joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9eb920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9eb96c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9eb932
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9eb9d0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9eba22
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9eba28
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0xa03f15
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a03bd5

Function at 0xa08d0f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a08b8e

Function at 0xa0e2c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa0e2ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa0e2ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
mov ecx, 0xc9932d4
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x711a15da
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x60b7a6
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp]
sub eax, 0x22
cmp byte [eax], 0xe8
jne 0x60b885
add eax, dword [eax + 1]
add eax, 5
cmp word [eax], 0x25ff
jne 0x60b885
mov eax, dword [eax + 2]
push eax
mov eax, dword [eax + 4]
cmp word [eax], 0xe850
jne 0x60b885
add eax, dword [eax + 2]
add eax, 6
cmp dword [eax], 0x8bec8b55
jne 0x60b885
push eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x60b834
lea esi, [ebx + eax]
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
add ebp, ebx
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x60b7f6
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x60b7e7
cmp edx, 0x7946c61b
je 0x60b805
dec ecx
jne 0x60b7dd
xor eax, eax
jmp 0x60b834
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x60b834
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x60b834
xor eax, eax
mov dword [esp + 0x1c], eax
popal
test eax, eax
je 0x60b885
mov dword [ebp - 4], eax
push 0
push esp
push 0x40
push 0x40
push dword [esp + 0x18]
call dword [ebp - 4]
test eax, eax
je 0x60b885
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
sub ecx, eax
sub ecx, 6
mov dword [eax + 2], ecx
mov ecx, dword [ebp - 4]
sub ecx, eax
sub ecx, 0x27
mov dword [eax + 0x23], ecx
push esp
push 0x40
push 0x40
push dword [esp + 0x14]
call dword [ebp - 4]
test eax, eax
je 0x60b885
pop eax
pop ecx
pop eax
pop dword [eax + 4]
leave
ret
mov eax, 0
jmp 0x60b88f
mov esp, ebp
pop ebp
ret
Function at 0x63ad85
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp]
sub eax, 0x22
cmp byte [eax], 0xe8
jne 0x63ae64
add eax, dword [eax + 1]
add eax, 5
cmp word [eax], 0x25ff
jne 0x63ae64
mov eax, dword [eax + 2]
push eax
mov eax, dword [eax + 4]
cmp word [eax], 0xe850
jne 0x63ae64
add eax, dword [eax + 2]
add eax, 6
cmp dword [eax], 0x8bec8b55
jne 0x63ae64
push eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x63ae13
lea esi, [ebx + eax]
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
add ebp, ebx
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x63add5
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x63adc6
cmp edx, 0x7946c61b
je 0x63ade4
dec ecx
jne 0x63adbc
xor eax, eax
jmp 0x63ae13
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x63ae13
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x63ae13
xor eax, eax
mov dword [esp + 0x1c], eax
popal
test eax, eax
je 0x63ae64
mov dword [ebp - 4], eax
push 0
push esp
push 0x40
push 0x40
push dword [esp + 0x18]
call dword [ebp - 4]
test eax, eax
je 0x63ae64
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
sub ecx, eax
sub ecx, 6
mov dword [eax + 2], ecx
mov ecx, dword [ebp - 4]
sub ecx, eax
sub ecx, 0x27
mov dword [eax + 0x23], ecx
push esp
push 0x40
push 0x40
push dword [esp + 0x14]
call dword [ebp - 4]
test eax, eax
je 0x63ae64
pop eax
pop ecx
pop eax
pop dword [eax + 4]
leave
ret
mov eax, 0
jmp 0x63ae6e
mov esp, ebp
pop ebp
ret
Function at 0x6b339c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [0x1b0], 0
jne 0x6b3402
push 0x80000002
push 0
push 1
push 0x80000301
push 0
push 0x9c8
push 2
mov ebx, 0x24
mov eax, 0xb
call fcn.006f344d
add esp, 0x1c
mov dword [0x1b0], eax
cmp dword [0x1b0], 0
jne 0x6b3402
mov eax, dword [ebp + 8]
jmp 0x6b3554
mov eax, dword [0x1b0]
mov dword [ebp - 4], eax
pushal
cmp dword [eax + 8], 0
jne 0x6b3469
mov edx, dword fs:[0x20]
imul edx, dword fs:[0x24]
mov eax, dword fs:[0x2c]
xor eax, dword fs:[0x30]
imul eax, edx
imul edx, eax, 0x41c64e6d
imul edx, dword [ebp - 4]
add edx, 0x3039
mov ebx, dword [ebp - 4]
add ebx, 8
mov dword [ebx], edx
xor eax, eax
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
inc eax
add edx, eax
mov dword [ebx + eax*4], edx
cmp eax, 0x26f
jb 0x6b344a
call fcn.006b34e3
mov ecx, 1
test byte [eax + 4], 1
jne 0x6b346e
xchg dword [eax + 4], ecx
test ecx, ecx
jne 0x6b346e
cmp dword [eax], 0x270
jne 0x6b3488
call fcn.006b34e3
mov edx, dword [eax]
inc dword [eax]
mov ecx, dword [eax + edx*4 + 8]
mov dword [eax + 4], 0
mov eax, ecx
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp ecx, ebx
jg 0x6b34cd
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
sub ecx, ebx
inc ecx
test ecx, ecx
xor edx, edx
div ecx
mov eax, edx
add eax, ebx
mov dword [esp + 0x1c], eax
popal
leave
ret 8
mov esp, ebp
pop ebp
ret 8

Function at 0x6b34e3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xor esi, esi
mov edi, dword [ebp - 4]
push edi
push ebp
add edi, 8
mov ebp, edi
mov ebx, 0x18d
inc esi
mov edx, esi
xor eax, eax
cmp esi, 0x270
cmove edx, eax
mov edx, dword [ebp + edx*4]
xor edx, dword [edi]
and edx, 0x7fffffff
xor edx, dword [edi]
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0x9908b0df
and dl, 1
cmove ecx, eax
xor edx, edx
cmp ebx, 0x270
cmove ebx, edx
mov edx, ebx
xor ecx, dword [ebp + edx*4]
mov dword [edi], ecx
lea edi, [edi + 4]
inc ebx
cmp ebx, 0x18d
jne 0x6b34f4
pop ebp
pop eax
mov dword [eax], 0
ret
Function at 0x403860
Capabilities:
Packed with generic packer

Disassembly:
sub ecx, eax
mov eax, dword [ebp - 4]
sbb eax, edx
push eax
mov eax, dword [0x4117f0]
xchg edi, eax
mov ebx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
rol byte [ebx], 1
jge 0x403825
rol byte [ebx], 1
jge 0x403825
mov ecx, ebx
clc
sbb ecx, dword [ebx + 0x6d1b8055]
push eax
push ecx
adc dword [eax - 0x5f], 0x410ba8
dec ebx
push 0x40e07e
add dh, dl
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebx]
daa
and ch, byte [edi + edi*8 + 0x3d8b00c4]
invalid
cdq
push edx
push eax
mov eax, dword [ebp - 0x1c]
les edx, [ecx - 0x18]
scasd eax, dword es:[edi]
jge 0x403831
add byte [edx], bh
mov edx, dword [ebp - 0x24]
loope 0x4037d9
test al, 0xad
inc ecx
add byte [edi + 0x52], dl
push ebx
push edi
push edi
push eax
push str._tr__s__th__s_Total:__th__td__s__5I64d__td__td__s__5I64d__td__td__s__5I64d__td___tr__n
call 0x3104bc22
push 0x90588b
call esi
wait
les eax, [edi + ebx*2]
pop esi
push edx
je 0x403840
pop ebp
cmp eax, dword [eax + edx*4 - 0x1374aa70]
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4102a8]
mov ecx, dword [0x40d021]
push ebx
push esi
cmp edi, dword [edi + edx*2 + 0xf]
lea ebx, [ecx + eax]
add byte [eax], al
mov esi, dword [ebp + 8]
xor edx, dword [ebx - 0x75]
pop ecx
mov dword [esi - 0x66], ebx
add bl, 0x89
pop esi
adc byte [ecx + 0x64799e], cl
add byte [eax - 0x62], dh
and byte [eax], cl
add byte [eax], al
mov dword [esi + 0x828], ebx
mov dword [esi + 0x14], ebx
je 0x4038aa
push eax
call 0x27411413
jmp 0x4038b9
mov ecx, dword [0x2141214c]
push ebx
mov byte [edx + 0x16a7e856], ah
add byte [ebx + ecx*4], dl
push ss
mov edx, dword [esi]
pop es
cld
jge 0x403900
mov esp, 0x819f6c0c
adc byte [ebp + 0x16a047e], cl
dec esi
popal
call 0x40c186
cmp esp, dword [0x68500e74]
cmp al, ch
insb byte es:[edi], dx
add al, ch
pushal
mov bl, 0xff
inc dword [ebx - 0x58cff73c]
jge 0x4038e8
push 8
push edx
or esp, ecx
fld dword [eax]
add byte [ebx], bh
ret
or byte [edx + 9], dl
int3
mov byte [ecx], cl
cli
or byte [ecx + 0x41026c], ah
cmp eax, ebx
je 0x40395b
push eax
mov eax, dword [edi]
push 0x2c
push eax
call 0x4130b0
cmp eax, ebx
je 0x40392e
cmp eax, 0xba011187
je 0x40392e
push eax
push 0x99cfe814
call 0x7f401ef1
add esp, 8
mov ecx, dword [0x49026c]
mov edx, dword [eax + 0x806851]
add byte [eax], al
push edx
call int.00408dcc
das
movsd dword es:[edi], dword [esi]
mov bl, 0x15
cmp eax, 0x11187
je 0x40395b
push eax
push 0x11e7fc
call 0xffe21e40
add esp, 8
jno 0x4038fd
xor byte [esi], dl
mov dword [0x2c410bb8], eax
mov ch, 0x15
movsb byte es:[edi], byte [esi]
lodsb al, byte [esi]
inc ecx
add byte [ebx + 0x30688917], cl
xor al, 0
add byte [ecx + 0x410ba4], ah
pushal
xchg byte [eax + ecx], dh
add byte [eax], al
mov ebx, dword [edx]
cld
pop ss
stc
add byte [ecx - 0x40], dl
call 0xe26840
mov ebx, eax
and al, 0xdb
je 0x9c403a5d
cmp ebx, 0xfe7975f1
invalid
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x40241c
Capabilities:
Get file attributes

Disassembly:
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
pop edx
pop ecx
ret

Function at 0x402427
Capabilities:
Set file attributes

Disassembly:
push ecx
push edx
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
pop ecx
ret

Function at 0x4026f7
Capabilities:
Accept command line arguments

Disassembly:
push eax
xor edx, edx
mov dl, 0xff
push 0x10
pop eax
call fcn.00402e80
pop eax
push eax
xor eax, eax
cdq
mov dl, 0xf
call fcn.00402e80
call sub.KERNEL32.DLL_ExitProcess
push ebx
push ecx
push edx
push esi
push edi
enter 0x40, 0
mov ebx, 0x400
mov edx, 0x113
lea eax, [ebp - 0x40]
call fcn.00402ed1
call sub.KERNEL32.DLL_GetCommandLineA
mov edx, eax
call fcn.004022e6
mov ecx, eax
mov ebx, eax
lea eax, [ebp - 0x40]
call fcn.00402f05
lea eax, [ecx + 1]
call fcn.00401ed1
mov dword [ebp - 4], eax
mov eax, ecx
shr eax, 1
shl eax, 2
add eax, 4
xor esi, esi
call fcn.00401ed1
mov dword [ebp - 8], eax
mov edx, eax
lea eax, [ebp - 0x40]
call fcn.00402f7e
mov edi, esi
mov ecx, eax
shl edi, 2
mov eax, edx
test ecx, ecx
je 0x40277a
mov edi, dword [ebp - 4]
add edx, 4
inc esi
mov dword [eax], edi
mov eax, edi
mov bl, byte [ecx]
inc ecx
mov byte [eax], bl
inc eax
test bl, bl
jne 0x40276b
mov dword [ebp - 4], eax
jmp 0x40274b
mov eax, dword [ebp - 8]
mov dword [0x405900], esi
mov dword [edx], ecx
lea edx, [edi + 4]
mov dword [0x405904], eax
call fcn.00403028
lea eax, [ebp - 0x40]
xor edx, edx
call fcn.00403038
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x4028d3
Capabilities:
Inspect section memory permissions

Disassembly:
push esi
push edi
push ebp
mov ebp, esp
push ebx
push ecx
cmp byte [eax], 0
je 0x402905
cmp byte [eax + 1], 0
je 0x4028f7
jmp 0x402905
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
jmp 0x4029d9
push 0xfffffffffffffff5
jmp 0x4028e9
mov bl, byte [eax]
cmp bl, 0x3c
jb 0x402905
jbe 0x4028e7
cmp bl, 0x3e
je 0x4028f3
mov ecx, dword [ebp - 4]
and ecx, 7
xor esi, esi
cmp ecx, 1
jb 0x402934
jbe 0x40292d
cmp ecx, 2
jbe 0x402926
cmp ecx, 4
jne 0x40294b
or esi, 0x80000000
jmp 0x40294b
mov esi, 0xc0000000
jmp 0x40294b
mov esi, 0x40000000
jmp 0x40294b
test ecx, ecx
jmp 0x40291c
or bl, 3
jmp 0x40296c
mov ebx, 1
jmp 0x40296c
mov ebx, 2
jmp 0x40296c
mov ecx, dword [ebp - 4]
and ecx, 0x70
xor ebx, ebx
cmp ecx, 0x20
jb 0x402968
jbe 0x40293d
cmp ecx, 0x30
jb 0x40296c
jbe 0x402944
cmp ecx, 0x40
je 0x402938
jmp 0x40296c
test ecx, ecx
jbe 0x402938
mov edi, dword [ebp - 8]
test byte [ebp - 3], 0x40
je 0x40297b
or edi, 0x80000000
test byte [ebp - 3], 1
je 0x402987
or edi, 0x20000000
xor ecx, ecx
cmp edx, 0x10
jb 0x4029bf
jbe 0x4029aa
cmp edx, 0x11
jbe 0x4029b1
cmp edx, 0x12
je 0x4029b8
jmp 0x4029cb
mov ecx, 3
jmp 0x4029cb
mov ecx, 5
jmp 0x4029cb
mov ecx, 1
jmp 0x4029cb
mov ecx, 4
jmp 0x4029cb
mov ecx, 2
jmp 0x4029cb
cmp edx, 1
jb 0x4029cb
jbe 0x40299c
cmp edx, 2
je 0x4029a3
push 0
push edi
push ecx
push 0
push ebx
push esi
push eax
call sub.KERNEL32.DLL_CreateFileA
mov edx, eax
mov eax, edx
leave
pop edi
pop esi
ret
Function at 0x402a8e
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
push ebp
mov ebp, esp
push eax
push edx
push ebx
mov esi, ebx
cmp ebx, 0xc350
jbe 0x402ab1
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetConsoleMode
test eax, eax
jne 0x402ad3
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x402acc
mov ebx, dword [ebp - 0xc]
jmp 0x402b16
mov ebx, 0xffffffff
jmp 0x402b16
xor edi, edi
mov ebx, 0x7d00
cmp esi, ebx
jae 0x402ae0
mov ebx, esi
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x402b01
test edi, edi
jne 0x402b14
mov edi, 0xffffffff
jmp 0x402b14
add edi, dword [ebp - 0xc]
cmp ebx, dword [ebp - 0xc]
jne 0x402b14
cmp esi, ebx
jbe 0x402b14
add dword [ebp - 8], ebx
sub esi, ebx
jmp 0x402ad5
mov ebx, edi
mov eax, ebx
leave
pop edi
pop esi
pop ecx
ret

Function at 0x403210
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
mov eax, 0x3020100
mov dword [edx], eax
add eax, 0x4040404
add edx, 4
test al, al
jne 0x403219
ret 4
Function at 0x30030e08
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x30034158
call fcn.3003107e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x3006bf28
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x30030bf8
cmp eax, esi
jne 0x30030beb
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x30030bfb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30030bd2
xor esi, esi
inc esi
mov eax, dword [0x3006bf24]
cmp eax, esi
jne 0x30030c0e
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x30030c49
mov eax, dword [0x3006bf24]
test eax, eax
jne 0x30030c43
mov dword [0x3006bf24], esi
push 0x30001378
push 0x3000136c
call fcn.30190000
pop ecx
pop ecx
test eax, eax
je 0x30030c49
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x30030d20
mov dword [0x3006bbd0], esi
mov eax, dword [0x3006bf24]
cmp eax, esi
jne 0x30030c6d
push 0x30001368
push 0x30001350
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x3006bf24], 2
cmp dword [ebp - 0x1c], ebx
jne 0x30030c7a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x3006bf34], ebx
je 0x30030c9b
push 0x3006bf34
call fcn.3003143c
pop ecx
test eax, eax
je 0x30030c9b
push ebx
push 2
push ebx
call dword [0x3006bf34]
mov eax, dword [0x3006bbb8]
mov ecx, dword [sym.imp.MSVCR80.dll___winitenv]
mov dword [ecx], eax
push dword [0x3006bbb8]
push dword [0x3006bbbc]
push dword [0x3006bbb4]
call fcn.3001c6cd
add esp, 0xc
mov dword [0x3006bbcc], eax
cmp dword [0x3006bbc0], ebx
jne 0x30030d06
push eax
call dword [sym.imp.MSVCR80.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR80.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x3006bbd0], ebx
jne 0x30030d14
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3006bbcc]
call fcn.300310c3
ret
call fcn.3003051e
jmp 0x30030bb0

Function at 0x30031694
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
inc esi
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x300316c2
xor eax, eax
jmp 0x300316ea
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x300316df
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x300316ef
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret 4
Function at 0x403918
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x10a91008], 0x8088405
inc edx
mov dword [ebx + 0x10a91008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41df90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov eax, dword [eax + 0x78]
add eax, ebx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0xc]
cmp edx, 0xffff
jbe 0x41e014
test esi, esi
jbe 0x41e02b
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00408cc8
test eax, eax
jne 0x41e006
mov eax, dword [ebp - 8]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x41e02b
add dword [ebp - 8], 2
add edi, 4
dec esi
test esi, esi
ja 0x41dfe3
jmp 0x41e02b
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e02b
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8