joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df620
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x5cda30]
xor edx, edx
cmp eax, edx
jne 0x4df646
xor eax, eax
mov byte [eax + 0x5cd930], al
inc eax
cmp eax, 0x100
jl 0x4df62e
mov dword [0x5cda30], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5cd930
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4df6d7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4df6aa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4df678
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4df750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4df7a3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4df78a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e6120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5141de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004e6a40
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x56c26c
call fcn.005053ec
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4e61b3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005053ec
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4e61ac
push 0
mov ecx, eax
call fcn.004dd250
mov dword [esi + 0xc], eax
jmp 0x4e61b5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4e61b5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x507a4f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x507a87
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00505b06
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00505ade
jmp 0x507a93
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x509149
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x50918b
call fcn.0050ebf9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x50918b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x509182
xor eax, eax
jmp 0x509193
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00509199
pop edi
pop esi
pop ebx
ret 4

Function at 0x50f129
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x50f157
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x50f175
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0050f08f
jmp 0x50f175
mov eax, dword [esi + 0x14]
test eax, eax
je 0x50f175
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0050f08f
test edi, edi
mov eax, edi
jne 0x50f15f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4017c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Extractor.txt
lea ecx, [ebp - 0x104]
push ecx
call fcn.0040e210
add esp, 8
push 0x43e0d8
lea edx, [ebp - 0x104]
push edx
call fcn.0040e1e1
add esp, 8
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x108]
push ecx
call fcn.0040e174
add esp, 8
mov edx, dword [ebp - 0x108]
push edx
call fcn.0040e0f7
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40184a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x401870
xor al, al
jmp 0x401872
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x401876
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43057c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20c]
call fcn.0042186b
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040184a
add esp, 4
and eax, 0xff
test eax, eax
je 0x4018e3
mov byte [ebp - 0x214], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.004217fd
mov al, byte [ebp - 0x214]
jmp 0x401b14
push 4
push 0
lea edx, [ebp - 0x204]
push edx
call fcn.0040dff0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.0040e630
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x204]
push edx
call fcn.0040e2f0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.0040e630
add esp, 4
mov byte [ebp + eax - 0x204], 0
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x208], 0xffffffff
je 0x40196c
mov ecx, dword [ebp - 0x208]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x208]
add edx, 1
push edx
push 0x5c
lea ecx, [ebp - 0x20c]
call fcn.00421d2c
mov dword [ebp - 0x208], eax
jmp 0x40193b
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401996
mov byte [ebp - 0x218], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.004217fd
mov al, byte [ebp - 0x218]
jmp 0x401b14
cmp dword [ebp - 0x10], 2
je 0x4019ac
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x204], 0
jmp 0x401a3d
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401a19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x50
jne 0x4019f5
mov byte [ebp - 0x21c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.004217fd
mov al, byte [ebp - 0x21c]
jmp 0x401b14
mov byte [ebp - 0x220], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.004217fd
mov al, byte [ebp - 0x220]
jmp 0x401b14
mov byte [ebp - 0x224], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.004217fd
mov al, byte [ebp - 0x224]
jmp 0x401b14
lea edx, [ebp - 0x204]
push edx
call fcn.0040184a
add esp, 4
and eax, 0xff
test eax, eax
jne 0x401ac4
lea eax, [ebp - 0x204]
push eax
call fcn.00401876
add esp, 4
and eax, 0xff
test eax, eax
jne 0x401a91
mov byte [ebp - 0x228], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.004217fd
mov al, byte [ebp - 0x228]
jmp 0x401b14
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401ac2
mov byte [ebp - 0x22c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.004217fd
mov al, byte [ebp - 0x22c]
jmp 0x401b14
jmp 0x401af5
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401af5
mov byte [ebp - 0x230], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.004217fd
mov al, byte [ebp - 0x230]
jmp 0x401b14
mov byte [ebp - 0x234], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.004217fd
mov al, byte [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x402fa4
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 5
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403020
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x403016
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x407e4f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430b08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x448
push edi
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x220], 0
push 0x20019
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x454]
call fcn.00408176
test eax, eax
jne 0x407ea8
xor eax, eax
jmp 0x408008
mov byte [ebp - 0x218], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x428], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x427]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x430], 0x208
mov dword [ebp - 0x21c], 0x208
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x10], 0
jmp 0x407f10
mov eax, dword [ebp - 0x42c]
add eax, 1
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x10], 0
jne 0x407ff1
cmp dword [ebp - 0x10], 0x103
je 0x407ff1
mov dword [ebp - 0x430], 0x208
mov dword [ebp - 0x21c], 0x208
push 0
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x428]
push edx
push 0
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x42c]
push edx
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x407fec
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x440]
call fcn.004040c0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x440]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.00409670
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.00403330
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x450]
call fcn.004040c0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x450]
push ecx
mov ecx, dword [ebp + 0x14]
call fcn.00409670
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.00403330
jmp 0x407f01
lea edx, [ebp - 0x220]
push edx
mov ecx, dword [ebp - 0x454]
call fcn.004081cc
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x408318
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret 8
Function at 0x40ba9d
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x26], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 2
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esp, ebp
pop ebp
ret

Function at 0x40bac9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x26], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 3
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esp, ebp
pop ebp
ret

Function at 0x40baf5
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x26], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 1
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esp, ebp
pop ebp
ret

Function at 0x4173e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4417f0
cmp edx, dword [eax]
je 0x417402
add eax, 8
inc ecx
cmp eax, 0x441880
jl 0x4173f3
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4417f0]
jne 0x417530
mov eax, dword [0x4448b4]
cmp eax, 1
je 0x41750a
test eax, eax
jne 0x417433
cmp dword [0x43f078], 1
je 0x41750a
cmp edx, 0xfc
je 0x417530
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41746a
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040e200
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040e630
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4174ad
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040e630
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x435a8c
push edi
call fcn.0040e8f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040e200
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040e210
lea eax, [ebp - 0xa0]
push 0x435a6c
push eax
call fcn.0040e210
push dword [esi + 0x4417f4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040e210
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00419ce2
add esp, 0x2c
pop edi
jmp 0x417530
lea eax, [ebp + 8]
lea esi, [esi + 0x4417f4]
push 0
push eax
push dword [esi]
call fcn.0040e630
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x423991
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4239c9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00421ca4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00421c7c
jmp 0x4239d5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x425793
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4257d5
call fcn.0042e8fa
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4257d5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4257cc
xor eax, eax
jmp 0x4257dd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004257e3
pop edi
pop esi
pop ebx
ret 4
Function at 0x41b8a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x41b8b7
pop dword [ebp - 0xc]
mov eax, 0xcf9f7922
sub eax, 0xcf5dc06b
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3fa63
push 0
mov eax, 0x66d34540
add eax, 0x996f0cd8
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x191c70d9
add ecx, 0xe6e3d99e
mov esi, eax
mov edi, 0x435400
add edi, dword [ebp - 0xc]
mov edx, 0x4fc2167a
add edx, 0x89928cd
sub dword [ebp - 4], ebx
mov ebx, dword [edi]
mov dword [ebp - 4], 0x2578d32e
xor ebx, edx
mov dword [esi], ebx
add dword [ebp - 8], edi
add esi, 0xfc2051ed
add esi, 0x3dfae17
add edi, 0xaa1acbdf
add edi, 0x55e53425
loop 0x41b910
add eax, 0xafbbd582
add eax, 0x5045472d
xor ebx, ebx
add ebx, eax
add eax, 0xb05a39e1
sub eax, 0xb05a39dc
mov ecx, 0x2433318
add ecx, 0xfdfccce8
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x403c60
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x448008], 0x8088405
inc edx
mov dword [ebx + 0x448008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x42b054
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x42b05c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x42a64e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x42a664
mov eax, esi
call fcn.00428b4c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040518c
lea ecx, [ebp - 0x10]
mov edx, 0x42a678
mov eax, esi
call fcn.00428b4c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040518c
lea ecx, [ebp - 0x14]
mov edx, 0x42a690
mov eax, esi
call fcn.00428b4c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.0040518c
lea ecx, [ebp - 0x18]
mov edx, 0x42a6ac
mov eax, esi
call fcn.00428b4c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040518c
lea ecx, [ebp - 0x1c]
mov edx, 0x42a6c8
mov eax, esi
call fcn.00428b4c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.0040518c
lea ecx, [ebp - 0x24]
mov edx, 0x42a6e0
mov eax, esi
call fcn.00428b4c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408960
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408d70
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x42a6f8
mov eax, esi
call fcn.00428b4c
mov eax, dword [ebp - 0x28]
call fcn.00427c48
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x42a708
mov eax, esi
call fcn.00428b4c
mov eax, dword [ebp - 0x2c]
call fcn.00427c48
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x42a720
mov eax, esi
call fcn.00428b4c
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408d70
inc eax
je 0x42b1f1
lea ecx, [ebp - 0x34]
mov edx, 0x42a720
mov eax, esi
call fcn.00428b4c
mov eax, dword [ebp - 0x34]
call fcn.00408d34
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a60c
fstp qword [ebp - 0x3c]
wait
call fcn.0040a970
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x42b20c
lea ecx, [ebp - 0x40]
mov edx, 0x42a720
mov eax, esi
call fcn.00428b4c
mov eax, dword [ebp - 0x40]
call fcn.00427c48
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x42a730
mov eax, esi
call fcn.00428b4c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.0040518c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a655
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040515c
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.0040515c
ret
Function at 0x437c6c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4370c6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00437c5c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0042662c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0042622c
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4370cd
lea eax, [ebp - 4]
call fcn.00405138
ret

Function at 0x43d228
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x43d241
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x43d23a
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x43d253
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x43d24c
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.0043ce1c
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x43d26d
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.0043cf2c
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x43d2f2
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x43d30f
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.0043ceac
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x43d338
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc