joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401da0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov edx, 2
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x24], eax
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
movzx eax, word [eax]
test ax, 0xffdf
je 0x401e37
cmp ax, 9
je 0x401e37
xor ecx, ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], ecx
cmp ax, 0x5c
je 0x401e25
lea esi, [esi]
nop
cmp ax, 0x22
je 0x401f58
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x20]
movzx eax, word [eax + edx*2 - 2]
test ax, ax
je 0x401e35
cmp ax, 9
lea edi, [edx + 1]
sete bl
cmp ax, 0x20
mov esi, ebx
sete bl
mov ecx, esi
or cl, bl
je 0x401e1d
test byte [ebp - 0x28], 1
je 0x401e35
mov edx, edi
cmp ax, 0x5c
jne 0x401de0
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x1c]
movzx eax, word [eax + edx*2 - 2]
test ax, ax
jne 0x401dfe
add edx, edx
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x2c], eax
sub esp, 0xc
mov ecx, eax
test eax, eax
je 0x401f27
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
movzx edx, word [eax]
test dx, 0xffdf
je 0x401fc7
cmp dx, 9
je 0x401fc7
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ecx
lea esi, [esi]
add eax, 2
cmp dx, 0x5c
je 0x401f38
cmp dx, 0x22
je 0x401f70
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
lea edi, [esi + 2]
mov word [esi], dx
mov dword [ebp - 0x1c], edi
movzx edx, word [eax]
test dx, dx
je 0x401eea
cmp dx, 9
sete bl
cmp dx, 0x20
mov edi, ebx
sete bl
mov esi, ebx
mov ebx, edi
mov ecx, esi
or bl, cl
je 0x401e98
test byte [ebp - 0x28], 1
jne 0x401e98
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
xor edx, edx
mov word [ecx], dx
mov dword [esi], eax
movzx edx, word [eax]
cmp dx, 9
je 0x401f06
cmp dx, 0x20
jne 0x401f27
add eax, 2
lea esi, [esi]
mov edi, dword [ebp - 0x24]
mov dword [edi], eax
movzx edx, word [eax]
add eax, 2
cmp dx, 9
je 0x401f10
cmp dx, 0x20
je 0x401f10
mov eax, dword [ebp - 0x2c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [ebp - 0x1c]
mov ebx, 0x5c
inc dword [ebp - 0x20]
lea ecx, [edi + 2]
mov word [edi], bx
mov dword [ebp - 0x1c], ecx
jmp 0x401ec2
and dword [ebp - 0x1c], 1
jne 0x401dea
xor dword [ebp - 0x28], 1
jmp 0x401df1
mov esi, dword [ebp - 0x20]
mov ebx, esi
shr ebx, 0x1f
mov edx, ebx
add edx, esi
sar edx, 1
and esi, 1
jne 0x401fa0
add edx, edx
xor dword [ebp - 0x28], 1
sub dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
jmp 0x401ec2
mov esi, dword [ebp - 0x1c]
mov ebx, 0x7fffffff
mov ecx, 0x22
mov dword [ebp - 0x20], 0
sub ebx, edx
lea edx, [esi + ebx*2]
lea edi, [edx + 2]
mov word [edx], cx
mov dword [ebp - 0x1c], edi
jmp 0x401ec2
mov ecx, dword [ebp - 0x2c]
jmp 0x401eed
Function at 0x403350
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x4033eb
cmp ax, 9
je 0x4033d8
cmp ax, 0x20
je 0x4033d8
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp ax, 0x5c
je 0x403440
cmp ax, 0x22
je 0x403450
mov dword [ebp - 0x6c], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x4033eb
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x403390
test edi, 1
jne 0x403390
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x4033d8
cmp ax, 0x20
je 0x4033d8
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x403468
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
inc dword [ebp - 0x6c]
jmp 0x4033ab
and dword [ebp - 0x6c], 1
jne 0x4033a4
xor edi, 1
jmp 0x4033ab
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x403404

