joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c183
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x46c8b2
call fcn.0044f047
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.0042c512
call fcn.00410a6d
push eax
lea ecx, [ebp - 0x94]
call fcn.00416d96
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00410a73
mov ecx, eax
call fcn.00417592
test al, al
je 0x42c299
push ebx
lea ecx, [ebp - 0x94]
call fcn.00417011
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00416f67
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x42c20a
push str.Error_opening_file
jmp 0x42c37a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x42c313
cmp edi, 0x400000
ja 0x42c324
and dword [ebp - 0x2c8], 0
push edi
call fcn.0044efdf
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x42c282
push ebx
call fcn.0044efe8
pop ecx
mov ecx, esi
call fcn.0042c512
push 0
push str.Could_not_read_file
jmp 0x42c37a
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.0042c3c5
push dword [ebp - 0x2cc]
jmp 0x42c3a8
call fcn.00410a73
push eax
lea ecx, [ebp - 0x94]
call fcn.00416ff4
call fcn.00410c34
test al, al
je 0x42c2ba
call fcn.00410a79
jmp 0x42c2d1
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00416f67
push eax
call fcn.0042896a
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x42c2e2
push eax
push str.Error_opening_zip_file
jmp 0x42c37a
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.004283ab
add esp, 0x14
test eax, eax
je 0x42c309
push 0
push str.Could_not_find_ziped_file
jmp 0x42c37a
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x42c31c
push 0
push str.File_is_empty
jmp 0x42c37a
cmp ebx, 0x400000
jbe 0x42c32d
push 0
push str.File_too_large
jmp 0x42c37a
push ebx
call fcn.0044efdf
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.00428d2a
add esp, 0x18
test eax, eax
je 0x42c385
cmp eax, 0x600
je 0x42c385
push dword [ebp - 0x2c8]
call fcn.0044efe8
pop ecx
call fcn.00410c34
test al, al
jne 0x42c373
push edi
call fcn.00428205
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.0042c53a
mov bl, al
jmp 0x42c3b0
call fcn.00410c34
test al, al
jne 0x42c395
push edi
call fcn.00428205
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.0042c3c5
push edi
mov bl, al
call fcn.0044efe8
pop ecx
lea ecx, [ebp - 0x94]
call fcn.00416e7b
mov al, bl
call fcn.0044f002
ret 8
Function at 0x436e26
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x436e4a
cmp dword [esi + 8], edi
jge 0x436e42
push esi
call fcn.004332a2
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x436e73
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x436e56
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x436e8d
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x436e7e
xor dl, dl
jmp 0x436e83
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x436e75
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x436ec2
push str.zlib_corrupt
call fcn.004331cb
add esp, 4
jmp 0x436f02
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x436ed2
push str.read_past_buffer
jmp 0x436eb8
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x436eec
push edi
push ecx
push esi
call fcn.004399a0
add esp, 0xc
test eax, eax
je 0x436f02
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.00450ef0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x447705
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x48b378]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041a63f
mov ecx, dword [esi + 0x6e8]
test ecx, ecx
je 0x447781
lea eax, [ebp - 0x14]
push eax
call fcn.00446ce0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [esi + 0x6e8]
test eax, eax
je 0x44775d
push 0
call fcn.0041743b
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x447781
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call fcn.0041743b
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044e878
mov esp, ebp
pop ebp
ret 0xc

Function at 0x447792
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x48b378]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x44781f
cmp dword [esi + 0x10], 0
je 0x44781f
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.0044f1a0
mov ebx, esp
test ebx, ebx
je 0x44781f
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1e4
call fcn.00416f0b
mov ecx, dword [esi + 0x10]
xor eax, eax
push 1
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x24]
mov ecx, eax
call fcn.004141c6
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.00410c41
test al, al
je 0x44781f
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x118]
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044e878
mov esp, ebp
pop ebp
ret 0x10
Function at 0x447e28
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x48b378]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea esi, [ebp + 8]
mov ebx, ecx
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041be0f
mov ecx, dword [ebx + 0x6e8]
test ecx, ecx
je 0x447eac
lea eax, [ebp - 0x14]
push eax
call fcn.00446ce0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [ebx + 0x6e8]
test eax, eax
je 0x447e88
push 0
call fcn.0041743b
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x447eac
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call fcn.0041743b
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e878
mov esp, ebp
pop ebp
ret 0x14

Function at 0x44a99f
Capabilities:
Hide graphical window

Disassembly:
push 0x9c
mov eax, 0x46d490
call fcn.0044f047
mov edi, ecx
mov dword [ebp - 0x98], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x10], eax
mov dword [eax + 0x6f8], ebx
cmp dword [edi + 4], ebx
jne 0x44aa31
lea eax, [ebp - 0xa8]
push eax
call fcn.0044a609
mov ecx, dword [edi + 0x10]
lea esi, [ebp - 0xa8]
push ebx
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
push ebx
movsd dword es:[edi], dword [esi]
push 0x40000000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x24]
mov ecx, eax
call fcn.00410a51
mov edi, dword [ebp - 0x98]
mov ecx, edi
push eax
call fcn.00415aef
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.00418893
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
mov ecx, eax
call fcn.00410618
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00417592
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.00416e7b
mov esi, 0x6e8
test bl, bl
je 0x44aa6c
mov eax, dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, esi
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
call fcn.0044f002
ret 4
Function at 0x44aaa2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x48b378]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041a63f
mov ecx, dword [esi + 0x700]
test ecx, ecx
je 0x44ab1e
lea eax, [ebp - 0x14]
push eax
call fcn.0044a609
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [esi + 0x700]
test eax, eax
je 0x44aafa
push 0
call fcn.0041743b
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x44ab1e
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call fcn.0041743b
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044e878
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44ac09
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x48b378]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea esi, [ebp + 8]
mov ebx, ecx
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041be0f
mov ecx, dword [ebx + 0x700]
test ecx, ecx
je 0x44ac8d
lea eax, [ebp - 0x14]
push eax
call fcn.0044a609
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [ebx + 0x700]
test eax, eax
je 0x44ac69
push 0
call fcn.0041743b
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x44ac8d
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call fcn.0041743b
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e878
mov esp, ebp
pop ebp
ret 0x14
Function at 0x44db45
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x46d647
call fcn.0044f047
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2cc], ebx
call fcn.00410a6d
push eax
lea ecx, [ebp - 0x94]
call fcn.00416d96
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00410a73
mov ecx, eax
call fcn.00417592
test al, al
je 0x44dc33
push ebx
lea ecx, [ebp - 0x94]
call fcn.00417011
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00416f67
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44dbd6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00416e7b
jmp 0x44dd14
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x44dbc2
push esi
mov dword [ebp - 0x2c8], edi
call fcn.0044efdf
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], esi
je 0x44dcff
push edi
call fcn.0044efe8
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00416e7b
jmp 0x44dd12
call fcn.00410a73
push eax
lea ecx, [ebp - 0x94]
call fcn.00416ff4
call fcn.00410c34
test al, al
je 0x44dc54
call fcn.00410a79
jmp 0x44dc6b
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00416f67
push eax
call fcn.0042896a
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x44dbc2
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push dword [ebp - 0x2cc]
push ebx
call fcn.004283ab
add esp, 0x14
test eax, eax
jne 0x44dbc2
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x44dbc2
push esi
call fcn.0044efdf
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x2d4]
push ebx
call fcn.00428d2a
add esp, 0x18
test eax, eax
je 0x44dcef
cmp eax, 0x600
je 0x44dcef
push edi
call fcn.0044efe8
pop ecx
call fcn.00410c34
test al, al
jne 0x44dc1f
push ebx
call fcn.00428205
jmp 0x44dc1e
call fcn.00410c34
test al, al
jne 0x44dcff
push ebx
call fcn.00428205
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00416e7b
test edi, edi
jne 0x44dd86
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44dd82
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x44dd82
push esi
mov dword [ebp - 0x2d0], edi
call fcn.0044efdf
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2d0]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d0], esi
je 0x44dd7e
push edi
call fcn.0044efe8
pop ecx
xor edi, edi
test edi, edi
jne 0x44dd86
xor eax, eax
jmp 0x44dda1
mov ecx, dword [ebp - 0x2d8]
push esi
push edi
call fcn.0044dda9
push 1
push edi
mov esi, eax
call fcn.0044e889
pop ecx
pop ecx
mov eax, esi
call fcn.0044f002
ret 4
Function at 0x4032ec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x419008], 0x8088405
inc edx
mov dword [ebx + 0x419008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x411490
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov byte [esp], al
mov esi, ecx
dec esi
test esi, esi
jl 0x4114d4
inc esi
xor ebx, ebx
mov ebp, edi
add ebp, ebx
mov edx, ebp
lea eax, [esp + 1]
mov ecx, 1
call fcn.00406794
movzx eax, byte [esp]
xor byte [esp + 1], al
lea edx, [esp + 1]
mov eax, ebp
mov ecx, 1
call fcn.00406794
inc ebx
dec esi
jne 0x4114a4
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4114dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov byte [esp], al
mov esi, ecx
dec esi
test esi, esi
jl 0x411520
inc esi
xor ebx, ebx
mov ebp, edi
add ebp, ebx
mov edx, ebp
lea eax, [esp + 1]
mov ecx, 1
call fcn.00406794
movzx eax, byte [esp]
xor byte [esp + 1], al
lea edx, [esp + 1]
mov eax, ebp
mov ecx, 1
call fcn.00406794
inc ebx
dec esi
jne 0x4114f0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x412a74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov byte [esp], al
mov esi, ecx
dec esi
test esi, esi
jl 0x412ab8
inc esi
xor ebx, ebx
mov ebp, edi
add ebp, ebx
mov edx, ebp
lea eax, [esp + 1]
mov ecx, 1
call fcn.00406794
movzx eax, byte [esp]
xor byte [esp + 1], al
lea edx, [esp + 1]
mov eax, ebp
mov ecx, 1
call fcn.00406794
inc ebx
dec esi
jne 0x412a88
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401874
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018b3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4018b3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4018b3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4018b3
cmp dword [ecx + 0x74], 0xe
jbe 0x4018b3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0xae6bb0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xae6bba
pushal
call 0xae6bc0
pop ebp
sub ebp, 0x10
sub ebp, 0x6e6bb0
jmp 0xae6bd6
mov eax, 0x6e6bb0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ba
mov edx, 0x321c42b8
xor byte [eax], dl
inc eax
dec ecx
jne 0xae6bed
jmp 0xae6c00
xor esi, dword [ebp + 0x33]
xor dword [eax + edi*4 + 0x7939b8b8], eax
inc eax
mov eax, 0x75bbb8b8
add byte [ebp + 0x2b8b8b8], bh
nop
mov eax, 0x5a4fb8b8
mov ebx, 0xb4393370
mov eax, 0x7dbbb8b8
call 0xd3133d13
mov dh, 0xb8
shr byte [eax + edi*4 - 0x28], 1
mov eax, 0xd09c94b9
cmc
push esp
sub bl, byte [edx - 0x474742b0]
mov eax, 0xb8b89051
mov eax, 0x335433ed
cmp eax, 0xb8b8b8b0
xor ebp, dword [0xb8b8b8b4]
xor esi, dword [0xb8b8b8a8]
jns 0xae6cac
mov edx, 0x7a3bba89
mov esp, 0x4c3db7f1
inc edi
inc edi
inc edi
in eax, 0x7a
mov ah, 0xb8
xor esi, dword [esp + ebx*4]
mov esp, 0xd0b8b8b8
sal byte fs:[esi - 0x47932f48], cl
fdivr dword [eax - 0x16636b47]
push eax
mov ebp, 0x51b8b8b8
mov edi, dword [edx - 0x13124748]
in eax, 0x47
int 0xb4
inc edi
int 0xb0
push eax
fidivr word [eax + 0x533b8b8]
mov al, 0xb8
mov eax, 0x8b718bb8
push 0x3b
push eax
mov ebp, 0xf63cb7f0
mov eax, 0x30b7b8b8
invalid
mov eax, 0xb8f030b7
mov eax, 0xa433deb8
cmp dword [eax], 0x3cb75043
mov byte [0x38b8b8b8], al
inc ebx
push ecx
mov bh, 0x3c
test eax, 0xdeb8b8b8
cmp dword [ebx + 0x47], eax
popfd
mov bh, 0x3c
lodsd eax, dword [esi]
mov eax, 0x51f9b8b8
je 0xae6d1f
inc edi
inc edi
xchg ecx, eax
hlt
mov edx, 0xbab8b8b8
push 0xffffffffffffffb7
cmp eax, 0xb8b8b8bd
xor ch, byte [esi - 0x48955502]
cmp esp, dword [eax + 0x47]
inc edi
inc edi
mov edx, 0xbd3db76a
mov eax, 0xae32b8b8
invalid
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x432000
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x5c7d431d
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x48492ba5
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x402e38
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404b30
test esi, esi
jne 0x402e6e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404c20
jmp 0x402e8c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402cec
mov edi, eax
test esi, esi
je 0x402e8c
cmp dword [ebx], 0
je 0x402e8c
dec esi
jmp 0x402e75
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403518
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x659008], 0x8088405
inc edx
mov dword [ebx + 0x659008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403534
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x659008], 0x8088405
inc edx
mov dword [ebx + 0x659008], edx
fld qword [ebx + 0x659058]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x403b94
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x659010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403c2c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403c0c
xor eax, eax
push ebp
push 0x403c05
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403c48
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403c0c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x659010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x659010], ax
mov esp, ebp
pop ebp
ret

Function at 0x404930
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x67204c], 0
je 0x404991
cmp word [0x672220], 0xd7b2
jne 0x404959
cmp dword [0x672228], 0
jbe 0x404959
mov eax, 0x67221c
call dword [0x672238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x659060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4049b8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x659020], 0
jne 0x4049ad
push 0
push 0x659080
push 0x659060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404ae4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402a68
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x67204d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404aac
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc