joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cbf7
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x750
push esi
push edi
test ebx, ebx
je 0x40cdcd
cmp dword [ebp + 0xc], 0
je 0x40cdcd
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x750]
push eax
push dword [ebx]
call esi
mov edi, eax
lea eax, [ebp - 0x750]
push eax
push dword [ebx]
call esi
cmp eax, 0xffffffff
je 0x40cdcd
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x750], 0x10
je 0x40cc7a
push 0x3c
pop ecx
mov edx, ecx
lea eax, [ebp - 0x88]
mov byte [eax], 0
inc eax
dec edx
jne 0x40cc56
mov eax, dword [ebx]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x6c], 1
lea eax, [ebp - 0x88]
jmp 0x40cd71
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
xor ecx, ecx
xor edi, edi
mov word [ebp - 0x500], ax
cmp dword [ebp + 0xc], ecx
jle 0x40ccc2
push 0x4177ec
lea eax, [ebp - 0x500]
push eax
call esi
push dword [ebx + edi*4]
lea eax, [ebp - 0x500]
push eax
call esi
push 0x4177f0
lea eax, [ebp - 0x500]
push eax
call esi
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x40cc92
xor ecx, ecx
push 0x44
pop edi
mov edx, edi
lea eax, [ebp - 0xd0]
mov byte [eax], 0
inc eax
dec edx
jne 0x40cccd
push 0x10
pop edx
lea eax, [ebp - 0x10]
mov byte [eax], 0
inc eax
dec edx
jne 0x40ccda
xor eax, eax
inc eax
mov word [ebp - 0xa0], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xd0]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x500]
push eax
push ecx
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xa4], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40cd78
xor edi, edi
mov word [ebp - 0x500], ax
cmp dword [ebp + 0xc], edi
jle 0x40cd4c
push dword [ebx + edi*4]
lea eax, [ebp - 0x500]
push eax
call esi
push 0x4176b8
lea eax, [ebp - 0x500]
push eax
call esi
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x40cd2c
push 0x3c
pop ecx
mov edx, ecx
lea eax, [ebp - 0x4c]
mov byte [eax], 0
inc eax
dec edx
jne 0x40cd54
lea eax, [ebp - 0x500]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 8
pop ecx
push 0x7fffffff
push dword [ebp + 8]
xor eax, eax
lea edi, [ebp - 0xf0]
lea esi, [ebp - 0xf0]
rep stosd dword es:[edi], eax
call fcn.0040c4fa
push eax
lea eax, [ebp - 0x500]
push 0x4177f8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x500]
push eax
call fcn.0040dbd1
push eax
xor edi, edi
call fcn.0040c5a0
test al, al
je 0x40cdcd
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
xor al, al
pop esi
leave
ret 8
Function at 0x40d0a7
Capabilities:
Create thread

Disassembly:
push ecx
push ecx
mov eax, dword [edi + 0x810]
test eax, eax
jg 0x40d0ba
xor al, al
jmp 0x40d143
push ebp
xor ebp, ebp
test eax, eax
jle 0x40d140
push ebx
push esi
mov esi, 0x41e3a8
lea ebx, [edi + 0x5a0]
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
push 0x40c738
push 0x10000
push eax
mov dword [esi], edi
mov dword [esi + 4], ebp
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0xc], 0xffffffff
je 0x40d124
cmp byte [ebx - 4], 0
jne 0x40d115
push 0xffffffffffffffff
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 8]
push dword [esp + 0xc]
add dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
add ebx, 0x14
add esi, 0xc
cmp ebp, dword [edi + 0x810]
jl 0x40d0ce
pop esi
pop ebx
mov al, 1
pop ebp
pop ecx
pop ecx
ret

Function at 0x40d146
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
cmp dword [edi + 0x2bfc], ebx
jle 0x40d1c9
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [edi + 0xa0c]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x40c78d
push 0x10000
push 0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
mov dword [ebp - 4], eax
call esi
cmp dword [ebp - 4], 0xffffffff
je 0x40d1b2
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
push dword [ebp - 4]
add dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
call esi
add dword [ebp - 8], 0x118
inc ebx
cmp ebx, dword [edi + 0x2bfc]
jl 0x40d167
pop esi
mov al, 1
pop ebx
leave
ret

Function at 0x40d1cf
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
and dword [esp], 0
cmp dword [ebx + 0x4f00], 0
jle 0x40d26e
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
mov esi, 0x41e530
lea edi, [ebx + 0x2c04]
mov ecx, dword [edi - 4]
lea eax, [esi - 8]
mov dword [eax], ecx
mov dword [esi - 4], ebx
mov ecx, dword [edi]
mov dword [esi], ecx
lea ecx, [edi + 0x10c]
mov dword [esi + 4], ecx
mov cl, byte [edi + 0x110]
mov byte [esi + 8], cl
lea ecx, [esp + 0x14]
push ecx
push 0
push eax
push 0x40c83c
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
mov dword [esp + 0x14], eax
call ebp
cmp dword [esp + 0x10], 0xffffffff
je 0x40d24b
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call ebp
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
add edi, 0x118
add esi, 0x14
cmp eax, dword [ebx + 0x4f00]
jl 0x40d1f7
pop edi
pop esi
pop ebp
mov al, 1
add esp, 0xc
ret
Function at 0x40d274
Capabilities:
Copy file
Move file

Disassembly:
mov eax, 0x41453c
call fcn.004104dc
sub esp, 0x25c
push ebx
push esi
push edi
lea eax, [ebp - 0x60]
xor ebx, ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call fcn.0040e2e2
mov dword [ebp - 4], ebx
lea esi, [ebp - 0x38]
call fcn.0040a5df
mov byte [ebp - 4], 1
lea esi, [ebp - 0x28]
call fcn.0040a5df
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0xff00aaee
mov byte [ebp - 0xd], bl
call fcn.0040ed34
test al, al
je 0x40d3fc
cmp dword [ebp - 0x14], ebx
je 0x40d404
cmp dword [ebp - 0x18], ebx
jbe 0x40d404
push ebx
push dword [ebp - 0x18]
lea esi, [ebp - 0x38]
call fcn.0040a263
mov eax, dword [ebp - 0x18]
push ebx
push dword [ebp - 0x14]
mov ecx, esi
call fcn.0040a74e
mov eax, esi
lea ebx, [ebp - 0x60]
call fcn.0040e3a6
lea eax, [ebp - 0x28]
mov edi, ebx
call fcn.0040e364
cmp dword [ebp - 0x24], 0
jle 0x40d3f2
push 3
lea eax, [ebp - 0x268]
push eax
push dword [ebp + 8]
call fcn.0040c973
push str..exe
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x268]
push eax
call fcn.0040b487
mov esi, eax
test esi, esi
je 0x40d3f2
push dword [ebp - 0x24]
mov ecx, esi
push dword [ebp - 0x28]
push dword [ebp + 8]
call fcn.0040b980
test al, al
je 0x40d395
push esi
push dword [ebp + 8]
call fcn.0040b723
mov ebx, eax
test ebx, ebx
je 0x40d395
push 0
push ebx
xor edi, edi
call fcn.0040c5a0
test al, al
je 0x40d38f
mov byte [ebp - 0xd], 1
push ebx
call fcn.0040e8d8
call fcn.0040dbd1
push eax
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str..csp
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x268]
push eax
call fcn.0040dbd1
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40d3ec
push 0
call fcn.0040dbd1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x268]
push eax
call fcn.0040dbf2
push esi
call fcn.0040e8d8
push dword [ebp - 0x14]
call fcn.0040e8d8
xor ebx, ebx
mov al, byte [ebp - 0xd]
mov byte [ebp + 0xb], al
jmp 0x40d407
mov byte [ebp + 0xb], bl
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
call fcn.0040a40a
mov byte [ebp - 4], bl
lea eax, [ebp - 0x38]
call fcn.0040a40a
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x60]
push eax
call fcn.0040e2ac
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0xb]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x40d78d
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.0040d04d
mov eax, dword [eax]
imul eax, eax, 3
cdq
sub eax, edx
mov esi, eax
sar esi, 1
call fcn.0040d04d
cmp esi, 0x6400000
ja 0x40d7ec
test esi, esi
jne 0x40d7b1
inc esi
add esi, 4
cmp dword [0x41ffa4], 0
jne 0x40d7c6
call fcn.00401270
test al, al
je 0x40d7f2
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push 8
push dword [0x41ffa4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x40d7e8
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, eax
jmp 0x40d7ee
xor esi, esi
test esi, esi
jne 0x40d7f6
xor eax, eax
pop esi
ret
inc dword [0x41ff88]
mov eax, dword [0x41ff88]
push 0x10
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
push 0x41cebc
push eax
mov dword [esi], 0xdeadface
call fcn.00401ab0
add esp, 0xc
mov eax, esi
pop esi
ret
Function at 0x40d821
Capabilities:
Create thread
Terminate thread

Disassembly:
mov eax, 0x4145ce
call fcn.004104dc
sub esp, 0x4c
push ebx
push esi
push edi
lea eax, [ebp - 0x58]
push eax
call fcn.0040a6c6
and dword [ebp - 4], 0
push dword [ebp + 0x20]
mov eax, dword [0x41ff8c]
push dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
push dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x14]
lea esi, [ebp - 0x58]
push dword [ebp + 0x10]
mov byte [ebp - 0xd], 0
call fcn.0040aa0b
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov edi, dword [eax + 0x24]
add edi, 0x5a
call fcn.0040d78d
mov esi, eax
mov dword [ebp + 0x1c], esi
call fcn.0040d761
mov eax, dword [ebp - 0x54]
mov ebx, dword [eax]
call fcn.0040d6fc
call fcn.0040d6ad
mov ebx, dword [esi + 8]
add ebx, 0x20
call fcn.0040d04d
push ebx
push esi
call fcn.0040f0dd
push 0x14
pop ecx
lea eax, [ebp - 0x2c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x40d8a5
call fcn.0040d04d
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
push 0x40d5ae
push 0x10000
push 0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], edi
mov byte [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 0x20], eax
cmp eax, 0xffffffff
je 0x40d91f
call fcn.0040d04d
mov ecx, ebx
imul ecx, ecx, 0x18
push dword [eax + ecx + 0x10]
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x40d90b
cmp eax, 0x102
jne 0x40d916
push 0
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x1c], 0
jne 0x40d992
call fcn.0040d04d
push eax
push 0x78
pop eax
call fcn.0040c8be
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x304]
test eax, eax
jle 0x40d944
mov ecx, eax
jmp 0x40d947
xor ecx, ecx
inc ecx
lea eax, [ebx + 1]
cdq
idiv ecx
mov ebx, edx
mov dword [ebp - 0x14], ebx
call fcn.0040d04d
cmp ebx, dword [eax + 0x304]
jl 0x40d89f
lea edi, [ebp + 0x1c]
mov dword [0x41ff8c], ebx
call fcn.0040d692
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x58]
push eax
call fcn.0040a68a
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x1c
call fcn.0040a1f4
mov byte [ebp - 0xd], 1
jmp 0x40d963

Function at 0x40d99d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
or eax, 0xffffffff
cmp dword [esp + 8], ecx
ja 0x40d9ac
xor eax, eax
jmp 0x40d9cd
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x41cf50]
inc ecx
cmp ecx, dword [esp + 8]
jb 0x40d9ac
ret 8
Function at 0x40dc16
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
push 0x3f
mov esi, edx
pop ebx
cmp edi, 3
jl 0x40dc95
push 3
pop ebx
xor edx, edx
div ebx
push 0x3f
pop ebx
mov dword [ebp - 4], eax
imul eax, eax, 0xfffffffd
add edi, eax
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, ebx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, ebx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 6
and eax, ebx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
and edx, ebx
mov byte [ecx + 2], al
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx + 3], al
add esi, 3
add ecx, 4
dec dword [ebp - 4]
jne 0x40dc3b
test edi, edi
jne 0x40dc9e
mov byte [ecx], 0
jmp 0x40dce9
movzx eax, byte [esi]
shl eax, 0x10
dec edi
mov word [ecx + 3], 0x3d
je 0x40dcc8
movzx edx, byte [esi + 1]
shl edx, 8
or eax, edx
mov edx, eax
shr edx, 6
and edx, ebx
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx + 2], dl
jmp 0x40dccc
mov byte [ecx + 2], 0x3d
mov edx, eax
shr edx, 0xc
and edx, ebx
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
shr eax, 0x12
and eax, ebx
mov byte [ecx + 1], dl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx], al
pop edi
pop esi
mov al, 1
pop ebx
leave
ret
Function at 0x40e79f
Capabilities:
Check os version

Disassembly:
mov eax, 0x41440f
call fcn.004104dc
sub esp, 0x11c
cmp dword [esi + 0x595c], 0xffffffff
push ebx
push edi
jne 0x40e8c4
call fcn.0040e766
mov ebx, 0x41e9a8
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
and dword [esi + 0x595c], 0
mov ecx, 0x11c
mov edx, ecx
lea eax, [ebp - 0x128]
mov byte [eax], 0
inc eax
dec edx
jne 0x40e7e7
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x128], ecx
call edi
test eax, eax
jne 0x40e836
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x128], 0x114
call edi
test eax, eax
jne 0x40e836
and dword [esi + 0x595c], eax
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x40e8ca
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x118], ecx
jbe 0x40e8b2
push 2
pop eax
cmp dword [ebp - 0x118], eax
jne 0x40e8b9
cmp dword [ebp - 0x124], 6
jbe 0x40e861
mov dword [esi + 0x595c], 5
jmp 0x40e8b9
jne 0x40e880
cmp dword [ebp - 0x120], ecx
jae 0x40e855
cmp dword [ebp - 0x120], 0
jne 0x40e8b2
mov dword [esi + 0x595c], 3
jmp 0x40e8b9
cmp dword [ebp - 0x124], 5
jne 0x40e8b2
cmp dword [ebp - 0x120], eax
jne 0x40e899
mov dword [esi + 0x595c], eax
jmp 0x40e8b9
cmp dword [ebp - 0x120], ecx
je 0x40e891
cmp dword [ebp - 0x120], 0
jne 0x40e8b2
mov dword [esi + 0x595c], ecx
jmp 0x40e8b9
and dword [esi + 0x595c], 0
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x595c]
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40f0dd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x104
cmp dword [ebp + 0x7c], 1
jg 0x40f0f5
xor al, al
jmp 0x40f237
push ebx
push esi
xor ecx, ecx
push edi
mov byte [ebp + 0x6e], cl
xor eax, eax
mov edi, 0x100
mov byte [ebp + eax - 0x92], al
inc eax
cmp eax, edi
jl 0x40f104
mov word [ebp - 0x94], cx
xor esi, esi
movzx ecx, byte [ebp - 0x94]
movzx ecx, byte [ecx + str.pHG5AS4deKLil9ADdR2BcA1hTNm0FQz3Atruefriendissomeonewhothinksthatyouareagoodeggeventhoughheknowsthatyouareslightlycrackedgroove]
lea eax, [ebp + esi - 0x92]
movzx edx, byte [eax]
add ecx, edx
movzx edx, byte [ebp - 0x93]
add ecx, edx
and ecx, 0x800000ff
jns 0x40f14c
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 0x93], cl
mov dl, byte [eax]
movzx ecx, cl
lea ecx, [ebp + ecx - 0x92]
mov bl, byte [ecx]
mov byte [eax], bl
mov byte [ecx], dl
movzx eax, byte [ebp - 0x94]
inc eax
and eax, 0x8000001f
jns 0x40f178
dec eax
or eax, 0xffffffe0
inc eax
inc esi
mov byte [ebp - 0x94], al
cmp esi, edi
jl 0x40f119
xor edi, edi
mov byte [ebp + 0x6e], 1
cmp dword [ebp + 0x7c], edi
jle 0x40f232
movzx esi, byte [ebp - 0x93]
movzx eax, al
inc eax
and eax, 0x800000ff
jns 0x40f1ab
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x94], al
movzx eax, al
lea eax, [ebp + eax - 0x92]
movzx ecx, byte [eax]
add ecx, esi
and ecx, 0x800000ff
jns 0x40f1d0
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 0x93], cl
mov dl, byte [eax]
movzx ecx, cl
lea ecx, [ebp + ecx - 0x92]
mov bl, byte [ecx]
mov byte [eax], bl
mov byte [ecx], dl
movzx esi, byte [ebp - 0x93]
movzx eax, byte [ebp - 0x94]
movzx edx, byte [ebp + esi - 0x92]
movzx ebx, byte [ebp + eax - 0x92]
mov ecx, dword [ebp + 0x78]
add edx, ebx
and edx, 0x800000ff
jns 0x40f21b
dec edx
or edx, 0xffffff00
inc edx
movzx edx, dl
mov dl, byte [ebp + edx - 0x92]
xor byte [ecx + edi], dl
inc edi
cmp edi, dword [ebp + 0x7c]
jl 0x40f19c
pop edi
pop esi
mov al, 1
pop ebx
add ebp, 0x70
leave
ret 8

Function at 0x40f23e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [esp + 4], 0
je 0x40f251
cmp dword [esp + 8], 1
jle 0x40f251
jmp fcn.0040f0dd
xor al, al
ret 8
Function at 0x40f8fd
Capabilities:
Accept command line arguments
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, eax
call fcn.00409a86
test al, al
je 0x40f9d6
call fcn.0040cdd5
call fcn.0040ce03
push str.SeDebugPrivilege
call fcn.0040d516
push str.SeChangeNotifyPrivilege
call fcn.0040d516
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0040c17d
call fcn.0040bdbf
call fcn.0040e79f
cmp eax, 0x309
jne 0x40f95e
call fcn.0040cde3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x40f982
cmp dword [ebp - 8], 1
jne 0x40f982
mov edi, esi
call fcn.0040d0a7
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, esi
call fcn.0040d1cf
xor ebx, ebx
jmp 0x40f9ce
mov edi, esi
call fcn.0040d146
push esi
call fcn.0040d274
test al, al
jne 0x40f9db
push esi
call fcn.0040d43f
test al, al
jne 0x40f9db
xor edi, edi
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040c13c
test al, al
jne 0x40f9db
inc edi
cmp edi, 0xb4
jl 0x40f9b1
cmp byte [esi + 0x5958], bl
je 0x40f994
pop edi
pop esi
pop ebx
leave
ret
call fcn.0040ca67
push ebx
jmp 0x40f958
Function at 0x4031d0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x40320c
movzx eax, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x40322c
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00405644
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x4034c4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004053d4
test esi, esi
jne 0x4034fa
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004054c4
jmp 0x403518
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403368
mov edi, eax
test esi, esi
je 0x403518
cmp dword [ebx], 0
je 0x403518
dec esi
jmp 0x403501
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40354c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x64e008], 0x8088405
inc edx
mov dword [ebx + 0x64e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40424c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x64e024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4042e4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4042c4
xor eax, eax
push ebp
push 0x4042bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x404300
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4042c4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x64e024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x64e024], ax
mov esp, ebp
pop ebp
ret

Function at 0x405180
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x6e504c], 0
je 0x4051e1
cmp word [0x6e5220], 0xd7b2
jne 0x4051a9
cmp dword [0x6e5228], 0
jbe 0x4051a9
mov eax, 0x6e521c
call dword [0x6e5238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405208
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x64e030], 0
jne 0x4051fd
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405358
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x64e038], 0
je 0x40537e
mov edx, esi
mov eax, ebx
call dword [0x64e038]
jmp 0x40538d
mov eax, 8
call fcn.00402ff4
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x6e504d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405320
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc