joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58f02f
Capabilities:
Reference sql statements

Disassembly:
push 0x20
mov eax, 0x5f781a
call fcn.005cb8ce
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.0058ce12
and dword [ebp - 4], 0
cmp dword [eax + 0x18], 0x10
jb 0x58f057
mov eax, dword [eax + 4]
jmp 0x58f05a
add eax, 4
mov edx, dword [ebp + 8]
push eax
push str.SELECT__nIdx_FROM__s_WHERE__token_pKeyword
mov ecx, 0x400
call fcn.0054aa9f
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004055c2
mov eax, dword [ebp + 8]
call fcn.005cb9a6
ret 4

Function at 0x58f086
Capabilities:
Reference sql statements

Disassembly:
push 0x20
mov eax, 0x5f781a
call fcn.005cb8ce
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.0058cdf6
and dword [ebp - 4], 0
cmp dword [eax + 0x18], 0x10
jb 0x58f0ae
mov eax, dword [eax + 4]
jmp 0x58f0b1
add eax, 4
mov edx, dword [ebp + 8]
push eax
push str.SELECT__uid_FROM__s_WHERE__msgId_pExternalReference
mov ecx, 0x400
call fcn.0054aa9f
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004055c2
mov eax, dword [ebp + 8]
call fcn.005cb9a6
ret 4
Function at 0x594c5f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xa0
mov eax, 0x5fccb2
call fcn.005cb937
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.005949ad
push ebx
lea ecx, [ebp - 0x74]
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], 1
mov byte [ebp - 0x56], 2
mov byte [ebp - 0x55], 3
mov byte [ebp - 0x54], 4
mov byte [ebp - 0x53], 5
mov byte [ebp - 0x52], 6
mov byte [ebp - 0x51], 7
mov byte [ebp - 0x50], 8
mov byte [ebp - 0x4f], 9
mov byte [ebp - 0x4e], 0xa
mov byte [ebp - 0x4d], 0xb
mov byte [ebp - 0x4c], 0xc
mov byte [ebp - 0x4b], 0xd
mov byte [ebp - 0x4a], 0xe
mov byte [ebp - 0x49], 0xf
mov byte [ebp - 0x48], 0x10
mov byte [ebp - 0x47], 0x11
mov byte [ebp - 0x46], 0x12
mov byte [ebp - 0x45], 0x13
mov byte [ebp - 0x44], 0x14
mov byte [ebp - 0x43], 0x15
mov byte [ebp - 0x42], 0x16
mov byte [ebp - 0x41], 0x17
mov byte [ebp - 0x40], 0x18
mov byte [ebp - 0x3f], 0x19
mov byte [ebp - 0x3e], 0x1a
mov byte [ebp - 0x3d], 0x1b
mov byte [ebp - 0x3c], 0x1c
mov byte [ebp - 0x3b], 0x1d
mov byte [ebp - 0x3a], 0x1e
mov byte [ebp - 0x39], 0x1f
mov byte [ebp - 0x38], 0x20
mov byte [ebp - 0x37], 0x21
mov byte [ebp - 0x36], 0x22
mov byte [ebp - 0x35], 0x23
mov byte [ebp - 0x34], 0x24
mov byte [ebp - 0x33], 0x25
mov byte [ebp - 0x32], 0x26
mov byte [ebp - 0x31], 0x27
mov byte [ebp - 0x30], 0x28
mov byte [ebp - 0x2f], 0x29
mov byte [ebp - 0x2e], 0x2a
mov byte [ebp - 0x2d], 0x2b
mov byte [ebp - 0x2c], 0x2c
mov byte [ebp - 0x2b], 0x2d
mov byte [ebp - 0x2a], 0x2e
mov byte [ebp - 0x29], 0x2f
mov byte [ebp - 0x28], 0x3a
mov byte [ebp - 0x27], 0x3b
mov byte [ebp - 0x26], 0x3c
mov byte [ebp - 0x25], 0x3d
mov byte [ebp - 0x24], 0x3e
mov byte [ebp - 0x23], 0x3f
mov byte [ebp - 0x22], 0x40
mov byte [ebp - 0x21], 0x5b
mov byte [ebp - 0x20], 0x5c
mov byte [ebp - 0x1f], 0x5d
mov byte [ebp - 0x1e], 0x5e
mov byte [ebp - 0x1d], 0x5f
mov byte [ebp - 0x1c], 0x60
mov byte [ebp - 0x1b], 0x7b
mov byte [ebp - 0x1a], 0x7c
mov byte [ebp - 0x19], 0x7d
mov byte [ebp - 0x18], 0x7e
mov byte [ebp - 0x17], 0x7f
mov dword [ebp - 0x5c], 0xf
call fcn.004055a6
push 0x42
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x74]
call fcn.004054fb
cmp dword [ebp + 0x24], ebx
je 0x594e04
push 0x641040
lea ecx, [ebp - 0xac]
call fcn.0040518c
push 0x641890
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
call fcn.0040518c
lea eax, [ebp - 0x74]
push eax
lea ebx, [ebp - 0xac]
lea edi, [ebp - 0x90]
mov byte [ebp - 4], 3
call fcn.0054aba1
pop ecx
push 0
push 1
mov ecx, edi
call fcn.004055c2
push 0
push 1
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.004055c2
xor ebx, ebx
push 1
lea eax, [ebp - 0x74]
push eax
push esi
lea eax, [ebp + 8]
push eax
call fcn.0059483c
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.004055c2
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.004055c2
call fcn.005cb9ba
ret 0x20
Function at 0x5975e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x80
mov eax, 0x607dda
call fcn.005cb937
mov eax, dword [ebp + 8]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x8c], eax
push 8
xor edi, edi
push edi
lea eax, [ebp + 0xc]
push eax
lea esi, [ebp - 0x84]
mov dword [ebp - 4], edi
call fcn.00406cc7
push 8
push edi
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040522b
push edi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x30], 0x76
mov byte [ebp - 0x2f], 0x70
mov byte [ebp - 0x2e], 0x57
mov byte [ebp - 0x2d], 0x3a
mov byte [ebp - 0x2c], 0x42
mov byte [ebp - 0x2b], 0x78
mov byte [ebp - 0x2a], 0x35
mov byte [ebp - 0x29], 0x49
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x71
mov byte [ebp - 0x26], 0x2a
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x5b
mov byte [ebp - 0x23], 0x33
mov byte [ebp - 0x22], 0x30
mov byte [ebp - 0x21], 0x5a
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x71
mov byte [ebp - 0x1e], 0x2a
mov byte [ebp - 0x1d], 0x32
mov byte [ebp - 0x1c], 0x5b
mov byte [ebp - 0x1b], 0x33
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x5a
mov byte [ebp - 0x18], 0x35
mov byte [ebp - 0x17], 0x49
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x71
mov byte [ebp - 0x14], 0x2a
mov byte [ebp - 0x13], 0x32
mov byte [ebp - 0x12], 0x5b
mov byte [ebp - 0x11], 0x33
mov dword [ebp - 0x34], 0xf
call fcn.004055a6
push 0x20
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.004054fb
push 0xffffffffffffffff
push edi
mov eax, esi
push eax
lea ecx, [ebp - 0x4c]
call fcn.00403e6f
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x4c]
lea edx, [ebp + 0xc]
call fcn.004a4db8
pop ecx
mov ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.00597741
push edi
push 1
lea ecx, [ebp - 0x68]
mov esi, eax
call fcn.004055c2
push edi
push 1
lea ecx, [ebp - 0x4c]
call fcn.004055c2
push edi
push 1
lea ecx, [ebp - 0x84]
call fcn.004055c2
push edi
push 1
lea ecx, [ebp + 0xc]
call fcn.004055c2
mov eax, esi
call fcn.005cb9ba
ret 0x24
Function at 0x5979f6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x1bc
mov eax, 0x6017ae
call fcn.005cb937
mov eax, dword [ebp + 8]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], edi
call fcn.00403859
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x14c], edi
call fcn.00403859
lea eax, [ebp - 0x170]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x150], esp
push dword [ebp - 0x148]
mov byte [ebp - 4], 2
lea esi, [ebp - 0x190]
call fcn.004051ae
mov edx, esi
lea ecx, [ebp - 0x14c]
call fcn.00575893
add esp, 0x20
push str.VolSer
lea ecx, [ebp - 0x1c8]
call fcn.0040518c
push 0x669e90
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 3
call fcn.0040518c
lea eax, [ebp - 0x1c8]
push eax
lea esi, [ebp - 0x170]
mov byte [ebp - 4], 4
call fcn.00403872
push eax
lea eax, [ebp - 0x1ac]
push eax
call fcn.00403872
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00404969
add esp, 0xc
push edi
push ebx
lea ecx, [ebp - 0x1ac]
call fcn.004055c2
push edi
push ebx
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 7
call fcn.004055c2
cmp dword [ebp - 0x2c], edi
jne 0x597b0a
mov ecx, dword [ebp - 0x140]
push 0x641040
call fcn.0040518c
mov dword [ebp - 0x144], ebx
jmp 0x597baa
lea esi, [ebp - 0x13c]
mov byte [ebp - 0x24], 0x38
mov byte [ebp - 0x23], 0x32
mov byte [ebp - 0x22], 0x67
mov byte [ebp - 0x21], 0x4b
mov byte [ebp - 0x20], 0x4c
mov byte [ebp - 0x1f], 0x5a
mov byte [ebp - 0x1e], 0x79
mov byte [ebp - 0x1d], 0x36
mov byte [ebp - 0x1c], 0x68
mov byte [ebp - 0x1b], 0x51
mov byte [ebp - 0x1a], 0x2d
mov byte [ebp - 0x19], 0x76
mov byte [ebp - 0x18], 0x24
mov byte [ebp - 0x17], 0x43
mov byte [ebp - 0x16], 0x37
mov byte [ebp - 0x15], 0x7a
call fcn.00567433
push 0x10
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x3c]
pop ecx
cmp dword [ebp - 0x28], ecx
jae 0x597b67
lea eax, [ebp - 0x3c]
push dword [ebp - 0x2c]
lea edx, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.005674ea
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x140]
lea esi, [ebp - 0x5c]
call fcn.0054aeb1
push edi
push ebx
mov ecx, esi
mov dword [ebp - 0x144], ebx
call fcn.004055c2
lea ecx, [ebp - 0x13c]
call fcn.0056746a
push edi
push ebx
lea ecx, [ebp - 0x40]
call fcn.004055c2
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], bl
call fcn.0040397a
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0
call fcn.0040397a
mov eax, dword [ebp - 0x140]
call fcn.005cb9ba
ret 8
Function at 0x597bdf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x554
mov eax, 0x607ce3
call fcn.005cb937
xor edi, edi
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x13c], edi
call fcn.004b3992
lea eax, [ebp - 0x560]
mov dword [ebp - 4], edi
call fcn.005671ee
cmp dword [ebp - 0x40], 0x10
mov eax, dword [ebp - 0x54]
jae 0x597c18
lea eax, [ebp - 0x54]
push dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x560]
call fcn.00567229
push eax
lea esi, [ebp - 0x3c]
call fcn.0054982d
pop ecx
lea esi, [ebp - 0x138]
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x55
mov byte [ebp - 0x1e], 0x30
mov byte [ebp - 0x1d], 0x6b
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x19], 0x49
mov byte [ebp - 0x18], 0x39
mov byte [ebp - 0x17], 0x38
mov byte [ebp - 0x16], 0x33
mov byte [ebp - 0x15], 0x42
mov byte [ebp - 0x14], 0x4e
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 0x12], 0x35
mov byte [ebp - 0x11], 0x50
call fcn.00567433
push 0x10
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x38]
pop ecx
cmp dword [ebp - 0x24], ecx
jae 0x597c8e
lea eax, [ebp - 0x38]
push dword [ebp - 0x28]
lea edx, [ebp - 0x138]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.005674ea
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.0040529a
push edi
push 1
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 2
call fcn.004055c2
lea esi, [ebp - 0x3c]
mov ecx, ebx
call fcn.0054aeb1
lea ecx, [ebp - 0x138]
call fcn.0056746a
push edi
push 1
mov ecx, esi
call fcn.004055c2
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.004055c2
mov eax, ebx
call fcn.005cb9ba
ret
Function at 0x5f0f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe4
mov eax, 0x641040
mov dword [esp], eax
mov dword [esp + 4], 0x646430
mov dword [esp + 8], 0x64164c
mov dword [esp + 0xc], 0x665e54
mov dword [esp + 0x10], 0x665e1c
mov dword [esp + 0x14], 0x640f34
mov dword [esp + 0x18], 0x641890
mov dword [esp + 0x1c], 0x642ab0
mov dword [esp + 0x20], 0x649588
mov dword [esp + 0x24], 0x641ca4
mov dword [esp + 0x28], 0x647740
mov dword [esp + 0x2c], 0x65c644
mov dword [esp + 0x30], 0x6411f0
mov dword [esp + 0x34], 0x642ab4
mov dword [esp + 0x38], 0x642994
mov dword [esp + 0x3c], 0x653f38
mov dword [esp + 0x40], 0x64f530
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x653b08
mov dword [esp + 0x4c], str.BDMS
mov dword [esp + 0x50], 0x641238
mov dword [esp + 0x54], 0x64123c
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x640b78
mov dword [esp + 0x64], 0x640b74
mov dword [esp + 0x68], 0x641b00
mov dword [esp + 0x6c], 0x641648
mov dword [esp + 0x70], 0x653b40
mov dword [esp + 0x74], 0x65cd1c
mov dword [esp + 0x78], 0x6408ac
mov dword [esp + 0x7c], 0x653fb4
mov dword [esp + 0x80], 0x6408a4
mov dword [esp + 0x84], 0x66928c
mov dword [esp + 0x88], 0x642ab8
mov dword [esp + 0x8c], 0x6408c4
mov dword [esp + 0x90], 0x6433c0
mov dword [esp + 0x94], 0x6417bc
mov dword [esp + 0x98], 0x66a6ac
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x64094c
mov dword [esp + 0xc0], 0x640930
mov dword [esp + 0xc4], 0x654980
mov dword [esp + 0xc8], 0x66a6cc
mov dword [esp + 0xcc], str.ZANYW
mov dword [esp + 0xd0], 0x640948
mov dword [esp + 0xd4], 0x65d848
mov dword [esp + 0xd8], 0x653bd4
mov dword [esp + 0xdc], 0x640934
mov dword [esp + 0xe0], 0x669cbc
cmp cl, 0x39
jae 0x5f10fc
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xe4
ret
Function at 0x4b039b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
mov ax, sp
not eax
sub esp, 2
lea esp, [esp + 1]
jmp 0x4b03c8
Function at 0x4e6a50
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 5]
jmp 0x4e6b35
movzx ecx, byte [esi + 9]
sub esp, 4
xchg dword [esp], edx
mov dword [esp], ecx
jmp 0x4e6b04
movzx eax, byte [ecx]
xchg dl, ch
mov byte [esi + 0x58], al
bswap ecx
jmp 0x4e6a6b
lea ecx, [esi*4]
rcr cl, cl
xchg ch, cl
jmp 0x4e6ad7
movzx edx, byte [esi + 0xa]
mov byte [esi + 0x5a], dl
movzx eax, byte [esi + 0xb]
jmp 0x4e6a8d
movzx ecx, byte [esi + 0xc]
mov eax, dword [esp]
not di
mov edi, ecx
lea edi, [edi*4]
jmp 0x4e6ae4
mov byte [esi + 0x5b], al
lea edi, [edx + esi]
not cx
dec dx
jmp 0x4e6ab0
mov byte [esi + 0x5c], cl
xchg cl, dh
movzx edx, byte [esi + 0xd]
not edi
jmp 0x4e6b16
xchg byte [esp + 2], dh
lea esp, [esp + 4]
mov byte [esi + 0x59], cl
not ah
setl ch
jmp 0x4e6aa3
lea edi, [eax + edi]
mov byte [esi + 0x5d], dl
bsr dx, di
jmp 0x4e6b5f
lea esp, [esp + 1]
lea esp, [esp + 2]
call fcn.004b54ac
bswap edi
jmp 0x4e6a81
movzx ecx, byte [esi + 0xf]
lea edx, [eax*4]
jmp 0x4e6b80
movzx eax, byte [esi + 0xe]
mov byte [esi + 0x5e], al
rdtsc
jmp 0x4e6b49
lea esp, [esp + 4]
movzx edx, byte [esi + 0x10]
sub esp, 8
jmp 0x4e6b8f
mov byte [esi + 0x5f], cl
push ebp
ror di, cl
lea edx, reloc.USER32.dll_MessageBoxA
jmp 0x4e6b6a
lea esp, [esp + 8]
mov byte [esi + 0x60], dl
jmp 0x4e6c18
mov byte [esi + 0x61], al
pushal
add esp, 4
mov dl, al
jmp 0x4e6bb8
movzx eax, byte [esi + 0x11]
dec edi
not dl
mov edx, eax
mov dh, pe_nt_image_headers32
jmp 0x4e6bce

Function at 0x5a822b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0xf]
pop esi
jmp 0x5a826b
popal
add al, dh
inc bl
pop dx
lea esp, [esp]
rdtsc
jmp 0x5a8254
Function at 0x5a8bd5
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
mov dx, 0x6449
add esp, 3
mov bh, byte [esp + 1]
xchg word [esp], bx
jmp 0x5a8be0
rdtsc
xchg di, bp
xchg word [esp], di
jmp 0x5a8bbd
mov byte [esp], dh
cpuid
btr ebp, esp
lea esp, [esp + 1]
cpuid
jmp 0x5a8c6a
add esp, 8
mov esi, ecx
sub esp, 0xa
mov ax, word [esp + 3]
pop ebp
mov bh, byte [esp]
jmp 0x5a8c99
sub esp, 0xc
pop word [esp + 1]
xchg word [esp], bx
bsf si, si
cpuid
xchg word [esp + 3], ax
jmp 0x5a8c43
xchg di, cx
inc dx
xchg word [esp], ax
mov word [esp + 7], di
jmp 0x5a8cf1
mov bx, sp
mov ax, sp
inc edx
push edx
cpuid
mov bx, sp
jmp 0x5a8c83
inc ax
mov ebx, 0x89a0a7a6
sub esp, 0x14
mov al, 0x2e
mov dx, 0x727b
xchg ch, dl
jmp 0x5a8d23
xchg ebx, eax
not eax
mov esi, dword [esp + 0x20]
pop dword [esp + 0x36]
push dword [esp + 0x17]
xchg esi, ebp
jmp 0x5a8d08
xchg word [esp + 4], si
push dword [esp + 0xa]
pop dword [esp + 5]
mov dword [esp + 7], esi
xchg dword [esp], ecx
inc edx
jmp 0x5a8cc5
not ebx
xchg ch, dl
push dword [esp + 4]
lea esp, [esp + 0x43]
setae ah
rdtsc
jmp 0x5a8d69
mov ah, byte [esp + 0x10]
mov edi, eax
pop word [esp]
cpuid
pushal
lea edi, [esp + ebx]
jmp 0x5a8cd9
xchg di, ax
lea ecx, [ebx + esi]
inc bl
mov edx, 0x7799ba04
mov al, ah
jmp 0x5a8dbd
mov esi, 0xf9e2eac2
bswap esi
mov dx, word [esp]
sub esp, 0x12
stc
mov byte [esp + 0xe], dh
call fcn.005a8d9b
mov dword [esi], ecx
pushfd
sti
push ss
xchg ecx, eax
pop ds
jmp 0x5b8ab1
invalid
sar esp, 1

Function at 0x5a9397
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x5a602a
call fcn.005a602f
push esp
push esp
lea esp, [esp + 2]
lea esp, [esp + 0xc]
cmp word [ebx], 0x4550
je 0x5a5e54
jne 0x5a934b
or eax, 0x8a7f188a
or eax, 0xdabf2fab
sub dword [ebp - 0x3d], esi
inc eax
salc
mov cl, 0x40
adc al, 0x7f
std
insd dword es:[edi], dx
hlt
push word [esp + 1]
jmp 0x5a9363

Function at 0x5a9675
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.005a80e3
push eax
jmp 0x5a80de
pop ecx
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x5a92ba
push ecx
mov ecx, eax
lea ecx, [ecx + 0x1c]
mov eax, dword [ecx]
jmp 0x5a92d1
lea esp, [esp + 0xb4]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x5a92fb
mov dword [esp + 1], ecx
push word [esp + 5]
pop word [esp + 5]
pop word [esp + 3]
push word [esp + 1]
mov dword [esp + 0xb4], edi
jmp 0x5a93d4
pop dword [esp]
mov byte [esp + 0x1e], dh
push edx
mov dword [esp + 0xb0], esi
push esp
push dword [esp + 2]
jmp 0x5a9434
pop word [esp + 0x1b]
push esp
jmp 0x5a95b9
Function at 0x40f6c5
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
mov edx, 0x523a23cf
xor edi, edi
mov ebx, 0x40f6fe
cmp eax, 0
jne 0x40f6da
sub byte [ebx], dl
inc ebx
shr edx, 8
inc edi
cmp edi, 4
jne 0x40f6ee
mov edx, 0x523a23cf
mov edi, 0
cmp ebx, 0x40fa00
jb 0x40f6d3
inc eax
cmp eax, 0x2715
jbe 0x40f6c7
nop
nop
nop
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
and ecx, ecx
mov ecx, 0x523a23cf
cmp ecx, dword [esp]
je 0x40f8d9
mov edi, 0
mov ebx, 0x40f6fe
add ebx, 0x32
mov edx, dword [esp]
inc ebx
cmp ebx, 0x40fa00
jne 0x40f75a
inc edi
cmp edi, 0x15f90
jne 0x40f752
xor eax, eax
mov eax, dword [esp]
xor ax, ax
push 0xffff
push 0x5d7574b6
push 0x71e40722
push 0x15f8ef80
push 0xd66358ec
mov edi, esp
cmp word [eax], 0x5a4d
jne 0x40f7ac
mov edx, dword [eax + 0x3c]
cmp edx, 0x1000
ja 0x40f7ac
cmp word [eax + edx], 0x4550
je 0x40f7b3
sub eax, 0x10000
jmp 0x40f792
push eax
mov esi, dword [eax + edx + 0x78]
add esi, eax
add esi, 0x18
xchg ebx, eax
lodsd eax, dword [esi]
push eax
lodsd eax, dword [esi]
push eax
lodsd eax, dword [esi]
push eax
add eax, ebx
push eax
lodsd eax, dword [esi]
push eax
mov ebp, esp
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov esi, dword [ebp + 4]
mov esi, dword [esi]
add esi, ebx
xor edi, dword [eax - 4]
or al, 0
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sub byte [ebx], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
pop es
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi], al
je 0x40f802
add edi, 4
jmp 0x40f7e7
shl edx, 1
mov ecx, dword [ebp]
add ecx, ebx
add ecx, edx
mov ecx, dword [ecx]
and ecx, 0xffff
mov edx, dword [ebp + 0xc]
add edx, ebx
add byte [eax], al
add byte [eax], al
mov al, byte [0xff001172]
invalid
pop esi
add eax, 0x40fa00
sub eax, 0x40f6fe
mov ebx, eax
xor eax, eax
mov ax, word [edi + 6]
dec ax
imul eax, eax, 0x28
sub edx, eax
xor cx, cx
mov esi, dword [edx + 0xc]
add esi, 0x400000
xor eax, eax
mov al, byte [esi]
add esi, eax
pushal
mov edi, ebx
call fcn.0040f92b
mov ecx, dword [esi]
mov edi, esi
sub edi, eax
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
popal
add edx, 0x28
inc cx
cmp cx, word [edi + 6]
jb 0x40f8f6
mov eax, 0x4051b9
call eax
ret
Function at 0x402b08
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404380
test esi, esi
jne 0x402b3e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404470
jmp 0x402b5c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a1c
mov edi, eax
test esi, esi
je 0x402b5c
cmp dword [ebx], 0
je 0x402b5c
dec esi
jmp 0x402b45
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402e38
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x55e008], 0x8088405
inc edx
mov dword [ebx + 0x55e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x55e024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033f8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033d8
xor eax, eax
push ebp
push 0x4033d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403414
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033d8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x55e024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x55e024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4041e4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x56104c], 0
je 0x404245
cmp word [0x561220], 0xd7b2
jne 0x40420d
cmp dword [0x561228], 0
jbe 0x40420d
mov eax, 0x56121c
call dword [0x561238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x55e070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40426c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x55e034], 0
jne 0x404261
push 0
push 0x55e068
push 0x55e070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret