joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40551a
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x405549
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x405544
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40552e
invalid
adc eax, dword [ecx + 0xfffe1]
add byte [ebx + 0x34572bd6], cl
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x405536
cmp edx, ebx
jne 0x405684
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x405505
add eax, dword [eax + 4]
jmp 0x4054f2
mov dword [ebp + 0xc], ebx
jmp 0x405554
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40556c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40558a
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4055e8
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4055cf
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4055d8
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4055e2
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4055c4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40554e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x405635
dec eax
je 0x40562c
sub eax, 3
je 0x405623
mov dword [ebp - 4], 0x40
jmp 0x405652
mov dword [ebp - 4], 4
jmp 0x405638
mov dword [ebp - 4], 0x20
jmp 0x405638
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x405684
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x405604
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00404e95
push 0xff666a5b
jne 0x40568f
push 1
push esi
call edi
mov eax, esi
jmp 0x405690
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405e0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + 0x30fffffc], ebx
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
xor dh, al
test dword [ebp + 0x36fffffc], esp
Function at 0x40cdf0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x41a510
call fcn.00413954
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x41b694
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x41b748
push 4
mov ebx, 0x41b684
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.004032a8
mov dword [esi + 0x3c], 0x41b7f8
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.004032a8
mov dword [edi], 0x41b800
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b99b
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.0040c3f8
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b99b
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0040c3f8
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b99b
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.0040c3f8
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b99b
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.0040c3f8
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040c3f8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x413220
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.004148be
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x413248
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413257
mov eax, 1
ret 4
Function at 0x1000100c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0
xor eax, eax
call dword [0x116f683f]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10001058
push 0
push 0x40100dc
push 6
call fcn.10002e30
add esp, 0xc
mov dword [ebp - 4], 0
push 0
mov ebx, 0x104
call fcn.10003220
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x100010a0
push 0x4b
push 0x40100dc
push 6
call fcn.10002e30
add esp, 0xc
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100010b0
push ebx
call fcn.10002e2a
add esp, 4
call fcn.1000121e
mov eax, 0x10009230
test eax, eax
je 0x100010d1
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.10002e24
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [0x116f682f]
test ebx, ebx
je 0x100010e5
push ebx
call fcn.10002e2a
add esp, 4
pop eax
mov dword [0x116f682f], eax
call fcn.10001304
and eax, 1
xor eax, 1
test eax, eax
je 0x100011d7
push 1
push 0
call fcn.100015d6
call fcn.10001656
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10001126
push ebx
call fcn.10002e2a
add esp, 4
pop eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x116f6833
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100011a9
push 8
call fcn.10002e24
add esp, 4
mov dword [ebp - 0x10], eax
mov edi, eax
mov esi, 0x116a9f38
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, 0x116a9f40
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0x116f6833
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x14]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x10001196
push ebx
call fcn.10002e2a
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.10002e2a
add esp, 4
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], esp
xor eax, eax
call dword [0x116f6843]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x100011d2
push 0x219
push 0x40100dc
push 6
call fcn.10002e30
add esp, 0xc
call fcn.10002388
call fcn.100023c3
mov dword [ebp - 0x10], esp
xor eax, eax
call dword [0x116f6843]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10001205
push 0x269
push 0x40100dc
push 6
call fcn.10002e30
add esp, 0xc
jmp 0x1000120a
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000121a
push ebx
call fcn.10002e2a
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x100023d2
Capabilities:
Check for trap flag exception

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
pushfd
or dword [esp], 0x100
popfd
clc
call fcn.100023f7

Function at 0x10003650
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000366e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x10003663
pop esi
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xf91d0e4a
adc edi, dword [edx - 0x7c3d0366]
or edi, dword [esi]
sub ebx, 0x912b0ab1
xchg ecx, eax
push ds
add bh, byte [ebx + edi*4]
xor ebx, dword [eax + 5]
adc eax, 0xbc34524
cdq
cld
jns 0x414ad2
cmp edi, dword [esi - 0x6314ac3d]
sub bl, 0x33
lodsb al, byte [esi]
cmp al, 0x14
and al, 0x14
cwde
adc al, 0x24
add edi, dword [ebx - 5]
mov ebx, 0xa03c3bd
jp 0x414b3a
adc al, 0x12
aas
ret
stosb byte es:[edi], al
invalid
Function at 0x1003a584
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push 1
xor edi, edi
pop eax
cmp ebx, eax
jl 0x1003a599
cmp ebx, 8
jle 0x1003a59b
xor eax, eax
mov esi, dword [esp + 0x10]
push 0x10015da0
push eax
push esi
call fcn.10039120
lea ecx, [esi + 0x6af68]
lea eax, [esi + 0x6af70]
add esp, 0xc
cmp dword [ecx], edi
mov dword [eax], edi
jne 0x1003a5cc
mov dword [eax], 1
mov dword [ecx], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af68]
push edi
push eax
mov dword [esi + 0x6af64], edi
call fcn.1003ccfc
mov eax, ebx
add esp, 0xc
shl eax, 3
cmp ebx, 2
movzx ecx, word [eax + 0x1000fc2a]
mov dword [esi + 0x6af90], ecx
movzx ecx, word [eax + 0x1000fc28]
mov dword [esi + 0x6af94], ecx
movzx ecx, word [eax + 0x1000fc2c]
mov dword [esi + 0x6af98], ecx
movzx eax, word [eax + 0x1000fc2e]
mov dword [esi + 0x6af8c], eax
jg 0x1003a62e
mov eax, dword [esp + 0x18]
or byte [eax], 4
jmp 0x1003a63a
cmp ebx, 8
jl 0x1003a63a
mov eax, dword [esp + 0x18]
or byte [eax], 2
lea ebx, [esi + 0x1af68]
push 0x10000
push ebx
push esi
mov dword [esi + 0x6af7c], edi
mov dword [esi + 0x6af6c], edi
call dword [esi + 9]
add esp, 0xc
cmp eax, edi
mov dword [esi + 0x6af88], eax
je 0x1003a6aa
cmp eax, 0xffffffff
je 0x1003a6aa
cmp eax, 0x106
mov dword [esi + 0x6af84], edi
jae 0x1003a67c
push esi
call fcn.1003a881
pop ecx
mov dword [esi + 0x6af74], edi
movzx eax, byte [ebx + edi]
mov ecx, dword [esi + 0x6af74]
and eax, 0x7fff
and ecx, 0x3ff
shl ecx, 5
xor eax, ecx
inc edi
cmp edi, 2
mov dword [esi + 0x6af74], eax
jb 0x1003a682
jmp 0x1003a6ba
mov dword [esi + 0x6af84], 1
mov dword [esi + 0x6af88], edi
pop edi
pop esi
pop ebx
ret
Function at 0x1003a9ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebp, ebp
xor edi, edi
mov eax, dword [esi + 0x6af88]
mov dword [esi + 0x6af78], 2
test eax, eax
je 0x1003abc6
push ebx
mov ebx, 0x7fff
cmp eax, 3
jb 0x1003aa24
mov ecx, dword [esi + 0x6af7c]
mov edx, dword [esi + 0x6af74]
and edx, 0x3ff
movzx eax, byte [ecx + esi + 0x1af6a]
and eax, ebx
shl edx, 5
xor eax, edx
and ecx, ebx
mov dword [esi + 0x6af74], eax
mov ebp, dword [esi + eax*4 + 0x4af68]
mov dword [esi + ecx*4 + 0x2af68], ebp
mov eax, dword [esi + 0x6af74]
mov ecx, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af68], ecx
test ebp, ebp
je 0x1003aa60
mov eax, dword [esi + 0x6af7c]
sub eax, ebp
cmp eax, 0x7efa
ja 0x1003aa60
mov ecx, dword [esi + 0x6af88]
lea eax, [esi + 0x6af98]
cmp dword [eax], ecx
jbe 0x1003aa49
mov dword [eax], ecx
push ebp
push esi
call fcn.1003a6be
mov edi, eax
mov eax, dword [esi + 0x6af88]
pop ecx
cmp edi, eax
pop ecx
jbe 0x1003aa60
mov edi, eax
cmp edi, 3
jb 0x1003ab3d
lea eax, [edi - 3]
push eax
mov eax, dword [esi + 0x6af7c]
sub eax, dword [esi + 0x6af80]
push eax
push esi
call fcn.10039ef2
sub dword [esi + 0x6af88], edi
add esp, 0xc
cmp edi, dword [esi + 0x6af90]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x6af88]
ja 0x1003aaf6
cmp eax, 3
jb 0x1003aaf6
dec edi
inc dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af7c]
mov edx, dword [esi + 0x6af74]
movzx eax, byte [esi + ecx + 0x1af6a]
and edx, 0x3ff
and eax, ebx
shl edx, 5
xor eax, edx
and ecx, ebx
mov dword [esi + 0x6af74], eax
dec edi
mov ebp, dword [esi + eax*4 + 0x4af68]
mov dword [esi + ecx*4 + 0x2af68], ebp
mov eax, dword [esi + 0x6af74]
mov ecx, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af68], ecx
jne 0x1003aaa1
jmp 0x1003ab61
add dword [esi + 0x6af7c], edi
mov eax, dword [esi + 0x6af7c]
lea edx, [esi + 0x6af74]
push 0x10015dfc
lea ecx, [eax + esi]
push 1
push esi
xor edi, edi
movzx eax, byte [ecx + 0x1af68]
mov dword [edx], eax
and eax, 0x3ff
movzx ecx, byte [ecx + 0x1af69]
and ecx, ebx
shl eax, 5
xor ecx, eax
mov dword [edx], ecx
call fcn.10039120
add esp, 0xc
jmp 0x1003ab67
mov eax, dword [esi + 0x6af7c]
movzx eax, byte [eax + esi + 0x1af68]
push eax
push 0
push esi
call fcn.10039ef2
add esp, 0xc
dec dword [esi + 0x6af88]
mov dword [esp + 0x14], eax
inc dword [esi + 0x6af7c]
cmp dword [esp + 0x14], 0
je 0x1003aba4
mov eax, dword [esi + 0x6af6c]
test eax, eax
jl 0x1003ab81
lea ecx, [eax + esi + 0x1af68]
jmp 0x1003ab83
xor ecx, ecx
mov edx, dword [esi + 0x6af7c]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.10039cea
mov eax, dword [esi + 0x6af7c]
add esp, 0x10
mov dword [esi + 0x6af6c], eax
cmp dword [esi + 0x6af88], 0x106
jae 0x1003abb7
push esi
call fcn.1003a881
pop ecx
mov eax, dword [esi + 0x6af88]
test eax, eax
jne 0x1003a9d5
pop ebx
mov eax, dword [esi + 0x6af6c]
test eax, eax
jl 0x1003abd9
lea ecx, [eax + esi + 0x1af68]
jmp 0x1003abdb
xor ecx, ecx
mov edx, dword [esi + 0x6af7c]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.10039cea
add esp, 0x10
pop edi
pop esi
pop ebp
ret
Function at 0x1003b71e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1003b72c
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x1003b80d
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x1000fc78]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x1000fc78]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x1000fc78]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x1000fc78]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x1000fc78]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x1000fc78]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x1000fc78]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x1000fc78]
xor eax, esi
inc edx
dec edi
jne 0x1003b749
pop ebx
cmp dword [ebp + 0x10], 0
je 0x1003b82e
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x1000fc78]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x1003b813
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x1003b834
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [esp + 0x10]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0x1000fc78]
xor eax, esi
mov esi, dword [ecx + 8]
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
mov edi, esi
and edi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr esi, 8
mov eax, dword [eax*4 + 0x1000fc78]
xor eax, esi
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x1003b9ef
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push eax
push edi
call dword [0x1000e030]
test eax, eax
jne 0x1003ba12
mov eax, 0x200
jmp 0x1003bb87
mov ecx, dword [ebp - 0x4c]
push ebx
push esi
push 1
mov edx, ecx
pop eax
xor ebx, ebx
and edx, eax
mov dword [ebp - 8], ebx
je 0x1003ba28
mov dword [ebp - 8], eax
test cl, 2
je 0x1003ba31
or dword [ebp - 8], 2
test cl, 4
je 0x1003ba3a
or dword [ebp - 8], 4
mov eax, ecx
and eax, 0x10
je 0x1003ba45
or dword [ebp - 8], 0x10
test cl, 0x20
je 0x1003ba4e
or dword [ebp - 8], 0x20
cmp eax, ebx
je 0x1003ba58
or byte [ebp - 5], 0x40
jmp 0x1003ba5c
or byte [ebp - 5], 0x80
or byte [ebp - 5], 1
cmp edx, ebx
jne 0x1003ba68
or byte [ebp - 6], 0x80
push ebx
push edi
call dword [0x1000e0cc]
cmp eax, 0x28
mov dword [ebp - 0x10], eax
jbe 0x1003bb03
mov esi, dword [0x1000e07c]
push ebx
push ebx
push ebx
push edi
call esi
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 2]
push 2
push eax
push edi
mov edi, dword [0x1000e0c8]
call edi
push ebx
push ebx
push 0x24
push dword [ebp + 8]
call esi
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x14]
push 4
push eax
push dword [ebp + 8]
call edi
cmp word [ebp - 2], 0x54ad
jne 0x1003bb03
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 0x34]
cmp dword [ebp - 0x10], ecx
jbe 0x1003bb03
push ebx
push ebx
push eax
push dword [ebp + 8]
call esi
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 0x18]
cmp eax, 0x5a4d
je 0x1003baff
cmp eax, 0x454e
je 0x1003baff
cmp eax, 0x454c
je 0x1003baff
cmp eax, 0x4550
jne 0x1003bb03
or byte [ebp - 6], 0x40
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1003bb0f
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x1003bb1b
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov esi, dword [ebp + 0x14]
cmp esi, ebx
je 0x1003bb57
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.1003b970
push dword [ebp - 0x34]
mov dword [esi], eax
mov dword [esi + 4], edx
push dword [ebp - 0x38]
call fcn.1003b970
push dword [ebp - 0x44]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
push dword [ebp - 0x48]
call fcn.1003b970
mov dword [esi + 0x10], eax
add esp, 0x18
mov dword [esi + 0x14], edx
mov esi, dword [ebp + 0x18]
cmp esi, ebx
je 0x1003bb83
lea eax, [ebp + 0xe]
push eax
lea eax, [ebp + 0xa]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.1003b992
movzx eax, word [ebp + 0xa]
movzx ecx, word [ebp + 0xe]
shl eax, 0x10
add esp, 0x10
or eax, ecx
mov dword [esi], eax
pop esi
xor eax, eax
pop ebx
pop edi
leave
ret
Function at 0x401000
Capabilities:
Authenticate hmac
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
bswap edi
bswap ebx
ror esi, 0x49
rcr ebx, 0x86
ror edx, 0x5c
bswap esi
inc esi
not ebx
ror esi, 0x54
neg ebx
mov ebx, 0x44
mov edi, 0x31
sbb ebx, 0x6d
dec edi
ror ebx, 0x53
and ebx, 0x3b
sbb edx, 0xc4
bswap edx
rol edx, 0x89
neg edi
bswap ebx
ror ebx, 0xf1
mov ebx, 0x14
add edi, 6
inc esi
neg edx
sub eax, 0x23
and edx, 0x72
inc edi
bswap esi
rcl edi, 2
rcr edi, 3
sbb eax, 0xab
or edx, 0xda
neg edx
inc esi
neg edx
mov eax, 0x61
not eax
bswap ebx
or esi, 0x38
sbb eax, 0x2b
and edx, 0xa0
rol edx, 0x5f
rcl esi, 3
imul edi
rcl ebx, 0x42
sub eax, 0x7f
not edi
not esi
xor ecx, ecx
xor edi, edi
not esi
and ebx, 0xf3
rcl esi, 0x27
sbb esi, 0x4e
bswap edx
ror esi, 0x64
bswap edx
dec ebx
sub esi, 0x2f
inc esi
neg eax
neg ebx
sub edi, 0x6d
sub esi, 0x50
rol edi, 0x5f
sub eax, 0x1b
rcr esi, 0x21
dec edi
dec edx
add edx, 0x71
not edi
inc edi
neg ebx
rcl eax, 0xd3
ror eax, 0x16
ror edi, 0xcc
not ebx
sbb edi, 0xa3
not ebx
not edi
not eax
mov esi, 0xe3
imul edi
imul eax
rol edx, 0x17
dec ebx
ror edi, 0x76
ror ebx, 0xed
sbb ebx, 0xee
sbb eax, 0x51
ror eax, 0x45
and edi, 0xd1
rol edi, 0x34
rol edx, 0x65
mov edx, 0x4c
mov esi, 0x38
not edx
rol edi, 0xc1
sbb edx, 0x51
add edx, 0x3c
mov ecx, dword [ebp + 0xc]
imul ebx
rcr edi, 0xae
inc eax
neg edi
neg edi
inc ebx
neg edx
dec esi
rol eax, 0x1b
dec esi
ror edi, 0xf4
inc ebx
neg edx
ror eax, 0xab
rol edi, 0xf3
bswap edi
inc ebx
dec edi
ror edx, 0xc3
imul ebx
not esi
add esi, 0x77
imul ebx
inc esi
bswap eax
neg edi
neg edx
rol edx, 0xf4
sbb ebx, 0xe8
neg esi
not edx
bswap esi
ror eax, 0xe9
rol esi, 0xa6
rcl ebx, 0xbc
not esi
or esi, 0xff
dec edi
add edi, 0x36
bswap edx
mov esi, 0x74
sub eax, 0xc
neg edi
rcr ebx, 0xdd
rcl ebx, 0x53
rcr eax, 0x63
sub ebx, 0x4b
neg ebx
imul edx
not edx
mov edi, dword [ebp + 8]
xor esi, ebx
xor eax, eax
mov esi, ebx
mov ebx, esi
mov eax, ebx
xor ebx, eax
xor eax, eax
mov ebx, eax
mov eax, ebx
xor esi, eax
mov eax, ebx
xor eax, eax
not byte [edi]
xor eax, eax
mov eax, ebx
mov eax, eax
mov eax, ebx
xor esi, eax
xor ebx, esi
mov eax, eax
mov eax, eax
mov eax, eax
sub byte [edi], 0x89
xor esi, eax
xor ebx, eax
xor eax, ebx
mov ebx, eax
mov eax, ebx
xor eax, esi
xor ebx, eax
xor ebx, ebx
xor ebx, ebx
add byte [edi], 0x43
xor esi, eax
xor ebx, esi
mov ebx, esi
mov ebx, eax
xor ebx, ebx
mov esi, esi
xor esi, ebx
mov eax, ebx
mov ebx, esi
imul byte [edi]
inc edi
loop 0x4011a9
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404c24
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45e6f0]
jne 0x404c2e
repz ret
jmp fcn.00409125