joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e10
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov edx, 2
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
cmp word [eax + ecx + 0x5c], 2
je 0x402df0
mov edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x402e10
mov dword [esp], eax
call sub.ucrtbase.dll_exit
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x54
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x402e67
xor ecx, ecx
xor edx, edx
jmp 0x402e49
cmp ax, 0x5c
jne 0x402ed8
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x402e67
cmp ax, 9
je 0x402e55
cmp ax, 0x20
jne 0x402e30
test ecx, ecx
je 0x402ec3
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x402e49
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x20], 1
je 0x402ef8
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004021c0
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x402ec0
cmp ax, 0x20
je 0x402ec0
jmp 0x402e67
cmp ax, 0x22
jne 0x402e59
and edx, 1
jne 0x402e59
xor ecx, 1
jmp 0x402e3d
mov eax, 1
mov esi, 1
mov word [ebp - 0x1c], ax
jmp 0x402e80
Function at 0x291a240
Capabilities:
Execute anti-debugging instructions

Disassembly:
sete dh
xchg edx, eax
call fcn.0291a28d
fcom dword [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
ljmp 0xeb48
mov ah, 0x9f
mov ax, word [esp]
mov al, 0xa1
rdtsc
btc ax, ax
jmp 0x291a26a
add cl, bl
bswap edx
rdtsc
jmp 0x291a2b7
je 0x291a22a
sete dh
xchg edx, eax
jmp 0x291a250
lea eax, reloc.DSOUND.dll_DirectSoundCreate
xchg dx, ax
jmp 0x291a2d9
mov al, cl
cmc
jle 0x291a334
shr dx, 0
jmp 0x291a338
shr dx, 0
call fcn.0291a308
pop edx
push word [esp + 4]
jmp 0x291a38a
push esp
lea esp, [esp + 2]
jmp 0x291a374
lea esp, [esp + 0x20]
sub al, 0x45
mov dx, word [esp]
mov dh, byte [esp]
call fcn.0291a3a9
cmp dword [edx], 0x15
test byte [edi - 0x43], dh
ja 0x291a349
push esp
lea esp, [esp + 2]
jmp 0x291a374

Function at 0x291a451
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esp + 0x5b]
xchg word [esp], ax
mov dh, byte [esp]
jmp 0x291a43b

Function at 0x291c2b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc ax
je 0x291c2b9
push dword [esp + 2]
jmp 0x291c2bd
not dl
jmp 0x291c29e
push dword [esp + 2]
lea esp, [esp + 8]
jmp 0x291c2c7
xor cl, 0x20
add ax, 0x43a7
jle 0x291c37e
mov edx, 0x76c29d7e
jmp 0x291c34b
mov ah, bl
jmp 0x291c38f
mov dx, 0x5f6b
mov dh, byte [esp]
bsf eax, edi
jmp 0x291c31e
mov edx, 0x76c29d7e
mov dx, 0x5f6b
mov dh, byte [esp]
bsf eax, edi
mov ah, bl
lea eax, [edx + edx]
lea edx, reloc.DSOUND.dll_DirectSoundCreate
mov dl, byte [esp]
neg cl
call fcn.0291c2ed
pop dx
jmp 0x291c3d3
rdtsc
mov ax, sp
jmp 0x291c3e2
rol dl, cl
jb 0x291c3bd
rdtsc
mov ax, sp
jmp 0x291c421
not ax
lea esp, [esp + 2]
jmp 0x291c40b
sub cl, 0x2a
mov ax, 0x9b44
mov eax, 0x52fed740
shr al, cl
jmp 0x291c42a
not ax
lea esp, [esp + 2]
jmp 0x291c40b
jg 0x291c440
jle 0x291c440
xchg byte [edi], al
xchg edi, eax
add dword [edi + reloc.DSOUND.dll_DirectSoundCreate], edi
mov eax, 0x37841509
push ds
imul ecx, dword [eax - reloc.DSOUND.dll_DirectSoundCreate], 0xfc2879f
lcall 0x8339, 0xeb2cebc4
lds eax, [ecx + ebp*8]
enter 0, 0
sub al, 0xaf
aas
pop edx
test eax, 0x56c04a08
xor eax, eax
jne 0x291c460
and ecx, 0x3c
mov dh, 0x9f
xchg edx, eax
setp ah
jmp 0x291c478
jmp 0x291c487
sal byte [ebp - 3], 0xcc
int3
mov edx, dword [ebp]
lea eax, [ebx + esi]
sbb eax, 0xf6733791
jbe 0x291c44c
ja 0x291c44c
mov dword [ecx + edi], edx
lea edx, [edi*4]
mov ecx, esi
mov dl, byte [esp]
call 0x291c44e
pop edi
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x2d]
dec edx

