joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003d1e0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1003d5d0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x10052b24], 0
jne 0x1003d21d
cmp dword [0x10052b20], 0
je 0x1003d21d
mov eax, dword [0x10052b20]
mov dword [0x10052b24], eax
cmp dword [0x10052b24], 0
je 0x1003d29a
mov ecx, dword [0x10052b24]
cmp dword [ecx + 8], 0
je 0x1003d29a
mov edx, dword [0x10052b24]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1003d29a
mov ecx, dword [0x10052b24]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1003d29a
mov eax, dword [0x10052b24]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x1003d269
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x1003d270
xor eax, eax
jmp 0x1003d3b9
mov ecx, dword [0x10052b24]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x1003d3b9
mov edx, dword [0x10052b20]
mov dword [0x10052b24], edx
jmp 0x1003d2b6
mov eax, dword [0x10052b24]
mov ecx, dword [eax + 4]
mov dword [0x10052b24], ecx
cmp dword [0x10052b24], 0
je 0x1003d2f6
cmp dword [0x10052b24], 0
je 0x1003d2f4
mov edx, dword [0x10052b24]
cmp dword [edx + 8], 0
je 0x1003d2f4
mov eax, dword [0x10052b24]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x1003d2f4
mov edx, dword [0x10052b24]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x1003d2f4
jmp 0x1003d24e
jmp 0x1003d2a8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1003d3c0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1003d3b7
mov eax, dword [ebp - 0x18]
mov dword [0x10052b24], eax
mov ecx, dword [0x10052b24]
mov dword [ecx], 0x52727464
mov edx, dword [0x10052b24]
mov dword [edx + 8], 0
mov eax, dword [0x10052b24]
mov ecx, dword [0x10052b20]
mov dword [eax + 4], ecx
mov edx, dword [0x10052b24]
mov dword [0x10052b20], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x10052b24]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x1003d387
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x1003d3a7
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1003d37e
mov eax, dword [0x10052b24]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1003d24e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003e100
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10052b20]
mov dword [ebp - 4], eax
jmp 0x1003e119
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1003e140
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1003e13e
call sub.KERNEL32.dll_GetLastError
jmp 0x1003e142
jmp 0x1003e110
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003e5e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x10052b30], eax
je 0x1003e604
mov eax, 0x10dd
jmp 0x1003e7ac
cmp dword [0x10052b34], 0
je 0x1003e617
mov eax, dword [0x10052b34]
jmp 0x1003e7ac
cmp dword [ebp + 0xc], 0
jne 0x1003e627
mov eax, 0x57
jmp 0x1003e7ac
cmp dword [ebp + 8], 0
jne 0x1003e637
mov eax, 6
jmp 0x1003e7ac
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1003e660
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x10052b34], ecx
mov edx, dword [ebp + 8]
mov dword [0x10052b38], edx
mov eax, dword [ebp - 8]
jmp 0x1003e7ac
push 0x18
call fcn.1003fee6
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003e6bb
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x10052b34], ecx
cmp dword [ebp - 4], 0
je 0x1003e6aa
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.1004024e
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x10052b38], ecx
mov eax, dword [ebp - 8]
jmp 0x1003e7ac
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.1003e5c0
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1003e5c0
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x1003e6fb
cmp dword [ebp - 0xc], 0x1e
jbe 0x1003e717
mov dword [ebp - 8], 9
cmp dword [0x10052b28], 0
je 0x1003e712
jmp 0x1003e689
jmp 0x1003e680
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1003e73e
mov dword [ebp - 8], 9
cmp dword [0x10052b28], 0
je 0x1003e739
jmp 0x1003e689
jmp 0x1003e680
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1003e769
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1003e680
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x10052b40]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x10052b40], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x1003e7c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x10052b30], eax
je 0x1003e7dd
mov eax, 0x10dd
jmp 0x1003e8c0
mov eax, dword [0x10052b40]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003e85c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1003e838
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1003e838
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1003d660
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.1004024e
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1003e7e5
mov dword [0x10052b40], 0
call fcn.1003df40
mov ecx, dword [0x10052b3c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1003e8aa
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1004024e
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1003e874
mov dword [0x10052b3c], 0
mov dword [0x10052b30], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003eda0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10052b34], 0
je 0x1003edb9
mov eax, dword [0x10052b34]
jmp 0x1003ee58
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1003edca
xor eax, eax
jmp 0x1003ee58
push 8
call fcn.1003fee6
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003ee22
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1003ee0b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.1004024e
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10052b34], eax
mov dword [0x10052b38], 0
mov eax, dword [ebp - 8]
jmp 0x1003ee58
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1003ee3a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1003edea
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10052b3c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10052b3c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x404860
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x445664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push eax
mov eax, 0x100
lea ebx, [ebp - 0x204]
call fcn.00402000
add esp, 4
cmp byte [0x448223], 0
pop ebx
je 0x4048ea
push esi
push str.KmsRequests
lea ecx, [ebp - 0x204]
push 0
mov dword [ebp - 0x208], ecx
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov esi, eax
test esi, esi
je 0x4048db
push 0
lea edx, [ebp - 0x208]
push edx
push 0
push 1
push 0
push 0x40000386
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418fcb
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x204]
push eax
push 0x43e330
call fcn.0041a429
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
call fcn.00418fcb
mov esp, ebp
pop ebp
ret

Function at 0x4072f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ebp - 0x33243], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
add eax, esi
test dword [ecx - 4], ecx
invalid
jmp dword [eax]
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
dec dword [ebx]

Function at 0x407530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.00406a25
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004069da
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
invalid
movsd dword es:[edi], dword [esi]
invalid
Function at 0x6923a5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x24]
je 0x68b9bb
mov ch, 0xf2
pushal
dec cx
call fcn.00712e88
add byte [eax], al
add byte [eax], al
mov dword [esp], esi
shr ah, 5
push edi
aas
daa
neg ah
push ebx
shl ax, 0xe
shld ax, sp, 9
adc al, 0x24
clc
push edx
aas
shrd ax, dx, cl
mov eax, dword [ebp + 8]
clc
test eax, eax
push ebp
lea esp, [esp + 4]
je 0x68b9bb
btr si, si
ror dl, cl
mov esi, dword [eax + 0x3c]
rol dl, 5
cmp ch, 0x93
add esi, eax
rcr edx, cl
mov edx, dword [esi + 0x78]
pushal
bt ax, si
jmp 0x697906
pushfd
test edx, edx
jmp 0x6904d6

Function at 0x694f1f
Capabilities:
Encode data using xor

Disassembly:
sub ecx, ebx
stc
shr esi, 8
lea esi, [esp + 8]
bt bx, sp
bt sp, cx
sub edi, 4
clc
cmc
clc
push 0x5c9fbfbf
push dword [edi]
pop dword [esp + 8]
push edx
cmp edi, ebx
pushal
call fcn.00710be7
jno 0x694f84
cmp byte [esi], 0x7d
sbb eax, esi
cmpsd dword [esi], dword es:[edi]
pop eax
salc
inc ebp
jne 0x694f95
pop esi
inc ebp
mov ecx, 0x9f3b84d8
out 0x92, al
inc ebp
mov ecx, 0xb76380f4
push es
mov byte [0x8b98c561], al
mov dword [edi + ebx*8 - 0x1b], eax
les esi, [ebx - 0x5f]
cmpsd dword fs:[esi], dword es:[edi]
push eax
inc edi
sub bl, byte [esi - 0x7533e93]
ret
sahf
lcall 0xfa33, 0x93346f64
xchg ebx, eax
xor edi, edx
or esp, dword [eax + 0x736d3d72]
movsb byte es:[edi], byte [esi]
or eax, 0x610d06c1
sub byte [edi - 0x6e], ah
push es
or eax, 0x92672861
lahf
lodsb al, byte [esi]
push 0xffffffffffffffdf
inc ecx
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
test al, 0x5b
xor al, 0x88
xchg esp, eax
ja 0x694f89
in al, dx
ret

Function at 0x695fc0
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
jae 0x68b9c5
xor di, bp
adc di, 0x8e95
shrd di, bx, 0xc
pushal
mov ebx, eax
rol ch, cl
mov edi, eax
dec ch
shr ch, cl
bsr cx, si
mov ecx, 0x104
call fcn.0068c5de

Function at 0x71845a
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor esi, ecx
mov ecx, edi
xor si, cx
rcr esi, 0x13
sub ecx, ebx
call fcn.00695a41

Function at 0x71846b
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
or byte [edi], cl
xchg eax, esi
cmpsb byte [esi], byte es:[edi]
invalid
mov byte [esp], cl
cmp eax, edx
pushal
mov dword [esp + 8], 0x3f7c952b
call fcn.007138d6
sub edi, ebp
and al, 8
sub edx, dword [ebp - 0x6c17c084]
sbb dword [eax], ecx
add byte [ecx], ch
out dx, eax
mov dl, 0x24
sti
aas
xor ch, bh
jo 0x691f38
or dword [ebp + 0x7501527d], edi
nop
cmp al, 0x83
das
out 0x48, al
and eax, dword [edi + 0x73037422]
stosb byte es:[edi], al
jne 0x691f1c
invalid
jmp 0x691f30
Function at 0x401060
Capabilities:
Allocate or change rwx memory
Terminate process

Disassembly:
push ebx
push esi
push 4
push 0x3000
push 0x17c841c0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
push eax
cmp eax, 0x11
je 0x401023
mov eax, eax
cld
test ecx, ecx
or eax, eax
clc
pop eax
test esi, esi
je 0x401056
nop
mov al, al
push 0x5e69ec0
push 0
push esi
call fcn.0042a2f0
add esp, 0xc
push ebx
mov cl, cl
mov cl, cl
cld
pop ebx
push 0x8000
push 0x17c841c0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop esi
pop ebx
ret
push 0
push 0x40
push 0x3000
push 0x7d0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test eax, eax
jne 0x401088
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp section..text

Function at 0x401130
Capabilities:
Get memory capacity
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x451f00]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.0042a2f0
add esp, 0xc
lea ecx, [ebp - 0x44]
push ecx
mov dword [ebp - 0x44], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp eax, 1
jne 0x401181
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
shrd ecx, eax, 0x14
shr eax, 0x14
test eax, eax
ja 0x401189
jb 0x401181
cmp ecx, 0x309
jae 0x401189
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a36a
mov esp, ebp
pop ebp
ret

Function at 0x4011a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x10], 2
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x4011c0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x451f00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x818], ecx
xor edi, edi
nop
push ebx
mov dword [ebp + edi*4 - 0x404], edi
call fcn.004204b0
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
inc edi
add esp, 4
movzx edx, byte [edx + ebx]
mov dword [ebp + edi*4 - 0x808], edx
cmp edi, 0x100
jl 0x4011f0
xor edi, edi
xor eax, eax
mov edx, dword [ebp + eax - 0x404]
mov ecx, dword [ebp + eax - 0x804]
add ecx, edx
add ecx, esi
and ecx, 0x800000ff
jns 0x401242
dec ecx
or ecx, 0xffffff00
inc ecx
mov esi, dword [ebp + ecx*4 - 0x404]
mov dword [ebp + eax - 0x404], esi
mov esi, dword [ebp + eax - 0x800]
mov dword [ebp + ecx*4 - 0x404], edx
mov edx, dword [ebp + eax - 0x400]
add esi, edx
add ecx, esi
and ecx, 0x800000ff
jns 0x401279
dec ecx
or ecx, 0xffffff00
inc ecx
mov esi, dword [ebp + ecx*4 - 0x404]
mov dword [ebp + eax - 0x400], esi
mov esi, dword [ebp + eax - 0x7fc]
mov dword [ebp + ecx*4 - 0x404], edx
mov edx, dword [ebp + eax - 0x3fc]
add esi, edx
add ecx, esi
and ecx, 0x800000ff
jns 0x4012b0
dec ecx
or ecx, 0xffffff00
inc ecx
mov esi, dword [ebp + ecx*4 - 0x404]
mov dword [ebp + eax - 0x3fc], esi
mov esi, dword [ebp + eax - 0x7f8]
mov dword [ebp + ecx*4 - 0x404], edx
mov edx, dword [ebp + eax - 0x3f8]
add esi, edx
add esi, ecx
and esi, 0x800000ff
jns 0x4012e7
dec esi
or esi, 0xffffff00
inc esi
mov ecx, dword [ebp + esi*4 - 0x404]
mov dword [ebp + eax - 0x3f8], ecx
add eax, 0x10
mov dword [ebp + esi*4 - 0x404], edx
cmp eax, 0x400
jl 0x401220
mov ebx, dword [ebp - 0x810]
push ebx
call fcn.004204b0
inc eax
push eax
call fcn.0042976c
push ebx
mov dword [ebp - 0x80c], eax
xor esi, esi
mov dword [ebp - 0x808], edi
call fcn.004204b0
add esp, 0xc
test eax, eax
mov eax, dword [ebp - 0x80c]
jle 0x401405
sub eax, ebx
mov dword [ebp - 0x814], eax
lea ebx, [ebx]
inc esi
and esi, 0x800000ff
jns 0x401361
dec esi
or esi, 0xffffff00
inc esi
mov eax, dword [ebp + esi*4 - 0x404]
add edi, eax
and edi, 0x800000ff
jns 0x40137a
dec edi
or edi, 0xffffff00
inc edi
mov ecx, dword [ebp + edi*4 - 0x404]
mov dword [ebp + esi*4 - 0x404], ecx
mov dword [ebp + edi*4 - 0x404], eax
add eax, dword [ebp + esi*4 - 0x404]
and eax, 0x800000ff
jns 0x4013a4
dec eax
or eax, 0xffffff00
inc eax
mov cl, byte [ebx]
movzx edx, cl
cmp dword [ebp + eax*4 - 0x404], edx
lea eax, [ebp + eax*4 - 0x404]
jne 0x4013c4
mov eax, dword [ebp - 0x814]
mov byte [eax + ebx], cl
jmp 0x4013d1
mov dl, byte [eax]
mov eax, dword [ebp - 0x814]
xor dl, cl
mov byte [eax + ebx], dl
mov ecx, dword [ebp - 0x810]
inc dword [ebp - 0x808]
push ecx
inc ebx
call fcn.004204b0
add esp, 4
cmp dword [ebp - 0x808], eax
jl 0x401350
mov eax, dword [ebp - 0x80c]
mov edx, dword [ebp - 0x808]
mov byte [eax + edx], 0
jmp 0x40140a
mov edx, esi
mov byte [eax + edx], dl
mov ecx, dword [ebp - 0x818]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a36a
mov esp, ebp
pop ebp
ret
Function at 0x401430
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4e28
call fcn.0042bc40
mov eax, dword [0x451f00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x4e1f
lea eax, [ebp - 0x4e23]
push 0
push eax
mov byte [ebp - 0x4e24], 0
call fcn.0042a2f0
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x4e28]
push ecx
push 0
push 1
push esi
mov dword [ebp - 0x4e28], 0
call fcn.004204b0
mov edi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
add esp, 4
push eax
push esi
call edi
push 0
push 0
lea edx, [ebp - 0x4e28]
push edx
lea eax, [ebp - 0x4e24]
push eax
push 1
push esi
call fcn.004204b0
add esp, 4
push eax
push esi
call edi
pop edi
test eax, eax
pop esi
lea eax, [ebp - 0x4e24]
jne 0x4014c7
mov eax, 0x440220
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a36a
mov esp, ebp
pop ebp
ret

Function at 0x403b80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
push 0x40
push 0
push esi
call dword [ebp + 8]
add esp, 0x10
test eax, eax
jne 0x403b9f
mov eax, 1
pop ebx
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x403c4b
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x403c4b
push edi
push ebx
push 0xf8
push eax
lea edi, [esi + 0x40]
push edi
call dword [ebp + 8]
add esp, 0x10
test eax, eax
jne 0x403bd7
pop edi
mov eax, 1
pop ebx
pop ebp
ret
cmp dword [edi], 0x4550
jne 0x403c42
mov ecx, 0x10b
cmp word [esi + 0x58], cx
jne 0x403c42
movzx eax, word [esi + 0x46]
test ax, ax
je 0x403c42
lea edi, [eax + eax*4]
add edi, edi
add edi, edi
add edi, edi
push edi
mov dword [esi + 0x140], edi
call fcn.0042bdf8
add esp, 4
mov dword [esi + 0x138], eax
test eax, eax
jne 0x403c1e
pop edi
mov eax, 3
pop ebx
pop ebp
ret
movzx edx, word [esi + 0x54]
mov ecx, dword [esi + 0x3c]
push ebx
lea ecx, [edx + ecx + 0x18]
push edi
push ecx
push eax
mov dword [esi + 0x13c], ecx
call dword [ebp + 8]
add esp, 0x10
neg eax
sbb eax, eax
pop edi
inc eax
pop ebx
pop ebp
ret
pop edi
mov eax, 2
pop ebx
pop ebp
ret
mov eax, 2
pop ebx
pop ebp
ret
Function at 0x405c40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x405c4e
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
not eax
cmp edx, 8
jb 0x405d2d
mov esi, edx
shr esi, 3
push edi
jmp 0x405c70
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x445050]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x445050]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x445050]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x445050]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x445050]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x445050]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x445050]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x445050]
add ecx, 8
sub edx, 8
dec esi
jne 0x405c70
pop edi
test edx, edx
je 0x405d4a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x445050]
inc ecx
dec edx
jne 0x405d31
not eax
pop esi
pop ebp
ret

Function at 0x405d50
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movsx ecx, byte [ebp + 0xc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x445050]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x445050]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x405da0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov eax, ecx
and eax, 0xfffd
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
mov al, byte [ebp + 0xc]
shr edx, 8
xor al, dl
mov edx, dword [esi]
push edi
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x445050]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x445050]
pop edi
mov dword [esi + 8], ecx
pop esi
pop ebx
pop ebp
ret