joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64b0c4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x64b305
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x2c4], 0
je 0x64b2d2
mov eax, dword [ebx + 0x36c]
cmp byte [eax + 0x4b], 0
jne 0x64b2c0
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2c0]
mov ecx, 0x3e8
xor edx, edx
div ecx
imul edx, eax, 0x3e8
add dword [ebx + 0x2c0], edx
movzx edx, word [ebx + 0x124]
cmp eax, edx
jae 0x64b135
sub word [ebx + 0x124], ax
jmp 0x64b13e
mov word [ebx + 0x124], 0
movzx esi, word [ebx + 0x124]
test si, si
jne 0x64b293
cmp ebx, dword [ebx + 0x2f4]
jne 0x64b281
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edi, eax
dec edi
test edi, edi
jle 0x64b261
mov dword [ebp - 4], 1
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2f8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
cmp byte [esi + 0x128], 0
je 0x64b22c
cmp byte [esi + 0x370], 0
jne 0x64b1af
cmp byte [esi + 0x378], 0
jne 0x64b1af
cmp byte [esi + 0xd46], 0
jne 0x64b1dc
push 1
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x15]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 4
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x64b31c
call fcn.0040bf74
mov edx, dword [ebp - 8]
xor ecx, ecx
mov eax, ebx
call fcn.006a6c7c
jmp 0x64b257
mov eax, dword [esi + 0x36c]
cmp byte [eax + 0x4b], 0
je 0x64b215
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [esi + 0x15]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 4
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x64b340
call fcn.0040bf74
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov eax, ebx
call fcn.006a6c7c
jmp 0x64b257
lea eax, [ebp - 0x18]
lea edx, [esi + 0x15]
call fcn.00405744
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.0069e990
jmp 0x64b257
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 0x15]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 4
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x64b368
call fcn.0040bf74
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, ebx
call fcn.006a6c7c
inc dword [ebp - 4]
dec edi
jne 0x64b177
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2c0], eax
mov eax, dword [0x7070f8]
movzx eax, word [eax + 0x5f48]
mov word [ebx + 0x124], ax
jmp 0x64b2e2
push 1
xor ecx, ecx
mov edx, 0x64b388
mov eax, ebx
call fcn.006a6c7c
jmp 0x64b2e2
push 1
lea eax, [ebp - 0x20]
push eax
movzx eax, si
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x64b3a8
call fcn.0040bf74
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, ebx
call fcn.006a6c7c
jmp 0x64b2e2
push 1
xor ecx, ecx
mov edx, 0x64b3d0
mov eax, ebx
call fcn.006a6c7c
jmp 0x64b2e2
push 1
xor ecx, ecx
mov edx, 0x64b3f0
mov eax, ebx
call fcn.006a6c7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64b30c
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004054f4
lea eax, [ebp - 8]
call fcn.004054d0
ret
Function at 0x64b4e8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405960
mov eax, dword [ebp - 8]
call fcn.00405960
xor eax, eax
push ebp
push 0x64b68a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x3bf], 0
jne 0x64b539
cmp byte [ebx + 0x2ed], 6
jb 0x64b65f
cmp dword [ebp - 8], 0
jne 0x64b56c
push 1
push 0x64b6a0
push dword [ebp - 4]
push 0x64b6b4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405874
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov eax, ebx
call fcn.006a6c7c
jmp 0x64b66f
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x42c]
cmp eax, 0x2710
ja 0x64b58b
cmp byte [ebx + 0x2ed], 3
jb 0x64b61f
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x42c], eax
mov eax, dword [0x707bc4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.0062fe20
mov esi, eax
test esi, esi
je 0x64b5ff
push 1
push dword [ebp - 8]
push 0x64b6c8
mov eax, dword [esi + 0x36c]
push dword [eax + 8]
push 0x64b6dc
lea edx, [ebp - 0x14]
mov eax, dword [esi + 0x24]
call fcn.0040ab6c
push dword [ebp - 0x14]
push 0x64b6e8
lea edx, [ebp - 0x18]
mov eax, dword [esi + 0x28]
call fcn.0040ab6c
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 7
call fcn.00405874
mov edx, dword [ebp - 0x10]
mov cl, 2
mov eax, ebx
call fcn.006a6c7c
jmp 0x64b66f
push 1
lea eax, [ebp - 0x1c]
mov ecx, 0x64b6f4
mov edx, dword [ebp - 8]
call fcn.004057f8
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, ebx
call fcn.006a6c7c
jmp 0x64b66f
push 1
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x42c]
mov ecx, 0x3e8
xor edx, edx
div ecx
sub eax, 0xa
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040ad3c
lea eax, [ebp - 0x20]
mov edx, 0x64b720
call fcn.004057ac
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, ebx
call fcn.006a6c7c
jmp 0x64b66f
push 1
xor ecx, ecx
mov edx, 0x64b744
mov eax, ebx
call fcn.006a6c7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64b691
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.004054f4
ret
Function at 0x64f0a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x64f1d9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x64f140
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c20]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x64f136
inc esi
xor edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c20]
mov edx, edi
call fcn.00420a68
mov ebx, eax
test ebx, ebx
je 0x64f132
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x9d]
imul edx, dword [ebx + 0x99], 0x3c
imul edx, edx, 0x3e8
cmp eax, edx
jbe 0x64f132
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x9d], eax
mov eax, dword [ebx + 0x91]
mov dword [ebx + 0x95], eax
inc edi
dec esi
jne 0x64f0e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64f1be
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64f1e0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004054f4
ret
Function at 0x6669b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov ebx, 1
mov eax, ebx
cmp eax, 9
ja case.0x6669c7.0
jmp dword [eax*4 + 0x6669ce]
cmp byte [esi + 0x18], 0
je case.0x6669c7.0
mov eax, dword [ebp + 8]
push eax
lea edx, [esi + 0x10]
lea eax, [esi + 0xc]
call fcn.00666944
pop ecx
jmp case.0x6669c7.0
cmp byte [esi + 0x28], 0
je case.0x6669c7.0
mov eax, dword [ebp + 8]
push eax
lea edx, [esi + 0x20]
lea eax, [esi + 0x1c]
call fcn.00666944
pop ecx
jmp case.0x6669c7.0
cmp byte [esi + 0x38], 0
je case.0x6669c7.0
mov eax, dword [ebp + 8]
push eax
lea edx, [esi + 0x30]
lea eax, [esi + 0x2c]
call fcn.00666944
pop ecx
jmp case.0x6669c7.0
cmp byte [esi + 0x48], 0
je case.0x6669c7.0
mov eax, dword [ebp + 8]
push eax
lea edx, [esi + 0x40]
lea eax, [esi + 0x3c]
call fcn.00666944
pop ecx
jmp case.0x6669c7.0
cmp byte [esi + 0x58], 0
je case.0x6669c7.0
mov eax, dword [ebp + 8]
push eax
lea edx, [esi + 0x50]
lea eax, [esi + 0x4c]
call fcn.00666944
pop ecx
jmp case.0x6669c7.0
cmp byte [esi + 0x68], 0
je case.0x6669c7.0
mov eax, dword [ebp + 8]
push eax
lea edx, [esi + 0x60]
lea eax, [esi + 0x5c]
call fcn.00666944
pop ecx
jmp case.0x6669c7.0
cmp byte [esi + 0x78], 0
je case.0x6669c7.0
mov eax, dword [ebp + 8]
push eax
lea edx, [esi + 0x70]
lea eax, [esi + 0x6c]
call fcn.00666944
pop ecx
jmp case.0x6669c7.0
cmp byte [esi + 0x88], 0
je case.0x6669c7.0
mov eax, dword [ebp + 8]
push eax
lea edx, [esi + 0x80]
lea eax, [esi + 0x7c]
call fcn.00666944
pop ecx
jmp case.0x6669c7.0
cmp byte [esi + 0x98], 0
je case.0x6669c7.0
mov eax, dword [ebp + 8]
push eax
lea edx, [esi + 0x90]
lea eax, [esi + 0x8c]
call fcn.00666944
pop ecx
inc ebx
cmp ebx, 0xa
jne 0x6669bc
pop esi
pop ebx
pop ebp
ret
Function at 0x67cd54
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov ebx, eax
lea eax, [ebp - 0x24]
mov edx, dword [0x48de28]
call fcn.00406228
xor eax, eax
push ebp
push 0x67ceaf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0xe40], 0
jne 0x67cd9b
cmp byte [ebx + 0xe42], 0
jne 0x67cd9b
cmp byte [ebx + 0xe41], 0
je 0x67cdc6
cmp byte [ebx + 0xe42], 0
je 0x67cdba
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0x13d6
mov eax, ebx
call fcn.0067dab0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x50]
jmp 0x67ce8b
xor eax, eax
push ebp
push 0x67ce6c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x1205], 0
jne 0x67cdf8
mov eax, ebx
call fcn.006822d0
mov byte [ebx + 0x1205], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x1208], eax
jmp 0x67ce62
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x1208]
cmp eax, 0x9c40
jbe 0x67ce54
mov byte [ebx + 0xe40], 1
jmp 0x67ce54
movzx esi, word [ebp - 0x24]
cmp si, 0x7f
jne 0x67ce3e
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.006b3f14
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00681ff8
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x1208], eax
jmp 0x67ce54
cmp si, 0x27
jne 0x67ce54
mov byte [ebx + 0x120c], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x1768], eax
lea edx, [ebp - 0x24]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test al, al
jne 0x67ce13
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x67ce8b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67ceb6
lea eax, [ebp - 0x28]
call fcn.004054d0
lea eax, [ebp - 0x24]
mov edx, dword [0x48de28]
call fcn.004062f8
ret
Function at 0x401047
Capabilities:
Set current directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.00403ea0
pop ecx
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea edi, [eax - 1]
neg edi
sbb edi, edi
neg edi
test esi, esi
je 0x401076
push dword [esp + 0xc]
call fcn.00401df5
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x401978
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [0x41d814]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4019a3
push edi
mov edi, dword [esp + 0xc]
movzx ecx, byte [edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x41ce00]
inc edi
dec esi
jne 0x40198c
pop edi
mov dword [0x41d814], edx
pop esi
ret
Function at 0x402d24
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push 0x105
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x402d47
cmp byte [esi], 0
je 0x402d47
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x402d95
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4191a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xc]
push eax
call fcn.00406690
pop ecx
cmp eax, 8
jae 0x402e5a
push esi
xor esi, esi
lea eax, [ebp - 0x2c]
push esi
push esi
push esi
push esi
push esi
push 0x20
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x402df8
mov eax, 0xffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00406a89
mov esp, ebp
pop ebp
ret 4
push 7
lea eax, [ebp - 0x2c]
push str.PKBACK
push eax
call fcn.00403445
add esp, 0xc
test eax, eax
jne 0x402de2
mov cl, byte [ebp - 0x2c]
lea eax, [ebp - 0x2c]
test cl, cl
je 0x402de2
cmp cl, 0x2e
je 0x402e2a
cmp cl, 0x20
je 0x402e2a
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x402e19
cmp byte [eax], 0
je 0x402de2
mov cl, byte [eax]
cmp cl, 0x30
jb 0x402e3b
cmp cl, 0x39
jbe 0x402e4f
inc eax
jmp 0x402e2f
movzx ecx, cl
sub ecx, 0x30
imul esi, esi, 0xa
cmp ecx, 9
ja 0x402e55
add esi, ecx
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x402e3e
mov ax, si
jmp 0x402de7
push 0x412
push str.sfxhead.c
call fcn.00404135
int3

Function at 0x40363c
Capabilities:
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
push esi
push 8
add edx, edx
pop esi
sar edx, 1
mov eax, ecx
xor eax, edx
shr ecx, 1
test al, 1
je 0x40365a
xor ecx, 0xedb88320
dec esi
test esi, esi
jg 0x403648
mov eax, ecx
pop esi
ret 4
Function at 0x403efe
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x4191a0]
xor eax, ebp
mov dword [ebp + 0x398], eax
push edi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x403ff6
lea eax, [ebp - 0x80]
mov edi, 0x209
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], edi
push eax
push str.winzip_shellopencommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x403ff6
push esi
lea esi, [ebp - 0x7c]
cmp word [ebp - 0x7c], ax
je 0x403f7d
push ebx
xor ebx, ebx
push 4
push str.___1
push esi
call fcn.004067e3
add esp, 0xc
test eax, eax
je 0x403f7c
add esi, 2
cmp word [esi], bx
jne 0x403f60
pop ebx
lea ecx, [ebp - 0x7c]
mov eax, esi
sub eax, ecx
add eax, 2
push 0x41d4a0
sar eax, 1
sub edi, eax
lea eax, [esi + 2]
push 0x4133cc
push edi
push eax
call fcn.00406a6d
mov eax, dword [0x419044]
add esp, 0x10
pop esi
test eax, 0x1000
je 0x403fdb
test eax, 0x8000
jne 0x403fdb
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x7a
pop ecx
push 0x69
lea eax, [ebp + eax*2 - 0x84]
mov word [eax], cx
pop ecx
mov word [eax + 2], cx
push 0x70
pop ecx
mov word [eax + 4], cx
push 0xffffffffffffffff
lea eax, [ebp - 0x7c]
push 0x4133d8
push eax
call fcn.0040424c
add esp, 0xc
neg eax
sbb eax, eax
neg eax
jmp 0x40401c
push 0
push 0x7d0
call fcn.004034be
push eax
push 0x40e
call fcn.004034be
push eax
push dword [0x41d81c]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
pop edi
call fcn.00406a89
lea esp, [ebp + 0x39c]
pop ebp
ret
Function at 0x404135
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x11c]
sub esp, 0x19c
mov eax, dword [0x4191a0]
xor eax, ebp
mov dword [ebp + 0x118], eax
mov eax, dword [0x41a2b8]
mov ecx, eax
mov edx, dword [ebp + 0x124]
inc eax
mov dword [0x41a2b8], eax
push esi
test ecx, ecx
je 0x404170
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x128]
push edx
push 0x7d4
call fcn.004034be
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x30
push 0x7d0
call fcn.004034be
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x41d81c]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push str.WZSFX32.RPT
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404168
push 0x413440
lea eax, [ebp - 0x7c]
push 0x191
push eax
call fcn.00406623
add esp, 0xc
lea eax, [ebp - 0x80]
push 0
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00406690
pop ecx
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.004038b9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WZSFX32.RPT
push 0x7d1
call fcn.004034be
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x30
push 0x7d0
call fcn.004034be
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x41d81c]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404168
Function at 0x40424c
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xfe8
mov eax, dword [0x4191a0]
xor eax, esp
mov dword [esp + 0xfe4], eax
push ebx
mov ebx, dword [esp + 0xff0]
lea eax, [esp + 0xa20]
push ebp
mov ebp, dword [esp + 0xffc]
push esi
mov esi, dword [esp + 0xffc]
push edi
push ebx
push 0x2e3
push eax
call fcn.00406787
xor edi, edi
add esp, 0xc
cmp word [esi], di
je 0x4042c3
push 0x413378
lea eax, [esp + 0xa30]
push 0x2e3
push eax
call fcn.00406787
push esi
lea eax, [esp + 0xa3c]
push 0x2e3
push eax
call fcn.0040671b
add esp, 0x18
cmp ebp, 0xffffffff
jne 0x40431b
push 0x10
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00403490
push 0x44
pop edi
push edi
xor ecx, ecx
lea eax, [esp + 0x30]
push ecx
push eax
call fcn.00403490
add esp, 0x18
mov dword [esp + 0x20], edi
lea eax, [esp + 0x10]
xor edi, edi
push eax
lea eax, [esp + 0x24]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0xa4c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40431b
mov eax, dword [esp + 0x10]
jmp 0x404453
lea eax, [esp + 0x464]
push eax
push edi
push ebx
call dword [sym.imp.SHELL32.dll_FindExecutableW]
mov edi, eax
cmp edi, 0x1f
jne 0x404392
mov ebp, pe_nt_image_headers32
lea eax, [esp + 0x64]
push ebp
push eax
push 0xffffffffffffffff
push 0x427
call fcn.004034be
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edi, edi
push eax
push edi
push edi
call esi
push ebx
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x46c]
push 0x2e3
push eax
call fcn.00406a6d
add esp, 0x10
lea eax, [esp + 0x264]
push ebp
push eax
push 0xffffffffffffffff
push 0x7d0
call fcn.004034be
push eax
push edi
push edi
call esi
push 0x10
jmp 0x404435
cmp edi, 0x20
jbe 0x4043d8
xor eax, eax
xor ecx, ecx
cmp word [esi], cx
push 1
cmovne eax, esi
push ecx
push eax
mov eax, dword [0x419044]
and eax, 0x20000
neg eax
push ebx
sbb eax, eax
and eax, 0x41337c
push eax
push dword [0x41d81c]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
test ebp, ebp
je 0x4043cf
mov dword [ebp], edi
cmp edi, 0x20
jbe 0x4043d8
mov eax, edi
jmp 0x404453
mov ebp, pe_nt_image_headers32
lea eax, [esp + 0x64]
push ebp
push eax
push 0xffffffffffffffff
push 0x400
call fcn.004034be
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
xor eax, eax
push eax
push eax
call esi
push ebx
push edi
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x470]
push 0x2e3
push eax
call fcn.00406a6d
add esp, 0x14
lea eax, [esp + 0x264]
push ebp
push eax
push 0xffffffffffffffff
push 0x7d0
call fcn.004034be
push eax
xor ebx, ebx
push ebx
push ebx
call esi
push ebx
lea eax, [esp + 0x268]
push eax
lea eax, [esp + 0x46c]
push eax
push dword [0x41d81c]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0xff4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00406a89
add esp, 0xfe8
ret
Function at 0x40446c
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [0x41d6ce]
test edi, edi
jg 0x404482
and dword [0x41d808], 0
xor eax, eax
pop edi
ret
mov eax, 0x800
cmp edi, eax
push esi
cmova edi, eax
push edi
push dword [0x41d810]
push dword [0x41a290]
call dword [sym.imp.KERNEL32.dll__lread]
cmp dword [0x41a2b0], 0
mov esi, eax
mov dword [0x41d808], esi
je 0x404500
cmp esi, 0xffffffff
je 0x404500
cmp esi, edi
je 0x404511
test esi, esi
js 0x404500
mov ax, word [0x419064]
push dword [0x41a2b4]
inc ax
movzx eax, ax
push eax
call fcn.00403683
mov esi, dword [0x41d808]
test esi, esi
jne 0x4044fa
push edi
push dword [0x41d810]
push dword [0x41a290]
call dword [sym.imp.KERNEL32.dll__lread]
mov esi, eax
mov dword [0x41d808], esi
cmp esi, 0xffffffff
cmovne edi, esi
cmp esi, edi
je 0x404511
push 2
call fcn.00401731
mov esi, dword [0x41d808]
sub dword [0x41d6ce], esi
cmp dword [0x41a2a0], 0
mov edi, dword [0x41d810]
mov dword [0x41d80c], edi
je 0x40454b
test esi, esi
je 0x40454b
call fcn.00406421
xor byte [edi], al
movzx eax, byte [edi]
push eax
call fcn.004064fb
inc edi
pop ecx
dec esi
jne 0x404530
mov esi, dword [0x41d808]
mov eax, esi
dec esi
mov dword [0x41d808], esi
pop esi
pop edi
ret
Function at 0x406473
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4191a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x41a2a8]
mov esi, dword [ebp + 8]
call fcn.0040643b
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0040346e
add esp, 0x10
xor esi, esi
call fcn.00406421
movzx ecx, byte [ebp + esi - 0x10]
xor eax, ecx
mov byte [ebp + esi - 0x10], al
movzx eax, al
push eax
call fcn.004064fb
inc esi
pop ecx
cmp esi, 0xc
jl 0x4064a3
cmp dword [0x41a2a4], 0
movzx ecx, byte [ebp - 5]
pop esi
je 0x4064e2
movzx eax, byte [0x41d6c7]
cmp cx, ax
je 0x4064eb
or eax, 0xffffffff
jmp 0x4064ed
movzx eax, byte [0x41d6cd]
jmp 0x4064d8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406a89
mov esp, ebp
pop ebp
ret

Function at 0x4064fb
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [0x41cdb0]
mov edx, 0xff
mov eax, ecx
shr ecx, 8
xor eax, dword [esp + 4]
and eax, edx
xor ecx, dword [eax*4 + 0x41ce00]
movzx eax, cl
add eax, dword [0x41cdb4]
mov dword [0x41cdb0], ecx
imul ecx, eax, 0x8088405
mov eax, dword [0x41cdb8]
inc ecx
mov dword [0x41cdb4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, edx
xor eax, dword [ecx*4 + 0x41ce00]
mov dword [0x41cdb8], eax
ret
Function at 0x40d9c7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4191a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408602
mov dword [ebp - 0x14], eax
cmp dword [0x41cd84], esi
jne 0x40daba
push 0x800
push esi
push 0x416fdc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40da47
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40db9a
push esi
push esi
push 0x416fdc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40db9a
push 0x416ff4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40db9a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x41cd84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x417010
push edi
mov dword [0x41cd88], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x41cd8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41cd94], eax
test eax, eax
je 0x40dab7
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41cd90], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40dadf
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40dad2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40daf4
push 4
pop eax
jmp 0x40db9c
cmp dword [ebp - 0x14], esi
je 0x40daf4
push dword [0x41cd84]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40dad9
mov eax, dword [0x41cd90]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40db52
cmp dword [0x41cd94], edi
je 0x40db52
push eax
call ebx
push dword [0x41cd94]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40db52
test eax, eax
je 0x40db52
call ecx
test eax, eax
je 0x40db47
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40db47
test byte [ebp - 8], 1
jne 0x40db52
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40db82
mov eax, dword [0x41cd88]
cmp eax, edi
je 0x40db7f
push eax
call ebx
test eax, eax
je 0x40db7f
call eax
mov esi, eax
test esi, esi
je 0x40db7f
mov eax, dword [0x41cd8c]
cmp eax, edi
je 0x40db7f
push eax
call ebx
test eax, eax
je 0x40db7f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x41cd84]
call ebx
test eax, eax
je 0x40db9a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40db9c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406a89
mov esp, ebp
pop ebp
ret