joyce8/EMBER2024-capa huggingface dataset:
Function at 0x253af8f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor dword [esp + ecx + 4], ecx
dec dx
mov dword [esp + ecx], 0xf90d0203
not dx
and al, byte [esp + ecx*8 + 7]
or ax, word [esp + eax + 6]
adc dx, 0x298b
xor dx, 0x19b5
xor bx, dx
not al
lea edi, [edi + ecx*2 - 4]
or word [esp + eax*4 - 0x3c3f0], ax
xadd dword [esp + ecx + 4], ecx
bswap ecx
mov dword [eax + edi - 0xf0fd], edx
lea esi, [eax + esi - 0xf101]
mov ecx, dword [esi + eax*4 - 0x3c3f4]
xor ecx, ebx
bts eax, 0x8a
sub eax, eax
inc ecx
ror ecx, 3
neg dword [esp + eax*2 + 2]
movzx edx, word [esp + eax + 4]
adc ecx, eax
bswap ecx
and ax, dx
xor ebx, ecx
sar ax, 0x21
adc ebp, ecx
neg dword [esp + eax]
rol edx, 0x48
mul dword [esp + eax*8 + 4]
pop eax
pop edx
jno fcn.01bc557c

Function at 0x253f56c
Capabilities:
Execute syscall

Disassembly:
push 0xbd853d1e
lea esp, [esp + 8]
jne 0x1a37e0b
mov dword [esp], 0x4e186b83
and byte [esp + 1], 0x25
dec ebx
jmp 0x1921d64

Function at 0x254053a
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], edx
push edx
rol ax, 1
inc ax
call fcn.01a091b5

Function at 0x2546f93
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x91142b20
cbw
mov ecx, dword [esi]
xor ecx, ebx
mov dword [esp], eax
push eax
inc ecx
mov dword [esp + 8], 0x742fa20b
rol dword [esp], 0xab
or eax, eax
ror ecx, 3
movsx edx, ax
not byte [esp + edx - 0x19]
inc ecx
sub al, ah
bswap ecx
div dword [esp + edx - 0x19]
lea eax, [edx + edx*8 + 0x309bc828]
xor ebx, ecx
pop edx
push eax
sal eax, 0x7e
add ebp, ecx
bt edx, 0xab
neg dl
sbb esi, 1
mul edx
add ax, word [esi + eax*4]
not dx
movsx ecx, word [esp + edx - 0x50007dbe]
xor ax, bx
push ecx
neg ax
pop edx
ror dx, 0x83
imul cx, word [esp + edx*2 - 0x4f8]
adc ax, 0x77b5
shr dword [esp + edx*4 - 0x9f8], 0xa1
xor ax, 0x27a4
sal cx, 9
add edx, edx
rol ax, 1
bt cx, cx
or ecx, 0x468db83c
inc edx
dec ax
not ax
call fcn.01a99845
shr dword [ecx], 0x75
dec ebx
inc edx
mov esi, 0x50ac32d0
jnp 0x2546fd6
jmp 0xae3729ea
xchg esp, edi
sbb bl, byte [eax]
in eax, 0x79
dec edx
out dx, al
lds ecx, [ebp + 0x33139949]
nop
and byte [ecx], bl
mov byte [0xd1049006], al
cmp cl, 0x7f
movsb byte es:[edi], byte [esi]
add dword [edi + 0x6b], 0x641936ed
push 0x8bc3abbd
test eax, 0x3fd68a91
mov ecx, 0x7270d112
mov byte [0xaf5e9f30], al
xlatb
ljmp 0xd4ad

Function at 0x2550552
Capabilities:
Hash data using murmur3

Disassembly:
bswap ecx
sub eax, 0xc3983c13
not eax
pop eax
adc ecx, edx
rol edx, 0x6e
rol ecx, 1
mov eax, dword [esp + 4]
inc dl
xor ebx, ecx
cdq
btr dx, 0x9b
call fcn.01d59d1b
Function at 0x409322
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00408442
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00408474
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00408429
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00408464
lodsd eax, dword [esi]
fisubr dword [edx + 0x10468]
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid

Function at 0x409cdf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x7425b], al
inc dword [eax]
mov byte [ebp - 0x742], 2
and byte [ebp - 0x741], 0
mov byte [ebp - 0x740], 0xb1
mov byte [ebp - 0x73f], 0x92
mov byte [ebp - 0x73e], 0x9c
mov byte [ebp - 0x73d], 0x99
mov byte [ebp - 0x73c], 0xb1
mov byte [ebp - 0x73b], 0x94
mov byte [ebp - 0x73a], 0x9f
mov byte [ebp - 0x739], 0x8f
mov byte [ebp - 0x738], 0x9c
mov byte [ebp - 0x737], 0x8f
mov byte [ebp - 0x736], 0x84
mov byte [ebp - 0x735], 0xbc
mov byte [ebp - 0x734], 0xfd
lea eax, [ebp - 0x744]
push eax
call fcn.00408474
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00408429
add esp, 0xc
mov dword [ebp - 0x704], eax
and byte [ebp - 0x6f4], 0
and byte [ebp - 0x6f3], 0
mov byte [ebp - 0x6f2], 0x43
and byte [ebp - 0x6f1], 0
mov byte [ebp - 0x6f0], 0xeb
mov byte [ebp - 0x6ef], 0xce
mov byte [ebp - 0x6ee], 0xd5
mov byte [ebp - 0x6ed], 0xc8
mov byte [ebp - 0x6ec], 0xd9
mov byte [ebp - 0x6eb], 0xfa
mov byte [ebp - 0x6ea], 0xd5
mov byte [ebp - 0x6e9], 0xd0
mov byte [ebp - 0x6e8], 0xd9
mov byte [ebp - 0x6e7], 0xbc
call fcn.00408464
invalid
Function at 0x42330d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
or dword [edi + 0x3c], 0xffffffff
lea eax, [edi + 0x1c]
push eax
call fcn.00402c72
mov esi, eax
test esi, esi
jns 0x423339
push str.Failed_to_copy_file_name.
jmp 0x423425
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x24], eax
test eax, eax
jne 0x423385
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x423364
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x42336b
mov esi, 0x80004005
push esi
push 0x8c
push str.c:_agent_work36_swix_src_burnenginecabextract.cpp
call fcn.004013b3
push str.Failed_to_create_begin_operation_event.
jmp 0x423425
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x28], eax
test eax, eax
jne 0x4233c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4233aa
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4233b1
mov esi, 0x80004005
push esi
push 0x8f
push str.c:_agent_work36_swix_src_burnenginecabextract.cpp
call fcn.004013b3
push str.Failed_to_create_operation_complete_event.
jmp 0x423425
push ebx
push ebx
push edi
push 0x422cca
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x20], eax
test eax, eax
jne 0x423414
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4233f6
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4233fd
mov esi, 0x80004005
push esi
push 0x93
push str.c:_agent_work36_swix_src_burnenginecabextract.cpp
call fcn.004013b3
push str.Failed_to_create_extraction_thread.
jmp 0x423425
push edi
call fcn.004230b0
mov esi, eax
test esi, esi
jns 0x42342d
push str.Failed_to_wait_for_operation_complete.
push esi
call fcn.004453e7
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42877b
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x46e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push 7
pop ecx
lea edi, [ebp - 0x20]
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4287e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4287c4
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4287cb
mov esi, 0x80004005
push esi
push 0x1fc
push str.c:_agent_work36_swix_src_burnenginemsuengine.cpp
call fcn.004013b3
push str.Failed_to_stop_wusa_service.
push esi
call fcn.004453e7
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00430093
leave
ret 4
Function at 0x100015e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
je 0x100015ef
xor eax, eax
pop ebp
ret 0xc
push 0
push 0
push 0
push 0x10001500
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x10002150
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10006040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
xor ebx, ebx
push ebx
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x100022cc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10002267
mov ebx, 1
cmp dword [ebp - 0x20], 0x10
jb 0x1000222a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1000222a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1000222a
mov edx, dword [esi]
test edx, edx
jne 0x100021f6
push 0x200
push edx
push dword [0x100066a4]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1000224f
jmp 0x1000221e
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1000221e
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x100066a4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1000224f
mov dword [esi], edx
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100021b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x10002267
mov eax, dword [esi]
xor ebx, ebx
test eax, eax
je 0x10002267
push eax
push ebx
push dword [0x100066a4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x100022cc
cmp dword [esi], 0
je 0x100022b9
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x100022b9
nop
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100022b3
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.10001fe0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10002280
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002b7d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 9
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002b7d
mov esp, ebp
pop ebp
ret
Function at 0x100022f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10006040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x100066b0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebx, [eax*2 + 5]
lea eax, [ebp - 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000234c
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002b7d
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10002367
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002b7d
mov esp, ebp
pop ebp
ret

Function at 0x100023a0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x100066b8]
sub esp, 0x10
push esi
xor esi, esi
test ecx, ecx
je 0x100023cd
mov eax, dword [0x100066b0]
add eax, 0x14
nop dword [eax + eax]
test byte [eax], 2
je 0x100023d4
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x100023c0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x100023cd
push ebx
push 1
or edx, 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10002150
mov ebx, eax
mov dword [ebp - 4], eax
add esp, 4
test ebx, ebx
jne 0x1000248f
mov ecx, dword [0x100066b8]
push edi
cmp esi, ecx
jae 0x1000243a
imul edi, esi, 0x2c
nop word [eax + eax]
mov eax, dword [0x100066b0]
test byte [edi + eax + 0x14], 2
jne 0x1000242f
mov ecx, esi
call fcn.100022f0
mov ebx, eax
test ebx, ebx
jne 0x10002437
mov ecx, dword [0x100066b8]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10002410
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1000248c
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x1000247d
mov ebx, eax
nop word [eax + eax]
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10002471
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10002450
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x100066a4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002f52
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x10002f87
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x10002f84
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x10002f90
add edx, 0x28
cmp edx, esi
jne 0x10002f72
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x10002f8d

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x50ac60ed
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x27060f7
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x10001016
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push esi
push edi
push 0x10003010
push 0x65
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10001061
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
jne 0x10001065
xor eax, eax
jmp 0x100010a7
push ebx
mov ebx, dword [esi]
push 0
push 4
push 2
push 0
push 2
push 0x40000000
push 0x10003038
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100010a3
lea eax, [esp + 0xc]
push 0
push eax
add esi, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop ebx
pop edi
pop esi
pop ecx
ret

Function at 0x100010ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
xor edx, edx
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], edx
push 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
push edx
push edx
push 0x8000000
push edx
push edx
push edx
push 0x10003038
push edx
mov word [ebp - 0x24], dx
mov dword [ebp - 0x28], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x10001110
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x10]
call esi
pop esi
xor eax, eax
leave
ret
Function at 0x402bf0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x530008], 0x8088405
inc edx
mov dword [ebx + 0x530008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x404464
Capabilities:
Packed with generic packer

Disassembly:
test edx, edx
je 0x4044c9
test ecx, ecx
je fcn.0040419c
cmp edx, dword [eax]
je 0x4044d0
cmp ecx, dword [eax]
je 0x404486
push eax
push ecx
call fcn.0040419c
pop edx
pop eax
jmp fcn.00404420
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
push eax
mov eax, dword [ebx - 4]
add eax, dword [esi - 4]
call fcn.0040420c
mov edi, eax
mov edx, eax
mov eax, ebx
mov ecx, dword [ebx - 4]
call fcn.0040293c
mov edx, edi
mov eax, esi
mov ecx, dword [esi - 4]
add edx, dword [ebx - 4]
call fcn.0040293c
pop eax
mov edx, edi
test edi, edi
je 0x4044c0
dec dword [edi - 8]
call fcn.0040419c
pop edi
pop esi
pop ebx
ret
mov edx, ecx
jmp fcn.0040419c
mov edx, ecx
jmp fcn.00404420

Function at 0x42f7c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42f7f1
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x42f7e2
and ecx, 3
je 0x42f809
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x42f7f6
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x42f814
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x42f84d
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x42f835
pop esi
and esi, 3
je 0x42f872
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x42f853
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x42f87c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42f8a8
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x42f899
and ecx, 3
je 0x42f8c0
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x42f8ad
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x42f8c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0x42f8d4
pop edi
pop ebx
ret

Function at 0x4301f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov esi, eax
mov eax, esi
shr eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.0042fe48
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x45032f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
dec edi
test edi, edi
jl 0x43029e
inc edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.0040293c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042f8c8
lea eax, [ebx + esi]
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
call fcn.0040293c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042f8c8
lea eax, [ebx + esi]
mov ebx, eax
dec edi
jne 0x43024b
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
cmp esi, edi
jg 0x4302ec
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.0040293c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042f8c8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov ecx, esi
call fcn.0040293c
lea eax, [ebx + esi]
mov ebx, eax
sub edi, esi
test edi, edi
jle 0x430316
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec edi
test edi, edi
jl 0x430316
inc edi
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dl, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec edi
jne 0x430306
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450336
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0042ffe4
ret