Function at 0x291c6d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 4], edi
lea esp, [esp + 4]
pushfd
jmp 0x291c007
jmp 0x291c610
Function at 0x29e7ee0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [esp + 0x11]
mov ebp, dword [esp + 0x14]
bsf esi, ecx
mov ch, 3
add esp, 0x1a
jmp 0x29e7f54
xchg word [esp + 0xb], dx
neg cx
lea ebx, [eax*4]
mov al, byte [esp + 0x1f]
jmp 0x29e7eca
lea esi, [ecx*4]
push word [esp + 1]
sub esp, 0xe
cmc
mov al, 0xf
bsr bp, sp
jmp 0x29e7f14
pop word [esp + 1]
pop dx
bsr dx, bp
mov word [esp], di
mov byte [esp], dl
add esp, 0
jmp 0x29e7f2a
Function at 0x29e85c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
cpuid
push word [esp + 9]
mov byte [esp + 7], dh
or ch, 0x96
mov cx, 0xf4db
jmp 0x29e862c
mov al, 5
push dword [esp + 8]
jmp 0x29e8596
xchg dword [esp + 4], esi
cpuid
neg bp
pushfd
xchg di, si
mov cx, si
jmp 0x29e8608
lea ebx, [ebx*4]
bswap edx
mov di, sp
inc edi
mov dh, cl
cpuid
jmp 0x29e85c9
sub esp, 9
pop word [esp]
sub esp, 0x1e
sub esp, 7
popal
jmp 0x29e86ac
mov bp, sp
pop eax
mov ebx, dword [esp + 9]
pop word [esp + 5]
mov dl, 0x6c
setg ch
jmp 0x29e85f2
shr ax, cl
xchg al, dl
mov byte [esp + 0xc], ah
pop dword [esp + 1]
mov ecx, 0x251a3dd6
mov dword [esp + 3], esp
jmp 0x29e85df
xchg ebx, eax
xchg word [esp + 2], ax
mov cx, 0xe076
std
mov bh, cl
xchg esi, ebx
jmp 0x29e8685
mov dword [esp + 6], eax
xchg bx, cx
pop dword [esp + 4]
neg al
lea esp, [esp + 0xa]
xchg ebx, ebp
jmp 0x29e8644
xchg esi, edx
push word [esp + 9]
setns al
jmp 0x29e86f0
push ebp
push dword [esp + 7]
lea edx, [ebp*4]
xchg word [esp + 0xa], cx
rdtsc
cmc
jmp 0x29e866f
pop dword [esp + 0xe]
mov word [esp + 9], cx
xchg edx, eax
bswap esi
xchg byte [esp + 5], al
neg dx
jmp 0x29e865a
