joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4020d3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareAdobeAdobe_Acrobat11.0Security
xor edi, edi
push 0x80000002
inc edi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40213d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x4042ac
push dword [ebp - 4]
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402134
cmp dword [ebp - 8], esi
jne 0x402134
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x40215d
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x406088], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x4021a1
call ebx
test eax, eax
jns 0x402197
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x406084], eax
mov dword [0x406088], 1
mov eax, dword [0x406084]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4021bd
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x4021ed
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x4021e3
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x4021d8
push dword [eax + 0xc]
call dword [eax + 8]
jmp 0x4021dd
push dword [eax + 4]
call dword [eax]
test eax, eax
je 0x4021ec
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x40279c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x406054]
jne 0x4027a6
repz ret
jmp fcn.00402cfa
Function at 0x10cd2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10cd21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10cd207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10cd206a
add dl, dl
jne 0x10cd2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10cd20dc
xor eax, eax
add dl, dl
jne 0x10cd2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10cd217d
add dl, dl
jne 0x10cd20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10cd20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10cd20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10cd20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10cd20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10cd2075
mov eax, 1
add dl, dl
jne 0x10cd20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10cd20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10cd20e1
sub eax, ebx
mov ebx, 1
jne 0x10cd2128
mov ecx, 1
add dl, dl
jne 0x10cd210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10cd2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10cd2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10cd2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10cd213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10cd214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10cd2136
cmp eax, 0x7d00
jae 0x10cd216d
cmp eax, 0x500
jb 0x10cd2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10cd2075
cmp eax, 0x7f
ja 0x10cd2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10cd2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10cd219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10cd2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x408c70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push 1
push 4
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
push 1
push 4
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
push 1
push 4
mov edx, dword [ebp + 0xc]
add edx, 8
push edx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
push 1
push 4
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
push 1
push 4
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
push 1
push 4
mov edx, dword [ebp + 0xc]
add edx, 0x20
push edx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
push 1
push 4
mov ecx, dword [ebp + 0xc]
add ecx, 0x24
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
push 1
push 4
mov eax, dword [ebp + 0xc]
add eax, 0x28
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x20], 2
jne 0x408d58
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ecx
push 4
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
jmp 0x408d77
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
add eax, 1
push eax
push 4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
push edx
push 4
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x28], 0
jle 0x408dbf
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x28]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x41b870
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43ecb0]
jne 0x41b87a
repz ret
jmp fcn.0041bc80
Function at 0x401047
Capabilities:
Set current directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.00403d77
pop ecx
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea edi, [eax - 1]
neg edi
sbb edi, edi
neg edi
test esi, esi
je 0x401076
push dword [esp + 0xc]
call fcn.00401c9b
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x40181e
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [0x4194d4]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401849
push edi
mov edi, dword [esp + 0xc]
movzx ecx, byte [edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x418ce0]
inc edi
dec esi
jne 0x401832
pop edi
mov dword [0x4194d4], edx
pop esi
ret
Function at 0x402c05
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push 0x105
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x402c28
cmp byte [esi], 0
je 0x402c28
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x402c76
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4151a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xc]
push eax
call fcn.00406540
pop ecx
cmp eax, 8
jae 0x402d39
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push 0x20
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x402cd7
mov eax, 0xffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00406929
leave
ret 4
push 7
pop edx
mov ecx, esi
mov al, byte [ecx + str.PKBACK]
dec edx
cmp al, byte [ebp + ecx - 0x2c]
jne 0x402cc3
inc ecx
test edx, edx
jne 0x402cdc
mov cl, byte [ebp - 0x2c]
lea eax, [ebp - 0x2c]
test cl, cl
je 0x402cc3
cmp cl, 0x2e
je 0x402d09
cmp cl, 0x20
je 0x402d09
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x402cf8
cmp byte [eax], 0
je 0x402cc3
mov cl, byte [eax]
cmp cl, 0x30
jb 0x402d1a
cmp cl, 0x39
jbe 0x402d2e
inc eax
jmp 0x402d0e
movzx ecx, cl
imul esi, esi, 0xa
sub ecx, 0x30
cmp ecx, 9
ja 0x402d34
add esi, ecx
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x402d1d
mov ax, si
jmp 0x402cc8
push 0x412
push str.sfxhead.c
call fcn.0040400a
int3

Function at 0x403512
Capabilities:
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
push esi
push 8
xor ecx, ecx
add edx, edx
pop esi
sar edx, 1
mov eax, ecx
xor eax, edx
shr ecx, 1
test al, 1
je 0x403530
xor ecx, 0xedb88320
dec esi
test esi, esi
jg 0x40351e
mov eax, ecx
pop esi
ret 4
Function at 0x403dd5
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x4151a0]
xor eax, ebp
mov dword [ebp + 0x398], eax
push edi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x403ecd
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.winzip_shellopencommand
mov edi, 0x209
push 0x80000000
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x403ecd
push esi
lea esi, [ebp - 0x7c]
cmp word [ebp - 0x7c], ax
je 0x403e54
push ebx
xor ebx, ebx
push 4
push str.___1
push esi
call fcn.00406693
add esp, 0xc
test eax, eax
je 0x403e53
add esi, 2
cmp word [esi], bx
jne 0x403e37
pop ebx
lea ecx, [ebp - 0x7c]
mov eax, esi
sub eax, ecx
add eax, 2
push 0x418aa0
sar eax, 1
sub edi, eax
push str.__s_
lea eax, [esi + 2]
push edi
push eax
call fcn.0040690d
mov eax, dword [0x415048]
add esp, 0x10
pop esi
test eax, 0x1000
je 0x403eb2
test eax, 0x8000
jne 0x403eb2
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x7a
pop ecx
lea eax, [ebp + eax*2 - 0x84]
push 0x69
mov word [eax], cx
pop ecx
mov word [eax + 2], cx
push 0x70
pop ecx
mov word [eax + 4], cx
push 0xffffffffffffffff
lea eax, [ebp - 0x7c]
push 0x40f3e0
push eax
call fcn.00404121
add esp, 0xc
neg eax
sbb eax, eax
neg eax
jmp 0x403ef3
push 0
push 0x7d0
call fcn.00403396
push eax
push 0x40e
call fcn.00403396
push eax
push dword [0x4194dc]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
pop edi
call fcn.00406929
add ebp, 0x39c
leave
ret

Function at 0x40400a
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x11c]
sub esp, 0x19c
mov eax, dword [0x4151a0]
xor eax, ebp
mov dword [ebp + 0x118], eax
mov eax, dword [0x415f20]
mov edx, dword [ebp + 0x124]
mov ecx, eax
inc eax
push esi
mov dword [0x415f20], eax
test ecx, ecx
je 0x404045
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x128]
push edx
push 0x7d4
call fcn.00403396
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x30
push 0x7d0
call fcn.00403396
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x4194dc]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push str.WZSFX32.RPT
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40403d
push 0x40f448
lea eax, [ebp - 0x7c]
push 0x191
push eax
call fcn.004064ce
add esp, 0xc
lea eax, [ebp - 0x80]
push 0
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00406540
pop ecx
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.0040378f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WZSFX32.RPT
push 0x7d1
call fcn.00403396
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x30
push 0x7d0
call fcn.00403396
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x4194dc]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40403d
Function at 0x404121
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xfe8
mov eax, dword [0x4151a0]
xor eax, esp
mov dword [esp + 0xfe4], eax
push ebx
mov ebx, dword [esp + 0xff0]
push ebp
mov ebp, dword [esp + 0xffc]
push esi
mov esi, dword [esp + 0xffc]
push edi
push ebx
lea eax, [esp + 0xa30]
push 0x2e3
push eax
call fcn.00406637
xor edi, edi
add esp, 0xc
cmp word [esi], di
je 0x404198
push 0x40f380
lea eax, [esp + 0xa30]
push 0x2e3
push eax
call fcn.00406637
push esi
lea eax, [esp + 0xa3c]
push 0x2e3
push eax
call fcn.004065cb
add esp, 0x18
cmp ebp, 0xffffffff
jne 0x4041f0
push 0x10
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00403368
push 0x44
pop edi
push edi
xor ecx, ecx
push ecx
lea eax, [esp + 0x34]
push eax
call fcn.00403368
add esp, 0x18
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], edi
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0xa4c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4041f0
mov eax, dword [esp + 0x10]
jmp 0x404328
lea eax, [esp + 0x464]
push eax
push edi
push ebx
call dword [sym.imp.SHELL32.dll_FindExecutableW]
mov edi, eax
cmp edi, 0x1f
jne 0x404267
mov ebp, 0x100
push ebp
lea eax, [esp + 0x68]
push eax
push 0xffffffffffffffff
push 0x427
call fcn.00403396
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
xor edi, edi
push edi
push edi
call esi
push ebx
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x46c]
push 0x2e3
push eax
call fcn.0040690d
add esp, 0x10
lea eax, [esp + 0x264]
push ebp
push eax
push 0xffffffffffffffff
push 0x7d0
call fcn.00403396
push eax
push edi
push edi
call esi
push 0x10
jmp 0x40430a
cmp edi, 0x20
jbe 0x4042ad
xor eax, eax
xor ecx, ecx
cmp word [esi], cx
push 1
cmovne eax, esi
push ecx
push eax
mov eax, dword [0x415048]
and eax, 0x20000
neg eax
sbb eax, eax
push ebx
and eax, 0x40f384
push eax
push dword [0x4194dc]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
test ebp, ebp
je 0x4042a4
mov dword [ebp], edi
cmp edi, 0x20
jbe 0x4042ad
mov eax, edi
jmp 0x404328
mov ebp, 0x100
push ebp
lea eax, [esp + 0x68]
push eax
push 0xffffffffffffffff
push 0x400
call fcn.00403396
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
xor eax, eax
push eax
push eax
call esi
push ebx
push edi
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x470]
push 0x2e3
push eax
call fcn.0040690d
add esp, 0x14
lea eax, [esp + 0x264]
push ebp
push eax
push 0xffffffffffffffff
push 0x7d0
call fcn.00403396
push eax
xor ebx, ebx
push ebx
push ebx
call esi
push ebx
lea eax, [esp + 0x268]
push eax
lea eax, [esp + 0x46c]
push eax
push dword [0x4194dc]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0xff4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00406929
add esp, 0xfe8
ret
Function at 0x404341
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [0x41938e]
test edi, edi
jg 0x404357
and dword [0x4194c8], 0
xor eax, eax
pop edi
ret
mov eax, 0x800
push esi
cmp edi, eax
cmova edi, eax
push edi
push dword [0x4194d0]
push dword [0x415f54]
call dword [sym.imp.KERNEL32.dll__lread]
cmp dword [0x415f70], 0
mov esi, eax
mov dword [0x4194c8], esi
je 0x4043d5
cmp esi, 0xffffffff
je 0x4043d5
cmp esi, edi
je 0x4043e6
test esi, esi
js 0x4043d5
mov ax, word [0x415028]
push dword [0x415f74]
inc ax
movzx eax, ax
push eax
call fcn.00403559
mov esi, dword [0x4194c8]
test esi, esi
jne 0x4043cf
push edi
push dword [0x4194d0]
push dword [0x415f54]
call dword [sym.imp.KERNEL32.dll__lread]
mov esi, eax
mov dword [0x4194c8], esi
cmp esi, 0xffffffff
cmovne edi, esi
cmp esi, edi
je 0x4043e6
push 2
call fcn.004015d7
mov esi, dword [0x4194c8]
sub dword [0x41938e], esi
cmp dword [0x415f64], 0
mov edi, dword [0x4194d0]
mov dword [0x4194cc], edi
je 0x404420
test esi, esi
je 0x404420
call fcn.004062d0
xor byte [edi], al
movzx eax, byte [edi]
push eax
call fcn.004063a8
inc edi
pop ecx
dec esi
jne 0x404405
mov esi, dword [0x4194c8]
mov eax, esi
dec esi
mov dword [0x4194c8], esi
pop esi
pop edi
ret
Function at 0x406322
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4151a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x415f6c]
mov esi, dword [ebp + 8]
call fcn.004062ea
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00403346
add esp, 0x10
xor esi, esi
call fcn.004062d0
movzx ecx, byte [ebp + esi - 0x10]
xor eax, ecx
mov byte [ebp + esi - 0x10], al
movzx eax, al
push eax
call fcn.004063a8
inc esi
pop ecx
cmp esi, 0xc
jl 0x406352
cmp dword [0x415f68], 0
movzx ecx, byte [ebp - 5]
pop esi
je 0x406391
movzx eax, byte [0x419387]
cmp cx, ax
je 0x40639a
or eax, 0xffffffff
jmp 0x40639c
movzx eax, byte [0x41938d]
jmp 0x406387
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406929
leave
ret

Function at 0x4063a8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [0x418a70]
mov eax, ecx
xor eax, dword [esp + 4]
shr ecx, 8
mov edx, 0xff
and eax, edx
xor ecx, dword [eax*4 + 0x418ce0]
movzx eax, cl
mov dword [0x418a70], ecx
mov ecx, dword [0x418a74]
add ecx, eax
mov eax, dword [0x418a78]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [0x418a74], ecx
shr ecx, 0x18
xor ecx, eax
and ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x418ce0]
mov dword [0x418a78], eax
ret
Function at 0x40d4f2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4151a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0040846c
mov dword [ebp - 0x14], eax
cmp dword [0x418a44], edi
jne 0x40d5e3
push 0x800
push edi
push 0x412f7c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40d570
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d6c3
push 0x412f7c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40d6c3
push 0x412f94
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d6c3
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x418a44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x412fb0
push esi
mov dword [0x418a48], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x418a4c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x418a54], eax
test eax, eax
je 0x40d5e0
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x418a50], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d608
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d5fb
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40d61d
push 4
pop eax
jmp 0x40d6c5
cmp dword [ebp - 0x14], edi
je 0x40d61d
push dword [0x418a44]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d602
mov eax, dword [0x418a50]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40d67b
cmp dword [0x418a54], esi
je 0x40d67b
push eax
call ebx
push dword [0x418a54]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d67b
test eax, eax
je 0x40d67b
call ecx
test eax, eax
je 0x40d670
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d670
test byte [ebp - 8], 1
jne 0x40d67b
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40d6ab
mov eax, dword [0x418a48]
cmp eax, esi
je 0x40d6a8
push eax
call ebx
test eax, eax
je 0x40d6a8
call eax
mov edi, eax
test edi, edi
je 0x40d6a8
mov eax, dword [0x418a4c]
cmp eax, esi
je 0x40d6a8
push eax
call ebx
test eax, eax
je 0x40d6a8
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x418a44]
call ebx
test eax, eax
je 0x40d6c3
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40d6c5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406929
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2b6a33ed
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x42650987
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x405110
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x405200
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x405200
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x40515a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x405161
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x405140
jmp 0x405163
mov esi, 0x1505
jmp 0x405163
mov esi, ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov dword [esp + 8], edx
sub edx, 1
mov dword [esp + 0xc], edx
jb 0x405200
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
xor edi, edi
mov edx, ebx
mov dword [esp], ebx
jmp 0x4051a1
mov eax, edi
and eax, 1
xor edi, 1
lea edi, [edi + eax*2]
cmp edi, dword [esp + 8]
jae 0x4051fe
lea eax, [edi + edx]
and eax, dword [esp + 0xc]
mov ebx, dword [esp + 4]
mov ebp, dword [ebx + eax*4]
cmp ebp, 0xffffffff
je 0x4051fe
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x405190
mov eax, dword [ecx + 0xc]
mov ebx, dword [eax + ebp*4]
push ebx
call fcn.0040d560
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x405190
push dword [esp + 0x2c]
push ebx
push dword [esp + 0x30]
call fcn.0040d580
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405190
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x405200
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret