joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52c65c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
je 0x52c66e
test edi, edi
jne 0x52c682
mov ecx, 0x3e3
mov edx, 0x52c6e0
mov eax, 0x52c790
call fcn.0040a694
push 0x40
push 0x1000
push 0x20
push 0
call sub.kernel32.dll_VirtualAlloc
mov ebp, eax
mov eax, dword [ebx]
xor ecx, ecx
mov edx, esi
call fcn.0052c7b4
mov esi, eax
mov eax, dword [ebx]
xor ecx, ecx
mov edx, edi
call fcn.0052c7b4
mov edi, eax
push edi
mov ecx, ebp
mov edx, esi
mov eax, ebx
call fcn.0052c8e0
test al, al
jne 0x52c6cd
push 0x8000
push 0x20
push ebp
call sub.kernel32.dll_VirtualFree
xor ebp, ebp
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x78f2c8
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x78f3be
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0xc], 1
push 0
push 5
call fcn.004f1814
push 0
push 3
call fcn.004f1814
mov eax, dword [ebx + 0x1c]
call fcn.004089b8
mov eax, dword [ebx + 0x18]
call fcn.004089b8
mov eax, dword [ebx + 8]
call fcn.004089b8
mov eax, dword [ebx + 0x10]
call fcn.004089b8
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.004074f8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00423d70
mov eax, dword [ebp - 8]
call fcn.0040b698
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x78f3a3
inc eax
mov dword [ebp - 4], eax
xor esi, esi
lea ecx, [ebp - 0x10]
mov eax, dword [ebx + 0x88]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
mov dl, 1
call fcn.00423b9c
test al, al
je 0x78f39d
lea ecx, [ebp - 0x18]
mov eax, dword [ebx + 0x88]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.0040b698
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.0040b6fc
mov eax, dword [ebp - 0x14]
call fcn.00423d14
inc esi
dec dword [ebp - 4]
jne 0x78f355
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78f3c5
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.0040a8a8
ret
Function at 0x78f778
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x78f935
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 1
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.0040b698
push eax
call fcn.004f17b0
mov esi, eax
cmp esi, 0xffffffff
je 0x78f91a
mov ecx, esi
mov dl, 1
mov eax, dword [0x48fb54]
call fcn.004b3dc0
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x48cd04]
call fcn.004b1e7c
mov ebx, eax
call sub.kernel32.dll_GetCurrentThreadId
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.004231b8
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [0x7c6cb0]
mov edx, dword [eax + 0x4c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [0x7c6cb0]
mov edx, dword [eax + 0x44]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x78f954
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x7c6cb0]
mov eax, dword [eax + 0x5c]
xor ecx, ecx
mov edx, 0x78f96c
mov edi, dword [eax]
call dword [edi + 0x164]
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov eax, dword [0x7c6cb0]
call fcn.0078c5ac
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea edx, [ebp - 0x18]
mov eax, dword [0x7c6cb0]
movzx eax, byte [eax + 0x90]
call fcn.00423190
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [0x7c6cb0]
mov edx, dword [eax + 0x74]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x78f980
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x7c6cb0]
mov eax, dword [eax + 0x5c]
xor ecx, ecx
mov edx, 0x78f990
mov edi, dword [eax]
call dword [edi + 0x164]
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x20]
push eax
mov eax, dword [0x7c6cb0]
mov eax, dword [eax + 0x5c]
xor ecx, ecx
mov edx, 0x78f9a4
mov edi, dword [eax]
call dword [edi + 0x164]
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
call fcn.00430628
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x8c]
mov eax, ebx
call fcn.004089b8
mov eax, dword [ebp - 8]
call fcn.004089b8
push esi
call sub.kernel32.dll_CloseHandle
push 2
mov eax, dword [ebp - 4]
call fcn.0040b698
push eax
call sub.kernel32.dll_SetFileAttributesW
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78f93c
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.0040a8a8
ret
Function at 0x78f9ac
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040a92c
xor eax, eax
push ebp
push 0x78fcbe
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 1
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0078f6f0
push dword [ebp - 0x70]
push 0x78fce0
push esi
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040b988
cmp dword [ebp - 4], 0
jne 0x78fa31
lea edx, [ebp - 0x74]
mov eax, ebx
call fcn.00423d70
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 4]
call fcn.0042a77c
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.00407eb8
mov dword [ebp - 0x5c], 0x44
movzx eax, word [ebp + 0xc]
mov word [ebp - 0x2c], ax
mov eax, 0x78fce4
mov dword [ebp - 0x50], eax
cmp dword [ebp - 4], 0
je 0x78fa69
mov eax, dword [ebp - 4]
call fcn.0040b698
mov ebx, eax
jmp 0x78fa6b
xor ebx, ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push 0
push 4
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040b698
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x78faa5
mov byte [ebp - 0x11], 0
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp + 8]
mov dword [edx], eax
jmp 0x78fc86
lea esi, [ebp - 0x6c]
mov edi, 0x7c6cec
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x64]
push eax
call fcn.004f1858
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x78fad3
mov eax, dword [ebp - 0x6c]
push eax
call fcn.004f182c
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x78faed
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 0x11], 0
xor eax, eax
push ebp
push 0x78fb3a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0040a848
mov eax, dword [0x7c6cb0]
mov ebx, dword [eax + 0x44]
lea edx, [ebp - 0x10]
mov dword [ebp - 0x78], ebx
mov eax, dword [ebp - 0x78]
call fcn.0042a734
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.0040ac70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78fb41
lea eax, [ebp - 0x10]
call fcn.0040a848
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78fcc5
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.0040a8a8
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.0040a8a8
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040a8a8
ret
Function at 0x2580f072
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x2580f081
pop dword [ebp - 0x30]
mov eax, 0x96b64de6
add eax, 0x8ecaa29b
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x95c9a9fd
sub dword [ebp - 0x40], 0x477764b2
mov dword [ebp - 0x3c], 0x78c00fc2
add dword [ebp - 0x3c], 0xb9733c83
mov dword [ebp - 0x38], 0xf1529a9e
sub dword [ebp - 0x38], 0xa5065670
mov dword [ebp - 0x34], 0xbe32199a
add dword [ebp - 0x34], 0x41cde666
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xb289b327
sub dword [ebp - 0x40], 0x3e1749d1
mov dword [ebp - 0x3c], 0x1ecdc0ef
sub dword [ebp - 0x3c], 0xdd615f7a
mov dword [ebp - 0x38], 0xdfff754f
add dword [ebp - 0x38], 0x836ff71d
mov dword [ebp - 0x34], 0x8fa3a36b
sub dword [ebp - 0x34], 0x8fa3a36b
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xc8b2cf61
add eax, 0x5ccf011f
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x42173
push 0
call eax
mov ecx, 0xb7a67142
sub ecx, 0xb7a61300
mov edi, eax
mov esi, 0x25829600
add esi, dword [ebp - 0x30]
mov ebx, 0x4c8317bd
add dword [ebp - 0x14], 0xa1dbd324
mov edx, dword [esi]
sub dword [ebp - 0x28], 0xe5169f4b
xor edx, ebx
xor dword [ebp - 0x2c], edi
mov dword [edi], edx
add edi, 4
add esi, 4
loop 0x2580f192
add eax, 0x9493cbcc
add eax, 0x6b6da00f
mov ebx, eax
add eax, 5
mov ecx, 0xda853ca2
add ecx, 0x4afac35e
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10011140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10043a41
call fcn.1001f59e
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x100111a1
call fcn.1000e50a
mov esi, eax
jmp 0x10011279
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x100111bf
call fcn.1000e50a
jmp 0x10011270
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x100111b5
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x100111f2
mov esi, 0x8007000e
jmp 0x10011272
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10038e9d
mov dword [ebp - 4], 1
jmp 0x10011226
cmp dword [ebp - 0x418], 0
je 0x100111e8
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x100111b5
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.10038e9d
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10011292
lea ecx, [ebp - 0x418]
call fcn.10011348
mov eax, esi
call fcn.1001f5f7
ret 0x10
Function at 0x1001f1ed
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x100463b8
call fcn.10021546
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x1001f27b
call fcn.10021514
test eax, eax
jne 0x1001f211
xor eax, eax
jmp 0x1001f347
call fcn.10020948
test eax, eax
jne 0x1001f221
call fcn.10021532
jmp 0x1001f20a
call fcn.100214c8
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x10193274], eax
call fcn.10038e9d
mov dword [0x101913dc], eax
call fcn.10038e9d
test eax, eax
jns 0x1001f24b
call fcn.10020621
jmp 0x1001f21a
call fcn.10038e9d
test eax, eax
js 0x1001f274
call fcn.10021100
test eax, eax
js 0x1001f274
push 0
call fcn.10038e9d
pop ecx
test eax, eax
jne 0x1001f274
inc dword [0x101913d8]
jmp 0x1001f344
call fcn.100210ad
jmp 0x1001f244
xor edi, edi
cmp eax, edi
jne 0x1001f2da
cmp dword [0x101913d8], edi
jle 0x1001f20a
dec dword [0x101913d8]
mov dword [ebp - 4], edi
cmp dword [0x10191744], edi
jne 0x1001f29f
call fcn.10020e3b
cmp dword [ebp + 0x10], edi
jne 0x1001f2b3
call fcn.100210ad
call fcn.10020621
call fcn.10021532
mov dword [ebp - 4], 0xfffffffe
call fcn.1001f2c6
jmp 0x1001f344
cmp eax, 2
jne 0x1001f338
call fcn.100205ed
push 0x214
push 1
call fcn.10038e9d
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x1001f20a
push esi
push dword [0x1004a940]
push dword [0x10191724]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x1001f32c
push edi
push esi
call fcn.10020662
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x1001f344
push esi
call fcn.10038e9d
pop ecx
jmp 0x1001f20a
cmp eax, 3
jne 0x1001f344
push edi
call fcn.10038e9d
pop ecx
xor eax, eax
inc eax
call fcn.1002158b
ret 0xc

Function at 0x1001f4a5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004a900]
jne 0x1001fc43
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10191500], eax
mov dword [0x101914fc], ecx
mov dword [0x101914f8], edx
mov dword [0x101914f4], ebx
mov dword [0x101914f0], esi
mov dword [0x101914ec], edi
mov word [0x10191518], ss
mov word [0x1019150c], cs
mov word [0x101914e8], ds
mov word [0x101914e4], es
mov word [0x101914e0], fs
mov word [0x101914dc], gs
pushfd
pop dword [0x10191510]
mov eax, dword [ebp]
mov dword [0x10191504], eax
mov eax, dword [ebp + 4]
mov dword [0x10191508], eax
lea eax, [ebp + 8]
mov dword [0x10191514], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10191450], 0x10001
mov eax, dword [0x10191508]
mov dword [0x10191404], eax
mov dword [0x101913f8], 0xc0000409
mov dword [0x101913fc], 1
mov eax, dword [0x1004a900]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1004a904]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10191448], eax
push 1
call fcn.10022bfb
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10003a64
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10191448], 0
jne 0x1001fd2f
push 1
call fcn.10022bfb
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x10033620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x34], ebx
je 0x10033636
push dword [esi + 0x34]
call fcn.10038e9d
mov dword [esi + 0x34], ebx
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10033646
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x44], ebx
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x10033656
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x48], ebx
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10033666
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x50], ebx
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x10033676
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x4c], ebx
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x10033686
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x54], ebx
push edi
push 7
lea edi, [esi + 0x58]
pop ebx
mov ecx, dword [edi]
test ecx, ecx
je 0x1003369c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [edi], 0
add edi, 4
dec ebx
jne 0x1003368d
mov ecx, dword [esi + 0x7c]
pop edi
test ecx, ecx
je 0x100336b5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x7c], ebx
jmp 0x100336b7
xor ebx, ebx
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x100336c7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x78], ebx
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x100336d7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x25c], ebx
mov dword [esi + 0x264], ebx
cmp dword [esi + 0x260], ebx
je 0x100336f1
mov dword [esi + 0x260], ebx
mov eax, dword [esi + 0x2d4]
test eax, eax
je 0x10033708
push eax
call fcn.10038e9d
pop ecx
mov dword [esi + 0x2d4], ebx
mov eax, dword [esi + 0x150]
test eax, eax
je 0x1003371f
push eax
call fcn.10038e9d
pop ecx
mov dword [esi + 0x150], ebx
mov ecx, esi
pop esi
pop ebx
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x761263d3
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x35555b4f
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x92d008], 0x8088405
inc edx
mov dword [ebx + 0x92d008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x91158e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x911595
ret
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x9128f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0x92f54c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0x92f54c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0x92e378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x9128fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret