joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000df40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038a46
mov eax, dword fs:[0]
push eax
sub esp, 0xb20
mov eax, dword [0x10045ca0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x100471dc
mov dword [ebp - 0xb2c], 0x100471dc
call fcn.10036879
mov byte [ebp - 0xb28], 1
lea eax, [ebp - 0xb20]
push eax
push 1
xor ebx, ebx
push ebx
push str.SoftwarecomScoreConfidence
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x1000e163
mov ecx, dword [ebp - 0xb20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x410]
push 0x3ff
push ecx
call fcn.10016637
add esp, 0x10
lea edx, [ebp - 0x9fc]
push edx
mov byte [ebp - 0x11], bl
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x9ee]
movzx edx, word [ebp - 0x9f0]
lea eax, [ebp - 0x410]
push eax
movzx eax, word [ebp - 0x9f2]
push ecx
movzx ecx, word [ebp - 0x9f4]
push edx
movzx edx, word [ebp - 0x9fc]
push eax
movzx eax, word [ebp - 0x9f6]
push ecx
movzx ecx, word [ebp - 0x9fa]
push edx
push eax
push ecx
push str._02d__02d__04d__02d:_02d:_02d._03d__s
lea edx, [ebp - 0x9ec]
push 0x5dc
push edx
call fcn.100164c0
add esp, 0x2c
push 3
lea ecx, [ebp - 0x9ec]
lea eax, [ebp - 0xb18]
push ecx
lea ecx, [ebp - 0xb1c]
mov dword [ebp - 0xb1c], eax
call fcn.1000d660
xor edx, edx
mov word [ebp - 0xa18], dx
mov edx, dword [ebp - 0xb1c]
mov eax, edx
mov byte [ebp - 4], 1
mov dword [ebp - 0xa04], 7
mov dword [ebp - 0xa08], ebx
lea esi, [eax + 2]
jmp 0x1000e090
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1000e090
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0xa18]
call fcn.1000ddd0
mov eax, dword [ebp - 0xb1c]
lea ecx, [ebp - 0xb18]
cmp eax, ecx
je 0x1000e0c5
push eax
call fcn.1001162a
add esp, 4
cmp dword [0x10047208], 0x10
mov eax, dword [0x100471f4]
jae 0x1000e0d8
mov eax, 0x100471f4
push ebx
push 0x80
push 4
push ebx
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
push ebx
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0xa04], 8
mov eax, dword [ebp - 0xa18]
jae 0x1000e111
lea eax, [ebp - 0xa18]
mov ecx, dword [ebp - 0xa08]
push ebx
lea edx, [ebp - 0xb24]
push edx
lea edx, [ecx + ecx]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xa04], 8
jb 0x1000e14a
mov eax, dword [ebp - 0xa18]
push eax
call fcn.100103f6
add esp, 4
xor ecx, ecx
mov dword [ebp - 0xa04], 7
mov dword [ebp - 0xa08], ebx
mov word [ebp - 0xa18], cx
mov ecx, 0x100471dc
mov dword [ebp - 4], 0xffffffff
call fcn.1003688e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001105b
mov esp, ebp
pop ebp
ret
Function at 0x1000e190
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038a80
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x10045ca0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x70]
call fcn.1000eb70
xor ebx, ebx
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], ebx
call fcn.1000e940
test al, 1
jne 0x1000e1e7
lea ecx, [ebp - 0x70]
call fcn.1000eb50
test al, 8
je 0x1000e34c
lea eax, [ebp - 0x5c]
push eax
push 0x20006
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist75048700_EF1F_11D0_9888_006097DEACF9Count
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x1000e34c
push ebx
call fcn.100159d8
lea ecx, [ebp - 0x64]
push ecx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
call fcn.100159b1
push eax
push str._m__d__y__H__M__S
lea edx, [ebp - 0x3c]
push 0x19
push edx
call fcn.100175c0
add esp, 0x18
push 0x26
push str.UEME_RUNPATH:C:ConfidenceConfidence_
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x58], bl
call fcn.10007470
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.10002210
push 4
push str._at
lea ecx, [ebp - 0x58]
call fcn.10002360
lea eax, [ebp - 0x3c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1000e273
sub eax, ecx
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x58]
call fcn.10002360
push 4
push str..exe
lea ecx, [ebp - 0x58]
call fcn.10002360
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x58]
mov esi, ecx
cmp eax, 0x10
jae 0x1000e2d0
lea esi, [ebp - 0x58]
mov edx, esi
mov edi, dword [ebp - 0x48]
add edi, edx
cmp eax, 0x10
jae 0x1000e2b7
lea ecx, [ebp - 0x58]
cmp ecx, edi
je 0x1000e2ec
sub esi, ecx
lea ecx, [ecx]
mov al, byte [ecx]
lea edx, [eax - 0x41]
cmp dl, 0x19
ja 0x1000e2d4
add al, 0xd
cmp al, 0x5a
jmp 0x1000e2e0
mov edx, ecx
jmp 0x1000e2aa
lea edx, [eax - 0x61]
cmp dl, 0x19
ja 0x1000e2e4
add al, 0xd
cmp al, 0x7a
jbe 0x1000e2e4
add al, 0xe6
mov byte [esi + ecx], al
inc ecx
cmp ecx, edi
jne 0x1000e2c0
mov eax, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x58]
mov esi, 0x10
cmp dword [ebp - 0x44], esi
jae 0x1000e311
lea eax, [ebp - 0x58]
mov edx, dword [ebp - 0x5c]
push esi
lea ecx, [ebp - 0x20]
push ecx
push 3
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x44], esi
jb 0x1000e33f
mov ecx, dword [ebp - 0x58]
push ecx
call fcn.100103f6
add esp, 4
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x58], bl
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0xffffffff
call fcn.1000e530
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001105b
mov esp, ebp
pop ebp
ret
Function at 0x1000e380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10045ca0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push 0x104
mov dword [ebp - 0x10c], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x1000e3c1
mov dword [ebp - 0x108], 0x5c3a43
lea eax, [ebp - 0x108]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000e3c8
mov ecx, dword [str.confidence_rk_new.log]
mov edx, dword [0x1003e028]
mov dword [eax], ecx
mov ecx, dword [0x1003e02c]
mov dword [eax + 4], edx
mov edx, dword [0x1003e030]
mov dword [eax + 8], ecx
mov ecx, dword [0x1003e034]
mov dword [eax + 0xc], edx
mov dx, word [0x1003e038]
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], dx
lea eax, [ebp - 0x108]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000e421
sub eax, edx
push eax
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.10007470
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1001105b
mov esp, ebp
pop ebp
ret

Function at 0x1000e590
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038abb
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x10045ca0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x154], 0xf
mov dword [ebp - 0x158], 0
mov byte [ebp - 0x168], 0
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0x14c]
push ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x170], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x14c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000e634
sub eax, edx
push eax
lea edx, [ebp - 0x14c]
push edx
lea ecx, [ebp - 0x168]
call fcn.10007470
push 8
push str.COMSCORE
lea ecx, [ebp - 0x168]
call fcn.10002360
cmp dword [ebp - 0x154], 0x10
mov eax, dword [ebp - 0x168]
jae 0x1000e677
lea eax, [ebp - 0x168]
mov edx, dword [ebp - 0x158]
lea ecx, [ebp - 0x24]
push ecx
push edx
push eax
lea ecx, [ebp - 0x169]
call fcn.10037369
lea eax, [ebp - 0x4c]
push eax
push 0x10
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x169]
call fcn.1003739d
cmp dword [ebp - 0x154], 0x10
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x170], eax
mov esi, eax
jb 0x1000e6c8
mov edx, dword [ebp - 0x168]
push edx
call fcn.100103f6
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001105b
mov esp, ebp
pop ebp
ret
Function at 0x1001105b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10045ca0]
jne 0x10011065
repz ret
jmp fcn.1001b24c

Function at 0x1002c24a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10045ca0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1001ac3b
and dword [ebp - 0x14], 0
cmp dword [0x10048254], 0
mov dword [ebp - 0x18], eax
jne 0x1002c2fd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1002c3a5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1002c3a5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10048254], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10048258], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1004825c], eax
call edi
push eax
call esi
mov dword [0x10048264], eax
test eax, eax
je 0x1002c2fd
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10048260], eax
mov eax, dword [0x10048260]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1002c356
cmp dword [0x10048264], ecx
je 0x1002c356
push eax
call esi
push dword [0x10048264]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1002c356
test ebx, ebx
je 0x1002c356
call edi
test eax, eax
je 0x1002c34d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1002c34d
test byte [ebp - 8], 1
jne 0x1002c356
or dword [ebp + 0x10], 0x200000
jmp 0x1002c389
mov eax, dword [0x10048258]
cmp eax, dword [ebp - 0x18]
je 0x1002c389
push eax
call esi
test eax, eax
je 0x1002c389
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1002c389
mov eax, dword [0x1004825c]
cmp eax, dword [ebp - 0x18]
je 0x1002c389
push eax
call esi
test eax, eax
je 0x1002c389
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10048254]
call esi
test eax, eax
je 0x1002c3a5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1002c3a7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001105b
leave
ret

Function at 0x1003659d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push 0x94
lea eax, [ebp - 0x94]
push 0
push eax
call fcn.100115b0
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 6
sbb eax, eax
inc eax
leave
ret

Function at 0x10037230
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret 4
Function at 0xe0c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xe0c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xe0c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe0c06a
add dl, dl
jne 0xe0c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe0c0dc
xor eax, eax
add dl, dl
jne 0xe0c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe0c17d
add dl, dl
jne 0xe0c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xe0c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xe0c075
mov eax, 1
add dl, dl
jne 0xe0c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe0c0e1
sub eax, ebx
mov ebx, 1
jne 0xe0c128
mov ecx, 1
add dl, dl
jne 0xe0c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe0c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe0c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe0c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xe0c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe0c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe0c136
cmp eax, 0x7d00
jae 0xe0c16d
cmp eax, 0x500
jb 0xe0c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe0c075
cmp eax, 0x7f
ja 0xe0c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe0c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xe0c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xe0c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x52f258
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf051e488
jmp 0x52f2c6
push dword [esp + 1]
jg 0x52f291
pop dword [esp]
jmp 0x52f27b
pushfd
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x52f29d
pop dword [esp]
pushfd
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x52f2dc
sub esp, 0
jg 0x52f2e2
cpuid
jmp 0x52f3ca
pushfd
jmp 0x52eff6
cpuid
add ebp, 0xd1bced3a
cpuid
jmp 0x52f318
mov esi, dword [esp + 0x2c]
jmp 0x52f348
bswap edx
not ebx
btr ebx, ecx
jmp 0x52f381
mov ah, 0x1c
lea edi, [esp]
not bx
jmp 0x52f411
jle 0x52f355
mov ah, 0x1c
jmp 0x52f357
add ebp, 0xd1bced3a
cpuid
call 0x52f302
mov ebx, esi
mov dh, dl
neg dx
jp 0x52f3f4
lea eax, [edx + ebx]
lea ecx, [ebx + ebp]
jmp 0x52f3f9
bsf ecx, esp
jne 0x52f3d7
je 0x52f3d7
call fcn.0052f427
mov dx, word [esp]
mov ecx, 0xe714a527
xchg cx, ax
jmp 0x52f4a4
sub esp, 0xc0
mov ebp, esp
mov ecx, 0xd12aa00b
lea edx, [eax*4]
jmp 0x52f3ed
lea ecx, reloc.ADVAPI32.DLL_RegCloseKey
jmp 0x52f4c7
inc esi
mov ch, 0xa9
mov dx, cx
mov ah, byte [esp]
rcr ax, 0xd
jmp 0x52f5fa
mov eax, dword [esp]
mov edx, 0x16bcd1ed
mov cl, 0x90
jmp 0x52f513
shl dh, 5
rol ecx, cl
clc
call fcn.0052f537
test al, 0x3b
stosd dword es:[edi], eax
into
cmp eax, 0x8e99eff
stosd dword es:[edi], eax
ret 0xd6f7
not esi
lea edx, [edx*4]
clc
jne 0x52f4fd
je 0x52f552
mov word [esp + 1], di
mov ax, 0x5f90
jmp 0x52f53c
lea esp, [esp + 4]
not esi
lea ecx, reloc.ADVAPI32.DLL_RegCloseKey
mov ax, sp
jmp 0x52f588
shl dh, 5
rol ecx, cl
clc
jmp 0x52f503
rdtsc
jmp 0x52f5b0
rcl edx, cl
neg dx
jmp 0x52f55a
bt edx, edi
jno 0x52f570
rcl edx, cl
neg dx
rdtsc
jmp 0x52f5b0
add esi, dword [edi]
xchg ecx, eax
sub esp, 0
jne 0x52f5d2
je 0x52f5bc
push ebx
fisttp dword [ebx + 0x2e]
invalid
inc esi
rdtsc
mov dl, 0x57
rdtsc
mov eax, dword [esp]
jmp 0x52f596
jmp 0x52f5bc
js 0x52f68e
jns 0x52f68e
sbb dl, cl
inc ecx
jmp 0x52f7b8
dec esi
bswap ecx
bswap edx
mov dl, ah
jmp 0x52f4d9
mov cl, al
setle dh
not dx
invalid
ja 0x52f7c2

Function at 0x52f427
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [ebx - 0x5ff44614], cl
sub dl, cl
push ebp
xchg dword [esp], ecx
xchg ecx, edx
call fcn.0052f4ef
mov ebx, 0x20d1b620
loop 0x52f416
sub al, 0x3f
push es
mov cl, 0x8d
add al, 0x1a
lea ecx, [ebx + ebp]
mov dx, word [esp]
mov ecx, 0xe714a527
xchg cx, ax
jmp 0x52f4a4
Function at 0x533939
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf051e488
jmp 0x53389a
not esi
jmp 0x5338a3
bswap esi
lea ecx, [edx + edx]
rdtsc
jmp 0x533884
mov edi, dword [esp + 0x2c]
pushal
rdtsc
pop word [esp + 0xe]
lea esp, [esp + 2]
jmp 0x53390b
lea esp, [esp + 0x4c]
pushfd
jmp 0x532ffe
setae bh
jmp 0x5338ed
setae bh
sub esp, 0xa4
mov ebp, esp
neg edx
jmp 0x533917
lea esi, [esp + 0x1c]
bswap ebp
neg bh
jno 0x5338ea
jo 0x5338d4
jne 0x53392d
or eax, 0x4c75b40c
jmp 0x533932
or eax, 0x4c75b40c
call 0x533939
xchg esi, eax
add dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey], ecx
and al, 3
mov ebx, edi
call fcn.00533978
loopne 0x53398c
sal byte [edi + 0x783c542], 1
xchg edi, eax
add dword [ebx + reloc.ADVAPI32.DLL_RegCloseKey], edi
lea esp, [esp + 2]
mov dword [esp + 0x4c], edi
jmp 0x5338ca
xchg dword [esp + 4], ebx
lea esp, [esp + 2]
mov dword [esp + 0x4c], edi
jmp 0x5338ca
lea edx, [ecx + ebx]
mov cl, 0xa3
not edx
sbb dx, 0x9c81
jmp 0x5339ae
jmp 0x5339e5
clc
lea ebx, [ebx + 0x50]
bts edx, edx
mov edx, dword [esp]
xchg ecx, eax
setnp al
jmp 0x533a30
mov esi, 0xcd8b668b

Function at 0x533a4a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
neg edi
xchg edx, eax
mov dl, ah
jmp 0x533a7d
mov dh, ah
sub esp, 0
jle 0x533a67
mov dx, word [esp]
jmp 0x533acd

Function at 0x57ee2e
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x57ef7a
push esp
jmp 0x57ef5c
jmp 0x57ee70
mov si, dx
pushfd
rdtsc
cld
jmp 0x57ee5a
lea esp, [esp + 8]
test eax, eax
je 0x522254
pushal
jmp 0x57ee30
lea esp, [esp + 4]
pop esi
push ax
mov byte [esp], dl
lea esp, [esp + 2]
jmp 0x57efcd
pop ebx
leave
ret 4
Function at 0x61836f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 2]
mov ebx, 0x9117a96e
jmp 0x6183b6
xchg ecx, edi
rdtsc
mov byte [esp + 0x1e], bl
mov ebx, 0xdc90d5f0
setbe dh
jmp 0x6183e1
lea ebx, reloc.ADVAPI32.DLL_RegCloseKey
dec bx
sub esp, 0x1e
mov dx, bp
push esp
mov dword [esp + 0xb], ecx
jmp 0x6183a0
mov cl, 0xcf
mov edi, ecx
mov cx, dx
mov word [esp + 0xb], ax
mov eax, dword [esp + 0x24]
jmp 0x618435
mov word [esp + 0x23], si
pop dword [esp + 0x19]
lea edi, [edx*4]
rdtsc
mov bp, word [esp + 0x1c]
lea ebp, [esi + ebp]
jmp 0x6183cb
add esp, 0
xchg ecx, edx
cmc
lea ebp, [ecx*4]
add esp, 4
jmp 0x6189f8
mov ah, byte [esp + 0x23]
popal
mov word [esp + 1], cx
mov dh, 0x84
add esp, 0
jmp 0x61841f
pop si
mov ah, 0xef
xchg dword [esp], edi
mov ax, word [esp + 1]
xchg word [esp + 1], di
mov di, cx
call fcn.0061847c
bsf eax, edi
push dword [esp + 6]
setg ah
cpuid
neg dl
xchg edx, ecx
jmp 0x6184eb
lea esp, [esp + 7]
setg ch
mov byte [esp + 2], ch
cpuid
rdtsc
jmp 0x618531
bswap ebx
setae bl
xchg ch, al
mov bh, ch
pushfd
xchg dl, bl
jmp 0x6184aa
lea ecx, [edi + 0x94]
pushfd
push esi
shl bh, cl
lea edx, [esp + esi]
mov dx, word [esp + 0xf]
jmp 0x618540
mov byte [esp + 1], dl
pushfd
mov cl, ah
cpuid
sbb ax, bp
std
jmp 0x618511
bts esi, esp
mov bh, 0x1f
pop eax
bswap edx
lea ebp, [eax*4]
push sp
jmp 0x61861a
add esp, 0
xchg bl, ch
lea edi, [eax*4]
xchg word [esp], bx
mov eax, 0xc824378e
xchg al, dh
jmp 0x618503
lea esi, [ecx*4]
bt cx, bx
push edx
lea ebp, [edx*4]
call fcn.006185ea
bt ebx, esp
xchg esi, ebx
stc
cpuid
std
mov cx, sp
call fcn.00618680
xchg ebp, eax
add al, 0xb7
sahf
jmp 0x24a61596
mov eax, 0x14516c28
mov bp, ax
lea ebp, [ecx*4]
mov dx, si
bsr ebx, esp
bsf dx, di
jmp 0x618566
Function at 0x6189d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, byte [esp + 7]
mov ax, 0x2466
pop dword [esp + 1]
xchg bl, cl
sub esp, 0xf
jmp 0x618987

Function at 0x619005
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
not cx
xchg byte [esp + 0xc], ah
call fcn.00618f73
inc edi
je 0x618f7d
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
dec esp
imul ebp, dword [esi + 0x65], 0xd1a60041
push eax
rol dword [esi + reloc.ADVAPI32.DLL_RegCloseKey], cl
pop edi
xchg cl, bl
rdtsc
pop di
pop eax
mov byte [esp + 3], cl
mov dl, dh
jmp 0x618f28
jmp 0x618f4a

Function at 0x61ccf1
Capabilities:
Execute anti-debugging instructions
Get number of processors
Packed with generic packer

Disassembly:
call fcn.0061bff7
lea esp, [esp + 1]
jmp 0x61cd62
mov eax, dword fs:[0x30]
jmp 0x61cd45
mov word [esp + 1], ax
push word [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x61cd17
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x61cd8d
mov word [esp], dx
pushfd
lea esp, [esp + 3]
mov dword [esp + 0x28], esi
pushfd
mov word [esp + 1], sp
jmp 0x61cd2d
mov eax, dword [eax + 8]
push eax
jmp 0x61bff2

Function at 0x61cd07
Capabilities:
Execute anti-debugging instructions
Get number of processors
Packed with generic packer

Disassembly:
mov byte [esp + 2], dl
mov dword [esp], ecx
mov dword [esp + 0x28], ebp
call fcn.0061ccf1
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x612008], 0x8088405
inc edx
mov dword [ebx + 0x612008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cc40
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cc71
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc59
add dl, dl
jne 0x41cc7c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cccd
xor eax, eax
add dl, dl
jne 0x41cc89
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd6a
add dl, dl
jne 0x41cc98
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cca3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccae
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccb9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41ccc3
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cc68
mov eax, 1
add dl, dl
jne 0x41ccdb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cce6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccd2
sub eax, ebx
mov ebx, 1
jne 0x41cd19
mov ecx, 1
add dl, dl
jne 0x41ccff
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccf6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cd30
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd3b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cd27
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cd8b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cc68
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret