joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b4a8
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x1005188a
call fcn.1004fe2e
cmp byte [0x100d3958], 0
je 0x1001b65b
movaps xmm0, xmmword [0x10058cc0]
lea ecx, [ebp - 0x3c]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x214021a
xor ebx, ebx
mov dword [ebp - 0x28], 0x581c12
mov byte [ebp - 0x24], 1
call fcn.10014512
push eax
call fcn.1002c921
lea ecx, [ebp - 0x20]
mov dword [esp], 0x3ba877d2
call fcn.1001e30a
sub esp, 0xc
mov dword [ebp - 4], ebx
mov edx, 0x100d395c
mov ecx, eax
call fcn.1003364a
movaps xmm0, xmmword [0x10059450]
add esp, 0xc
movups xmmword [ebp - 0x44], xmm0
mov ecx, ebx
mov byte [ebp - 0x24], 1
movaps xmm0, xmmword [str._AFF___z_JEN7]
movups xmmword [ebp - 0x34], xmm0
lea eax, [ecx + 0x63]
xor byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0x1f
jb 0x1001b52e
mov byte [ebp - 0x24], bl
mov ecx, 0x8f
mov edx, ebx
mov al, byte [edx + 0x10053fa8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b562
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xa
jl 0x1001b545
mov byte [ebp - 0x16], bl
push ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 1
push eax
mov edx, 0x100d3960
lea ecx, [ebp - 0x20]
call fcn.10033d08
pop ecx
pop ecx
mov ecx, 0xe8
mov edx, ebx
mov al, byte [edx + 0x10053fb4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b5aa
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 9
jl 0x1001b58d
mov byte [ebp - 0x17], bl
sub esp, 0xc
mov dword [ebp - 4], 2
mov edx, 0x100d3968
lea ecx, [ebp - 0x20]
call fcn.1003364a
add esp, 0xc
mov ecx, 0x81
mov edx, ebx
mov al, byte [edx + 0x10053fc0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b5f1
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 9
jl 0x1001b5d4
mov byte [ebp - 0x17], bl
sub esp, 0xc
mov dword [ebp - 4], 3
mov edx, 0x100d396c
lea ecx, [ebp - 0x20]
call fcn.1003364a
add esp, 0xc
mov ecx, 0xec
mov edx, ebx
mov al, byte [edx + 0x10053fcc]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b638
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1001b61b
mov byte [ebp - 0x15], bl
sub esp, 0xc
mov dword [ebp - 4], 4
mov edx, 0x100d3964
lea ecx, [ebp - 0x20]
call fcn.1003364a
add esp, 0xc
call fcn.1004fdec
ret
Function at 0x1001bba6
Capabilities:
Execute command

Disassembly:
push 0x2c
mov eax, 0x10051961
call fcn.1004fe2e
and dword [ebp - 0x38], 0
and dword [ebp - 0x34], 0
xor ebx, ebx
push 0x51
pop ecx
mov edx, ebx
mov al, byte [edx + 0x10054040]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1001bbde
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x1001bbc1
mov byte [ebp - 0x15], bl
push ebx
lea edx, [ebp - 0x38]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x24]
call fcn.1002d13f
pop ecx
test al, al
je 0x1001bc31
push 0x11
pop ecx
mov edx, ebx
mov al, byte [edx + 0x10054050]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x30], al
and ecx, 0x800000ff
jns 0x1001bc1d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x1d
jl 0x1001bc00
lea eax, [ebp - 0x30]
mov byte [ebp - 0x13], bl
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
pop ecx
and dword [ebp - 0x38], 0
mov ecx, 0xbb
and dword [ebp - 0x34], 0
mov edx, ebx
mov al, byte [edx + 0x10054070]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001bc5d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x1001bc40
mov byte [ebp - 0x13], bl
push ebx
lea edx, [ebp - 0x38]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.1002d13f
or dword [ebp - 4], 0xffffffff
pop ecx
test al, al
je 0x1001bc87
call fcn.1000fbe2
and dword [ebp - 0x38], 0
mov ecx, 0xf2
and dword [ebp - 0x34], 0
mov edx, ebx
mov al, byte [edx + 0x10054080]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001bcb3
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x1001bc96
mov byte [ebp - 0x13], bl
push ebx
lea edx, [ebp - 0x38]
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.1002d13f
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x20]
pop ecx
mov cl, al
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
test cl, cl
je 0x1001bce9
call fcn.10014533
call fcn.1004fdec
ret
Function at 0x1001dcb5
Capabilities:
Create thread
Terminate process

Disassembly:
push 0x50
mov eax, 0x10051a71
call fcn.1004fe2e
cmp dword [ebp + 0xc], 1
mov esi, dword [ebp + 8]
jne 0x1001dd75
lea ecx, [ebp - 0x40]
call fcn.1000ed80
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
call fcn.1000822a
call fcn.1000ee5e
add esp, 0x18
test al, al
je 0x1001dd80
mov ecx, esi
call fcn.10008b02
mov ecx, esi
call fcn.10008aa6
push 0x64
push 0x232
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x1001dcb0
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x10008a54
push ebx
push ebx
call esi
push 6
pop ecx
movaps xmm0, xmmword [0x10059270]
lea edi, [ebp - 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0x434c45
rep stosd dword es:[edi], eax
push ecx
push ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x14], 1
movups xmmword [ebp - 0x28], xmm0
call fcn.1000ece1
lea edx, [ebp - 0x5c]
mov ecx, eax
call fcn.100023b8
pop ecx
pop ecx
call fcn.1000ed02
lea ecx, [ebp - 0x40]
call fcn.10007a51
xor eax, eax
inc eax
call fcn.1004fdec
ret 0xc
movaps xmm0, xmmword [0x100590d0]
lea ecx, [ebp - 0x28]
push 0x10
push 0x10052593
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x18], 0x100
call fcn.100144af
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1001de0f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x46], 0
je 0x1001de2c
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0x45
jb 0x1001de1a
mov byte [esi + 0x46], 0
pop esi
ret

Function at 0x1001df45
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x1001df62
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0x1c
jb 0x1001df50
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x1001df64
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x1001df81
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0x17
jb 0x1001df6f
mov byte [esi + 0x18], 0
pop esi
ret

Function at 0x1001df83
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x1001dfa0
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0x16
jb 0x1001df8e
mov byte [esi + 0x17], 0
pop esi
ret

Function at 0x1001dfa2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x1001dfbf
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0x1a
jb 0x1001dfad
mov byte [esi + 0x1b], 0
pop esi
ret

Function at 0x1001dfc1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x1001dfde
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0x14
jb 0x1001dfcc
mov byte [esi + 0x15], 0
pop esi
ret
Function at 0x1001dfe0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x1001dffd
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0xe
jb 0x1001dfeb
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x1001dfff
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x1001e01c
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0x10
jb 0x1001e00a
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x1001e01e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x1001e03b
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0xf
jb 0x1001e029
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x1001e03d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x1001e05a
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0xa
jb 0x1001e048
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x1001e0fc
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x1001e119
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0x12
jb 0x1001e107
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x1001e11b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x1001e138
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0x13
jb 0x1001e126
mov byte [esi + 0x14], 0
pop esi
ret

Function at 0x1001e30a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x70
pop edx
mov al, byte [esi + edi - 0x2ba33912]
xor al, dl
inc edx
mov byte [ecx + esi], al
and edx, 0x800000ff
jns 0x1001e334
dec edx
or edx, 0xffffff00
inc edx
inc esi
cmp esi, 0xc
jl 0x1001e317
pop edi
pop esi
mov byte [ecx + 0xc], 0
mov eax, ecx
pop ebp
ret 4
Function at 0x1001f409
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1005d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x100d3a0c]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push dword [0x1010a620]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
movd xmm1, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x20]
mov ecx, edi
sub ecx, dword [0x1010a628]
mov esi, dword [ebp - 0x1c]
mov edx, esi
sbb edx, dword [0x1010a62c]
call fcn.10050490
mov edx, dword [0x1010a634]
mov ecx, dword [0x1010a630]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.10050490
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x1010a62c], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x1010a628], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xf1], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xf2], al
call esi
shr eax, 0xf
and al, 1
mov byte [ebx + 0xf4], 0
mov byte [ebx + 0xf3], al
call fcn.1001f362
cmp byte [ebx + 0xf0], 0
pop edi
pop esi
pop ebx
je 0x1001f503
or eax, 0xffffffff
jmp 0x1001f50e
mov eax, dword [0x100d3a0c]
mov eax, dword [eax + 0x1cfc]
cmp dword [0x1005dc6c], eax
je 0x1001f520
mov dword [0x1005dc6c], eax
call fcn.1001f2c6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c374
leave
ret

Function at 0x10020a2c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1010a67c], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x10020a6b
xor esi, esi
push 8
mov ecx, esi
pop edx
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub edx, 1
jne 0x10020a46
mov dword [esi*4 + 0x1010a678], ecx
inc esi
cmp esi, 0x100
jb 0x10020a41
mov esi, dword [ebp + 8]
not esi
mov edx, esi
test ebx, ebx
jle 0x10020ab0
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1010a678]
inc edi
sub ebx, 1
jne 0x10020a76
jmp 0x10020ab7
cmp al, 0x23
jne 0x10020a9e
cmp byte [edi], al
jne 0x10020a9e
cmp byte [edi + 1], al
cmove edx, esi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1010a678]
mov al, byte [edi]
inc edi
test al, al
jne 0x10020a90
pop edi
not edx
pop esi
mov eax, edx
pop ebx
pop ebp
ret
Function at 0x100212b1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100212c0
and dword [edi], 0
mov edx, 0x10057ff8
call fcn.1002121f
mov esi, eax
test esi, esi
je 0x1002135e
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10021353
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
je 0x10021353
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10021353
mov ecx, ebx
call fcn.100229dc
mov dword [ebp + 8], eax
test eax, eax
je 0x10021353
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x10021341
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp + 8]
dec dword [0x1010a624]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x1002135a
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
test edi, edi
je 0x1002134e
mov dword [edi], ebx
mov eax, dword [ebp + 8]
jmp 0x1002135d
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x10025a63
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100d3a0c]
push esi
mov esi, ecx
and dword [eax + 0x2c8c], 0
test esi, esi
je 0x10025ab3
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push edi
call fcn.10025ab6
mov edx, 0x10057ffc
mov ecx, esi
mov edi, eax
call fcn.1002121f
mov esi, eax
test esi, esi
je 0x10025ab2
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x1002c8d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [0x100d3a0c]
mov eax, dword [edi + 0x1a20]
mov byte [eax + 0x78], 1
mov eax, dword [edi + 0x1a20]
cmp byte [eax + 0x7b], 0
jne 0x1002c91e
push edx
lea esi, [edi + 0x2ec4]
mov edx, 0xc01
push ecx
mov ecx, esi
call fcn.100209fe
pop ecx
pop ecx
lea edx, [edi + 0x2ec4]
mov ecx, esi
lea edx, [edx + eax]
pop edi
pop esi
jmp fcn.1002c95e
pop edi
pop esi
ret
Function at 0x1003db94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x1005d040]
xor eax, esp
mov dword [esp + 0x2c], eax
movaps xmm0, xmmword [0x10058eb0]
xor edx, edx
movups xmmword [esp], xmm0
mov dword [esp + 0x20], 0xece4f7f4
movaps xmm0, xmmword [0x10059930]
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x24], 0xffedcfaa
mov dword [esp + 0x28], 0x1008fe5
mov al, dl
add al, 0x66
xor byte [esp + edx], al
inc edx
cmp edx, 0x2a
jb 0x1003dbd9
push ecx
lea eax, [esp + 4]
mov byte [esp + 0x2f], 0
push eax
mov edx, 0x1010aa84
call fcn.10033d08
pop ecx
pop ecx
test al, al
je 0x1003dc46
mov eax, dword [0x1010aa84]
sub eax, 0
je 0x1003dc3b
sub eax, 1
je 0x1003dc34
sub eax, 1
je 0x1003dc2d
sub eax, 1
je 0x1003dc26
sub eax, 1
jne 0x1003dc42
call fcn.10046be7
jmp 0x1003dc42
call fcn.10047251
jmp 0x1003dc42
call fcn.1004605f
jmp 0x1003dc42
call fcn.100466db
jmp 0x1003dc42
xor ecx, ecx
call fcn.100456e9
mov al, 1
jmp 0x1003dc48
xor al, al
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1004c374
mov esp, ebp
pop ebp
ret
Function at 0x1004060d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x1004062a
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x66]
xor byte [ecx], al
inc edx
cmp edx, 0x33
jb 0x10040618
mov byte [esi + 0x34], 0
pop esi
ret

Function at 0x1004062c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x10040649
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x66]
xor byte [ecx], al
inc edx
cmp edx, 0x23
jb 0x10040637
mov byte [esi + 0x24], 0
pop esi
ret

Function at 0x1004064b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a5], 0
je 0x10040671
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x66]
xor byte [ecx], al
inc edx
cmp edx, 0x1a4
jb 0x10040659
mov byte [esi + 0x1a5], 0
pop esi
ret

Function at 0x10040673
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2c], 0
je 0x10040690
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x66]
xor byte [ecx], al
inc edx
cmp edx, 0x2b
jb 0x1004067e
mov byte [esi + 0x2c], 0
pop esi
ret

Function at 0x10040692
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x100406af
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x66]
xor byte [ecx], al
inc edx
cmp edx, 0x21
jb 0x1004069d
mov byte [esi + 0x22], 0
pop esi
ret

Function at 0x100406b1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5f], 0
je 0x100406ce
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x66]
xor byte [ecx], al
inc edx
cmp edx, 0x5e
jb 0x100406bc
mov byte [esi + 0x5f], 0
pop esi
ret

Function at 0x100406d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3c], 0
je 0x100406ed
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x66]
xor byte [ecx], al
inc edx
cmp edx, 0x3b
jb 0x100406db
mov byte [esi + 0x3c], 0
pop esi
ret

Function at 0x100406ef
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x68], 0
je 0x1004070c
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x66]
xor byte [ecx], al
inc edx
cmp edx, 0x67
jb 0x100406fa
mov byte [esi + 0x68], 0
pop esi
ret

Function at 0x1004070e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x41], 0
je 0x1004072b
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x66]
xor byte [ecx], al
inc edx
cmp edx, 0x40
jb 0x10040719
mov byte [esi + 0x41], 0
pop esi
ret

Function at 0x1004072d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x8b], 0
je 0x10040753
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x66]
xor byte [ecx], al
inc edx
cmp edx, 0x8a
jb 0x1004073b
mov byte [esi + 0x8b], 0
pop esi
ret

Function at 0x10040755
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x10040772
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x66]
xor byte [ecx], al
inc edx
cmp edx, 0x2a
jb 0x10040760
mov byte [esi + 0x2b], 0
pop esi
ret
Function at 0x10040774
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x10040791
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x66]
xor byte [ecx], al
inc edx
cmp edx, 0x1d
jb 0x1004077f
mov byte [esi + 0x1e], 0
pop esi
ret
Function at 0x1004d440
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1004d5f0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1004d50d
mov edx, dword [ebp - 4]
cmp edx, dword [0x1005d090]
jb 0x1004d48a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1005d094]
ja 0x1004d48a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004d45a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1004d4b0
jmp 0x1004d50d
cmp dword [ebp - 0x14], 0x10000
jne 0x1004d4f3
cmp dword [ebp - 0x18], 0x10000
jb 0x1004d4f3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004d4e6
mov eax, dword [ebp - 8]
jmp 0x1004d50f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1004d508
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1004d5f0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004d45a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1004d520
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1004d620
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1004d5e5
mov edx, dword [ebp - 4]
cmp edx, dword [0x1005d090]
jb 0x1004d565
mov eax, dword [ebp - 4]
cmp eax, dword [0x1005d094]
ja 0x1004d565
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004d535
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1004d58b
jmp 0x1004d5e5
cmp dword [ebp - 0x14], 0x10000
jne 0x1004d5ce
cmp dword [ebp - 0x18], 0x10000
jb 0x1004d5ce
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004d5c1
mov eax, dword [ebp - 8]
jmp 0x1004d5e7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1004d5e0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1004d620
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004d535
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4029f4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403fb0
test esi, esi
jne 0x402a2a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004040a0
jmp 0x402a48
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402908
mov edi, eax
test esi, esi
je 0x402a48
cmp dword [ebx], 0
je 0x402a48
dec esi
jmp 0x402a31
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402c98
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x454008], 0x8088405
inc edx
mov dword [ebx + 0x454008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4030f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x454024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403188
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403168
xor eax, eax
push ebp
push 0x403161
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4031a4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403168
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x454024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x454024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e34
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x456044], 0
je 0x403e95
cmp word [0x456218], 0xd7b2
jne 0x403e5d
cmp dword [0x456220], 0
jbe 0x403e5d
mov eax, 0x456214
call dword [0x456230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x454070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403ebc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x454034], 0
jne 0x403eb1
push 0
push 0x454068
push 0x454070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret