joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb1826c
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax + 4], edx
xor esi, esi
mov ebx, 0xb6da48
mov al, byte [ebx]
dec eax
xor edx, edx
mov dl, al
mov ecx, edx
and ecx, 0x1f
push ecx
mov ecx, 0x1f
pop edi
sub ecx, edi
mov edi, 1
shl edi, cl
shr edx, 5
mov eax, dword [esp]
and edi, dword [eax + edx*4]
je 0xb182e7
mov eax, esi
and eax, 0x8000001f
jns 0xb182c6
dec eax
or eax, 0xffffffe0
inc eax
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
mov edx, esi
test edx, edx
jns 0xb182dd
add edx, 0x1f
sar edx, 5
mov ecx, dword [esp + 4]
or dword [ecx + edx*4], eax
inc esi
inc ebx
cmp esi, 0x30
jne 0xb18291
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xb18a2c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], eax
lea esi, [esp + 8]
mov edi, 0xb6de48
mov byte [esp + 4], 4
mov ebp, dword [esp]
add ebp, 2
mov cl, 4
mov edx, ebp
mov eax, edx
mov dword [esi], eax
mov eax, dword [esi]
movzx eax, byte [eax]
mov al, byte [edi + eax]
mov ebx, dword [esi]
mov byte [ebx], al
inc edx
dec cl
jne 0xb18a4e
add ebp, 4
dec byte [esp + 4]
jne 0xb18a4a
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb18a74
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], eax
lea esi, [esp + 8]
mov edi, 0xb6df48
mov byte [esp + 4], 4
mov ebp, dword [esp]
add ebp, 2
mov cl, 4
mov edx, ebp
mov eax, edx
mov dword [esi], eax
mov eax, dword [esi]
movzx eax, byte [eax]
mov al, byte [edi + eax]
mov ebx, dword [esi]
mov byte [ebx], al
inc edx
dec cl
jne 0xb18a96
add ebp, 4
dec byte [esp + 4]
jne 0xb18a92
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb18bc4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], eax
mov byte [esp + 8], 4
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0xc], eax
mov bl, 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0xb18be7
xor ebx, ebx
lea esi, [esp + 4]
mov eax, dword [esp + 0xc]
mov edi, eax
mov dl, byte [esi]
mov al, 2
call fcn.00b18b88
push eax
mov ebp, ebx
and ebp, 0xff
mov eax, ebp
inc eax
and eax, 3
mov dl, byte [esp + eax + 8]
mov al, 3
call fcn.00b18b88
pop edx
xor dl, al
mov eax, ebp
add eax, 2
and eax, 3
xor dl, byte [esp + eax + 4]
add ebp, 3
and ebp, 3
xor dl, byte [esp + ebp + 4]
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0xb18bff
inc dword [esp + 0xc]
dec byte [esp + 8]
jne 0xb18bdd
lea eax, [esp + 4]
mov edx, 4
call fcn.00b1778c
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xb18c68
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], eax
mov byte [esp + 8], 4
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0xc], eax
mov bl, 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0xb18c8b
xor ebx, ebx
lea esi, [esp + 4]
mov eax, dword [esp + 0xc]
mov edi, eax
mov dl, byte [esi]
mov al, 0xe
call fcn.00b18b88
push eax
mov ebp, ebx
and ebp, 0xff
mov eax, ebp
inc eax
and eax, 3
mov dl, byte [esp + eax + 8]
mov al, 0xb
call fcn.00b18b88
pop edx
xor dl, al
push edx
mov eax, ebp
add eax, 2
and eax, 3
mov dl, byte [esp + eax + 8]
mov al, 0xd
call fcn.00b18b88
pop edx
xor dl, al
push edx
add ebp, 3
and ebp, 3
mov dl, byte [esp + ebp + 8]
mov al, 9
call fcn.00b18b88
pop edx
xor dl, al
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0xb18ca3
inc dword [esp + 0xc]
dec byte [esp + 8]
jne 0xb18c81
lea eax, [esp + 4]
mov edx, 4
call fcn.00b1778c
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb18d3c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
lea ebp, [esp + 0x10]
mov byte [esp + 0xc], 0
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0x14], eax
xor eax, eax
mov al, byte [esp + 0xc]
add eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov edi, dword [edx + eax*4]
xor ebx, ebx
mov eax, dword [esp + 0x14]
mov esi, eax
mov eax, esi
mov dword [ebp], eax
mov edx, edi
mov eax, ebx
call fcn.00b18d28
mov edx, dword [ebp]
xor byte [edx], al
inc ebx
add esi, 4
cmp bl, 4
jne 0xb18d7a
inc byte [esp + 0xc]
inc dword [esp + 0x14]
cmp byte [esp + 0xc], 4
jne 0xb18d61
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb19f18
Capabilities:
Encode data using xor

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, ecx
dec eax
test eax, eax
jl 0xb19f3f
inc eax
mov edx, dword [esp + 4]
mov dl, byte [edx]
mov ecx, dword [esp]
xor byte [ecx], dl
inc dword [esp]
inc dword [esp + 4]
dec eax
jne 0xb19f2a
pop ecx
pop edx
ret
Function at 0xb1a14c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a155
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a12ef4
test esi, esi
jl 0xb1a1de
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a12ef4
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 0x100c]
xor byte [eax], dl
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a12ef4
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
mov byte [ebp + ebx - 0x200d], al
dec esi
inc dword [ebp - 0xc]
test esi, esi
jge 0xb1a18a
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b1778c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xb1a1f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a1fd
mov eax, dword [ebp - 4]
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x2014]
mov eax, dword [ebp + 0xc]
mov ecx, esi
call fcn.00a12ef4
cmp dword [ebp - 0x14], 0
jl 0xb1a295
lea edx, [ebp - 0x1014]
lea eax, [ebp - 0x2014]
mov ecx, esi
call fcn.00a12ef4
lea edx, [ebp - 0x1014]
mov ecx, esi
mov eax, dword [ebp - 0xc]
call dword [ebp + 0x14]
mov ecx, esi
dec ecx
lea edx, [ebp - 0x2014]
lea eax, [ebp - 0x2013]
call fcn.00a12ef4
mov eax, dword [ebp - 0x10]
mov bl, byte [eax]
mov byte [ebp + esi - 0x2015], bl
xor bl, byte [ebp - 0x1014]
mov eax, dword [ebp - 0x10]
mov byte [eax], bl
dec dword [ebp - 0x14]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x14], 0
jge 0xb1a23d
lea eax, [ebp - 0x1014]
mov edx, esi
call fcn.00b1778c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xb1a2ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a2b5
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a12ef4
test esi, esi
jl 0xb1a33f
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a12ef4
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 0x100c]
xor byte [eax], dl
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a12ef4
mov al, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
dec esi
inc dword [ebp - 0xc]
test esi, esi
jge 0xb1a2ea
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b1778c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xb1a354
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a35d
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a12ef4
test esi, esi
jl 0xb1a3e7
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a12ef4
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a12ef4
mov al, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 0x100c]
xor byte [eax], dl
dec esi
inc dword [ebp - 0xc]
test esi, esi
jge 0xb1a392
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b1778c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xb3a4b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0xb3a4c1
mov eax, dword [ebp - 4]
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa03c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xb3a988
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
lea eax, [ebp - 0x18]
call fcn.00a14db0
xor ecx, ecx
mov dl, 1
mov eax, dword [0xb090d0]
call fcn.00b0b048
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0xb3a95b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0b134
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0xb3a4b4
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0xb3a498
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x8c], edx
mov dword [eax + 0x88], 0xb3a49c
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x90]
mov dl, byte [0xb3a99c]
call fcn.00b0a508
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00aecc9c
test al, al
je 0xb3a598
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0a9a0
jmp 0xb3a5a6
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0aa20
mov eax, dword [ebp - 4]
movzx edx, word [eax + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00b0aaa0
xor eax, eax
push ebp
push 0xb3a60d
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0a960
jmp 0xb3a5f5
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [0xb74238]
mov eax, dword [eax]
call fcn.00a779d0
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x30], 0
jne 0xb3a603
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0xfa0
jbe 0xb3a5d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xb3a617
push ebx
push ecx
pushfd
mov ebx, 0xae9585a7
mov ecx, 0xcc37e19f
mov ebx, dword [esp + ecx + 0x33c81e69]
mov dword [esp + 8], 0x1768a7c
mov ecx, dword [esp + ecx*2 + 0x67903cc6]
call fcn.0183c184
out 0x12, eax
mov bl, 0x4a
adc eax, 0x4a6abf7d
dec edx
test byte [edx + ecx*8 + 0x41], ch
mov ch, 0x1c
mov edx, ds
mov edi, 0xea1ea7b5
mov ah, 0xb5
in eax, 0x59
mov al, 0x4a
cmp al, 0x61
sub eax, 0xbc9b542
cmp esi, dword [esi + 0x6224e4b5]
adc bh, byte [edx + 0x538d014a]
dec edx
inc eax
adc dword [0x18ffb551], ebp
xchg ebp, eax
mov cl, 0xb5
stc
imul ebp, dword [esi - 0x35b8f1c1], 0xffffffd9
push edi
pshufw mm5, qword [eax], 0xbb
jae 0xb3a6cb
mov esp, 0x61bce76
scasb al, byte es:[edi]
push 0x68
sub byte [edi], bh
and al, 0x33
adc eax, dword [esi - 0x305e7110]
int 0x74
pop esi
invalid
mov ebx, 0x9f739f09
jmp 0x890b1929
Function at 0xb4db90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [esi], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0x40
call fcn.00b4d3cc
test al, al
jne 0xb4dbcc
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4df90
mov dword [esi], 1
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x5a4d
je 0xb4dbee
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4df90
mov dword [esi], 2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
add eax, 0xf8
cdq
push edx
push eax
call fcn.00b4d3cc
test al, al
jne 0xb4dc1d
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4df90
mov dword [esi], 3
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x4550
je 0xb4dc57
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4df90
mov dword [esi], 4
mov eax, dword [ebp - 0x10]
cmp word [eax + 4], 0x14c
je 0xb4dc77
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4df90
mov dword [esi], 5
mov eax, dword [ebp - 0x10]
test byte [eax + 0x38], 1
je 0xb4dc95
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4df90
mov dword [esi], 6
xor eax, eax
push ebp
push 0xb4df7b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.017f2792
cmc
add dword [edx - 0x16], ecx
push ebp
out dx, eax
sti
dec edx
les ebx, [esi + edi]
int1
clc
dec edx
std
movsd dword es:[edi], dword [esi]
push ecx
mov ch, 0x5b
mov ch, 0xbb
iretd
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0xb5ea24
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0xb5ea2c
push ecx
push ebx
push esi
mov eax, 0xb5e3cc
call fcn.00a17380
mov esi, dword [0xb74238]
xor eax, eax
push ebp
push 0xb5ebfe
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00a13098
cmp eax, 2
jne 0xb5eabd
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00a13100
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.00a19d98
call fcn.00aef5ac
mov ebx, 0x64
lea edx, [ebp - 0x18]
mov eax, 2
call fcn.00a13100
mov eax, dword [ebp - 0x18]
call fcn.00a15280
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.00a13100
mov eax, dword [ebp - 0x1c]
call fcn.00a1a250
test al, al
je 0xb5eabd
push 0xa
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0xb5ea7f
mov al, byte [0xb5ec0c]
push eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00a13100
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, 0xb5ec18
call fcn.00a1f378
mov eax, dword [ebp - 0x20]
call fcn.00a15280
push eax
push 0
push 0
call fcn.00a176e8
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0xb5eb34
push 0x40
push 0xb5ec1c
lea edx, [ebp - 0x2c]
mov eax, dword [0xb7431c]
call fcn.00a170b0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00ad11c0
mov eax, dword [ebp - 0x28]
call fcn.00a15280
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0xb5ebe3
mov dl, 1
mov eax, dword [0xa29c6c]
call fcn.00a13f14
mov edx, dword [0xb74230]
mov dword [edx], eax
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00aec164
test al, al
jne 0xb5eb66
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00a13f44
jmp 0xb5ebe3
mov eax, dword [esi]
call fcn.00a77af4
lea edx, [ebp - 0x34]
mov eax, dword [esi]
call fcn.00a7824c
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00a1a6a4
mov eax, dword [ebp - 0x30]
call fcn.00a1a9f8
mov ecx, dword [0xb74070]
mov eax, dword [esi]
mov edx, dword [0xb50264]
call fcn.00a77b0c
mov ecx, dword [0xb743f4]
mov eax, dword [esi]
mov edx, dword [0xb5d2c8]
call fcn.00a77b0c
mov ecx, dword [0xb74108]
mov eax, dword [esi]
mov edx, dword [0xb5c4cc]
call fcn.00a77b0c
mov ecx, dword [0xb742d4]
mov eax, dword [esi]
mov edx, dword [0xb5b52c]
call fcn.00a77b0c
mov eax, dword [esi]
call fcn.00a77b8c
push ebx
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb5ec05
lea eax, [ebp - 0x34]
mov edx, 9
call fcn.00a14dd4
ret

Function at 0x17d6fd8
Capabilities:
Authenticate hmac

Disassembly:
neg eax
mov dword [esp + edx - 0x5930bf51], 0xe2839e8e
inc word [esp + edx - 0x5930bf51]
shl word [esp + edx - 0x5930bf50], 0xc5
xor ebx, eax
ror dx, 9
sar ecx, cl
sets cl
adc edi, eax
or edx, ecx
bswap edx
mov ecx, dword [esi]
call fcn.017d827b
Function at 0x17dac97
Capabilities:
Encode data using base64

Disassembly:
push ebx
pushfd
mov ebx, 0x3f9418af
cmp bl, 0x39
mov dword [esp + 8], 0xbc53272c
mov ebx, dword [esp + ebx*2 - 0x7f28315a]
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.01803d1d
mov dword [esi + eax*2 - 0x200], edx
ror ecx, 0xe1
mov eax, dword [edi + eax - 0x100]
movzx edx, cx
setb dl
xor edx, ecx
lea edi, [edi + ecx*2 - 0xfffc]
jle 0x182ae4b
setg dl
jle 0x181364a

Function at 0x184db1f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
jmp 0x1847933
sal cx, 0xad
or dl, al
jmp 0x17ff9c9
ror cx, 0x8f
mov word [esi + ecx*2 - 0x25c48000], dx
not cx
xadd word [esp + ecx - 0x12e2bfff], cx
sete byte [esp + ecx - 0x12e20302]
mov dword [esp + ecx - 0x12e20302], edi
ret
not al
inc dword [esp + ecx - 0x12e20371]
jno 0x17e2430
dec ax
xor ebx, edx
add edi, edx
neg eax
movzx dx, byte [esi + ecx - 0x79c30301]
mov al, byte [ecx + esi - 0x79c302ff]
lea esi, [esi + ecx - 0x79c302ff]
xor dword [esp + ecx - 0x79c30301], ecx
xchg dword [esp + ecx - 0x79c30301], ecx
not dl
jno 0x18450bc
call fcn.01855ae7
and word [esp], dx
xor ecx, 0xbaaa80
sub ecx, 0x37bb7d19
rol word [esp + 9], 0x6c
mov word [esp + 5], 0x6484
call fcn.017bbe49
neg edx
jmp 0x17b9d79

Function at 0x1860e84
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + 8], 0x350d35fe
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.01794ffa

Function at 0x1862bcb
Capabilities:
Encode data using xor

Disassembly:
xor edx, 0x4a049cbf
lea edx, [edx + ecx + 0x3834ee16]
sar ecx, cl
sub ecx, 0xa18b6839
bswap edx
pop ecx
xor edx, 0xd634aeb8
call fcn.0183278d
xor ecx, ebx
bswap edx
rol ecx, 3
not ecx
neg ecx
add edx, edx
ror edx, 0x12
lea ecx, [ecx + edx*2 + 0xd5341e]
call fcn.0185df80
mov ecx, 0xe9bddf12
movzx edx, cl
mov eax, 0x5825c298
mov ecx, dword [edi + edx*4 - 0x48]
lea edi, [edi + edx*4 - 0x44]
inc ax
setno dl
xor dx, ax
xor ecx, ebx
call fcn.01832477
xor edx, 0x782326a9
pop eax
or word [esp + 1], ax
xchg byte [esp + 2], al
xor ebx, edx
add edi, edx
add ax, 0xfdb3
movzx edx, al
not dword [esp + edx - 0x6d]
mov eax, ebp
pop edx
sub ebp, 2
mov ecx, edx
push edx
mov word [ebp], ax
not dx
add byte [esp], dh
movsx eax, word [esp]
pop ecx
jns fcn.0183a37c
mov ecx, dword [esi]
push 0x9980673b
mov edx, dword ss:[ecx]
mov eax, 0xba0131b1
movzx ecx, ax
mov dword [esi + ecx - 0x31b1], edx
mov edx, dword [edi + ecx - 0x31b1]
sub ecx, dword [esp + ecx*2 - 0x6362]
lea eax, [eax*4 + 0x6f32fcbe]
lea edi, [edi + ecx - 0x667fca72]
sal eax, 0x59
jb 0x18347a6
not ax
xor edx, ebx
jmp 0x177d690
call fcn.01823982
call fcn.018467bc
mov ecx, 0xbc3b928b
mov edx, ecx
mov eax, dword [esi]
mov cl, byte [esi + 4]
add esi, 2
shr eax, cl
mov dword [esi], eax
sub edi, 4
shr dl, 6
mov ecx, dword [edi]
jne 0x17a1e60
Function at 0x1869168
Capabilities:
Encode data using xor

Disassembly:
add esi, 8
mov dword ss:[edx], eax
ror ecx, 0x12
movzx edx, cl
lea edi, [edx + edi - 0x6f]
lea eax, [ecx*4 - 0x33c6eb55]
mov edx, dword [edi + edx - 0x6b]
sub ecx, ecx
xor edx, ebx
call fcn.0182f471
call fcn.017a768b
push 0xda1e5a02
pushfd
xor dword [esp + 4], 0x4b2c299f
jo fcn.01869168
mov dword [esp + 8], 0x15703b6b
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.017746e0
mov edx, 0x1daef79e
lea eax, [edx*4 - 0x686a56c9]
mov edx, dword [esi + edx - 0x1daef79e]
movzx ecx, al
shr ax, cl
sub ecx, eax
mov eax, dword [esi + eax*2 - 0x1ca1fffe]
jno 0x179f30a
Function at 0x402d88
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402dc5
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402de5
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404f00
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x403060
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404c90
test esi, esi
jne 0x403097
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404d80
jmp 0x4030b8
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402efc
mov dword [esp], eax
test esi, esi
je 0x4030b8
cmp dword [ebx], 0
je 0x4030b8
dec esi
jmp 0x40309f
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4036e0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4fe008], 0x8088405
inc edx
mov dword [ebx + 0x4fe008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4fe024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403d68
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403d48
xor eax, eax
push ebp
push 0x403d41
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403d84
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403d48
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4fe024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4fe024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404a88
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x50f04c], 0
je 0x404ae9
cmp word [0x50f220], 0xd7b2
jne 0x404ab1
cmp dword [0x50f228], 0
jbe 0x404ab1
mov eax, 0x50f21c
call dword [0x50f238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4fe074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404b10
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4fe034], 0
jne 0x404b05
push 0
push 0x4fe06c
push 0x4fe074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404c44
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402b50
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x50f04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404c0c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc