joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43efa0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.00439750
test eax, eax
je 0x43f08f
mov ecx, edi
call fcn.00439750
mov ecx, eax
call fcn.00436dd0
test eax, eax
jne 0x43f08f
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x43f08f
mov eax, dword [0x706220]
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x43f002
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
lea ecx, [esp + 0x10]
mov ebp, dword [esp + 0x24]
push 1
push ecx
mov ecx, dword [edi + 0x44]
lea edx, [esp + 0x1c]
shr ecx, 4
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x2c]
and ecx, 1
push eax
push ecx
push ebp
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov ecx, edi
call fcn.00439750
mov ecx, eax
call fcn.00437000
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x28]
mov eax, 1
cmp ecx, eax
jne 0x43f08f
cmp ebx, eax
jne 0x43f08f
cmp dword [esp + 0x10], eax
jne 0x43f075
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xcc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi]
push eax
mov eax, dword [esp + 0x24]
push ecx
push ebp
push eax
mov ecx, edi
call dword [edx + 0xc0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x441cb0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4916d8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x441ce9
inc eax
mov dword [esi + 0x10], eax
jmp 0x441dfc
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x441cfd
mov eax, 0xffffffc7
jmp 0x441dfe
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x441d0e
cmp dword [esi + 8], eax
jne 0x441cfd
cmp dword [esi + 8], eax
jne 0x441d27
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x441d27
mov eax, 0xffffffc7
jmp 0x441dfe
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x441d3b
push eax
mov ecx, ebx
call fcn.004414e0
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.0040f7f0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x441d6c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.0040f810
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00440c50
test eax, eax
mov dword [esp + 0x38], eax
je 0x441d9f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x60ee88
call fcn.0040f9f0
mov eax, dword [esp + 0x38]
jmp 0x441dfe
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00441b10
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x441de3
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00441b30
mov esi, eax
test esi, esi
jne 0x441e13
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00441b10
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x441db5
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x60ee88
call fcn.0040f9f0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x60ee88
call fcn.0040f9f0
mov eax, esi
jmp 0x441dfe

Function at 0x444f40
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x444fa0
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x444fa0
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x444fa0
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x444fa0
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x444fe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x44af00
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x491d08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.0048850c
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0044a8a0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0048843a
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.00484c1e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.00484c1e
push 1
push 0
push 0
mov ecx, esi
call fcn.00484bc6
push 1
push 0
push 1
mov ecx, esi
call fcn.00484bc6
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0048857e
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x44b080
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x491d28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0048850c
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0044a8a0
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0048843a
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x44b144
cmp dword [esp + 0x40], 1
jne 0x44b142
cmp ecx, eax
jge 0x44b144
mov eax, ecx
cmp eax, 0xc8
jge 0x44b150
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0044af00
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0048857e
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x44b8d0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x491d93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0048303e
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004887b4
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00489e06
test eax, eax
je 0x44b9ec
mov ecx, dword [esp + 0x3c]
call fcn.004887e1
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x44b9b0
push edi
mov ecx, esi
call fcn.00485da1
mov ecx, esi
call fcn.0044bb50
cmp dword [esp + 0x38], 1
jne 0x44b9e5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00485f0b
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x44e410
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44e443
push esi
call fcn.00451500
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44e43c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44e4c9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44e4b2
mov eax, dword [esi + 8]
test eax, eax
je 0x44e467
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44e4ae
cmp eax, 2
je 0x44e4b2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44e45a
cmp eax, 3
je 0x44e48d
cmp eax, 1
jne 0x44e45a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44e45a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44e45a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044e4f0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44e4d8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044e4f0
add esp, 4
pop esi
ret
Function at 0x45bc40
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x45bc89
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x45c100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4924e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0045bcb0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0045bd30
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0045bd30
lea ecx, [esi + 0xc]
call fcn.004819cc
lea ecx, [esi + 0x10]
call fcn.004819cc
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0045d2c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0045d2c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0045d2c0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00481a41
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00481a41
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x45d4b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x45d516
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x45d516
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x45d4f7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x483e34
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x483e6c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00481ee8
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00481ec0
jmp 0x483e78
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x485522
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x485564
call fcn.0048b3cd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x485564
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48555b
xor eax, eax
jmp 0x48556c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00485572
pop edi
pop esi
pop ebx
ret 4

Function at 0x48b8fd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48b92b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48b949
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048b863
jmp 0x48b949
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48b949
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048b863
test edi, edi
mov eax, edi
jne 0x48b933
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0xa0a40d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
mov dword [eax + 0x10], 0x98badcfe
call fcn.00a09f26
push esp
mov word [esp + 2], sp
push edx
jmp 0xa0a2f3

Function at 0xb0f89d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 7]
push dword [esp]
jmp 0xb0fa19
sub esp, 0x16
lea eax, [esp + ebx]
xchg dword [esp + 8], ebp
rdtsc
mov ebp, ecx
bswap edx
jmp 0xb0f915
lea edi, [esi*4]
inc cl
xchg word [esp + 0x2b], bx
cpuid
jmp 0xb0f9e3
mov ecx, dword [esp + 0x13]
mov bl, bh
xchg dword [esp + 0x12], eax
inc di
setp ah
xchg cx, bp
jmp 0xb0f8d7
mov dx, word [esp]
not di
mov byte [esp + 0x27], ch
xchg dword [esp + 6], edi
rdtsc
jmp 0xb0f8e9
xchg bx, di
clc
bsr bx, bp
mov eax, ecx
sub esp, 0x1c
setl dh
jmp 0xb0f901
cld
add esp, 9
lea esp, [esp + 2]
lea esp, [esp + 3]
lea esp, [esp + 0x10]
pushal
jmp 0xb0f92c

Function at 0xb0fc1d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, ebx
mov dh, byte [esp + 0xc]
xchg dword [esp + 7], edi
xchg ah, bl
pop word [esp + 7]
add esp, 0xe
jmp 0xb0fc2d
pop word [esp]
mov ax, word [esp + 1]
mov word [esp + 2], di
jmp 0xb0fbf8
mov al, ah
mov al, 0x56
xchg cx, si
rdtsc
xor bx, 0x358c
mov byte [esp], ah
jmp 0xb0fc5e
mov al, 0xe
mov byte [esp], dh
btc ecx, ebx
mov ch, byte [esp]
mov al, ah
lea esi, [edx + edi]
jmp 0xb0fcaf
clc
xchg dx, ax
lea eax, [esp + ebp]
lea edx, [edx + edi]
xchg ch, dl
ror bh, 3
jmp 0xb0fc40
lea ecx, [ebx + esi]
lea edi, [eax + edx]
bsr bp, cx
add ax, 0xc0c6
mov bp, word [esp]
xchg ebp, eax
jmp 0xb0fc92

Function at 0xb0fe3e
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg eax
rdtsc
neg esi
jmp 0xb0fe4a
mov edi, 0x714ec6ee
mov dl, dh
push dword [esp + 2]
sub esp, 0x1e
jmp 0xb0fe8a
shr bh, 3
add bp, 0xa2a6
mov al, ah
mov cl, 0x52
mov esi, ebp
jmp 0xb0ff5c
lea edi, [ecx - 0x8b]
pushal
lea esp, [esp + 0x48]
mov cx, 0x48db
inc edx
jmp 0xb0fe74
lea ebp, [ebx + edi]
sub esp, 0
mov bx, sp
lea ecx, [esp + ebx]
lea ebx, [ecx + 0x23ff5873]
mov dl, byte [esp]
mov bx, 0xdcd9
jmp 0xb0ff1a

Function at 0xb0ff8d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp]
add esp, 1
mov byte [esp + 3], ah
mov word [esp], di
xchg ebp, eax
mov edi, dword [esp + 1]
jmp 0xb0ff92
btr esi, esp
jmp 0xb0ff74
push dword [esp]
sub esp, 0x14
mov ch, byte [esp + 0x1b]
mov dword [esp + 9], ebp
jmp 0xb0ffe7
bsr dx, cx
bsr dx, cx
rdtsc
mov bl, bh
setbe ch

Function at 0xb1028d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, dh
lea ecx, [ebp + 0x7f]
bsr cx, cx
Function at 0xb11d0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
setne dh
cpuid
xchg word [esp], di
mov si, 0xa9cd
pushal
jmp 0xb11d0d
jmp 0xb11cf3
xchg ah, bl
popal
pop word [esp]
mov edx, 0x5e8cf2ec
sub esp, 0xa
pop bp
jmp 0xb11e54
shr edi, 0x19
pop word [esp + 1]
rdtsc
add esp, 5
call fcn.00b11e37
invalid

Function at 0xb11ddc
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 6
mov ax, word [esp + 4]
xchg ecx, eax
not si
cmc
mov si, sp
jmp 0xb11d85
bswap ecx
rdtsc
lea esp, [esp + 5]
jmp 0xb11db0

Function at 0xb121d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov di, word [esp + 0xa]
mov word [esp + 0xc], sp
mov si, word [esp + 0x12]
push word [esp + 9]
not bx
rol bx, cl
jmp 0xb121dd
push edx
mov cl, ch
jmp 0xb121b8
mov edx, 0x18e06d1a
mov dword [esp + 1], esi
cld
cpuid
inc ecx
rdtsc
jmp 0xb12262
xchg word [esp + 0x10], cx
mov cx, 0xa013
mov dword [esp + 1], ecx
lea esp, [esp + 1]
jmp 0xb122b8
mov word [esp + 6], bx
lea esi, [ebp*4]
inc cx
jmp 0xb12210
mov di, 0x3c39
mov al, ah
mov bx, 0xac09
inc eax
mov edi, 0x5a0441c6
xchg dword [esp + 3], edi
jmp 0xb12227
xchg byte [esp + 0xa], bl
xchg byte [esp + 0x10], bl
xchg si, dx
lea esi, [esi + 0xfd]
xchg cx, ax
btc esi, edi
jmp 0xb1223f
mov ebp, esi
push dword [esp + 0x12]
mov bx, di
bsr di, bp
mov bl, bh
bswap edx
jmp 0xb122e3
mov cx, 0x2ee1
pop dx
mov ch, byte [esp + 0x11]
rdtsc
xchg byte [esp + 9], al
rdtsc
jmp 0xb12295
pop dx
call fcn.00b122cc
sbb al, 0x85
adc eax, 0xae248f7c
movsb byte es:[edi], byte ss:[esi]
ret
Function at 0xb125e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
bsr cx, cx
lea edi, [ecx*4]
jmp 0xb1261a
mov bl, 0x28
xchg byte [esp + 0x16], al
lea esp, [esp + 0x12]
bsf dx, si
jmp 0xb12634
bswap ebp
sub bl, ah
cpuid
push esp
mov ch, byte [esp + 0xa]
sub esp, 0x1e
jmp 0xb12603
push word [esp + 7]
pop eax
mov cx, word [esp + 0x12]
cld
bsr si, cx
jmp 0xb12660

Function at 0xb12a16
Capabilities:
Parse pe header

Disassembly:
mov word [esp + 1], sp
mov byte [esp + 7], dh
pop word [esp + 5]
pushal
mov word [esp + 9], dx
mov word [esp + 0x20], sp
jmp 0xb12a18
jmp 0xb129ed
lea esp, [esp + 1]
mov dword [esp + 0xdc], edi
jmp 0xb12a49

Function at 0xb12a2f
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push dword [esp + 2]
push word [esp + 7]
push dword [esp + 8]
mov byte [esp + 6], ah
lea esp, [esp + 7]
call fcn.00b12a16
lea esp, [esp + 0xdc]
mov eax, dword fs:[0x30]
jmp 0xb12a89
mov eax, dword [eax + 8]
jmp 0xb12b5a
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0xb12a73
Function at 0x402ffc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x47f008], 0x8088405
inc edx
mov dword [ebx + 0x47f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40355c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x47f010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035f4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4035d4
xor eax, eax
push ebp
push 0x4035cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403610
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035d4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x47f010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x47f010], ax
mov esp, ebp
pop ebp
ret

Function at 0x4042d4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x481048], 0
je 0x404335
cmp word [0x48121c], 0xd7b2
jne 0x4042fd
cmp dword [0x481224], 0
jbe 0x4042fd
mov eax, 0x481218
call dword [0x481234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47f058
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40435c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47f020], 0
jne 0x404351
push 0
push 0x47f078
push 0x47f058
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404488
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402720
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x481049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404450
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc