov byte [esp + 4], 0
jmp 0x4738c6
lea eax, [esp + 4]
mov edx, ebx
call fcn.00402e84
mov eax, ebx
call fcn.00402714
mov eax, esi
lea edx, [esp + 4]
call fcn.00402c18
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x473900
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe00
mov ebp, edx
mov edi, eax
push 0x1000
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x473996
mov eax, 0xc8
call fcn.004026fc
mov ebx, eax
mov eax, 0xc8
call fcn.004026fc
mov esi, eax
mov edx, 0x4739c8
mov eax, esi
call fcn.00408ac4
push 0xc7
push ebx
push esi
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, esp
mov edx, ebx
call fcn.00402e84
mov eax, ebx
call fcn.00402714
mov eax, esi
call fcn.00402714
mov eax, esp
mov edx, 0x4739d8
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402ce8
jne 0x473986
lea edx, [esp + 0x100]
mov eax, edi
call fcn.004739e8
jmp 0x4739a4
lea eax, [esp + 0x100]
mov edx, esp
call fcn.00402c18
jmp 0x4739a4
lea edx, [esp + 0x100]
mov eax, edi
call fcn.004739e8
mov eax, ebp
lea edx, [esp + 0x100]
call fcn.00402c18
add esp, 0x200
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4739e8
Capabilities:
Get hostname

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov dword [esp], 0x400
mov eax, dword [esp]
call fcn.004026fc
mov ebx, eax
push esp
push ebx
call sub.kernel32.dll_GetComputerNameA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x473a27
mov edx, 0x473a50
xor eax, eax
call fcn.00453298
mov byte [esp + 4], 0
jmp 0x473a32
lea eax, [esp + 4]
mov edx, ebx
call fcn.00402e84
mov eax, ebx
call fcn.00402714
mov eax, esi
lea edx, [esp + 4]
call fcn.00402c18
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x479890
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4798e1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4798c8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4798b8
jmp 0x4798e1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4798c9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x486cb4
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x28]
call fcn.004102c8
mov esi, eax
xor eax, eax
push ebp
push 0x486d2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x486d12
mov edx, ebx
mov eax, esi
call fcn.0040fe20
test byte [eax + 0x40], 1
je 0x486d0c
push 0
mov edx, ebx
mov eax, esi
call fcn.0040fe20
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov edx, ebx
mov eax, esi
call fcn.0040fd44
dec ebx
cmp ebx, 0xffffffff
jne 0x486ce0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486d35
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x28]
call fcn.0041032c
ret

Function at 0x48b66c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x48b69a
mov eax, ebx
call fcn.0048c110
cmp dword [ebx + 0x3c], 0
je 0x48b693
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x48b70b
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x48b6fd
cmp dword [ebx + 8], 0
je 0x48b6bc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x48b6ce
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x48b6fd
cmp dword [ebx + 8], 0
je 0x48b6af
cmp eax, 3
je 0x48b6e1
dec eax
jne 0x48b6af
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48b6af
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x48b6af
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x48b729
cmp dword [ebx + 0x10], 0xcc
je 0x48b729
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0048b734
pop ebx
ret
Function at 0x4a0f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x50c], ecx
mov esi, edx
lea edi, [ebp - 0x108]
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a1116
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x50c]
lea edx, [ebp - 0x108]
call fcn.00403ed8
mov eax, dword [ebp - 0x50c]
call fcn.0040871c
cmp al, 1
je 0x4a0f64
mov eax, dword [0x4eccb0]
cmp dword [eax], 0
je 0x4a10fd
mov dl, 1
mov eax, dword [0x45836c]
call fcn.00403050
mov ebx, eax
push 1
lea edx, [ebp - 0x108]
mov ecx, 1
mov eax, ebx
call fcn.00459730
test eax, eax
jge 0x4a0f9d
push 0
push 0x4a1128
push 0x4a1130
push 0
call sub.user32.dll_MessageBoxA_1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0045a420
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10c]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x40]
jmp 0x4a10dc
lea edx, [ebp - 0x308]
mov ecx, 0xff
mov eax, ebx
call fcn.0045a4b8
cmp dword [ebx + 0x208], 0
je 0x4a10e9
mov word [ebp - 0x208], 0x6101
cmp dword [ebp - 8], 0x1b3
jne 0x4a0ffd
cmp byte [ebp - 0x208], 1
lea eax, [ebp - 0x408]
push eax
lea edx, [ebp - 0x308]
mov eax, 0x4a1148
call fcn.00402aa8
mov ecx, eax
dec ecx
mov edx, 1
lea eax, [ebp - 0x308]
call fcn.00402824
lea eax, [ebp - 0x508]
push eax
lea edx, [ebp - 0x308]
mov eax, 0x4a1148
call fcn.00402aa8
mov edx, eax
inc edx
mov ecx, 0x46
lea eax, [ebp - 0x308]
call fcn.00402824
xor edx, edx
mov dl, byte [ebp - 0x508]
test edx, edx
jle 0x4a1073
lea eax, [ebp - 0x507]
xor ecx, ecx
mov cl, byte [eax]
xor ecx, 0xea
mov byte [eax], cl
inc eax
dec edx
jne 0x4a1063
xor edx, edx
mov dl, byte [ebp - 0x408]
test edx, edx
jle 0x4a1095
lea eax, [ebp - 0x407]
xor ecx, ecx
mov cl, byte [eax]
xor ecx, 0xea
mov byte [eax], cl
inc eax
dec edx
jne 0x4a1085
lea eax, [ebp - 0x50c]
lea edx, [ebp - 0x508]
call fcn.00403ed8
mov edx, dword [ebp - 0x50c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x50c]
lea edx, [ebp - 0x408]
call fcn.00403ed8
mov edx, dword [ebp - 0x50c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10c]
mov ecx, dword [eax]
call dword [ecx + 0x34]
cmp dword [ebx + 0x208], 0
jg 0x4a0fc5
mov eax, ebx
call fcn.00458708
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a111d
lea eax, [ebp - 0x50c]
call fcn.00403cb8
ret
Function at 0x4a1dc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaf8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x508], ebx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x304]
push ecx
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop ecx
mov esi, ecx
lea edi, [ebp - 0x204]
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea edi, [ebp - 0x104]
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4a1f74
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 1
xor edx, edx
mov dl, byte [ebp - 0x204]
test edx, edx
jle 0x4a1e46
lea eax, [ebp - 0x203]
xor ecx, ecx
mov cl, byte [eax]
xor ecx, 0xea
mov byte [eax], cl
inc eax
dec edx
jne 0x4a1e36
xor edx, edx
mov dl, byte [ebp - 0x304]
test edx, edx
jle 0x4a1e68
lea eax, [ebp - 0x303]
xor ecx, ecx
mov cl, byte [eax]
xor ecx, 0xea
mov byte [eax], cl
inc eax
dec edx
jne 0x4a1e58
lea edx, [ebp - 0x304]
lea eax, [ebp - 0x504]
call fcn.00402c18
mov edx, 0x4a1f88
lea eax, [ebp - 0x504]
call fcn.00402bc0
lea edx, [ebp - 0x204]
lea eax, [ebp - 0x504]
call fcn.00402bc0
lea edx, [ebp - 0x504]
lea eax, [ebp - 0x404]
call fcn.00402c18
mov dl, 1
mov eax, dword [0x4583c4]
call fcn.00403050
mov esi, eax
lea eax, [ebp - 0x508]
lea edx, [ebp - 0x104]
call fcn.00403ed8
mov eax, dword [ebp - 0x508]
call fcn.0040871c
test al, al
je 0x4a1ede
cmp bl, 1
jne 0x4a1f21
cmp bl, 1
jne 0x4a1eff
lea eax, [ebp - 0x508]
lea edx, [ebp - 0x104]
call fcn.00403ed8
mov eax, dword [ebp - 0x508]
call fcn.00408814
push 1
mov ecx, 5
lea edx, [ebp - 0x104]
mov eax, esi
call fcn.00458a68
mov edx, 0x1b3
mov eax, esi
call fcn.00458780
jmp 0x4a1f47
push 1
mov ecx, 2
lea edx, [ebp - 0x104]
mov eax, esi
call fcn.00458a68
mov eax, dword [esi + 0x618]
mov ecx, 2
xor edx, edx
call fcn.004086a0
lea edx, [ebp - 0x404]
mov eax, esi
call fcn.004588a8
mov eax, esi
call fcn.00458708
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1f7b
lea eax, [ebp - 0x508]
call fcn.00403cb8
ret
Function at 0x4d6ef4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov edi, eax
xor eax, eax
push ebp
push 0x4d7102
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi + 0x268], 0
jne 0x4d6f25
mov bl, 1
jmp 0x4d6f27
xor ebx, ebx
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x11c], eax
xor eax, eax
mov dword [ebp - 0x118], eax
fild qword [ebp - 0x11c]
fld xword [edi + 0x140]
fsubp st(1)
fdiv dword [0x4d7110]
fstp xword [ebp - 0x12]
wait
mov edx, dword [edi + 0x14c]
test edx, edx
jle 0x4d6f79
mov dword [ebp - 0x120], edx
fild dword [ebp - 0x120]
fld xword [ebp - 0x12]
fcompp
fnstsw ax
sahf
jb 0x4d6f79
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [0x4ec99c]
mov eax, dword [eax]
call fcn.004a680c
mov esi, eax
cmp esi, 0xa
jl 0x4d6fa3
cmp byte [edi + 0x158], 1
jne 0x4d6fa3
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x48]
mov byte [edi + 0x150], 3
test bl, bl
je 0x4d6fdb
lea ecx, [ebp - 0x124]
mov eax, dword [0x4eca0c]
mov eax, dword [eax]
mov edx, 0xf7
call fcn.0045b468
mov edx, dword [ebp - 0x124]
mov eax, dword [0x4ec9b8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2e0]
call fcn.0042e754
jmp 0x4d70e9
lea ecx, [ebp - 0x124]
mov eax, dword [0x4eca0c]
mov eax, dword [eax]
mov edx, 0x82
call fcn.0045b468
mov edx, dword [ebp - 0x124]
mov eax, dword [0x4ec9b8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2e0]
call fcn.0042e754
mov eax, dword [0x4ec9b8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
mov edx, esi
call fcn.0048878c
mov ecx, dword [edi + 0x268]
sub ecx, esi
cmp ecx, dword [edi + 0x270]
je 0x4d70e9
mov dword [edi + 0x270], ecx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 8], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x124]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x134], eax
mov byte [ebp - 0x130], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0
lea edx, [ebp - 0x134]
mov ecx, 1
mov eax, 0x4d711c
call fcn.00409158
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x112]
mov ecx, 0xff
call fcn.00403f10
lea eax, [ebp - 0x124]
lea edx, [ebp - 0x112]
call fcn.00403ed8
mov edx, dword [ebp - 0x124]
mov eax, dword [0x4ec9b8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.0042e754
cmp esi, dword [edi + 0x268]
jl 0x4d70e9
test bl, bl
jne 0x4d70e9
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x44]
mov byte [edi + 0x150], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7109
lea eax, [ebp - 0x124]
call fcn.00403cb8
ret
Function at 0x4d750c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d76de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004a5adc
mov byte [ebx + 0x12a], 0
cmp dword [ebx + 0x25c], 0
jne 0x4d7571
mov eax, dword [ebx + 0x13c]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 4
jl 0x4d7571
lea ecx, [ebp - 4]
mov edx, 3
mov eax, dword [ebx + 0x13c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x25c]
call fcn.00403d0c
mov eax, dword [ebx + 0x25c]
call fcn.00403f34
inc eax
call fcn.00408c24
mov esi, eax
mov edx, dword [ebx + 0x25c]
mov eax, esi
call fcn.00408ac4
mov edx, esi
mov eax, ebx
call fcn.004d7a04
mov eax, esi
call fcn.00408c70
mov ecx, dword [0x4ec9b8]
mov eax, dword [0x4eccb8]
mov eax, dword [eax]
mov edx, dword [0x49d760]
call fcn.0044aad0
mov eax, dword [0x4ec9b8]
mov eax, dword [eax]
mov edx, dword [eax + 0x318]
mov eax, dword [0x4ecd00]
mov eax, dword [eax]
call fcn.004a486c
mov eax, dword [0x4ec9b8]
mov eax, dword [eax]
mov edx, dword [eax + 0x314]
mov eax, dword [0x4ecd00]
mov eax, dword [eax]
call fcn.004a486c
mov eax, dword [0x4ec9b8]
mov eax, dword [eax]
mov edx, dword [eax + 0x30c]
mov eax, dword [0x4ecd00]
mov eax, dword [eax]
call fcn.004a486c
mov eax, dword [0x4ec9b8]
mov eax, dword [eax]
mov edx, dword [eax + 0x310]
mov eax, dword [0x4ecd00]
mov eax, dword [eax]
call fcn.004a486c
mov eax, dword [0x4ec9b8]
mov eax, dword [eax]
mov eax, dword [eax + 0x318]
call fcn.0042e978
mov eax, dword [0x4ec9b8]
mov eax, dword [eax]
mov eax, dword [eax + 0x314]
call fcn.0042e978
mov eax, dword [0x4ec9b8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30c]
call fcn.0042e978
mov eax, dword [0x4ec9b8]
mov eax, dword [eax]
mov eax, dword [eax + 0x310]
call fcn.0042e978
mov eax, ebx
call fcn.004d76ec
cmp dword [ebx + 0x260], 0
je 0x4d7687
call fcn.00409788
mov eax, dword [ebx + 0x260]
fstp qword [eax + 0x514]
wait
mov byte [ebx + 0x150], 0
mov dword [ebx + 0xc], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0x30]
mov dword [ebx + 8], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
fild qword [ebp - 0xc]
fstp xword [ebx + 0x12c]
wait
mov eax, dword [0x4ecd00]
mov eax, dword [eax]
mov dword [eax + 0x1bc], ebx
mov edx, dword [ebx]
mov edx, dword [edx + 0xc]
mov dword [eax + 0x1b8], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d76e5
lea eax, [ebp - 4]
call fcn.00403cb8
ret
Function at 0x4df0c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], eax
xor eax, eax
push ebp
push 0x4df225
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.00402d58
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00402d58
xor ebx, ebx
call fcn.00409788
fstp qword [ebp - 8]
wait
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
lea edx, [ebp - 0x64]
mov eax, dword [0x4eccb8]
mov eax, dword [eax]
call fcn.0044b018
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.004088ac
mov eax, dword [ebp - 0x60]
call fcn.004040f8
push eax
push 0
push 0
push 0
push 0
push 0
push 0x4df234
push 0
call sub.kernel32.dll_CreateProcessA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x4df19d
mov eax, dword [0x4ecd00]
mov eax, dword [eax]
xor edx, edx
call fcn.004a472c
push 0x10
mov eax, dword [0x4eca0c]
mov eax, dword [eax]
mov edx, 1
call fcn.0045b37c
push eax
mov eax, dword [0x4eca0c]
mov eax, dword [eax]
mov edx, 0x1dd
call fcn.0045b180
mov edx, eax
mov eax, dword [0x4eccb8]
mov eax, dword [eax]
pop ecx
call fcn.0044aca8
jmp 0x4df20a
mov bl, 1
mov eax, dword [0x4eccb8]
mov eax, dword [eax]
call fcn.0044a9a4
call fcn.00409788
fsub qword [ebp - 8]
fmul dword [0x4df24c]
fcomp dword [0x4df250]
fnstsw ax
sahf
jbe 0x4df1fa
push 0x10
mov eax, dword [0x4eca0c]
mov eax, dword [eax]
mov edx, 1
call fcn.0045b37c
push eax
mov eax, dword [0x4eca0c]
mov eax, dword [eax]
mov edx, 0x1de
call fcn.0045b180
mov edx, eax
mov eax, dword [0x4eccb8]
mov eax, dword [eax]
pop ecx
call fcn.0044aca8
jmp 0x4df20a
push 0x4df254
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x4df19f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df22c
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.00403cdc
ret
Function at 0x403b79
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x40840e]
test eax, eax
jg 0x403b8c
and dword [0x4083d4], 0
xor eax, eax
ret
push edi
push esi
mov esi, 0x800
cmp eax, esi
ja 0x403b99
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll__lread]
push esi
push dword [0x4083d0]
push dword [0x407e04]
call edi
cmp dword [0x407e14], 0
mov ecx, eax
mov dword [0x4083d4], ecx
je 0x403c08
cmp ecx, 0xffffffff
je 0x403c08
cmp ecx, esi
je 0x403c19
test ecx, ecx
jl 0x403c08
mov ax, word [0x4078d0]
push dword [0x407e18]
inc ax
push eax
call fcn.0040132a
mov ecx, dword [0x4083d4]
test ecx, ecx
jne 0x403c01
push esi
push dword [0x4083d0]
push dword [0x407e04]
call edi
mov ecx, eax
mov dword [0x4083d4], ecx
cmp ecx, 0xffffffff
je 0x403c08
mov esi, ecx
cmp ecx, esi
je 0x403c19
push 2
call fcn.00401d71
mov ecx, dword [0x4083d4]
sub dword [0x40840e], ecx
mov esi, dword [0x4083d0]
cmp dword [0x407e08], 0
mov dword [0x40841c], esi
je 0x403c5b
mov eax, ecx
mov edx, eax
dec eax
test edx, edx
je 0x403c5b
lea edi, [eax + 1]
call fcn.004054cc
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.004054e2
inc esi
dec edi
pop ecx
jne 0x403c40
mov ecx, dword [0x4083d4]
mov eax, ecx
dec ecx
pop esi
mov dword [0x4083d4], ecx
pop edi
ret

Function at 0x4054e2
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x407e70]
xor eax, ecx
mov edx, 0xff
and eax, edx
push esi
shr ecx, 8
mov eax, dword [eax*4 + 0x407ea0]
xor eax, ecx
mov ecx, dword [0x407e78]
mov dword [0x407e70], eax
and eax, edx
add eax, dword [0x407e74]
mov esi, ecx
and esi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [0x407e74], eax
shr eax, 0x18
xor esi, eax
shr ecx, 8
mov eax, dword [esi*4 + 0x407ea0]
pop esi
xor eax, ecx
mov dword [0x407e78], eax
ret

Function at 0x4055c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push dword [0x407e10]
call fcn.0040553d
pop ecx
lea eax, [ebp - 0xc]
push 0xc
push dword [ebp + 8]
push eax
call fcn.00401000
add esp, 0xc
xor edi, edi
lea esi, [ebp + edi - 0xc]
call fcn.004054cc
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.004054e2
inc edi
pop ecx
cmp edi, 0xc
jl 0x4055f0
cmp dword [0x407e0c], 0
movzx ax, byte [ebp - 1]
je 0x405623
xor ecx, ecx
mov cl, byte [0x408407]
jmp 0x40562c
mov ecx, dword [0x40840a]
shr ecx, 0x18
cmp ax, cx
je 0x405636
or eax, 0xffffffff
jmp 0x405638
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
jmp 0x42da43
push 0x14
push 0x448130
call fcn.0042db10
push 1
call fcn.0042d629
pop ecx
test al, al
jne 0x42d8fa
push 7
call fcn.0042dd15
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0042d5f4
mov byte [ebp - 0x24], al
mov eax, dword [0x44b81c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x42d8f3
test eax, eax
jne 0x42d964
mov dword [0x44b81c], ecx
push 0x43d308
push 0x43d2f0
call fcn.0043435d
pop ecx
pop ecx
test eax, eax
je 0x42d947
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x42da3d
push 0x43d2ec
push 0x43d284
call fcn.00434301
pop ecx
pop ecx
mov dword [0x44b81c], 2
jmp 0x42d969
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0042d783
pop ecx
call fcn.0042e000
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x42d999
push esi
call fcn.0042d6f9
pop ecx
test al, al
je 0x42d999
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0042db09
call esi
call fcn.0042e006
mov esi, eax
cmp dword [esi], edi
je 0x42d9b7
push esi
call fcn.0042d6f9
pop ecx
test al, al
je 0x42d9b7
push dword [esi]
call fcn.004337c0
pop ecx
call fcn.0042de30
movzx eax, ax
push eax
call fcn.004342ae
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0042de63
test al, al
jne 0x42d9e2
push esi
call fcn.004337f8
test bl, bl
jne 0x42d9eb
call fcn.0043379b
push edi
push 1
call fcn.0042d7a0
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x42da3d
call fcn.0042db56
ret
call fcn.0042defc
jmp 0x42d8db