joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407eb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425ea0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x434054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0040e090
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0040d6f7
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c140
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x434054]
xor eax, ebp
mov dword [ebp - 8], eax
movups xmm0, xmmword [edx]
push esi
movups xmm1, xmmword [edx + 0x10]
mov edx, dword [ebp + 8]
mov esi, ecx
movd eax, xmm0
lea ecx, [ebp - 0x16c]
movups xmmword [ebp - 0x18], xmm1
and al, 0xf8
psrldq xmm1, 0xf
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 0x28], al
movd eax, xmm1
and al, 0x3f
or al, 0x40
mov byte [ebp - 9], al
call fcn.00409710
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0x20c]
call fcn.0040a990
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0x1bc]
call fcn.0040ad10
lea eax, [ebp - 0x1bc]
push eax
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x11c]
call fcn.00408cd0
add esp, 0xc
lea ecx, [ebp - 0x11c]
call fcn.004091a0
lea ecx, [ebp - 0x11c]
call fcn.00409280
movups xmm0, xmmword [ebp - 0x11c]
lea edx, [ebp - 0x84]
mov ecx, esi
movups xmmword [ebp - 0x84], xmm0
movups xmm0, xmmword [ebp - 0x10c]
movups xmmword [ebp - 0x74], xmm0
movups xmm0, xmmword [ebp - 0xfc]
movups xmmword [ebp - 0x64], xmm0
movups xmm0, xmmword [ebp - 0xec]
movups xmmword [ebp - 0x54], xmm0
movups xmm0, xmmword [ebp - 0xdc]
movups xmmword [ebp - 0x44], xmm0
call fcn.00409a10
mov ecx, dword [ebp - 8]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0040e07d
mov esp, ebp
pop ebp
ret

Function at 0x419860
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004196d6
Function at 0x401170
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40e210
call fcn.00402310
add esp, 4
call fcn.00401020
movzx eax, al
test eax, eax
jne 0x40119d
xor ecx, ecx
je 0x4011aa
push str.kernel32.dll
call fcn.00402310
add esp, 4
push 3
call fcn.00401bd0
add esp, 4
push 0x4158fc
push 0x4158f8
push 0x40e240
push 0x65
call fcn.00401b60
add esp, 0x10
test eax, eax
jne 0x4011d8
xor eax, eax
jmp 0x40129c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00402210
add esp, 4
lea edx, [ebp - 0x10]
push edx
call fcn.00401dc0
add esp, 4
test eax, eax
je 0x40126b
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x40e244
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401261
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
mov edx, 1
test edx, edx
je 0x401238
mov dword [ebp - 0x14], str.svc32
jmp 0x40123f
mov dword [ebp - 0x14], str.svc64
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push section..text
call fcn.004012b0
add esp, 4
push 0x401150
push 0x64
call fcn.00401f40
add esp, 8
mov edx, 1
test edx, edx
je 0x40129a
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401287
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004025ef
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4012b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x4012d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4014b0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x401585
lea eax, [ebp - 0x20]
push eax
push 0x28
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40157b
lea edx, [ebp - 0xc]
push edx
push 0x40e28c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40157b
mov dword [ebp - 0x1c], 1
mov eax, 0xc
imul ecx, eax, 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov dword [ebp + ecx - 0x18], edx
mov dword [ebp + ecx - 0x14], eax
mov ecx, 0xc
imul edx, ecx, 0
mov dword [ebp + edx - 0x10], 2
push 0
push 0
push 0x10
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x40157b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
je 0x40156e
mov dword [ebp - 0x28], 1
jmp 0x401575
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004025ef
mov esp, ebp
pop ebp
ret
Function at 0x401a30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
jne 0x401a59
mov ecx, 1
test ecx, ecx
jne 0x401a73
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x18]
cmp eax, 0x20b
jne 0x401b4d
xor ecx, ecx
je 0x401b4d
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax + 0x78]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402140
add esp, 8
add eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402140
add esp, 8
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402140
add esp, 8
add eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x401ad9
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x401b4d
push 0x40e2c4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402140
add esp, 8
add eax, dword [ebp + 8]
push eax
call fcn.004025a0
add esp, 8
test eax, eax
je 0x401b39
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402140
add esp, 8
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx]
mov eax, dword [eax + edx*4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402140
add esp, 8
jmp 0x401b4f
mov edx, dword [ebp - 0x10]
add edx, 4
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [ebp - 0x14], eax
jmp 0x401ad0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x401b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401bc4
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp + 0x14]
cmp dword [edx], 0
je 0x401bc4
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401bc4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, 1
jmp 0x401bc6
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401c00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401ea0
add esp, 8
test eax, eax
je 0x401daf
cmp dword [ebp - 8], 1
jne 0x401c3e
mov dword [ebp - 0x28], 1
jmp 0x401c45
mov dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], 0
jne 0x401daf
mov edx, dword [ebp + 8]
push edx
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401daf
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0x1d
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
jl 0x401da5
cmp dword [ebp - 0xc], 0
jne 0x401da5
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004015e0
add esp, 8
test eax, eax
je 0x401da5
cmp dword [ebp - 0x10], 0x2000
jb 0x401da5
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401a30
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x401da5
push 0x40
push 0x3000
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x401da5
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x401da5
mov dword [ebp - 0x18], 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push 0x1fffff
lea edx, [ebp - 0x18]
push edx
call fcn.004020f0
test eax, eax
jl 0x401da5
cmp dword [ebp - 0x18], 0
je 0x401da5
cmp dword [ebp + 0x14], 0
je 0x401d5d
mov dword [ebp - 0x24], 1
jmp 0x401d9b
push 0x64
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x401d9b
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x401d9b
cmp dword [ebp - 0x14], 0
je 0x401d8e
mov dword [ebp - 0x30], 1
jmp 0x401d95
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004025ef
mov esp, ebp
pop ebp
ret
Function at 0x401f40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 8
call fcn.00402600
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401f6b
xor eax, eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
jmp 0x401f72
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x401fb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x402140
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 8], edx
mov eax, 0x28
imul ecx, eax, 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
cmp eax, dword [edx + ecx + 0x14]
jae 0x402181
mov eax, dword [ebp + 0xc]
jmp 0x4021ff
xor ecx, ecx
mov word [ebp - 4], cx
jmp 0x402195
mov dx, word [ebp - 4]
add dx, 1
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + 6]
cmp eax, edx
jge 0x4021fd
movzx eax, word [ebp - 4]
imul ecx, eax, 0x28
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
cmp eax, dword [edx + ecx + 0xc]
jb 0x4021fb
movzx ecx, word [ebp - 4]
imul edx, ecx, 0x28
movzx eax, word [ebp - 4]
imul ecx, eax, 0x28
mov eax, dword [ebp - 8]
mov edx, dword [eax + edx + 0xc]
mov eax, dword [ebp - 8]
add edx, dword [eax + ecx + 0x10]
cmp dword [ebp + 0xc], edx
jae 0x4021fb
movzx ecx, word [ebp - 4]
imul edx, ecx, 0x28
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
sub ecx, dword [eax + edx + 0xc]
movzx edx, word [ebp - 4]
imul eax, edx, 0x28
mov edx, dword [ebp - 8]
add ecx, dword [edx + eax + 0x14]
mov eax, ecx
jmp 0x4021ff
jmp 0x402189
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x402210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3e80
call fcn.0040263e
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x3e8
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004016c0
add esp, 8
test eax, eax
je 0x4022ca
mov dword [ebp - 0x10], 0
jmp 0x402263
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 8]
jae 0x4022ca
mov edx, dword [ebp - 0x10]
shl edx, 4
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + edx + 4]
cmp ecx, 0x7273
jne 0x4022c8
mov edx, dword [ebp - 0x10]
shl edx, 4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx]
cmp ecx, dword [ebp + 8]
je 0x4022c8
mov edx, dword [ebp - 0x10]
shl edx, 4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4022c8
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40225a
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00402647
add esp, 4
cmp dword [ebp - 0x18], 0
jne 0x4022eb
mov dword [ebp - 0x20], 0
jmp 0x4022f8
mov dword [ebp - 0xc], 0x8123
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004025ef
mov esp, ebp
pop ebp
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x48073c
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x69
arpl word [ebp + 0x58549370], di
lodsd eax, dword [esi]
test al, 0x21
sub byte [ebp + 0x4fbf6f10], ah
dec edi
xor byte [ebx], cl
push 0x4acf2baf
rcr dword [0x30eacee7], 0x4b
push eax
js 0x48076e
das
je 0x48074c
int3
or dl, byte [eax - 2]
pop esi
aam 0xcd
adc dword [ebp - 0x49], edx
inc byte [ebx]
fmul dword [edi + ebp*2 + 0x6a6a2f95]
push 0xffffffffffffffef
mov al, 0xb3
xchg esp, eax
das
imul dl
xor byte [edi - 1], cl
sub dword [eax + ebx + 0x3c], edx
mov edi, 0x627cb62f
mov dword [0xf571ffc1], eax
adc byte [edi], dh
enter 0x56dd, 0xffffffffffffffee
xchg esp, ebx
sbb esi, dword [edx + 0x2bd0fe70]
aad 0x92
daa
and al, 0x6d
push cs
cwde
in al, dx
push es
mov esi, 0x993de5df
or ch, byte [esi]
mov dl, 0x44
inc esi
test al, 0x3f
arpl word [esi + esi*2], cx
sub bh, byte [ebp - 0x5a]
and eax, 0x41233463
jae 0x4807ea
push ss
retf 0xe66e
cmpsd dword [esi], dword es:[edi]
or eax, 0x6435c1cb
in eax, dx
sbb dh, byte [ebp - 0x19]
jp 0x48084f
neg byte [ecx]
adc al, 0x97
ret
dec esp
pop ebp
mov word [ebx + 0xb], ss
ret 0x506f

Function at 0x5ac330
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x12], dl
xchg edx, eax
add byte [edi + edi], cl
add byte [ebx], cl
movsd dword es:[edi], dword [esi]
imul eax, dword [ebx - 0x493c2042], 0x92f900bc
add byte [ebx + 0x6d], dl
xor byte [ebp + 0x17f100a7], dl
add byte [eax], al
xchg edx, eax
add byte [eax + eax + 0x585f6b70], bh
push cs
add byte [eax + 0x5c], bh
cwde
mov eax, 0x8f44fa42
inc eax
inc ecx
or eax, 0xc6a40000
cmp dword [ebx], eax
jns 0x5ac335
dec esp
aas
add byte [eax], al
or esp, dword [ebp - 0x20417c97]
ret
sbb ecx, esi
mov dword [0x80ffffe9], eax
add byte [ebx + edi*8 + 0x79], ah
invalid
Function at 0x1004828
Capabilities:
Parse pe header

Disassembly:
push 0x60
push 0x1001fa0
call fcn.01005a90
mov edi, 0x94
mov eax, edi
call fcn.01005000
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x1001024]
mov ecx, dword [esi + 0x10]
mov dword [0x100b758], ecx
mov eax, dword [esi + 4]
mov dword [0x100b764], eax
mov edx, dword [esi + 8]
mov dword [0x100b768], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x100b75c], esi
cmp ecx, 2
je 0x1004888
or esi, 0x8000
mov dword [0x100b75c], esi
shl eax, 8
add eax, edx
mov dword [0x100b760], eax
xor esi, esi
push esi
mov edi, dword [fcn.01001040]
call edi
cmp word [eax], 0x5a4d
jne 0x10048c3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10048c3
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10048db
cmp eax, 0x20b
je 0x10048c8
mov dword [ebp - 0x1c], esi
jmp 0x10048ef
cmp dword [ecx + 0x84], 0xe
jbe 0x10048c3
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x10048e9
cmp dword [ecx + 0x74], 0xe
jbe 0x10048c3
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.01005a3c
pop ecx
test eax, eax
jne 0x100491b
cmp dword [0x100b748], 1
jne 0x1004908
call fcn.01005250
push 0x1c
call fcn.01005087
push 0xff
call fcn.01004b66
pop ecx
pop ecx
mov dword [ebp - 4], esi
call fcn.01005877
test eax, eax
jge 0x100492f
push 0x1b
call fcn.01004803
pop ecx
call dword [0x1001048]
mov dword [0x100cd34], eax
call fcn.01005751
mov dword [0x100b740], eax
call fcn.010056af
test eax, eax
jge 0x1004955
push 8
call fcn.01004803
pop ecx
call fcn.01005463
test eax, eax
jge 0x1004966
push 9
call fcn.01004803
pop ecx
call fcn.01004b96
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x1004979
push eax
call fcn.01004803
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [0x1001044]
call fcn.010053fa
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x100499a
movzx eax, word [ebp - 0x34]
jmp 0x100499d
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.01004215
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x10049bb
push edi
call fcn.01004ca5
call fcn.01004cc7
jmp 0x10049ed
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.01005ac9
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x69c908e3
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x57fb6277
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40470c
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x40474e
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x40476e
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.00407cc8
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x4049c4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406e84
test esi, esi
jne 0x4049fa
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040700c
jmp 0x404a18
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004048a8
mov edi, eax
test esi, esi
je 0x404a18
cmp dword [ebx], 0
je 0x404a18
dec esi
jmp 0x404a01
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x404a4c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x605008], 0x8088405
inc edx
mov dword [ebx + 0x605008], edx
mul edx
mov eax, edx
pop ebx
ret