joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40230f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x24]
push edi
mov edi, dword [esi + 0x34]
sub edi, dword [esi + 0x6c]
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x24]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
cmp eax, ecx
mov dword [ebp - 8], edi
jb 0x40239c
mov eax, dword [esi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0040179d
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x3c]
sub dword [esi + 0x68], ebx
sub dword [esi + 0x64], ebx
add esp, 0xc
sub dword [esi + 0x54], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x40235c
mov eax, dword [esi + 0x38]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x40237e
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x402448
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x64]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x30]
mov edx, dword [ebp - 8]
cmp ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jbe 0x4023c4
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x4023ce
xor eax, eax
jmp 0x402409
sub ecx, dword [ebp - 4]
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
cmp dword [ecx + 0x18], 1
jne 0x4023f3
push dword [ebp - 4]
push dword [edi]
push dword [edi + 0x30]
call fcn.00401d77
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.0040179d
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x6c], eax
mov edi, dword [esi + 0x6c]
cmp edi, 3
jb 0x402434
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp edi, 0x106
jae 0x402448
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x40231a
pop edi
pop ebx
leave
ret
Function at 0x4058a1
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, dword [esp + 4]
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edi + edx*4]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edi + edx*4]
pop esi
mov dword [ecx + 8], eax
mov eax, dword [esp + 4]
ret
Function at 0x100064bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebx
lea esp, [esp + 4]
jmp 0x100269b4

Function at 0x10017a53
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ah
lea esp, [esp + 1]
jmp 0x100178ac
clc
call fcn.100178ca
invalid
xor dl, 0x69
sub esp, 0x12
jnp 0x10017896
clc
mov ecx, dword [esp]
mov ax, 0x43e0
mov eax, dword [esp + 0x11]
jmp 0x100178e5
mov word [esp + 5], ax
jmp 0x10017969
xchg byte [esp + 2], cl
jmp 0x10017946
setl al
dec ah
sub esp, 0x17
lea esp, [esp + 3]
push dword [esp + 0x28]
ret 0x2c
sub esp, 0x14
btr eax, ebx
xchg al, ah
mov ah, 0xfc
xchg dword [esp + 0x14], ecx
mov ah, 0x49
jmp 0x1001790f
and edx, 0x3c
cmc
jns 0x10017978
xchg cx, ax
bswap ecx
mov eax, ebx
jmp 0x100179f3
pop ax
dec ecx
js 0x100178ec
xchg byte [esp + 2], cl
jmp 0x10017946
xchg cx, ax
call fcn.10017a15
xchg edi, eax
adc dword [ecx + reloc.IPHLPAPI.DLL_GetInterfaceInfo], eax
xchg edx, eax
add byte [edi - 0x6e], ah
adc eax, 0xe0860a93
mov ah, al
cmp eax, ecx
mov eax, dword [esp]
neg eax
lea ecx, [ecx + 0x44]
jmp 0x10017934
xchg al, ch
jmp 0x100179fe
lea ecx, [edx*4]
bswap eax
jmp 0x100179d5
lea eax, reloc.IPHLPAPI.DLL_GetInterfaceInfo
pushal
pop ecx
or cx, 0x41e4
jmp 0x10017a28
jo 0x10017a3e
jno 0x10017a3e
insd dword es:[edi], dx
arpl word [esi], ax
cmc
ret 0xf475
mov eax, dword [esi]
inc ch
jmp 0x10017a8f
bt cx, bx
clc
call 0x10017a53
mov esp, dword [esi - 9]
fldpi
and dword [edx], esp
pop ebp
lodsb al, byte [esi]
mov edi, 0xb2b4b966
pop ecx
mov cl, 0x8f
mov cx, 0x2702
mov cx, word [esp]
jmp 0x10017b1d
jbe 0x10017a48
bt cx, bx
clc
jmp 0x10017a4d
xor edx, 0xeac18175
bswap edx
mov dx, word [esp]
jmp 0x10017ae2
mov dh, ch
jmp 0x10017ab2
rdtsc
neg dl
lea esp, [esp + 2]
jmp 0x10017b03
pushal
pop word [esp + 0x13]
clc
ja 0x10017acc
jbe 0x10017af5
adc al, 0x95
add eax, 0x84a19f6c
aaa
rdtsc
neg dl
lea esp, [esp + 2]
jmp 0x10017b03
add esi, 4
push ebp
mov byte [esp + 2], bl
mov edx, edi
shr ch, cl
jmp 0x10017b37
mov dword [edx + edi], eax
bsf dx, ax
je 0x10017ac8
mov dh, ch
xor edx, 0xeac18175
bswap edx
mov dx, word [esp]
pushal
jmp 0x10017ae3
jl 0x10017b4d
not al
lea ecx, [esp + edx]
jmp 0x10017b71
not al
lea ecx, [esp + edx]
xchg byte [esp], cl
mov edx, dword [esp]
pop word [esp]
pop ax
jmp 0x10017b93
xchg byte [esp], cl
mov edx, dword [esp]
pop word [esp]
jmp 0x10017b5c
movzx edx, byte [ebp]
call fcn.10017d22
retf 0xdd4d
xchg dh, dl
jmp 0x10017b7d

Function at 0x100a571d
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x100a5707
mov byte [esp + 0x15], cl
lea esp, [esp + 2]
mov dword [esp + 0x4c], edi
lea esp, [esp + 0x4c]
jmp 0x100a575e
Function at 0x100bf43b
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ax
jg 0x100bf443
not dh
lea ebx, [eax*4]
jmp 0x100bf483
pop ax
mov word [esp], cx
jmp 0x100bf425
not dh
lea ebx, [eax*4]
jmp 0x100bf4ac
lea ebx, [esi + ebp]
jmp 0x100bf489
lea esp, [esp + 2]
jmp 0x100bf4b0
bt ax, di
mov edx, 0x2422f291
lea ebx, [edx + edi]
jmp 0x100bf5d8
lea esp, [esp + 2]
ror ebp, 0
js 0x100bf46d
lea ebx, [esi + ebp]
bt ax, di
mov edx, 0x2422f291
lea ebx, [edx + edi]
mov bh, dh
jmp 0x100bf5da
shr ebx, cl
jno 0x100bf53b
lea edx, [edx*4]
adc eax, esp
jmp 0x100bf50e
neg ebp
mov bl, byte [esp]
setle dl
jmp 0x100bf4cb
sub esp, 3
jmp 0x100bf51f
neg ebp
bsr ax, bp
jl 0x100bf4f8
sub esp, 3
jmp 0x100bf561
mov dl, byte [esp + 1]
pop ax
lea esp, [esp + 1]
jmp 0x100bf546
lea edx, [edx*4]
adc eax, esp
jmp 0x100bf50e
not ebp
bts ax, sp
jbe 0x100bf5fd
ja 0x100bf5e7
test eax, 0x2adfb82a
add cl, bl
bound ebx, qword [ebp + 0x124548a]
mov dl, byte [esp + 1]
pop ax
lea esp, [esp + 1]
call fcn.100bf587
in al, dx
lea ebx, [eax + edi]
pushfd
lea eax, [eax - 0x2a]
not bx
mov bl, byte [esp]
jmp 0x100bf5b7
dec eax
js 0x100bf4ee
jns 0x100bf4ee
lea edx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
btr bx, dx
cmp dh, 0x82
xchg dword [esp + 4], eax
xchg ebx, edx
mov ebx, 0xe799b74e
jmp 0x100bf626
mov bh, dh
xor ebp, 0x2da400b
mov dh, al
setp ah
jmp 0x100bf5aa
rdtsc
jmp 0x100bf5ff
rdtsc
call 0x100bf605
inc ecx
add ebp, dword [esi]
xchg al, dh
lea edx, [ecx*4]
lea edx, [ebx + esi]
jmp fcn.100bf645
rcr ebx, cl
push dword [esp + 4]
ret 8

Function at 0x100db98e
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr cx, cx
jns 0x100db9ac
js 0x100db9ac
mov eax, dword [esp]
mov cx, 0x4ff5
mov cx, word [esp]
mov edx, esi
mov ch, byte [esp]
jmp 0x100db996
lea edx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x100db964
mov ah, pe_nt_image_headers32
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
lea eax, [eax*4]
jmp 0x100dba0e
cmp ebp, eax
ja fcn.100d5686
invalid
jbe 0x100db96c
js 0x100db9b2
push 0x5a98fa0f
fisttp word [edi + 0x2a]
fxch st(7)
mov dl, 0xad
mov esp, 0x224648d
lea eax, [esi + 0x50]
mov dx, word [esp]
call fcn.100db98e
sub eax, edx
js 0x100db9ed
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x100dba31
jmp 0x100db9d5
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
mov ecx, ebx
mov cx, word [esp]
bswap ecx
mov cx, word [esp]
jmp 0x100dba3b
scasb al, byte es:[edi]
leave
cmp byte [ebx - 0x6f], bl
adc eax, 0x201fec85
add al, 0x8d
inc esi
inc eax
lea eax, [esi + 0x40]
bswap ecx
mov ch, dl
adc ecx, ebp
jno 0x100db9eb
jo 0x100db9d5
mov cx, word [esp]
jmp 0x100dba3b
mov ecx, ebx
mov cx, word [esp]
bswap ecx
jmp 0x100dba1b
lea ecx, [ebp - 0x80]
sub esp, 9
jmp 0x100dbacc
lea esp, [esp + 1]
jmp 0x100dba7a
sub ecx, eax
call fcn.100dba9f
popfd
push ss
test bl, ah
push ds
cdq
pop es
mov ebx, dword [ebx]
jle 0x100dba03
jmp 0x90a67429
and cl, 0xfc
pushal
pop word [esp]
lea esp, [esp + 2]
jmp 0x100dba64
jge 0x100dba47
lea esp, [esp + 1]
jmp 0x100dba7a
Function at 0x100f2c48
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 1], bh
jmp 0x100f2c26
mov edi, dword [edi*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
mov bp, 0x20eb
mov bp, word [esp]
mov ebp, 0xff00
sub esp, 8
jmp 0x100f2bf7
and edi, ebp
stc
xor eax, edi
jmp 0x100f2c6a
lea edi, [ecx + 0x10]
xor ebx, eax
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x100f2c54
mov word [esp], cx
pop bp
lea esp, [esp + 2]
jmp 0x100f2c0d
mov dword [edi], eax
inc ah
jmp 0x100f2c7c
lea esp, [esp + 0xc]
xor eax, dword [ecx]
mov edi, 0xf496026c
bsf edi, edx
mov edi, edx
jmp 0x100f2c2d
mov eax, dword [ecx + 8]
pushal
xor eax, ebx
pushal
jmp 0x100f2cd5
mov dword [edx], ebx
pop edx
jmp 0x100f2cbe
mov dword [ecx + 0x18], eax
jmp 0x100f2ca8
push edx
mov edx, ecx
add edx, 0x14
jmp 0x100f2c85

Function at 0x100f2f9a
Capabilities:
Encrypt data using aes

Disassembly:
pop eax
mov bl, byte [esp]
mov bx, word [esp]
jmp 0x100f2fab
push 0xa
mov si, di
mov al, 0xa4
xchg ebx, edi
jmp 0x100f2f65
lea esp, [esp + 4]
jne 0x100ad776
lea eax, [esp + ebp]
bswap ebx
jmp 0x100f2f7b
pop edi
call 0x100f2fb2
inc ebp
mov si, dx
jmp 0x100f31e5
not bh
lea ebx, [ebx*4]
mov ebx, dword [esp]
not ebx
pop ebx
ret
lea esp, [esp + 4]
pop esi
mov bx, 0x288c
pop ebp
jmp 0x100f315c

Function at 0x100f31f4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
xchg di, dx
jmp 0x100f321b
stc
add ecx, 0x31144920
cmc
jmp 0x100f3231
lea esp, [esp + 4]
jmp 0x100ade46
Function at 0x100f32fa
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add edi, 4
mov edx, dword [edi]
pop edi
jmp 0x100f3308
xchg dword [esp], ebp
mov dword [esp + 4], esi
lea esp, [esp + 4]
popal
jmp 0x100f32e4
mov dword [esi], edi
shr edi, cl
mov ebx, dword [ebx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
dec di
jmp 0x100f332f
mov di, dx
mov edi, dword [esp]
mov edi, edx
pushal
push word [esp]
jmp 0x100f3342
sub esp, 0xd
lea esp, [esp + 3]
jmp 0x100f345d
xor edi, dword [ebx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
sub esp, 0x11
lea esp, [esp + 1]
jmp 0x100f33a9
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
and ebx, ecx
jmp 0x100f336d
movzx ebx, byte [ebp]
pop ebp
jmp 0x100f33c7
push ebp
mov ebp, esi
add ebp, 9
jmp 0x100f3393
and edx, ecx
jmp 0x100f33f7
and edx, ecx
mov edx, dword [edx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
jmp 0x100f33b1
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
lea ebx, [eax + esi]
mov bx, word [esp]
xchg bh, bl
jmp 0x100f3384
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
push eax
jmp 0x100f3433
push ebp
mov ebp, esi
add ebp, 4
mov dword [ebp], edi
jmp 0x100f343d
and edi, ecx
sub esp, 0x10
mov edi, dword [edi*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
and ebx, ecx
jmp 0x100f33e1
mov eax, esi
add eax, 8
mov edx, dword [eax]
pop eax
jmp 0x100f3405
pop ebp
push ax
add esp, 0
lea esp, [esp + 2]
mov ebx, dword [ebx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
jmp 0x100f3505
shr edi, 0x18
push eax
mov edi, dword [edi*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
jmp 0x100f3423
mov edi, dword [edi*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
call fcn.100f346a
mov edi, dword [edi*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
call fcn.100f34c3
wait
pop ss
xchg edx, esp
adc dword [ebx], edi
or ah, byte [ebp - 0x7611b82c]
adc al, 0x24
mov dword [esp], edx
popal
stc
shr edi, 0x18
jmp 0x100f3480
not edi
bswap edi
mov di, 0xcfce
pushal
mov bl, cl
jmp 0x100f34a3
Function at 0x100f34c3
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
setle bh
jmp 0x100f34e5
push word [esp]
lea esp, [esp + 2]
and ebx, ecx
jmp 0x100f34ad
mov ebx, dword [ebx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
jmp 0x100f352f
movzx ebx, byte [esi + 0xa]
sub esp, 0xe
pop dword [esp + 5]
lea esp, [esp + 2]
jmp 0x100f34cf
push ecx
mov ecx, esi
add ecx, 0xd
jmp 0x100f35cc
and ebx, ecx
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
btr bx, sp
jmp 0x100f3512
and edx, ecx
jmp 0x100f3597
lea esi, reloc.IPHLPAPI.DLL_GetInterfaceInfo
mov edx, dword [esi]
pop esi
jmp 0x100f3542
push esi
mov esi, edx
lea esi, [esi*4]
jmp 0x100f3558
mov edx, dword [esi + 0xc]
jmp 0x100f35a8
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
mov edx, dword [esp]
dec edx
jmp 0x100f3581
mov dword [esi + 8], edi
bswap edi
mov edi, dword [esp]
stc
jmp 0x100f3684
movzx ebx, byte [ecx]
pop ecx
pushfd
add esp, 0
and edx, ecx
jmp 0x100f3575
mov ebx, dword [ebx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
mov edi, 0x8f4ff2f8
dec edi
mov edi, edx
call fcn.100f35b6
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
call fcn.100f3b2d
cmp al, 0xbc
push edx
xor eax, 0xa809cfc4
retf

Function at 0x100f3b2d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
jne 0x100ade46
dec dword [edi]
test byte [eax], al
cmpsd dword [esi], dword es:[edi]
sti
push dword [edi - 9]
je 0x100adde9
ja 0x100f36e2
add dh, cl
ret 0xe86f
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
push eax
jmp 0x100f36d9
and edx, ecx
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
push di
lea esp, [esp + 2]
jmp 0x100f36f6
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x100f3724
Function at 0x1021a063
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 7], edi
mov dh, al
push dword [esp]
or cl, 0x2a
lea esp, [esp + 1]
jmp 0x1021a080
mov word [esp + 0xc], dx
pop dword [esp + 5]
mov byte [esp + 9], bh
jmp 0x1021a0c0
xchg dl, cl
xchg word [esp + 8], bx
push word [esp]
lea edi, [esi + esi]
mov bl, dh
jmp 0x1021a0ec
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
mov si, word [esp]
mov ebx, dword [esp + 1]
stc
lea edx, [ebp + ebp]
cmc
jmp 0x1021a0aa
neg bh
add esp, 0xa
mov dh, byte [esp + 2]
lea edx, [eax*4]
jmp 0x1021a101
xchg byte [esp + 6], ah
mov ah, byte [esp + 5]
xchg ebx, eax
mov edi, dword [esp + 2]
dec dx
xchg di, ax
jmp 0x1021a0d6
mov byte [esp + 1], ah
lea edi, [ecx + edi]
lea esp, [esp + 2]
mov esi, 0x392abc5d
mov bh, byte [esp]
inc ebx
jmp 0x1021a137
cpuid
rcr edx, cl
dec ecx
stc
mov ebx, dword [esp]
lea esp, [esp]
jmp 0x1021a170
mov word [esp + 6], sp
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x1021a195
cpuid
std
bsf esi, esi
mov byte [esp], bl
sub esp, 8
cmc
jmp 0x1021a15a
lea esp, [esp + 2]
sub esp, 0x1d
pop di
xchg cl, bh
xchg bx, si
jmp 0x1021a374
mov bx, word [esp + 6]
lea esp, [esp + 3]
pop dx
inc dh
mov dh, al
jmp 0x1021a17f
pushal
mov cx, word [esp + 0x10]
bts dx, di
mov dword [esp + 0x1a], ecx
bt ebp, esp
jmp 0x1021a1bd
xchg dword [esp + 3], ecx
xchg dword [esp + 2], ebp
mov di, word [esp + 3]
xchg ebp, esi
bt bx, cx
bsf ebx, ebx
jmp 0x1021a1d3
lea edi, [edx*4]
rdtsc
xchg di, cx
lea edx, [eax + edx]
mov ah, byte [esp]
sub esp, 8
jmp 0x1021a1ec
pushal
lea esp, [esp + 0x59]
lea ebp, [eax + edi]
bswap esi
setle bl
mov esi, dword [esp]
jmp 0x1021a21c
pop word [esp + 0xf]
xchg dword [esp + 0x12], edi
xchg byte [esp + 0x11], ah
mov edx, esp
sub esp, 2
sub esp, 0x1c
jmp 0x1021a28d
Function at 0x1021ab93
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
push si
push dword [esp + 4]
push word [esp + 4]
lea edx, [edx*4]
bt ecx, eax
jmp 0x1021abb8
rdtsc
xchg word [esp + 1], dx
mov ebp, esp
cld
xchg dword [esp], edi
jmp 0x1021ab75
neg dh
mov ah, bh
mov edi, 0xe9cba9f6
rdtsc
pop dword [esp]
jmp 0x1021abe5
mov cx, word [esp]
xchg dword [esp + 8], ebp
rcl al, cl
lea esp, [esp + 4]
xchg edi, eax
mov eax, 0x54c54627
jmp 0x1021aba2
cpuid
cpuid
inc bx
mov ch, byte [esp]
push dword [esp + 3]
add edi, ecx
jmp 0x1021ac00
btc bx, si
sbb ebx, 0xc14739ac
xchg byte [esp + 2], bh
xchg word [esp], ax
mov di, bp
mov bl, byte [esp + 1]
jmp 0x1021abcf
sub edi, ecx
push ax
shl si, cl
sub esp, 0xe
btr dx, si
xchg ecx, eax
jmp 0x1021ac6b
xchg bh, ch
lea esp, [esp + 0xf]
xchg cx, bp
mov dx, 0xe65d
rdtsc
jmp 0x1021ac52
bsf eax, edx
mov al, byte [esp + 3]
rcr ebx, 0x1f
call fcn.1021ac94
and eax, 0xa05136a0
daa
pop ebp
xchg dl, dh
mov dword [esp + 3], ebx
pop bp
xchg edi, ebx
bswap edi
shr edx, 0x18
jmp 0x1021ac3c
push bx
push word [esp + 9]
neg ebp
xchg word [esp + 0xb], dx
pop ecx
bswap esi
jmp 0x1021ac12

Function at 0x1021ae98
Capabilities:
Parse pe header

Disassembly:
pushal
push word [esp + 1]
mov word [esp + 0x16], bp
mov dword [esp + 0xf], ebx
jmp 0x1021af54
pop word [esp + 1]
mov dword [esp + 0x1c], esp
jmp 0x1021ae82
lea esp, [esp + 2]
mov dword [esp + 0x38], ebp
pushal

Function at 0x1021aeb3
Capabilities:
Parse pe header

Disassembly:
pop word [esp]
call fcn.1021ae98

Function at 0x1021aebc
Capabilities:
Parse pe header

Disassembly:
pushal
mov dword [esp + 0x78], edi
lea esp, [esp + 0x78]
mov eax, dword fs:[0x30]
jmp 0x1021aefa
push ebp
mov ebp, eax
lea ebp, [ebp + 0xc]
jmp 0x1021aee4

Function at 0x1021b1d4
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 2], al
jmp 0x1021afa1

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0xeb42319
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x45032731
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x403fb9
Capabilities:
Get system information on windows

Disassembly:
push 0x3c
push 0x504320
call fcn.004eb254
mov ebx, ecx
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x48]
mov edi, eax
mov dword [ebp - 0x20], edi
and dword [ebx], 0
push 4
push 0x2000
shl eax, 0xa
push eax
push 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call esi
test eax, eax
je 0x40405b
mov dword [ebp - 0x24], edi
push 4
push 0x1000
push edi
push eax
call esi
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x40405b
and dword [ebp - 4], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.MSVCRT.dll_vswprintf]
add esp, 0xc
mov dword [ebp - 0x28], eax
or dword [ebp - 4], 0xffffffff
mov dword [ebx], esi
jmp 0x40405d
xor eax, eax
call fcn.004eb28f
ret

Function at 0x40408d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
mov edi, eax
test edi, edi
je 0x4040ca
cmp word [edi], 0
je 0x4040ca
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
mov edi, eax
call esi
cmp edi, 0xffffffff
pop esi
pop ebx
je 0x4040ca
mov eax, edi
and al, 0x10
xor ecx, ecx
cmp al, 0x10
setne cl
pop edi
mov eax, ecx
ret
xor eax, eax
pop edi
ret

Function at 0x404187
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 4], edi
jne 0x4041b6
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esi + 0xc]
push eax
push edi
push esi
push fcn.0040413e
push edi
push edi
mov dword [eax], edi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
xor eax, eax
pop edi
inc eax
pop esi
ret
Function at 0x4041e0
Capabilities:
Check for time delay via gettickcount
Terminate thread

Disassembly:
sub esp, 0x28
push ebx
push esi
mov ebx, ecx
push edi
lea esi, [ebx + 4]
xor edi, edi
cmp dword [esi], edi
mov dword [esp + 0x10], ebx
je 0x404301
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push dword [ebx + 8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esp + 0x3c]
push 0x14
push edi
push esi
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, edi
je 0x404300
cmp eax, 1
jne 0x4042d1
push edi
push edi
push edi
push edi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4042d1
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_IsWindowUnicode]
push edi
push edi
mov ebx, eax
cmp ebx, edi
lea eax, [esp + 0x24]
push edi
push eax
je 0x40426b
call dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x404271
call dword [sym.imp.USER32.dll_GetMessageA]
cmp eax, edi
jle 0x404297
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
cmp ebx, edi
lea eax, [esp + 0x1c]
push eax
je 0x404291
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x404297
call dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4042c5
call ebp
sub eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x40]
jae 0x4042c5
push edi
push edi
push edi
push edi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x40424b
jmp 0x4042cd
mov dword [esp + 0x10], 1
mov ebx, dword [esp + 0x14]
call ebp
sub eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x40]
jb 0x4042e5
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], edi
je 0x404213
mov eax, dword [esi]
cmp eax, edi
je 0x404300
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi], edi
pop ebp
mov dword [ebx + 0xc], edi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
add esp, 0x28
ret 8

Function at 0x404992
Capabilities:
Suspend thread

Disassembly:
cmp dword [esi + 0x2c], 0
jne 0x4049ac
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi + 0x2c], ecx
mov eax, dword [esi + 0x2c]
ret

Function at 0x4049b0
Capabilities:
Resume thread

Disassembly:
cmp dword [esi + 0x2c], 0
je 0x4049c8
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x2c], eax
xor eax, eax
cmp dword [esi + 0x2c], eax
sete al
ret