joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407282
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0040cb60
push esi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x4110d0
push esi
lea eax, [ebp - 0x1004]
push eax
push 0x40d47b
push dword [ebp + 8]
push 0x4111d8
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp byte [ebp - 0x1004], 0
pop esi
je 0x4072ee
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_strcpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x4072f2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0040cb60
push esi
push edi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x4110d0
push edi
push esi
lea eax, [ebp - 0x1004]
push eax
push 0x40d47b
push dword [ebp + 8]
mov esi, 0x4111d8
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp byte [ebp - 0x1004], 0
jne 0x40735a
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
jmp 0x40735c
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x407652
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.00405007
test eax, eax
pop ecx
je 0x4076d9
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x4110d0
push edi
call sub.msvcrt.dll_strcpy
push 0x40db5c
mov esi, 0x4111d8
push esi
call sub.msvcrt.dll_strcpy
add esp, 0x10
push edi
push 0
push 0x40db78
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push 0x40db7c
mov esi, 0x411228
mov dword [0x411220], eax
call fcn.0040725e
push 0x3f
push 0x40db84
mov esi, 0x411268
call fcn.0040725e
push 0xff
push 0x40db94
mov esi, 0x4112a8
call fcn.0040725e
add esp, 0x18
pop edi
pop esi
ret

Function at 0x409426
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push 0x40dd9c
lea eax, [ebp - 4]
call fcn.0040b3d3
push 0x40ddb0
lea eax, [ebp - 4]
call fcn.0040b3d3
push 0x40ddc4
lea eax, [ebp - 4]
call fcn.0040b3d3
cmp dword [ebp - 4], 0
je 0x409465
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
leave
ret
Function at 0x40a029
Capabilities:
Delete file
Get common file path
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov esi, eax
lea eax, [ebp - 0x208]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
test eax, eax
jne 0x40a05b
push edi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [ebp - 0x104]
push eax
push 0
push 0x40deb8
lea eax, [ebp - 0x208]
push eax
mov byte [ebp - 0x104], 0
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
push 1
push 2
lea eax, [ebp - 0x104]
push eax
call fcn.00409f00
test eax, eax
je 0x40a0d3
push dword [esi + 0x108]
call dword [0x40d21c]
test eax, eax
je 0x40a0b0
lea eax, [ebp - 0x104]
push eax
call fcn.00404ecb
pop ecx
jmp 0x40a0b6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x40a0c6
push dword [esi + 0x108]
call fcn.00404d9a
pop ecx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop edi
pop esi
leave
ret
Function at 0x40bfca
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040cb60
xor eax, eax
cmp dword [ebp + 8], eax
push ebx
push esi
mov byte [ebp - 0x2004], al
je 0x40c021
push 0x2000
push eax
lea eax, [ebp - 0x2003]
push eax
call sub.msvcrt.dll_memset
push dword [edi]
lea ebx, [ebp - 0x2004]
push dword [ebp + 0x14]
call fcn.004055a1
add esp, 0x14
push dword [ebp + 0x18]
mov eax, ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
mov esi, eax
jmp 0x40c06c
mov esi, 0x2000
push esi
push eax
lea eax, [ebp - 0x2003]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0x18]
lea eax, [ebp - 0x2004]
push esi
push eax
push 0x40d47b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push dword [ebp + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
push edi
lea ebx, [ebp - 0x2004]
neg esi
call fcn.0040561a
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40c072
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x18]
je 0x40c090
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040bf7e
add esp, 0x10
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [esi], eax
pop ebp
ret

Function at 0x40c32d
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
call fcn.0040c2fe
xor ebx, ebx
cmp dword [0x4113b4], ebx
je 0x40c358
call fcn.00405191
push ebx
push 0x22
push edi
push ebx
call dword [0x4113b4]
jmp 0x40c3cb
push 0x103
lea eax, [ebp - 0x127]
push ebx
push eax
mov byte [ebp - 0x128], bl
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x40d9f8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40c3b5
push esi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov eax, 0x104
lea esi, [ebp - 0x128]
call fcn.0040c0bc
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
lea eax, [ebp - 0x128]
push eax
push edi
call sub.msvcrt.dll_strcpy
xor eax, eax
cmp byte [edi], bl
pop ecx
pop ecx
setne al
pop ebx
leave
ret
Function at 0x40c910
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x40d3c0
call fcn.0040cafc
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40c94d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40c94d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40c965
cmp eax, 0x20b
je 0x40c952
mov dword [ebp - 0x1c], ebx
jmp 0x40c979
cmp dword [ecx + 0x84], 0xe
jbe 0x40c94d
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x40c973
cmp dword [ecx + 0x74], 0xe
jbe 0x40c94d
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x411c0c], 0xffffffff
or dword [0x411c10], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x410aac]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x410aa8]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x411c08], eax
call fcn.00408366
cmp dword [0x410000], ebx
jne 0x40c9d4
push fcn.00408366
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0040cae8
push 0x40d394
push 0x40d390
call sub.msvcrt.dll__initterm
mov eax, dword [0x410aa4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x410aa0]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x40d38c
push 0x40d374
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x40ca6a
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x40ca3e
cmp al, 0x22
jne 0x40ca30
cmp byte [esi], 0x22
jne 0x40ca47
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x40ca51
cmp al, 0x20
jbe 0x40ca43
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x40ca75
movzx eax, word [ebp - 0x48]
jmp 0x40ca78
cmp byte [esi], 0x20
jbe 0x40ca47
inc esi
mov dword [ebp - 0x34], esi
jmp 0x40ca6a
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x40ca95
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x40caca
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040cb35
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40633c
pop dword [ebp - 0x24]
mov eax, 0x271df4a1
sub eax, 0x26dd9165
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xde031992
sub dword [ebp - 0x34], 0x8fb0d447
mov dword [ebp - 0x30], 0xc55d7c1c
sub dword [ebp - 0x30], 0x932a2fd7
mov dword [ebp - 0x2c], 0xcf71e741
sub dword [ebp - 0x2c], 0x8325a313
mov dword [ebp - 0x28], 0x5228711e
sub dword [ebp - 0x28], 0x5228711e
lea eax, [ebp - 0x34]
push eax
mov eax, 0x33e39415
sub eax, 0x33a323b5
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x13d93614
add dword [ebp - 0x34], 0x60993342
mov dword [ebp - 0x30], 0x3a0d5af6
sub dword [ebp - 0x30], 0xf8a0f981
mov dword [ebp - 0x2c], 0x8c71ce15
add dword [ebp - 0x2c], 0xd6fd9e57
mov dword [ebp - 0x28], 0x9cdab356
add dword [ebp - 0x28], 0x63254caa
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x1bb32094
sub eax, 0x1b72af94
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3911d
push 0
call eax
mov ecx, 0x366bec1c
add ecx, 0xc99465b2
xor ebx, ebx
add ebx, eax
mov esi, 0xfc5c936
sub esi, 0xf84c936
add esi, dword [ebp - 0x24]
mov edx, 0xed5fa270
add edx, 0x7d31b5fd
add dword [ebp - 4], 0x3aebedbd
mov edi, dword [esi]
xor dword [ebp - 0x1c], ebx
xor edi, edx
xor dword [ebp - 0x10], esi
mov dword [ebx], edi
mov dword [ebp - 8], 0x3a2f736a
add ebx, 0xf32908d0
add ebx, 0xcd6f734
add esi, 0xf4e0dd9
add esi, 0xf0b1f22b
loop 0x406460
add eax, 0xf42169bf
sub eax, 0xf4202fb4
xor ebx, ebx
add ebx, eax
add eax, 0xa0a94c6d
sub eax, 0xa0a94c68
mov ecx, 0x1786941d
sub ecx, 0x1746941d
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x10011023
Capabilities:
Terminate process

Disassembly:
jmp 0x1001cb00
jmp fcn.1001cb30
cmp ecx, dword [0x10021054]
jne 0x1001cb0a
repz ret
jmp 0x100110b9

Function at 0x10016640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1001664f
pop dword [ebp - 0x38]
mov eax, 0x727cbc1f
sub eax, 0x627b55d0
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x8393c68b
sub dword [ebp - 0x48], 0x35418140
mov dword [ebp - 0x44], 0x68301fe6
sub dword [ebp - 0x44], 0x35fcd3a1
mov dword [ebp - 0x40], 0xab359d1c
sub dword [ebp - 0x40], 0x5ee958ee
mov dword [ebp - 0x3c], 0x9ae9c42c
sub dword [ebp - 0x3c], 0x9ae9c42c
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xa34c0d31
sub dword [ebp - 0x48], 0x2ed9a3db
mov dword [ebp - 0x44], 0xd7e88384
sub dword [ebp - 0x44], 0x967c220f
mov dword [ebp - 0x40], 0xb56f60f2
sub dword [ebp - 0x40], 0x51fff486
mov dword [ebp - 0x3c], 0x16d3a05a
add dword [ebp - 0x3c], 0xe92c5fa6
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x8f0bdbc
add eax, 0x7116434
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39504
push 0
call eax
mov ecx, 0x62d079b3
sub ecx, 0x62d02924
mov edx, eax
mov ebx, 0x95a1416
add ebx, 0x6a835ea
add ebx, dword [ebp - 0x38]
mov esi, 0xb76cadc0
xor dword [ebp - 8], edx
mov edi, dword [ebx]
add dword [ebp - 8], ebx
sub edi, esi
add dword [ebp - 0x34], ecx
mov dword [edx], edi
xor dword [ebp - 0x34], 0x1e6fe2e6
add edx, 0xc4ea0620
add edx, 0x3b15f9e4
add ebx, 0xe0d716dd
sub ebx, 0xe0d716d9
loop 0x10016766
add eax, 0xf3a724e1
add eax, 0xc5a102e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x214af8a2
add ecx, 0xeeb5075e
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x1003596d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x14]
je 0x1003555a
dec si
btr dx, 0xd
not si
mov esi, dword [eax + 0x3c]
rol dh, cl
dec dh
test ax, 0xec21
add esi, eax
ror dx, cl
jmp 0x1004b8a6

Function at 0x1004f86f
Capabilities:
Check for software breakpoints

Disassembly:
call 0x1004b8f8
cmp si, bp
sub ecx, ebx
bsr si, bp
push ebp
lea esi, [esp + 4]
push dword [esp]
stc
cmp al, dh
sub edi, 4
clc
cmp di, ax
bt cx, 3
clc
push dword [edi]
pop dword [esp + 4]
cmp bh, 0xcc
push 0x8d4b9035
cmp edi, ebx
jmp 0x1004bf72
push esp
lea esp, [esp + 0x20]
jne 0x1003555a
ror cx, cl
bt bx, di
mov ecx, edi
shr esi, 0x1c
jmp 0x1004dbd5
Function at 0x4010b2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4010ff
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x804]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x404]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x40170c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40171b
pop dword [ebp - 0x50]
mov eax, 0x40171b
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x6aa29572
add dword [ebp - 0x60], 0xe3afafd9
mov dword [ebp - 0x5c], 0xed2d4ce4
add dword [ebp - 0x5c], 0x4505ff61
mov dword [ebp - 0x58], 0x354ac6e3
add dword [ebp - 0x58], 0x17017d4b
mov dword [ebp - 0x54], 0x1758cf1e
sub dword [ebp - 0x54], 0x1758cf1e
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x4ddcd23f
sub dword [ebp - 0x60], 0xd96a68e9
mov dword [ebp - 0x5c], 0x29594e57
sub dword [ebp - 0x5c], 0xe7ecece2
mov dword [ebp - 0x58], 0xcef1bcfe
sub dword [ebp - 0x58], 0x6b825092
mov dword [ebp - 0x54], 0x14505d4a
sub dword [ebp - 0x54], 0x14505d4a
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x11bb575e
add eax, 0xee8578ee
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3b1f2
push 0
call eax
mov ecx, 0x4d8f
mov edx, eax
mov ebx, 0x2fd82c2e
add ebx, 0xd06983d2
add ebx, dword [ebp - 0x50]
mov edi, 0x26472187
sub edi, 0xaa8fa366
add dword [ebp - 0x1c], esi
mov esi, dword [ebx]
xor esi, edi
sub dword [ebp - 0x4c], ebx
mov dword [edx], esi
sub dword [ebp - 0x2c], edx
add edx, 4
add ebx, 4
loop 0x40182d
add eax, 0x1290f
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x403054
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4ca008], 0x8088405
inc edx
mov dword [ebx + 0x4ca008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4219c8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4219ce
ret

Function at 0x460258
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x4caff4
test edx, edx
jne 0x460268
xor eax, eax
pop esi
pop ebx
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x460330
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ecx, 8
cmp ecx, 8
jae 0x460274
test ecx, ecx
je 0x46034f
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ecx
test ecx, ecx
jne 0x460334
xor eax, 0xffffffff
pop esi
pop ebx
ret

Function at 0x468180
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.004683a0
mov ebx, eax
mov eax, esi
call fcn.004680d8
mov edi, eax
dec edi
test edi, edi
jl 0x4681b6
inc edi
mov eax, dword [esi + 8]
cdq
xor eax, edx
sub eax, edx
mov edx, eax
mov eax, ebx
xor ecx, ecx
call fcn.00403034
add ebx, dword [esi + 8]
dec edi
jne 0x46819d
pop edi
pop esi
pop ebx
ret
Function at 0x46f954
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
test dl, dl
je 0x46f971
add esp, 0xfffffff0
call fcn.00403ac4
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x46fb21
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x46fb48
call fcn.00406c14
mov esi, eax
mov dword [edi + 4], esi
test esi, esi
jne 0x46f9b7
lea edx, [ebp - 0x2c]
mov eax, 0x46f76c
call fcn.0040672c
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x46f54c]
call fcn.0040c338
call fcn.00403f2c
push 0x46fb54
mov eax, dword [edi + 4]
push eax
call fcn.00406b5c
mov esi, eax
mov dword [edi + 8], esi
test esi, esi
jne 0x46f9ef
lea edx, [ebp - 0x30]
mov eax, 0x46f76c
call fcn.0040672c
mov ecx, dword [ebp - 0x30]
mov dl, 1
mov eax, dword [0x46f54c]
call fcn.0040c338
call fcn.00403f2c
push 0
lea eax, [edi + 0xc]
push eax
push 0
call dword [edi + 8]
call fcn.0046f844
push 1
call fcn.004070a4
push eax
mov eax, dword [edi + 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.0046f844
lea eax, [ebp - 0x12]
xor ecx, ecx
mov edx, 0x12
call fcn.00403034
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x14
call fcn.00403034
mov dword [ebp - 0x28], 0x14
mov dword [ebp - 0x24], 0x80ea
mov dword [ebp - 0x20], 0x5622
lea eax, [ebp - 0x12]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x12], 1
mov word [ebp - 0x10], 2
mov dword [ebp - 0xe], 0x5622
mov dword [ebp - 0xa], 0xac44
mov word [ebp - 6], 2
mov word [ebp - 4], 8
mov word [ebp - 2], 0x12
push 0
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [edi + 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.0046f844
push 0xffffd8f0
mov eax, dword [edi + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
call fcn.0046f844
push 1
push 0
push 0
mov eax, dword [edi + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.0046f844
mov ecx, edi
mov dl, 1
mov eax, dword [0x46f6f8]
call fcn.0046fcc0
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x415098]
call fcn.00403730
mov dword [edi + 0x18], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x42d7bc]
call fcn.0042e52c
mov esi, eax
mov dword [edi + 0x1c], esi
mov eax, esi
mov edx, 0x32
call fcn.0042e6c4
push edi
push 0x46fc8c
mov eax, dword [edi + 0x1c]
call fcn.0042e6d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fb28
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00404510
ret