joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9231
Capabilities:
Encode data using xor

Disassembly:
invalid
insd dword es:[edi], dx
invalid
test byte [edi - 0x1e], 0x54
xchg ecx, eax
and eax, 0x1bb378d
test eax, 0x4ae15b6c
bnd js 0x4d91c2
fst qword [di]
scasd eax, dword es:[edi]
add edi, dword [ecx - 0x64df75cf]
shl byte [esi + ecx*8 + 0x76], 1
cld
xor dword [edx + 0x64d09b20], ecx
into
into
jbe 0x4d9201
sub al, 0xec
push edi
wait
and dword [edi - 0x5af248c4], eax
pop ds
push esp
call 0xc4be8d57
outsd dx, dword [esi]
aad 0x1d
cmpsb byte [esi], byte es:[edi]
push edi
mov ecx, 0xcfe9bdef
neg byte [edi + 0x3e]
dec esi
sub eax, 0xae28c723
out dx, eax
salc
inc ebx
out 0xee, eax
ja 0x4d91fc
je 0x4d91e1
scasd eax, dword es:[edi]
inc ebx
sub byte [ebp + 0x64d3c311], ah
lahf
or eax, 0xabafe88d
mov ebp, 0xd5145a54
mov ah, 0x42
mov dh, 0x6c
rcr dword [0x6b87408f], 0xab
jb 0x4d91e4
pop esp
add eax, 0x3faf03cf
mov ecx, 0xb0b7dd2e
cmp edi, edi
push ds
popfd
loop 0x4d92c6
pop ecx
or al, 0xf4
and dh, ch
insb byte es:[edi], dx
xchg esp, eax
rol dword [eax - 0x76], cl
frstor dword [esp - 0x20fd14ce]
test byte [edi + edx*2], bl
shl byte [edi], 1
int 0x89
loopne fcn.004d9231
fstp qword [ebp - 0x5c]
add al, 0x21
mov ah, 0x91
call 0x859eb706
and bl, ah
mov edi, 0x19a9efb5
imul ebx, dword [ebx + esi*4 - 0x58090baf], 0x5fa01c4f
pushal
les ebp, [ebx + 0xa]
outsd dx, dword [esi]
invalid
hlt
pop ss
rcpps xmm5, xmm3
mov ebp, 0xbaffb4f9
xor byte [esi - 0x70], 1
mov esp, 0x4d2740d7
aaa
invalid
aam 0x8d
out 0x28, al
sbb eax, ebx
sub al, 0xa6
push ebx
aaa
imul esi, edi, 0x62aa178e
in al, dx
adc byte [ebp - 0x4e9bf1ae], ah
inc edi
in eax, 0xb5
loop 0x4d92a8
sti
lcall 0x382e, 0xa7fc49cf
in eax, dx
push esp
bsf edx, dword [esp + edi]
add dword [esi - 0x10], esi
xor dword [edi - 0x1c], ecx
in al, dx
cmp dword [edi + 0x37], ebp
mov ah, 0x3d
mov esi, 0x5d3c9347
dec esp
daa
insb byte es:[edi], dx
loopne 0x4d9294
mov byte [edi - 0x39], bl
stosw word es:[edi], ax
add al, 0xb9
sub al, 0xfb
pop ds
stosb byte es:[edi], al
call [ebx - 0x56]
cmp ecx, dword [edi]
adc ebx, dword [edi]
pop ds
add dh, bl
cmp dword [0x8fedac44], ecx
mov bh, 0x62
inc esp
cld
out dx, al
insd dword es:[edi], dx
pop ss
xor al, 0xd7
lahf
mov eax, 0xe73fb30c
push ebx
scasd eax, dword es:[edi]
jl 0x4d9319
mov bh, 0xef
mov byte [0x3f8c44dd], al
fadd dword [edx + esi - 0x5c]
and al, byte [edx]
push eax
invalid
Function at 0x4e1420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
je 0x4e143b
cmp dword [ebp - 8], 0
jne 0x4e1445
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4e15a7
xor dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xc], 8
jb 0x4e156c
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x5bea58]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 1]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x5bea58]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 2]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x5bea58]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 3]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x5bea58]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 4]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x5bea58]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 5]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x5bea58]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 6]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x5bea58]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 7]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x5bea58]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
add dword [ebp - 8], 8
sub dword [ebp - 0xc], 8
cmp dword [ebp - 0xc], 8
jae 0x4e1453
cmp dword [ebp - 0xc], 0
jbe 0x4e159e
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x5bea58]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
inc dword [ebp - 8]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
ja 0x4e1572
mov eax, dword [ebp - 4]
xor eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4e7fc7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov esi, dword [esi + 0x53ecc400]
push esi
push edi
mov dword [ebp], ecx
add dword [ebp - 8], edx
mov dword [ebp - 4], eax
jp 0x4e7fdb
cld
cmp dword [ebp - 0xc], 0
je 0x4e80e6
mov eax, dword [ebp - 8]
xor eax, 0xca8b1000
sub cl, 0xa
je 0x4e7ff3
add ecx, ecx
je 0x4e8012
dec cl
jns 0x4e7ffb
sub cl, 6
je 0x4e8022
jmp 0x4e8056
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.004d802f
jmp 0x4e8247
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call int.004d8041
jmp 0x4e8247
movzx ecx, byte [eax - 0x29]
add al, cl
mov dword [ebp - 0x10], ecx
movzx eax, dl
add byte [ecx], al
add ebx, esi
cmp eax, 9
mov dh, 0
cmp edx, 0
cmp eax, 9
ja 0x4e8158
movzx eax, byte [eax]
add ebp, edx
inc eax
add bh, bh
and al, 0x88
add ch, dl
inc eax
add byte [ecx], al
add al, byte [ebx]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add bh, byte [ebp + 0x6c]
add byte [eax], al
inc ecx
aad 0x40
add byte [ecx - 0x2b], bl
add byte [ecx], al
aad 0x40
add byte [eax - 0xb], dh
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 6]
add byte [ecx], al
invalid
mov al, 0xd4
add byte [esp + ebx*4 + 0x4dffffff], bh
hlt
mov eax, ebx
xlatb
add byte [ebx - 0x75], bl
in eax, 0x5d
ret

Function at 0x532f37
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov esi, dword [esi + 0x53ecc400]
push esi
push edi
mov dword [ebp], ecx
add dword [ebp - 8], edx
mov dword [ebp - 4], eax
jp 0x532f4b
cld
cmp dword [ebp - 0xc], 0
je 0x533056
mov eax, dword [ebp - 8]
xor eax, 0xca8b1000
sub cl, 0xa
je 0x532f63
add ecx, ecx
je 0x532f82
dec cl
jns 0x532f6b
sub cl, 6
je 0x532f92
jmp 0x532fc6
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.00522f9f
jmp 0x5331b7
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.00522fb1
jmp 0x5331b7
movzx ecx, byte [eax - 0x29]
add al, cl
mov dword [ebp - 0x10], ecx
movzx eax, dl
add byte [ecx], al
add ebx, esi
cmp eax, 9
mov dh, 0
cmp edx, 0
cmp eax, 9
ja 0x5330c8
movzx eax, byte [eax]
add ebp, edx
inc eax
add bh, bh
and al, 0x88
add ch, dl
inc eax
add byte [ecx], al
add al, byte [ebx]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add bh, byte [ebp + 0x6c]
add byte [eax], al
inc ecx
aad 0x40
add byte [ecx - 0x2b], bl
add byte [ecx], al
aad 0x40
add byte [eax - 0xb], dh
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 6]
add byte [ecx], al
invalid
mov al, 0xd4
add byte [esp + ebx*4 + 0x4dffffff], bh
hlt
mov eax, ebx
xlatb
add byte [ebx - 0x75], bl
in eax, 0x5d
ret
Function at 0x53ec13
Capabilities:
Encode data using xor

Disassembly:
cld
dec esi
push esi
lea ebp, [0xec614fb2]
pushal
getsec
out dx, eax
jmp 0xf9459f6b
mov ebp, 0x635c7e33
push eax
sub al, 0xce
push esi
xor edx, dword [ebx]
aaa
jno 0x53eb5e
outsb dx, byte [esi]
int3
int 0x67
xorps xmm1, xmmword [esi + 0xc]
ficomp word [ebx]
mov fs, word [ecx]
popfd
mov bl, 0x52
aad 0xbe
pop ebp
xchg esp, eax
mov eax, dword [0xe7725dd7]
xlatb
pop ebp
jb 0x53ebfe
xlatb
pop ebp
jb 0x53ebfe
pop esp
jb 0x53eb9c
adc dword [0x34d96add], eax
or eax, 0x9c1ca62d
cmp al, 0x1f
inc edx
jl 0x53ec7f
adc ah, byte [edx - 0x46]
add dword [edx], 0x157d0db2
pushfd
dec esi
ljmp 0xd7d3
mov dword [0x6688ae70], eax
in al, dx
inc edx
add esp, esi
aas
xchg ebx, eax
push es
in al, dx
sbb eax, 0xd3bd2dbd
invalid

Function at 0x56efb1
Capabilities:
Encode data using xor

Disassembly:
rol dword [ecx + 0x24ff9ce9], 1
fisubr dword [0x4ac0e6b9]
cld
ror edx, 0x1f
rol byte [edx - 0x54], cl
dec esp
push ebp
dec edi
push edx
cmpsb byte [esi], byte es:[edi]
and bh, byte [edi + 0x43]
outsb dx, byte [esi]
out dx, al
insb byte es:[edi], dx
jle 0x56f03b
adc ah, ch
dec bh
mov ah, 0x45
cld
sub al, 0x7f
push ebp
mulps xmm7, xmmword [edi - 0x7def771d]
mov edi, 0x78d0944b
movsd dword es:[edi], dword [esi]
sti
aas
aaa
inc edi
sbb al, 0x65
imul edi, dword [ebp - 0x5857ec0e], 0xffffff88
loopne 0x56f010
push ebx
adc byte [edi + 0x16f270b0], al
outsd dx, dword [esi]
inc esi
sub al, byte [edx + 0x2f]
in al, dx
invalid
out dx, eax
add dword [ebx], ebp
invalid
mov dword [ecx], edi
add ebp, dword [edi]
stc
jg 0x56f085
add dword [esi - 9], 0xffffffe3
mov ds, word [edx + ebx*8]
iretd
in eax, 7
invalid

Function at 0x57dd47
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov esi, dword [esi + 0x53ecc400]
push esi
push edi
mov dword [ebp], ecx
add dword [ebp - 8], edx
mov dword [ebp - 4], eax
jp 0x57dd5b
cld
cmp dword [ebp - 0xc], 0
je 0x57de66
mov eax, dword [ebp - 8]
xor eax, 0xca8b1000
sub cl, 0xa
je 0x57dd73
add ecx, ecx
je 0x57dd92
dec cl
jns 0x57dd7b
sub cl, 6
je 0x57dda2
jmp 0x57ddd6
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.0056ddaf
jmp 0x57dfc7
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.0056ddc1
jmp 0x57dfc7
movzx ecx, byte [eax - 0x29]
add al, cl
mov dword [ebp - 0x10], ecx
movzx eax, dl
add byte [ecx], al
add ebx, esi
cmp eax, 9
mov dh, 0
cmp edx, 0
cmp eax, 9
ja 0x57ded8
movzx eax, byte [eax]
add ebp, edx
inc eax
add bh, bh
and al, 0x88
add ch, dl
inc eax
add byte [ecx], al
add al, byte [ebx]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add bh, byte [ebp + 0x6c]
add byte [eax], al
inc ecx
aad 0x40
add byte [ecx - 0x2b], bl
add byte [ecx], al
aad 0x40
add byte [eax - 0xb], dh
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 6]
add byte [ecx], al
invalid
mov al, 0xd4
add byte [esp + ebx*4 + 0x4dffffff], bh
hlt
mov eax, ebx
xlatb
add byte [ebx - 0x75], bl
in eax, 0x5d
ret
Function at 0x5c93d7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov esi, dword [esi + 0x53ecc400]
push esi
push edi
mov dword [ebp], ecx
add dword [ebp - 8], edx
mov dword [ebp - 4], eax
jp 0x5c93eb
cld
cmp dword [ebp - 0xc], 0
je 0x5c94f6
mov eax, dword [ebp - 8]
xor eax, 0xca8b1000
sub cl, 0xa
je 0x5c9403
add ecx, ecx
je 0x5c9422
dec cl
jns 0x5c940b
sub cl, 6
je 0x5c9432
jmp 0x5c9466
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.005b943f
jmp 0x5c9657
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.005b9451
jmp 0x5c9657
movzx ecx, byte [eax - 0x29]
add al, cl
mov dword [ebp - 0x10], ecx
movzx eax, dl
add byte [ecx], al
add ebx, esi
cmp eax, 9
mov dh, 0
cmp edx, 0
cmp eax, 9
ja 0x5c9568
movzx eax, byte [eax]
add ebp, edx
inc eax
add bh, bh
and al, 0x88
add ch, dl
inc eax
add byte [ecx], al
add al, byte [ebx]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add bh, byte [ebp + 0x6c]
add byte [eax], al
inc ecx
aad 0x40
add byte [ecx - 0x2b], bl
add byte [ecx], al
aad 0x40
add byte [eax - 0xb], dh
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 6]
add byte [ecx], al
invalid
mov al, 0xd4
add byte [esp + ebx*4 + 0x4dffffff], bh
hlt
mov eax, ebx
xlatb
add byte [ebx - 0x75], bl
in eax, 0x5d
ret

Function at 0x614267
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov esi, dword [esi + 0x53ecc400]
push esi
push edi
mov dword [ebp], ecx
add dword [ebp - 8], edx
mov dword [ebp - 4], eax
jp 0x61427b
cld
cmp dword [ebp - 0xc], 0
je 0x614386
mov eax, dword [ebp - 8]
xor eax, 0xca8b1000
sub cl, 0xa
je 0x614293
add ecx, ecx
je 0x6142b2
dec cl
jns 0x61429b
sub cl, 6
je 0x6142c2
jmp 0x6142f6
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.006042cf
jmp 0x6144e7
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.006042e1
jmp 0x6144e7
movzx ecx, byte [eax - 0x29]
add al, cl
mov dword [ebp - 0x10], ecx
movzx eax, dl
add byte [ecx], al
add ebx, esi
cmp eax, 9
mov dh, 0
cmp edx, 0
cmp eax, 9
ja 0x6143f8
movzx eax, byte [eax]
add ebp, edx
inc eax
add bh, bh
and al, 0x88
add ch, dl
inc eax
add byte [ecx], al
add al, byte [ebx]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add bh, byte [ebp + 0x6c]
add byte [eax], al
inc ecx
aad 0x40
add byte [ecx - 0x2b], bl
add byte [ecx], al
aad 0x40
add byte [eax - 0xb], dh
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 6]
add byte [ecx], al
invalid
mov al, 0xd4
add byte [esp + ebx*4 + 0x4dffffff], bh
hlt
mov eax, ebx
xlatb
add byte [ebx - 0x75], bl
in eax, 0x5d
ret
Function at 0x6597ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x661418
cmp edx, dword [eax]
je 0x6597cf
add eax, 8
inc ecx
cmp eax, 0x6614a8
jl 0x6597c0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x661418]
jne 0x6598fd
mov eax, dword [0xa5bf78]
cmp eax, 1
je 0x6598d7
test eax, eax
jne 0x659800
cmp dword [0x661344], 1
je 0x6598d7
cmp edx, 0xfc
je 0x6598fd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659837
lea eax, [ebp - 0x1a4]
push 0x65e978
push eax
call fcn.0065a190
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a620
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x65987a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a620
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65e974
push edi
call fcn.0065c4f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65e958
push eax
call fcn.0065a190
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a1a0
lea eax, [ebp - 0xa0]
push 0x65e954
push eax
call fcn.0065a1a0
push dword [esi + 0x66141c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a1a0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65e92c
push eax
call fcn.0065c464
add esp, 0x2c
pop edi
jmp 0x6598fd
lea eax, [ebp + 8]
lea esi, [esi + 0x66141c]
push 0
push eax
push dword [esi]
call fcn.0065a620
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x756190
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x73d015
lea edi, [esi - 0x33c015]
push edi
jmp 0x7561aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7561b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7561a0
mov eax, 1
add ebx, ebx
jne 0x7561c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7561d4
jne 0x7561f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7561f3
dec eax
add ebx, ebx
jne 0x7561e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7561b8
add ebx, ebx
jne 0x7561ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x756245
xor ecx, ecx
sub eax, 3
jb 0x75620b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x75627a
sar eax, 1
mov ebp, eax
jmp 0x756216
add ebx, ebx
jne 0x756216
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7561e4
inc ecx
add ebx, ebx
jne 0x756224
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7561e4
add ebx, ebx
jne 0x756231
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x756226
jne 0x756242
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x756226
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x756264
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x756256
jmp 0x7561a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x756264
add edi, ecx
jmp 0x7561a6
pop esi
mov edi, esi
mov ecx, 0x1225
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x756282
cmp byte [edi], 0xd
jne 0x756282
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x756287
lea edi, [esi + 0x354000]
mov eax, dword [edi]
or eax, eax
je 0x7562f6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x35dcb0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x35dd64]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7562b4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x35dd68]
or eax, eax
je 0x7562f0
mov dword [ebx], eax
add ebx, 4
jmp 0x7562d1
call dword [esi + 0x35dd78]
mov ebp, dword [esi + 0x35dd6c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x75632a
sub esp, 0xffffff80
jmp 0x4012a0
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4dc517]
shl eax, 2
mov dword [0x4dc51b], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004935ac
pop edx
call fcn.00493510
call fcn.004935ec
push 0
call fcn.00494868
pop ecx
push 0x4dc4c0
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4dc51f], eax
push 0
jmp fcn.0049a950

Function at 0x408bd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
mov eax, dword [0x4f71d4]
mov eax, dword [eax]
call fcn.0044b630
call sub.KERNEL32.DLL_GetTickCount
mov edx, eax
sub edx, ebx
cmp esi, edx
jbe 0x408bf8
cmp eax, ebx
jae 0x408bdb
pop esi
pop ebx
ret

Function at 0x408bfc
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x408c26
push 5
push 0
push 0
mov eax, ebx
call fcn.00490734
push eax
push 0x408c28
mov eax, dword [0x4f71d4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.SHELL32.DLL_ShellExecuteA
pop ebx
ret
Function at 0x412324
Capabilities:
Check http status code

Disassembly:
les ecx, [esi + eax*2]
add byte [eax + ebx*4 + 0x6f2c0045], ah
inc edi
add al, ch
xor byte [ecx], al
pop eax
jo 0x41237c
add byte [eax + esi*4], ch
inc ebp
add byte [eax - 0x67ffba85], bl
fiadd dword [edi]
adc dh, dl
inc edi
add ah, dh
aad 0x47
add byte [eax - 0x7fffb826], dh
sub al, 0x41
add byte [eax + 0x4004606], bh
or eax, 0xbe00046
inc esi
add byte [eax - 0x3bffba01], dl
inc dword [ebp]
aam 0xfb
inc ebp
add ah, al
insb byte es:[edi], dx
inc ebp
add ah, bl
insb byte es:[edi], dx
inc ebp
add byte [ecx + ebp*4], bh
inc ebp
add byte [eax + 0x400045a9], al
inc eax
outsd dx, dword [esi]
inc ebp
add byte [eax + 0x7d], ch
inc ebp
add byte [eax - 0x3ffba84], ch
add dword [ebp], 0x457f74
sub al, 0xcb
inc ebp
add byte [edx + ebp*4 + 0x45], dl
add byte [esp + edi*8 + 0x45], al
add al, dh
cld
inc ebp
add byte [eax], bl
test byte [ebp], 0xc8
cld
inc ebp
add byte [eax + esi*4 - 0x4907ffbb], ah
inc ebp
add byte [ebp + eax*8 + 0x45], al
add byte [eax], ch
xor al, 0x42
add byte [eax], dl
xor eax, 0x35a00042
inc edx
add byte [esp + eax*8 + 0x45], dh
add byte [esi + esi + 0x42], al
add byte [esi + edi*8 - 0x2f8fffbb], dl
inc ebp
add byte [ecx + edi*8 - 0x24fffbb], ah
inc ebp
add byte [eax + 0x2e], bh
inc edx
add ah, dl
xor dword [edx], eax
jl 0x412413
inc edx
add byte [eax + 0x8004233], al
xor al, byte [edx]
test al, 0x31
inc edx
add byte [eax + 0x32], dh
inc edx
add ah, bl
xor al, byte [edx]
or al, byte [eax]
or al, 0xb0
push cs
mov al, 0x13
mov al, 0x14
mov al, 7
add byte [eax], cl
add byte [ebx + 0x24008500], al
mov al, 9
mov al, 0xc
xor dword [ecx], eax
dec esp
xor dword [ecx], eax
sbb al, 0x30
inc ecx
add byte [eax + esi + 0x41], dl
add byte [ecx + esi + 0x31b40041], al
inc ecx
add ah, ah
xor dword [ecx], eax
adc byte [edx], dh
inc ecx
add ah, al
sub eax, 0x2e380041
inc ecx
add byte [edi], cl
push esp
inc ebx
jne 0x4124ae
je 0x4124ac
insd dword es:[edi], dx
inc esi
insb byte es:[edi], dx
popal
je 0x412488
imul esi, dword fs:[eax + edx*4 - 0x70], sym.chemax.exe___xp_29Tflateditunit_TCustomFlatEdit
test al, 0x25
inc ecx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x20004125], bl
add al, byte [eax]
add al, bl
and al, byte [ecx]
push eax
fiadd dword [edi]
fdiv st(7)
dec eax
add byte [eax + edx*8], ah
and al, 0xd0
inc edi
add al, dh
test dword [eax], 0x4237c8
invalid
Function at 0x4175a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x417721
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4176fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x119], 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x105
lea eax, [ebp - 0x119]
push eax
lea eax, [ebp - 0x120]
mov dl, byte [ebp - 1]
call fcn.00490498
lea eax, [ebp - 0x120]
mov edx, 0x417734
call fcn.00490578
mov eax, dword [ebp - 0x120]
call fcn.00490734
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x417660
lea eax, [ebp - 0x119]
call fcn.00486aa8
mov ecx, eax
lea edx, [ebp - 0x119]
mov eax, dword [ebp - 8]
call fcn.004903b0
jmp 0x417668
mov eax, dword [ebp - 8]
call fcn.004902c8
cmp byte [ebp - 1], 0x61
jae 0x41768e
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0048ac78
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 8]
call fcn.0049031c
jmp 0x4176ac
lea edx, [ebp - 0x128]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0048aba4
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 8]
call fcn.0049031c
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x134], eax
mov byte [ebp - 0x130], 0xb
lea edx, [ebp - 0x134]
xor ecx, ecx
mov eax, 0x417740
call fcn.0048731c
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp - 8]
call fcn.0049031c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417703
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret

Function at 0x41b238
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00490734
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x41b25e
test byte [ebp - 0xc], 0x10
jne 0x41b262
xor eax, eax
jmp 0x41b264
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret