joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x428004]
jne 0x40100a
repz ret
jmp fcn.004012fe

Function at 0x4046cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x428004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403a60
and dword [ebp - 0x14], 0
cmp dword [0x42aa38], 0
mov dword [ebp - 0x18], eax
jne 0x40477e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404826
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404826
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42aa38], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42aa3c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42aa40], eax
call edi
push eax
call esi
mov dword [0x42aa48], eax
test eax, eax
je 0x40477e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42aa44], eax
mov eax, dword [0x42aa44]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4047d7
cmp dword [0x42aa48], ecx
je 0x4047d7
push eax
call esi
push dword [0x42aa48]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4047d7
test ebx, ebx
je 0x4047d7
call edi
test eax, eax
je 0x4047ce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4047ce
test byte [ebp - 8], 1
jne 0x4047d7
or dword [ebp + 0x10], 0x200000
jmp 0x40480a
mov eax, dword [0x42aa3c]
cmp eax, dword [ebp - 0x18]
je 0x40480a
push eax
call esi
test eax, eax
je 0x40480a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40480a
mov eax, dword [0x42aa40]
cmp eax, dword [ebp - 0x18]
je 0x40480a
push eax
call esi
test eax, eax
je 0x40480a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42aa38]
call esi
test eax, eax
je 0x404826
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404828
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x401555
Capabilities:
Log keystrokes via polling

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x24
call sym._mcount
call dbg._monstartup
call dbg.__main
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
mov dword [esp], 0xa
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov byte [ebp - 9], 8
movsx eax, byte [ebp - 9]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
cmp ax, 0x8001
sete al
test al, al
je 0x4015c1
movsx eax, byte [ebp - 9]
mov dword [esp + 4], str.log.txt
mov dword [esp], eax
call sym.Save_int__char_
movzx eax, byte [ebp - 9]
add eax, 1
mov byte [ebp - 9], al
jmp 0x401591

Function at 0x409650
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp sym.___write_memory.part.0
Function at 0x40a050
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40a088
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x40a07e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x40a08a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x40a070
xor eax, eax
pop ebx
pop esi
ret

Function at 0x40b6e0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sym._strlen
mov esi, eax
lea eax, [eax + 0x41]
and eax, 0xfffffff0
call fcn.0040a350
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], esi
lea edi, [esp + 0xc]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [esi + 0x10]
mov dword [ebp - 0x1c], eax
add eax, edi
mov dword [eax], 0x61616161
mov dword [eax + 4], 0x61616161
mov dword [eax + 8], 0x61616161
mov dword [eax + 0xc], 0x61616161
mov dword [eax + 0x10], 0x61616161
mov dword [eax + 0x14], 0x61616161
mov dword [eax + 0x18], 0x61616161
mov dword [eax + 0x1c], 0x61616161
mov byte [esp + esi + 0x3c], 0
mov byte [esp + esi + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [edi + esi + 0xf], 0x2d
sub esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x40b7c8
int3
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x40b863
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov ebx, eax
mov eax, dword [ebp - 0x1c]
lea edx, [edi + eax]
mov eax, 0x20
bt ebx, eax
jae 0x40b7fd
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x40b7f5
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x40b860
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call dbg.get_ptr_from_atom
cmp eax, ebx
mov esi, eax
je 0x40b87a
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
int3
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call dbg.get_ptr_from_atom
mov esi, eax
jmp 0x40b837
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40b837
mov dword [esp], ebx
call dword [ebp + 0x10]
nop
jmp 0x40b837
Function at 0x415ed0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x2e0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x415f00
lea esp, [ebp - 8]
mov eax, 0xffffffff
pop ebx
pop esi
pop ebp
ret
lea eax, [ebp - 0x2d4]
mov esi, 0xffffffff
mov dword [ebp - 0x2d4], 0x10003
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esp, 8
test eax, eax
mov dword [esp], ebx
cmovne esi, dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x417170
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x488e00]
test ebx, ebx
je 0x4171a0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
mov eax, dword [0x488e00]
test eax, eax
je 0x4171c5
cmp dword [eax], 0xffffffff
je 0x4171e8
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x488e00], eax
mov ebx, eax
jmp 0x41717e
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x488e00], eax
jmp 0x41718f
call sym._abort
lea esi, [esi]
Function at 0x4177c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x488e04]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0xfeedbab1
mov dword [ebp - 0x24], 0
test eax, eax
mov dword [ebp - 0x1c], 1
je 0x417942
cmp dword [eax], 1
je 0x4177fc
call sym.__pthread_once_raw.part.1.constprop.4
mov eax, dword [0x488e00]
test eax, eax
je 0x417968
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x417827
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._pop_pthread_mem
mov esi, eax
mov eax, dword [entry3]
test eax, eax
je 0x41781d
test esi, esi
je 0x41781d
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x44], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x6c], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x40], eax
call ebx
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call ebx
mov edx, dword [ebp - 0x2c]
lea ecx, [esi + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x4179b4
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], eax
movzx eax, byte [esi + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [esi + 0x20], al
mov eax, dword [0x488e00]
test eax, eax
je 0x41798e
mov dword [esp + 4], esi
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4179b4
mov ebx, esi
jmp 0x41781d
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x488e04], eax
jmp 0x4177f2
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x488e00], eax
jmp 0x417809
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x488e00], eax
jmp 0x417925
call sym._abort
lea esi, [esi]
Function at 0x4193e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xbc]
test eax, eax
jne 0x419461
test byte [ebx + 0x20], 0x30
je 0x419468
mov eax, dword [0x488e00]
test eax, eax
je 0x4194f1
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x419458
cmp dword [eax + 0x14], 0
je 0x4194be
mov esi, dword [eax + 4]
mov dword [eax + 0x70], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41944b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x41947b
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call sym.__pthread_cleanup_dest.part.2
jmp 0x4193ff
add ebx, 0x78
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
cmp dword [ebx + 0xb8], 0
mov dword [ebx + 0x14], 0
je 0x4194e8
mov eax, dword [0x488e00]
test eax, eax
je 0x419517
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x419458
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4194d5
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xb8], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jne 0x41949e
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x41949e
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x488e00], eax
jmp 0x419412
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x488e00], eax
jmp 0x4194a7
Function at 0x41c980
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.0040a350
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
lea esi, [esp + 0xc]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edx, [esi + eax]
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x30]
mov dword [edx], 0x61616161
mov dword [edx + 4], 0x61616161
mov dword [edx + 8], 0x61616161
mov dword [edx + 0xc], 0x61616161
mov dword [edx + 0x10], 0x61616161
mov dword [edx + 0x14], 0x61616161
mov dword [edx + 0x18], 0x61616161
mov dword [edx + 0x1c], 0x61616161
mov dword [ebp - 0x20], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [esi + ebx + 0xf], 0x2d
sub esp, 0xc
mov edi, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x41ca6e
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x41cb07
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov ebx, eax
mov eax, dword [ebp - 0x1c]
lea edx, [esi + eax]
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x41caa8
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x41caa0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x41cb04
mov ecx, dword [ebp - 0x1c]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x41cb1e
mov dword [esp], ebx
call sym._free
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x1c]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x41cae2
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41cae2
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x41cae2
Function at 0x44f6b0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ecx, edi
call method.std::__basic_file_char_.fd__
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._read
cmp eax, 0xffffffff
mov ebp, eax
je 0x44f6f0
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x44f6c1
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x120cc10
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x120cc2e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x120cc23
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x402ee4
pop dword [ebp - 0x20]
mov eax, 0x402ee4
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x9eee53dc
sub dword [ebp - 0x30], 0x509c0e91
mov dword [ebp - 0x2c], 0x3de9e32d
add dword [ebp - 0x2c], 0xf4496918
mov dword [ebp - 0x28], 0x5073c6ef
sub dword [ebp - 0x28], 0x42782c1
mov dword [ebp - 0x24], 0x90db2c8b
add dword [ebp - 0x24], 0x6f24d375
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xfa3f8f56
sub dword [ebp - 0x30], 0x85cd2600
mov dword [ebp - 0x2c], 0xf9138b51
add dword [ebp - 0x2c], 0x4858d624
mov dword [ebp - 0x28], 0x5dac9a34
add dword [ebp - 0x28], 0x5c2d238
mov dword [ebp - 0x24], 0xcefc10f8
sub dword [ebp - 0x24], 0xcefc10f8
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xbb0cd5e8
add eax, 0x4533ab18
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x30c5f
push 0
call eax
mov ecx, 0x767120cb
add ecx, 0x898f0e28
mov edx, eax
mov edi, 0x46e400
add edi, dword [ebp - 0x20]
mov esi, 0x3d09dd0c
xor dword [ebp - 0x14], 0xdf7dcb59
mov ebx, dword [edi]
xor dword [ebp - 0xc], edi
xor ebx, esi
mov dword [edx], ebx
xor dword [ebp - 8], edi
add edx, 0xfb2adfe5
sub edx, 0xfb2adfe1
add edi, 0x81ab6595
sub edi, 0x81ab6591
loop 0x402ff0
add eax, 0x2b504d2d
add eax, 0xd4b06172
xor ebx, ebx
add ebx, eax
add eax, 0xab7ecd8c
sub eax, 0xab7ecd87
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x404f44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x404fe4
test ebp, ebp
setl byte [esp]
mov eax, edi
xor ecx, ecx
mov edx, 0xb
call sub.rtl120.bpl__System__LStrSetLength_qqrv
mov esi, 0xb
mov eax, ebp
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov ecx, 0xa
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
add bl, 0x30
mov byte [eax + esi - 1], bl
dec esi
test ebp, ebp
jne 0x404f6e
cmp byte [esp], 0
je 0x404fb3
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x404ff0
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
push eax
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call sub.rtl120.bpl__System_Move_qqrpxvpvi
mov edx, ebx
mov eax, edi
xor ecx, ecx
call sub.rtl120.bpl__System__LStrSetLength_qqrv
jmp 0x404ff0
mov eax, edi
mov edx, 0x405004
call sub.rtl120.bpl__System__LStrAsg_qqrpvpxv
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x405008
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x4050ab
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call sub.rtl120.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov ecx, 0xa
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringU_qqrr20System_UnicodeString
add bp, 0x30
mov word [eax + esi*2 - 2], bp
dec esi
test ebx, ebx
jne 0x405030
cmp byte [esp], 0
je 0x405079
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringU_qqrr20System_UnicodeString
mov word [eax + esi*2 - 2], 0x2d
dec esi
test esi, esi
jle 0x4050b7
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringU_qqrr20System_UnicodeString
push eax
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringU_qqrr20System_UnicodeString
lea eax, [eax + esi*2]
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
add ecx, ecx
pop edx
call sub.rtl120.bpl__System_Move_qqrpxvpvi
mov edx, ebx
mov eax, edi
call sub.rtl120.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
jmp 0x4050b7
mov eax, edi
mov edx, 0x4050cc
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x406224
Capabilities:
Get geographical location

Disassembly:
push ecx
cmp word [0x5952dc], 0
jne 0x40625c
push 2
lea eax, [esp + 4]
push eax
push 0xe
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x406253
movzx eax, word [esp]
mov word [0x5952dc], ax
jmp 0x40625c
mov word [0x5952dc], 0x2c
movzx eax, word [0x5952dc]
pop edx
ret