joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485378
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x31
push 0
push 0
dec ecx
jne 0x485380
push ecx
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405440
mov eax, dword [ebp - 8]
call fcn.00405440
lea eax, [ebp - 0x164]
mov edx, dword [0x40815c]
call fcn.00405968
xor eax, eax
push ebp
push 0x4855ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 4]
call fcn.004090d0
mov edx, dword [ebp - 0x168]
lea eax, [ebp - 4]
call fcn.00405028
lea edx, [ebp - 0x16c]
mov eax, dword [ebp - 8]
call fcn.004090d0
mov edx, dword [ebp - 0x16c]
lea eax, [ebp - 8]
call fcn.00405028
mov eax, dword [ebp - 4]
call fcn.00405250
test eax, eax
je 0x485572
mov eax, dword [ebp - 8]
call fcn.00405250
test eax, eax
je 0x485572
lea eax, [ebp - 0x170]
push eax
mov ecx, 2
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.004054b0
mov eax, dword [ebp - 0x170]
mov edx, 0x4855c4
call fcn.0040539c
jne 0x485572
lea eax, [ebp - 0x174]
push eax
mov ecx, 2
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.004054b0
mov eax, dword [ebp - 0x174]
mov edx, 0x4855c4
call fcn.0040539c
jne 0x485572
mov eax, dword [ebp - 8]
call fcn.00405250
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
je 0x485493
lea eax, [ebp - 8]
mov edx, 0x4855d0
call fcn.00405258
lea edx, [ebp - 0x178]
mov eax, dword [ebp - 4]
call fcn.00409ac4
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0xc]
call fcn.004090d0
lea edx, [ebp - 0x17c]
mov eax, dword [ebp - 4]
call fcn.00409b8c
cmp dword [ebp - 0x17c], 0
je 0x485572
cmp dword [ebp - 0xc], 0
je 0x485572
lea ecx, [ebp - 0x164]
mov edx, 0x3f
mov eax, dword [ebp - 4]
call fcn.00409900
mov ebx, eax
test ebx, ebx
jne 0x485567
push 0
lea edx, [ebp - 0x184]
mov eax, dword [ebp - 0x158]
call fcn.004090d0
mov ecx, dword [ebp - 0x184]
lea eax, [ebp - 0x180]
mov edx, dword [ebp - 8]
call fcn.0040529c
mov eax, dword [ebp - 0x180]
call fcn.00405450
push eax
lea edx, [ebp - 0x18c]
mov eax, dword [ebp - 0x158]
call fcn.004090d0
mov ecx, dword [ebp - 0x18c]
lea eax, [ebp - 0x188]
mov edx, dword [ebp - 0xc]
call fcn.0040529c
mov eax, dword [ebp - 0x188]
call fcn.00405450
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x164]
call fcn.00409950
mov ebx, eax
test ebx, ebx
je 0x4854ed
lea eax, [ebp - 0x164]
call fcn.00409974
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4855b5
lea eax, [ebp - 0x18c]
mov edx, 0xa
call fcn.00404fb4
lea eax, [ebp - 0x164]
mov edx, dword [0x40815c]
call fcn.00405a38
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404fb4
ret
Function at 0x4855d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405440
mov eax, dword [ebp - 8]
call fcn.00405440
lea esi, [ebp - 0x11]
xor eax, eax
push ebp
push 0x485716
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x22b
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 8], 0
jne 0x485623
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405028
mov dl, 1
mov eax, dword [0x41417c]
call fcn.004041d4
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x41417c]
call fcn.004041d4
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4856f4
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004189a8
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004181f8
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4856cb
inc ebx
mov edx, esi
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
shrd eax, edx, 8
shr edx, 8
xor byte [esi], al
push 0
push 0xce6d
xor eax, eax
mov al, byte [esi]
xor edx, edx
add eax, dword [ebp - 0x20]
adc edx, dword [ebp - 0x1c]
call fcn.00405dd0
add eax, 0x58bf
adc edx, 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov edx, esi
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0x10]
dec ebx
jne 0x485675
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.004188d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4856fb
mov eax, dword [ebp - 0x10]
call fcn.00404204
mov eax, dword [ebp - 0xc]
call fcn.00404204
ret
Function at 0x485724
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405440
mov eax, dword [ebp - 8]
call fcn.00405440
xor eax, eax
push ebp
push 0x485868
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x22b
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 8], 0
jne 0x48576f
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405028
mov dl, 1
mov eax, dword [0x41417c]
call fcn.004041d4
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x41417c]
call fcn.004041d4
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x485846
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004189a8
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004181f8
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
mov esi, eax
dec esi
test esi, esi
jl 0x48581d
inc esi
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, byte [ebp - 0x11]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
shrd eax, edx, 8
shr edx, 8
xor byte [ebp - 0x11], al
push 0
push 0xce6d
xor eax, eax
mov al, bl
xor edx, edx
add eax, dword [ebp - 0x20]
adc edx, dword [ebp - 0x1c]
call fcn.00405dd0
add eax, 0x58bf
adc edx, 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec esi
jne 0x4857c1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.004188d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48584d
mov eax, dword [ebp - 0x10]
call fcn.00404204
mov eax, dword [ebp - 0xc]
call fcn.00404204
ret
Function at 0x489330
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4894a1
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48947c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00405178
lea eax, [ebp - 0x118]
mov edx, 0x4894b8
call fcn.00405258
mov eax, dword [ebp - 0x118]
call fcn.00405450
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4893ee
lea eax, [ebp - 0x111]
call fcn.00409cc8
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00405080
jmp 0x4893f5
mov eax, esi
call fcn.00404f90
cmp bl, 0x61
jae 0x489416
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040e040
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404fe4
jmp 0x489430
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040dfb4
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404fe4
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4894c4
call fcn.0040a3e8
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404fe4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489483
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x490940
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x49096e
mov eax, ebx
call fcn.004913f4
cmp dword [ebx + 0x40], 0
je 0x490967
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4909df
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4909d1
cmp dword [ebx + 8], 0
je 0x490990
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4909a2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4909d1
cmp dword [ebx + 8], 0
je 0x490983
cmp eax, 3
je 0x4909b5
dec eax
jne 0x490983
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x490983
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x490983
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4909fd
cmp dword [ebx + 0x14], 0xcc
je 0x4909fd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00490a08
pop ebx
ret
Function at 0x4a6840
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor ecx, ecx
push ebp
push 0x4a68e5
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [eax + 0x2fc]
cmp byte [eax + 0x28d], 1
je 0x4a68ca
mov eax, dword [0x4b1c9c]
call fcn.004a7f78
mov eax, dword [0x4b1c9c]
mov edx, dword [eax + 0x3c0]
lea eax, [ebp - 4]
mov ecx, 0x4a68f8
call fcn.0040529c
push 5
push 0x4a690c
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4a691c
mov edx, 0x4a6930
xor eax, eax
call fcn.00485878
push dword [ebp - 0xc]
push 0x4a6940
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405310
mov eax, dword [ebp - 8]
call fcn.00405450
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a68ec
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404fb4
ret

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x4e4e4d71
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x5d945149
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x402a30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ecx, 0x41ca68
push 0
call fcn.00403385
mov edi, eax
mov esi, 1
test edi, edi
je 0x402b84
mov ebx, dword [ebp + 8]
mov eax, ebx
shr eax, 4
mov dword [ebp - 4], eax
inc eax
movzx eax, ax
mov dword [ebp + 8], eax
nop dword [eax]
push 0
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x402a91
push ebx
mov edx, eax
mov ecx, edi
call fcn.00403260
add esp, 4
test eax, eax
jne 0x402aac
push esi
mov ecx, 0x41ca68
inc esi
call fcn.00403385
mov edi, eax
test edi, edi
je 0x402b84
mov eax, dword [ebp + 8]
jmp 0x402a70
test edi, edi
je 0x402b84
mov eax, dword [ebp - 4]
inc eax
push 6
movzx eax, ax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x402b84
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402b84
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402b84
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and ebx, 0xf
jbe 0x402b15
cmp esi, ecx
jae 0x402b84
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ebx, 1
jne 0x402b03
cmp esi, ecx
jae 0x402b84
cmp word [esi], 0
je 0x402b84
mov ebx, dword [ebp - 8]
mov ecx, 1
movzx edi, word [esi]
mov eax, dword [ebx]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x402b40
push edi
mov ecx, ebx
call fcn.00402de0
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebx]
call fcn.00408181
add esp, 0x10
cmp eax, 0x50
ja case.0x402b5f.1
movzx eax, byte [eax + 0x402bc0]
jmp dword [eax*4 + 0x402bb0]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg case.0x402b5f.20
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x8007000e
call fcn.00401030
push 0x80070057
call fcn.00401030
push 0x80004005
call fcn.00401030
nop dword [eax]
sub ax, word [eax]
invalid

Function at 0x403260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4032bb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4032bb
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4032a8
cmp esi, edx
jae 0x4032bb
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x403296
cmp esi, edx
jae 0x4032bb
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x403c0a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403c49
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403c49
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403c49
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403c49
cmp dword [ecx + 0x74], 0xe
jbe 0x403c49
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4136f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41371d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41371d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x5f4ddf
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
pop ecx
jmp 0x5f2ef6
xchg dword [esp], ebp
jmp 0x5f2f18
add ecx, ebp
add ecx, 0xf3f454b
mov ebp, dword [esp]
jmp fcn.005f4d72
not ebp
push 0xe5104b6
mov dword [esp], ebp
jmp 0x5f3d44
mov esp, dword [esp]
jmp 0x5f3331
push ecx
mov ecx, esp
push ebp
push ecx
mov ecx, 0x397f79d4
mov ebp, ecx
jmp 0x5f2393
not dword [esp]
pop ebp
push eax
mov eax, 0x756f4006
jmp 0x5f400b
or ebp, eax
jmp 0x5f45f5
pop eax
xor ebp, 0x69bf0ba6
jmp 0x5f5504
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
jmp 0x5f245e
add ebp, 0xeb3f8d94
jmp 0x5f5729
push edx
mov edx, 0x63512074
sub edx, 0x7d9fab90
inc edx
shl edx, 6
dec edx
xor edx, 0x5f17fe00
add edx, 0xdbf47e0c
sub ecx, edx
pop edx
jmp 0x5f2a55

Function at 0x401300
Capabilities:
Allocate or change rwx memory
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], str.248058040134
push 0x41a2b4
mov eax, dword [ebp + 0x10]
push eax
call fcn.00404678
add esp, 8
mov dword [ebp - 0xc], eax
push 0x40
push 0x3000
push 0x181e
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 1
push 0x181e
mov edx, dword [ebp - 8]
push edx
call fcn.00404875
add esp, 0x10
cmp dword [ebp - 4], 0x181e
jge 0x401396
mov eax, dword [ebp - 4]
cdq
mov ecx, 0xc
idiv ecx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
mov byte [ecx], al
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x40135d
mov eax, dword [ebp - 8]
jmp eax

Function at 0x401510
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 4], 0
push 5
lea eax, [ebp - 0xb8]
push eax
push 0x20
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0
push 0
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4015a7
mov edx, dword [ebp - 8]
shl edx, 1
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4015a7
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0xb8]
push edx
lea eax, [ebp - 0x18]
push eax
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x408d59
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00408bcf
Function at 0x403500
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4cb008], 0x8088405
inc edx
mov dword [ebx + 0x4cb008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406de0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404580
xor eax, eax
push ebp
push 0x4b624a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00404390
test eax, eax
jle 0x406e34
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
xor ecx, 0x6521458a
add ebx, ecx
mov ecx, ebx
shl ecx, 0xd
mov esi, ebx
shr esi, 0x13
or ecx, esi
sub ebx, ecx
inc edx
dec eax
jne 0x406e12
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6251
lea eax, [ebp - 4]
call fcn.004040e4
ret

Function at 0x40d0e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4bc609
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, esi
call fcn.0040cfcc
mov eax, dword [ebx]
call fcn.00404390
cmp eax, 4
jg 0x40d12b
mov eax, ebx
call fcn.004040e4
jmp 0x40d1ee
mov eax, dword [ebx]
call fcn.00404390
mov edi, eax
test edi, edi
jle 0x40d155
mov esi, 1
mov eax, ebx
call fcn.004045e8
mov edx, dword [ebx]
mov dl, byte [edx + esi - 1]
xor dl, 0x5c
mov byte [eax + esi - 1], dl
inc esi
dec edi
jne 0x40d13d
mov eax, dword [ebx]
movzx esi, byte [eax + 2]
mov eax, dword [ebx]
movzx edi, byte [eax + 3]
mov eax, ebx
mov ecx, 4
mov edx, 1
call fcn.00404630
mov eax, ebx
mov ecx, edi
mov edx, 1
call fcn.00404630
push ebx
mov eax, dword [ebx]
mov ecx, esi
mov edx, 1
call fcn.004045f0
cmp dword [ebx], 0
je 0x40d1ee
mov eax, dword [ebp - 8]
call fcn.00404390
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404390
add esi, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
mov ecx, esi
mov edx, 1
call fcn.004045f0
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004043dc
mov edx, dword [ebp - 0x10]
pop eax
call fcn.004044dc
je 0x40d1e0
mov eax, ebx
call fcn.004040e4
jmp 0x40d1ee
mov eax, ebx
mov ecx, esi
mov edx, 1
call fcn.00404630
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc610
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404108
ret
Function at 0x418b6c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404580
xor eax, eax
push ebp
push 0x4c80e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004040e4
xor ebx, ebx
mov esi, 0x11
push esi
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4c7f4c]
call fcn.004053a8
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [eax], 0x99935097
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0x2c89d95b
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0x6df8e950
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xc], 0xdf4eff82
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x10], 0xe8ead4ad
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0xbb07f9ad
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0xb746652e
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x1c], 0x7f612d05
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0xd7520332
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x24], 0x20278d52
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x28], 0xfe2bf75e
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x2c], 0xba2aac6b
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0xd1823480
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0x5ef1f8a2
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x38], 0x2ac162ac
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x3c], 0x6ea634c0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x40], 0xf10ecec6
dec esi
test esi, esi
jl 0x418c88
inc esi
xor edi, edi
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + edi*4]
mov eax, dword [ebp - 4]
call fcn.00418a80
mov ebx, eax
test ebx, ebx
jne 0x418c88
inc edi
dec esi
jne 0x418c70
test ebx, ebx
jne 0x418cb1
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x4c8100
call fcn.004043dc
mov eax, dword [ebp - 0x10]
mov ecx, 0x4c8120
xor edx, edx
call fcn.00419288
jmp 0x418cbb
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004189cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c80ee
lea eax, [ebp - 0x10]
call fcn.004040e4
lea eax, [ebp - 0xc]
mov edx, dword [0x4c7f4c]
call fcn.004053b4
lea eax, [ebp - 4]
call fcn.004040e4
ret
Function at 0x40a47f
Capabilities:
Create process on windows

Disassembly:
push 0x28
mov eax, 0x4467d9
call fcn.0042f7d0
push dword [ebp + 8]
mov ebx, 0x44e464
push str.strURL:__s
push ebx
mov esi, str.CHyperLink::Navigate
push 3
mov edx, str.Enter
mov ecx, esi
mov edi, 0x461d88
call fcn.0040d853
add esp, 0x10
push 1
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x40a598
push eax
push str.ShellExecute_error:__d
push str.ShellExecute_returned_an_error__trying_to_open_iexplorer_directly.
push 4
mov edx, str.Internal
mov ecx, esi
call fcn.0040d853
add esp, 0x10
call fcn.004157d6
push eax
lea ecx, [ebp - 0x10]
call fcn.00401347
and dword [ebp - 4], 0
push 0x20019
mov edi, 0x104
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
lea esi, [ebp - 0x30]
mov dword [ebp - 0x14], edi
call fcn.0040dbcc
push edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040126b
push ebx
lea esi, [ebp - 0x14]
mov edi, eax
lea ebx, [ebp - 0x30]
call fcn.0040e168
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004092e9
mov esi, dword [ebp - 0x10]
push esi
push str.sPath:__s
push str.Path_to_internet_explorer.
push 4
mov edx, str.Internal
mov ecx, str.CHyperLink::Navigate
mov edi, 0x461d88
call fcn.0040d853
add esp, 0x10
push 1
xor ebx, ebx
push ebx
push dword [ebp + 8]
push esi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.0040dd18
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.0040136f
mov esi, str.CHyperLink::Navigate
mov ebx, 0x44e464
push ebx
push ebx
push 3
mov edx, str.Leave
mov ecx, esi
call fcn.0040d853
add esp, 0xc
call fcn.0042f8a8
ret