joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x4070b4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x403780
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x4070b4]
movzx eax, al
bt eax, esi
jae 0x4037e0
mov ecx, dword [0x4070a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x403685
test byte [0x404020], 8
jne 0x403720
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x404030], 8
jne 0x4036d0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x403654
cmp esi, 3
jbe 0x403690
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4056e8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x403654
mov ecx, dword [0x4070b4]
test ecx, ecx
je 0x4037c0
mov dword [esp], 0x404030
call dword [0x4070b4]
test al, 8
je 0x40362b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x40362b
mov ebx, dword [0x4070b4]
test ebx, ebx
je 0x4037a0
mov dword [esp], 0x404020
call dword [0x4070b4]
test al, 8
je 0x403616
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x40361e
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4070b4
call sym._load_func.part.0
jmp 0x4035dd
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4070b4
call sym._load_func.part.0
jmp 0x40372a
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4070b4
call sym._load_func.part.0
jmp 0x4036de
mov eax, 0xffffffff
jmp 0x403685
Function at 0x403950
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x4163ee
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407f85
mov dword [ebp - 0x14], eax
cmp dword [0x820f3c], esi
jne 0x4164e1
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41646e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4165c1
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4165c1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4165c1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x820f3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x820f40], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x820f44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x820f4c], eax
test eax, eax
je 0x4164de
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x820f48], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x416506
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4164f9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41651b
push 4
pop eax
jmp 0x4165c3
cmp dword [ebp - 0x14], esi
je 0x41651b
push dword [0x820f3c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x416500
mov eax, dword [0x820f48]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x416579
cmp dword [0x820f4c], edi
je 0x416579
push eax
call ebx
push dword [0x820f4c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x416579
test eax, eax
je 0x416579
call ecx
test eax, eax
je 0x41656e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41656e
test byte [ebp - 8], 1
jne 0x416579
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4165a9
mov eax, dword [0x820f40]
cmp eax, edi
je 0x4165a6
push eax
call ebx
test eax, eax
je 0x4165a6
call eax
mov esi, eax
test esi, esi
je 0x4165a6
mov eax, dword [0x820f44]
cmp eax, edi
je 0x4165a6
push eax
call ebx
test eax, eax
je 0x4165a6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x820f3c]
call ebx
test eax, eax
je 0x4165c1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4165c3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406f2e
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.00401533
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401dc7
sub eax, fcn.00401592
push eax
push fcn.00401592
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40107a
mov eax, ebx
lea edx, [ebp - 2]
jmp loc.004247de
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401533
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ecx
push edx
enter 0x11c, 0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
sub eax, 0x41
leave
pop edx
pop ecx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x403203
pop dword [ebp - 0x30]
mov eax, 0xd8ab2765
sub eax, 0xd86af562
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x7d76439a
sub dword [ebp - 0x40], 0x2f23fe4f
mov dword [ebp - 0x3c], 0x7a1cfe15
add dword [ebp - 0x3c], 0xb8164e30
mov dword [ebp - 0x38], 0x10b9f202
add dword [ebp - 0x38], 0x3b92522c
mov dword [ebp - 0x34], 0xefc90b59
add dword [ebp - 0x34], 0x1036f4a7
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xe57c8102
add dword [ebp - 0x40], 0x8ef5e854
mov dword [ebp - 0x3c], 0xb7cb7c6
sub dword [ebp - 0x3c], 0xca105651
mov dword [ebp - 0x38], 0xb6aabed1
sub dword [ebp - 0x38], 0x533b5265
mov dword [ebp - 0x34], 0x43ef0252
add dword [ebp - 0x34], 0xbc10fdae
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xb828f663
add eax, 0x48178a71
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3839d
push 0
call eax
mov ecx, 0x4e87
xor esi, esi
add esi, eax
mov edx, 0x6a59788d
sub edx, 0x6a18688d
add edx, dword [ebp - 0x30]
mov ebx, 0xb8bb683a
sub ebx, 0x96033cb0
mov edi, dword [edx]
sub dword [ebp - 4], 0x6b91c454
sub edi, ebx
xor dword [ebp - 8], 0xf6da00e6
mov dword [esi], edi
add dword [ebp - 0xc], eax
add esi, 0xcd94decd
add esi, 0x326b2137
add edx, 4
loop 0x40331c
add eax, 0x12cef
mov ebx, eax
add eax, 0x3850585c
add eax, 0xc7afa7a9
mov ecx, 0x2c9575f7
sub ecx, 0x2c5575f7
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4373d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x32000]
push edi
jmp 0x4373ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4373f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4373e0
mov eax, 1
add ebx, ebx
jne 0x437403
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4373f8
jne 0x437414
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4373f8
xor ecx, ecx
sub eax, 3
jb 0x437428
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43749a
mov ebp, eax
add ebx, ebx
jne 0x437433
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x437440
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x437464
inc ecx
add ebx, ebx
jne 0x437450
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x437445
jne 0x437461
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x437445
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x437484
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x437475
jmp 0x4373e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x437484
add edi, ecx
jmp 0x4373e6
pop esi
mov edi, esi
mov ecx, 0x240
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4374a2
cmp byte [edi], 1
jne 0x4374a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4374a7
lea edi, [esi + 0x35000]
mov eax, dword [edi]
or eax, eax
je 0x43751f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x39cb8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x39d84]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4374d4
mov ecx, edi
jns 0x437503
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x39d8c]
or eax, eax
je 0x437519
mov dword [ebx], eax
add ebx, 4
jmp 0x4374f1
call dword [esi + 0x39d88]
mov ebp, dword [esi + 0x39d90]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x437553
sub esp, 0xffffff80
jmp 0x403161
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x402ee4
pop dword [ebp - 0x48]
mov eax, 0x22beb976
add eax, 0xdd81756e
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x48ecaaa4
add dword [ebp - 0x58], 0x5659aa7
mov dword [ebp - 0x54], 0xea853f49
add dword [ebp - 0x54], 0x47ae0cfc
mov dword [ebp - 0x50], 0x74bb7648
add dword [ebp - 0x50], 0xd790cde6
mov dword [ebp - 0x4c], 0x219277d2
sub dword [ebp - 0x4c], 0x219277d2
lea eax, [ebp - 0x58]
push eax
mov eax, 0x1e2a00af
sub eax, 0x1de97fab
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x66d8361c
add dword [ebp - 0x58], 0xd9a333a
mov dword [ebp - 0x54], 0x2674c257
sub dword [ebp - 0x54], 0xe50860e2
mov dword [ebp - 0x50], 0xe7b9211f
sub dword [ebp - 0x50], 0x8449b4b3
mov dword [ebp - 0x4c], 0x3635d2ac
sub dword [ebp - 0x4c], 0x3635d2ac
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xdea6e26a
sub eax, 0xde66616a
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3c0af
push 0
call eax
mov ecx, 0x92fee528
add ecx, 0x6d0176df
mov edx, eax
mov edi, 0x33c65b5b
sub edi, 0x337f775b
add edi, dword [ebp - 0x48]
mov esi, 0xa2320ea4
sub esi, 0x8394e201
add dword [ebp - 0xc], ebx
mov ebx, dword [edi]
sub dword [ebp - 0x2c], edx
sub ebx, esi
mov dword [ebp - 0x20], 0x7447af65
mov dword [edx], ebx
xor dword [ebp - 0x40], 0x882e9c31
add edx, 0x1dae56bb
sub edx, 0x1dae56b7
add edi, 0x80a85864
add edi, 0x7f57a7a0
loop 0x403006
add eax, 0xac8baf18
sub eax, 0xac8a4c29
mov ebx, eax
add eax, 0x83588b98
add eax, 0x7ca7746d
mov ecx, 0x913e781a
sub ecx, 0x90fe781a
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x481d58
Capabilities:
Check for software breakpoints

Disassembly:
call 0x481d5d
pop eax
mov ebx, 0x400000
mov esi, dword [ebx + 0xc0]
lea eax, [ebx + esi]
dec eax
mov cl, byte [eax]
cmp cl, 0xcc
je 0x481d6c
sub eax, 3
mov edx, dword [eax]
mov esi, dword [ebx + 0x16c]
add esi, ebx
lea edi, [ebx + 0x1000]
push edi
mov ecx, edx
sub ecx, esi
push ecx
push esi
call fcn.00481bfa
lea edx, [eax - 4]
sub edx, dword [edx]
mov esi, ebx
add esi, dword [edx + 0x10c]
mov edi, dword [edx + 0x104]
mov ecx, 0x1d6be
call fcn.00481d1b
mov esi, dword [edx + 0x80]
push edx
add esi, ebx
mov eax, dword [esi + 0xc]
or eax, eax
je 0x481e03
add eax, ebx
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebp, eax
mov ecx, dword [esi]
add ecx, ebx
mov edi, dword [esi + 0x10]
add edi, ebx
mov eax, dword [ecx]
or eax, eax
je 0x481dfe
pushal
test eax, 0x80000000
je 0x481de8
and eax, 0x7fffffff
jmp 0x481dec
lea eax, [ebx + eax + 2]
push eax
push ebp
call sub.kernel32.dll_GetProcAddress
mov dword [edi], eax
popal
add edi, 4
add ecx, 4
jmp 0x481dd3
add esi, 0x14
jmp 0x481db9
pop edx
add ebx, dword [edx + 0x28]
jmp ebx
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x402c00
pop dword [ebp - 0x48]
mov eax, 0xc4fe6ad4
sub eax, 0xc4be3ed4
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x3d8972f4
sub dword [ebp - 0x58], 0xef372da9
mov dword [ebp - 0x54], 0xf3458e38
sub dword [ebp - 0x54], 0xc11241f3
mov dword [ebp - 0x50], 0x3c8d06d5
add dword [ebp - 0x50], 0xfbf3d59
mov dword [ebp - 0x4c], 0x6c048013
add dword [ebp - 0x4c], 0x93fb7fed
lea eax, [ebp - 0x58]
push eax
mov eax, 0x8a012667
add eax, 0x763f49fd
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x33348388
add dword [ebp - 0x58], 0x413de5ce
mov dword [ebp - 0x54], 0x5f231290
add dword [ebp - 0x54], 0xe2494ee5
mov dword [ebp - 0x50], 0xef773cd9
sub dword [ebp - 0x50], 0x8c07d06d
mov dword [ebp - 0x4c], 0xeae2f450
add dword [ebp - 0x4c], 0x151d0bb0
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xd25c2d77
add eax, 0x2de44331
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3b2c6
push 0
call eax
mov ecx, 0x1d461879
add ecx, 0xe2ba4177
mov edx, eax
mov ebx, 0x7b5aba0a
sub ebx, 0x7b19ba0a
add ebx, dword [ebp - 0x48]
mov edi, 0x383a2a64
add edi, 0x5905c591
xor dword [ebp - 0x1c], edi
mov esi, dword [ebx]
sub dword [ebp - 0x1c], 0xb9a2595
sub esi, edi
xor dword [ebp - 8], ecx
mov dword [edx], esi
xor dword [ebp - 0xc], edi
add edx, 4
add ebx, 4
loop 0x402d22
add eax, 0xec50a050
add eax, 0x13b0ba43
mov ebx, eax
add eax, 0xedcd0027
sub eax, 0xedcd0022
mov ecx, 0xd810592e
add ecx, 0x282fa6d2
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5c6008], 0x8088405
inc edx
mov dword [ebx + 0x5c6008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd64
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd95
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd7d
add dl, dl
jne 0x41cda0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cdf1
xor eax, eax
add dl, dl
jne 0x41cdad
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce8e
add dl, dl
jne 0x41cdbc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdc7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdd2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cddd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cde7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd8c
mov eax, 1
add dl, dl
jne 0x41cdff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ce0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdf6
sub eax, ebx
mov ebx, 1
jne 0x41ce3d
mov ecx, 1
add dl, dl
jne 0x41ce23
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce2e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce1a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce54
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce5f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce4b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ceaf
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd8c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret