joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54ca32
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x120]
mov edi, dword [ebp + 8]
test al, al
jne 0x54ca6b
mov eax, dword [edi]
sub eax, 9
cmp eax, 0xc
ja 0x54ca6b
mov ecx, dword [esi + 0x568]
push edi
test ecx, ecx
je 0x54cb3e
mov eax, dword [ecx]
call dword [eax + 0x18]
jmp 0x54cb45
mov ecx, dword [esi + 0x568]
test ecx, ecx
je 0x54cace
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [eax + 0x458], 0
je 0x54cace
cmp dword [edi], 0xf
jne 0x54cace
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x118]
test al, al
je 0x54cb45
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
lea esi, [esi + 0x558]
mov edi, dword [esi]
and ax, cx
mov ecx, esi
je 0x54cac7
call dword [edi + 0x10]
neg al
mov ecx, esi
sbb al, al
inc al
push eax
call dword [edi + 0x18]
jmp 0x54cb45
push 1
call dword [edi + 0x14]
jmp 0x54cb45
cmp dword [edi], 0xd
je 0x54ca88
cmp dword [edi], 0xe
jne 0x54cafb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x118]
test al, al
je 0x54cb45
mov ecx, dword [esi + 0x44]
xor eax, eax
push eax
push eax
push eax
push str.itemclick
push esi
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
jmp 0x54cb45
cmp dword [edi], 9
je 0x54cb45
cmp dword [edi], 0xb
jne 0x54cb23
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x118]
test al, al
je 0x54cb45
or dword [esi + 0x564], 8
mov ecx, esi
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CListContainerElementUI::Invalidate_void_
jmp 0x54cb45
cmp dword [edi], 0xa
jne 0x54cb3d
mov eax, dword [esi + 0x564]
test al, 8
je 0x54cb45
and eax, 0xfffffff7
mov dword [esi + 0x564], eax
jmp 0x54cb1a
push edi
mov ecx, esi
call sym.360huabao.exe_public_virtual:_void___thiscall_DuiLib::CListElementUI::DoEvent_struct_DuiLib::tagTEventUI__
pop edi
pop esi
pop ebp
ret 4
Function at 0x55ac78
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x6c4], edi
je 0x55ace2
cmp dword [ebp + 8], 0x100
jne 0x55acd1
cmp word [ebp + 0xc], 0xd
jne 0x55acd1
cmp byte [esi + 0x6ca], 0
je 0x55acb8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x55acd1
cmp byte [esi + 0x6cb], 0
jne 0x55acd1
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x55accd
push edi
push edi
push edi
push str.return
push esi
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
jmp 0x55ace5
mov eax, dword [esi + 0x6c4]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x55fcff
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.360huabao.exe_public_virtual:_void___thiscall_DuiLib::CListUI::DoEvent_struct_DuiLib::tagTEventUI__
Function at 0x573686
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x6c45ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x573710
cmp dword [esi + 0x10], 0
je 0x573710
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00591f80
mov ebx, esp
test ebx, ebx
je 0x573710
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1d4
call fcn.00537018
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x1c]
xor ecx, ecx
push ecx
push ecx
push ecx
push str.textchanged
push dword [esi + 0x10]
mov ecx, eax
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call sym.360huabao.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::IsLayered_void_
test al, al
je 0x573710
mov ecx, dword [esi + 0x10]
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CControlUI::Invalidate_void_
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00590be8
leave
ret 0x10
Function at 0x578135
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x6c45ac]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x294]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x5781d3
push esi
mov esi, 0xff
push esi
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.005a88e0
add esp, 0xc
lea eax, [ebp - 0x104]
push esi
push eax
call sub.WS2_32.dll_gethostname
lea eax, [ebp - 0x104]
push eax
call sub.WS2_32.dll_gethostbyname
pop esi
test eax, eax
je 0x5781d3
mov eax, dword [eax + 0xc]
push 4
push dword [eax]
lea eax, [ebp - 0x298]
push eax
call fcn.005a8a40
mov ecx, dword [ebp - 0x298]
add esp, 0xc
movzx eax, cl
shl eax, 8
movzx ecx, ch
add eax, ecx
movzx ecx, byte [ebp - 0x296]
shl eax, 8
add eax, ecx
movzx ecx, byte [ebp - 0x295]
shl eax, 8
add eax, ecx
jmp 0x5781d5
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00590be8
leave
ret

Function at 0x5798ca
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6c45ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov dword [ebp - 0x210], ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, dword [ebp + 0xc]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov edi, eax
cmp esi, 0x21
jb 0x579918
cmp esi, 0x28
jbe 0x579912
lea eax, [esi - 0x2d]
cmp eax, 1
ja 0x579918
or edi, 0x100
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005a88e0
add esp, 0xc
shl edi, 0x10
lea eax, [ebp - 0x20c]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00590be8
leave
ret
Function at 0x579bef
Capabilities:
Hide graphical window

Disassembly:
push 0x9c
mov eax, 0x5f11ba
call fcn.00592017
mov esi, ecx
mov dword [ebp - 0x98], esi
mov eax, dword [ebp + 8]
mov dword [esi + 0x10], eax
test eax, eax
je 0x579d0c
lea eax, [ebp - 0xa8]
push eax
call sym.360huabao.exe_public:_struct_tagRECT___thiscall_DuiLib::CHotKeyWnd::CalPos_void_
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call sym.360huabao.exe_public:_struct_HWND______thiscall_DuiLib::CPaintManagerUI::GetPaintWindow_void_const
xor ecx, ecx
lea esi, [ebp - 0xa8]
push ecx
sub esp, 0x10
mov edi, esp
push ecx
movsd dword es:[edi], dword [esi]
push 0x40000080
push ecx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x98]
mov ecx, edi
call sym.360huabao.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__struct_tagRECT__struct_HMENU____
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x579d0c
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, dword [edi + 0x10]
mov esi, eax
call sym.360huabao.exe_public:_int___thiscall_DuiLib::CLabelUI::GetFont_void_const
push eax
mov ecx, esi
call sym.360huabao.exe_public:_struct_DuiLib::tagTFontInfo____thiscall_DuiLib::CPaintManagerUI::GetFontInfo_int_
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
movzx eax, word [ecx + 0x7ae]
push eax
movzx eax, word [ecx + 0x7ac]
mov ecx, edi
push eax
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CHotKeyWnd::SetHotKey_unsigned_short_int__unsigned_short_int_
lea eax, [ebp - 0x94]
mov ecx, edi
push eax
call sym.360huabao.exe_public:_class_DuiLib::CDuiString___thiscall_DuiLib::CHotKeyWnd::GetHotKeyName_void_
mov ecx, dword [edi + 0x10]
and dword [ebp - 4], 0
add ecx, 0x1d4
push eax
call fcn.00536f8a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CDuiString::destructor_void_
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x118]
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
call fcn.00591fc1
ret 4
Function at 0x588884
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x5888b2
cmp eax, edi
jge 0x5888a6
push esi
call fcn.0058425a
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x5888d5
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x5888bb
mov dword [esi + 8], edx
jmp 0x5888ea
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x5888e0
xor dl, dl
jmp 0x5888e5
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x5888d5
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x588924
push str.zlib_corrupt
call fcn.00584185
add esp, 4
jmp 0x588964
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x588934
push str.read_past_buffer
jmp 0x58891a
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x58894e
push edi
push ecx
push esi
call fcn.0058b405
add esp, 0xc
test eax, eax
je 0x588964
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.005a8a40
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x59354d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x5cc709
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005cc588

Function at 0x5d161f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005d12df
Function at 0x404ac8
Capabilities:
Encode data using xor

Disassembly:
xor byte [eax + 0x50e8843a], 0xe8
jg 0x404b27
mov esi, ecx
inc esi
pop esp
push es
in al, dx
add eax, 0xe80b5000
push ss
pop edi
push es
add byte [eax + 0x4d], dl
call 0x9904aec
call fcn.0046a909
push dword [ebp - 0x14]
push eax
mov ebx, dword [ebx - 0x13]
dec ebp
invalid
add byte [eax - 0x177bc550], al
push eax
call 0xf1cba152
inc esi
pop esp
push es
in al, dx
add eax, 0xe80c5000
mov dh, 0x5e
push es
add byte [eax + 0x4d], dl
call 0x9904b4c
call fcn.0046a909
push dword [ebp - 0x14]
push eax
mov ebx, dword [ebx - 0x13]
dec ebp
invalid
Function at 0x448799
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4813ec
call fcn.0045bad4
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov eax, dword [0x4a746c]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 8], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0xc], eax
mov eax, dword [0x4a746c]
lea ebx, [esi + 0x10]
mov dword [ebx], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x14], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x18], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x2c], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x30], eax
mov eax, dword [0x4a746c]
lea ecx, [esi + 0x3c]
mov dword [ecx], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x44], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x54], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x58], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x5c], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x60], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x64], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x68], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x70], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x74], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x7c], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x80], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x84], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0x88], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0xa0], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0xa4], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0xa8], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0xac], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0xb4], eax
mov eax, dword [0x4a746c]
mov dword [esi + 0xbc], eax
push str.__s___s
mov byte [ebp - 4], 0x1b
mov dword [esi], 0x4875a0
mov dword [esi + 4], edi
call fcn.0046aa46
push str.TLB_ERR_FORMAT
lea ecx, [esi + 0x14]
call fcn.0046aa46
push 0x4a2490
mov ecx, ebx
call fcn.0046aa46
mov ecx, dword [ebp - 0xc]
push 1
pop eax
mov dword [esi + 0x8c], edi
mov dword [esi + 0x50], eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], edi
mov dword [esi + 0x48], 0x15
mov dword [esi + 0x4c], 5
mov dword [esi + 0x78], 2
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x448956
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x481544
call fcn.0045bad4
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4875a0
lea ecx, [esi + 0xbc]
mov dword [ebp - 4], 0x1a
call fcn.0046a909
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 0x19
call fcn.0046a909
lea ecx, [esi + 0xac]
mov byte [ebp - 4], 0x18
call fcn.0046a909
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 0x17
call fcn.0046a909
lea ecx, [esi + 0xa4]
mov byte [ebp - 4], 0x16
call fcn.0046a909
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 0x15
call fcn.0046a909
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 0x14
call fcn.0046a909
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 0x13
call fcn.0046a909
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 0x12
call fcn.0046a909
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 0x11
call fcn.0046a909
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 0x10
call fcn.0046a909
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 0xf
call fcn.0046a909
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 0xe
call fcn.0046a909
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 0xd
call fcn.0046a909
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 0xc
call fcn.0046a909
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 0xb
call fcn.0046a909
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x58]
call fcn.0046a909
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 9
call fcn.0046a909
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 8
call fcn.0046a909
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 7
call fcn.0046a909
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 6
call fcn.0046a909
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 5
call fcn.0046a909
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 4
call fcn.0046a909
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 3
call fcn.0046a909
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 2
call fcn.0046a909
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call fcn.0046a909
and byte [ebp - 4], 0
lea ecx, [esi + 8]
call fcn.0046a909
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44fc00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [eax]
mov esi, dword [ecx]
mov edx, esi
dec esi
test edx, edx
je 0x44fc3a
mov edx, dword [esp + 8]
xor ecx, ecx
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4a4ee8]
xor ecx, eax
mov eax, ecx
mov ecx, esi
dec esi
test ecx, ecx
jne 0x44fc18
pop esi
ret
Function at 0x452890
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x4ab510]
push ebx
push esi
push edi
push eax
call dword [0x484318]
mov ebx, eax
test ebx, ebx
jne 0x4528ac
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
lea ecx, [ebx + 0xc88]
push ebp
push ecx
call fcn.00458c60
mov ebp, dword [esp + 0x18]
add esp, 4
xor edi, edi
call fcn.00458bb0
xor edx, edx
mov esi, eax
mov dl, byte [edi + ebp]
xor esi, edx
push esi
call fcn.00458be0
add esp, 4
inc edi
cmp edi, 0xc
jl 0x4528c2
mov al, byte [ebx + 0xafc]
pop ebp
test al, 8
je 0x4528f8
xor eax, eax
mov ax, word [ebx + 0xb00]
shr eax, 8
jmp 0x45290d
mov eax, dword [ebx + 0xc4a]
xor ecx, ecx
shr eax, 0x10
mov cl, ah
and ecx, 0xff
mov eax, ecx
and esi, 0xffff
cmp esi, eax
je 0x45291e
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [ebx + 0x8cea]
mov ecx, dword [ebx + 0xab2]
cmp eax, ecx
jbe 0x452930
mov eax, ecx
mov esi, dword [ebx + 0x8ce6]
mov edx, eax
dec eax
test edx, edx
je 0x45295c
lea edi, [eax + 1]
call fcn.00458bb0
mov ebx, eax
xor eax, eax
mov al, byte [esi]
xor ebx, eax
push ebx
call fcn.00458be0
add esp, 4
mov byte [esi], bl
inc esi
dec edi
jne 0x452940
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x458be0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x4ab510]
push eax
call dword [0x484318]
test eax, eax
je 0x458c58
mov edx, dword [eax + 0xcca]
push esi
mov esi, dword [esp + 8]
mov ecx, edx
xor ecx, esi
and ecx, 0xff
shr edx, 8
mov ecx, dword [ecx*4 + 0x4a539c]
xor ecx, edx
mov edx, dword [eax + 0xcce]
mov dword [eax + 0xcca], ecx
and ecx, 0xff
add ecx, edx
mov edx, dword [eax + 0xcd2]
imul ecx, ecx, 0x8088405
inc ecx
mov esi, edx
mov dword [eax + 0xcce], ecx
and esi, 0xff
shr ecx, 0x18
xor ecx, esi
pop esi
shr edx, 8
mov ecx, dword [ecx*4 + 0x4a539c]
xor ecx, edx
mov dword [eax + 0xcd2], ecx
ret
Function at 0x405e3d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422ac4], 0
push esi
jne 0x405e74
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405e4e
mov dword [ecx*4 + 0x422ac0], eax
inc ecx
cmp ecx, 0x100
jl 0x405e49
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405ea5
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422ac0]
xor eax, esi
inc ecx
dec edx
jne 0x405e87
pop edi
not eax
pop esi
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x401130
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push edi
push str.MyCMD.dll
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x401199
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MyCreatePipe
push edi
call ebx
push str.MySetHandleInformation
push edi
mov dword [esi + 0x20], eax
call ebx
push str.MyCreateProcess
push edi
mov dword [esi + 0x24], eax
call ebx
push str.MyCreateProcessW
push edi
mov dword [esi + 0x28], eax
call ebx
push str.MyWaitForSingleObject
push edi
mov dword [esi + 0x2c], eax
call ebx
mov dword [esi + 0x30], eax
xor ebx, ebx
mov ecx, dword [esi + 0x20]
mov dword [esi], ebx
lea ebx, [esi + 4]
lea edi, [esi + 8]
lea eax, [esi + 0xc]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [eax], 0
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
test ecx, ecx
je 0x401228
push 0
lea edx, [ebp - 0xc]
push edx
push eax
push edi
call ecx
add esp, 0x10
test eax, eax
je 0x401228
mov eax, dword [esi + 0x24]
test eax, eax
je 0x401228
mov ecx, dword [edi]
push 0
push 1
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x401228
mov eax, dword [esi + 0x20]
push 0
lea edx, [ebp - 0xc]
push edx
push ebx
push esi
call eax
add esp, 0x10
test eax, eax
je 0x401228
mov ecx, dword [ebx]
mov edx, dword [esi + 0x24]
push 0
push 1
push ecx
call edx
add esp, 0xc
test eax, eax
je 0x401228
mov ecx, esi
call fcn.00401260
pop edi
mov eax, esi
pop ebx
mov esp, ebp
pop ebp
ret