joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x102f2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.102f21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x102f207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102f206a
add dl, dl
jne 0x102f2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102f20dc
xor eax, eax
add dl, dl
jne 0x102f2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102f217d
add dl, dl
jne 0x102f20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102f20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102f20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102f20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x102f20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x102f2075
mov eax, 1
add dl, dl
jne 0x102f20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102f20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102f20e1
sub eax, ebx
mov ebx, 1
jne 0x102f2128
mov ecx, 1
add dl, dl
jne 0x102f210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x102f2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102f2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102f2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x102f213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x102f214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102f2136
cmp eax, 0x7d00
jae 0x102f216d
cmp eax, 0x500
jb 0x102f2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102f2075
cmp eax, 0x7f
ja 0x102f2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102f2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x102f219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x102f2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x774610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x77a4cc]
cmp dword [eax + 0x28], 0
jne 0x774628
xor eax, eax
jmp 0x774757
mov ecx, dword [0x77a43c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x77a430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x77a42c], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x77a430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x77a42c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x77a4b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x778680
push 0x7786d0
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x77a428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.00774550
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x7745e0
mov edx, dword [0x77a4cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x77a434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x774757
cmp dword [ebp - 0x38], 0x12
jne 0x77474b
mov dword [0x77a444], 0
call fcn.00774760
xor eax, eax
jmp 0x774757
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x77471c
mov esp, ebp
pop ebp
ret 4

Function at 0x775b30
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x7766cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x778168
sub eax, eax
test esi, esi
je 0x7767a4
sub eax, 1
test ecx, ecx
je 0x7767a2
test esi, 3
je 0x77670a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x7766ef
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x776789
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x776714
mov ecx, edx
test ecx, ecx
je 0x7767a2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x77678f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x7767ac
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0077682f
jae 0x7767ba
xor ecx, ecx
call fcn.0077682f
jae 0x7767e9
xor eax, eax
call fcn.0077682f
jae 0x7767f9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0077682f
adc al, al
jae 0x7767db
jne 0x776825
stosb byte es:[edi], al
jmp 0x7767bd
call fcn.0077683b
sub ecx, ebx
jne 0x776802
call fcn.00776839
jmp 0x776821
lodsb al, byte [esi]
shr eax, 1
je 0x77684b
adc ecx, ecx
jmp 0x77681e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00776839
cmp eax, 0x7d00
jae 0x77681e
cmp ah, 5
jae 0x77681f
cmp eax, 0x7f
ja 0x776820
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7767bd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x77717c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x77a000]
jne 0x777186
repz ret
jmp fcn.0077742d
Function at 0xb2da69
Capabilities:
Encode data using xor

Disassembly:
add esp, 3
call fcn.00b2dfba
movsb byte es:[edi], byte [esi]
daa
mov bh, 0xd2
and dword [edx + edx*8 + reloc.MSVCRT.dll_malloc], ebx
fbstp tbyte [0xbf4c25b5]
or eax, 0x3fbe5724
sar dword [edx - 7], cl
push esi
wait
jns 0xb2da87
dec bp
jns 0xb2da8b
adc eax, 0x29f9798b
cdq
js 0xb2da93
mov edi, dword [ecx - 7]
sub dword [ecx + reloc.MSVCRT.dll_malloc], ebx
fcom qword [ebp + eax*4 - 7]
push esp
test ecx, edi
mov dl, 0x5f
pop edi
jns 0xb2da9b
sbb dword [edx + 0x3771f97f], edx
xchg edx, eax
jg 0xb2da9f
jno 0xb2dadf
jnp 0xb2daa3
sub eax, 0x1af977e4
jge 0xb2db29
stc
xor eax, 0x3acff978
xor eax, 0x3acff978
jg 0xb2dab3
pushal
ja 0xb2db37
stc
cdq
push ecx
jns 0xb2dabb
sub eax, 0x8cf977e4
jle 0xb2db43
stc
sub eax, 0xd9f977e4
invalid
xor edi, dword [eax - 7]
dec esi
push es
jp 0xb2dad7
or eax, dword [ecx + 0x7e]
stc
inc ecx
jle 0xb2dadb
or dword [ebx + reloc.MSVCRT.dll_malloc], 0x8c69f983
adc eax, 0x8c69f983
invalid
jl 0xb2dae7
dec edx
jp 0xb2daeb
dec eax
test byte [edx - 7], bh
movsd dword es:[edi], dword [esi]
stc
mov eax, dword [reloc.MSVCRT.dll_malloc]
xor edi, dword [edx - 7]
dec edx
aad 0x7f
stc
jbe 0xb2db80
dec eax
jg 0xb2db33
fisub dword [edi + 0x7c]
stc
sbb dword [ebx + 0x7a], ebx
stc
xchg esp, eax
add edi, dword [eax - 7]
loopne 0xb2db51
jns 0xb2db43
test eax, 0x2df9796f
in al, 0x77
stc
movsd dword es:[edi], dword [esi]
pop ebx
js 0xb2db4f
aam 0x8c
cmp ecx, 0xffffff9a
test byte [edx - 7], bh
ljmp 0x7ff1

Function at 0xb316ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edi
push word [esp]
xor al, 0x24
jbe 0xb316dc
ja 0xb316dc
jge 0xb316b0
outsb dx, byte [esi]
or eax, edi
dec ebx
push ebp
les esi, [edi + 0x5e]
test eax, 0xeb280c8d
ret
call fcn.00b316c6
Function at 0xb316e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0b19d18
jmp 0xb317f5
lea esp, [esp + 3]
push esi
mov byte [esp], cl
jmp 0xb317b3
lea esp, [esp + 2]
mov word [esp], bx
lea esp, [esp + 3]
mov dword [esp], ecx
call fcn.00b3176f
pushfd
jmp 0xb30125
jmp 0xb31859
bswap ebx
mov ebp, dword [esp]
rcr bx, cl
jl 0xb317df
neg dx
jmp 0xb3185c
lea esp, [esp + 6]
xchg dl, bh
lea esp, [esp + 1]
jmp 0xb31835
jmp 0xb3181d
lea edi, [esp + 0x14]
neg al
jmp 0xb318c1
btc edx, ecx
push ebp
not bx
jmp 0xb31871
neg dx
mov esi, dword [esp + 0x2c]
sub esp, 0x1b
jo 0xb31833
lea esp, [esp + 6]
xchg dl, bh
lea esp, [esp + 1]
jmp 0xb31835
sub esp, 0xa8
mov ebp, esp
not bx
lea eax, [ebx*4]
jmp 0xb31897
not bx
jmp 0xb31871
mov ebx, esi
xchg edx, eax
xchg dl, dh
cmc
jmp 0xb318e3
not eax
xchg dx, cx
lea edx, [edi*4]
not ah
or edx, 0x9a1be1a
jmp 0xb3191a
jnp 0xb31841
btc edx, ecx
push ebp
jmp 0xb31892
lea edx, [edi*4]
not ah
or edx, 0x9a1be1a
jmp 0xb3191a
jbe 0xb318a4
not eax
xchg dx, cx
jmp 0xb318cd
neg ax
xchg cl, dh
push edi
call fcn.00b31933
xchg ebp, eax
push ss
test bl, ah
push ds
scasd eax, dword es:[edi]
pop es
scasb al, byte es:[edi]
mov ecx, 0xe91afb98
sbb ch, cl
jmp 0xb318ec
sub esi, 0x3165ecbf
or dh, 0xe4
jne 0xb31902
sbb ch, cl
neg ax
xchg cl, dh
push edi
jmp 0xb3199a
bswap edx
jmp 0xb319f4
call fcn.00b31a0b
add dword [edx], reloc.MSVCRT.dll_malloc
test dword [edx], reloc.MSVCRT.dll_malloc
xor al, cl
jle 0xb319ec
add byte [eax], al
add byte [ebx + 0x2f79002], al
mov esp, 0x3257c747
sar dword [esi - 1], 0x78
out dx, al
invalid
js 0xb319dd
mov dword [eax - 0x38], edi
aad 0x44
lea esp, [esp + 4]
neg esi
mov cx, word [esp]
cmc
jo 0xb319db
bsr eax, eax
jmp 0xb31a68
mov dl, ch
xchg ah, ch
seto dh
jmp 0xb31adf
mov dl, byte [esp + 8]
lea esp, [esp + 1]
jmp 0xb31a99
lea esp, [esp + 0xc]
add esi, 0x4025406d
setbe cl
call fcn.00b31abb
out dx, al
stc
fdivr dword [ebx]
jae 0xb31a71
mov dl, byte [esp + 8]
lea esp, [esp + 1]
jmp 0xb31a99
xor esi, 0x2dc53bdc
rdtsc
mov edx, 0x144950a4
rdtsc
sub esp, 0xd
jmp 0xb31aaf

Function at 0xb317dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0xb31758
mov dword [esp], ebx
push esp
push ebx
mov word [esp + 1], di
mov byte [esp + 2], ch
jmp 0xb3178f
mov dword [esp + 4], ebp
push cx
call 0xb317dd
pushfd
sbb byte [esi - 0xa56e717], cl
in al, 0x17
jle 0xb317d8
push dword [esp + 1]
je 0xb31779
mov dword [esp + 4], ebp
push cx
jmp 0xb3177f
inc esp
push es
mov cl, 0xb0
mov bl, 0xeb
mov esi, 0x28aa78eb
mov esi, 0xc49828d9
inc ebp
aad 0xbc
sub byte [eax - 0x432aba3c], bl
dec edi
cld
jbe 0xb317e5
add edi, esi
dec esi
mov cs, word [bx]
retf

Function at 0xb31a0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc dx, bx
mov dx, 0x9cc7
clc
xchg dword [esp], eax
dec edx
jmp 0xb31a4d
lea ecx, [ebp*4]
clc
xchg dword [esp], eax
rdtsc
mov dh, al
jmp 0xb31a5f
shr dl, 0
mov dh, 0x2f
neg cx
mov dh, 0xf
lea eax, [eax + 0x41]
xchg cx, dx
jmp 0xb31a37
mov cx, 0xf83a
call fcn.00b31b16
Function at 0xc4da85
Capabilities:
Encode data using xor

Disassembly:
call 0xc4da85
fdivr dword [edi + 0x5b4497a1]
xchg edx, eax
mov dl, 0xb9
and ebp, esp
aas
das
test byte [ecx - 0x19], 0x5d
fisttp qword [ebp + 0x14]
out 0x55, eax
lodsb al, byte [esi]
mov edi, 0x2a11e850
in eax, dx
invalid

Function at 0xc7fc9f
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
mov dl, bh
lea esp, [esp + 0xf]
lea esp, [esp + 0xe]
pushfd
mov dword [esp], ebx
jmp 0xc7fc7c
lea eax, [ecx + edx]
mov edx, ebp
cld
lea ecx, [edx + edx]
mov dl, ah
setl ah
jmp 0xc7fc40
xchg byte [esp + 6], dh
lea esp, [esp + 2]
mov byte [esp + 8], ch
xchg di, bp
jmp 0xc7fcaf
btr esi, ebx
xchg word [esp + 2], bx
sub esp, 0x1f
xchg ah, cl
xchg byte [esp + 7], bl
lea esp, [esp + 0x17]
jmp 0xc7fc66
mov bp, di
not di
sub esp, 0x1a
xchg word [esp + 0x18], cx
jmp 0xc7fc56
mov esi, 0x11ba9149
setb cl
sub esp, 9
mov ebp, eax
lea esp, [esp + 8]
bswap ebx
jmp 0xc7fcf5
xchg word [esp + 6], bx
lea ebp, [edx*4]
xchg bl, al
std
mov word [esp], di
mov bl, byte [esp + 5]
jmp 0xc7fcdf
Function at 0xc8038e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xb
add esp, 4
lea esi, [ebx + ebx]
cpuid
mov edi, dword [esp]
rol esi, cl
jmp 0xc80307
rdtsc
lea eax, [ecx + edx]
bsf ebx, ebp
lea ebx, [eax + ebp]
lea eax, [eax*4]
mov byte [esp + 0xd], bh
jmp 0xc802c3
mov bl, al
bswap ebx
xchg word [esp], bp
mov bl, 0x53
lea esi, [ecx + edi]
jmp 0xc80334
mov eax, 0x67b00e42
mov edx, 0xcf5243b8
neg bp
lea ecx, [edi + ebp]
mov ebx, esi
rol bx, cl
jmp 0xc802f1
ror bp, 0xb
xchg ebx, edi
lea esi, [edi*4]
jmp 0xc80366
xchg byte [esp + 1], al
add esp, 2
mov byte [esp], dl
sub esp, 7
mov al, byte [esp + 2]
xchg word [esp + 4], cx
jmp 0xc8031e
xchg byte [esp + 1], al
sub esp, 0x10
pop ax
sbb ecx, edi
xchg di, bp
xchg ebx, eax
jmp 0xc802d9
bt cx, bx
sub esp, 0xc
mov ecx, dword [esp + 0xd]
lea esi, [edi*4]
mov al, byte [esp + 4]
xchg di, bp
jmp 0xc8051e
xchg bh, al
bswap ecx
rdtsc
lea esp, [esp + 1]
mov ebx, dword [esp + 3]
jmp 0xc80351

Function at 0xc80504
Capabilities:
Execute anti-debugging instructions

Disassembly:
sbb ebp, ecx
push word [esp + 5]
mov ch, byte [esp + 4]
lea esi, [eax + ebx]
push si
pop dword [esp + 8]
jmp 0xc80426
std
add esp, 3
mov dword [esp + 8], ebx
lea edx, reloc.MSVCRT.dll_malloc
lea eax, reloc.MSVCRT.dll_malloc
xchg word [esp + 1], dx
jmp 0xc8039e
xchg word [esp + 0x23], si
xchg bp, dx
mov eax, 0xd8a4f219
xchg dl, al
ror dl, 7
bswap eax
call fcn.00c803e3
test dword [ecx], eax
xchg ecx, eax
lock add esi, dword [eax + reloc.MSVCRT.dll_malloc]
ret 0x572
xchg dword [esp], ebp
mov dh, 0x69
mov dword [esp + 5], edx
sub esp, 0x1f
mov bh, dh
ror ax, 0xf
jmp 0xc803f9
setne ch
mov byte [esp + 0x1e], bl
mov byte [esp + 0xc], ah
call 0xc80504
xchg esp, eax
pop es
scasb al, byte es:[edi]
mov ecx, 0x245c8898
mov byte [esp + 0x13], bl
invalid
je 0xc8051c
mov byte [esp + 0x13], bl
push dword [esp + 0x14]
bt ebp, ebx
xchg byte [esp + 0x19], cl
mov dl, bh
jmp 0xc804db
adc al, 0xf
mov dword [reloc.MSVCRT.dll_malloc], eax
sbb dword [edx + 0x66d7ebd7], ecx
mov ecx, edi
shr bh, 6
neg si
jmp 0xc8054c
fsubr qword [edi]
mov bh, 0xc7
pop dword [esp + 1]
adc al, 0x45
mov ebp, dword [esp + 0xc]
bts edx, edx
mov byte [esp + 0xd], al
jmp 0xc803c8
mov ecx, dword [esp + 4]
xchg ch, al
push dword [esp + 4]
std
mov byte [esp], bl
jmp 0xc805d6
popal
lea eax, reloc.MSVCRT.dll_malloc
pop word [esp]
pushfd
mov eax, dword [esp + 1]
xchg dword [esp], ebx
jmp 0xc80536
sub esp, 0x1d
inc ch
std
mov dl, 4
pop edi
xchg byte [esp + 0x20], bh
jmp 0xc8056d
bsr esi, esi
push word [esp + 4]
mov bp, 0xfe6a
not dx
sub esp, 2
pop word [esp]
jmp 0xc80583

Function at 0xc808a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xc808b9
push word [esp]
neg edx
bswap ebp
mov ah, byte [esp + 2]
mov cl, bh
jmp 0xc808fb
mov word [esp + 2], sp
setl ch
mov bp, ax
pop ax
bsr ebp, eax
mov word [esp + 1], dx
jmp 0xc808e5
Function at 0xce4494
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00ce403c
jmp 0xce455d
pop word [esp]
lea esp, [esp + 1]
push ecx
lea esp, [esp + 4]
mov word [esp], bp
mov word [esp], bp
jmp 0xce450d
mov byte [esp], ah
pushfd
pop word [esp + 0x17]
lea esp, [esp + 1]
lea esp, [esp + 0x1c]
jmp 0xce4536
lea esp, [esp + 0x2e]
mov dword [esp + 3], eax
pushal
mov dword [esp + 0x15], edi
push word [esp + 0x21]
lea esp, [esp + 0xf]
jmp 0xce44c7
lea esp, [esp]
pushal
pop dword [esp + 0xe]
pushal
pop dword [esp + 2]
pop dword [esp + 0x14]
jmp 0xce44e1
call fcn.00c22c1a
jmp 0xce4037
pop word [esp]
mov byte [esp], al
lea esp, [esp + 2]
mov byte [esp], ch
push sp
push word [esp + 1]
jmp 0xce4499

Function at 0xce4af3
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov bl, bh
add esp, 7
rdtsc
jmp 0xce4b13
mov si, sp
bsr bx, cx
mov byte [esp + 1], dh
btr di, di
neg ecx
xchg byte [esp + 1], ch
jmp 0xce4b3a
lea edi, [esi + 0xac]
lea edi, [esp + 0x7c]
cpuid
bsr eax, edx
not ah
mov bh, byte [esp + 1]
jmp 0xce4c02
bsr eax, ebp
mov word [esp], di

Function at 0xce4cc5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, word [esp + 3]
pop ax
jmp 0xce4d03
lea ebx, [ecx + edx]
mov ebx, dword [esp + 4]
add esp, 5
lea eax, [edi*4]
sub esp, 0x1f
jmp 0xce4ced

Function at 0xce51a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
setle dh
push ebp
bswap ecx
pop si
bswap eax
pop dword [esp + 0xd]
jmp 0xce51b7
pop ebp
xchg al, bh
sets ah
lea ecx, reloc.MSVCRT.dll_malloc
jmp 0xce518d
seto bh
xchg ch, ah
neg bx
lea edi, [esi + ebp]
pop edi
push word [esp + 0xe]
jmp 0xce5356
stc
shl ax, 8
lea esp, [esp + 0x1c]
mov dx, 0xf33a
jmp 0xce5229
lea edi, [edx*4]
xchg byte [esp + 0x17], cl
pop word [esp + 9]
lea eax, [esp - 0x2f]
mov dl, byte [esp]
mov cx, si
jmp 0xce51e0
popal
push word [esp]
mov eax, dword [esp + 0x17]
push ax
mov al, byte [esp + 0xb]
cpuid
jmp 0xce51f6
cmp edx, 0x19726254
mov bx, 0x5a54
lea eax, [eax*4]
inc al
stc
mov edx, 0xd110faa6
jmp 0xce529b
push word [esp + 0x1d]
mov dword [esp + 0x1c], edi
push ecx
xchg al, cl
push word [esp + 0x34]
lea ebx, [ebp*4]
jmp 0xce5216
push word [esp + 2]
bswap edx
mov word [esp + 1], di
bsf si, bx
jmp 0xce52ad
dec ah
xchg byte [esp], bl
rdtsc
mov byte [esp], ah
lea ebx, [edx + esi]
sub esp, 8
jmp 0xce5263
cmc
inc ah
mov edi, 0x372e8470
mov ebx, dword [esp]
sub esi, edi
cmp cl, 0x79
jmp 0xce5279
bsr dx, ax
mov cx, word [esp + 0xa]
bt bx, bp
not edx
mov cx, 0xc623
inc ax
jmp 0xce530a
rdtsc
lea esi, [esp - 0xc9]
mov word [esp + 0x16], cx
mov dh, 0x93
xor dl, 0xeb
mov byte [esp + 3], ah
jmp 0xce5249
mov dl, byte [esp + 3]
pushal
mov bp, di
xchg word [esp + 0xf], dx
call fcn.00ce52e8
lea ebp, [eax + edi]
mov dx, 0xcd51
mov cx, word [esp]
shl ch, 1
sub esp, 0x18
jmp 0xce5382
neg esi
bsf bp, bp
lea edx, [esi + ebp]
pushal
mov ecx, edx
mov ecx, 0xf1233b5a
jmp 0xce52cc
mov al, byte [esp]
mov word [esp], bp
mov eax, edi
call fcn.00ce53aa
fstp qword [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
ljmp 0x6615
add esp, 0x15
mov cx, di
lea ecx, [esp + esi]
rol ebx, 0x1c
mov al, 0xd1
and edx, esi
jmp 0xce536c
Function at 0xce51d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp]
push word [esp + 3]
rdtsc
bsf ebp, esp
std
not bp
jmp 0xce511d
pop word [esp]
shl edi, cl
pop edi
mov edx, dword [esp]
not ch
neg al
call fcn.00ce50f5
push ecx
rcl byte [ebx - 0x36]
mov dl, al
mov dl, al
pop word [esp + 1]
mov edx, 0x97671dee
add esp, 1
push word [esp + 1]
neg ax
jmp 0xce50b1
mov edi, 0x62253d9
not ah
push word [esp + 4]
xchg ebx, esi
add esp, 3
not bh
jmp 0xce50c4
mov word [esp + 2], ax
pop ecx
push word [esp + 1]
rdtsc
not si
rdtsc
jmp 0xce50dc
xchg edx, ebx
jmp 0xce514e

Function at 0xce53b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ebx
sete ah
jmp 0xce5675
cld
mov bh, 0x24
mov dword [esp], edx
pushal
mov ebp, ebx
pop dword [esp + 2]
push esp
jmp 0xce5557

Function at 0xce56b5
Capabilities:
Parse pe header

Disassembly:
push dword [esp + 1]
mov word [esp + 5], bp
mov word [esp + 1], cx
jmp 0xce5710
pop word [esp + 1]
push word [esp + 5]
mov dword [esp + 0xc], ebx
push dx
push di
mov dword [esp + 0xc], esp
call fcn.00ce56e9
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
jmp 0xce5748
mov eax, dword fs:[0x30]
jmp 0xce57cf
mov eax, dword [edi]
pop edi
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0xce5779
push edi
mov edi, eax
lea edi, [edi + 0xc]
jmp 0xce5793

Function at 0xce56e9
Capabilities:
Parse pe header

Disassembly:
call fcn.00ce4054
jmp 0xce5760
push dword [esp + 1]
mov byte [esp], cl
pop word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 0xc], ebp
call fcn.00ce56eb
mov eax, dword [eax + 8]
push eax
jmp 0xce404f

Function at 0xce5741
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
mov dword [esp + 1], esi
lea esp, [esp + 2]
mov dword [esp + 0x10], esi
pushfd
push dword [esp + 1]
mov dword [esp], esi
jmp 0xce572b
push word [esp + 6]
jmp 0xce56f0
Function at 0x402e14
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x528008], 0x8088405
inc edx
mov dword [ebx + 0x528008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4032fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x528024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403394
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403374
xor eax, eax
push ebp
push 0x40336d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033b0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403374
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x528024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x528024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404148
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x52c04c], 0
je 0x4041a9
cmp word [0x52c220], 0xd7b2
jne 0x404171
cmp dword [0x52c228], 0
jbe 0x404171
mov eax, 0x52c21c
call dword [0x52c238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x528070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4041d0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x528034], 0
jne 0x4041c5
push 0
push 0x528068
push 0x528070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4042fc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004028ec
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x52c04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4042c4
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc