joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x402c00
pop dword [ebp - 8]
mov eax, 0x2352e3
sub eax, 0xffe326e3
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x2e332023
add dword [ebp - 0x18], 0x201f2528
mov dword [ebp - 0x14], 0x7e398d6c
sub dword [ebp - 0x14], 0x4c064127
mov dword [ebp - 0x10], 0x71b3679
add dword [ebp - 0x10], 0x45310db5
mov dword [ebp - 0xc], 0x14112da0
add dword [ebp - 0xc], 0xebeed260
lea eax, [ebp - 0x18]
push eax
mov eax, 0x2994a8fc
sub eax, 0x29543898
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x3d140ed0
add dword [ebp - 0x18], 0x375e5a86
mov dword [ebp - 0x14], 0x2eae6762
add dword [ebp - 0x14], 0x12bdfa13
mov dword [ebp - 0x10], 0x8eccf862
sub dword [ebp - 0x10], 0x2b5d8bf6
mov dword [ebp - 0xc], 0x51bbab42
sub dword [ebp - 0xc], 0x51bbab42
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xbb381f6c
sub eax, 0xbaf7aec4
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3409e
push 0
call eax
mov ecx, 0x3d66
xor esi, esi
add esi, eax
mov edi, 0x888ad0d2
sub edi, 0x8849d0d2
add edi, dword [ebp - 8]
mov ebx, 0xd56f32ea
add ebx, 0xaef20cc6
xor dword [ebp - 4], edx
mov edx, dword [edi]
mov dword [ebp - 4], 0x6f7ebf26
xor edx, ebx
mov dword [ebp - 4], 0xbafcc820
mov dword [esi], edx
add dword [ebp - 4], eax
add esi, 4
add edi, 4
loop 0x402d1e
add eax, 0xe86b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xf45ad669
add ecx, 0xbe52997
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x411c90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x411cb2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411cb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411ca8
mov eax, 1
add ebx, ebx
jne 0x411ccb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411cc0
jne 0x411cdc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411cc0
xor ecx, ecx
sub eax, 3
jb 0x411cf0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411d62
mov ebp, eax
add ebx, ebx
jne 0x411cfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411d08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x411d2c
inc ecx
add ebx, ebx
jne 0x411d18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x411d0d
jne 0x411d29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411d0d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x411d4c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x411d3d
jmp 0x411cae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x411d4c
add edi, ecx
jmp 0x411cae
pop esi
mov edi, esi
mov ecx, 0x122
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x411d6a
cmp byte [edi], 7
jne 0x411d6a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x411d6f
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411de7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12efc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12f9c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x411d9c
mov ecx, edi
jns 0x411dcb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12fa0]
or eax, eax
je 0x411de1
mov dword [ebx], eax
add ebx, 4
jmp 0x411db9
call dword [esi + 0x12fa4]
popal
jmp 0x40128f
Function at 0x401ba0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c0cb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x42d1d0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
call fcn.00401ad0
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x42f8a0
push 0
push 0x4296dc
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push 0x42f8a0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov esi, eax
lea eax, [ebp - 0x224]
push eax
push edi
push ebx
push esi
mov dword [ebp - 0x224], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x42d000]
push ecx
mov esi, esp
mov ecx, 0x42d000
mov dword [ebp - 0x220], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, 0x429ec0
mov byte [ebp - 4], 1
test eax, 0xffff0000
jne 0x401cad
movzx edi, ax
mov ecx, edi
call fcn.00401250
test eax, eax
je 0x401cbb
push edi
push eax
mov ecx, esi
call fcn.00402b10
jmp 0x401cbb
push 0x2d
push 0x429ec0
mov ecx, esi
call fcn.00402750
mov byte [ebp - 4], 0
call fcn.00401990
add esp, 4
mov ecx, eax
call fcn.004018a0
push 0x424018
push ecx
mov ecx, esp
push 0x42a6f4
test al, al
je 0x401da6
mov byte [ebp - 4], 2
call fcn.00401f70
call fcn.00401990
add esp, 4
push eax
push ecx
mov ecx, esp
push 0x42a710
call fcn.00401f70
call fcn.00401990
add esp, 4
push eax
push ecx
mov ecx, esp
push 0x42a73c
call fcn.00401f70
call fcn.00401990
add esp, 4
mov edx, 0x42f8a0
mov ecx, eax
call fcn.004018d0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00403f2b
mov esp, ebp
pop ebp
ret
mov byte [ebp - 4], 4
call fcn.00401f70
call fcn.00401990
add esp, 4
push eax
push ecx
mov ecx, esp
push 0x42a710
call fcn.00401f70
call fcn.00401990
add esp, 4
push eax
push ecx
mov ecx, esp
push 0x42a754
call fcn.00401f70
call fcn.00401990
add esp, 4
mov edx, 0x42f8a0
mov ecx, eax
call fcn.004018d0
add esp, 0xc
jmp 0x401d2f
Function at 0x40b2a1
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42d1d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00408579
mov dword [ebp - 0x14], eax
cmp dword [0x42f804], edi
jne 0x40b392
push 0x800
push edi
push 0x41f85c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40b31f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40b472
push 0x41f85c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40b472
push 0x41f874
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b472
push eax
call ebx
push 0x41f880
push esi
mov dword [0x42f804], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x41f890
push esi
mov dword [0x42f808], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x41f8a4
push esi
mov dword [0x42f80c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42f814], eax
test eax, eax
je 0x40b38f
push 0x41f8c0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42f810], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40b3b7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40b3aa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40b3cc
push 4
pop eax
jmp 0x40b474
cmp dword [ebp - 0x14], edi
je 0x40b3cc
push dword [0x42f804]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40b3b1
mov eax, dword [0x42f810]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40b42a
cmp dword [0x42f814], esi
je 0x40b42a
push eax
call ebx
push dword [0x42f814]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40b42a
test eax, eax
je 0x40b42a
call ecx
test eax, eax
je 0x40b41f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40b41f
test byte [ebp - 8], 1
jne 0x40b42a
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40b45a
mov eax, dword [0x42f808]
cmp eax, esi
je 0x40b457
push eax
call ebx
test eax, eax
je 0x40b457
call eax
mov edi, eax
test edi, edi
je 0x40b457
mov eax, dword [0x42f80c]
cmp eax, esi
je 0x40b457
push eax
call ebx
test eax, eax
je 0x40b457
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x42f804]
call ebx
test eax, eax
je 0x40b472
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40b474
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f2b
leave
ret
Function at 0x41aa16
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004079c3
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x41aa4e
xor eax, eax
jmp 0x41aa7a
cmp esi, dword [ebp - 4]
je 0x41aa77
cmp dword [ebp + 0xc], 0
je 0x41aa77
push dword [edi + 0x9c]
call fcn.0041a624
push dword [edi + 0x9c]
mov esi, eax
call fcn.0040b1ca
pop ecx
pop ecx
cmp esi, eax
je 0x41aa4a
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40123a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e8
push edi
and dword [ebp - 0xc], 0
mov byte [ebp - 0x110], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
call sub.iphlpapi.DLL_GetAdaptersInfo
mov dword [ebp - 8], eax
push 0
call sub.KERNEL32.dll_DeleteFileA
cmp dword [ebp - 4], 0
jne 0x4013f1
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp - 8]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403206
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x403226
cmp dword [edi + 0x54], 0
jne 0x403226
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0040511d
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004031cd
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x40a1f7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40a23a
call fcn.0040511d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40a23a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40a255
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00409dae
test ebx, ebx
mov esi, eax
je 0x40a253
test edi, edi
je 0x40a253
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x411bbc
Capabilities:
Check for software breakpoints

Disassembly:
mov word [ebx - 0x7e7a4441], fs
xchg esi, eax
adc byte [ebx + 0x3ca906e5], 0x8c
stosb byte es:[edi], al
mov edi, 0xa9a82bd
sahf
cmp byte [esi], ah
pop ss
sbb ebx, dword [ebx]
push 0x214ce6fd
test dword [ebp + 0x38858585], eax
arpl word [esi - 0x4c74c4c5], bx
mov ebp, 0xc298f38c
mov word [ecx - 0x667dc141], gs
leave
mov ebx, 0x56983e2c
invalid

Function at 0x413de3
Capabilities:
Encode data using xor

Disassembly:
invalid
in eax, 0x8c
test eax, 0x38e53cbf
jp 0x413e67
cmp edi, dword [ebx]
and eax, 0x3b892a38
cmp ecx, ebx
xor eax, dword [esi + 0x46]
test eax, 0x5aa4388a
sbb ebx, dword [ebx]
mov esi, dword [ebx]
aas
cmp byte [ecx], 0xc9
mov ebx, 0x1d983381
cmp byte [edx - 0x74e4e4a6], ah
xor esp, dword [ebx]
cmp byte [ecx], 0xc9
pop es
xor dword [ebx], 0xafdb1b23
cmp eax, 0x1ae73b83
jecxz 0x413ddf
mov esp, 0x85e4c95b
push es
int3
leave
popfd
int3
dec ebx
in al, 0xbc
jnp 0x413ec9
cmp edi, dword [ebx]
pop es
xor dword [ebx], 0x93e62386
xor dword [ebx], 0xaa8b93e6
mov ebp, dword [edx - 0x56c44441]
add ch, ah
mov word [ecx + 0x1ae7bcbf], gs
jecxz 0x413e45
cmp edi, dword [0x38e55ea9]
sbb eax, 0x4b3b3bbb
out 0xbc, eax
sbb edi, eax
sbb ebx, dword [ebx]
mov esp, edi
cmp ecx, dword ds:[ebx - 0x1874c401]
cmp al, 0x3b
inc esi
out 0x93, al
sbb ebp, dword [eax + 0x20]
push 0x38e5e63f
mov ah, 0x58
sbb ebx, dword [ebx]
inc esi
inc esi
adc byte [ebx + 0x3b7b3bab], 0x3b
invalid
Function at 0x4118d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x4118f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4118f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4118e8
mov eax, 1
add ebx, ebx
jne 0x41190b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411900
jne 0x41191c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411900
xor ecx, ecx
sub eax, 3
jb 0x411930
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4119a2
mov ebp, eax
add ebx, ebx
jne 0x41193b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411948
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41196c
inc ecx
add ebx, ebx
jne 0x411958
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41194d
jne 0x411969
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41194d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41198c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41197d
jmp 0x4118ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41198c
add edi, ecx
jmp 0x4118ee
pop esi
mov edi, esi
mov ecx, 0x24e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4119aa
cmp byte [edi], 0
jne 0x4119aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4119af
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411a1e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11d78]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11e18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4119dc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11e1c]
or eax, eax
je 0x411a18
mov dword [ebx], eax
add ebx, 4
jmp 0x4119f9
call dword [esi + 0x11e24]
mov ebp, dword [esi + 0x11e20]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x411a52
sub esp, 0xffffff80
jmp 0x404319
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404de0
add esp, 0x104
pop ebx
ret
Function at 0x420dca
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x1381f104
sti
and edi, dword [ecx + 0x16a19b61]
pushfd
cmp cl, byte [edi]
clc
xchg byte [ecx], ch
cmp bh, byte [ecx]
movsd dword es:[edi], dword [esi]
mov cl, 0x48
mov dword [ebp + 0x5df869e8], ebx
cmpsb byte [esi], byte es:[edi]
mov dword [0xfde46f36], eax
pop esp
cdq
add dword [ecx - 0x760a6a6a], esp
adc bl, byte [ecx - 0x64]
mov eax, dword [0x1b08696a]
mov eax, dword [0x6bdb0b1f]
lcall 0x907f, 0xc34819fe
sbb dword [eax - 0x3d], ecx
jg 0x420d5f
sbb dword [eax - 0x3d], ecx
jg 0x420d5f
inc esp
inc esp
stosb byte es:[edi], al
fst dword [esi]
lds ebp, [eax]
mov ah, 0xfd
in al, 0x67
pop edx
sub byte [ebp + 0x66081602], ah
mov eax, dword [0xae532953]
push ss
mov ecx, esp
pop ecx
mov esi, 0x9589749a
wait
cmpsd dword [esi], dword es:[edi]
mov ch, 0xec
xchg edi, eax
adc byte [esi - 0x29bbc274], 0x9d
wait
jne 0x420d95
bound edx, qword [edi - 0x38]
rcl dword [ecx + edx*4]
movsb byte es:[edi], byte [esi]
fisub word [eax + eax*2 - 0x1c]
sub cl, byte [edx - 0x14]
push ss
sbb dword [ebx - 0xf1b3171], edx
invalid
Function at 0x43835a
Capabilities:
Encode data using xor

Disassembly:
loop 0x438357
pop edi
jns 0x43837d
mov word gs:[ecx - 0x14], cs
dec ecx
push ebp
sub cl, cl
imul eax, dword ss:[edi - 0x6d56daa0], 0x72f21de8
lcall 0xf7bf, 0x97c3b740
inc eax
xlatb
rol esp, 0x85
or ch, bl
add al, bl
jbe 0x43839e
inc esi
rcl byte [edi]
sahf
sbb eax, 0xd3f8b701
mov ah, 0x16
in al, dx
imul eax, dword [ecx - 0xf0c2211], 0x3049a213
jo 0x438301
xor byte [eax - 0x3d], dh
dec ebx
inc eax
mov al, byte [eax + eax*4 + 0x7d7b409e]
les ebp, [ebp - 0x1b70b993]
mov ebp, 0x145ab7c0
fistp dword [edi]
add ecx, ecx
je 0x43833b
jecxz 0x4383cc
jae 0x438379
pop ds
jb 0x4382fc
invalid
cwde
push edi
push es
stc
test eax, 0x8536e9e3
cmp ebx, dword [edx]
insd dword es:[edi], dx
xor byte [esi + 0xe], bl
invalid
adc dword [ecx], ebp
push ds
mov al, byte [0x1d528326]
bnd jnp 0x4383f0
cwde
outsb dx, byte [esi]
jmp 0x26a1bf7e
mov esp, ss
test dword [ebx], edx
cld
cmp ch, al
mov al, al
push ss
xchg ebp, eax
rcl byte [esi], 0x95
sbb dword [0x1d26b058], ebp
imul ecx, ebx, 0xffffff9d
pushfd
pop esp
xlatb
clc
dec ebx
das
mov dword [edx + ecx*4], ecx
jns 0x4383da
insd dword es:[edi], dx
jp 0x4383c4
fld dword [edx + 0x40e69506]
retf
int 7
xlatb
mov esi, dword [0x780ecfb6]
ljmp 0xd8a1
Function at 0x46577a
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xc11e6877
in eax, 0xd0
leave
or dword [edi], ecx
mov ecx, 0xcaee54ef
xlatb
adc bl, 0x87
pop edi
dec edi
test dword [ecx], 0x825a5282
out dx, eax
or dword [edi - 0x25], esi
pop es
rcr byte [0x60d969b9], 0xe4
mov bh, 0xb
imul edx, dword [eax - 0x519872f9], 0xffffffc6
nop
pop es
fcompi st(5)
and bh, 0x88
outsd dx, dword [esi]
cli
xor eax, 0x37ad3f68
mov bl, 5
adc byte [ecx + 0x6f], 0xa7
jne 0x4657a5
pop es
lea esp, [edi - 0x52]
invalid
cwde
les ecx, [esi + 0x17]
ljmp 0xdfa7
Function at 0x47f49a
Capabilities:
Encode data using xor

Disassembly:
push esi
or al, 0xb7
lds edi, [ebx]
sub ch, al
salc
cmpsb byte [esi], byte es:[edi]
sbb eax, 0xf8ac91bb
mov bl, 0xdf
pushfd
je 0x47f4a9
jge 0x47f4cb
sbb eax, dword [esp + ecx*8 - 0x75ebfbc3]
jno 0x47f488
add al, 0x14
mov dh, byte [ecx - 0x1f]
loop 0x47f4a2
mov eax, dword [0xf4936dfd]
pop ds
test dword [edi - 0x1fa42841], 0xe093e763
sub byte [eax - 0x2252529d], cl
fistp dword [0x287b6f8b]
invalid
mov ebp, 0xcb761be6
sbb esi, dword [esi - 0x35]
fisub dword [edi + esi*2 + 0x3d5d9b45]
mov esi, 0x67bb8597
jno 0x47f4c9
mov dword [0x366dd666], eax
out dx, al
or ebp, ebp
clc
imul ebx, ebp, 0x864ab26f
sbb al, 0x58
pop eax
sub esp, edx
inc ebx
jne 0x47f51e
add cl, byte [eax]
jb 0x47f4f2
ret
ficom dword [eax]
packsswb mm2, qword cs:[eax - 0x32]
or al, 0x8e
push 0xffffffffffffffd3
scasb al, byte es:[edi]
fild word [ecx]
xchg edi, eax
xor dword [ebx], ecx
sub byte [edx + 0x4c], ch
push 0x4c
cli
call 0x6e7e5e4
cmp al, 0x89
xor byte [esi + 0x6d], bh
aas
jecxz 0x47f530
mov esp, 0x31669c8e
shl dword [edi + edi*2 + 0x28], cl
outsd dx, dword [esi]
xor al, 0x41
sar ah, 1
xor ebp, dword [edx + 0x2f8a832d]
add edi, dword cs:[edx + 0x30]
test byte [edi], bh
wait
cmp al, 0xc6
jno 0x47f4ec
iret