joyce8/EMBER2024-capa huggingface dataset:
Function at 0x951423
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0
xchg bl, dh
rdtsc
mov bp, cx
jmp 0x95145c
mov ebx, dword [esp + 2]
setne dh
mov bh, byte [esp]
sub esp, 0xd
mov bl, cl
jmp 0x9514aa
mov dword [esp], ecx
bsr eax, eax
cld
xchg bx, ax
setno bl
mov cl, ch
jmp 0x95142f
mov ax, bp
pop word [esp + 0x27]
shr al, 1
neg edi
mov dword [esp + 0xc], edx
jmp 0x9514be
bsr edi, ecx
pushal
mov byte [esp + 0x1c], dh
push dword [esp + 7]
xchg dh, bl
mov dword [esp + 0xf], eax
jmp 0x951492
lea eax, [ecx*4]
lea ebx, [ecx + ebp]
cld
setnp bh
bswap ecx
rol si, 3
jmp 0x9514f2
pop si
xchg byte [esp + 0x2c], ch
popal
mov word [esp + 8], bp
cmc
not ch
jmp 0x951595
lea esp, [esp + 2]
lea esp, [esp + 0x28]
popal
push dx
add esp, 1
jmp 0x951569
mov di, 0xfb69
mov esi, dword [esp + 0x12]
pushfd
rdtsc
mov dword [esp + 0x13], esp
bsf bp, cx
jmp 0x951528
sub esp, 0x19
call 0x951553
popfd
push 0xc0712fe8
jmp 0x95157d
add dword [esp], reloc.Util.dll__SetGBKtoFZRelease__YAXXZ
call fcn.009515e3
outsb dx, byte gs:[si]
jb 0x9515f0
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx + 0x59062474], cl
mov dword [esp + 6], esi
pop ecx
mov bl, byte [esp + 0xb]
cld
sub esp, 0x16
bsf bp, cx
jmp 0x95153e
push word [esp]
pushfd
push dword [esp + 3]
pop word [esp + 5]
jmp 0x95160e
xor al, 0x24
pop word [esp]
jmp 0x9515cd

Function at 0x9595f9
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
call fcn.009590af
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x9590aa
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x959545
push word [esp + 3]
mov word [esp + 2], bx
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x959596
Function at 0x67a3bb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
jp 0x67a40a
jnp 0x67a40a
or ch, byte [eax + 0x2fa8593e]
inc ebp
lds edx, [ebp + 0x3c]
iretd
call fcn.0067a3f4

Function at 0x67a3f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0666278
jmp 0x67a46d
lea esp, [esp + 3]
jmp 0x67a425
pushfd
jmp 0x678dd1
mov dword [esp + 0x94], edi
lea esp, [esp + 0x94]
jmp 0x67a40f
btr bx, dx
lea ecx, [edi*4]
jmp 0x67a477
mov bl, dl
bsf bp, bx
jle 0x67a456
jg 0x67a495
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp]
mov bx, word [esp]
cpuid
jmp 0x67a4a2
btr bx, dx
lea ecx, [edi*4]
jmp 0x67a477
lea ebp, [esp]
bswap ebx
mov edx, 0xb6a801bf
lea ebx, [eax + esi]
setne bh
jmp 0x67a8d1
mov edi, esp
mov ah, 0x49
xchg cl, al
mov cl, 0xc4
mov eax, 0x986c24c6
jmp fcn.0067a90b
sub esp, 0xc0
jmp 0x67a8bb

Function at 0x67aa62
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], bh
xchg byte [esp + 2], dl
call fcn.0067aa22

Function at 0x67aee2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
bts eax, esi
pop ax
lea esp, [esp + 2]
xchg dword [esp + 0x30], ebx
jmp 0x67afa2
setns ah
sub esp, 0x15
not al
lea esp, [esp + 1]
lea ebx, reloc.WINMM.dll_midiStreamStop
lea eax, reloc.WINMM.dll_midiStreamStop
jmp 0x67aeaa
bt eax, ebx
rcl ax, cl
inc ax
xchg dword [esp], ebx
mov al, 0x8d
jmp 0x67aec0
seto ah
shr ax, cl
call fcn.0067af67
inc ax
rdtsc
neg eax
cmc
btc eax, ebx
mov eax, dword [esp]
jmp 0x67afd4
lea esp, [esp + 4]
sub bl, 0xd6
not ax
mov ax, bp
mov ax, word [esp]
jmp 0x67aff4
not ah
mov ah, 0x71
ror bl, 0
jg 0x67b02c
jle 0x67b016
xchg edi, eax
pop ds
invalid
mov al, bh
lea edx, [eax + ecx]
mov eax, dword [esp]
jmp 0x67b040
mov al, bh
lea edx, [eax + ecx]
mov eax, dword [esp]
lea eax, reloc.WINMM.dll_midiStreamStop
jmp 0x67b084
lea eax, reloc.WINMM.dll_midiStreamStop
mov eax, ebp
jmp 0x67b086
mov eax, ebp
mov edx, dword [esp]
neg bl
call fcn.0067b06e
mov word [esp], bp
mov word [esp], bx
jmp 0x67b0f8
jmp 0x67b106
mov ax, word [esp + 4]
lea esp, [esp + 3]
jmp 0x67b113
lea esp, [esp + 2]
ror bl, 0
rdtsc
sub esp, 0x1f
js 0x67b0c3
mov dx, 0x1efe
jmp 0x67b0c5
lea eax, [esp + edi]
rcl eax, cl
lea edx, [eax*4]
jmp 0x67b0dd
mov dx, 0x1efe
mov ax, word [esp + 4]
lea esp, [esp + 3]
mov eax, ebx
lea edx, [ebp + 0x98]
call fcn.0067b6a4
invalid
Function at 0x6843e9
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x669e36
pushfd
or dword [esp], reloc.WINMM.dll_midiStreamStop
popfd
cpuid
nop
jmp 0x669e4d
pop ebx
ret
jmp 0x669e2a

Function at 0x754057
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, 0xcd02ffff
add cl, ch
lea ebp, [esi + esi]
std
call 0x754057
ja 0x753fe8
add ax, si
adc byte [ebx - 0x13], ch
jge 0x754004
neg dword [ebx]
jl 0x754053
lea ebp, reloc.WINMM.dll_midiStreamStop
neg bp
or bp, cx
lea ecx, [ebp*4]
lea ecx, [ebx + esi]
bt edi, ecx
jmp 0x753feb
mov cl, ch
xchg ecx, eax
rdtsc
mov ax, word [esp]
mov cl, 0x49
rdtsc
jmp 0x754004
xchg word [esp], bp
lea edx, [ecx*4]
mov byte [esp], al
jmp 0x754083
ja 0x7540b3
test eax, 0x66ce0fc8
pop ebp
mov di, word [esp]
jmp 0x754041
sbb ch, 0x99
mov ch, byte [esp]
bsr dx, di
xchg esi, edx
cld
mov dh, byte [esp]
jmp 0x754032
mov bx, word [esp + 1]
inc edi
xchg byte [esp], cl
std
adc edi, 0x1a3fad30
mov eax, 0xd560a61b
jmp 0x7540cf
bsr cx, di
mov ebx, 0x5bb0d02a
sub ah, 0x68
neg cl
bsr edx, esp
ror dh, 7
aam 0xc0
into
pop es
jmp 0x754071
inc edx
inc ebx
shr edx, 0x1e
mov bx, 0x7949
setp ch
jmp 0x754144
pop dx
std
lea edx, [edx*4]
bts eax, ecx
neg dx
shl edx, cl
jmp 0x7540b9
mov bx, word [esp]
setae al
not al
xchg ebx, ecx
xchg bl, al
xchg ch, dl
jmp 0x75412d
mov si, 0xf473
bswap edi
adc dx, bp
cmp ch, 0x87
not edi
mov edi, 0xa3122990
jmp 0x7540e3
sub esp, 0x16
pop esi
btr bp, dx
shl cx, 9
dec cl
adc ebp, esp
jmp 0x75415f
bswap edi
rcr edx, 0
cmc
sub esp, 0xd
pop dword [esp + 4]
xchg dword [esp + 1], edi
jmp 0x754117
mov ax, 0x6b77
lea ebx, [edx*4]
bsf ax, di
lea edi, [ebx + edi]
mov dl, byte [esp]
mov di, word [esp]
jmp 0x754102
mov ax, bx
rdtsc
cmc
xchg edi, esi
pop dword [esp]
btr esi, ecx
jmp 0x7541e9
neg edx
clc
xchg esi, eax
xor dh, ch
setl ah
bsf cx, si
jmp 0x7540a3
pop si
rdtsc
bts eax, ebp
mov byte [esp], ch
push esi
lea esp, [esp + 4]
jmp 0x7541d1
not ebx
lea ebx, [ebp + 0x80]
mov si, 0xbba1
push bp
xchg dx, cx
mov byte [esp + 1], bl
jmp 0x75418e
lea ecx, [edx + esi]
add dx, 0x8879
call fcn.00754275
mov al, 0x20
mov dh, 0xd1
and byte [edi - 0x74c0d323], al
lds ecx, [edi]
mov dword [reloc.WINMM.dll_midiStreamStop], eax
mov bl, 0xd6
mov eax, ebp
bt esi, eax
push eax
btr si, dx
mov eax, dword [esp + 1]
mov dword [esp], esp
jmp 0x7541bb
mov si, word [esp + 2]
lea ebp, [esi + ebp]
not cx
rol ah, cl
add esp, 0x16
xchg byte [esp], dh
jmp 0x7541a4
bsr bx, si
mov edx, 0x503a340a
shl di, cl
xchg bl, dh
cmp dh, 0x7f
rdtsc
jmp 0x75417c
pushfd
clc
push di
mov byte [esp], cl
lea esp, [esp + 2]
pushal
jmp 0x7545c4
call 0x754df3
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
jmp 0x75489e
Function at 0x754275
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [esi*4]
mov byte [esp], bh
xchg si, bp
stc
jmp 0x754256
mov ch, byte [esp + 1]
cld
sete bh
push word [esp + 8]
rdtsc
add esp, 0xa
jmp 0x7541fe
setae bh
pop bp
xchg word [esp + 2], di
push sp
lea ebp, reloc.WINMM.dll_midiStreamStop
xchg word [esp + 4], bx
jmp 0x754214
xchg byte [esp], ch
cpuid
neg ecx
add esp, 0
mov ah, byte [esp]
mov ebp, ecx
jmp 0x754557
xchg byte [esp + 4], bh
setle bh
lea edi, [esi*4]
xchg dword [esp], ebx
jmp 0x75423d
btr si, cx
mov cl, ch
lea ebp, [ebx*4]
bswap eax
jmp 0x7542c9
xchg cx, ax
mov edi, eax
mov edi, dword [esp]
lea edx, [ebx + 0xdc]
mov bp, 0xe115
mov bh, dh
jmp 0x754288
mov ebp, dword [esp]
cpuid
mov bp, ax
lea esp, [esp]
call fcn.007542da
ret 0x4c7d
xchg di, ax
mov ebp, esp
rcl di, 3
mov byte [esp], dh
mov edi, edx
neg ecx
jmp 0x7542b3
mov byte [esp], cl
mov ah, 0x54
mov ah, dl
xchg ebp, ebx
not edi
lea ebp, [esi + ebp]
jmp 0x75429e
lea esi, [ebx - 0x2d]
xchg dl, bh
xchg bp, bx
xchg dx, bp
lea edx, [esi*4]
xchg di, ax
jmp 0x7542f6
clc
bswap ebp
std
rdtsc
xchg byte [esp], bl
setg ah
jmp 0x754447
Function at 0x754df3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, 0xcd02ffff
add cl, ch
lea ebp, [esi + esi]
std
call 0x754057
ja 0x753fe8
add ax, si
adc byte [ebx - 0x13], ch
jge 0x754004
neg dword [ebx]
jl 0x754053
lea ebp, reloc.WINMM.dll_midiStreamStop
neg bp
or bp, cx
lea ecx, [ebp*4]
lea ecx, [ebx + esi]
bt edi, ecx
jmp 0x753feb
mov cl, ch
xchg ecx, eax
rdtsc
mov ax, word [esp]
mov cl, 0x49
rdtsc
jmp 0x754004
xchg word [esp], bp
lea edx, [ecx*4]
mov byte [esp], al
jmp 0x754083
ja 0x7540b3
test eax, 0x66ce0fc8
pop ebp
mov di, word [esp]
jmp 0x754041
sbb ch, 0x99
mov ch, byte [esp]
bsr dx, di
xchg esi, edx
cld
mov dh, byte [esp]
jmp 0x754032
mov bx, word [esp + 1]
inc edi
xchg byte [esp], cl
std
adc edi, 0x1a3fad30
mov eax, 0xd560a61b
jmp 0x7540cf
bsr cx, di
mov ebx, 0x5bb0d02a
sub ah, 0x68
neg cl
bsr edx, esp
ror dh, 7
aam 0xc0
into
pop es
jmp 0x754071
inc edx
inc ebx
shr edx, 0x1e
mov bx, 0x7949
setp ch
jmp 0x754144
pop dx
std
lea edx, [edx*4]
bts eax, ecx
neg dx
shl edx, cl
jmp 0x7540b9
mov bx, word [esp]
setae al
not al
xchg ebx, ecx
xchg bl, al
xchg ch, dl
jmp 0x75412d
mov si, 0xf473
bswap edi
adc dx, bp
cmp ch, 0x87
not edi
mov edi, 0xa3122990
jmp 0x7540e3
sub esp, 0x16
pop esi
btr bp, dx
shl cx, 9
dec cl
adc ebp, esp
jmp 0x75415f
bswap edi
rcr edx, 0
cmc
sub esp, 0xd
pop dword [esp + 4]
xchg dword [esp + 1], edi
jmp 0x754117
mov ax, 0x6b77
lea ebx, [edx*4]
bsf ax, di
lea edi, [ebx + edi]
mov dl, byte [esp]
mov di, word [esp]
jmp 0x754102
mov ax, bx
rdtsc
cmc
xchg edi, esi
pop dword [esp]
btr esi, ecx
jmp 0x7541e9
neg edx
clc
xchg esi, eax
xor dh, ch
setl ah
bsf cx, si
jmp 0x7540a3
pop si
rdtsc
bts eax, ebp
mov byte [esp], ch
push esi
lea esp, [esp + 4]
jmp 0x7541d1
not ebx
lea ebx, [ebp + 0x80]
mov si, 0xbba1
push bp
xchg dx, cx
mov byte [esp + 1], bl
jmp 0x75418e
lea ecx, [edx + esi]
add dx, 0x8879
call fcn.00754275
mov al, 0x20
mov dh, 0xd1
and byte [edi - 0x74c0d323], al
lds ecx, [edi]
mov dword [reloc.WINMM.dll_midiStreamStop], eax
mov bl, 0xd6
mov eax, ebp
bt esi, eax
push eax
btr si, dx
mov eax, dword [esp + 1]
mov dword [esp], esp
jmp 0x7541bb
mov si, word [esp + 2]
lea ebp, [esi + ebp]
not cx
rol ah, cl
add esp, 0x16
xchg byte [esp], dh
jmp 0x7541a4
bsr bx, si
mov edx, 0x503a340a
shl di, cl
xchg bl, dh
cmp dh, 0x7f
rdtsc
jmp 0x75417c
pushfd
clc
push di
mov byte [esp], cl
lea esp, [esp + 2]
pushal
jmp 0x7545c4
call 0x754df3
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
jmp 0x75489e
Function at 0x754f32
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, word [esp + 0xf]
setae dl
pop esi
push dword [esp + 0xc]
cpuid
lea ebx, [ebx*4]
jmp 0x754e27
pop eax
cmc
lea esp, [esp + 0x18]
pop word [esp + 0xb]
cmp ch, dh
xchg cl, al
jmp 0x754df8
pop dword [esp + 1]
pop ebp
shr ebp, cl
push ebx
or bx, 0xfaf8
add ch, cl
jmp 0x754e79
lea ebp, [esi*4]
rdtsc
bsf si, sp
pop word [esp + 9]
mov cl, dl
push dword [esp + 0xc]
jmp 0x754e16
bsr eax, ebp
pop dword [esp + 1]
mov edi, ecx
xchg ecx, ebp
lea edx, [eax + esi]
jmp 0x754ed9
bts ebp, eax
pop bx
cmc
push word [esp + 7]
lea edx, reloc.WINMM.dll_midiStreamStop
mov ecx, dword [esp + 5]
jmp 0x754e63
mov dword [esp + 7], ecx
xchg si, dx
setae dh
btr di, dx
sbb edx, esi
rdtsc
jmp 0x754e49
xchg byte [esp + 8], bl
xchg di, bx
lea esi, [edx + edi]
mov al, dl
cld
rcl edx, cl
jmp 0x754f06
push word [esp + 2]
mov word [esp + 4], sp
pop dword [esp]
push edx
bswap ebp
mov ecx, 0xf2db3342
jmp 0x754eb3
mov byte [esp + 5], bh
mov byte [esp + 1], ch
cpuid
cpuid
sub esp, 0xf
jmp 0x754f71
lea edx, [edx*4]
mov bx, word [esp + 3]
push word [esp + 9]
push dword [esp + 0xc]
mov word [esp + 6], ax
mov ah, bh
jmp 0x754ef0
push ebx
mov byte [esp + 6], ch
pop word [esp + 0x1b]
jmp 0x754e9f
rcr edi, 0xb
push dword [esp + 0x1b]
bswap esi
add esp, 0x1d
or bp, sp
jmp 0x754f97
xchg edi, ebp
xchg edi, ecx
rdtsc
mov byte [esp + 0x1d], dh
mov dword [esp + 0x12], ebx
mov dx, word [esp + 3]
jmp 0x754f41
push ax
bsr dx, bp
xchg bl, al
pop di
rcr ch, cl
mov bh, cl
jmp 0x754f57
btr edx, ecx
mov ax, word [esp]
lea esp, [esp + 3]
lea esp, [esp + 4]
popal
jmp 0x754fe8
mov eax, dword [esp + 6]
pop word [esp]
push word [esp + 3]
rol si, cl
mov bp, word [esp + 6]
mov ah, 0xd2
jmp 0x754f81
pushal
pushal
call fcn.00754fd2
push word [esp + 1]
mov dword [esp], ecx
call fcn.0075509a
xor al, 0xbe
sub al, 0x4b
invalid
Function at 0x10164190
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x101641c1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x101641c1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x101641c1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x44b380
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3a000]
push edi
or ebp, 0xffffffff
jmp 0x44b3a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44b3a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44b398
mov eax, 1
add ebx, ebx
jne 0x44b3bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44b3b0
jne 0x44b3cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44b3b0
xor ecx, ecx
sub eax, 3
jb 0x44b3e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44b452
mov ebp, eax
add ebx, ebx
jne 0x44b3eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x44b3f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x44b41c
inc ecx
add ebx, ebx
jne 0x44b408
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44b3fd
jne 0x44b419
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44b3fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44b43c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44b42d
jmp 0x44b39e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44b43c
add edi, ecx
jmp 0x44b39e
pop esi
mov edi, esi
mov ecx, 0xa85
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44b45a
cmp byte [edi], 6
jne 0x44b45a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44b45f
lea edi, [esi + 0x49000]
mov eax, dword [edi]
or eax, eax
je 0x44b4d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x741b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7422c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44b48c
mov ecx, edi
jns 0x44b4bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x74230]
or eax, eax
je 0x44b4d1
mov dword [ebx], eax
add ebx, 4
jmp 0x44b4a9
call dword [esi + 0x74240]
mov ebp, dword [esi + 0x74234]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44b50b
sub esp, 0xffffff80
jmp 0x4167d2
Function at 0x40e0c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x61a480], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x61a47c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x61a480], edx
cmp eax, 0x26f
jl 0x40e0c8
mov dword [0x5a4780], 0x270
ret

Function at 0x40e100
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x61a484]
mov ebx, dword [eax*4 + 0x61a480]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x61aab4]
mov dword [eax*4 + 0x61a480], edx
cmp eax, 0xe2
jl 0x40e108
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x61a484]
mov ebx, dword [eax*4 + 0x61a480]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x61a0f4]
mov dword [eax*4 + 0x61a480], edx
cmp eax, 0x26e
jl 0x40e158
mov edx, dword [0x61a480]
mov ecx, dword [0x61ae3c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x61aab0]
mov dword [0x61ae3c], eax
mov dword [0x5a4780], 0
pop ebx
ret

Function at 0x40e1e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x5a4780]
add dword [0x5a4780], 1
mov eax, dword [0x619030]
cmp eax, dword [0x5a3ed0]
jne 0x40e203
cmp ebx, 0x271
jb 0x40e224
mov eax, dword [0x619030]
call fcn.0040e0c0
not dword [0x619030]
mov eax, dword [0x619030]
mov dword [0x5a3ed0], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40e240
call fcn.0040e100
xor ebx, ebx
mov dword [0x5a4780], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x61a480]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x40fd10
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x5a3c20]
cmp ax, 0xcb
je 0x40fe1c
cmp ax, 0xcc
je 0x40fe1c
lea esi, [esi]
mov edx, dword [0x61b080]
test edx, edx
je 0x40fd45
mov eax, dword [0x61af30]
call edx
mov ebx, eax
jmp 0x40fd4a
mov ebx, 0x61af34
cmp word [0x61af20], 0
jle 0x40fd70
mov eax, 0x61af00
call fcn.0040ff80
mov eax, ebx
call fcn.0040f8d0
mov eax, ebx
call fcn.0040f940
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x40fd92
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40fd8d
mov edx, edi
mov eax, ebx
call fcn.0040ed40
jmp 0x40fd90
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40fd78
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x61af20], 0
jle 0x40fe1c
mov edx, 0x61ae40
mov eax, ebx
call fcn.0040ee80
mov edi, eax
test edi, edi
je 0x40fdec
mov eax, dword [0x61aed4]
mov dword [edi + 0xc], eax
cmp dword [0x61aed4], 0
je 0x40fde0
mov eax, dword [0x61aed4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x61aed4], eax
nop
sub word [0x61af20], 1
cmp word [0x61af20], 0
sete bl
mov eax, 0x61af00
call fcn.0040ffa0
test bl, bl
je 0x40fe1c
mov eax, 0x61af00
call fcn.0040ff70
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x411c80
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov esi, eax
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00411c70
push ebp
push 0x413330
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
push 0
mov eax, esi
test esi, esi
jne 0x411cb9
mov eax, 0x61a300
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
lea edx, [ebx - 1]
lea eax, [ebp - 0xc]
call fcn.0040a8d0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x411cdc
mov eax, 0x61a300
push eax
push ebx
mov eax, esi
test esi, esi
jne 0x411ce9
mov eax, 0x61a300
push eax
call sub.kernel32.dll_GetFullPathNameW
mov edx, eax
test edx, edx
je 0x411dae
jmp 0x411d03
sub edx, 1
cmp edx, 3
jbe 0x411d14
mov eax, dword [ebp - 0xc]
cmp word [eax + edx*2 - 2], 0x5c
je 0x411d00
mov eax, ebx
mov edi, 0
sub eax, 1
sbb edi, 0
mov ecx, edx
xor ebx, ebx
cmp edi, ebx
jne 0x411d2d
cmp eax, ecx
je 0x411d38
lea eax, [ebp - 0xc]
call fcn.0040a8d0
lea esi, [esi]
mov eax, 0x4011d0
mov edx, dword [ebp - 0xc]
call fcn.00411bf0
mov edx, dword [0x61b080]
test edx, edx
je 0x411d58
mov eax, dword [0x61a170]
call edx
jmp 0x411d5d
mov eax, 0x61a174
cmp word [eax], 0
jne 0x411dba
mov eax, esi
test esi, esi
je 0x411d6d
mov eax, dword [eax - 4]
cmp eax, 2
jle 0x411dba
cmp word [esi + 2], 0x3a
jne 0x411dba
mov word [ebp - 8], 0x3d
mov ax, word [esi]
mov word [ebp - 6], ax
mov word [ebp - 4], 0x3a
mov word [ebp - 2], 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x411d9f
mov eax, 0x61a300
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_SetEnvironmentVariableW
lea esi, [esi]
jmp 0x411dba
mov eax, 0x4011d0
mov edx, esi
call fcn.00411bf0
mov edx, dword [0x61b080]
test edx, edx
je 0x411dcd
mov eax, dword [0x61a170]
call edx
jmp 0x411dd2
mov eax, 0x61a174
cmp word [eax], 2
jne 0x411df8
mov edx, dword [0x61b080]
test edx, edx
je 0x411dec
mov eax, dword [0x61a170]
call edx
jmp 0x411df1
mov eax, 0x61a174
mov word [eax], 3
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00411c70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411e30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00411e10
push ebp
push 0x413330
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x411f5a
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040a8d0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x411ebf
mov edx, 0x61a300
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x411f11
call sub.kernel32.dll_GetLastError
call fcn.004033b0
lea eax, [ebp - 0x10]
call fcn.00409690
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.00409b30
mov edx, dword [ebp - 0x14]
mov ecx, 0x5c7320
lea eax, [ebp - 0x10]
call fcn.004099c0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040a270
jmp 0x411fa8
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x411f2a
cmp eax, ecx
je 0x411f34
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040a8d0
cmp byte [0x5a3e90], 0
jne 0x411fa8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040ae20
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040a300
lea esi, [esi]
jmp 0x411fa8
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040a8d0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x411f7e
mov eax, 0x61a300
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x5a3e90], 0
jne 0x411fa8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040ae20
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040a300
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00411e10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret