joyce8/EMBER2024-capa huggingface dataset:
Function at 0x550ba8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.RtlVcl160.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x550c4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 6], 0
lea eax, [ebp - 4]
push eax
mov ecx, 0xf
mov edx, 1
mov eax, dword [ebp - 4]
call sub.RtlVcl160.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
mov eax, dword [ebp - 4]
call sub.RtlVcl160.bpl__System__UStrLen_qqrx20System_UnicodeString
mov ebx, eax
test ebx, ebx
jle 0x550c25
mov eax, 1
mov edx, dword [ebp - 4]
movzx edx, byte [edx + eax*2 - 2]
mov ecx, eax
mov esi, edx
shl si, cl
mov ecx, 0xf
sub ecx, eax
movzx edx, dx
shr edx, cl
add si, dx
and si, 0x7fff
mov edx, esi
xor word [ebp - 6], dx
inc eax
dec ebx
jne 0x550bf8
mov eax, dword [ebp - 4]
call sub.RtlVcl160.bpl__System__UStrLen_qqrx20System_UnicodeString
xor ax, word [ebp - 6]
xor ax, 0xce4b
mov word [ebp - 6], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x550c56
lea eax, [ebp - 4]
call sub.RtlVcl160.bpl__System__UStrClr_qqrpv
ret

Function at 0x556104
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.RtlVcl160.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x556193
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call sub.RtlVcl160.bpl__System_Sysutils_FileOpen_qqrx20System_UnicodeStringui
mov ebx, eax
mov eax, ebx
cdq
cmp edx, 0
jne 0x55613c
cmp eax, 0xffffffff
je 0x55614f
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
mov eax, ebx
call sub.RtlVcl160.bpl__System_Sysutils_FileClose_qqrui
mov dword [ebp - 0x14], esi
fild dword [ebp - 0x14]
fdiv dword [0x5561a4]
fmul dword [0x5561a8]
add esp, 0xfffffff4
fstp xword [esp]
wait
call sub.RtlVcl160.bpl__System_Math_Ceil_qqrxg
mov dword [ebp - 0x14], eax
fild dword [ebp - 0x14]
fdiv dword [0x5561a8]
fstp qword [ebp - 0x10]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55619a
lea eax, [ebp - 4]
call sub.RtlVcl160.bpl__System__UStrClr_qqrpv
ret

Function at 0x557044
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
push esp
push 0xff
call sub.kernel32.dll_GetTempPathW
mov edx, ebx
mov eax, esp
call sub.RtlVcl160.bpl__System_Sysutils_StrPas_qqrpxb
add esp, 0x200
pop ebx
ret
Function at 0x56e468
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x56e470
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x56e5fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 1
call fcn.00414c90
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_Close_qqrv
push 0x56e618
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx + 0x60c]
mov eax, dword [eax + 0x310]
mov ecx, 5
mov edx, 1
call sub.RtlVcl160.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
push dword [ebp - 0x18]
push 0x56e668
lea eax, [ebp - 0x14]
mov edx, 3
call sub.RtlVcl160.bpl__System__UStrCatN_qqrv
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call sub.RtlVcl160.bpl__System__WStrFromUStr_qqrr17System_WideStringx20System_UnicodeString
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x328]
mov eax, dword [ebp - 0xc]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_Open_qqrv
mov eax, dword [ebp - 0xc]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_GetFieldCount_qqrv
mov edi, eax
dec edi
test edi, edi
jle 0x56e5bd
mov esi, 1
mov ecx, esi
mov edx, dword [ebx + 0x418]
mov eax, ebx
call fcn.0044c8b8
test al, al
je 0x56e5b5
lea edx, [ebp - 0x24]
lea eax, [esi + 1]
call sub.RtlVcl160.bpl__System_Sysutils_IntToStr_qqri
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x56e67c
call sub.RtlVcl160.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x80]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call sub.RtlVcl160.bpl__System_Sysutils_Trim_qqrx20System_UnicodeString
lea ecx, [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.0044cb3c
cmp dword [ebp - 8], 0
je 0x56e5b5
cmp dword [ebp - 4], 0
je 0x56e5b5
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x60c]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_FindField_qqrx20System_UnicodeString
test eax, eax
je 0x56e5b5
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x60c]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
push eax
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 8]
call sub.RtlVcl160.bpl__System_Variants__VarFromUStr_qqrr8TVarDatax20System_UnicodeString
lea edx, [ebp - 0x34]
pop eax
mov ecx, dword [eax]
call dword [ecx + pe_nt_image_headers32]
inc esi
dec edi
jne 0x56e512
mov eax, dword [ebp - 0xc]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_Close_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56e604
lea eax, [ebp - 0x34]
call sub.RtlVcl160.bpl__System_Variants__VarClr_qqrr8TVarData
lea eax, [ebp - 0x24]
mov edx, 5
call sub.RtlVcl160.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0x10]
call sub.RtlVcl160.bpl__System__WStrClr_qqrpv
lea eax, [ebp - 8]
mov edx, 2
call sub.RtlVcl160.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x408c93
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.00407597
test eax, eax
jne 0x408cb1
push eax
push eax
push esi
push 0x4082d6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret
push dword [0x422738]
mov ecx, esi
push dword [esi + 4]
call fcn.0040790b
push 0x2d
pop ecx
call fcn.00403ce0
push eax
push 0x4b2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov ecx, esi
call fcn.0040790b
pop esi
ret
Function at 0x413dfa
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413e20
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x413e20
xor al, al
jmp 0x413e35
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x4166c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp bl, 0xff
inc dword [edi]
sub byte [ecx], 0xbf
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
invalid

Function at 0x41695f
Capabilities:
Contain obfuscated stackstrings
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x41691d
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x41693b
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x416999
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
or byte gs:[eax], al
add byte [eax], al
inc eax
or byte gs:[eax], al
add byte [eax], al
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x416980
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x416989
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x416993
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x416975
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4168ff
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4169e6
dec eax
je 0x4169dd
sub eax, 3
je 0x4169d4
mov dword [ebp - 4], 0x40
jmp 0x416a03
mov dword [ebp - 4], 4
jmp 0x4169e9
mov dword [ebp - 4], 0x20
jmp 0x4169e9
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
invalid
Function at 0x401937
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, section..data
mov ecx, 0x432c
mov esi, 0x2b339a
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov edx, ecx
shr edx, 0xc
xor byte [eax], dl
inc eax
dec esi
jne 0x401947
pop esi
ret

Function at 0x401aa3
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
mov ebx, eax
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
movzx eax, word [esi + 0x14]
push edi
lea edi, [eax + esi + 0x18]
xor eax, eax
cmp ax, word [esi + 6]
jae 0x401aea
push 7
push str..custom
push edi
call fcn.0040161c
add esp, 0xc
test eax, eax
je 0x401af1
movzx eax, word [esi + 6]
inc dword [ebp - 4]
add edi, 0x28
cmp dword [ebp - 4], eax
jl 0x401ac7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0xc]
mov esi, dword [eax + ebx]
lea edi, [eax + ebx + 8]
mov ebx, dword [eax + ebx + 4]
push esi
call fcn.00401e30
and dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
push 1
push 5
push edi
lea ecx, [ebp - 0xc]
push ecx
add edi, 5
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], 0x401960
mov dword [ebp - 0x14], 0x40196b
call fcn.0040379c
add esp, 0x28
test eax, eax
je 0x401b51
push dword [ebp - 4]
call fcn.00401e47
pop ecx
jmp 0x401aea
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp - 4]
jmp 0x401aec

Function at 0x401d84
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
je 0x401dc3
push edi
mov edi, dword [esp + 0x14]
sub edi, 0xf443a8
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov eax, edx
shr eax, 0xc
xor al, byte [edi + esi + 0xf443a8]
inc esi
mov byte [esi + 0xf443a7], al
cmp esi, ebx
jb 0x401d9f
pop edi
pop esi
mov byte [ebx + 0xf443a8], 0
mov eax, 0xf443a8
pop ebx
ret

Function at 0x401dd2
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
je 0x401e10
mov eax, dword [esp + 0x10]
sub eax, 0xf443a8
push ebx
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov ebx, edx
shr ebx, 0xc
xor bl, byte [eax + esi + 0xf443a8]
inc esi
mov byte [esi + 0xf443a7], bl
cmp esi, edi
jb 0x401dec
pop ebx
mov byte [edi + 0xf443a8], 0
mov byte [edi + 0xf443a9], 0
pop edi
mov eax, 0xf443a8
pop esi
ret
Function at 0x401eec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x401f05
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x401f28
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x401f2d
inc edi
cmp edi, dword [ebp - 4]
jb 0x401f1f
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x402025
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x401f84
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x401f58
cmp cl, 0xff
jne 0x401faf
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x401fbd
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x401fc4
dec ecx
shl edx, cl
and edx, 7
je 0x401f49
movzx ecx, byte [edx + 0xc90298]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0xc90290], 0
mov cl, byte [ebx + 4]
je 0x401fac
test cl, cl
je 0x401fac
cmp cl, 0xff
jne 0x401f49
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x401f1a
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x401ff8
movzx esi, byte [edx + 0xc90298]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x401fe3
cmp al, 0xff
jne 0x401ff5
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x401f76
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x401f1a
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x40102d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xb0
mov eax, dword [0x4008bc0]
xor eax, esp
mov dword [esp + 0xac], eax
mov edx, dword [esp + 0xb8]
push ebp
mov ebp, dword [esp + 0xb8]
test ebp, ebp
push esi
mov esi, ebp
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
je 0x401032a
mov eax, dword [0x4017198]
xor ecx, ecx
cmp ebp, eax
je 0x401031d
jb 0x4010378
mov eax, dword [ecx*8 + 0x40171a0]
add ecx, 1
cmp ebp, eax
jne 0x401030d
mov eax, dword [ecx*8 + 0x401719c]
mov dword [esp + 8], eax
mov esi, eax
test edx, edx
je 0x4010433
cmp dword [section..data], 0
je 0x4010433
push edi
mov edi, section..data
push ebx
test ebp, ebp
mov ebx, ebp
jne 0x401034e
mov ebx, dword [edi]
test esi, esi
je 0x401035a
cmp esi, dword [edi]
jne 0x401041f
cmp dword [esp + 0xcc], 0
jne 0x401037f
mov ecx, dword [edi + 8]
push ecx
push ebx
call edx
test eax, eax
je 0x4010431
jmp 0x4010417
xor eax, eax
jmp 0x401043e
movzx eax, word [edi + 4]
movzx esi, ax
mov eax, dword [0x409d158]
mov edx, esi
shr edx, 4
push 6
add edx, 1
push edx
push eax
call dword [sym.imp.kernel32.dll_FindResourceA]
test eax, eax
je 0x4010413
mov ecx, dword [0x409d158]
push eax
push ecx
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4010413
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
je 0x4010413
mov ecx, esi
and ecx, 0x8000000f
jns 0x40103cd
dec ecx
or ecx, 0xfffffff0
inc ecx
je 0x40103dc
nop
sub ecx, 1
movsx edx, word [eax]
lea eax, [eax + edx*2 + 2]
jne 0x40103d0
movsx ecx, word [eax]
cmp ecx, 0x50
jbe 0x40103e9
mov ecx, 0x50
lea esi, [ecx + ecx]
add eax, 2
push esi
push eax
lea eax, [esp + 0x20]
push eax
call sub.msvcr80.dll_memcpy
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push ebx
mov word [esp + esi + 0x20], 0
call dword [esp + 0x1c]
test eax, eax
je 0x401042d
mov esi, dword [esp + 0x10]
cmp esi, dword [edi]
je 0x4010431
mov edx, dword [esp + 0x14]
add edi, 0xc
cmp dword [edi], 0
jne 0x4010346
jmp 0x4010431
mov esi, dword [esp + 0x10]
pop ebx
pop edi
test esi, esi
mov eax, esi
jne 0x401043e
mov eax, 1
mov ecx, dword [esp + 0xb4]
pop esi
pop ebp
xor ecx, esp
call fcn.04015245
add esp, 0xb0
ret 0xc
Function at 0x4015245
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4008bc0]
jne 0x401524e
ret
jmp fcn.040155ef

Function at 0x4015f13
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4015f22
pop dword [ebp - 0x1c]
mov eax, 0x6ea8b7bc
sub eax, 0x6aa7589a
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xd497ac11
sub dword [ebp - 0x2c], 0x864566c6
mov dword [ebp - 0x28], 0x74d3eb58
add dword [ebp - 0x28], 0xbd5f60ed
mov dword [ebp - 0x24], 0x102dad70
add dword [ebp - 0x24], 0x3c1e96be
mov dword [ebp - 0x20], 0xec9ce4df
add dword [ebp - 0x20], 0x13631b21
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x173867c4
add dword [ebp - 0x2c], 0x5d3a0192
mov dword [ebp - 0x28], 0x67a323ac
add dword [ebp - 0x28], 0xd9c93dc9
mov dword [ebp - 0x24], 0x78f04bba
sub dword [ebp - 0x24], 0x1580df4e
mov dword [ebp - 0x20], 0x3a6630ff
sub dword [ebp - 0x20], 0x3a6630ff
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a1a8
push 0
call eax
mov ecx, 0x309ec550
sub ecx, 0x309e6eed
mov edi, eax
mov ebx, 0x5abb87
sub ebx, 0xfc50bb87
add ebx, dword [ebp - 0x1c]
mov edx, 0x31c28e6e
add edx, 0x5b4eabfc
sub dword [ebp - 0x18], esi
mov esi, dword [ebx]
sub dword [ebp - 4], 0x45e4302f
xor esi, edx
sub dword [ebp - 0x18], edi
mov dword [edi], esi
xor dword [ebp - 0x18], 0x5a297f9a
add edi, 4
add ebx, 0x90ec1a99
add ebx, 0x6f13e56b
loop 0x401603a
add eax, 0x9615617d
add eax, 0x69ebeae2
mov ebx, eax
add eax, 0x438d5d19
add eax, 0xbc72a2ec
mov ecx, 0x7353b18f
sub ecx, 0x6f53b18f
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, 0x708298f1
inc eax
cmp eax, 0x5d
mov eax, ecx
mov eax, 0x9fd79b3a
mov eax, ecx
mov eax, ecx
mov eax, ebx
inc eax
cmp eax, 0x37eadb9
cmp eax, 0x46
inc eax
nop
cmp eax, 0xffffff8e
mov eax, ebx
mov eax, ecx
nop
inc eax
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
nop
inc eax
inc eax
mov eax, 0xb95bb5a7
cmp eax, 0xffffffd2
nop
mov eax, ecx
mov eax, 0xe3415a52
inc eax
mov eax, 0x93022826
mov eax, ecx
mov eax, ecx
inc eax
cmp eax, 0xb
mov eax, ecx
mov eax, ecx
inc eax
cmp eax, 0xfffffffa
nop
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 0x8fb333c8
mov eax, ecx
mov eax, 0xa0dee9fa
inc eax
cmp eax, 0xffffff9d
mov eax, 0x395f13d0
mov eax, 0x1744e799
mov eax, 0x73ea8235
nop
mov eax, 0x3ec8af40
mov eax, ecx
mov eax, ecx
nop
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, ebx
mov eax, ebx
cmp eax, 0xffffffa2
inc eax
mov eax, ecx
cmp eax, 0x5431d576
inc eax
mov eax, ebx
mov eax, ebx
mov eax, ecx
nop
cmp eax, 0xffffffc5
nop
cmp eax, 0x67
mov eax, ecx
cmp eax, 0x18
mov eax, 0xfc6a1f16
mov eax, ecx
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
cmp eax, 0x8ad48ee0
mov eax, ebx
mov eax, ecx
mov eax, ebx
mov eax, ecx
mov eax, 0x136c5cf7
mov eax, 0x9dbde9c5
inc eax
cmp eax, 0x87958fd7
mov eax, ebx
nop
inc eax
mov eax, 0x631aa03b
mov eax, ebx
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, ecx
nop
mov eax, ecx
cmp eax, 0xc1c8ea31
cmp eax, 0xf0c42fda
mov eax, ebx
cmp eax, 0x74
mov eax, ecx
inc eax
inc eax
cmp eax, 0xb7114086
cmp eax, 0xfffffff1
cmp eax, 0x3c23c64c
mov eax, 0x1f7a4d12
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001e77b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001e5f1

Function at 0xeffc44
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeffc4e
pushal
call 0xeffc54
pop ebp
sub ebp, 0x10
sub ebp, 0xaffc44
jmp 0xeffc6a
mov eax, 0xaffc44
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ba
mov edx, 0x5dd638c9
xor byte [eax], dl
inc eax
dec ecx
jne 0xeffc81
jmp 0xeffc94
inc edx
add al, 0x42
inc eax
cmc
leave
leave
leave
dec eax
or byte [ecx], dh
leave
leave
leave
retf 0x7104
Function at 0x401d7e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41cc57
call fcn.0041730c
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0040f19b
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040f19b
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
call fcn.0040f19b
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x402cb1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0x10]
lea eax, [esi + 1]
push eax
push 0x40
call dword [0x42002c]
and dword [ebp - 4], 0
mov ecx, eax
mov dword [ebp - 8], ecx
mov byte [ecx + esi], 0
test esi, esi
je 0x402d4c
mov eax, dword [ebp + 8]
mov esi, dword [0x420028]
push ebx
sub eax, ecx
push edi
mov edi, dword [0x420024]
mov dword [ebp - 0xc], eax
push str.XDSFCDR9VQ
call esi
push 0x4231e8
call esi
push 0x423278
call esi
mov ebx, dword [ebp - 4]
push dword [ebp + 0xc]
add ebx, dword [ebp - 8]
call fcn.00417312
mov ecx, eax
mov eax, dword [ebp - 4]
xor edx, edx
div ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [esp], str.v___n
mov al, byte [edx + eax]
xor al, byte [ecx + ebx]
mov byte [ebx], al
call edi
push str.4W5_1CD__DT
call edi
push 0x4234b0
call edi
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jb 0x402cee
pop edi
pop ebx
mov eax, dword [ebp - 8]
pop esi
leave
ret