joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401720
Capabilities:
Delete file
Move file

Disassembly:
jmp 0x401720
sub esp, 0x50c
mov eax, dword [0x48e0d0]
xor eax, esp
mov dword [esp + 0x508], eax
push 0x5c
push 0x48fcf0
call fcn.00408600
add eax, 1
lea edx, [esp + 0x20c]
add esp, 8
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x401750
push ebp
push esi
push edi
lea eax, [esp + 0x210]
push 0x476df4
push eax
call fcn.0040cff0
push 0x476df4
push 0
mov esi, eax
call fcn.0040cff0
mov edi, eax
push edi
xor ebp, ebp
push ebp
push esi
push str...log_
lea ecx, [esp + 0x334]
push str._s_s_d._s
push ecx
call fcn.0040cc80
lea edx, [esp + 0x33c]
push 0x476d2c
push edx
call fcn.0040c1b0
add esp, 0x30
test eax, eax
je 0x4017f2
push eax
add ebp, 1
call fcn.004077f0
push edi
push ebp
push esi
push str...log_
lea eax, [esp + 0x328]
push str._s_s_d._s
push eax
call fcn.0040cc80
lea ecx, [esp + 0x330]
push 0x476d2c
push ecx
call fcn.0040c1b0
add esp, 0x24
test eax, eax
jne 0x4017b6
test ebp, ebp
push ebx
mov ebx, ebp
jle 0x401856
lea esp, [esp]
push edi
lea eax, [ebx - 1]
push eax
push esi
push str...log_
lea edx, [esp + 0x24]
push str._s_s_d._s
push edx
mov dword [esp + 0x28], eax
call fcn.0040cc80
push edi
push ebx
push esi
push str...log_
lea eax, [esp + 0x13c]
push str._s_s_d._s
push eax
call fcn.0040cc80
add esp, 0x30
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebx, dword [esp + 0x10]
test ebx, ebx
jg 0x401800
push edi
push 0
push esi
push str...log_
lea eax, [esp + 0x24]
push str._s_s_d._s
push eax
call fcn.0040cc80
add esp, 0x18
lea ecx, [esp + 0x14]
push ecx
push 0x48fcf0
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x476dcc
push 0x48fcf0
call fcn.0040c1b0
add esp, 8
lea edx, [ebp + 1]
cmp edx, dword [0x48fcec]
mov dword [0x48fce8], eax
pop ebx
jne 0x4018c9
push edi
push ebp
push esi
push str...log_
lea eax, [esp + 0x20]
push str._s_s_d._s
push eax
call fcn.0040cc80
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x514]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040c270
add esp, 0x50c
ret
Function at 0x4060a0
Capabilities:
Enumerate processes

Disassembly:
jmp 0x4060a0
sub esp, 0x23c
mov eax, dword [0x48e0d0]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x250]
xor ebx, ebx
test edi, edi
mov dword [esp + 0x14], ebx
je 0x406234
push 0x47ad9c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov esi, dword [sym.agentmonitor.exe_Log]
je 0x406110
push str.WTSGetActiveConsoleSessionId
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40610a
push str.WTSGetActiveConsoleSessionId_Function_not_present_in_Kernel32.lib.
push 3
push 0x84
push str...main_srcAgentUtil.cpp
call esi
add esp, 0x10
jmp 0x406112
call eax
mov ebx, eax
jmp 0x406112
xor ebx, ebx
push edi
push str.GetProcessID:Given_Process_Name_:__S
push 3
push 0x90
push str...main_srcAgentUtil.cpp
call esi
push ebx
push str.Active_console_sessionid_is_:__d
push 3
push 0x91
push str...main_srcAgentUtil.cpp
call esi
add esp, 0x28
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x406173
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateToolhelp32Snapshot_failed_with_the_Error_:_d
push 3
push 0x95
push str...main_srcAgentUtil.cpp
call esi
add esp, 0x14
xor eax, eax
jmp 0x406238
lea ecx, [esp + 0x1c]
push ecx
push eax
mov dword [esp + 0x24], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40616c
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x40]
push edi
push edx
call fcn.0040f4d0
add esp, 8
test eax, eax
jne 0x406213
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4061fa
mov edx, dword [esp + 0x10]
push edx
push edi
push str.Session_ID_of__S_is__d_n
push 3
push 0xa7
push str...main_srcAgentUtil.cpp
call esi
add esp, 0x18
cmp dword [esp + 0x10], ebx
je 0x40622c
push edi
push str.session_id_of__S_is_does_not_match_with_active_console_session_id
push 3
push 0xb0
push str...main_srcAgentUtil.cpp
call esi
mov eax, dword [esp + 0x38]
mov dword [esp + 0x28], eax
jmp 0x406210
call ebp
push eax
push str.Problem_in_ProcessIdToSessionId_...__:__d.
push 3
push 0xb6
push str...main_srcAgentUtil.cpp
call esi
add esp, 0x14
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x406190
jmp 0x406234
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x406238
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040c270
add esp, 0x23c
ret

Function at 0x40c270
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48e0d0]
jne 0x40c27a
repz ret
jmp fcn.004212f0
Function at 0x41f9f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x48ed74]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41fa2b
mov ecx, dword [0x4900c8]
push ecx
call fcn.0041f910
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x48ed74]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x7ffe54a7
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
call 0x7ffe54b2
pop edx
xor dx, dx
add edx, 0xd5e0
xor ecx, ecx
mov cl, 0x1e
xor byte [ecx + edx], 0x74
loop 0x7ffe54c0
push dword fs:[0x24]
pop dword [edx + 0xa]
mov cl, 0xff
push edx
loop 0x7ffe54d2
mov dword [edx + 0x11], 0xffffacbb
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x1b], ecx
mov dword [edx + 0x100], ecx
mov dword [eax + 0x2c], esp
push 0
push 0
push 0
push 0
push 0x30
push 0x20
push 0
push 0
add edx, 0xffff7f39
push edx
push edx
push 0
call dword [edx + 0x820a]
add esp, 0x3f8
xor eax, eax
inc eax
stc
ret 0xc
Function at 0x408769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40c190
cmp edx, dword [eax]
je 0x40878b
add eax, 8
inc ecx
cmp eax, 0x40c220
jl 0x40877c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40c190]
jne 0x4088b9
mov eax, dword [0x40cbb0]
cmp eax, 1
je 0x408893
test eax, eax
jne 0x4087bc
cmp dword [0x40c0e4], 1
je 0x408893
cmp edx, 0xfc
je 0x4088b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4087f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00409670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00409490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x408836
lea eax, [ebp - 0x1a4]
push eax
call fcn.00409490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b45c
push edi
call fcn.00409f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00409670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00409680
lea eax, [ebp - 0xa0]
push 0x40b43c
push eax
call fcn.00409680
push dword [esi + 0x40c194]
lea eax, [ebp - 0xa0]
push eax
call fcn.00409680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00409e75
add esp, 0x2c
pop edi
jmp 0x4088b9
lea eax, [ebp + 8]
lea esi, [esi + 0x40c194]
push 0
push eax
push dword [esi]
call fcn.00409490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4068fb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40691f
xor eax, eax
test eax, eax
je 0x406932
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406932
xor ecx, ecx
jmp 0x406935
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a58
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43110c], 0
push esi
jne 0x406a8f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a69
mov dword [ecx*4 + 0x431108], eax
inc ecx
cmp ecx, 0x100
jl 0x406a64
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406ac0
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431108]
xor eax, esi
inc ecx
dec edx
jne 0x406aa2
pop edi
not eax
pop esi
ret 0xc

Function at 0x7ffe543e
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
xor eax, ecx
xor eax, ecx
and al, 0xff
not eax
not eax
push eax
pop eax
push bx
inc esp
inc esp
add al, 0
push bx
inc esp
inc esp
add al, 0
not eax
not eax
push eax
pop eax
pushf
popf
push eax
pop eax
cld
call 0x7ffe546e
pop edx
xor dx, dx
inc esi
dec esi
cld
push es
pop ds
add edx, 0xd5e0
xor ecx, ecx
stc
mov cl, 0x1e
xor byte [ecx + edx], 0x7d
loop 0x7ffe5482
push eax
pop eax
add al, 0
cld
push dword fs:[0x24]
pop dword [edx + 0xa]
clc
mov cl, 0xff
push edx
loop 0x7ffe549a
nop
add al, 0
mov dword [edx + 0x11], 0xffffacbb
push es
pop ds
mov ecx, dword [eax + 0x2c]
and bh, 0xff
mov dword [edx + 0x1b], ecx
and al, 0xff
mov dword [edx + 0x100], ecx
nop
mov dword [eax + 0x2c], esp
add al, 0
push 0
and bh, 0xff
push 0
and al, 0xff
push eax
pop eax
push 0
lea esp, [esp]
push 0
push es
pop ds
push 0x30
cld
push 0x20
add al, 0
push 0
and al, 0xff
nop
push es
pop ds
push 0
add edx, 0xffff7f39
nop
push edx
inc esi
dec esi
push eax
pop eax
push edx
stc
inc esi
dec esi
push 0
push eax
pop eax
add al, 0
call dword [edx + 0x820a]
cld
add esp, 0x3f8
add al, 0
xor eax, eax
inc esi
dec esi
and bh, 0xff
inc eax
add al, 0
ret 0xc
Function at 0x404de5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x404e07
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x404df8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x404f35
mov eax, dword [0x408a48]
cmp eax, 1
je 0x404f0f
test eax, eax
jne 0x404e38
cmp dword [0x4085d4], 1
je 0x404f0f
cmp edx, 0xfc
je 0x404f35
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404e6f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004032f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004033f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404eb2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004033f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.00405720
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004032f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403300
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.00403300
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403300
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405697
add esp, 0x2c
pop edi
jmp 0x404f35
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.004033f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x55362b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x553663
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x553651
mov al, 1
jmp 0x5536c2
cmp dword [ebx + 0x54], ecx
jne 0x55365a
mov al, 2
jmp 0x5536c2
cmp dword [ebx + 0x7c], ecx
jne 0x5536c2
mov al, 3
jmp 0x5536c2
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x553678
mov al, 4
jmp 0x5536c2
cmp ecx, 5
jne 0x553698
cmp ebx, 0
jne 0x553686
mov al, 5
jmp 0x5536c2
cmp ebx, 1
jne 0x55368f
mov al, 6
jmp 0x5536c2
cmp ebx, 2
jne 0x553698
mov al, 7
jmp 0x5536c2
cmp ecx, 6
jne 0x5536c0
cmp ebx, 0
jne 0x5536a6
mov al, 8
jmp 0x5536c2
cmp ebx, 1
jne 0x5536ad
mov al, 9
cmp ebx, 2
jne 0x5536b4
mov al, 0xa
cmp ebx, 3
jne 0x5536bb
mov al, 0xb
cmp ebx, 4
jne 0x5536c2
mov al, 0xc
pop ebx
leave
ret
Function at 0x5672b1
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x5672e9
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x5672d7
mov al, 1
jmp 0x567348
cmp dword [ebx + 0x54], ecx
jne 0x5672e0
mov al, 2
jmp 0x567348
cmp dword [ebx + 0x7c], ecx
jne 0x567348
mov al, 3
jmp 0x567348
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x5672fe
mov al, 4
jmp 0x567348
cmp ecx, 5
jne 0x56731e
cmp ebx, 0
jne 0x56730c
mov al, 5
jmp 0x567348
cmp ebx, 1
jne 0x567315
mov al, 6
jmp 0x567348
cmp ebx, 2
jne 0x56731e
mov al, 7
jmp 0x567348
cmp ecx, 6
jne 0x567346
cmp ebx, 0
jne 0x56732c
mov al, 8
jmp 0x567348
cmp ebx, 1
jne 0x567333
mov al, 9
cmp ebx, 2
jne 0x56733a
mov al, 0xa
cmp ebx, 3
jne 0x567341
mov al, 0xb
cmp ebx, 4
jne 0x567348
mov al, 0xc
pop ebx
leave
ret
Function at 0x413d2c
Capabilities:
Encode data using xor

Disassembly:
movzx eax, ax
lea eax, [eax*8 + 0x4784b8]
xor edx, edx
xor ecx, ecx
cmp dx, word [eax + 2]
jae 0x413d59
push esi
mov edx, dword [eax + 4]
movzx esi, cx
mov dl, byte [edx + esi]
xor dl, byte [eax]
xor dl, cl
inc ecx
mov byte [esi + edi], dl
cmp cx, word [eax + 2]
jb 0x413d41
pop esi
movzx eax, word [eax + 2]
mov byte [eax + edi], 0
ret

Function at 0x413d62
Capabilities:
Encode data using xor

Disassembly:
movzx eax, ax
lea eax, [eax*8 + 0x4784b8]
xor ecx, ecx
xor edx, edx
cmp cx, word [eax + 2]
jae 0x413da1
push ebx
push edi
mov edi, dword [eax + 4]
movzx ebx, byte [eax]
movzx ecx, dx
movsx di, byte [edi + ecx]
xor di, bx
xor di, dx
mov ebx, 0xff
and di, bx
inc edx
mov word [esi + ecx*2], di
cmp dx, word [eax + 2]
jb 0x413d78
pop edi
pop ebx
movzx eax, word [eax + 2]
xor ecx, ecx
mov word [esi + eax*2], cx
ret

Function at 0x4149ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi + 0x3c]
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [eax + edi + 0x78]
add esi, edi
cmp dword [esi + 0x18], 0
jbe 0x414a2f
mov ebx, dword [esi + 0x20]
add ebx, edi
test ebx, ebx
je 0x414a21
mov ecx, dword [ebx]
push dword [ebp + 8]
or eax, 0xffffffff
add ecx, edi
or edx, eax
call fcn.0042bc3c
test eax, eax
je 0x414a37
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add ebx, 4
cmp eax, dword [esi + 0x18]
jb 0x414a08
xor eax, eax
pop esi
pop ebx
leave
ret 4
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + edi]
mov ecx, dword [esi + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + edi]
add eax, edi
jmp 0x414a31

Function at 0x414ab0
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push esi
push edi
cld
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
mov ecx, 0x18
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x414ad3
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x414aca
cmp edi, 0x6a4abc5b
mov eax, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x414ac0
pop edi
pop esi
ret

Function at 0x41569c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, 0x4a8
push edx
push 0x476d88
push eax
call fcn.0042b0c1
mov ecx, dword [0x4a5cac]
add ecx, dword [0x4a60a0]
mov esi, edx
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x4156be
pop esi
ret
Function at 0x4232f9
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
imul eax, eax, 0x8088405
push 0x20
push 0
push dword [esp + 0xc]
inc eax
push 0
push eax
mov dword [ecx], eax
call fcn.00430081
push edx
push eax
call fcn.004300b5
ret 4

Function at 0x42331e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x108
push ebx
push esi
push edi
call fcn.0042bc28
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0xff
jge 0x42343e
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
call fcn.0042b917
test al, al
je 0x42343e
sub esi, 4
xor ebx, ebx
mov dword [ebp - 4], 0xcf671
test esi, esi
jle 0x42338a
push 8
lea ecx, [ebp - 4]
lea edi, [ebp + ebx - 0x108]
call fcn.004232f9
movsx ecx, al
mov al, byte [edi]
rol al, cl
inc ebx
mov byte [edi], al
cmp ebx, esi
jl 0x42336b
mov dword [ebp - 4], 0x3039
mov dword [ebp - 8], 0x100
push esi
lea ecx, [ebp - 4]
call fcn.004232f9
push esi
lea ecx, [ebp - 4]
movsx edi, al
call fcn.004232f9
dec dword [ebp - 8]
movsx ecx, al
lea ecx, [ebp + ecx - 0x108]
mov bl, byte [ecx]
lea eax, [ebp + edi - 0x108]
mov dl, byte [eax]
mov byte [eax], bl
mov byte [ecx], dl
jne 0x423398
xor edi, edi
mov dword [ebp - 4], 0xa564
test esi, esi
jle 0x4233f1
push 0x100
lea ecx, [ebp - 4]
call fcn.004232f9
xor byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
jl 0x4233d8
xor edi, edi
mov dword [ebp - 4], 0xd431
test esi, esi
jle 0x423417
push 0x100
lea ecx, [ebp - 4]
call fcn.004232f9
sub byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
jl 0x4233fe
xor eax, eax
test esi, esi
jle 0x423431
movzx ecx, byte [ebp + eax - 0x108]
mov edx, dword [ebp + 8]
mov word [edx + eax*2], cx
inc eax
cmp eax, esi
jl 0x42341d
mov ecx, dword [ebp + 8]
xor eax, eax
mov word [ecx + esi*2], ax
mov eax, esi
jmp 0x423440
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x423f2b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0xff
push edi
lea eax, [ebp - 0x100]
push eax
call fcn.0042b0c1
mov cl, byte [ebp - 0xff]
xor cl, byte [ebp - 0x100]
mov dl, byte [ebp - 0xfe]
xor eax, eax
or cl, 0x50
mov byte [ebp - 2], al
cmp dl, al
je 0x423f7d
push esi
lea esi, [ebp - 0xfe]
xor dl, cl
movzx edx, dl
mov word [edi + eax*2], dx
inc eax
inc esi
mov dl, byte [esi]
test dl, dl
jne 0x423f6b
pop esi
xor ecx, ecx
mov word [edi + eax*2], cx
leave
ret
Function at 0x424210
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
mov ecx, edi
call fcn.0042bc28
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0xff
jge 0x4242c2
lea ecx, [ebp - 0x100]
mov eax, edi
call fcn.0042b917
test al, al
je 0x4242c2
xor eax, eax
test esi, esi
jle 0x424259
xor byte [ebp + eax - 0x100], 0x5c
inc eax
cmp eax, esi
jl 0x42424c
mov bl, byte [ebp - 0x100]
cmp bl, 0xff
jne 0x424272
mov bl, byte [ebp - 0xfe]
lea eax, [ebp - 0xfd]
jmp 0x424278
lea eax, [ebp - 0xff]
movzx ecx, byte [eax]
lea ecx, [eax + ecx + 1]
movzx eax, bl
lea edx, [eax + ecx]
lea esi, [ebp + esi - 0x100]
cmp edx, esi
ja 0x4242c2
cmp eax, dword [ebp + 8]
jl 0x4242c2
cmp byte [ebp - 0x100], 0xff
jne 0x4242a4
add ecx, dword [ebp + 8]
sub bl, byte [ebp + 8]
movzx eax, bl
xor edx, edx
test eax, eax
jle 0x4242ba
movzx esi, byte [edx + ecx]
mov word [edi + edx*2], si
inc edx
cmp edx, eax
jl 0x4242ad
xor ecx, ecx
mov word [edi + eax*2], cx
jmp 0x4242c4
xor eax, eax
pop esi
pop ebx
leave
ret 4
Function at 0x42532e
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
test esi, esi
je 0x42545f
test edi, edi
je 0x42545f
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x42545f
mov ecx, dword [edi + 0x3c]
cmp ecx, 0x400
jg 0x42545f
add ecx, edi
cmp dword [ecx], 0x4550
jne 0x42545f
movzx eax, word [ecx + 4]
mov edx, 0x14c
cmp ax, dx
jne 0x4253e2
add edx, 0xffffffbf
cmp word [ecx + 0x18], dx
jne 0x4253e2
or dword [esi + 0x10], 0x10000
and dword [ebp - 4], 0
mov dword [esi + 0xc], edi
mov dword [esi], edi
mov dword [esi + 4], ecx
movzx edx, word [ecx + 0x14]
xor ebx, ebx
xor al, al
lea edx, [edx + ecx + 0x18]
cmp bx, word [ecx + 6]
jae 0x42544e
lea ebx, [edx + 0xc]
test al, al
jne 0x425455
mov eax, dword [ebx]
push dword [ebx - 4]
add eax, edi
push eax
call dword [0x471158]
mov ecx, dword [esi + 4]
movzx ecx, word [ecx + 6]
dec eax
neg eax
sbb al, al
inc al
inc dword [ebp - 4]
add ebx, 0x28
cmp dword [ebp - 4], ecx
jb 0x4253b1
jmp 0x42544a
mov edx, 0x8664
cmp ax, dx
jne 0x42545f
mov eax, 0x20b
cmp word [ecx + 0x18], ax
jne 0x42545f
or dword [esi + 0x10], 0x10000
and dword [ebp - 4], 0
mov dword [esi + 0xc], edi
mov dword [esi], edi
mov dword [esi + 8], ecx
movzx edx, word [ecx + 0x14]
xor ebx, ebx
xor al, al
lea edx, [edx + ecx + 0x18]
cmp bx, word [ecx + 6]
jae 0x42544e
lea ebx, [edx + 0xc]
test al, al
jne 0x425455
mov eax, dword [ebx]
push dword [ebx - 4]
add eax, edi
push eax
call dword [0x471158]
mov ecx, dword [esi + 8]
movzx ecx, word [ecx + 6]
dec eax
neg eax
sbb al, al
inc al
inc dword [ebp - 4]
add ebx, 0x28
cmp dword [ebp - 4], ecx
jb 0x42541f
test al, al
jne 0x425455
or dword [esi + 0x10], 0x20000
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov al, 1
jmp 0x425461
xor al, al
pop ebx
leave
ret 4
Function at 0x425466
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ecx, ecx
push esi
push edi
cmp dword [ebp + 8], ecx
je 0x425569
mov eax, dword [ebp + 0xc]
cmp eax, ecx
je 0x425569
cmp dword [ebp + 0x10], ecx
je 0x425569
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x425569
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
jne 0x425569
movzx eax, word [esi + 4]
mov edx, 0x14c
cmp ax, dx
je 0x4254c6
mov edx, 0x8664
cmp ax, dx
jne 0x425569
movzx eax, word [esi + 0x14]
lea eax, [eax + esi + 0x18]
mov dword [ebp + 0x10], eax
cmp eax, ecx
je 0x425569
movzx edx, word [esi + 6]
imul edx, edx, 0x28
mov edi, dword [eax + edx - 0x20]
add edi, dword [eax + edx - 0x1c]
mov eax, dword [esi + 0x50]
push 0x40
cmp edi, eax
push 0x1000
cmovb edi, eax
push edi
push ecx
call dword [0x471258]
mov ebx, eax
test ebx, ebx
je 0x425569
push edi
push ebx
call fcn.0042b126
push dword [esi + 0x54]
push dword [ebp + 0xc]
push ebx
call fcn.0042b0c1
xor eax, eax
xor edx, edx
cmp ax, word [esi + 6]
jae 0x425548
mov eax, dword [ebp + 0x10]
add eax, 0x14
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push dword [eax - 4]
push ecx
mov ecx, dword [eax - 8]
add ecx, ebx
push ecx
call fcn.0042b0c1
movzx ecx, word [esi + 6]
inc edx
add eax, 0x28
cmp edx, ecx
jb 0x425528
mov esi, dword [ebp + 8]
push 0x700
mov edi, ebx
call fcn.0042532e
test al, al
jne 0x425572
push 0x8000
push 0
push ebx
call dword [0x4711dc]
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov eax, esi
or dword [eax + 0x10], 0x1000000
mov al, 1
jmp 0x42556b