joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10072260
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x100722fb
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x100722b2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x100722b2
cmp esi, ebx
jge 0x100722b2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x100722f5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x100722f5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783dc]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783dc]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1007230d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10072530
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
mov eax, dword [ebp + 8]
je 0x10072558
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10072572
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1003be89
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10076450
leave
ret 4

Function at 0x10072740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10072776
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x100727d5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1003be89
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1003be89
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1003be89
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10076450
leave
ret 0x10
Function at 0x100727f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1007281c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1007284d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1007284b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1003be89
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1007284d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10076450
leave
ret 8
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3c344a6d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1c791efd
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x2d746a9e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x53ed647f
nop
nop
nop
nop
nop
test eax, eax
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4941b0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x1c
push esi
push edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push 0x850f48
mov dword [esp + 0x3c], 8
mov dword [esp + 0x40], 4
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea edx, [esp + 0xc]
mov dword [esp + 0x14], 0
push edx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x14
push 0x40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test edi, edi
je 0x494250
mov eax, dword [0x650d78]
push 0x650aa8
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.GlobalPipeCRT40
push 0
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xc
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [0x650d74], esi
mov eax, esi
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x4e54e0
Capabilities:
Encode data using xor

Disassembly:
div dword [eax]
push cs
pop esp
mov edx, ss
add dword [ebp + 0x66], 0x44
add eax, 0x6423167f
add ebp, esp
movsb byte es:[edi], byte [esi]
dec esp
mov byte [ecx - 0x441e1714], dh
scasd eax, dword es:[edi]
pushfd
adc dword [eax - 0x595feab8], ebx
test byte [edi - 2], al
xor eax, 0x230a6676
or bl, ch
movsd dword es:[edi], dword [esi]
mov dh, 0xa2
add bh, byte [ebx]
shl ebp, 1
nop
sbb al, ch
jae 0x4e54f1
ret

Function at 0x50496a
Capabilities:
Encode data using xor

Disassembly:
inc dword [edx + 0x33]
pop ss
cwde
pop es
lodsd eax, dword [esi]
fidiv dword [0x5b0e39d2]
popfd
call 0xcc5f017c
fsub st(3)
adc ah, ah
xor cl, byte [eax - 0x12]
cmp edx, ebx
inc edi
inc esp
inc ebx
int3
push edi
push esp
scasd eax, dword es:[edi]
mov bh, 0x1f
mov cl, 0x59
salc
xor bl, bl
cli
test eax, 0x8f3493a7
sub eax, 0x5762f3b2
xor eax, 0x97dfe9db
invalid
repne cmpsb byte fs:[esi], byte es:[edi]
jno 0x5048a2
loop 0x5048aa
stosd dword es:[edi], eax
sub ah, byte [eax]
jae 0x50491d
and byte [ebx - 3], dh
ja 0x50492e
mov eax, 0xfcf8460a
insb byte es:[edi], dx
hlt
pop dx
dec edi
popfd
sub bl, byte [edx + ecx]
lea esp, [ebx - 0x617341d1]
xchg ecx, eax
test dword [eax], ecx
jb 0x504999
add esp, 0x174857f1
dec ebp
push 0x30eaf84c
sbb eax, 0xe736ceb7
loopne 0x5048e0
loopne 0x504979
dec esp
fdivr qword [ecx - 1]
sbb eax, 0xaa3cd010
invalid
push es
xor ah, byte [edx]
xchg dword [eax + ebp*2], ebp
jg 0x504914
push es
invalid
scasb al, byte es:[edi]
mov bh, dl
dec byte [edi + eax*8 - 0x4e935174]
mov esi, 0xb8f4086e
pop esi
add eax, 0x130e1c47
and al, 6
or ah, dh
mov eax, 0x1c47055e
push cs
adc esp, dword [esi + eax]
xchg ebp, eax
mov eax, 0x3d778a06
jnp 0x504985
cmp edi, ebp
std
invalid
Function at 0x504a90
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0xe4
cli
xor byte [ecx + eax*8 - 0x19], bl
shl edi, 0xd6
shl edi, 0xd6
push ecx
mov ss, ebx
in eax, dx
mov ebx, 0xadc6899e
movsd dword es:[edi], dword [esi]
cld
adc bl, ah
pop edx
in eax, dx
jns 0x504a8b
dec edi
mov dh, 0x45
xchg byte [eax - 0x58da22e7], cl
xchg dword [ebp - 0x4a], eax
sub al, 5
in al, dx
aad 0x15
int 0xd7
xor al, 0x87
dec eax
punpckldq mm6, dword [esi + 0x1e4a7406]
pop esi
daa
pop esi
push ss
invalid

Function at 0x53cafa
Capabilities:
Encode data using xor

Disassembly:
sbb ah, byte [edi + 0x384089a0]
xor bh, al
inc ebp
wait
sti
adc byte [ebx - 0xc090496], 0x79
cld
test byte [eax + ebp*2 - 0x179a1364], al
int 0xd6
lea ebx, [ecx]
pop ebx
daa
jl 0x53c9e4
scasb al, byte es:[edi]
pushfd
invalid
add ch, byte [ebp - 0x1e]
push es
jne 0x53c9f7
mov edi, 0xf65e1c9c
mov cl, dh
salc
cld
popfd
popal
inc ebx
sbb al, 0xc
imul eax, dword [eax], 0x28e9a521
call 0xec7e6b24
or byte [edi + ebx*8 - 0x2c], dl
test dword [0xe563254b], esi
add byte [ecx], ah
movsd dword es:[edi], dword [esi]
jmp 0xa117b287
arpl bp, sp
mov eax, dword [0x1630d563]
cli
mov eax, 0xb70d60c0
adc byte [0x1a9c708d], al
scasb al, byte es:[edi]
sbb byte [esi + esi*2 - 0x5675f7c0], bh
adc ecx, ecx
jne 0x53ca57
jns 0x53ca42
aad 0xa4
inc esp
mov ecx, 0x7165888c
std
mov dword [0xb7fd7075], eax
adc ch, byte [esi]
insb byte es:[edi], dx
push ds
cmpsd dword [esi], dword es:[edi]
into
mov esp, 0x5ffd4804
jmp 0xbccb6035
aaa
mov esi, 0x6f638d98
or byte [eax + 0x6c], ch
invalid
loopne 0x53caaf
xchg esi, eax
loope 0x53ca69
insd dword es:[edi], dx
scasb al, byte es:[edi]
xor al, cl
xchg ebx, eax
add byte [edx], ch
stc
and eax, 0xd1d24934
js 0x53cad5
inc ecx
insb byte es:[edi], dx
xchg esp, eax
sub al, 0xdc
add eax, dword [eax - 0x57d05633]
arpl word [esi + ebp*4 - 0x6b], di
pop ecx
invalid

Function at 0x5e27d0
Capabilities:
Encode data using xor

Disassembly:
invalid
scasd eax, dword es:[edi]
xor eax, 0x876779e2
rcl byte [eax - 0x2f], cl
mov dl, 0xd2
mov al, 0xb3
mov es, ebx
movsb byte es:[edi], byte [esi]
xor esp, dword [ebp + 0xc]
mov al, byte [0xe95f6433]
ja 0x5e2791
inc ebx
or al, 0x3b
or al, 0x40
or dl, byte [eax]
mov gs, word [edi + 0x54d39100]
xchg ebx, eax
sbb dword [ebp + 0x1261f33d], ecx
mov byte [0x414c81e9], al
lodsd eax, dword [esi]
dec esi
int1
and edx, 7
cmp dword fs:[ebx + 0x7d], esi
push edi
xor edx, dword [ebx - 0x212b77df]
out 3, al
salc
xchg ebp, eax
ret
Function at 0x60c8d0
Capabilities:
Encode data using xor

Disassembly:
sbb al, byte [eax - 0x5bd74c4f]
rol edi, 1
push ss
out 0xf7, al
push edx
xlatb
inc edi
pop edi
push esp
cmp eax, 0xd6c6e649
fxch st(7)
add dword [eax], ebp
inc ecx
and dword [ebx], ebp
dec ebx
insd dword es:[edi], dx
ret 0xb8b0
jmp 0x60c8da
push ecx
test ecx, esp
xor dword [edx], esp
dec eax
inc eax
je 0x60c843
push 0x5d69c72f
mov edx, 0x43e0cbd2
aad 0x6d
jmp 0x46f4022d
sahf
nop
sub byte [0xe5f31f92], 0xbb
dec bx
shr dword [ebp*2 + 0x314845de], 1
ret
jle 0x60c876
aaa
sal dword [ecx - 3], cl
or eax, ebx
cmp eax, 0x9bd136fd
jae 0x60c879
rcr dword ss:[ebx + 0x31529a73], 1
pop ds
push edx
xor dword [edi], ebx
lds esi, [eax - 0x6b]
loope 0x60c8fb
or dword [edi + 0x4092f4a6], edx
popfd
shl dl, cl
sub byte [eax], ah
push edx
push ecx
xchg ebp, ebp
loop 0x60c927
jo 0x60c90c
pop es
adc esi, dword [esi]
xor eax, 0xc272982f
mov ecx, 0x62d68ebe
sub dword [ebx + 0x13bbdaa3], esp
mov cl, byte cs:[edi + 0x6f9ed251]
adc ebp, dword [esi]
mov cl, byte [edi + 0x6f9ed251]
mov dl, 0xa9
adc al, 0xb5
and byte [ebp + 0x60], al
mov ebx, 0xbd2f84bb
jge 0x60c8ab
inc esp
cmp al, 0xfb
adc cl, byte [eax + 0x239cecae]
nop
mov byte [esi - 0x6fdc6314], ch
invalid
Function at 0x41ecdc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00415fe2
and dword [ebp - 0x14], 0
cmp dword [0x46b270], 0
mov dword [ebp - 0x18], eax
jne 0x41ed8f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41ee37
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41ee37
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46b270], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46b274], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46b278], eax
call edi
push eax
call esi
mov dword [0x46b280], eax
test eax, eax
je 0x41ed8f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46b27c], eax
mov eax, dword [0x46b27c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ede8
cmp dword [0x46b280], ecx
je 0x41ede8
push eax
call esi
push dword [0x46b280]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ede8
test ebx, ebx
je 0x41ede8
call edi
test eax, eax
je 0x41eddf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41eddf
test byte [ebp - 8], 1
jne 0x41ede8
or dword [ebp + 0x10], 0x200000
jmp 0x41ee1b
mov eax, dword [0x46b274]
cmp eax, dword [ebp - 0x18]
je 0x41ee1b
push eax
call esi
test eax, eax
je 0x41ee1b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41ee1b
mov eax, dword [0x46b278]
cmp eax, dword [ebp - 0x18]
je 0x41ee1b
push eax
call esi
test eax, eax
je 0x41ee1b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46b270]
call esi
test eax, eax
je 0x41ee37
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41ee39
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410717
leave
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
sub ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x408957
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, 0x4085d8
mov edi, edi
mov edi, 0x9688f8bb
call fcn.0040898d
push ecx
pop ecx
or edi, edi
xor dword [eax], edx
inc eax
push 0x7349d6d1
mov edi, dword [esp]
add esp, 4
sub edi, 0xb40d2c06
cmp eax, esi
jne fcn.00408957
ret
Function at 0x40f200
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rcr esi, 0x8b
dec edx
bswap eax
neg edi
add edx, 0x44
sub edi, 0x48
sub eax, 0x5f
dec ebx
mov ebx, 0xfc
add ebx, 0xba
imul esi
dec edi
rol esi, 0x80
rcr ebx, 0x7f
imul edx
and eax, 9
neg eax
sbb esi, 0xee
not eax
dec eax
dec esi
neg eax
sub edx, 0xee
dec edx
not ebx
and esi, 0x68
not edi
neg edi
dec esi
ror edx, 0x72
dec eax
add edx, 0x11
and ebx, 0xa3
rcl esi, 0xa2
sub esi, 0x77
sbb eax, 0xe6
neg esi
add esi, 0x33
sbb ebx, 0x4d
ror edx, 0x3c
imul eax
not edi
not ebx
mov ebx, 0x59
rol eax, 0x39
rcr esi, 0xe
inc ebx
ror eax, 0xe6
rcl edx, 0x40
neg edi
xor ecx, ecx
xor edi, edi
dec ebx
bswap edx
not edx
imul edx
rcl ebx, 0xc3
mov esi, 0x83
rcr edi, 0xd1
inc ebx
imul edi
imul ebx
not ebx
rcl ebx, 0x27
neg ebx
ror ebx, 0x78
mov eax, 0xb0
bswap edi
dec ebx
and eax, 0x63
not esi
imul esi
mov eax, 0x6e
mov eax, 0xf
and edi, 0x81
not edx
imul eax
rcr eax, 0xab
inc ebx
mov edi, 0x47
dec edx
mov eax, 0x1a
dec eax
add edx, 0xe2
imul eax
bswap eax
not edi
or eax, 0xc7
dec esi
sub esi, 0x4a
ror edi, 0xfb
neg esi
sub esi, 0xf1
mov edi, 0xe9
bswap edx
rol ebx, 0xfc
neg edi
add esi, 0xdc
or edx, 0xa1
or eax, 0x67
rcl edx, 0xb
bswap edi
mov ecx, dword [ebp + 0xc]
rol edx, 0x36
inc eax
dec edx
imul edx
rcl esi, 0xbb
imul edi
bswap eax
bswap ebx
rcr esi, 0xcc
inc edi
bswap edx
dec edx
and edi, 0x96
rol ebx, 0x88
neg ebx
neg ebx
not ebx
or eax, 0x3d
and eax, 0x6a
and edi, 0xb
mov esi, 0xf9
rcl edi, 0x7f
dec edx
ror esi, 0xa6
ror edi, 0x25
add edi, 0x89
not edx
or eax, 0xac
neg edi
dec ebx
and eax, 0xe5
and edx, 0xb0
neg edx
bswap ebx
dec ebx
rcr eax, 0xe5
rcl eax, 0xad
imul eax
mov edx, 0x6a
inc ebx
neg edx
inc edx
bswap esi
or eax, 0xc3
not esi
rcl esi, 0x8a
not edx
rol ebx, 0xcb
sbb edx, 0xde
not ebx
mov edi, dword [ebp + 8]
mov eax, eax
xor ebx, ebx
xor eax, eax
not byte [edi]
xor esi, esi
xor eax, ebx
xor ebx, ebx
xor eax, eax
mov esi, ebx
xor ebx, esi
mov ebx, eax
mov ebx, ebx
mov ebx, ebx
add byte [edi], 0x26
xor eax, eax
xor eax, esi
xor eax, ebx
xor esi, eax
xor ebx, ebx
mov eax, ebx
mov esi, esi
mov esi, eax
xor ebx, eax
sub byte [edi], 0x86
mov esi, esi
xor eax, esi
xor eax, eax
xor esi, ebx
mov ebx, esi
xor ebx, esi
mov ebx, eax
xor ebx, esi
xor ebx, ebx
imul byte [edi]
inc edi
loop 0x40f3b9
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5e7133a5
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x298c0246
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x402850
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x40287f
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403628
jmp 0x40289d
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402780
mov edi, eax
test ebx, ebx
je 0x40289d
cmp dword [esi], 0
je 0x40289d
dec ebx
jmp 0x402886
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402a84
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x489030], 0x8088405
inc edx
mov dword [0x489030], edx
mul edx
mov eax, edx
ret