mov ecx, dword [esp + 0xc]
mov bx, 0x6f2f
mov di, 0x8734
jmp 0x29e8728
mov word [esp + 8], dx
pushfd
push word [esp + 7]
push word [esp + 0xc]
jmp 0x29e86c1
lea edx, [edx*4]
xchg cl, ah
add esp, 0
xchg dword [esp + 7], ecx
mov esi, 0xfda629d8
dec dx
jmp 0x29e86d7
btc edx, eax
mov dword [esp + 8], edx
setp cl
ror ecx, 0x1c
dec ah
xchg word [esp + 6], dx
jmp 0x29e8771
push word [esp + 0xb]
mov word [esp], si
pop word [esp + 0x13]
xchg bx, dx
xchg dword [esp + 9], ebp
push word [esp + 1]
jmp 0x29e8709
xchg word [esp + 1], cx
rol cx, 0xe
bswap ecx
xchg word [esp + 9], dx
dec ebp
std
jmp 0x29e881b
pop word [esp + 0xc]
cmc
pop word [esp + 3]
mov ebp, dword [esp + 6]
jmp 0x29e8803
mov word [esp + 6], di
rdtsc
cpuid
push word [esp + 0xe]
adc edi, edx
not bh
jmp 0x29e87a0
pop bx
lea ebp, [ebx*4]
lea edx, [ebp*4]
lea ecx, [ebx + ebp]
bsf edi, edx
mov dh, byte [esp + 0xe]
jmp 0x29e87b6
push dword [esp + 1]
mov ecx, 0xa58598a1
setp ah
neg edi
jmp 0x29e885c
add esp, 0xa
xchg byte [esp + 2], dh
add esp, 1
cpuid
btc bx, bx
not dl
jmp 0x29e87ed
mov bx, 0xb9a0
xchg cx, bx
bts ax, si
lea esp, [esp + 5]
pop word [esp]
lea edx, [ecx*4]
jmp 0x29e87d1
sub esp, 0xf
xchg byte [esp + 0x2e], bh
add esp, 7
cpuid
sub esp, 0xa
xchg word [esp + 0x2a], bp
jmp 0x29e8889
mov word [esp + 5], bx
mov cx, word [esp + 6]
lea eax, [esp + ebx]
mov ecx, 0xfe632b83
cpuid
pushal
jmp 0x29e8837
std
btr esi, ebx
pop ebx
not ch
mov ebx, edi
cpuid
jmp 0x29eac33
rcl di, cl
mov ah, byte [esp + 0x21]
shl dx, 0xa
lea edx, [esp + eax]
rdtsc
bswap ebx
jmp 0x29e8873
xchg bx, si
Function at 0x29eb804
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg edx
xchg byte [esp + 4], ch
lea esp, [esp + 1]
xchg word [esp + 0x11], di
jmp 0x29eb826

Function at 0x29ebdbe
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc ebp
adc al, 0xb7
push esp
lea ecx, [eax + ebx]
xchg dword [esp + 0x1f], edi
jmp 0x29ebdfa
cpuid
shl al, 2
add esp, 0x21
cld
cmc
lea ebp, reloc.DSOUND.dll_DirectSoundCreate
jmp 0x29ebe3f
neg bx
sbb dh, 0x22
not bh
mov bh, ch
mov ebp, dword [esp + 0x14]
xchg bx, si
jmp 0x29ebde4
setb al
mov ebp, ebx
mov si, 0xb792
lea esi, [ebx*4]
jmp 0x29ebfe9
pop word [esp + 5]
lea esp, [esp + 2]
pop esi
add esp, 1
lea esi, reloc.DSOUND.dll_DirectSoundCreate
xchg edx, esi
jmp 0x29ebe29
mov bl, byte [esp]
cpuid
not bx
xchg si, bp
lea ebp, [ebx - 0x67]
push di
jmp 0x29ebf0d
rdtsc
mov edi, 0xb80913b7
bswap eax
pushal
xchg bx, si
popal
jmp 0x29ebe56
pop word [esp]
add esp, 5
pop ax
setge dh
rdtsc
mov cl, byte [esp]
jmp 0x29ebe6c
mov dword [esp], ebx
bt bp, cx
push eax
mov al, 8
xchg ecx, edi
stc
jmp 0x29ebee3
std
mov dx, 0xf37
push word [esp + 1]
xchg dword [esp], ebx
lea esp, [esp]
mov dword [esp], edx
jmp 0x29ebea2
neg si
xchg word [esp], bx
shr eax, cl
xchg word [esp + 1], ax
call fcn.029ebef6
insd dword es:[edi], dx
jl 0x29ebf32
std
push word [esp + 4]
lea eax, reloc.DSOUND.dll_DirectSoundCreate
not esi
pop eax
xchg esi, ebx
jmp 0x29ebecd
mov ah, byte [esp + 1]
mov word [esp], ax
lea eax, [ebp - 0x3f]
mov ch, 0xa3
mov eax, 0xfc225d03
stc
jmp 0x29ebeb8
mov byte [esp], bl
dec ebp
jmp 0x29ebf5b
setl cl
add esp, 1
inc dh
mov eax, dword [esp]
btc bx, si
rdtsc
jmp 0x29ebfa8
lea ecx, [esp + edx]
bsr bx, di
cpuid
add esp, 1
lea edx, reloc.DSOUND.dll_DirectSoundCreate
rcl ecx, 0x18
jmp 0x29ebfd2
mov bx, word [esp + 1]
dec bx
bsr di, ax
or ecx, ebx
neg ebx
add esp, 0
jmp 0x29ebf8a
lea edx, [edx*4]
pop dx
setle ah
lea ebx, [ebx + esi]
jmp 0x29ec01a
cpuid
mov di, dx
mov cl, 0x17
sub esp, 0x1e
pop esi
jmp 0x29ebfbc
mov edi, 0x7febdca4
mov bp, 0x5ff0
push word [esp + 1]
xchg dh, ah
cpuid
push dword [esp + 2]
jmp 0x29ebe8f
pop di
mov ch, bh
mov word [esp + 0x25], di
xchg word [esp + 0xb], dx
cld
jmp 0x29ec02d
sub esp, 0x15
xchg bx, si
cpuid
cmc
xchg dword [esp + 0x10], edi
pop dword [esp + 0x25]
jmp 0x29ec004
lea edi, [edx + ebp]
cpuid
push edi
mov byte [esp + 0xe], cl
mov byte [esp + 6], dl
jmp 0x29ec356
mov bp, si
rol dx, 2
sub bh, 0x34
push dword [esp + 1]
mov cl, byte [esp + 0xf]
call fcn.029ec055
mov eax, dword [esp + 0xe]
pop word [esp + 0xf]
xchg dword [esp + 0xc], esi
jmp 0x29ec0c7
mov dh, bh
lea ebx, reloc.DSOUND.dll_DirectSoundCreate
xchg word [esp + 4], di
jmp 0x29ec0e0
mov byte [esp + 9], bh
mov bx, 0xcd44
bts ax, si
cpuid
push word [esp + 0x14]
mov ecx, dword [esp + 3]
jmp 0x29ec0b1
push word [esp + 1]
call fcn.029ec1ec
stosb byte es:[edi], al
xor dword [ecx - reloc.DSOUND.dll_DirectSoundCreate], esp
xor ah, byte [eax - 0x4c4acd39]
stosb byte es:[edi], al
invalid
push dword [esp + 7]
pop dx
setns cl
rdtsc
xchg bx, bp
mov ecx, ebp
jmp 0x29ec06b
add esp, 0x26
btc ax, di
mov word [esp + 1], ax
pushfd
xchg ch, bl
mov dword [esp], ebp
jmp 0x29ec0f9
Function at 0x29ebef6
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
pop edi
jmp 0x29ebf73
clc
lea ecx, [ecx*4]
lea edi, reloc.DSOUND.dll_DirectSoundCreate
mov ebp, edi
rcr ah, cl
dec ecx
sete dh
xchg byte [esp + 1], ch
push word [esp]
pop word [esp]
jmp 0x29ebf22
neg bh
add esp, 1
bsf ebx, ebp
or dx, 0xafe2
pop di
and ebp, 0x2a76c3bb
jmp 0x29ebf47

Function at 0x29ec213
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ebx + ebx]
mov esi, 0x47641952
sub esp, 0x1c
push dword [esp + 0x26]
jmp 0x29ec224
mov byte [esp + 0x11], bl
mov ecx, 0xae4fa29
mov edi, dword [esp + 0xc]
rdtsc
jmp 0x29ec1fd
mov dword [esp + 0x14], ebp
xchg word [esp + 0x1c], di
lea esi, [eax + edi]
mov ch, byte [esp + 0x2c]
rdtsc
lea ecx, [ebx + edi]
jmp 0x29ec26d
mov word [esp + 0xe], dx
push dword [esp + 0xa]
mov bx, 0xbfad
jmp 0x29ec309
mov dl, dh
mov byte [esp + 0x2b], ch
mov esi, dword [esp + 0x16]
add esp, 0x24
lea edi, [eax + ebx]
xchg bl, cl
jmp 0x29ec257

Function at 0x29ec393
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, dh
xchg cl, dh
not si
neg dx
dec ecx
mov cx, bp
jmp 0x29ec3b7
xchg dword [esp], ebp
xchg byte [esp + 0xa], dl
bt dx, dx
jmp 0x29ec3a1
add dl, ah
neg esi
mov byte [esp + 2], al
xchg byte [esp + 2], bh
jmp 0x29ec36d
lea ecx, reloc.DSOUND.dll_DirectSoundCreate
pop cx
mov dl, dh
add esp, 0xd
not dl
pop eax
jmp 0x29ec47d
xchg dword [esp], edx
lea esp, [esp]
pop si
neg bh
clc
sub esp, 0x15
jmp 0x29ec37d
xchg dword [esp + 8], edi
lea ebp, reloc.DSOUND.dll_DirectSoundCreate
rdtsc
lea esp, [esp + 0x2c]
jmp 0x29ec3eb
sub esp, 0x18
stc
xchg byte [esp + 0xe], cl
xchg word [esp + 0x2e], bx
mov ecx, 0x7b3f02a5
bswap eax
jmp 0x29ec401
mov ah, byte [esp + 3]
rdtsc
rdtsc
pushal
pop word [esp + 0x10]
mov si, 0xb27
jmp 0x29ec418

Function at 0x29ecc1f
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x29eb448
jmp 0x29ecc67
mov byte [esp + 2], ah
push si
pop word [esp]
mov dword [esp + 0x14], esp
pushfd
call fcn.029ecc21
pop word [esp + 1]
push word [esp + 4]
mov dword [esp + 0x1c], esi
pushfd
call 0x29ecc90
aaa
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x29ecce5
push eax
jmp 0x29eb443
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x29eccb7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x29ecccd

Function at 0x29ecc21
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], dh
jmp 0x29ecc4e
mov dword [esp + 0x18], ebp
push ebx
push edi
mov dword [esp + 1], esp
mov word [esp + 5], bp
jmp 0x29ecc7b

Function at 0x29ecc90
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
call 0x29eb448
jmp 0x29ecc67
mov byte [esp + 2], ah
push si
pop word [esp]
mov dword [esp + 0x14], esp
pushfd
call fcn.029ecc21
pop word [esp + 1]
push word [esp + 4]
mov dword [esp + 0x1c], esi
pushfd
call 0x29ecc90
aaa
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x29ecce5
push eax
jmp 0x29eb443
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x29eccb7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x29ecccd
Function at 0x402a60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x402a71
jmp dword [eax*4 + 0x404c14]
cmp dword [0x407334], 0
je 0x402b6a
push 0x407338
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x407350]
test edi, edi
je 0x402b5f
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402abb
mov edi, dword [edi + 8]
test edi, edi
je 0x402b5f
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x402ab0
test esi, esi
je 0x402ab0
mov eax, dword [edi + 4]
push esi
call eax
add esp, 4
jmp 0x402ab0
call fcn.00401df0
jmp case.default.0x402a71
cmp dword [0x407334], 0
je case.default.0x402a71
push 0x407338
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x407350]
test edi, edi
je 0x402b52
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402b17
mov edi, dword [edi + 8]
test edi, edi
je 0x402b52
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x402b10
test esi, esi
je 0x402b10
mov eax, dword [edi + 4]
push esi
call eax
add esp, 4
jmp 0x402b10
cmp dword [0x407334], 0
jne 0x402b46
push 0x407338
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x407334], 1
jmp case.default.0x402a71
push 0x407338
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x402a71
push 0x407338
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x407334]
cmp eax, 1
jne case.default.0x402a71
mov eax, dword [0x407350]
test eax, eax
je 0x402b92
nop dword [eax]
mov esi, dword [eax + 8]
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x402b80
mov dword [0x407350], 0
mov dword [0x407334], 0
push 0x407338
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402cc0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x404004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x402d26
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x402d26
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x402d26
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x402d26
mov edx, dword [esp + 0xc]
sub edx, dword [0x404004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x402d16
add esi, 0x28
dec ecx
je 0x402d26
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x402d10
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x402d10
mov eax, esi
pop esi
pop edi
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40610e
Capabilities:
Encode data using xor

Disassembly:
and ecx, 0x49d29618
and edx, 0xb62d69e7
or edx, ecx
mov edi, 0x3084b90f
xor edi, 0x30c4b90f
mov ebx, 0x403bf2de
mov esi, 0x403b32d6
xor esi, ebx
xor edi, esi
xor edx, edi
xor ebx, ebx
add ebx, edx
sub ebx, 0x37
mov eax, dword [ebx + 0x37]
push 0x43f2c2aa
mov ecx, 0x43f2c2aa
inc ebx
pop edx
xor ecx, edx
push ecx
mov ebx, esp
push ebx
pop edi
mov edx, 0xfffffffc
add esp, edx
mov dword [esp], edi
mov esi, 0x40
mov ebx, 0
xor esi, ebx
push esi
mov ebx, 0x930f
add ebx, 0xf1
push ebx
mov esi, 0x400000
mov edx, 0x1000
xor esi, edx
push esi
call eax
pop esi
mov ecx, 0x758772da
mov esi, 0x2536f761
xor esi, ecx
mov edx, 0x4556653c
mov ebx, 0x2fe1b001
xor ebx, edx
xor ebx, esi
mov esi, 0x2225005e
mov edi, 0x8821321
xor esi, edi
push esi
mov edi, 0x559814b3
mov eax, 0x4539546b
xor eax, edi
pop edx
xor eax, edx
xor eax, ebx
mov esi, 0x7f42a572
mov ecx, 0x1f0a82ba
xor ecx, esi
mov edx, 0x554e336
mov edi, 0x651c91ff
xor edi, edx
xor edi, ecx
mov ebx, 0x4effac5b
xor ebx, 0x5db0da0e
mov esi, 0x130f7e47
xor ebx, esi
xor edi, ebx
mov edx, 0xe6573c8
xor edx, 0x36efed23
push edx
push 0x16237d9e
mov esi, 0x2ee96b34
pop edx
xor esi, edx
pop ecx
xor esi, ecx
mov ecx, 0x415b7764
mov ebx, 0x161d1946
xor ebx, ecx
mov ecx, 0x3b3b94e3
xor ebx, ecx
xor ebx, 0x6c7dfe5f
xor esi, ebx
mov ebx, eax
add esp, 0xfffffffc
mov dword [esp], ebx
pop ecx
mov edx, 4
sub esp, edx
mov edx, esp
mov ebx, edx
mov dword [ebx], ecx
xor ebx, ebx
add ebx, esi
mov ecx, 0
mov edx, 4
xor ecx, edx
sub esp, ecx
mov dword [esp], ebx
xor eax, eax
mov al, byte [edi]
add esi, eax
mov al, byte [esi]
mov ecx, 0x13d30410
xor ecx, 0x7bfc1638
mov edx, 0x479f921d
xor ecx, edx
xor ecx, 0x3d91e81d
mov edx, 0x754d54b4
mov ebx, 0xddc75471
xor ebx, edx
xor ecx, ebx
mov edx, esi
add esp, 0xfffffffc
mov dword [esp], edx
pop ebx
add ebx, esi
je 0x4061e8
pop esi
mov byte [edi], al
mov ebx, 0x171695e8
xor ebx, 0x171695e9
sub edi, ebx
pop eax
dec eax
mov edx, 0
xor edx, eax
add esp, 0xfffffffc
mov ecx, esp
mov dword [ecx], edx
pop ebx
add ebx, eax
jne 0x4061e8
mov ebx, 0x565d770d
xor ebx, 0x18fb4dcf
mov edi, 0x57e7357b
mov eax, 0x19011ff9
xor eax, edi
xor eax, ebx
push 0x2e9318d9
mov edi, 0x7fc012f0
pop ecx
xor edi, ecx
push edi
mov esi, 0x78035797
xor esi, 0x2950140d
pop ebx
xor esi, ebx
xor eax, esi
call eax
pop ebx
pop ebx
ret
Function at 0x401970
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004027a0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004027a0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4019d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x297807c]
test esi, esi
jle 0x401af0
mov eax, dword [0x2978080]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401a04
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401a87
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4019f0
mov dword [esp], ebx
call fcn.00402350
mov edi, eax
test eax, eax
je 0x401b17
mov eax, dword [0x2978080]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402490
mov edx, dword [0x2978080]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401af7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401a80
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401a90
add dword [0x297807c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x2978080]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401a80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401970
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401a0e
mov eax, dword [0x2978080]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401970
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401970
lea esi, [esi]
nop
Function at 0x401fd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x2978098
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x2978090]
sub esp, 4
test ebx, ebx
je 0x402025
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40201e
test esi, esi
je 0x40201e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402000
mov dword [esp], 0x2978098
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402350
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402375
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402380
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402375
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4023c8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4023be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4023ca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4023b0
xor eax, eax
pop ebx
pop esi
ret