joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62a0bbc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov al, byte [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x18]
mov dword [edx], ecx
mov byte [edx + 4], al
lea esi, [esp + 0x2c]
push edx
push esi
call fcn.06285f1f
pop eax
pop ecx
mov eax, dword [esi]
cmp eax, 0x80000000
je 0x62a0c09
cmp eax, 0x80000001
jne 0x62a0c1c
mov eax, dword [esp + 0x30]
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov byte [esi], 6
jmp 0x62a0ddd
mov esi, dword [ebp + 8]
mov byte [esi], 5
and dword [esi + 4], 0
and dword [esi + 0xc], 0
jmp 0x62a0ddd
and dword [esp + 0xc], 0
mov ecx, dword [esp + 0x30]
and dword [esp + 0x14], 0
mov edx, dword [esp + 0x34]
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], ecx
lea esi, [esp + 0xd0]
lea eax, [esp + 0x18]
push eax
push esi
call fcn.0628602d
pop eax
pop ecx
cmp byte [esi], 6
jne 0x62a0c73
mov eax, dword [esp + 0xd4]
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov byte [esi], 6
lea eax, [esp + 0x50]
push eax
call fcn.062b1154
pop eax
jmp 0x62a0dd2
lea eax, [esp + 0x50]
lea ecx, [esp + 0xc]
lea edi, [esp + 0x78]
push esi
push eax
push ecx
push edi
call fcn.062d53db
add esp, 0x10
mov ecx, edi
call fcn.062a1857
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.06285f1f
pop eax
pop ecx
mov esi, dword [esp + 0x20]
cmp esi, 0x80000000
je 0x62a0d80
cmp esi, 0x80000001
je 0x62a0d7a
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x44], esi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x9c]
push eax
call fcn.0628602d
pop eax
pop ecx
cmp byte [esp + 0x98], 6
je 0x62a0db5
movsd xmm0, qword [esp + 0xa8]
lea eax, [esp + 0x78]
movsd qword [eax + 0x14], xmm0
movups xmm0, xmmword [esp + 0x98]
movups xmmword [eax + 4], xmm0
mov ecx, eax
movups xmm0, xmmword [esp + 0x78]
movups xmm1, xmmword [esp + 0x84]
movaps xmmword [esp + 0x50], xmm0
movups xmmword [esp + 0x5c], xmm1
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], edi
lea eax, [esp + 0x50]
movups xmm0, xmmword [eax + 4]
movaps xmmword [esp + 0xb0], xmm0
movsd xmm0, qword [eax + 0x14]
movsd qword [esp + 0xc0], xmm0
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x14]
push eax
mov esi, ecx
push ecx
call fcn.062d53db
add esp, 0x10
mov ecx, esi
jmp 0x62a0c8d
mov esi, dword [esp + 0x24]
jmp 0x62a0dc7
mov eax, dword [esp + 0x14]
mov dword [esp + 0x83], eax
movsd xmm0, qword [esp + 0xc]
movsd qword [esp + 0x7b], xmm0
mov esi, dword [ebp + 8]
mov byte [esi], 5
movsd xmm0, qword [esp + 0x78]
movsd xmm1, qword [esp + 0x7f]
movsd qword [esi + 1], xmm0
movsd qword [esi + 8], xmm1
jmp 0x62a0ddd
mov esi, dword [esp + 0x9c]
lea eax, [esp + 0x44]
push eax
call fcn.062b1154
pop eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], esi
mov esi, eax
mov byte [eax], 6
lea eax, [esp + 0xc]
push eax
call fcn.062d6614
pop eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x62a883e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x108
mov edi, dword [esp + 0x12c]
mov eax, 0xfffffeff
lea ecx, [edi + eax]
cmp ecx, eax
jbe 0x62a895c
mov esi, dword [esp + 0x128]
lea eax, [esp + 6]
push 0x102
push 0
push eax
call fcn.062ffa00
add esp, 0xc
xor eax, eax
cmp eax, 0x100
je 0x62a888a
mov byte [esp + eax + 6], al
inc eax
jmp 0x62a887c
xor ecx, ecx
xor ebx, ebx
cmp ecx, 0x100
je 0x62a88bd
mov al, byte [esp + ecx + 6]
mov byte [esp], al
add bl, al
mov eax, ecx
xor edx, edx
div edi
add bl, byte [esi + edx]
movzx eax, bl
mov dl, byte [esp + eax + 6]
mov byte [esp + ecx + 6], dl
mov dl, byte [esp]
mov byte [esp + eax + 6], dl
inc ecx
jmp 0x62a888e
push 0
mov edi, dword [esp + 0x128]
push edi
call fcn.062b1109
pop ecx
pop ecx
mov dword [esp], eax
mov esi, edx
push edi
push dword [esp + 0x124]
push edx
call fcn.062ff480
add esp, 0xc
mov cl, byte [esp + 0x106]
mov al, byte [esp + 0x107]
inc cl
movzx ebp, cl
xor edx, edx
cmp dword [esp + 0x124], edx
je 0x62a8938
lea ebx, [edx + ebp]
movzx ebx, bl
mov ah, byte [esp + ebx + 6]
add al, ah
movzx edi, al
mov cl, byte [esp + edi + 6]
mov byte [esp + ebx + 6], cl
mov byte [esp + edi + 6], ah
add ah, byte [esp + ebx + 6]
mov ecx, dword [esp + 0x120]
mov cl, byte [ecx + edx]
movzx edi, ah
xor cl, byte [esp + edi + 6]
mov byte [esi + edx], cl
inc edx
jmp 0x62a88f9
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp]
mov dword [eax], ecx
mov dword [eax + 4], esi
mov ecx, dword [esp + 0x124]
mov dword [eax + 8], ecx
add esp, 0x108
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6315250
push 0x35
push 0x6315219
call fcn.0630eaf0
Function at 0x62d7d72
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov al, byte [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x1c]
mov dword [edx], ecx
mov byte [edx + 4], al
lea esi, [esp + 0x4c]
push edx
push esi
call fcn.062d7666
pop eax
pop ecx
mov eax, dword [esi]
cmp eax, 0x80000000
je 0x62d7dbf
cmp eax, 0x80000001
jne 0x62d7dd2
mov eax, dword [esp + 0x50]
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov byte [esi], 6
jmp 0x62d7f80
mov esi, dword [ebp + 8]
mov byte [esi], 5
and dword [esi + 4], 0
and dword [esi + 0xc], 0
jmp 0x62d7f80
and dword [esp + 0xc], 0
mov ecx, dword [esp + 0x50]
and dword [esp + 0x14], 0
mov edx, dword [esp + 0x54]
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], edx
mov dword [esp + 0x74], ecx
lea esi, [esp + 0xd0]
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.062d7774
pop eax
pop ecx
cmp byte [esi], 6
jne 0x62d7e29
mov eax, dword [esp + 0xd4]
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov byte [esi], 6
lea eax, [esp + 0x70]
push eax
call fcn.062b1154
pop eax
jmp 0x62d7f75
lea eax, [esp + 0x70]
lea ecx, [esp + 0xc]
lea edi, [esp + 0x30]
push esi
push eax
push ecx
push edi
call fcn.062d53db
add esp, 0x10
mov ecx, edi
call fcn.062d684e
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.062d7558
pop eax
pop ecx
mov esi, dword [esp + 0x24]
cmp esi, 0x80000000
je 0x62d7f29
cmp esi, 0x80000001
je 0x62d7f23
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x64], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], ebx
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.062d7774
pop eax
pop ecx
cmp byte [esp + 0x30], 6
je 0x62d7f5b
movsd xmm0, qword [esp + 0x40]
movsd qword [esp + 0xc0], xmm0
movups xmm1, xmmword [esp + 0x30]
movaps xmmword [esp + 0xb0], xmm1
movsd qword [edi + 0x14], xmm0
movups xmmword [edi + 4], xmm1
movups xmm0, xmmword [esp + 0x30]
movups xmm1, xmmword [esp + 0x3c]
movaps xmmword [esp + 0x70], xmm0
movups xmmword [esp + 0x7c], xmm1
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], ebx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x70]
movups xmm0, xmmword [eax + 4]
movaps xmmword [esp + 0x90], xmm0
movsd xmm0, qword [eax + 0x14]
movsd qword [esp + 0xa0], xmm0
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x14]
push eax
jmp 0x62d7e38
mov esi, dword [esp + 0x28]
jmp 0x62d7f6a
mov eax, dword [esp + 0x14]
mov dword [esp + 0x3b], eax
movsd xmm0, qword [esp + 0xc]
movsd qword [esp + 0x33], xmm0
mov esi, dword [ebp + 8]
mov byte [esi], 5
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x37]
movsd qword [esi + 1], xmm0
movsd qword [esi + 8], xmm1
jmp 0x62d7f80
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x64]
push eax
call fcn.062b1154
pop eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], esi
mov esi, eax
mov byte [eax], 6
lea eax, [esp + 0xc]
push eax
call fcn.062d6614
pop eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x62f7c0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov esi, dword [esp + 0x68]
mov ebp, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov ebx, dword [eax]
lea edi, [ebx + 0x28]
mov ecx, edi
call fcn.062edd3a
cmp byte [ebx + 0x78], 0
je 0x62f7c40
push ebp
call fcn.062f4908
pop eax
mov byte [esi], 4
jmp 0x62f7d81
lea eax, [ebx + 0x30]
movzx ecx, byte [esp + 0x74]
push ecx
push ebp
push eax
call fcn.062edcba
add esp, 0xc
lock inc dword [ebx + 0xa0]
mov eax, dword [ebx + 0x9c]
test eax, eax
je 0x62f7c80
lock dec dword [ebx + 0x9c]
inc dword [ebx + 0x60]
add ebx, 0x90
mov ecx, ebx
call fcn.062f5dc0
jmp 0x62f7d7e
mov eax, dword [ebx + 0x98]
cmp eax, dword [ebx + 0x94]
je 0x62f7d7e
mov eax, dword [ebx + 0x64]
test eax, eax
je 0x62f7dc0
mov dword [esp + 4], eax
lock inc dword [eax]
jle 0x62f7dd1
mov eax, dword [ebx + 0x74]
mov dword [esp], eax
lea ebp, [esp + 0x14]
mov dword [ebp + 8], 0x80000000
and dword [ebp], 0
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov edx, dword [ecx + 8]
dec edx
and edx, 0xfffffff8
add eax, edx
add eax, 8
lea edx, [esp + 0x3c]
push eax
push edx
call dword [ecx + 0x14]
add esp, 8
lea eax, [esp + 0x28]
lea ecx, [esp + 0x3c]
push ecx
push ebp
push eax
call fcn.062dbe40
add esp, 0xc
cmp dword [ebx + 8], 0
je 0x62f7d05
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x78]
call fcn.062f4549
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov ebp, dword [esp]
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
lea ecx, [esp + 8]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2c]
push eax
push ecx
call fcn.062f54a8
add esp, 0xc
lea eax, [esp + 8]
cmp dword [eax], 0
je 0x62f7d92
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x48]
mov dword [ecx + 8], eax
movsd xmm0, qword [esp + 8]
movsd qword [ecx], xmm0
lock inc dword [ebx + 0x98]
inc dword [ebx + 0x74]
add ebx, 0x40
push ecx
push ebp
push ebx
lea ebx, [esp + 0x20]
push ebx
call fcn.062f17c4
add esp, 0x10
mov ecx, ebx
call fcn.062f595f
mov byte [esi], 5
mov ecx, edi
call fcn.062edd5c
mov eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
lea ebp, [esp + 0xc]
mov ecx, ebp
call fcn.062f4e58
cmp al, 0xd
jne 0x62f7db4
mov eax, dword [ebx + 0x98]
test eax, eax
je 0x62f7db4
push ebp
call fcn.06283a64
pop eax
jmp 0x62f7d7e
movsd xmm0, qword [esp + 0xc]
movsd qword [esi], xmm0
jmp 0x62f7d81
push 0x6334d50
push 0x2e
push 0x6334cfc
call fcn.0630eaf0
ud2

Function at 0x62ff009
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x6311018]
test eax, eax
je 0x62ff048
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x62ff048
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x62ff048
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x62ff048
cmp dword [ecx + 0x74], 0xe
jbe 0x62ff048
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x630d900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x630d92d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x630d92d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x630ec70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x630ecc2
cmp eax, 1
jne 0x630ecd0
mov dword [esp], 0x6317da2
mov edx, 2
jmp 0x630ecdc
mov dword [esp], 0x6317da0
mov edx, 2
jmp 0x630ecdc
mov edx, 7
mov dword [esp], 0x6317da4
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x630ed44
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x6317ddc
mov dword [esp + 0x3c], 3
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x62bd3b0
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x62bd390
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x62bd390
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
jmp 0x630edbd
movsd xmm0, qword [ecx + 0x10]
movups xmm1, xmmword [ecx]
mov edx, esp
lea esi, [esp + 0x50]
mov dword [esp + 0x38], 0x6317e10
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 8]
mov dword [esp + 0x1c], 0x62bd3b0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x62b7880
lea esi, [esp + 0x10]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x62bd390
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x62bd390
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movups xmmword [esp + 0x50], xmm1
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.0630ea20
int3
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x42e000
Capabilities:
Encode data using base64
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x5d9a4a
Capabilities:
Encode data using xor

Disassembly:
pop eax
cmp eax, 0xa1fb3c37
mov edi, esp
mov esp, dword [0x30feb064]
dec edx
mov ah, 0x8a
and eax, 0xd434bad
cmp al, 0xfb
mov eax, dword [0x258bfc8b]
mov al, 0xfe
xor byte [edx - 0x4c], cl
mov ah, byte [0xd434bad]
jge 0x5d99fc
push 0x17fcad20
mov edx, 0xa1fafda1
mov ah, 0xfc
mov esp, dword [0x8e8eb134]
insd dword es:[edi], dx
retf
jb 0x5d9a82
adc dword [edi], edx
jmp 0x622f371d
mov eax, ebx
jae 0x5d9a3b
loopne 0x5d9a92
add byte [ebp - 0x2a], dl
push ebp
in eax, dx
dec ecx
jp 0x5d99f9
xchg ecx, eax
mov bh, ah
adc eax, 0x30852dbd
dec ecx
mov eax, dword [0x85ad258a]
ret 0x4937
and eax, 0x25fa70b0
lodsd eax, dword [esi]
cld
mov cl, byte [edx - 0x5f]
jo 0x5d9a9e
cmp dword [esi - 0x52dce731], ebp
cld
mov ecx, dword [esi + 0x6b418246]
retf 0x3ff
and ebp, dword [ebp + 0x468e8bfc]
add byte [ecx + 0x6b], 0xca
inc dword [ebx]
mov dh, 0x7c
test al, 0xfc
add byte [esi*8 - 0x352df9b], 0x8b
mov byte [esi], ah
call 0xc6f2ce06
mov eax, dword [0xd39dad25]
jecxz 0x5d9ac6
xchg dword [ecx - 0x1f218c28], ecx
xor eax, dword [eax]
push ebp
salc
push ebp
in eax, dx
dec ecx
jp 0x5d9a59
xchg edx, eax
xchg ecx, eax
mov bh, ah
adc eax, 0x30852dbd
dec ecx
movsd dword es:[edi], dword [esi]
mov esp, dword [0x37c285ad]
dec ecx
int 0x8b
and eax, 0x6b4183ad
lodsd eax, dword [esi]
inc dword [ebx]
mov dh, 0x7c
test al, 0xfc
add byte [esi*8 - 0x352d837], 0x8b
mov byte [esi], ah
call 0x336bce4a
Function at 0x401c90
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
jne 0x401c9f
xor eax, eax
ret
mov eax, 1
ret

Function at 0x405230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x44e664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
push 0x1f4
lea ecx, [ebp - 0x1f8]
push 0
push ecx
mov dword [ebp - 0x200], eax
call fcn.0042a2b0
add esp, 0xc
push 0x447570
lea edx, [ebp - 0x1f8]
push edx
call dword [0x43f014]
mov esi, dword [0x43f010]
lea eax, [ebp - 0x1f8]
push eax
call esi
lea ecx, [ebp - 0x1f8]
push ecx
call esi
lea edx, [ebp - 0x1f8]
push edx
call esi
lea eax, [ebp - 0x1f8]
push eax
call esi
lea ecx, [ebx + 1]
push ecx
push 0x40
call dword [0x43f018]
lea edx, [ebp - 0x1f8]
mov edi, eax
push edx
mov dword [ebp - 0x1fc], edi
call esi
lea eax, [ebp - 0x1f8]
push eax
call esi
lea ecx, [ebp - 0x1f8]
push ecx
call esi
lea edx, [ebp - 0x1f8]
push edx
call esi
lea eax, [ebp - 0x1f8]
push eax
mov byte [ebx + edi], 0
call esi
lea ecx, [ebp - 0x1f8]
push ecx
call esi
lea edx, [ebp - 0x1f8]
push edx
call esi
lea eax, [ebp - 0x1f8]
push eax
call esi
xor edi, edi
test ebx, ebx
je 0x405384
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x204], eax
lea ecx, [ebp - 0x1f8]
push ecx
call esi
lea edx, [ebp - 0x1f8]
push edx
call esi
lea eax, [ebp - 0x1f8]
push eax
call esi
mov ecx, dword [ebp - 0x200]
push ecx
call fcn.0042a410
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp - 0x200]
add esp, 4
mov cl, byte [edx + eax]
mov edx, dword [ebp - 0x1fc]
lea eax, [edi + edx]
mov edx, dword [ebp - 0x204]
xor cl, byte [edx + eax]
mov byte [eax], cl
lea eax, [ebp - 0x1f8]
push eax
call esi
lea ecx, [ebp - 0x1f8]
push ecx
call esi
lea edx, [ebp - 0x1f8]
push edx
call esi
inc edi
cmp edi, ebx
jb 0x405315
lea eax, [ebp - 0x1f8]
push eax
call esi
lea ecx, [ebp - 0x1f8]
push ecx
call esi
lea edx, [ebp - 0x1f8]
push edx
call esi
push 0x1f4
lea eax, [ebp - 0x1f8]
push 0
push eax
call fcn.0042a2b0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1fc]
add esp, 0xc
pop edi
xor ecx, ebp
pop esi
call fcn.0042a296
mov esp, ebp
pop ebp
ret 8
Function at 0x4053d0
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0x405468
mov eax, dword [ebx]
push 0x40
push eax
push esi
call fcn.0042a4a0
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0x405499
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x405499
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0x405468
mov ecx, dword [ebx]
push edi
push 0xf8
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
call fcn.0042a4a0
add esp, 0xc
cmp dword [edi], 0x4550
jne 0x405492
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0x405492
movzx eax, word [esi + 0x46]
test ax, ax
je 0x405492
lea edi, [eax + eax*4]
add edi, edi
add edi, edi
add edi, edi
push edi
mov dword [esi + 0x140], edi
call fcn.0042a83b
add esp, 4
mov dword [esi + 0x138], eax
test eax, eax
jne 0x40546e
mov eax, 3
pop edi
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
push ebx
lea ecx, [ecx + edx + 0x18]
push edi
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.00405a90
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop edi
ret
mov eax, 2
pop edi
ret
mov eax, 2
ret
Function at 0x4083a0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0x4083a7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x40847d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4490f8]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4490f8]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4490f8]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4490f8]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4490f8]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4490f8]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4490f8]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4490f8]
add ecx, 8
sub edx, 8
dec esi
jne 0x4083c0
pop edi
test edx, edx
je 0x40849a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4490f8]
inc ecx
dec edx
jne 0x408481
not eax
pop esi
ret

Function at 0x4084a0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4490f8]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x4490f8]
mov dword [edx + 8], ecx
ret

Function at 0x4084f0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x4490f8]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4490f8]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0x41e0e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d8f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x44e664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [edi + 0x44], 0
je 0x41e1e8
cmp byte [edi + 0x49], 0
je 0x41e1e8
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x41e1dc
lea esi, [ebp - 0x2c]
call fcn.0041ddd0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x41e153
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x41e17c
dec eax
je 0x41e180
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x41e1d7
jmp 0x41e1e3
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x41e190
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x41e1b9
cmp ebx, 0x10
jae 0x41e19f
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0042d83b
add esp, 0x10
cmp esi, eax
jne 0x41e1d4
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x41e1e0
test esi, esi
jne 0x41e147
push esi
lea ebx, [esi + 8]
lea esi, [ebp - 0x2c]
call fcn.004115f0
jmp 0x41e141
lea ecx, [ebp - 0x2c]
call fcn.00405c10
xor al, al
jmp 0x41e1ea
lea ecx, [ebp - 0x2c]
call fcn.00405c10
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a296
mov esp, ebp
pop ebp
ret