Function at 0x403480
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x4433af
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xc
mov ecx, dword [0x235c204]
push ebx
push ebp
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0x10], esi
test ecx, ecx
jle 0x443583
mov edx, dword [esp + 0x28]
mov eax, dword [esi*4 + 0x235c758]
cmp dword [eax], edx
je 0x4433e9
inc esi
mov dword [esp + 0x10], esi
cmp esi, ecx
jl 0x4433d0
jmp 0x443583
cmp dword [esp + 0x38], 0x20
jne 0x443557
mov eax, dword [eax + 8]
mov ebp, dword [esp + 0x44]
test eax, eax
je 0x44342d
cmp ebp, 0x20
je 0x443409
cmp ebp, 0xffffffff
jne 0x44342d
push ebp
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call eax
jmp 0x443581
mov eax, dword [esp + 0x2c]
inc eax
imul ebx, eax, 3
and ebx, 0xfffffffc
mov eax, ebx
mov dword [esp + 0x14], ebx
imul eax, dword [esp + 0x30]
push eax
push 0
push dword [0x235ac2c]
call dword [0x235860c]
mov dword [esp + 0x18], eax
test eax, eax
je 0x443583
mov edi, dword [esp + 0x30]
test edi, edi
jle 0x443522
mov edx, dword [esp + 0x24]
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ecx
mov ebp, edx
test eax, eax
jle 0x443502
mov ebx, ecx
mov esi, eax
mov ecx, 0xff
movzx eax, byte [ebp + 2]
sub eax, ecx
movzx ecx, byte [ebp + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebx + 2], al
movzx eax, byte [ebp + 1]
sub eax, ecx
movzx ecx, byte [ebp + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebx + 1], al
movzx eax, byte [ebp]
lea ebp, [ebp + 4]
sub eax, ecx
movzx ecx, byte [ebp - 1]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebx], al
lea ebx, [ebx + 3]
dec esi
jne 0x443493
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
add edx, dword [esp + 0x34]
add ecx, ebx
dec dword [esp + 0x24]
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], ecx
jne 0x443480
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x44]
mov eax, dword [esi*4 + 0x235c758]
mov esi, dword [esp + 0x18]
push ebp
push dword [esp + 0x44]
push dword [esp + 0x44]
push ebx
push edi
push dword [esp + 0x40]
push esi
push dword [esp + 0x3c]
call dword [eax + 4]
push esi
push 0
push dword [0x235ac2c]
mov edi, eax
call dword [0x2358610]
jmp 0x443583
cmp dword [esp + 0x38], 0x18
jne 0x443583
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call dword [eax + 4]
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x28
Function at 0x480f07
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x480fbd
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x480f9d
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x480f78
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x480fb2
add edi, dword [esp + 0x14]
jmp 0x480fb6
add edi, dword [esp + 0x24]
test edx, edx
jne 0x480f56
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x4812c8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x4813a2
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x481378
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x481340
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x48138f
add edi, ecx
jmp 0x481393
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x481316
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x4819c2
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x481a77
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x481a58
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x481a33
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x481a6d
add edx, dword [esp + 0x14]
jmp 0x481a71
add edx, dword [esp + 0x24]
test esi, esi
jne 0x481a11
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x401cb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401d0b
cmp byte [esi + ebx - 1], 0xa
je 0x401cdf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4020f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x401f30
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x68c420
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push edi
push ecx
mov edi, eax
mov esi, dword [esp + 0x10]
mov eax, 0xa46de6
xor esi, eax
sub esi, eax
and esi, 0xffff
call 0x68c441
pop eax
sub eax, 0x135
add esi, eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esi]
inc esi
push edi
mov ah, byte [esi]
xor ah, al
mov byte [edi], ah
inc esi
ror al, 1
inc edi
dec ecx
jne 0x68c451
pop eax
pop ecx
pop edi
pop esi
ret

Function at 0x68c60a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, esi
add eax, dword [esi + 0x3c]
mov edi, esi
add edi, dword [eax + 0x78]
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0068c5d0
test eax, eax
jne 0x68c679
mov ebx, 0
cmp ebx, dword [edi + 0x18]
jae 0x68c696
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0068c5d0
test eax, eax
je 0x68c690
lea eax, [ebx + ebx]
add eax, dword [edi + 0x24]
movzx eax, word [eax + esi]
shl eax, 2
add eax, dword [edi + 0x1c]
add esi, dword [eax + esi]
mov eax, esi
jmp 0x68c69b
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x68c656
mov eax, 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10009761
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1001f5e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.1000a23f
test eax, eax
je 0x10009876
xor ebx, ebx
mov dword [ebp - 0x214], 0x104
push ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.shlwapi.dll_PathCreateFromUrlW]
test eax, eax
js 0x10009876
push ebx
push 0x80
push 3
push ebx
inc ebx
lea eax, [ebp - 0x20c]
push ebx
push SysReAllocStringLen
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10009876
push 0
lea eax, [ebp - 0x218]
push eax
push 4
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
push edi
mov esi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
je 0x10009876
cmp dword [ebp - 0x218], 4
jne 0x10009876
push 3
lea eax, [ebp - 0x210]
push 0x10017620
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10009840
push 3
lea eax, [ebp - 0x210]
push 0x10017624
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10009840
mov al, bl
jmp 0x10009878
xor eax, eax
push eax
push eax
push eax
movsx ax, byte [ebp - 0x20d]
movzx eax, ax
push eax
call fcn.10009989
mov ecx, dword [0x10020678]
add esp, 0x10
mov edi, eax
mov esi, edx
call fcn.10009989
cmp edx, esi
jb 0x10009872
ja 0x1000983c
cmp eax, edi
jae 0x1000983c
xor bl, bl
jmp 0x1000983c
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10013bb0
leave
ret 4

Function at 0x10009989
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10009998
pop dword [ebp - 0x4c]
mov eax, 0x10009998
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3c386
push 0
mov eax, 0x502f501
add eax, 0xafe6c3f
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x6463b5f7
sub ecx, 0x64636612
mov ebx, eax
mov edi, 0x10024400
add edi, dword [ebp - 0x4c]
mov edx, 0xc3e0ef85
sub edx, 0x1dc42878
sub dword [ebp - 0x30], 0xb3bebd12
mov esi, dword [edi]
xor dword [ebp - 0x24], 0xd536c85d
xor esi, edx
xor dword [ebp - 0x38], eax
mov dword [ebx], esi
xor dword [ebp - 0x2c], esi
add ebx, 4
add edi, 0x6daba01c
add edi, 0x92545fe8
loop 0x100099ec
add eax, 0xfd0b18b2
sub eax, 0xfd09e64b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x737d4b20
add ecx, 0x9c82b4e0
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x40893f
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
call fcn.00408967
and edx, eax
and eax, edx
xor dword [edi], esi
add edi, 1
add edx, 0xda65a15b
sub edx, 0x1548c0ad
cmp edi, ebx
jne fcn.0040893f
inc edx
ret

Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x73977fec
xor esi, 0x4dee99de
push esi
mov ecx, 0x42a05d04
mov ebx, 0x280d20b1
xor ecx, ebx
pop edi
xor ecx, edi
mov eax, 0x75b4e1f8
xor eax, 0x3eda9181
push 0x4cab251c
mov edx, 0x5311cee2
pop ebx
xor edx, ebx
xor edx, eax
xor edx, ecx
mov ecx, 0xfd6d43b
mov esi, 0x460cdea0
xor esi, ecx
mov ebx, 0x6ac5711c
mov eax, 0x231f7b87
xor eax, ebx
xor eax, esi
xor eax, edx
and eax, eax
je 0x403f6c
rol byte [eax], 3
mov word [0x40c3dc], 0
mov word [0x40c3ec], 1
call fcn.0040285c
mov eax, 0x40c038
mov edx, 0x404398
call fcn.00403c25
mov eax, 0x40c204
mov edx, 0x404398
call fcn.00403c25
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404391
ret

Function at 0x4051fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40523e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405248
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405269
mov al, byte [esp]
jmp 0x40526b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..retplne
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5a636ae6
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..reloc
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x10ce47dd
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x100019a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100019b5
xor eax, eax
jmp 0x10001a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100019e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10001a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001a23
xor eax, eax
jmp 0x10001a2a
jmp 0x100019d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10010370]
mov dword [ebp - 4], eax
jmp 0x10001c09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001c26
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001c00
mov esp, ebp
pop ebp
ret