joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x18af008], 0x8088405
inc edx
mov dword [ebx + 0x18af008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd64
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd95
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd7d
add dl, dl
jne 0x41cda0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cdf1
xor eax, eax
add dl, dl
jne 0x41cdad
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce8e
add dl, dl
jne 0x41cdbc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdc7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdd2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cddd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cde7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd8c
mov eax, 1
add dl, dl
jne 0x41cdff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ce0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdf6
sub eax, ebx
mov ebx, 1
jne 0x41ce3d
mov ecx, 1
add dl, dl
jne 0x41ce23
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce2e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce1a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce54
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce5f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce4b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ceaf
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd8c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e5a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1896a63
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e655
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e63e
test esi, esi
jbe 0x41e655
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088e4
test eax, eax
jne 0x41e630
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e655
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e60d
jmp 0x41e655
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e655
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1896a6a
ret
Function at 0x41eec4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x1897473
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eeff
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41ef18
lea eax, [ebp - 0x10]
mov edx, dword [0x18b12a4]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ef2b
lea eax, [ebp - 0x10]
mov edx, dword [0x18b12a4]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ef37
adc edx, 0
mov edx, dword [edx*4 + 0x18b010c]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41f045
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41f038
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41f038
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41f038
cmp dx, 0x150
ja 0x41f038
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41f038
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41f05d
inc ebx
cmp ebx, 0x19
jne 0x41eef1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x189747a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
mov ecx, 0x2526249
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x21b54478
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10004820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004829
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10004840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004849
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10005590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10005599
pop esi
pop ebp
ret 8

Function at 0x100055b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055b9
pop esi
pop ebp
ret 4

Function at 0x100055d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055d9
pop esi
pop ebp
ret 8

Function at 0x100184b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1017c928]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1017f7a8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
test eax, eax
jne 0x10018588
push esi
push 0x55
pop esi
push esi
push 0x1017f7b0
push 0x5c
push ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10018572
push esi
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.100a6450
add esp, 0xc
mov eax, ebx
cmp word [eax*2 + 0x1017f7b0], 0x5f
mov cl, 0x2d
je 0x10018512
mov cl, byte [eax*2 + 0x1017f7b0]
mov byte [ebp + eax - 0x5c], cl
test cl, cl
je 0x1001851f
inc eax
cmp eax, esi
jl 0x100184fe
cmp eax, esi
push 0x41
sbb al, al
and byte [ebp - 8], al
call sym.icucnv67.dll_u_strFromUTF8WithSub_67
mov esi, eax
pop ecx
test esi, esi
je 0x10018572
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call sym.icucnv67.dll_u_strFromUTF8WithSub_67
add esp, 0x10
cmp dword [ebp - 0x60], ebx
jg 0x1001856b
push 0x10017d70
push 0x15
mov byte [eax + esi], bl
mov dword [0x1017f7a8], esi
mov byte [0x1017f7ac], 1
call sym.icucnv67.dll_u_strFromUTF8WithSub_67
pop ecx
jmp 0x10018571
push esi
call sym.icucnv67.dll_u_strFromUTF8WithSub_67
pop ecx
mov ecx, dword [0x1017f7a8]
mov eax, 0x100fbd80
test ecx, ecx
pop esi
cmovne eax, ecx
mov dword [0x1017f7a8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100814c9
leave
ret
Function at 0x1004fc10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi + 0xc]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
test eax, eax
jle 0x1004fc67
mov ebx, dword [edi + 4]
movzx edx, byte [ebp + 8]
mov ecx, dword [ebx + esi*8]
mov ebx, dword [ebx + esi*8 + 4]
movzx eax, cl
dec ebx
mov dword [ebp - 4], eax
mov eax, ebx
xor eax, ecx
test eax, 0xffffff00
jne 0x1004fc52
cmp dword [ebp - 4], edx
ja 0x1004fc5e
jmp 0x1004fc57
cmp dword [ebp - 4], edx
jbe 0x1004fcab
movzx eax, bl
cmp edx, eax
jbe 0x1004fcab
mov ebx, dword [edi + 4]
inc esi
cmp esi, dword [ebp - 8]
jl 0x1004fc32
lea ecx, [edi - 4]
call sym.icucnv67.dll_private:_signed_char___thiscall_icu_67::UnicodeSet::hasStrings_void_const
test al, al
je 0x1004fca2
mov eax, dword [edi + 0x28]
xor esi, esi
cmp dword [eax + 4], esi
jle 0x1004fca2
movzx ebx, byte [ebp + 8]
push esi
mov ecx, eax
call sym.icucnv67.dll_u_strFromUTF8WithSub_67
push 0
mov ecx, eax
call sym.icucnv67.dll_u_strFromUTF8WithSub_67
movzx eax, al
cmp eax, ebx
je 0x1004fcab
mov eax, dword [edi + 0x28]
inc esi
cmp esi, dword [eax + 4]
jl 0x1004fc81
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
mov al, 1
jmp 0x1004fca4
Function at 0x401000
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, section..data
push eax
call sub.msvcrt.dll_system
add esp, 4
leave
ret

Function at 0x40101a
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
nop
mov eax, 0xfffffff5
push eax
call sub.kernel32.dll_GetStdHandle
mov ecx, dword [ebp + 8]
sub ecx, 1
mov word [ebp - 4], cx
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov word [ebp - 2], cx
sub esp, 4
mov ecx, esp
mov edx, 4
push edx
lea edx, [ebp - 4]
push edx
push ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetConsoleCursorPosition
leave
ret

Function at 0x401278
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
nop
mov eax, 0
push eax
call sub.msvcrt.dll_time
add esp, 4
push eax
call sub.msvcrt.dll_srand
add esp, 4
call sub.msvcrt.dll_rand
mov ecx, 0xd
cdq
idiv ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, 0xd
jle 0x4012bd
mov eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 1
jne 0x4012d7
mov eax, 0x404020
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp - 4]
cmp eax, 2
jne 0x4012f1
mov eax, 0x404029
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp - 4]
cmp eax, 3
jne 0x40130b
mov eax, 0x404032
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp - 4]
cmp eax, 4
jne 0x401325
mov eax, 0x40403b
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp - 4]
cmp eax, 5
jne 0x40133f
mov eax, 0x404044
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp - 4]
cmp eax, 6
jne 0x401359
mov eax, 0x40404d
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp - 4]
cmp eax, 7
jne 0x401373
mov eax, 0x404056
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp - 4]
cmp eax, 8
jne 0x40138d
mov eax, 0x40405f
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp - 4]
cmp eax, 9
jne 0x4013a7
mov eax, 0x404068
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp - 4]
cmp eax, 0xa
jne 0x4013c1
mov eax, 0x404071
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp - 4]
cmp eax, 0xb
jne 0x4013db
mov eax, 0x40407a
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp - 4]
cmp eax, 0xc
jne 0x4013f5
mov eax, 0x404083
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp - 4]
cmp eax, 0xd
jne 0x40140f
mov eax, 0x40408c
push eax
call sub.msvcrt.dll_system
add esp, 4
leave
ret
Function at 0x401411
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
call fcn.00401278
mov eax, 0
push eax
call sub.msvcrt.dll_time
add esp, 4
push eax
call sub.msvcrt.dll_srand
add esp, 4
mov eax, 0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0x190
jge 0x40152d
jmp 0x401460
mov eax, dword [ebp - 4]
mov ecx, eax
add eax, 1
mov dword [ebp - 4], eax
jmp 0x40143f
call sub.msvcrt.dll_rand
mov ecx, 0x6e
cdq
idiv ecx
mov dword [ebp - 8], edx
call sub.msvcrt.dll_rand
mov ecx, 0x26
cdq
idiv ecx
mov dword [ebp - 0xc], edx
call sub.msvcrt.dll_rand
mov ecx, 0xd
cdq
idiv ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040106f
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0040101a
add esp, 8
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0x404095
push eax
call sub.msvcrt.dll_printf
add esp, 0x10
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0040101a
add esp, 8
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0x40409c
push eax
call sub.msvcrt.dll_printf
add esp, 0x10
mov eax, 0x14
push eax
call sub.msvcrt.dll__sleep
add esp, 4
call sub.msvcrt.dll__kbhit
test eax, eax
je 0x401528
mov eax, 0
push eax
call sub.msvcrt.dll_exit
add esp, 4
jmp 0x401453
mov eax, 0x4040a3
push eax
call sub.msvcrt.dll_system
add esp, 4
leave
ret

Function at 0x40153d
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
mov eax, str.color_0
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, 0
push eax
call sub.msvcrt.dll_time
add esp, 4
push eax
call sub.msvcrt.dll_srand
add esp, 4
mov eax, 0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0x320
jge 0x401623
jmp 0x401595
mov eax, dword [ebp - 4]
mov ecx, eax
add eax, 1
mov dword [ebp - 4], eax
jmp 0x401574
call sub.msvcrt.dll_rand
mov ecx, 0x6e
cdq
idiv ecx
mov dword [ebp - 8], edx
call sub.msvcrt.dll_rand
mov ecx, 0x28
cdq
idiv ecx
mov dword [ebp - 0xc], edx
call sub.msvcrt.dll_rand
mov ecx, 0xd
cdq
idiv ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040106f
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0040101a
add esp, 8
mov eax, 4
push eax
mov eax, 0x4040af
push eax
call sub.msvcrt.dll_printf
add esp, 8
call sub.msvcrt.dll__kbhit
test eax, eax
je 0x401610
mov eax, 0
push eax
call sub.msvcrt.dll_exit
add esp, 4
mov eax, 1
push eax
call sub.msvcrt.dll__sleep
add esp, 4
jmp 0x401588
mov eax, 0x4040b2
push eax
call sub.msvcrt.dll_system
add esp, 4
leave
ret
Function at 0x401b66
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
call fcn.00401278
mov eax, 0
push eax
call sub.msvcrt.dll_time
add esp, 4
push eax
call sub.msvcrt.dll_srand
add esp, 4
call sub.msvcrt.dll_rand
mov ecx, 0xd
cdq
idiv ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040106f
add esp, 4
mov eax, 0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0x190
jge 0x401d18
jmp 0x401bd1
mov eax, dword [ebp - 4]
mov ecx, eax
add eax, 1
mov dword [ebp - 4], eax
jmp 0x401bb0
call sub.msvcrt.dll_rand
mov ecx, 0x6e
cdq
idiv ecx
mov dword [ebp - 8], edx
call sub.msvcrt.dll_rand
mov ecx, 0x23
cdq
idiv ecx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0040101a
add esp, 8
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 0x404128
push eax
call sub.msvcrt.dll_printf
add esp, 0x18
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0040101a
add esp, 8
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 0x404133
push eax
call sub.msvcrt.dll_printf
add esp, 0x18
mov eax, dword [ebp - 0xc]
add eax, 2
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0040101a
add esp, 8
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 0x40413e
push eax
call sub.msvcrt.dll_printf
add esp, 0x18
mov eax, dword [ebp - 0xc]
add eax, 3
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0040101a
add esp, 8
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, 4
push eax
mov eax, str._c_c_c_c_c
push eax
call sub.msvcrt.dll_printf
add esp, 0x18
mov eax, 0x14
push eax
call sub.msvcrt.dll__sleep
add esp, 4
call sub.msvcrt.dll__kbhit
test eax, eax
je 0x401d13
mov eax, 0
push eax
call sub.msvcrt.dll_exit
add esp, 4
jmp 0x401bc4
mov eax, 0x404154
push eax
call sub.msvcrt.dll_system
add esp, 4
leave
ret
Function at 0x4023ae
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
call fcn.00401278
mov eax, 0
push eax
call sub.msvcrt.dll_time
add esp, 4
push eax
call sub.msvcrt.dll_srand
add esp, 4
mov eax, 0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0x320
jge 0x40266b
jmp 0x4023fd
mov eax, dword [ebp - 4]
mov ecx, eax
add eax, 1
mov dword [ebp - 4], eax
jmp 0x4023dc
call sub.msvcrt.dll_rand
mov ecx, 0x6e
cdq
idiv ecx
mov dword [ebp - 8], edx
call sub.msvcrt.dll_rand
mov ecx, 0x28
cdq
idiv ecx
mov dword [ebp - 0xc], edx
call sub.msvcrt.dll_rand
mov ecx, 0xd
cdq
idiv ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040106f
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0040101a
add esp, 8
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0x40428c
push eax
call sub.msvcrt.dll_printf
add esp, 0x1c
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0x404299
push eax
call sub.msvcrt.dll_printf
add esp, 0x1c
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0x4042a6
push eax
call sub.msvcrt.dll_printf
add esp, 0x1c
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0x4042b3
push eax
call sub.msvcrt.dll_printf
add esp, 0x1c
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0x4042c0
push eax
call sub.msvcrt.dll_printf
add esp, 0x1c
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0x4042cd
push eax
call sub.msvcrt.dll_printf
add esp, 0x1c
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0x4042da
push eax
call sub.msvcrt.dll_printf
add esp, 0x1c
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0x4042e7
push eax
call sub.msvcrt.dll_printf
add esp, 0x1c
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0x4042f4
push eax
call sub.msvcrt.dll_printf
add esp, 0x1c
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, 0xdb
push eax
mov eax, str._c_c_c_c_c_c
push eax
call sub.msvcrt.dll_printf
add esp, 0x1c
call sub.msvcrt.dll__kbhit
test eax, eax
je 0x402658
mov eax, 0
push eax
call sub.msvcrt.dll_exit
add esp, 4
mov eax, 1
push eax
call sub.msvcrt.dll__sleep
add esp, 4
jmp 0x4023f0
mov eax, 0x40430e
push eax
call sub.msvcrt.dll_system
add esp, 4
leave
ret
Function at 0x403043
Capabilities:
Execute command
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
nop
mov eax, 0x6d
mov byte [ebp - 0x32], al
mov eax, 0x6f
mov byte [ebp - 0x31], al
mov eax, 0x64
mov byte [ebp - 0x30], al
mov eax, 0x65
mov byte [ebp - 0x2f], al
mov eax, 0x20
mov byte [ebp - 0x2e], al
mov eax, 0
mov byte [ebp - 0x2d], al
mov eax, 0x2c
push eax
mov eax, 0
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, str.110_40
push eax
lea eax, [ebp - 0x32]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
lea eax, [ebp - 0x32]
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, str.Telas_em_C
push eax
call sub.kernel32.dll_SetConsoleTitleA
call fcn.00401411
call fcn.0040153d
call fcn.00401633
call fcn.004018a1
call fcn.00401a43
call fcn.00401b66
call fcn.00401d28
call fcn.004020f1
call fcn.004023ae
call fcn.0040267b
call fcn.00402796
call fcn.00402875
call fcn.00402924
call fcn.00402b5f
call fcn.00402c6e
call fcn.00402d4b
call sub.msvcrt.dll__kbhit
test eax, eax
je 0x4030be
leave
ret
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40345b
pop dword [ebp - 0x48]
mov eax, 0x552119b9
add eax, 0xab1f1aa2
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x5ead51b0
sub dword [ebp - 0x58], 0x105b0c65
mov dword [ebp - 0x54], 0xfd8ff94b
sub dword [ebp - 0x54], 0xcb5cad06
mov dword [ebp - 0x50], 0xb0c2037b
sub dword [ebp - 0x50], 0x6475bf4d
mov dword [ebp - 0x4c], 0xc4634f6
sub dword [ebp - 0x4c], 0xc4634f6
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x6c0b8d7c
sub dword [ebp - 0x58], 0xf7992426
mov dword [ebp - 0x54], 0xa034f1a1
sub dword [ebp - 0x54], 0x5ec8902c
mov dword [ebp - 0x50], 0x4d776f8a
sub dword [ebp - 0x50], 0xea08031e
mov dword [ebp - 0x4c], 0xf1621bca
sub dword [ebp - 0x4c], 0xf1621bca
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x34d9b
push 0
call eax
mov ecx, 0x3ff1
xor ebx, ebx
add ebx, eax
mov edi, 0x5ef95121
sub edi, 0x5eb8cd21
add edi, dword [ebp - 0x48]
mov edx, 0x549f6b99
sub edx, 0x6c5ab210
mov esi, dword [edi]
xor dword [ebp - 0x10], edx
xor esi, edx
xor dword [ebp - 0x1c], 0xabf95105
mov dword [ebx], esi
add ebx, 0x3be74fbe
add ebx, 0xc418b046
add edi, 0x5038b6e7
add edi, 0xafc7491d
loop 0x40356f
add eax, 0xb43d2614
add eax, 0x4bc3cc83
mov ebx, eax
add eax, 0xb36ef052
add eax, 0x4c910fb3
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret