joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417934
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x417add
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x417af0
mov edx, edi
mov eax, 1
call fcn.0040cae0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 4]
mov dl, 0x22
call fcn.0040c6a4
lea eax, [ebp - 8]
push eax
mov ecx, 0x417af0
mov edx, edi
mov eax, 2
call fcn.0040cae0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x417af0
mov edx, edi
mov eax, 3
call fcn.0040cae0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x417af0
mov edx, edi
mov eax, 4
call fcn.0040cae0
mov eax, dword [ebp - 0x18]
mov edx, 1
call fcn.004066c8
sub eax, 1
jb 0x4179d1
je 0x4179d5
dec eax
je 0x4179dc
dec eax
je 0x4179e3
jmp 0x4179ea
xor esi, esi
jmp 0x4179ef
mov esi, 1
jmp 0x4179ef
mov esi, 3
jmp 0x4179ef
mov esi, 7
jmp 0x4179ef
mov esi, 1
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x417af0
mov edx, edi
mov eax, 5
call fcn.0040cae0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
mov dl, 0x22
call fcn.0040c6a4
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x417af0
mov edx, edi
mov eax, 6
call fcn.0040cae0
mov eax, dword [ebp - 0x18]
mov edx, 1
call fcn.004066c8
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x417af0
mov edx, edi
mov eax, 7
call fcn.0040cae0
mov eax, dword [ebp - 0x18]
mov edx, 1
call fcn.004066c8
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x10]
call fcn.004161f0
cmp byte [ebp - 0x11], 0
je 0x417a8a
mov eax, dword [ebp - 0xc]
push eax
push esi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [0x41b6b8]
call fcn.004119cc
cmp byte [ebp - 0x12], 0
je 0x417ab8
test eax, eax
jne 0x417aba
jmp 0x417ab8
push esi
mov eax, dword [ebp - 0xc]
call fcn.004038b4
push eax
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
push 0
mov eax, dword [0x41b6b8]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jle 0x417aba
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417ae4
lea eax, [ebp - 0x18]
call fcn.00403498
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004034bc
ret
Function at 0x418e9c
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
push 0x41b6f0
push 4
push 0
push 0x417c28
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x41b6ec], eax
xor eax, eax
push ebp
push 0x418f57
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x41b70a], 0
jne 0x418ee5
mov eax, 0x418f70
call fcn.00418bd4
jmp 0x418ef0
mov eax, dword [0x41b6ec]
push eax
call sub.kernel32.dll_ResumeThread
call fcn.00414c70
lea eax, [ebp - 8]
push eax
mov eax, dword [0x41b6ec]
push eax
call sub.kernel32.dll_GetExitCodeThread
cmp dword [ebp - 8], 0x103
je 0x418ef0
cmp dword [ebp - 8], 0
je 0x418f1a
call fcn.00403050
jmp 0x418f5e
mov dl, 1
mov eax, dword [0x41b6fc]
call fcn.0040fabc
mov eax, dword [0x41b6d0]
call fcn.004132cc
mov eax, dword [0x41b704]
call fcn.004132cc
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418f5e
mov eax, dword [0x41b6ec]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret

Function at 0x418f80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x418fe7
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
lea eax, [ebp - 4]
mov ecx, dword [0x41b6f8]
mov edx, 0x418ffc
call fcn.0040373c
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
mov eax, dword [0x41b700]
call fcn.004038b4
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0x3e8
call sub.kernel32.dll_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418fee
lea eax, [ebp - 4]
call fcn.00403498
ret
Function at 0x677c84
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x677cf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00409878
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a81c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a688
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x677ce1
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040aa64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x677cfe
lea eax, [ebp - 4]
call fcn.00409878
ret
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x614c7495
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x77a07554
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x51056b55
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5fc14bac
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x401029
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x401a4f
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 7
push esi
push str..PhysicalDrive0
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x401b45
push ebx
push edi
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
stosd dword es:[edi], eax
lea esi, [ebp - 0x41c]
mov dword [ebp - 4], 0x400
mov ebx, dword [ebp - 4]
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push ebx
push esi
lea eax, [ebp - 0x1c]
push 0xc
push eax
push 0x2d1400
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, edi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edi
je 0x401af3
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], esi
cmp eax, ebx
jbe 0x401ad4
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
jmp 0x401af3
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x401af3
lea edi, [eax + esi]
push edi
call fcn.00402d00
push eax
push edi
push dword [ebp + 8]
call fcn.004018cc
add esp, 0x10
xor edi, edi
lea eax, [ebp - 0x41c]
cmp esi, eax
je 0x401b04
push esi
call fcn.00402ce6
pop ecx
cmp dword [ebp - 8], edi
jne 0x401b3a
cmp dword [ebp - 0xc], edi
jne 0x401b27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x401b3a
cmp dword [ebp - 4], ebx
ja 0x401b27
or bx, 0xfff
inc ebx
mov dword [ebp - 4], ebx
push dword [ebp - 4]
call fcn.00402cd8
mov esi, eax
pop ecx
cmp esi, edi
jne 0x401a98
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, dword [ebp - 8]
pop esi
leave
ret
Function at 0x40170f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x4042be], ebp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404844], eax
xor eax, eax
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4047d4], eax
mov dword [0x4042b6], eax
mov dword [0x4047c0], 0x30
mov dword [0x4047c4], 2
jmp 0x401750
xor eax, eax
mov dword [0x4047c8], 0x402df1
mov dword [0x4047cc], eax
mov dword [0x4047d0], eax
mov eax, str.rewit
mov dword [0x4047e0], 0xe
mov dword [0x4047e8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4047dc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4047d8], eax
mov dword [0x4047ec], eax
push 0x4047c0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4042b6]
push 0
push 0
push 0x1e0
push 0x1fe
push 0xfffff862
push 0xfffff8f8
push 0xcf0000
push 0x404342
push str.rewit
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404838], eax
push 5
push eax
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404838]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x4047f0]
jmp 0x401817
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x401809
mov eax, dword [0x4047f8]
jmp 0x401832
call 0x402aec
ret
Function at 0x1ce4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01ce41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1ce407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1ce406a
add dl, dl
jne 0x1ce4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1ce40dc
xor eax, eax
add dl, dl
jne 0x1ce4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1ce417d
add dl, dl
jne 0x1ce40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1ce40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1ce40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1ce40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1ce40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1ce4075
mov eax, 1
add dl, dl
jne 0x1ce40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1ce40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1ce40e1
sub eax, ebx
mov ebx, 1
jne 0x1ce4128
mov ecx, 1
add dl, dl
jne 0x1ce410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1ce4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1ce4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1ce4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1ce413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1ce414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1ce4136
cmp eax, 0x7d00
jae 0x1ce416d
cmp eax, 0x500
jb 0x1ce4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1ce4075
cmp eax, 0x7f
ja 0x1ce4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1ce4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1ce419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1ce4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x402e99
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [0x4050f8]
push ebx
call edi
pop ecx
test eax, eax
je 0x402ed1
push esi
mov esi, dword [ebp + 8]
sub ebx, esi
mov al, byte [ebx + esi]
push dword [ebp + 0xc]
xor al, 0xfe
inc dword [ebp - 4]
mov byte [esi], al
inc esi
call edi
pop ecx
cmp dword [ebp - 4], eax
jb 0x402eba
pop esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
pop edi
mov byte [ecx + eax], 0
pop ebx
leave
ret

Function at 0x402edf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push edi
mov edi, dword [ebp + 0xc]
mov byte [ebp - 0x400], 0
test edi, edi
jle 0x402f25
push ebx
push esi
lea esi, [ebp + 0xc]
mov ebx, edi
add esi, 4
movzx eax, byte [esi]
xor eax, 0xde
push eax
lea eax, [ebp - 0x400]
push eax
push 0x40593c
push eax
call dword [0x4050fc]
add esp, 0x10
dec ebx
jne 0x402efe
pop esi
pop ebx
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 8]
mov byte [ebp + edi - 0x400], 0
call dword [0x4050f4]
pop ecx
pop ecx
pop edi
leave
ret
Function at 0x403280
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x45fbec]
mov ecx, dword [0x45f67c]
push ebx
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x4032f9
mov edi, dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
mov esi, ecx
mov dword [ebp - 4], eax
cmp dword [0x45fbec], 0x959
jne 0x4032ea
push 0
push 0
call edi
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push esi
call fcn.00403040
add esi, 8
sub dword [ebp - 4], 1
jne 0x4032aa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407600
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4575a8]
jne 0x40760a
repz ret
jmp fcn.0040bfd3

Function at 0x40bc8e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004083e2
and dword [ebp - 4], 0
cmp dword [0x45d628], 0
mov ebx, eax
jne 0x40bd3f
push 0x401b70
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bdf0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b64
push edi
call esi
test eax, eax
je 0x40bdf0
push eax
call fcn.00408370
mov dword [esp], 0x401b54
push edi
mov dword [0x45d628], eax
call esi
push eax
call fcn.00408370
mov dword [esp], 0x401b40
push edi
mov dword [0x45d62c], eax
call esi
push eax
call fcn.00408370
mov dword [esp], 0x401b24
push edi
mov dword [0x45d630], eax
call esi
push eax
call fcn.00408370
pop ecx
mov dword [0x45d638], eax
test eax, eax
je 0x40bd3f
push 0x401b0c
push edi
call esi
push eax
call fcn.00408370
pop ecx
mov dword [0x45d634], eax
mov eax, dword [0x45d634]
cmp eax, ebx
je 0x40bd97
cmp dword [0x45d638], ebx
je 0x40bd97
push eax
call fcn.004083eb
push dword [0x45d638]
mov esi, eax
call fcn.004083eb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bd97
test edi, edi
je 0x40bd97
call esi
test eax, eax
je 0x40bd8e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bd8e
test byte [ebp - 0xc], 1
jne 0x40bd97
or dword [ebp + 0x10], 0x200000
jmp 0x40bdd0
mov eax, dword [0x45d62c]
cmp eax, ebx
je 0x40bdd0
push eax
call fcn.004083eb
pop ecx
test eax, eax
je 0x40bdd0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bdd0
mov eax, dword [0x45d630]
cmp eax, ebx
je 0x40bdd0
push eax
call fcn.004083eb
pop ecx
test eax, eax
je 0x40bdd0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45d628]
call fcn.004083eb
pop ecx
test eax, eax
je 0x40bdf0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bdf2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7ffe5323
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
add eax, 0
nop
push edx
cdq
pop edx
cld
and bh, 0xff
stc
and bh, 0xff
nop
lea esp, [esp]
stc
and bh, 0xff
nop
push edx
cdq
pop edx
cld
lea esp, [esp]
nop
add eax, 0
cld
pushal
inc eax
popal
clc
push edx
cdq
pop edx
clc
add eax, 0
clc
push edx
cdq
pop edx
nop
pushal
inc eax
popal
clc
lea esp, [esp]
cld
pushal
inc eax
popal
stc
push edx
cdq
pop edx
nop
pushal
inc eax
popal
clc
lea esp, [esp]
cld
pushal
inc eax
popal
stc
pushal
inc eax
popal
cld
and bh, 0xff
clc
lea esp, [esp]
cld
add eax, 0
nop
lea esp, [esp]
cld
and bh, 0xff
stc
and bh, 0xff
cld
pushal
inc eax
popal
cld
push edx
cdq
pop edx
stc
and bh, 0xff
nop
add eax, 0
stc
add eax, 0
cld
and bh, 0xff
clc
push edx
cdq
pop edx
cld
and bh, 0xff
cld
push edx
cdq
pop edx
nop
pushal
inc eax
popal
clc
lea esp, [esp]
cld
pushal
inc eax
popal
cld
pushal
inc eax
popal
stc
call 0x7ffe53ce
pop edx
stc
cld
cld
xor dx, dx
cld
and bh, 0xff
nop
clc
add edx, 0xd5e0
clc
pushal
inc eax
popal
stc
pushal
inc eax
popal
clc
clc
cld
xor ecx, ecx
push edx
cdq
pop edx
cld
lea esp, [esp]
cld
push edx
cdq
pop edx
clc
mov cl, 0x1e
and bh, 0xff
xor byte [ecx + edx], 0xa
loop 0x7ffe53ff
cld
clc
push dword fs:[0x24]
cld
lea esp, [esp]
nop
lea esp, [esp]
cld
and bh, 0xff
cld
pop dword [edx + 0xa]
add eax, 0
and bh, 0xff
mov cl, 0xff
add eax, 0
clc
add eax, 0
cld
nop
push edx
loop 0x7ffe542f
mov dword [edx + 0x11], 0xffffacbb
cld
mov ecx, dword [eax + 0x2c]
push edx
cdq
pop edx
stc
lea esp, [esp]
stc
push edx
cdq
pop edx
cld
mov dword [edx + 0x1b], ecx
push edx
cdq
pop edx
cld
pushal
inc eax
popal
nop
pushal
inc eax
popal
cld
stc
mov dword [edx + 0x100], ecx
clc
stc
stc
clc
mov dword [eax + 0x2c], esp
cld
lea esp, [esp]
clc
push edx
cdq
pop edx
stc
push 0
and bh, 0xff
cld
push 0
and bh, 0xff
stc
add al, 0
cld
push 0
and bh, 0xff
cld
pushal
inc eax
popal
cld
push 0
pushal
inc eax
popal
cld
and bh, 0xff
push 0x30
nop
push edx
cdq
pop edx
stc
lea esp, [esp]
nop
and bh, 0xff
push 0x20
clc
pushal
inc eax
popal
and bh, 0xff
push 0
pushal
inc eax
popal
stc
push 0
push edx
cdq
pop edx
stc
lea esp, [esp]
cld
nop
add edx, 0xffff7f2b
cld
lea esp, [esp]
push edx
stc
push edx
pushal
inc eax
popal
cld
and bh, 0xff
cld
lea esp, [esp]
clc
push 0
add eax, 0
nop
add eax, 0
stc
nop
call dword [edx + 0x8218]
add esp, 0x3f8
clc
and bh, 0xff
nop
stc
nop
xor eax, eax
lea esp, [esp]
clc
inc eax
lea esp, [esp]
cld
nop
ret 0xc
Function at 0x7ffe9c50
Capabilities:
Encode data using xor

Disassembly:
adc bl, byte [esi]
adc eax, 0x18140b1b
sbb byte [edi], cl
sbb dword [ecx], edx
sbb al, 4
or dword [edx], edx
pop es
sbb ebx, dword [edi]
pop ss
sbb dl, byte [edi]
or bl, byte [esi]
pop ss
sbb ebx, dword [ebx]
sbb byte [ebx], bl
or byte [ebx], al
and byte [edi], al
or dword [esi], edx
sbb cl, byte [ebx]
push cs
or dl, byte [0x1d161012]
add al, 8
push ss
or al, byte [edi]
movups xmm4, xmmword [ecx]
add al, 0x18
adc eax, 0x717071a
push cs
sbb byte [edx], bl
push ss
push cs
sbb edx, dword [ebx]
adc eax, 0x190f0d16
sbb al, 0x1e
sbb bl, byte [eax]
adc dl, byte [ebx]
or byte [edx], cl
adc eax, 0x11141308
or dl, byte [ebx]
add al, 0x11
adc eax, 0x41c0c1f
add eax, 0x9f712115
jno 0x7ffe9bf1
jno 0x7ffe9bf1
pop es
mov dh, dl
arpl word [edx], bx
or byte [edx], bl
pushfd
xor byte [edx], cl
aam 0x10
xchg edi, eax
insb byte es:[edi], dx
adc byte ds:[edi], cl
adc eax, 0x10b795a8
pop ss
punpckhbw mm2, mm1
pop ebp
add edx, dword [0x93806d01]
movsb byte es:[edi], byte [esi]
mov eax, 0xb181113
sbb ebx, dword [0x9b980de2]
wait
invalid
Function at 0x404914
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00407614
test esi, esi
jne 0x40494a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040779c
jmp 0x404968
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004047f8
mov edi, eax
test esi, esi
je 0x404968
cmp dword [ebx], 0
je 0x404968
dec esi
jmp 0x404951
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x40499c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x554008], 0x8088405
inc edx
mov dword [ebx + 0x554008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406354
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.0040674c
mov byte [esp], al
cmp byte [esp], 0
jne 0x4064e0
test edi, edi
je 0x4064e0
mov byte [esp + 1], 0
test ebp, ebp
jle 0x406417
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x4063f2
cmp edi, 0xffffffff
je 0x4063b3
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4063b3
mov byte [esp], 0
jmp 0x4064e0
mov ebx, dword [esi]
cmp ebx, 1
jg 0x4063f2
test ebx, ebx
jne 0x4063e8
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00402770
test eax, eax
jne 0x4063e8
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4064e0
call 0x406870
dec ebp
test ebp, ebp
jg 0x406398
cmp edi, 0xffffffff
je 0x406417
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x406415
mov byte [esp], 0
jmp 0x4064e0
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x406362
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00402770
cmp ebx, eax
jne 0x406417
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00406550
mov edx, eax
mov ebx, dword [0x5598f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x40647e
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40647c
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x40647e
xor edi, edi
cmp byte [esp], 0
je 0x4064a7
mov ebx, dword [esi]
test bl, 1
jne 0x4064c0
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00402770
cmp ebx, eax
jne 0x406484
mov byte [esp + 1], 1
jmp 0x4064c0
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00402770
cmp ebx, eax
jne 0x4064a7
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x406431
cmp byte [esp], 0
je 0x4064e0
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret