joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414c30
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6945d4]
jne 0x414c3a
repz ret
jmp fcn.0041509e

Function at 0x415600
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push edi
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jne 0x41562a
or eax, 0xffffffff
pop edi
add esp, 0x14
ret 0x10
mov eax, dword [esp + 4]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
seto cl
push ebx
push esi
neg ecx
or ecx, eax
push ecx
call fcn.0041571c
mov esi, eax
mov eax, dword [esp + 0x10]
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], 0
test eax, eax
jle 0x4156cb
mov eax, edi
sub eax, esi
push ebp
mov dword [esp + 0x18], eax
jmp 0x415674
mov eax, dword [esp + 0x18]
mov edi, dword [eax + esi]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
push ebx
call fcn.0041571c
add esp, 4
push 0
push 0
push ebx
mov ebp, eax
push ebp
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x14]
mov dword [esi], ebp
mov eax, dword [esp + 0x10]
inc ecx
add esi, 4
mov dword [esp + 0x14], ecx
cmp ecx, eax
jl 0x415670
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
pop ebp
push edi
mov dword [esi + eax*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0xc]
push esi
push eax
call fcn.00401140
xor edi, edi
add esp, 8
mov ebx, eax
cmp dword [esp + 0xc], edi
jle 0x415708
mov eax, dword [esi + edi*4]
test eax, eax
je 0x415708
push eax
call sub.QL_CR100.dll_void___cdecl_operator_delete___void__
inc edi
add esp, 4
cmp edi, dword [esp + 0xc]
jl 0x4156f1
push esi
call sub.QL_CR100.dll_void___cdecl_operator_delete___void__
add esp, 4
pop esi
mov eax, ebx
pop ebx
pop edi
add esp, 0x14
ret 0x10
Function at 0x4045b0
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x18
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
sub esp, 4
mov dword [esp], ebx
call sub.msvcrt.dll_remove
add esp, 0x18
pop ebx
ret

Function at 0x4045e0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov eax, 0x4018
call fcn.0040a650
sub esp, eax
mov eax, dword [esp + 0x4020]
lea ebx, [esp + 0x10]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00405280
mov dword [esp + 8], 0x2000
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
jne 0x404640
add esp, 0x4018
xor eax, eax
pop ebx
ret
lea eax, [esp + 0x2010]
mov dword [esp + 8], 0x2000
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
sub esp, 0xc
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004050e0
test eax, eax
je 0x40462c
cmp byte [eax], 0
je 0x40462c
mov dword [esp], eax
call sub.msvcrt.dll__strdup
add esp, 0x4018
pop ebx
ret

Function at 0x404690
Capabilities:
Set environment variable

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00405280
mov esi, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00405280
mov dword [esp], esi
mov ebx, eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
sub esp, 8
mov edi, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x10
mov eax, edi
pop ebx
pop esi
pop edi
ret

Function at 0x404700
Capabilities:
Set environment variable

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00405280
mov dword [esp + 4], 0
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
sub esp, 8
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
Function at 0x404750
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
push edi
mov eax, 0x202c
push esi
push ebx
call fcn.0040a650
sub esp, eax
lea ebx, [esp + 0x20]
mov esi, dword [esp + 0x2040]
mov dword [esp], 0x1000
mov dword [esp + 4], ebx
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
sub esp, 8
lea edi, [esp + 0x10]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x1000
mov dword [esp], esi
mov ebx, 5
call fcn.004050e0
call sub.msvcrt.dll__getpid
mov dword [esp + 4], str._MEI_d
mov dword [esp + 8], eax
mov dword [esp], edi
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__tempnam]
mov dword [esp], eax
mov ebp, eax
call sub.msvcrt.dll__mkdir
test eax, eax
je 0x4047f0
mov dword [esp], ebp
call sub.msvcrt.dll_free
sub ebx, 1
jne 0x4047b5
add esp, 0x202c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp], ebp
call sub.msvcrt.dll_free
add esp, 0x202c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x404880
Capabilities:
Delete directory

Disassembly:
push ebp
push edi
mov eax, 0x125c
push esi
push ebx
call fcn.0040a650
sub esp, eax
mov eax, dword [esp + 0x1270]
lea ebp, [esp + 0x24f]
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], ebp
call sub.msvcrt.dll_strlen
mov edx, eax
mov dword [esp + 0x12c], eax
movzx edx, byte [esp + edx + 0x24e]
cmp dl, 0x5c
je 0x4048d1
cmp dl, 0x2f
jne 0x404980
lea ebx, [esp + 0x134]
mov edx, 0x2a
mov word [ebp + eax], dx
mov dword [esp], ebp
mov dword [esp + 4], ebx
call dword [sym.imp.msvcrt.dll__findfirst]
cmp eax, 0xffffffff
mov dword [esp + 0x128], eax
je 0x404961
mov edi, esp
mov esi, ebx
mov ecx, 0x46
rep movsd dword es:[edi], dword [esi]
mov eax, ebp
mov edx, dword [esp + 0x12c]
call fcn.004049b0
jmp 0x404939
mov edi, esp
mov esi, ebx
mov ecx, 0x46
rep movsd dword es:[edi], dword [esi]
mov eax, ebp
mov edx, dword [esp + 0x12c]
call fcn.004049b0
mov eax, dword [esp + 0x128]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__findnext]
test eax, eax
je 0x404920
mov eax, dword [esp + 0x128]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__findclose]
mov eax, dword [esp + 0x1270]
mov dword [esp], eax
call sub.msvcrt.dll__rmdir
add esp, 0x125c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 0x5c
mov word [ebp + eax], cx
add eax, 1
mov dword [esp], ebp
mov dword [esp + 0x12c], eax
call sub.msvcrt.dll_strlen
jmp 0x4048d1
Function at 0x404d00
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push edi
push esi
mov eax, 0x20a0
push ebx
call fcn.0040a650
sub esp, eax
mov eax, dword [esp + 0x20b0]
lea esi, [esp + 0xa0]
mov dword [esp + 8], 0x1000
mov dword [esp + 0x3c], 0
lea edi, [esp + 0x5c]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00405280
mov dword [esp + 4], 1
mov dword [esp], 0x16
call sub.msvcrt.dll_signal
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.msvcrt.dll_signal
mov dword [esp + 4], 1
mov dword [esp], 0xf
call sub.msvcrt.dll_signal
mov dword [esp + 4], 1
mov dword [esp], 0x15
call sub.msvcrt.dll_signal
mov dword [esp + 0x40], 0xc
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoW]
mov eax, 1
sub esp, 4
mov word [esp + 0x8c], ax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x88], 0x101
mov dword [esp], eax
call sub.msvcrt.dll__fileno
mov ebx, dword [sym.imp.msvcrt.dll__get_osfhandle]
mov dword [esp], eax
call ebx
mov dword [esp + 0x94], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll__fileno
mov dword [esp], eax
call ebx
mov dword [esp + 0x98], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll__fileno
mov dword [esp], eax
call ebx
mov dword [esp + 0x9c], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
lea edx, [esp + 0x4c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x24], edx
lea edx, [esp + 0x40]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x404eb0
mov dword [esp], str.Error_creating_child_process__n
call fcn.00401e10
add esp, 0x20a0
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
sub esp, 8
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
sub esp, 8
mov eax, dword [esp + 0x3c]
add esp, 0x20a0
pop ebx
pop esi
pop edi
ret
Function at 0x409a50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00409ab0

Function at 0x409ab0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x41e2f0]
test eax, eax
jle 0x409bb3
mov edx, dword [0x41e2f4]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x409ae1
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x409b56
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x409ad0
mov dword [esp], esi
call fcn.0040a430
test eax, eax
mov edi, eax
je 0x409bda
lea esi, [ebx + ebx*2]
mov ebx, dword [0x41e2f4]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.0040a520
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x41e2f4]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x409bba
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x409b60
add dword [0x41e2f0], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x409b4f
cmp eax, 0x80
je 0x409b4f
cmp eax, 8
je 0x409b4f
mov eax, dword [ebp - 0x28]
add esi, dword [0x41e2f4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x409b4f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00409a50
xor ebx, ebx
jmp 0x409aeb
mov eax, dword [0x41e2f4]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00409a50
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00409a50
lea esi, [esi]

Function at 0x40a350
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40a388
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x40a37e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x40a38a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x40a370
xor eax, eax
pop ebx
pop esi
ret
Function at 0x41b56a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x41b579
pop dword [ebp - 0x1c]
mov eax, 0xbcfd9d28
sub eax, 0xbcbbe7af
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x5d6b8ff5
sub dword [ebp - 0x2c], 0xf194aaa
mov dword [ebp - 0x28], 0x94606d64
sub dword [ebp - 0x28], 0x622d211f
mov dword [ebp - 0x24], 0xc0031cb2
sub dword [ebp - 0x24], 0x73b6d884
mov dword [ebp - 0x20], 0x3582daa8
add dword [ebp - 0x20], 0xca7d2558
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x4b578562
sub eax, 0x4b11d4fe
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xc5bd5d20
sub dword [ebp - 0x2c], 0x514af3ca
mov dword [ebp - 0x28], 0x194de875
add dword [ebp - 0x28], 0x281e7900
mov dword [ebp - 0x24], 0x24aee80a
add dword [ebp - 0x24], 0x3ec08462
mov dword [ebp - 0x20], 0xefdc9d13
add dword [ebp - 0x20], 0x102362ed
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x4a903
push 0
call eax
mov ecx, 0xb9d32104
sub ecx, 0xb9d2e418
mov edi, eax
mov ebx, 0x95f60753
sub ebx, 0x95aea753
add ebx, dword [ebp - 0x1c]
mov esi, 0x54c2f0ad
add esi, 0xa13ef11b
sub dword [ebp - 0xc], edi
mov edx, dword [ebx]
xor dword [ebp - 0x18], 0xac48c4d6
add edx, esi
sub dword [ebp - 0xc], 0xa92d0d6e
mov dword [edi], edx
sub dword [ebp - 0x18], eax
add edi, 0x1208e1ab
sub edi, 0x1208e1a7
add ebx, 4
loop 0x41b696
add eax, 0xe683
xor ebx, ebx
add ebx, eax
add eax, 0x45215cc3
sub eax, 0x45215cbe
mov ecx, 0x5b9de0ba
sub ecx, 0x5b5de0ba
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x30015fc2
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x30018a58
call fcn.30191000
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x3001dc9c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x30015d65
cmp eax, esi
jne 0x30015d58
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x30015d68
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30015d3f
xor esi, esi
inc esi
mov eax, dword [0x3001dc98]
cmp eax, esi
jne 0x30015d7b
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x30015daa
mov eax, dword [0x3001dc98]
test eax, eax
jne 0x30015da4
mov dword [0x3001dc98], esi
push 0x300013d8
push 0x300013d0
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x30015daa
jmp 0x30015ece
mov dword [0x3001d94c], esi
mov eax, dword [0x3001dc98]
cmp eax, esi
jne 0x30015dce
push 0x300013cc
push 0x30001308
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x3001dc98], 2
cmp dword [ebp - 0x20], ebx
jne 0x30015ddb
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x3001dca8], ebx
je 0x30015dfc
push 0x3001dca8
call fcn.3001652e
pop ecx
test eax, eax
je 0x30015dfc
push ebx
push 2
push ebx
call dword [0x3001dca8]
mov eax, dword [sym.imp.MSVCR80.dll__wcmdln]
cmp dword [eax], ebx
je 0x30015ece
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x30015e66
cmp cx, bx
je 0x30015e21
cmp dword [ebp - 0x1c], ebx
jne 0x30015e66
movzx ecx, word [eax]
cmp cx, bx
je 0x30015e36
cmp cx, 0x20
ja 0x30015e36
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x30015e21
test byte [ebp - 0x40], 1
je 0x30015e42
movzx ecx, word [ebp - 0x3c]
jmp 0x30015e45
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x30000000
call main
mov dword [0x3001d948], eax
cmp dword [0x3001d93c], ebx
jne 0x30015eab
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp cx, 0x22
jne 0x30015e77
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x30015e0b
cmp dword [0x3001d94c], ebx
jne 0x30015eb9
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3001d948]
jmp 0x30015eda
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.300161f5
ret
call fcn.30015670
jmp 0x30015d02
Function at 0x4014d8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
lea eax, [ebp - 8]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor ebx, ebx
lea eax, [ebp - 0x28]
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x20
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x40153a
push 7
lea eax, [ebp - 0x28]
push str.PKBACK
push eax
call fcn.00401028
add esp, 0xc
test eax, eax
jne 0x40153a
mov al, byte [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmp al, bl
je 0x401536
cmp al, 0x2e
je 0x401536
cmp al, 0x20
je 0x401536
mov al, byte [ecx + 1]
inc ecx
jmp 0x401524
cmp byte [ecx], bl
jne 0x401540
or ax, 0xffff
jmp 0x40156c
mov al, byte [ecx]
cmp al, 0x30
jb 0x40154a
cmp al, 0x39
jbe 0x40154d
inc ecx
jmp 0x401540
xor eax, eax
mov dl, byte [ecx]
cmp dl, bl
je 0x40156c
movzx edx, dl
lea eax, [eax + eax*4]
shl eax, 1
sub edx, 0x30
js 0x40156c
cmp edx, 9
jg 0x40156c
add eax, edx
inc ecx
jmp 0x40154f
pop ebx
leave
ret 4

Function at 0x401650
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40168b
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x401672
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x401683
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40168d
inc edi
add eax, 0x28
cmp edi, esi
jb 0x401668
xor eax, eax
pop edi
pop esi
ret

Function at 0x401877
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], pe_nt_image_headers32
mov byte [ebp - 0x47], 0xa7
call fcn.00401610
sti
pop es
mov esp, 0xa8458d47
push eax
call fcn.00401620
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004015d5
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4018fe
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00401610
fcom qword [0x458ddf6c]
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x401d1f
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x401ce7
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x401d05
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
inc ebp
invalid
ja 0x401d63
inc ebp
mov esp, 0xd78b4077
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x401d4a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x401d53
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x401d5d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x401d3f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
cmp ecx, dword [eax + 6]
jbe 0x401cc9
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x401db0
dec eax
je 0x401da7
sub eax, 3
je 0x401d9e
mov dword [ebp - 4], 0x40
jmp 0x401dcd
mov dword [ebp - 4], 4
jmp 0x401db3
mov dword [ebp - 4], 0x20
jmp 0x401db3
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x401dff
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x401d7f
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00401610
sahf
pop esi
das
stc
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x401e0b
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4054e2
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x407e70]
xor eax, ecx
mov edx, 0xff
and eax, edx
push esi
shr ecx, 8
mov eax, dword [eax*4 + 0x407ea0]
xor eax, ecx
mov ecx, dword [0x407e78]
mov dword [0x407e70], eax
and eax, edx
add eax, dword [0x407e74]
mov esi, ecx
and esi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [0x407e74], eax
shr eax, 0x18
xor esi, eax
shr ecx, 8
mov eax, dword [esi*4 + 0x407ea0]
pop esi
xor eax, ecx
mov dword [0x407e78], eax
ret

Function at 0x4055c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push dword [0x407e10]
call fcn.0040553d
pop ecx
lea eax, [ebp - 0xc]
push 0xc
push dword [ebp + 8]
push eax
call fcn.00401000
add esp, 0xc
xor edi, edi
lea esi, [ebp + edi - 0xc]
call fcn.004054cc
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.004054e2
inc edi
pop ecx
cmp edi, 0xc
jl 0x4055f0
cmp dword [0x407e0c], 0
movzx ax, byte [ebp - 1]
je 0x405623
xor ecx, ecx
mov cl, byte [0x408407]
jmp 0x40562c
mov ecx, dword [0x40840a]
shr ecx, 0x18
cmp ax, cx
je 0x405636
or eax, 0xffffffff
jmp 0x405638
xor eax, eax
pop edi
pop esi
leave
ret