joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ca18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
xor edx, dword [eax + 0x204]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
xor edx, dword [eax + 0x208]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ecx + 8]
mov edx, dword [edx + 0xc]
xor ebx, dword [eax + 0x20c]
xor edx, dword [eax + 0x210]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov ecx, edx
mov esi, edx
shr esi, 0x15
shl ecx, 0xb
or ecx, esi
mov esi, dword [ebp - 0x18]
and esi, 3
add ecx, ebx
xor ecx, dword [eax + esi*4 + 0x204]
mov edi, ecx
mov esi, ecx
shr edi, 8
and esi, 0xff
and edi, 0xff
movzx esi, byte [eax + esi + 0x104]
movzx edi, byte [eax + edi + 0x104]
shl edi, 8
or esi, edi
mov edi, ecx
shr edi, 0x10
shr ecx, 0x18
and edi, 0xff
and ecx, 0xff
movzx edi, byte [eax + edi + 0x104]
movzx ecx, byte [eax + ecx + 0x104]
shl edi, 0x10
shl ecx, 0x18
or esi, edi
or esi, ecx
mov ecx, ebx
xor esi, dword [ebp - 8]
mov dword [ebp - 0x10], esi
mov esi, ebx
shr esi, 0xf
shl ecx, 0x11
or ecx, esi
mov esi, dword [ebp - 0x18]
and esi, 3
xor ecx, edx
add ecx, dword [eax + esi*4 + 0x204]
mov edi, ecx
mov esi, ecx
shr edi, 8
and esi, 0xff
and edi, 0xff
movzx esi, byte [eax + esi + 0x104]
movzx edi, byte [eax + edi + 0x104]
shl edi, 8
or esi, edi
mov edi, ecx
shr edi, 0x10
shr ecx, 0x18
and edi, 0xff
and ecx, 0xff
movzx edi, byte [eax + edi + 0x104]
movzx ecx, byte [eax + ecx + 0x104]
shl edi, 0x10
shl ecx, 0x18
or esi, edi
or esi, ecx
xor esi, dword [ebp - 0xc]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edx
mov ecx, esi
mov edx, ecx
mov ebx, dword [ebp - 0x10]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x20
jl 0x40ca64
mov ecx, dword [ebp - 0x14]
xor ebx, dword [eax + 0x204]
mov dword [ecx], ebx
xor edx, dword [eax + 0x208]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor edx, dword [eax + 0x20c]
mov dword [ecx + 8], edx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
xor edx, dword [eax + 0x210]
mov dword [ecx + 0xc], edx
mov edx, dword [ebp - 4]
call fcn.0040cd5c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cbb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx]
xor ecx, dword [ebx + 0x204]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 4]
xor edx, dword [ebx + 0x208]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov esi, dword [ecx + 8]
mov edi, dword [eax + 0xc]
xor esi, dword [ebx + 0x20c]
xor edi, dword [ebx + 0x210]
push 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 4]
push eax
call fcn.0043bb34
add esp, 0xc
mov dword [ebp - 0x18], 0x1f
mov eax, edi
mov edx, edi
mov ecx, dword [ebp - 0x18]
shr edx, 0x15
and ecx, 3
shl eax, 0xb
or eax, edx
add eax, esi
xor eax, dword [ebx + ecx*4 + 0x204]
xor ecx, ecx
mov edx, eax
and edx, 0xff
mov cl, byte [ebx + edx + 0x104]
mov edx, eax
shr edx, 8
and edx, 0xff
movzx edx, byte [ebx + edx + 0x104]
shl edx, 8
or ecx, edx
mov edx, eax
shr edx, 0x10
shr eax, 0x18
and edx, 0xff
and eax, 0xff
movzx edx, byte [ebx + edx + 0x104]
movzx eax, byte [ebx + eax + 0x104]
shl edx, 0x10
shl eax, 0x18
or ecx, edx
or ecx, eax
mov eax, esi
xor ecx, dword [ebp - 8]
mov edx, esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x18]
shr edx, 0xf
and ecx, 3
shl eax, 0x11
or eax, edx
xor eax, edi
add eax, dword [ebx + ecx*4 + 0x204]
xor ecx, ecx
mov edx, eax
and edx, 0xff
mov cl, byte [ebx + edx + 0x104]
mov edx, eax
shr edx, 8
and edx, 0xff
movzx edx, byte [ebx + edx + 0x104]
shl edx, 8
or ecx, edx
mov edx, eax
shr edx, 0x10
shr eax, 0x18
and edx, 0xff
and eax, 0xff
movzx edx, byte [ebx + edx + 0x104]
movzx eax, byte [ebx + eax + 0x104]
shl edx, 0x10
shl eax, 0x18
or ecx, edx
or ecx, eax
xor ecx, dword [ebp - 0xc]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
mov eax, ecx
mov edi, eax
mov esi, dword [ebp - 0x10]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0
jge 0x40cc11
mov eax, dword [ebp - 0x14]
xor esi, dword [ebx + 0x204]
mov dword [eax], esi
xor edi, dword [ebx + 0x208]
mov edx, dword [ebp - 0x14]
mov dword [edx + 4], edi
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
xor ecx, dword [ebx + 0x20c]
mov dword [eax + 8], ecx
mov eax, ebx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
xor edx, dword [ebx + 0x210]
mov dword [ecx + 0xc], edx
lea edx, [ebp - 0x28]
call fcn.0040cd5c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40cd5c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, 0x44afbc
xor ecx, ecx
movzx esi, byte [edx + ecx]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x204], esi
movzx esi, byte [edx + ecx + 1]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x208], esi
movzx esi, byte [edx + ecx + 2]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x20c], esi
movzx esi, byte [edx + ecx + 3]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x210], esi
add ecx, 4
cmp ecx, 0x10
jl 0x40cd65
pop esi
pop ebx
ret
Function at 0x40d640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
mov ebx, dword [ebp + 8]
jg 0x40d660
xor eax, eax
jmp 0x40d721
mov edx, dword [ebp - 0xc]
test edx, edx
jns 0x40d66a
add edx, 0xf
sar edx, 4
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
add eax, 4
mov ecx, dword [eax]
xor ecx, dword [edx]
mov dword [ebp - 0x24], ecx
mov ecx, dword [eax + 4]
xor ecx, dword [edx + 4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 8]
xor ecx, dword [edx + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, ebx
mov eax, dword [eax + 0xc]
xor eax, dword [edx + 0xc]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
call fcn.0040daa4
add dword [ebp - 8], 0x10
mov edx, dword [ebp - 0x14]
dec edx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jle 0x40d6fd
mov eax, ebx
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
xor ecx, dword [edx]
mov dword [ebp - 0x24], ecx
mov ecx, dword [eax + 4]
xor ecx, dword [edx + 4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 8]
xor ecx, dword [edx + 8]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0xc]
xor eax, dword [edx + 0xc]
mov dword [ebp - 0x18], eax
add ebx, 0x10
lea edx, [ebp - 0x24]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.0040daa4
add dword [ebp - 8], 0x10
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0
jg 0x40d6b9
mov eax, dword [ebp - 4]
add eax, 4
mov edx, ebx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x14]
shl eax, 4
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40d728
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x40d73f
test esi, esi
jg 0x40d746
xor eax, eax
jmp 0x40d7ee
push 0x10
mov edx, dword [ebp - 4]
add edx, 4
push edx
lea ecx, [ebp - 0x28]
push ecx
call fcn.0043bb34
add esp, 0xc
test esi, esi
jns 0x40d762
add esi, 0xf
sar esi, 4
mov dword [ebp - 8], esi
mov esi, dword [ebp - 8]
test esi, esi
jle 0x40d7d3
lea ecx, [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040e020
mov eax, dword [ebp - 0x28]
xor dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x24]
xor dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x20]
xor dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0xc], eax
mov eax, ebx
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0xc], ecx
add ebx, 0x10
add dword [ebp + 8], 0x10
dec esi
test esi, esi
jg 0x40d76f
push 0x10
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
add eax, 4
push eax
call fcn.0043bb34
add esp, 0xc
mov eax, dword [ebp - 8]
shl eax, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40d7f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 4
push 0x20
push edx
lea edx, [esp + 0x14]
push edx
call fcn.0043bb34
add esp, 0xc
xor esi, esi
xor ecx, ecx
xor edx, edx
jmp 0x40d861
xor eax, eax
mov edi, esi
mov ebp, dword [esp]
shl edi, 4
lea ebx, [esp + edx*4 + 0xc]
lea edi, [ebp + edi]
mov bl, byte [ebx + eax]
lea edi, [edi + ecx*4]
mov byte [edi + eax + 0x14], bl
inc eax
cmp eax, 4
jl 0x40d82c
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x40d859
cmp ecx, 4
jl 0x40d82a
cmp ecx, 4
jne 0x40d861
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x40d86c
cmp esi, 0xa
jle 0x40d84e
cmp esi, 0xa
jg 0x40d9ff
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov al, byte [edx + 0x44b3bc]
xor byte [esp + 0xc], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 0xa]
mov dl, byte [eax + 0x44b3bc]
xor byte [esp + 0xd], dl
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov al, byte [edx + 0x44b3bc]
xor byte [esp + 0xe], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 8]
mov dl, byte [eax + 0x44b3bc]
xor byte [esp + 0xf], dl
mov eax, dword [esp + 4]
mov dl, byte [eax + 0x44b5bc]
xor byte [esp + 0xc], dl
inc dword [esp + 4]
cmp dword [esp + 8], 8
je 0x40d90f
mov edx, 1
cmp edx, dword [esp + 8]
jge 0x40d9ad
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x40d8ef
inc edx
cmp edx, dword [esp + 8]
jl 0x40d8ed
jmp 0x40d9ad
mov edx, 1
jmp 0x40d92d
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x40d918
inc edx
mov eax, dword [esp + 8]
sar eax, 1
jns 0x40d938
adc eax, 0
cmp edx, eax
jl 0x40d916
mov eax, dword [esp + 8]
sar eax, 1
jns 0x40d947
adc eax, 0
xor edx, edx
mov dl, byte [esp + eax*4 + 8]
mov dl, byte [edx + 0x44b3bc]
xor byte [esp + eax*4 + 0xc], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov dl, byte [edx + 0x44b3bc]
xor byte [esp + eax*4 + 0xd], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xa]
mov dl, byte [edx + 0x44b3bc]
xor byte [esp + eax*4 + 0xe], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov dl, byte [edx + 0x44b3bc]
xor byte [esp + eax*4 + 0xf], dl
mov edx, eax
inc edx
cmp edx, dword [esp + 8]
jge 0x40d9ad
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x40d992
inc edx
cmp edx, dword [esp + 8]
jl 0x40d990
xor edx, edx
jmp 0x40d9eb
xor eax, eax
mov ebx, esi
shl ebx, 4
mov edi, dword [esp]
lea ebx, [edi + ebx]
lea ebx, [ebx + ecx*4]
lea edi, [ebx + eax + 0x14]
lea ebx, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
mov byte [edi], bl
inc eax
cmp eax, 4
jl 0x40d9b5
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x40d9e3
cmp ecx, 4
jl 0x40d9b3
cmp ecx, 4
jne 0x40d9eb
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x40d9f6
cmp esi, 0xa
jle 0x40d9d8
cmp esi, 0xa
jle 0x40d875
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40da08
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
shl ebx, 2
add edx, edi
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx ebp, byte [edx + 1]
mov bl, byte [edx]
lea ebp, [ebp*4 + 0x44d9da]
lea ebx, [ebx*4 + 0x44d5da]
mov bl, byte [ebx + eax]
xor bl, byte [ebp + eax]
movzx ebp, byte [edx + 2]
movzx edx, byte [edx + 3]
lea ebp, [ebp*4 + 0x44ddda]
lea edx, [edx*4 + 0x44e1da]
xor bl, byte [ebp + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x40da1a
inc eax
cmp eax, 4
jl 0x40da18
mov ecx, esi
push 0x10
shl ecx, 4
lea eax, [esp + 4]
add ecx, edi
push eax
add ecx, 0x14
push ecx
call fcn.0043bb34
add esp, 0xc
inc esi
cmp esi, 0xa
jl 0x40da16
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41020c
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax]
cmp edx, 0x11
jle 0x41022c
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x44], ecx
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x38], ecx
xor ecx, ecx
mov dword [eax + edx*4], ecx
dec edx
cmp edx, 0x11
jg 0x410213
cmp dword [eax], 0x11
jbe 0x410248
mov dword [eax], 0x11
jmp 0x41023b
dec dword [eax]
cmp dword [eax], 0
je 0x410248
mov edx, dword [eax]
cmp dword [eax + edx*4], 0
je 0x410239
ret

Function at 0x410ad8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [esi]
cmp eax, dword [ebx]
jae 0x410b20
mov eax, 1
jmp 0x410af8
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi]
jbe 0x410aee
mov ecx, dword [ebx]
mov edx, eax
sub ecx, dword [esi]
shl ecx, 2
shl edx, 2
push ecx
shl eax, 2
add edx, ebx
push edx
add eax, edi
push eax
call fcn.0043bb34
add esp, 0xc
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x410b86
mov ecx, dword [esi]
cmp ecx, dword [ebx]
jbe 0x410b5f
mov eax, 1
jmp 0x410b37
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebx]
jbe 0x410b2d
mov ecx, dword [esi]
mov edx, eax
sub ecx, dword [ebx]
shl ecx, 2
shl edx, 2
push ecx
shl eax, 2
add edx, esi
push edx
add eax, edi
push eax
call fcn.0043bb34
add esp, 0xc
mov eax, dword [esi]
mov dword [edi], eax
jmp 0x410b86
mov eax, dword [ebx]
test eax, eax
jbe 0x410b72
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
jne 0x410b72
dec eax
test eax, eax
ja 0x410b65
mov dword [edi], eax
test eax, eax
jbe 0x410b86
mov ecx, dword [esi + eax*4]
xor ecx, dword [ebx + eax*4]
mov dword [edi + eax*4], ecx
dec eax
test eax, eax
ja 0x410b78
pop edi
pop esi
pop ebx
ret
Function at 0x41a748
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xffffff70
xor eax, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
xor edx, edx
mov dword [esp + 8], edx
mov esi, dword [esp + 8]
jmp 0x41a7c5
xor eax, eax
mov edx, dword [esp]
add edx, esi
add edx, eax
mov cl, byte [edx + 1]
mov byte [esp + eax + 0x19], cl
mov bl, byte [edx]
sub bl, cl
mov byte [esp + eax + 0x18], bl
mov dl, byte [edx + 2]
sub dl, cl
mov byte [esp + eax + 0x1a], dl
add eax, 3
cmp eax, 0x78
jl 0x41a773
mov ebx, 3
mov cl, byte [esp + ebx + 0x18]
sub cl, byte [esp + ebx + 0x15]
movsx ecx, cl
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 8]
add dword [esp + edx*4 + 0xc], eax
inc ebx
cmp ebx, 0x78
jl 0x41a79f
add esi, 0x780
mov eax, dword [esp + 4]
add eax, 0xffffff88
cmp esi, eax
jl 0x41a771
inc dword [esp + 8]
cmp dword [esp + 8], 2
jle 0x41a76b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp edx, eax
jb 0x41a7f1
cmp eax, dword [esp + 0x14]
ja 0x41a7f1
xor eax, eax
jmp 0x41a7fd
mov eax, 1
cmp edx, dword [esp + 0x14]
jbe 0x41a7fd
inc eax
add esp, 0x90
pop esi
pop ebx
ret

Function at 0x41ae2c
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
push esp
push 0
push edx
push eax
push 0x10000
push 0
call sub.KERNEL32.DLL_CreateThread
mov ebx, eax
test ebx, ebx
jne 0x41ae6d
mov edx, str.CreateThread_failed
mov eax, 0x448c38
call fcn.00433b74
mov eax, 0x448c38
call fcn.00433e84
mov eax, 0x448c38
mov edx, 2
call fcn.00433d14
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x433c00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
push esi
mov eax, 0xd08
call fcn.0040f04c
push eax
test ebx, ebx
je 0x433c2b
cmp byte [ebx], 0
je 0x433c2b
mov edx, ebx
jmp 0x433c2d
xor edx, edx
push edx
call fcn.0042bb80
add esp, 0xc
call fcn.0042bc70
call sub.KERNEL32.DLL_GetLastError
cmp eax, 3
jne 0x433cac
push esi
call fcn.0043bd54
pop ecx
mov dword [ebp - 4], eax
mov eax, esi
call fcn.004025b8
test al, al
jne 0x433c7f
lea ecx, [ebp - 0x404]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0x404]
push eax
call fcn.0043bd54
pop ecx
add eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x104
jle 0x433cac
push 0x104
mov eax, 0xe6c
call fcn.0040f04c
push eax
test ebx, ebx
je 0x433ca1
cmp byte [ebx], 0
jne 0x433ca3
xor ebx, ebx
push ebx
call fcn.0042bb80
add esp, 0xc
mov eax, edi
call fcn.00433e84
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b788
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x440a4c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x440aae
call fcn.004409fc
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0043bd54
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0043bd54
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x440b0c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x448150], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x440be6
cmp dword [0x44814c], 0
jne 0x440be6
cmp dword [0x448340], 0
je 0x440ba0
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00440950
add esp, 8
mov ebx, eax
test eax, eax
jne 0x440b86
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00440950
add esp, 8
mov ebx, eax
test eax, eax
jne 0x440b86
lea ebx, [ebp - 0x84]
jmp 0x440b87
inc ebx
call fcn.00440ac8
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x440c21
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x448154
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0043bd54
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x448157
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x440c21
cmp dword [0x44814c], 0
je 0x440c00
cmp dword [0x44814c], 0xffffffff
je 0x440c21
push esi
call dword [0x44814c]
pop ecx
mov eax, dword [0x448150]
test eax, eax
je 0x440c21
cmp dword [0x448150], 0xffffffff
je 0x440c21
cmp byte [eax], 0
je 0x440c21
push esi
push eax
call fcn.00440a4c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44120d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44123b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x441259
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00441177
jmp 0x441259
mov eax, dword [esi + 0x14]
test eax, eax
je 0x441259
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00441177
test edi, edi
mov eax, edi
jne 0x441243
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56b32c]
test ecx, ecx
je 0x44130c
jmp 0x44120c
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x404728
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00407a5c
test esi, esi
jne 0x404760
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00407b98
jmp 0x40477e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040460c
mov edi, eax
test esi, esi
je 0x40477e
cmp dword [ebx], 0
je 0x40477e
dec esi
jmp 0x404767
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4047b4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x53e008], 0x8088405
inc edx
mov dword [ebx + 0x53e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x408510
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x408552
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x408572
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.00407c6c
add esp, 0x41c
pop esi
pop ebx
ret