joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021330
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x100213d7
cmp dword [esi + 4], 0xffffffff
jne 0x100213d7
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10021362
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x10021399
cmp eax, 0x2f
je 0x10021399
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10021386
mov eax, dword [0x100784ec]
mov dword [edi], eax
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.10020040
add esp, 8
test eax, eax
jne 0x100213b8
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
call fcn.100204a0
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10021af0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100864b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x10021b22
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10021b22
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x10021c0c
push edi
mov edi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x10021b3f
cmp ax, 0x5c
jne 0x10021b41
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x10021b33
cmp edi, ebx
je 0x10021b8a
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call fcn.10039a90
add esp, 0xc
cmp edi, 0x208
jae 0x10021c1c
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, esi
mov word [ebp + edi - 0x414], ax
call fcn.10021af0
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x10021bb0
lea ecx, [ebp - 0x20c]
sub ecx, esi
nop
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x10021ba0
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x10021bb2
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
jmp 0x10021bd0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10021bd0
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x10021c0c
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100325a2
mov esp, ebp
pop ebp
ret
call fcn.10035f54
int3
Function at 0x10022830
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100864b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 8], ebx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x1002291d
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x10022874
cmp dword [esi + 0x40], ebx
jae 0x10022874
push eax
call fcn.10027712
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x1002288c
lea eax, [ebx + ebx]
push eax
call fcn.100276e5
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push dword [esi + 0x3c]
call fcn.10039a90
xor edx, edx
add esp, 0xc
mov dword [ebp - 0xc], edx
test ebx, ebx
je 0x1002291a
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, ecx
or edi, 2
and eax, 0xff
shr ecx, 8
mov eax, dword [eax*4 + 0x10079dd0]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
and eax, 0xff
shr edx, 8
xor cl, bl
mov ebx, dword [ebp - 8]
xor edx, dword [eax*4 + 0x10079dd0]
mov dword [esi + 0x38], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp - 0xc], edx
cmp edx, ebx
jb 0x100228a2
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1002295d
mov edx, dword [esi + 0x24]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x10022938
mov dword [esi + 0x14], 0x30000
jmp 0x10022990
push ebx
add ecx, edx
push edi
push ecx
call fcn.10039a90
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100325a2
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x10022989
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100325a2
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x14], 0x1000000
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100325a2
mov esp, ebp
pop ebp
ret 8
Function at 0x10023cc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100693e3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100864b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x10095c1c
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x10095c1c
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x1007750b
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10027250
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414ac0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
in al, 0x48
sub bl, byte [edx - 0x77]
jl 0x414abb
mov al, byte [0x539c419e]
sahf
inc ecx
pushfd
push ebx
popal
fst st(7)
mov edx, 0xe8e8da7
and byte [eax + 0x4ab1375f], cl
sbb al, 0x5f
or edi, dword [esi - 0x4a]
and eax, 0xfa176a4
mov dword [eax + ebx*4], ebp
mov eax, dword [0xbf5e319e]
and ecx, dword [eax - 0x357ea41c]
pop esi
out 0x51, eax
call 0xd8caaa0c
mov eax, dword [0x5609ea0]
mov al, byte [0x4fe6779e]
add ecx, ecx
pop esi
mov bh, 0xb0
push cs
mov eax, dword [0x5e4ba8a0]
pop edi
popal
mov byte [esi + 0x5f], bl
popal
mov byte [esi + 0x5f], bl
popal
mov byte [esi + 0x5f], bl
popal
ja 0x414ab3
mov al, byte [0x5f5e889e]
popal
ja 0x414abb
mov al, byte [0x5f5e889e]
popal
mov byte [esi + 0x5f], bl
popal
mov byte [esi + 0x5f], bl
popal
mov byte [esi - 0x24], bl
lea ecx, [ecx + ebx*4 - 0x99bbaa5]
sbb eax, 0x10a58161
or dword [eax - 0x399ee1d2], ecx
sbb edi, esp
mov ecx, 0xdad9640a
inc edi
invalid
Function at 0x401a66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a14c]
jne 0x401a70
repz ret
jmp fcn.0040251b

Function at 0x40b0ae
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a14c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404134
and dword [ebp - 0x14], 0
cmp dword [0x42c7d8], 0
mov dword [ebp - 0x18], eax
jne 0x40b161
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b209
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40b209
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42c7d8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42c7dc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42c7e0], eax
call edi
push eax
call esi
mov dword [0x42c7e8], eax
test eax, eax
je 0x40b161
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42c7e4], eax
mov eax, dword [0x42c7e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b1ba
cmp dword [0x42c7e8], ecx
je 0x40b1ba
push eax
call esi
push dword [0x42c7e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b1ba
test ebx, ebx
je 0x40b1ba
call edi
test eax, eax
je 0x40b1b1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b1b1
test byte [ebp - 8], 1
jne 0x40b1ba
or dword [ebp + 0x10], 0x200000
jmp 0x40b1ed
mov eax, dword [0x42c7dc]
cmp eax, dword [ebp - 0x18]
je 0x40b1ed
push eax
call esi
test eax, eax
je 0x40b1ed
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b1ed
mov eax, dword [0x42c7e0]
cmp eax, dword [ebp - 0x18]
je 0x40b1ed
push eax
call esi
test eax, eax
je 0x40b1ed
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42c7d8]
call esi
test eax, eax
je 0x40b209
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b20b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a66
leave
ret
Function at 0x422e00
Capabilities:
Get geographical location

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jle 0x422e8e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp dword [esp + 0x18], 0x2d
jne 0x422e4c
push 0
push str.vepamanal_tulesizoxe_yabadodopa_zokorubonoxesiticohub_foyidufumobowebacaxosububonobo
call edi
push str.wuviyakox
push str.yekukefocudovizene
push str.kaluravujokiziduyux
push str.vixuboxituja
call ebx
push 0
call ebp
call fcn.00422d50
mov ecx, dword [esp + 0x14]
xor byte [esi + ecx], al
cmp dword [esp + 0x18], 0xf
jne 0x422e84
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push str.tigegisipawupesavumefozoj
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [esp + 0x18]
jl 0x422e22
pop edi
pop ebp
pop ebx
cmp dword [esp + 0xc], 0x2d
pop esi
jne 0x422eaa
mov dword [0x42d8d0], 0xa62e7790
mov dword [0x42d8d4], 0xffffffff
ret
Function at 0x423250
Capabilities:
Access the windows event log
Set file attributes

Disassembly:
mov eax, dword [0x42d8c4]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov ebp, 0x1519a5
lea esp, [esp]
mov dword [0x42d52c], 0x8e46a7b8
cmp eax, 0x3dc
jne 0x42329a
push 0
push 0x427f78
call esi
push str.rusokuj
push 0
push 0
call edi
mov eax, dword [0x42d8c4]
dec ebp
jne 0x423270
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
xor esi, esi
mov ebp, 0xec58acac
lea ebx, [ebx]
cmp eax, 0x997
jne 0x4232c2
push 0
push 0
call edi
mov eax, dword [0x42d8c4]
cmp esi, 0x846373
jne 0x4232d9
mov eax, dword [0x42bad0]
add eax, 0xa231
mov dword [0x42d8c4], eax
cmp eax, 0x141
jne 0x4232f0
mov dword [0x42cd18], ebp
mov dword [0x42cd1c], 0xffffffff
inc esi
cmp esi, 0x123c962
jl 0x4232b0
call fcn.00422ef0
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x10
Function at 0x408b40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
adc eax, 0x8b560c4d
jne 0x408b5d
push 0xffffffffffffffaa
lea edx, [ebp - 8]
push 0xfffffffffffffff7
mov eax, dword [esi]
push edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
mov dword [ebp - 0x28], ecx
push eax
mov esp, dword [esp + eax + 0x6af04d22]
add dword [ecx + 0x50], edx
cmp al, byte [ebp - 4]
add byte [eax], al
add byte [eax], al
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x408bb3
push edi
mov ebp, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
call edi
test eax, eax
xlatb
or ah, dh
push es
pop edi
pop esi
mov ah, ch
mov edx, 0x43fff60c
mov dword [esi], 0
pop edi
add eax, 0xafc08
pop esi
mov edi, 0xf4025de5
add byte [ebx + 0x689fc45], ah
mov dword [0x689fc45], eax
pop esi
div dword [ecx]
sbb eax, eax
and eax, 0xb8feee4e
jnp 0x408c42
adc dword [ecx], eax
add byte [ebx + 0x2dc25de5], cl
add byte [eax - 0x74b06f70], dl
in al, dx
push ecx
mov ecx, dword [ebp + 0x5c]
pop esp
lea eax, [ebp - 4]
xor byte [eax + 0x7e], ch
add al, 0x80
push ecx
mov dword [ebp - 4], 0xe0000
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
cmp eax, 0x2a
jne 0x408bd6
push esi
mov esi, dword [0xac1d8]
xor al, 0xd6
test eax, eax
jne 0x408c05
pop esi
lahf
in eax, 0x5d
ret
call esi
add eax, 0x99fc80
pop esi
mov esp, ebp
pop ebp
ret
push ds
push esi
mov ebp, dword [ecx + 3]
mov dword [0xd6ff0040], eax
test eax, eax
jne 0x408c55
pop esi
mov esp, ebp
pop ebp
ret
invalid

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
jne 0x40a41a
or byte [ebx + 0x7e851476], cl
je 0x40a410
mov eax, dword [eax]
or al, 0x51
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
ret
inc edx
cmp ecx, dword [esi]
add byte [edi], cl
ret 8
nop
nop
nop
nop
nop
nop
ret

Function at 0x914570
Capabilities:
Encode data using xor

Disassembly:
jmp 0x91457a
pushal
call 0x914580
pop ebp
sub ebp, 0x10
sub ebp, 0x514570
jmp 0x914596
mov eax, 0x514570
add eax, ebp
add eax, 0x4c
mov ecx, 0x603
mov edx, 0xb2ed3015
xor byte [eax], dl
inc eax
dec ecx
jne 0x9145ad
jmp 0x9145c0
sahf
fcomp dword [esi + 0x1515299c]
adc eax, 0x15edd494
adc eax, 0xadd81615
adc edx, dword [0x3daf1515]
adc eax, 0xf7e21515
push ss
fstp qword [esi + 0x15151994]
adc eax, 0x9845d016
jno 0x91461b
jmp 0x7dc2578b
sbb dword [0x989e1515], edx
adc eax, 0x989e1515
add eax, 0xd4151515
cld
pop ss
and al, 0x17
xchg esi, eax
xlatb
adc dword [edx + ebx - 0x70], ebx
loope 0x91461c
ljmp 0x7198:0x31399eea
Function at 0x402733
Capabilities:
Terminate process

Disassembly:
call section..text
push 0
push 0x405018
push 0x405014
call fcn.00402c85
push 0
push 0x405020
push 0x40501c
call fcn.00402c85
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403126
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x405784]
test eax, eax
je 0x40313f
call eax
test eax, eax
jne 0x40313f
push 0xfffffffffffffffe
jmp 0x403159
push 1
push 0x405010
push 0x405008
call fcn.00402c85
add esp, 0xc
test eax, eax
je 0x40315f
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x405004
push section..data
call fcn.00402c85
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x403185
mov esi, 0x404561
mov cl, 0x20
jmp 0x40318e
cmp al, 0x20
ja 0x403198
inc esi
mov al, byte [esi]
test al, al
jne 0x403189
cmp al, 0x20
jbe 0x4031af
mov al, byte [esi]
cmp al, 0x22
jne 0x4031a1
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x40319a
jmp 0x4031af
cmp al, cl
ja 0x4031b5
inc esi
mov al, byte [esi]
test al, al
jne 0x4031aa
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x4031de
movzx eax, word [ebp - 0x14]
jmp 0x4031e1
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00402733
pop ecx
pop esi
leave
ret

Function at 0x403218
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40518d], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0x80000000
push 0xfffffc18
push 0xfffffc18
push 0xcf0000
push 0x4055e0
push 0x405648
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403262
xor eax, eax
jmp 0x403279
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
leave
ret
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
ror esi, 1
imul ebx
imul edx
dec edx
add eax, 0x4b
sbb ebx, 0xd9
imul edx
dec esi
or eax, 0x98
rcl edx, 0xd3
and edx, 0xdb
bswap ebx
dec edi
imul eax
sbb ebx, 8
add esi, 0xb7
add esi, 0xab
ror eax, 0x50
sub esi, 0x46
inc edx
or edi, 0xc5
and edi, 0x94
and ebx, 0xae
add esi, 0xc1
sub edi, 0x15
inc edi
rcl eax, 0x67
mov eax, 0xbe
or edx, 0x7a
sub edi, 0xcb
mov eax, 0xff
neg ebx
neg ebx
not edi
dec edi
bswap edx
mov edi, 0xf0
sbb ebx, 0xc4
not eax
inc edx
add edi, 0x10
inc ebx
sub eax, 0x10
sub esi, 0xab
inc eax
ror ebx, 0xf1
bswap eax
and esi, 0xf8
or eax, 0x85
sub edi, 0x3c
xor ecx, ecx
xor edi, edi
inc edx
add ebx, 0x35
imul eax
dec ebx
rol eax, 0x3c
sbb edi, 0x2a
dec eax
ror edi, 0x75
add edx, 0x4f
dec edi
inc eax
sub esi, 0x6f
rcr esi, 0x1f
sub ebx, 0x48
imul ebx
add ebx, 0xfe
sbb esi, 0x39
rcr edi, 0x4b
imul eax
or edi, 0x6a
not ebx
bswap ebx
add esi, 0x75
imul esi
rcl ebx, 0xa9
sub eax, 0xd8
ror edi, 0x57
not ebx
mov edi, 7
not ebx
imul esi
and esi, 0x28
rcl edx, 0x21
sbb edi, 0x9d
not esi
rcl edi, 0x26
or ebx, 0x31
imul ebx
mov ebx, 0x7e
dec edx
rcr esi, 0xca
neg ebx
imul ebx
neg ebx
bswap edi
mov ebx, 0x6a
not edx
dec eax
inc ebx
ror eax, 9
mov ecx, dword [ebp + 0xc]
bswap ebx
neg edx
dec ebx
or edx, 0xdc
sub edi, 0x3f
dec eax
bswap ebx
ror edx, 0x43
bswap edi
imul edi
dec esi
rol eax, 0xbf
imul ebx
bswap ebx
and edx, 0x79
mov esi, 0xf3
neg esi
neg ebx
sbb esi, 0
imul eax
bswap ebx
rol eax, 0x11
imul ebx
sub edi, 0x34
rol ebx, 0x42
dec edx
and edx, 0xad
rcr eax, 0x96
inc edi
inc edi
not eax
not ebx
add ebx, 0x8f
not ebx
mov edx, 0x55
bswap esi
dec eax
and esi, 0x6f
bswap edi
neg eax
rcl ebx, 0x11
mov edi, 0x5d
inc edx
dec ebx
neg esi
rcr esi, 0xe2
or edx, 0x10
inc edx
neg edx
rcl ebx, 7
mov edi, dword [ebp + 8]
mov esi, eax
xor ebx, eax
xor esi, eax
mov eax, esi
xor ebx, ebx
xor eax, esi
xor esi, ebx
xor eax, esi
xor ebx, esi
mov eax, ebx
mov ebx, eax
mov esi, eax
not byte [edi]
mov ebx, ebx
mov eax, esi
mov eax, eax
xor eax, ebx
xor esi, eax
xor esi, eax
mov esi, ebx
xor eax, esi
xor eax, eax
sub byte [edi], 0x65
mov eax, esi
xor eax, eax
xor ebx, ebx
mov esi, eax
mov esi, ebx
mov eax, esi
mov ebx, ebx
mov esi, eax
xor eax, eax
add byte [edi], 0x98
xor ebx, esi
mov ebx, ebx
xor ebx, esi
mov esi, eax
xor esi, eax
mov eax, ebx
xor ebx, ebx
mov eax, eax
mov eax, esi
imul byte [edi]
inc edi
loop 0x4011bd
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404c34
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x462af0]
jne 0x404c3e
repz ret
jmp fcn.00409135
Function at 0x4055a3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402ed1
and dword [ebp - 4], 0
cmp dword [0x4637f4], 0
mov ebx, eax
jne 0x405654
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405705
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405705
push eax
call fcn.00402e5f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4637f4], eax
call esi
push eax
call fcn.00402e5f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4637f8], eax
call esi
push eax
call fcn.00402e5f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4637fc], eax
call esi
push eax
call fcn.00402e5f
pop ecx
mov dword [0x463804], eax
test eax, eax
je 0x405654
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402e5f
pop ecx
mov dword [0x463800], eax
mov eax, dword [0x463800]
cmp eax, ebx
je 0x4056ac
cmp dword [0x463804], ebx
je 0x4056ac
push eax
call fcn.00402eda
push dword [0x463804]
mov esi, eax
call fcn.00402eda
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4056ac
test edi, edi
je 0x4056ac
call esi
test eax, eax
je 0x4056a3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4056a3
test byte [ebp - 0xc], 1
jne 0x4056ac
or dword [ebp + 0x10], 0x200000
jmp 0x4056e5
mov eax, dword [0x4637f8]
cmp eax, ebx
je 0x4056e5
push eax
call fcn.00402eda
pop ecx
test eax, eax
je 0x4056e5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4056e5
mov eax, dword [0x4637fc]
cmp eax, ebx
je 0x4056e5
push eax
call fcn.00402eda
pop ecx
test eax, eax
je 0x4056e5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4637f4]
call fcn.00402eda
pop ecx
test eax, eax
je 0x405705
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405707
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x581008], 0x8088405
inc edx
mov dword [ebx + 0x581008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cb9c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cbcd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbb5
add dl, dl
jne 0x41cbd8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc29
xor eax, eax
add dl, dl
jne 0x41cbe5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ccc6
add dl, dl
jne 0x41cbf4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cbff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc0a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cc1f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cbc4
mov eax, 1
add dl, dl
jne 0x41cc37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc42
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc2e
sub eax, ebx
mov ebx, 1
jne 0x41cc75
mov ecx, 1
add dl, dl
jne 0x41cc5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc66
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc52
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cc8c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc97
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc83
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cce7
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cbc4
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret