joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b7a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40b7fb
cmp byte [esi + ebx - 1], 0xa
je 0x40b7cf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x410f8c], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x40c0a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
lea eax, [ebp - 0x810]
sub esp, 0x840
mov dword [ebp - 0x80c], 0x800
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20019
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
sub esp, 0x24
test eax, eax
je 0x40c118
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea eax, [ebp - 0x80c]
lea esi, [ebp - 0x808]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x810]
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
mov dword [esp + 4], str.LastKey
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40c1b0
mov eax, dword [0x410b58]
mov dword [esp], esi
add eax, 0x40
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
je 0x40c1b0
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._FindPathInTree
test eax, eax
je 0x40c1b0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 9
mov dword [esp + 4], 0x110b
mov dword [esp], ebx
call dword [0x417714]
sub esp, 0x10
jmp 0x40c1fa
mov eax, dword [0x410b58]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov esi, dword [0x417714]
mov dword [esp + 4], 0x110a
mov eax, dword [eax + 4]
mov dword [esp], eax
call esi
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 0x1102
mov dword [esp], ebx
call esi
sub esp, 0x10
mov eax, dword [ebp - 0x810]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x40c220
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x410e00]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x1c], eax
call eax
mov edx, dword [ebp + 8]
mov eax, dword [0x411204]
test edx, edx
je 0x40c31f
test eax, eax
je 0x40c370
mov esi, dword [0x410f6c]
test esi, esi
je 0x40c3e0
mov dword [esp + 4], 0x4128fd
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strpbrk]
test eax, eax
jne 0x40c3a0
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov edi, dword [0x4107d8]
mov dword [esp + 4], esi
mov ebx, eax
lea eax, [eax + 1]
mov dword [esp + 8], eax
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_memmove]
mov esi, dword [0x411204]
mov eax, esi
sub eax, ebx
cmp eax, 2
jbe 0x40c348
mov eax, dword [ebp + 8]
add edi, ebx
mov dword [esp + 4], 1
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov eax, ebx
not eax
lea edx, [eax + esi]
mov dword [esp + 8], edx
call dword [sym.imp.ucrtbase.dll_fread]
test eax, eax
jne 0x40c300
mov eax, dword [0x4107d8]
mov dword [0x410f6c], 0
test eax, eax
je 0x40c2f3
call sym._GetWideString.part.0
mov dword [0x410e00], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [0x4107d8]
add ebx, esi
mov dword [0x410f6c], esi
mov byte [ebx + eax], 0
test esi, esi
jne 0x40c261
mov eax, dword [0x411204]
mov dword [0x410e00], 0
test eax, eax
jne 0x40c3ea
mov dword [0x411204], 0
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
add esi, esi
mov dword [esp], edi
mov dword [0x411204], esi
mov dword [esp + 4], esi
call dword [sym.imp.ucrtbase.dll_realloc]
mov dword [0x4107d8], eax
mov edi, eax
jmp 0x40c2b2
mov dword [0x411204], 0x1000
mov dword [esp], 0x1000
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x4107d8], eax
mov esi, eax
mov byte [eax], 0
mov dword [0x410f6c], eax
jmp 0x40c261
lea ecx, [eax + 1]
cmp byte [eax], 0xd
mov dword [0x410f6c], ecx
je 0x40c3c8
mov byte [eax], 0
mov eax, esi
call sym._GetWideString.part.0
mov dword [0x410e00], eax
jmp 0x40c2f8
cmp byte [eax + 1], 0xa
jne 0x40c3ae
lea ecx, [eax + 2]
mov dword [0x410f6c], ecx
jmp 0x40c3ae
mov dword [0x410e00], 0
mov eax, dword [0x4107d8]
mov dword [esp], eax
mov eax, dword [ebp - 0x1c]
call eax
jmp 0x40c331
Function at 0x40c400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov eax, dword [0x411200]
test edi, edi
je 0x40c4fc
test eax, eax
je 0x40c550
mov ebx, dword [0x410f68]
test ebx, ebx
je 0x40c5b9
mov dword [esp + 4], 0x4128d2
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcspbrk]
test eax, eax
jne 0x40c58e
mov edx, dword [0x410f68]
cmp word [edx], 0
je 0x40c580
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x40c460
sub eax, edx
mov edi, eax
mov ebx, eax
lea eax, [eax + 2]
sar edi, 1
mov esi, dword [0x4107d4]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_memmove]
mov eax, dword [0x411200]
mov edx, eax
sub edx, edi
cmp edx, 2
jbe 0x40c520
mov ecx, dword [ebp + 8]
mov edx, edi
mov dword [esp + 4], 2
not edx
add eax, edx
mov dword [esp + 0xc], ecx
lea ecx, [esi + ebx]
mov dword [esp + 8], eax
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_fread]
test eax, eax
jne 0x40c4e0
mov dword [0x410f68], 0
mov ebx, dword [0x4107d4]
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [0x4107d4]
add eax, edi
xor ecx, ecx
mov word [ebx + eax*2], cx
mov dword [0x410f68], ebx
test ebx, ebx
jne 0x40c42f
mov eax, dword [0x411200]
test eax, eax
jne 0x40c5b9
mov dword [0x411200], 0
xor ebx, ebx
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [eax + eax]
shl eax, 2
mov dword [esp], esi
mov dword [0x411200], edx
mov dword [ebp - 0x1c], edx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_realloc]
mov edx, dword [ebp - 0x1c]
mov dword [0x4107d4], eax
mov esi, eax
mov eax, edx
jmp 0x40c49d
mov dword [0x411200], 0x1000
xor esi, esi
mov dword [esp], 0x2000
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x4107d4], eax
mov ebx, eax
mov word [eax], si
mov dword [0x410f68], eax
jmp 0x40c42f
mov eax, 2
xor ebx, ebx
xor edi, edi
jmp 0x40c474
lea edx, [eax + 2]
cmp word [eax], 0xd
mov dword [0x410f68], edx
je 0x40c5a7
xor edx, edx
mov word [eax], dx
jmp 0x40c4d6
cmp word [eax + 2], 0xa
jne 0x40c59d
lea edx, [eax + 4]
mov dword [0x410f68], edx
jmp 0x40c59d
mov eax, dword [0x4107d4]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x40c509
Function at 0x40c9a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x40c9d5
lea eax, [ebp - 0x4e]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_fread]
cmp eax, 1
je 0x40c9e8
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ecx, byte [ebp - 0x4d]
movzx eax, byte [ebp - 0x4e]
xor esi, esi
mov byte [ebp - 0x59], cl
mov ecx, sym._get_lineA
cmp al, 0xff
jne 0x40ca11
xor edx, edx
mov edi, sym._get_lineW
cmp byte [ebp - 0x59], 0xfe
sete dl
cmove ecx, edi
mov esi, edx
movzx edx, byte [ebp - 0x59]
mov dword [ebp - 0x4c], ebx
lea ebx, [ebp - 0x4c]
mov word [ebp - 0x48], ax
lea eax, [ebp - 0x48]
mov word [ebp - 0x46], dx
mov edx, 0xffffffff
mov word [ebp - 0x40], dx
mov edx, sym._header_state
mov dword [ebp - 0x44], esi
mov dword [0x410c60], ecx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
jmp 0x40ca8a
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx*4 + 0x412e20]
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
test eax, eax
jne 0x40ca80
movzx eax, word [ebp - 0x40]
lea edx, [eax - 3]
cmp dx, 1
jbe 0x40caf0
mov eax, dword [ebp - 0x34]
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov ebx, 1
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x40c9d7
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
cmp ax, 3
sete bl
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40d810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
lea eax, [ebp - 0x2c]
push ebx
sub esp, 0x5c
mov dword [ebp - 0x2c], edx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0x500
call dword [sym.imp.kernel32.dll_FormatMessageW]
sub esp, 0x1c
mov ebx, eax
test eax, eax
jne 0x40d8c0
mov edi, dword fs:[0x18]
cmp dword [edi + 0x34], 0xeb
je 0x40d8c0
test byte [0x4107a4], 1
je 0x40d90b
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x34]
mov dword [esp + 0xc], str.Could_not_format_string:_le_lu__fmt_s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.output_formatstring
mov dword [esp + 4], 0x4107a4
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebp - 0x20]
mov dword [esp], 0xfffffff5
mov edi, dword [sym.imp.kernel32.dll_GetStdHandle]
call edi
lea ecx, [ebp - 0x1c]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x40d918
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LocalFree]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x3c], edx
call edx
mov dword [esp + 0x1c], 0
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [ebp - 0x38], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x30], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x3c]
test eax, eax
mov dword [ebp - 0x34], eax
je 0x40d8fc
call edx
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
lea ebx, [ebp - 0x1c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
call eax
sub esp, 0x20
mov dword [esp], 0xfffffff5
call edi
mov edi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
sub esp, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp + 0x10], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x40d8fc
Function at 0x40df90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [edx + 0x10]
push esi
lea esi, [edx + 8]
push ebx
mov ebx, edx
sub esp, 0x3c
mov dword [ebp - 0x20], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
mov eax, dword [edx]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [ebp - 0x24], eax
call eax
sub esp, 0x18
test eax, eax
je 0x40e050
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebx + 4]
cmp eax, 2
je 0x40e020
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x8045
mov dword [esp], eax
call sym._error_code_messagebox
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov dword [ebx + 0xc], 0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test ecx, ecx
jne 0x40dfe8
mov dword [ebx + 8], 1
mov dword [ebx + 0x10], 2
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll_malloc]
xor ecx, ecx
mov dword [ebx + 0xc], eax
mov word [eax], cx
mov eax, 1
jmp 0x40e014
mov eax, dword [ebx + 0x10]
add eax, 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp + 0x14], edi
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp + 8], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x24]
call eax
sub esp, 0x18
test eax, eax
jne 0x40e0b8
mov eax, dword [ebx + 0x10]
test al, 1
jne 0x40e0a1
mov ecx, dword [ebp - 0x1c]
and eax, 0xfffffffe
xor edx, edx
mov word [ecx + eax], dx
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0xc], eax
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebx + 4]
jmp 0x40dfe8

Function at 0x40e3f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x20]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebx + 0x1c]
sub esp, 0x18
sub eax, 3
cmp eax, 1
jbe 0x40e460
cmp word [ebx + 0xc], 1
mov eax, 1
mov dword [ebx + 0x24], 0
sbb eax, 0xffffffff
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x30], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x40e438
Function at 0x40fcc0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40fd5b
cmp ax, 9
je 0x40fd48
cmp ax, 0x20
je 0x40fd48
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp ax, 0x5c
je 0x40fdb0
cmp ax, 0x22
je 0x40fdc0
mov dword [ebp - 0x6c], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40fd5b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x40fd00
test edi, 1
jne 0x40fd00
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x40fd48
cmp ax, 0x20
je 0x40fd48
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x40fdd8
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
inc dword [ebp - 0x6c]
jmp 0x40fd1b
and dword [ebp - 0x6c], 1
jne 0x40fd14
xor edi, 1
jmp 0x40fd1b
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x40fd74

Function at 0x40fdf0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x10006857
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10006866
pop dword [ebp - 0x10]
mov eax, 0x10006866
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3bf36
push 0
mov eax, 0x5e515028
add eax, 0xb1b02118
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x428d0720
add ecx, 0xbd734924
mov edx, eax
mov edi, 0x709abf30
add edi, 0x9f6794d0
add edi, dword [ebp - 0x10]
mov esi, 0xab0a4c0e
add esi, 0xcb316f86
xor dword [ebp - 0xc], 0xeaebbdc0
mov ebx, dword [edi]
sub ebx, esi
add dword [ebp - 4], ebx
mov dword [edx], ebx
add dword [ebp - 0xc], 0x13830e50
add edx, 0x910d5c7a
add edx, 0x6ef2a38a
add edi, 0xff468566
add edi, 0xb97a9e
loop 0x100068c0
add eax, 0xb81bcf63
sub eax, 0xb81a9b80
xor ebx, ebx
add ebx, eax
add eax, 0x59250f3d
sub eax, 0x59250f38
mov ecx, 0x59a0c095
sub ecx, 0x49a0c095
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x402d54
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4b8008], 0x8088405
inc edx
mov dword [ebx + 0x4b8008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4045c8
Capabilities:
Packed with generic packer

Disassembly:
test edx, edx
je 0x40462d
test ecx, ecx
je fcn.00404300
cmp edx, dword [eax]
je 0x404634
cmp ecx, dword [eax]
je 0x4045ea
push eax
push ecx
call fcn.00404300
pop edx
pop eax
jmp fcn.00404584
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
push eax
mov eax, dword [ebx - 4]
add eax, dword [esi - 4]
call fcn.00404370
mov edi, eax
mov edx, eax
mov eax, ebx
mov ecx, dword [ebx - 4]
call fcn.0040293c
mov edx, edi
mov eax, esi
mov ecx, dword [esi - 4]
add edx, dword [ebx - 4]
call fcn.0040293c
pop eax
mov edx, edi
test edi, edi
je 0x404624
dec dword [edi - 8]
call fcn.00404300
pop edi
pop esi
pop ebx
ret
mov edx, ecx
jmp fcn.00404300
mov edx, ecx
jmp fcn.00404584

Function at 0x42f650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42f67d
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x42f66e
and ecx, 3
je 0x42f695
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x42f682
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x42f6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x42f6d9
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x42f6c1
pop esi
and esi, 3
je 0x42f6fe
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x42f6df
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x42f708
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42f734
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x42f725
and ecx, 3
je 0x42f74c
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x42f739
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x42f754
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0x42f760
pop edi
pop ebx
ret

Function at 0x43007c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov esi, eax
mov eax, esi
shr eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.0042fcd4
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x3be1bb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
dec edi
test edi, edi
jl 0x43012a
inc edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.0040293c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042f754
lea eax, [ebx + esi]
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
call fcn.0040293c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042f754
lea eax, [ebx + esi]
mov ebx, eax
dec edi
jne 0x4300d7
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
cmp esi, edi
jg 0x430178
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.0040293c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042f754
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov ecx, esi
call fcn.0040293c
lea eax, [ebx + esi]
mov ebx, eax
sub edi, esi
test edi, edi
jle 0x4301a2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec edi
test edi, edi
jl 0x4301a2
inc edi
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dl, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec edi
jne 0x430192
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3be1c2
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0042fe70
ret