joyce8/EMBER2024-capa huggingface dataset:
Function at 0x251788f
Capabilities:
Encrypt data using speck

Disassembly:
xor ecx, ebx
inc ecx
lea eax, [eax*8 + 0x4c36f002]
and al, dl
xor ecx, 0xb33d9a16
neg ecx
rol eax, 0xe
bswap ecx
lea ecx, [ecx + edx - 0x6f541963]
ror eax, 0x7f
push eax
jae 0x24b3e65
bswap eax
ror eax, 1
or edx, edx
sbb cl, byte [esp + edx*2 - 0x1726d]
lea eax, [eax + ecx*2 - 0xaa0472a]
neg byte [esp + edx - 0xb930]
adc byte [esp + edx*4 - 0x2e4ec], dl
ror eax, 2
mov dword [esp + edx*2 - 0x17278], ecx
xor eax, 0x9c3bb5b8
add dword [esp + edx - 0xb932], ecx
not cl
xor ebx, eax
inc dl
add edi, eax
mov dword [esp + ecx - 0x622eefa4], 0xca90f79b
neg dword [esp + edx*2 - 0x17272]
push edx
pop edx
pop edx
pop eax
pop edx
pop eax
jns fcn.015b753e
xor ecx, 0x75162d3d
push eax
lea edx, [edx + 0x72393c26]
call fcn.01507766
add ecx, dword [esp + edx*8 - 0x5c9e4]
xor eax, ebx
rol cl, 0xe3
jb 0x2479c3c
mov edx, ecx
shl ecx, 0x3c
lea ebp, [ebp + ecx*2 - 4]
setbe dl
setp dl
xadd edx, eax
adc ecx, dword [ebp + ecx*2]
bswap eax
jmp 0x16e9e30

Function at 0x251af5e
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xcba961b0
sub esi, 0xc
mov dword [esi + 0xc], eax
push 0xbd0780b8
mov dword [esi + 8], ebx
mov eax, 0xf61c510b
mov dword [esi + 4], ecx
ror al, 0xc5
sub byte [esp + 1], ah
xchg byte [esp + 4], al
mov dword [esi], edx
movsx ebx, byte [esp]
add ebx, 0x8815e98d
call fcn.0258eca4
jmp 0x15892f7

Function at 0x2523b5c
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec edx
ror edx, 1
bswap edx
sal eax, cl
xor edx, 0x32cfc15
inc cl
sub cx, 0x2636
xor ebx, edx
dec eax
add edi, edx
movzx dx, byte [eax + ebp - 0x7fffffff]
ror ax, cl
inc eax
mov cl, byte [ebp + eax - 0x7ffffffe]
setge al
ror eax, 0x73
lea ebp, [ebp + eax*2 - 0x5ffe]
call fcn.014ec15f
mov ecx, 0xdf39e1ae
rol cx, cl
mov eax, dword [edi]
ror cx, cl
call fcn.025c7328
xor ecx, ebx
not ecx
mov dword [esp + eax - 0x6a7e5b81], eax
sub ecx, 0x3728931e
sal eax, 0xa7
not ecx
dec ecx
add edx, edx
shr dl, 0xe3
xor ebx, ecx
xadd word [esp + edx - 0x7240c207], ax
sbb edx, 0x7f37e8a5
jle 0x252dc06
mov edx, 0xe52bbd23
lea ecx, [edx + edx*2 - 0x1a6dbbfd]
sub esi, 4
mov edx, dword [esi]
lea eax, [ecx + ecx*2 + 0x70894a37]
neg ax
xor edx, ebx
and ax, cx
xor ax, 0x5106
not edx
or ecx, 0xb79e293e
jp 0x161df5f

Function at 0x252531e
Capabilities:
Encrypt data using speck

Disassembly:
adc esi, eax
add dword [esp + edx*8 - 0x385e0], esi
ret 4
xor ebx, eax
shr dx, cl
and edx, 0xa235f6bc
ja 0x1501b54
xor eax, 0x14306e14
rol eax, cl
and dl, cl
sub dx, cx
jbe 0x169c0ce
xor ebx, edx
mov dword [esp + 4], 0x1f8d4b01
add esi, edx
or dword [esp + 4], 0xa48fe931
adc cx, word [esp + 6]
pop edx
add edx, 0xf74d57
jmp edx
xor eax, 0xed121f0c
mov edx, 0x871c282b
sub edx, edx
mov dword [esp + edx*8], 0x5034a12d
not eax
push edx
ror eax, 2
jmp 0x169d783
Function at 0x2525710
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe99b01b0
mov eax, dword [ebp]
push 0xd337b04
lea esp, [esp + 4]
call eax
push 0x635ee04
call fcn.0255c023
shr byte [esp + eax - 0x390cdcbe], 0xa6
adc word [esp + eax - 0x390cdcbf], cx
bswap edx
lea eax, [ecx + ecx*4 - 0x7b61e6c7]
lea edx, [edx + ecx*4 - 0x748f99bd]
push ecx
jp 0x2529206
rol edx, 1
xor ebx, edx
mov eax, 0x5b35efa0
add edi, edx
lea edx, [eax + eax*8 - 0x66555e52]
or dx, dx
jmp edi
jne 0x23cbea8
mov ebp, edi
shl byte [esp + edx - 0x400003fa], 0x81
sal byte [esp + edx - 0x400003fc], 0x46
mov ebx, eax
mov eax, edx
ror dx, 0x41
mov edx, ebx
adc dword [esp + eax - 0x400003fc], 0xc1a32906
not dword [esp + eax - 0x400003fc]
shl edx, 2
shr eax, 0xda
lea eax, [eax + eax*2 - 0x58633173]
adc eax, eax
mov eax, ebp
add eax, edx
mov dword [ebp - 4], eax
mov dword [esp], 0x47275530
test ebx, ebx
lea esp, [esp + 8]
je 0x1680376
mov eax, 0xda2a6718
call fcn.023e3e68
mov ecx, 0x31a93205
rol ecx, cl
mov cl, byte [esi + ecx*2 - 0x6a4c814a]
mov eax, 0x390cdcbf
lea esi, [esi + eax - 0x390cdcbd]
or al, al
shl dx, cl
push eax
and eax, dword [esp + eax*2 - 0x7219b97e]
lea ecx, [eax*2 - 0x4b5567c3]
mov word [esi + eax - 0x390cdcbf], dx
movzx edx, cx
lea ebp, [ebp + ecx*2 - 0x4d88a37a]
mov edx, dword [ebp + eax*2 - 0x7219b97e]
sal dword [esp + eax*2 - 0x7219b97e], cl
xor edx, ebx
jmp 0x16d5240
sub ecx, 0xce870f90
xor edx, 0x3f3c1f04
add cx, cx
dec edx
not eax
xor ebx, edx
add edi, edx
mov dword [esp + ecx - 0x583d8456], edi
ret 4
Function at 0x25277a6
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
adc ebp, 4
dec edx
rol cx, 0x84
jnp 0x24679d5
xor eax, ebx
shl dword [esp], 0x4c
inc eax
bswap eax
xchg word [esp + 2], dx
neg word [esp + 1]
add cx, 0xd312
neg eax
shr dword [esp], cl
and word [esp], 0xfb8b
sbb eax, 0xfe34332f
xor ebx, eax
lea edx, [ecx + ecx + 0x55abeb87]
push edx
sal dx, 0xa1
add esi, eax
or dword [esp], edx
pop eax
pop eax
js fcn.01615121
neg dx
not al
shl edx, cl
xor al, 0x81
add al, 0x24
not cl
mov dword [esp + ecx - 0x3e3ec4fe], 0x498b3101
xor bl, al
lea edi, [edi + ecx*2 - 0x7c7d89fe]
neg byte [esp + ecx*2 - 0x7c7d89f9]
mov word [ecx + edi - 0x3e3ec4fe], ax
mov eax, dword [ecx + ebp - 0x3e3ec4fe]
sal word [esp + ecx - 0x3e3ec4fd], 0xcc
xor ecx, 0xa5aa740a
jno 0x1639ac4

Function at 0x25369b2
Capabilities:
Encode data using xor

Disassembly:
xor ebx, eax
lea ecx, [ecx*4 - 0x68ee04d6]
add esi, eax
push ecx
lea ecx, [ecx*2 + 0x5b8ff91a]
mov eax, dword [edi + ecx*2 - 0xfa1f8cc]
mov ecx, dword [edi + ecx - 0x7d0fc62]
add edi, 4
xor edx, edx
sal word [esp + 1], 0x44
test ecx, ecx
lea esp, [esp + 0x10]
je 0x1637b1a
jmp 0x1637acd

Function at 0x2537f0d
Capabilities:
Execute syscall

Disassembly:
mov dword [edi], ecx
sete al
pop ecx
pop edx
jmp esi
mov dword [esp], eax
shl byte [esp + 0xa], 0xa4
or ecx, edx
and word [esp + 4], ax
pop eax
jo 0x1614b78
not ecx
jle 0x253125f
mov dword ss:[edx + ecx*2 - 0x723b2548], eax
movsx edx, cx
ror dl, 0x21
push ecx
lea esi, [esi + ecx*2 - 0x723b254c]
adc dl, 0x8b
rol byte [esp + ecx - 0x391d92a2], 0xa3
shr dword [esp + ecx*2 - 0x723b2548], cl
mov edx, dword [esi + ecx*2 - 0x723b2548]
xor edx, ebx
dec edx
sal dword [esp + ecx*2 - 0x723b2548], cl
bswap edx
add dword [esp + ecx - 0x391d92a4], ecx
neg edx
bswap edx
movzx eax, cx
shl cx, cl
dec eax
xor ebx, edx
xchg dword [esp + eax - 0x92a3], ecx
neg byte [esp + eax - 0x92a2]
add edi, edx
mov dword [esp + eax - 0x92a3], edi
ret

Function at 0x253b874
Capabilities:
Execute anti-debugging instructions

Disassembly:
xadd eax, ecx
xor edx, ebx
inc ecx
call fcn.0246d996
rol al, 1
sub al, 0x17
pop edx
xor bl, al
xadd byte [esp + 2], ch
lea eax, [esp + eax + 0x14]
xchg word [esp + 1], cx
mov edx, dword [esp + 8]
mov ecx, dword [eax]
shl edx, 0x8d
lea eax, [edx + edx - 0x73678fe7]
lea edi, [eax + edi - 0x4ac0701d]
neg dword [esp + eax - 0x4ac0700a]
add dword [esp + eax - 0x4ac0700e], eax
xor eax, edx
mov dword [edi], ecx
sal eax, 0xe8
add eax, dword [esp + 0x10]
sar ax, 0xb
pop ecx
pop eax
pop eax
pop eax
pop eax
jp fcn.016762b7
mov edx, 0xa22d9f2e
mov eax, edx
mov edx, dword [ebp]
add ebp, 4
movsx ecx, ax
jmp 0x251cea8

Function at 0x2543e02
Capabilities:
Encrypt data using speck

Disassembly:
not cl
or al, cl
sub edx, 0x7b09624
mov word [edi + edx - 0x7856919c], ax
pop edx
mov edx, dword [esp]
mov eax, dword [ebp]
adc ebp, 4
jmp 0x2408f20
Function at 0x254d112
Capabilities:
Encode data using xor

Disassembly:
cmp dl, byte [eax - 0x1f]
jge 0x254d0e7
clc
dec esp
sbb ebp, edi
push ds
xchg esp, eax
cmp ebp, 0xc18159f3
pop ecx
add ecx, 0xeca9f1
jmp ecx
mov eax, 0xb6b0f496
sub eax, 0x48cf91f
mov dword [edi], edx
call fcn.024db63a
loope 0x254d16b
mov dh, 0xd7
or dword [esi + 0x296c1b43], 0xffffffa9
push eax
dec esi
leave
jo 0x254d0bd
push ebp
add eax, 0xc4cfedd3
sbb al, 0x8a
mov dword [0x39536411], eax
stc
imul ecx, dword [esi], 0x1b
push es
popal
int 0x42
cli
lea esi, [esi]
call 0x80878e8b
cmp byte [ebp + 0x30], ah
adc edx, dword [ebx]
adc byte [ebx + ebp*2 + 0x43], al
fsubr qword [edi]
jns 0x254d140
xchg dword [bp + si], ebx
cld
rcl byte [ebx - 0x4e74e943], 0x6c
fnstsw word [esi]
ljmp 0xc77b
fisubr word [ecx + ebp*8]
sar dword [ebx - 0x39], cl
jne 0x254d131
invalid

Function at 0x2550c17
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + ecx*2 - 0x5f5d933a]
xor edx, ebx
lea eax, [ecx*4 + 0x4c23b9a1]
shr eax, 0x59
not edx
mov dword [esp + eax - 5], ecx
lea edx, [edx + ecx*2 + 0x38c52042]
neg byte [esp + eax*2 - 0xa]
sbb cx, ax
xor edx, 0xfc9a99b4
bswap edx
xchg byte [esp + ecx*2 - 0x5f5d9332], ah
shr dword [esp + ecx - 0x2faec999], 0x2b
xor ebx, edx
not cx
rol eax, cl
adc esi, edx
inc cx
lea eax, [eax + eax + 0x78006d84]
mov ebp, dword [ebp + eax - 0x7830f004]
pop edx
jnp fcn.02513ddd
mov ah, 0x9b
mov bh, 0xd7
out 0x53, eax
sahf
sbb ch, byte [esp + esi*8 + 0x74]
push ecx
dec esi
add al, 0x55
aas
mov byte [ebx + edx*8], al
fnstcw word [edx]
sbb dword [0xb9b4b68a], ebx
push edx
cmp esp, edi
cld
mov esi, 0xb4061ad3
adc byte [ebx - 6], al
fldenv [ebx]
xor eax, 0x6317bd3a
in eax, 0x64
xor bh, cl
outsb dx, byte [esi]
lodsd eax, dword [esi]
cdq
push 0x43
popal
bnd js 0x2550c93
retf 0x47d2

Function at 0x2561b1c
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x4bb40000], 0x80387294
lea eax, [eax + 0x26be00b7]
neg dl
ror ecx, 0x81
ror dl, 1
xadd dword [esp + eax - 0x727200b7], eax
shl eax, 0x7d
xor bl, dl
pop eax
add edx, esp
sar cx, 0x87
xor ax, 0x693f
mov ax, word [edx + ecx - 0x25da0000]
mov edx, 0xb2a629b1
lea ebp, [ebp + ecx*2 - 0x4bb40002]
sub edx, 0xf61e8e28
add cl, dl
sal dx, 0x28
mov word [ebp + ecx*2 - 0x4bb40112], ax
jne fcn.01577f93
and eax, 0xf0d5b7f6
arpl word [ebx + 0x4e], dx
mov al, byte [0x69f23b1]
rcl ebp, cl
pop esi
push cs
pop ds
mov al, byte [edx - 0x58]
scasb al, byte es:[edi]
push eax
cmp dword [ecx + 0x618c432], eax
cmp byte [edi], al
xor dword [edx], 0x380618c4
pop es
inc ecx
cli
push ebp
scasd eax, dword es:[edi]
and bh, byte [eax]
mov ebp, 0x66f2df3b
xor byte [ebx + 0x688e293a], al
inc ebx
in eax, 0xe5
jp 0x2561b92
pop edi
out dx, al
fsubr qword [ecx - 0x5c]
int1
xor ebx, ebx
add bl, ah
push esp
inc esp
cli
outsd dx, dword [esi]
sub byte [ecx + ebx*4 - 0x19], ah
out dx, eax
invalid
Function at 0x256e895
Capabilities:
Authenticate hmac

Disassembly:
adc eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 4]
je 0x259f48a
mov dword [esp], esi
push ebx
sar edx, 0x9f
adc edx, 0x7e3d4e30
jl 0x251008f
mov ebp, edi
mov ebx, eax
mov edx, ebx
mov eax, 0xacb2730f
shl edx, 2
sub eax, eax
inc ax
rol ax, 0x25
mov eax, ebp
push 0x6e307ba8
ja 0x23dee92

Function at 0x2571c6a
Capabilities:
Execute syscall

Disassembly:
push edi
lea esp, [esp + 0xc]
je 0x25bf665
jmp 0x161d57d

Function at 0x259a42c
Capabilities:
Encode data using xor

Disassembly:
xor ecx, esi
call fcn.024be882
insb byte es:[edi], dx
dec ecx
mov eax, 0x5cdcb9d5
dec esi
fcom dword [eax - 0x2cf6df0e]
aad 0x57
mov cl, 0x10
mov ch, byte [ebx + 0x395f11d1]
call 0x8711fa3
pop ecx
mov eax, 0x2ef5fa4e
popfd
aaa
mov ebp, 0x694d466a
xor byte [ebx], bl
rcr dword [eax + 0x31], cl
inc ebx
xchg esp, eax
pop edx
jne 0x259a44b
push dword [edi]
pop edx
mov esp, ecx
xchg ebx, eax
std
arpl word [edi + 0x66155cb1], ax
lahf
shr byte [eax + eax*8], cl
add ecx, dword [esi]
retf

Function at 0x259ba67
Capabilities:
Encode data using xor

Disassembly:
rol edx, 3
xor ebx, edx
call fcn.0165ff95
mov dh, 0x35
imul ebp, ebx, 0x42
xchg ecx, eax
mov ecx, 0x7a9b060e
push edi
push cs
push es
wait
jp 0x259bad4
cli
aam 0x5f
mov ebp, 0x708fcc70
xor byte [ecx + 0x7ef39289], dh
inc ebx
pop esi
cwde
insb byte es:[edi], dx
jecxz 0x259ba78
mov ah, 0x70
dec ebx
aad 0x93
xlatb
mov eax, dword [0x6747b19e]
mov esp, 0xea2ccb5d
xchg ecx, eax
int3
invalid

Function at 0x259fd37
Capabilities:
Encrypt data using speck

Disassembly:
sar cx, 0xa5
mov dword [esp + edx*2 - 0xa764], eax
mov edx, dword [edx + ebp - 0x53b2]
adc cl, 0x90
push eax
xchg ecx, eax
xor edx, ebx
neg edx
inc ecx
js 0x1634eb3

Function at 0x259ff58
Capabilities:
Encrypt data using speck

Disassembly:
xor ebx, eax
xadd dl, dh
add esi, eax
sal ecx, 0xfa
add cx, word [ebp + ecx*2]
lea eax, [edx + edx*8 - 0x567fb152]
mov dword [esp], eax
mov ax, word [ebp + 2]
pop edx
add ebp, 2
push edx
call fcn.0255bd5d

Function at 0x259ff82
Capabilities:
Encrypt data using speck

Disassembly:
rol edx, 3
xchg cx, ax
and dword [esp + ecx - 0x5325f8a8], ecx
not edx
or byte [esp + eax - 0x53258c00], al
call fcn.0249e24f
mov edx, 0x1f164294
lea ecx, [edx - 0x25552de8]
lea ebp, [ebp + edx*2 - 0x3e2c852c]
lea eax, [ecx + ecx*2 - 0x39e92874]
add al, ah
shl edx, cl
mov ecx, dword [ebp + edx - 0x64294000]
rol edx, 0xc3
xor ecx, ebx
sar al, 0x47
bswap eax
bswap ecx
not ecx
xchg edx, eax
xchg edx, eax
inc ecx
xor ax, 0x6c9f
ror eax, 0xf3
call fcn.015becef
mov ecx, 0xd40da938
add ecx, ecx
rol eax, 1
mov edx, ecx
not byte [esp + 6]
shr byte [esp + 5], 0x44
sbb eax, 0x9b2c8c3e
call fcn.0167547e
mov eax, 0x53258c01
lea ebp, [ebp + eax - 0x53258c05]
push eax
dec byte [esp + eax - 0x53258c01]
mov edx, dword [ebp + eax - 0x53258c01]
xor edx, ebx
mov ecx, eax
and word [esp + ecx - 0x53258bff], ax
neg edx
bswap edx
xor ax, 0x74a9
js 0x24e85d2
call fcn.01596db1
Function at 0x25aee39
Capabilities:
Encrypt data using speck

Disassembly:
add ebp, 6
jmp 0x2457b26
xor edx, 0x59017c8c
lea eax, [ecx + eax*8 + 0x21019f3a]
rol al, 0xc2
bswap edx
call fcn.02500fb5
rdtsc
dec ecx
sub esp, 8
shl ebp, 0x53
inc edx
mov dword [ebp - 0x71bffffc], eax
inc esp
movzx ecx, ch
inc ebx
mov dword [ecx], edx
movsx ebx, bp
inc ecx
mov edx, ecx
push edx
inc edi
mov eax, dword [ebp + ecx*2]
dec eax
inc ebp
dec esi
lea ebp, [ebp + ebp - 0x71bffffd]
call fcn.015a462c
mov edx, dword [ebp]
mov eax, 0xc43a389b
dec ax
mov eax, dword [ebp + 4]
mov ecx, 0x5b94cd35
neg cl
sub cx, 0xe4b1
mov cl, byte [ebp + ecx - 0x5b94e912]
jbe 0x15031fd
inc ebp
xor bl, bh
inc ebp
movzx eax, si
pop ebp
dec eax
add ebp, 0xe1edd8
jmp ebp
push 0x15a6a516
shrd edx, eax, cl
sub dword [esp], 0x18123f14
mov dword [ebp], edx
sub esi, 4
shr byte [esp + 1], 0xa2
jne 0x252c088
mov ecx, dword [esp]
mov eax, dword [esi]
xor eax, ebx
xor ecx, 0x612a72a0
cmovno ecx, dword [esp]
ror dword [esp], cl
lea eax, [eax + ecx - 0x561325eb]
sar cx, 0xc7
add dword [esp], 0x8cbdf03e
xor eax, 0x4431c499
pop ecx
mov edx, ecx
not eax
call fcn.01614c0b
xor ecx, ebx
neg ecx
not ecx
add ecx, 0x7caa2a1c
mov edx, 0x6939781
mov dword [esp + edx*2 - 0xd272f02], edx
shl byte [esp + edx*2 - 0xd272efe], 0xe1
xor ecx, 0x1a050ab5
lea eax, [edx + edx*8 + 0x999ea0d]
or dword [esp + edx - 0x6939780], 0xf1b4b7b8
xor ebx, ecx
add edi, ecx
mov dword [esp + edx - 0x6939781], edi
ret 4
mov dword [esp + ecx - 0xfb], 0xc99ad8a1
not edx
xor ecx, ecx
bswap edx
neg dword [esp + ecx]
pop eax
sub cx, cx
not edx
sbb edx, 0x86228828
shl ecx, 0x1d
sar ecx, 0x50
jbe 0x165d5e4
mov ebp, 0xd4122e38
jmp 0x1680159

Function at 0x25b6c42
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov cl, byte [esi + 8]
add esi, 6
shld edx, eax, cl
mov dword [esi], edx
mov eax, 0xdb90d534
shl al, 0x21
call fcn.023d05d9

Function at 0x25b9582
Capabilities:
Authenticate hmac

Disassembly:
sub dl, cl
xor ebx, eax
pop ecx
jmp 0x25144b6
sub dword [esp], edx
adc esi, eax
lea ecx, [edx + edx*4 - 0x74de9678]
mov eax, edx
push edx
dec eax
ror eax, 3
lea eax, [eax + ecx - 0x7277fa0f]
ror eax, 1
sal word [esp + 4], 0xcb
ja 0x23dca5e

Function at 0x25be8f9
Capabilities:
Encode data using xor
Encrypt data using speck

Disassembly:
jle 0x2599f71
dec edi
lea esp, [esp + edx*2 - 0x2184cfa]
inc esp
xadd byte [esp + edx - 0x79127f8a], bh
inc bx
mov dword [esp + edx - 0x10c2680], eax
dec edx
mov dword [esp + edx*4 - 0x4309a00], esi
ret 0x10
dec eax
arpl cx, cx
dec esi
mov dword [esp + edx*2 - 0x2184d00], ecx
dec eax
adc esi, ecx
inc ecx
push edx
dec ebx
mov edi, dword [esp + edx*2 - 0x2184d00]
dec eax
bswap ebp
push ebx
inc dx
movzx eax, byte [edi + edx*2 - 0x2184d00]
shr edx, 0xa1
jo 0x2457b4a
sub ecx, 0x8db8d72a
sub al, 0x24
bswap ecx
movzx edx, byte [esp + eax*2 - 0x3dbfffb4]
xchg word [esp + eax - 0x1edfffd4], dx
inc ecx
pop eax
rol dx, 0xeb
not ecx
xchg edx, eax
bswap ecx
inc dx
shl edx, 0xcb
xor ebx, ecx
jmp 0x2484996
Function at 0x403160
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404570
test esi, esi
jne 0x403196
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404660
jmp 0x4031b4
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403064
mov edi, eax
test esi, esi
je 0x4031b4
cmp dword [ebx], 0
je 0x4031b4
dec esi
jmp 0x40319d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4031e8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x428008], 0x8088405
inc edx
mov dword [ebx + 0x428008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4037cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x428024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403864
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403844
xor eax, eax
push ebp
push 0x40383d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403880
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403844
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x428024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x428024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4043f0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x443044], 0
je 0x404451
cmp word [0x443218], 0xd7b2
jne 0x404419
cmp dword [0x443220], 0
jbe 0x404419
mov eax, 0x443214
call dword [0x443230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404478
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x428034], 0
jne 0x40446d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405b24
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d54
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405ba7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d54
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405ba7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d70
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405c30
xor eax, eax
push ebp
push 0x405c29
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405960
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405c0e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405d90
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405c0e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c30
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405d4a
cmp byte [ebp - 0xd], 0
jne 0x405c77
cmp byte [ebp - 0x12], 0
je 0x405d4a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405c90
dec ebx
cmp byte [ebx], 0x2e
je 0x405c9f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405c8f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405d4a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405cdc
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d4a
cmp byte [ebp - 0xd], 0
je 0x405d4a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d4a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret