joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d740
mov esi, eax
sar esi, 1
and eax, 8
mov ecx, esi
xor ecx, 4
lea ebx, [ecx + eax]
add eax, ecx
inc eax
test eax, eax
jns 0x43d768
mov eax, 0xffffffff
jmp 0x43d76f
lea eax, [ebx*2 + 2]
push eax
call fcn.00408b60
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [edi]
test dx, dx
je 0x43d7b1
add edi, 2
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [edi]
add edi, 2
test dx, dx
jne 0x43d7a0
mov word [ecx], 0
mov ecx, ebx
and ecx, 0xfffd
and esi, 2
mov edx, esi
xor edx, 2
imul edx, ecx
or ebx, 2
imul ebx, esi
lea ecx, [ebx + edx]
mov word [esp], cx
lea ecx, [ebx + edx]
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x66676869
xor ecx, ecx
nop
nop
nop
mov edx, ecx
add dl, 0x46
xor dl, byte [esp + ecx + 0x20]
add dl, 0xd0
mov byte [esp + ecx + 0x20], dl
inc ecx
cmp ecx, 4
jne 0x43d820
mov esi, dword [esp + 0x20]
mov ecx, dword [0x4486a8]
test ecx, ecx
je 0x43d889
xor edx, edx
mov edi, dword [0x4486ac]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xcaa82e26
je 0x43d860
inc edx
cmp ecx, edx
jne 0x43d850
jmp 0x43d889
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43d889
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x4486b0]
mov edi, eax
call fcn.0043b5b0
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.00408b70
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43d89f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43d8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x66676869
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x46
xor cl, byte [esp + eax]
add cl, 0xd0
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x43d8d0
mov eax, dword [esp]
mov edx, dword [0x4486a8]
test edx, edx
je 0x43d938
xor ebx, ebx
mov ecx, dword [0x4486ac]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x43d910
inc ebx
cmp edx, ebx
jne 0x43d900
jmp 0x43d938
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43d938
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x4486b0]
call fcn.0043b5b0
add esp, 0x20
test edi, edi
je 0x43d942
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43d94e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43da90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 0x66676869
xor eax, eax
nop
nop
nop
mov ebx, eax
add bl, 0x46
xor bl, byte [esp + eax + 4]
add bl, 0xd0
mov byte [esp + eax + 4], bl
inc eax
cmp eax, 4
jne 0x43dab0
mov eax, dword [esp + 4]
mov ebx, dword [0x4486a8]
test ebx, ebx
je 0x43db1e
xor ebp, ebp
mov edi, dword [0x4486ac]
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x88822328
je 0x43daf0
inc ebp
cmp ebx, ebp
jne 0x43dae0
jmp 0x43db1e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43db1e
lea eax, [esp + 4]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x4486b0]
call fcn.0043b5b0
add esp, 0x30
cmp eax, 0x103
jne 0x43db99
mov dword [esp], 0x66676869
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x46
xor cl, byte [esp + eax]
add cl, 0xd0
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x43db30
mov eax, dword [esp]
mov ecx, dword [0x4486a8]
test ecx, ecx
je 0x43db91
xor edx, edx
mov edi, dword [0x4486ac]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43db70
inc edx
cmp ecx, edx
jne 0x43db60
jmp 0x43db91
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43db91
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x4486b0]
call fcn.0043b5b0
add esp, 0x18
test eax, eax
js 0x43db99
mov eax, dword [esp + 4]
test esi, esi
je 0x43dba3
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x11a121c3
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x61f41816
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x404f0b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x43d9cd
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x404f31

Function at 0x404f1d
Capabilities:
Read file on windows

Disassembly:
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004255e2
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
Function at 0x409ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x4c6480]
mov dword [esp + 4], ecx
dec esp
and al, 4
push esi
push edi
test al, 1
je 0x40b3d6
mov edi, dword [ebp + 0x10]
xor eax, eax
push 8
mov word [esp + 0x5c], 1
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0
invalid
mov dword [esp + 0xc], eax
or eax, 1
mov dword [0x4c6488], 0
push 0x43b5ec
mov dword [0x4c6480], eax
mov dword [0x4c6490], 0
mov dword [0x4c6494], 1
call fcn.00422d40
add esp, 4
jmp 0x409ebf

Function at 0x409edd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], 1
call fcn.00420db6
mov edx, eax
mov dword [esp + 0x20], eax
add esp, 4
test edx, edx
je 0x40b52a
mov dword [edx], 0x14
mov esi, dword [ebp + 0xc]
mov dword [edx + 4], 0
mov dword [esp + 0x54], edx
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [esp + 0x50], 1
mov dword [esp + 0x10], 0x17
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
movsx eax, word [eax + 0xa]
mov dword [esp + 0x5c], eax
jmp 0x409faa
xor edx, edx
mov dword [esp + 0x1c], edx
jmp 0x409f04
Function at 0x40fce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x10]
sub esp, 0x10
mov dword [esp + 0x28], ebx
mov eax, dword [esi + 4]
mov dword [esp + 0x30], 3
mov edx, dword [edi]
mov eax, dword [eax + edx*4]
mov edx, esp
movsx ecx, word [eax + 0xa]
mov dword [esp + 0x4c], ecx

Function at 0x412b62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [esi + 8], 1
jbe 0x412b8c
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
call fcn.00409b3c
dec eax
je 0x412bab
dec eax
je 0x412bab
dec eax
je 0x446aec
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0xc]
push dword [eax]
call fcn.00409d3c
mov ecx, dword [ebp + 0xc]
call fcn.0040937a
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
mov ecx, edi
push esi
call fcn.00412919
jmp 0x412ba1
dec eax
add al, 0xe8
popfd
xor byte [edi], cl
test dword [ecx + 0x4c6242a2], esp
test dword [edi + 0xe919be], eax
add bl, byte [esi - 0x73]
inc esi
inc dword [eax + edx*4 - 4]
ja 0x4dd0295f
cld
lea eax, [ebp + 0x56]
inc ebp
push esi
mov ecx, dword [eax]
call 0x15c8ef8
push edx
dec dword [ebx - 0x1774fbaa]
loopne 0x446aaa
add bh, bh
invalid
call 0x462198d2
loopne 0x446acc
mov esi, 0x31368524
inc esi
jmp 0x208c2942
Function at 0x413fe0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x30], 0
lea eax, [esi + esi]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x11c], eax
add eax, ebx
mov dword [ebp - 0x110], eax
mov dword [ebp - 4], eax
add eax, 0xfffffffe
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x118], eax
test edi, edi
je 0x44748d
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
test ecx, 0xe20f5a6f
jne 0x414764
test edi, edi
je 0x414853
test ebx, ebx
je 0x414853
cmp dword [ebp + 0x18], 0
mov eax, dword [ebp + 0x1c]
je 0x4474ca
test eax, eax
js 0x41476e
test edx, edx
js 0x414778
test esi, esi
js 0x414849
cmp esi, edx
jg 0x414849
mov eax, dword [edi]
cmp eax, 0x50435245
jne 0x4474d7
test byte [edi + 0xc], 2
je 0x414782
mov ebx, dword [edi + 8]
test ebx, 0x800
je 0x41478c
mov eax, 1
mov dword [ebp - 8], eax
mov dword [ebp - 0xb0], eax
test ecx, 0x8000000
jne 0x414793
test ecx, 0x8000
jne 0x41479d
xor eax, eax
cmp dword [ebp - 8], 0
mov dword [ebp - 0x74], eax
je 0x414120
test ecx, 0x2000
je 0x4474eb
movzx eax, word [edi + 0x22]
mov esi, dword [edi + 0x30]
movzx edx, word [edi + 0x24]
mov dword [ebp - 0xc], esi
mov esi, dword [ebp - 0x10]
lea eax, [edi + eax*2]
mov dword [ebp - 0xd0], eax
test esi, esi
movzx eax, word [edi + 0x26]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xe0], eax
mov eax, 0x989680
mov ecx, eax
mov dword [ebp - 0xdc], edx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0xfc], eax
mov eax, 0xfffffffd
jmp 0x4145c1
mov eax, 0xfffffff1
jmp 0x4145c1
mov eax, 0xffffffe0
jmp 0x4145c1
mov eax, 0xffffffe4
jmp 0x4145c1
xor eax, eax
jmp 0x4140e8
mov eax, 2
jmp 0x41410b
mov eax, 1
jmp 0x41410b
mov eax, 0xffffffe8
jmp 0x4145c1
mov eax, 0xfffffffe
jmp 0x4145c1
retf 0x4c52
push ebx
xor edx, edx
xor ecx, ecx
call 0xb0924872
call 0xf82d8969
ror byte [ecx + 0x4c64400d], 1
pop dword [ecx - 0x164fb22d]
invalid
jmp 0xdce45d3
inc ebx
push edx
inc ebp
neg eax
sbb eax, eax
and eax, 0x19
add eax, 0xffffffe3
jmp 0x14145d3

Function at 0x415cf8
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x415d20
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x415d12
pop edi
pop esi
pop ebp
ret 4
Function at 0x418d4c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
movzx eax, word [ecx]
xor edx, edx
movzx eax, byte [eax + 0x4a5470]
lea ecx, [ecx + eax*2]
call fcn.004184a5
mov esi, eax
movzx eax, word [esi]
cmp eax, 0x87
je 0x4555cb
cmp eax, 0x83
je 0x418e31
cmp eax, 0x84
je 0x418e31
cmp eax, 0x88
je 0x418e31
cmp eax, 0x89
je 0x418e31
cmp eax, 0x85
je 0x418e1a
cmp eax, 0x86
je 0x418e1a
cmp eax, 0x8a
je 0x418e1a
cmp eax, 0x8b
je 0x418e1a
cmp eax, 0x7d
je 0x418e31
cmp eax, 0x81
je 0x418e10
cmp eax, 0x82
je 0x418e10
cmp eax, 0x55
je 0x455626
cmp eax, 0x56
je 0x455626
cmp eax, 0x5e
je 0x455626
cmp eax, 0x1b
je 0x455668
cmp eax, 0x1c
je 0x455668
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
inc eax
push eax
jmp fcn.00455654
movzx ecx, word [esi + 4]
xor edx, edx
inc edx
cmp ecx, 0x20
jge fcn.0045564d
shl edx, cl
jmp fcn.0045564d
push dword [ebp + 0xc]
jmp fcn.00455654
int1
or al, 0x8b
ror dword [ebx + 0x53e857ce], cl
aaa
cmp eax, edi
jne 0x8554a6cd
int 0x37
push es
mov eax, 0xc7df8
adc byte [edi - 0x47f9c83d], cl
clc
jg 0x4556ef
add cl, ch
je 0x4556f7
push ecx
call fcn.0041f9de
mov dword [esi + 8], edi
mov byte [esi + 0xd], 0
jmp 0xf46f92d

Function at 0x45929c
Capabilities:
Encode data using xor

Disassembly:
cld
push 0x39c0800
call 0x43e1416
jbe 0x4592bc
or al, 0x6a
xor al, 0xff
jne 0x4592ab
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp + 0x502c2440]
lea eax, [eax + 0x24]
sub al, 0x50
push eax
mov dword [ebp - 0x24], 0xfb70400
call 0x9d2f14f4
test edi, edi
jle 0x459322
push dword [ebp - 4]
push esi
push 0x75c11073
push dword [ebx]
call dword [0x148f688]
push 0x39c0800
lea eax, [ebp - 0x7bf008c8]
push eax
push dword [ebp - 8]
lea ecx, [ebp + 0x502c2440]
call 0x985214bf
xor eax, eax
mov word [ebp + 0x502c2438], ax
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x7bf008c8]
push eax
call 0xc7812f35
pop ecx
pop ecx
add byte [eax], al
je 0x459322
inc esi
cmp esi, edi
jl 0x4592d2
cmp esi, edi
jne 0x459329
or esi, 0xffffffff
lea ecx, [ebp + 0x502c2440]
call fcn.0041619d
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46881f
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4c3190]
jne 0x468831
call 0x53cccc1
mov eax, dword [0x4c6ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c6ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xc7ffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x468874
fadd qword [0x4b9e48]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4b9e20]
mov esp, ebp
pop ebp
ret
Function at 0x468884
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4c6530], ecx
inc esi
mov ecx, 0x4c6530
cmp eax, 0xc1018bd6
call 0x6947bbbb
shl byte [ebp - 0x77], 7
insb byte es:[edi], dx
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x4c6eec
jl 0x468895
mov dword [0x4c3190], esi
mov dword [0x4c6518], esi
pop esi
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6e83373f
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x32d21b8f
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x402f80
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41f008], 0x8088405
inc edx
mov dword [ebx + 0x41f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406c8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004047e4
mov eax, dword [ebp - 8]
call fcn.004047e4
xor eax, eax
push ebp
push 0x406d76
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x406cd7
mov eax, dword [ebp - 0xc]
call fcn.00404358
jmp 0x406d4e
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004043f0
lea eax, [ebp - 0x10]
call fcn.00404358
mov eax, dword [ebp - 4]
call fcn.004045f4
mov esi, eax
test esi, esi
jle 0x406d43
mov ebx, 1
mov eax, dword [ebp - 0x14]
call fcn.004045f4
push eax
mov eax, ebx
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
inc edi
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + edi - 1]
mov ecx, 0xa
xor edx, edx
div ecx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
xor edx, eax
lea eax, [ebp - 0x18]
call fcn.00404540
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.004045fc
inc ebx
dec esi
jne 0x406cfd
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.004043ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d7d
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040437c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040437c
ret

Function at 0x41779c
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffd0
lea eax, [esp + 4]
push eax
push 0x20
call fcn.00406248
push eax
call fcn.00406178
lea eax, [esp + 8]
push eax
push 0x417838
push 0
call fcn.00406170
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 1
xor ebx, ebx
mov dword [esp + 0x2c], ebx
push esp
lea eax, [esp + 0x14]
push eax
push 0x10
lea eax, [esp + 0x2c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call fcn.00406168
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 1
or ebx, 2
mov dword [esp + 0x1c], ebx
push esp
push 0
mov eax, dword [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call fcn.00406168
add esp, 0x30
pop ebx
ret
Function at 0x41da08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004047e4
xor eax, eax
push ebp
push 0x41dadd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x41da41
mov eax, dword [ebp - 8]
call fcn.00404358
jmp 0x41daba
lea eax, [ebp - 0x10]
mov edx, 0x41daf4
call fcn.004043f0
lea eax, [ebp - 0xc]
call fcn.00404358
mov eax, dword [ebp - 4]
call fcn.004045f4
mov esi, eax
test esi, esi
jle 0x41daaf
mov ebx, 1
mov eax, dword [ebp - 0x10]
call fcn.004045f4
push eax
mov eax, ebx
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
inc edi
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + edi - 1]
mov ecx, 0xa
xor edx, edx
div ecx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
xor edx, eax
lea eax, [ebp - 0x14]
call fcn.00404540
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.004045fc
inc ebx
dec esi
jne 0x41da69
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004043ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dae4
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040437c
lea eax, [ebp - 4]
call fcn.00404358
ret

Function at 0x430145
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.004301c4
jae 0x430151
xor ecx, ecx
call fcn.004301c4
jae 0x43017b
xor eax, eax
call fcn.004301c4
jae 0x43018c
mov al, 0x10
call fcn.004301c4
adc al, al
jae 0x43016d
jne 0x4301b9
stosb byte es:[edi], al
jmp 0x430152
call fcn.004301d0
dec ecx
loop 0x430198
mov eax, ebp
call fcn.004301ce
jmp 0x4301ba
lodsb al, byte [esi]
shr eax, 1
je 0x4301e0
adc ecx, 2
mov ebp, eax
jmp 0x4301ba
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.004301ce
cmp eax, 0x7d00
jae 0x4301b8
cmp eax, 0x500
jae 0x4301b9
cmp eax, 0x7f
ja 0x4301ba
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x430152
pop ebp
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x583d59d6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x7f2e4a91
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219