joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437221
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [0x44bc64], ebx
sub eax, esi
xor esi, eax
xor ecx, eax
not esi
xor dword [ebx], 0x2354a6d6
xor edx, dword [0x44bfbc]
xor dword [0x44bbfd], 0x1d8aded0
inc eax
add eax, 0x28f3b2f
xchg eax, eax
neg esi
xor esi, 0x11ab03a9
rol esi, 0x19
inc esi
ror edx, 5
add dword [0x44bd10], esi
ror eax, 0x10
adc byte [eax - 0x39], cl
add eax, 0x44bc0b
test dword [esi], ebp
add al, byte [edx]
not edi
xchg eax, esi
dec eax
not eax
not eax
inc eax
xchg eax, esi
not edi
inc eax
rol eax, 0x10
or dword [0x44bbd9], edi
rol edx, 5
dec esi
ror esi, 0x19
into
sbb dword [ecx - 0x54fc560a], eax
adc edi, esi
fiadd word [edi + 0x2fe881c0]
cmp ecx, dword [edi + 0x13f74802]
xor esi, eax
sub esi, dword [0x44befc]
inc ebx
sub esi, edx
xor esi, eax
inc esi
sub esi, edx
xor esi, 0x405ad2b
sub esi, dword [0x44be24]
mov dword [0x44bbd8], ebx
dec edx
xor edx, ebp
xor edx, ebp
inc edx
mov dword [0x44bd2e], ebx
xor esi, 0x405ad2b
add esi, edx
dec esi
xor esi, eax
add esi, edx
dec ebx
xor esi, eax
xor dword [ebx], 0x2354a6d6
inc edx
sub esi, dword [0x44bdd7]
sub dword [0x44bcc8], 0x35451e70
xor esi, eax
xor edx, ebx
mov dword [0x44bbf8], ecx
xchg esi, edx
mov dword [0x44bc70], ebx
mov dword [0x44bcd4], ecx
neg esi
neg esi
or dword [0x44bcab], esi
xchg esi, edx
xor edx, ebx
xor esi, eax
mov dword [0x44bceb], 0x11c4bf47
dec edx
not dword [ebx]
sub ecx, dword [0x44bf35]
xor ecx, 0x9444c5c
not eax
ror edx, 0x1a
xor dword [0x44bd8d], edx
not eax
add esi, eax
ror eax, 0xd
xor edx, esp
sub esi, eax
not esi
inc edx
xor edi, ebx
xor edi, ebx
dec edx
not esi
add esi, eax
xor edx, esp

Function at 0x4372f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x1efa75ca
xchg edx, eax
mov dword [0x44bd8f], ecx
mov dword [0x44bd12], ecx
sub dword [0x44bc4b], 0x2958e88f
mov dword [0x44bb94], edi
not eax
sub dword [0x44bcf0], edi
xor edx, eax
ror ecx, 0x10
dec eax
xor dword [0x44bd44], 0x1d1832da
inc ebx
sub dword [0x44bb88], ecx
neg eax
rol eax, 0xd
sub esi, eax
not eax
mov dword [0x44bc55], esi
rol edx, 0x1a
not eax
xor ecx, 0x9444c5c
sub dword [ebx], 0x2354a6d6
mov dword [0x44bd1a], ecx
xor edx, esi
inc esi
sub ebx, esp
add edx, dword [0x44bdc2]
mov dword [0x44bbc8], 0x33225df2
xor edi, dword [0x44bedc]
sub dword [0x44bc86], 0x8b3c38
neg esi
inc eax
xor ebx, eax
dec edx
sub edi, dword [0x44be5c]
rol ebx, 0x10
mov dword [0x44bbbc], edx
ror eax, 0x11
add edx, dword [0x44be90]
dec eax
xchg ebx, esi
neg edx
add ecx, esi
invalid
into
Function at 0x4373d5
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
not esi
neg edx
xor ecx, ebx
sub esi, eax
xor ecx, esi
mov dword [0x44bd56], ebx
sub edx, 4
jne 0x436f0c
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
mov edx, dword fs:[eax + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
xor edi, edi
lodsb al, byte [esi]
cmp al, 0x61
jl 0x437410
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x437409
push edx
push edi
mov edx, dword [edx + 0x10]
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
jecxz 0x43748a
add ecx, edx
push ecx
mov ebx, dword [ecx + 0x20]
add ebx, edx
mov ecx, dword [ecx + 0x18]
jecxz 0x437489
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
ror edi, 0xd
add edi, eax
test al, al
jne 0x43743c
cmp edi, 0x835e515e
je 0x437456
cmp edi, 0x30dbca36
jne 0x437430
pop eax
push eax
push ebx
push ecx
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
cmp edi, 0x835e515e
jne 0x43747a
mov dword [ebp - 4], eax
jmp 0x437493
cmp edi, 0x30dbca36
jne 0x437485
mov dword [ebp - 8], eax
pop ecx
pop ebx
jmp 0x437430
pop edi
pop edi
pop edx
mov edx, dword [edx]
jmp 0x437400
mov dword [ebp - 0xc], 0x894b8111
mov ebx, dword [ebp - 0xc]
push esp
push 4
mov eax, 0x45a000
mov edi, eax
mov ecx, dword [edi + 4]
xor ecx, ebx
push ecx
mov ecx, dword [edi]
xor ecx, ebx
push ecx
call dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov ecx, dword [edi + 4]
xor ecx, ebx
push edi
lea esi, [edi + 8]
mov edi, dword [edi]
xor edi, ebx
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [edi + 4]
xor eax, ebx
add ecx, 4
cdq
div ecx
mov ecx, eax
mov eax, dword [edi]
xor eax, ebx
xor dword [eax], ebx
add eax, 4
loop 0x4374d9
pop eax
push esp
push eax
mov ecx, dword [edi + 4]
xor ecx, ebx
push ecx
mov ecx, dword [edi]
xor ecx, ebx
push ecx
mov dword [ebp - 0xc], ecx
call dword [ebp - 8]
push 0
push 0
push 0
call 0x4374ff
pop eax
Function at 0x40273a
Capabilities:
Terminate process

Disassembly:
call section..text
push 0
push 0x406018
push 0x406014
call fcn.00402d64
push 0
push 0x406020
push 0x40601c
call fcn.00402d64
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403402
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x406a44]
test eax, eax
je 0x40341b
call eax
test eax, eax
jne 0x40341b
push 0xfffffffffffffffe
jmp 0x403435
push 1
push 0x406010
push 0x406008
call fcn.00402d64
add esp, 0xc
test eax, eax
je 0x40343b
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x406004
push section..data
call fcn.00402d64
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x403461
mov esi, 0x405bd1
mov cl, 0x20
jmp 0x40346a
cmp al, 0x20
ja 0x403474
inc esi
mov al, byte [esi]
test al, al
jne 0x403465
cmp al, 0x20
jbe 0x40348b
mov al, byte [esi]
cmp al, 0x22
jne 0x40347d
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x403476
jmp 0x40348b
cmp al, cl
ja 0x403491
inc esi
mov al, byte [esi]
test al, al
jne 0x403486
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x4034ba
movzx eax, word [ebp - 0x14]
jmp 0x4034bd
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0040273a
pop ecx
pop esi
leave
ret

Function at 0x4034f8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x406391], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0x80000000
push 0xfffffc18
push 0xfffffc18
push 0xcf0000
push 0x4068a0
push 0x406908
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403542
xor eax, eax
jmp 0x403559
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
leave
ret

Function at 0x40136a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40303c]
jne 0x401374
repz ret
jmp fcn.00401625
Function at 0x10072480
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1007251b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x100724d2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x100724d2
cmp esi, ebx
jge 0x100724d2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10072515
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10072515
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783d8]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783d8]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1007252d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10072750
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
mov eax, dword [ebp + 8]
je 0x10072778
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10072792
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.100295b3
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10076730
leave
ret 4

Function at 0x10072960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10072996
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x100729f5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.100295b3
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.100295b3
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.100295b3
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10076730
leave
ret 0x10
Function at 0x10072a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10072a3c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10072a6d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10072a6b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.100295b3
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10072a6d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10076730
leave
ret 8
Function at 0x4394f6
Capabilities:
Encode data using xor

Disassembly:
std
lodsd eax, dword [esi]
and esi, eax
push ecx
pushfd
std
mov ah, 0xe
iretd
in eax, dx
pop ebx
mov ah, 0xde
cwde
push cs
sbb ch, 0x5f
out 0xcc, eax
insb byte es:[edi], dx
jg 0x4394d6
std
mov cs, word [eax - 0x7181fafc]
imul esp, ebp, 0xffffffd5
push es
outsb dx, byte [esi]
inc ebx
xor eax, 0x93fde113
sub ah, byte [edi*8 - 0x45bfbf36]
push ss
mov edi, esi
dec ecx
sub dword [ecx], 0x735e0390
das
not byte [edi - 0x42]
push eax
cmp cl, byte [edi + 0x3c]
sbb al, 0xb0
cdq
dec edx
scasd eax, dword es:[edi]
cmc
or al, al
mov edi, 0xc8fe8cc
clc
pop edi
sub al, 0xb4
inc edi
push ss
or byte [esi], ch
in al, dx
sbb cl, byte [0xd00418c1]
call 0xbed9f3d9
fild word [ebx + 0x3e2574c4]
cmp al, 0xaa
insd dword es:[edi], dx
wait
out 0xc1, al
inc edx
jne 0x439510
fidivr word [esi - 0x32997dc2]
mov bh, 0x92
wrmsr
cli
sub bh, dl
sub al, 0xf6
sub ch, cl
jle 0x4395eb
jmp 0x4395c5
push cs
xchg ebx, eax
xchg ebx, eax
cmp al, 0x9f
push edi
imul ecx, dword [ebp + 0x7dd46a4f], 0x23
xor esp, dword [edx - 0x6ddd6603]
or dword [edi - 0x414301b4], 0xc88bd7a3
jo 0x4395e6
bound edi, qword [eax + 0x3c]
jl 0x4395f2
cmp al, 0x7c
or dword [ebx + ebp*2 + 0x4e], ebp
insb byte es:[edi], dx
imul ecx, dword [esi + 0x78], 0x7f
dec esi
js 0x43966d
pop ecx
js 0x4395c6
sbb byte [edx - 0x92f9371], bl
into
enter 0xffffffffffffb4ff, 0xffffffffffffff9a
imul ebx, dword [eax + edi*4 + 0x70], 0xffffffbd
ror dword [ecx], 0x3f
xchg ecx, eax
lcall 0xc8ce, 0xf6d06c8f
push dword [edx + ebx*4 + 0x70b85c6b]
mov ebp, 0x913f09c1
loopne 0x439609
sbb ah, byte [eax + 0x63]
popfd
inc esp
and ch, byte [esi + 0x6711cef5]
fld qword [edi]
arpl word [ebp - 0xa51ddbc], bx
into
adc dword [edi - 0x23], esp
pop es
mov edi, dword [esi - 0x5c]
invalid
mov eax, dword [0x32f8d979]
stosd dword es:[edi], eax
not byte [eax]
mov esi, 0x751d6bc5
pop esp
mov esi, 0xd1ed188f
pop ebp
out 0x4d, eax
jge 0x439685
sbb ecx, dword [ebp - 0x1c972416]
fisub dword [eax]
invalid
Function at 0x59da46
Capabilities:
Encode data using xor

Disassembly:
lock sub esp, dword [eax + 0x32971549]
mov ecx, 0x967fd3b2
jg 0x59d93e
xchg esi, eax
mov ecx, 0xaaaee134
imul edi, dword [ebx - 0x95f0cc5], 0x3c75068b
invalid
adc edi, ebx
sub al, byte [eax - 0x6e8ace6b]
push edi
in al, 0x37
cmc
test al, 0xd7
add eax, 0xf1a4d27f
pop ebx
cmc
movsb byte es:[edi], byte [esi]
cli
ja 0x59d99c
retf
pop ebx
mov dh, bh
psrlw mm0, qword [ebp + 0x1bed4c37]
inc edi
jecxz 0x59d9c2
mov ebx, dword [0xa529e547]
and byte [edi - 0x6b1c596e], dl
insd dword es:[edi], dx
inc esp
sti
adc eax, ebp
add esp, dword [edx + 0x68]
push esi
xor ebp, dword [ebp + 0x25]
dec esi
movsd dword es:[edi], dword [esi]
mov esp, 0xacee5865
int 0xa3
mov ebx, 0x48a867d
loope 0x59d9c0
mov bl, 0x18
fnsave dword [ecx + 0x15233a8d]
cmc
insb byte es:[edi], dx
ficom dword [ebp + 0x6b]
adc edx, edi
add eax, 0x9cd74f12
push edx
adc eax, 0x8c517723
fisub dword [esi - 0x3d]
popfd
jae 0x59da23
mov ebp, 0xa3e1ca85
loope 0x59d9e3
push esp
insd dword es:[edi], dx
xor bl, al
adc dl, byte fs:[ebp + 0x17]
push ebp
pop ss
push ebp
pop ss
or al, 0x62
cmp byte [0xbc22560f], ah
jecxz 0x59da40
sbb al, 0x43
shl ebp, cl
sar byte [edi], cl
loop 0x59da3e
bound eax, qword [edi + 0x5b]
movsd dword es:[edi], dword [esi]
salc
inc ebp
rcr ah, 0x74
sbb dword [ebp - 0x63], eax
pushfd
sar dword [ebp - 0x29], cl
iretd

Function at 0x5e1e66
Capabilities:
Encode data using xor

Disassembly:
test byte [eax], al
invalid
xor byte [eax + 0xf], cl
js 0x5e1e94
sbb al, 0x97
add edi, esp
and eax, 0xa54212ef
jecxz 0x5e1eb7
inc esp
stc
jo 0x5e1eeb
mov cl, ch
shr byte [ecx + 0xb], 0xa4
sal byte [esi - 0x75], 0x28
sbb dword [edi - 0x37], esi
sbb esp, dword [eax + 0x3a]
rcr byte [eax + 4], 1
dec ebx
wait
pop ecx
push ecx
shl dword [esi], cl
pop ss
pop ss
jo 0x5e1e4b
out dx, al
int 2
xchg edi, eax
int 0x5f
pushal
lodsb al, byte [esi]
pop edi
cdq
xchg ebx, eax
dec edi
call 0x71c51f52
sbb dword [eax + 0x19780e15], edx
dec edx
fild word [edx - 0x74]
out 0x64, eax
mov edi, 0xcc519690
retf
xchg esi, eax
push ecx
int3
pop ss
pushal
daa
xchg edx, eax
mov edi, 0x69c07720
insd dword es:[edi], dx
daa
xchg edi, eax
imul byte [esi + 0x1f0aef5]
int3
Function at 0x5eef17
Capabilities:
Encode data using xor

Disassembly:
pop ss
xor dl, byte [eax - 0x436a7908]
or byte [ebx + 0x3a1d573f], bh
xchg ecx, eax
adc ebx, ebx
jbe 0x5eef99
pop ds
push ebp
adc byte [eax], dh
out dx, eax
pushfd
pop ebp
invalid
lahf
mov edx, 0xb64e57b0
sbb dword [edi - 0x3b], 0x935732e9
push ecx
lahf
and al, byte [ecx]
jbe 0x5eefec
sub al, 0xf0
sub dword [edi + 0x33], ebp
push ebx
xabort 0xffffffffffffffd7
shl byte [ebp - 0x64088f9], 0x26
xchg esi, eax
out 0xf8, al
outsb dx, byte [esi]
lcall 0xb8a3, 0x61b0a490
cdq
movsd dword es:[edi], dword [esi]
cmc
jg 0x5eef99
jns 0x5eefbd
insb byte es:[edi], dx
jb 0x5eef76
inc edx
jno 0x5ef017
inc ecx
push cs
adc al, 0xb8
in eax, dx
adc edx, ebp
mov edi, 0xc18ec915
mov dword [0xdc7482ec], eax
mov ebx, 0x71021005
fisub dword [edi + 0x2f7fe1a1]
int3
add dh, byte [ecx - 0x26]
cmpsd dword [esi], dword es:[edi]
mov eax, dword [0xcc2f7fe1]
inc edi
sub eax, 0x2e07cba0
in eax, 0xb7
xchg esp, eax
shl dword [edi + 0x1217efcd], 1
or dword [ecx + 0x66], 0xffffffb8
je 0x5ef004
pop edi
adc dh, byte [edi - 0x33]
sub eax, 0xcaaa2b19
sub eax, 0x94c24c77
inc esp
sal ah, 1
pop eax
adc edx, edi
add ecx, edx
xchg edi, eax
je 0x5ef06e
cli
cmpsd dword [esi], dword es:[edi]
xor dword [edi + 0x4730472a], eax
add dh, byte [ebx - 0x80]
xor edx, dword [di]
outsb dx, byte [esi]
xor eax, 0x2c333902
xchg ebx, eax
adc edx, edi
mov ecx, dword [ebx]
and byte [esi + ebx*4 - 0x45274bdd], dl
fnstsw word [esi - 0x3047e537]
sal byte [eax + edx], 0x70
cmp al, 0x72
add al, 0x1a
xor byte [esi], cl
sahf
and esi, dword [eax + ebx*8 - 0x36412246]
sbb bh, byte [eax + 0x1034c0cf]
jo 0x5ef063
jb 0x5ef02d
sbb dh, byte [eax]
push cs
invalid
in eax, 0x18
jbe 0x5eefc5
dec edx
loop 0x5ef08e
aam 0x6a
pop eax
aad 0x53
sbb byte [ecx + ecx*2 + 0x36a690e7], 0x4e
pushfd
dec ecx
out 0x90, eax
cmpsb byte [esi], byte es:[edi]
dec esi
xor byte [edi + 0x7fe1ff45], dl
xchg ebx, eax
scasd eax, dword es:[edi]
jge 0x5ef03b
sti
popal
jp 0x5ef055
sub dword [edi + ecx*8 - 0x5b884040], ecx
mov edi, 0x26c5a477
lds esp, [esi]
inc ecx
jne 0x5ef058
cmc
cwde
push eax
push edi
jbe 0x5ef06a
jbe 0x5ef06a
cld
inc eax
pop ds
push ecx
stosb byte es:[edi], al
mov eax, dword [0x5507ad23]
push ebp
sub eax, 0x37943a4d
mov al, 0xa5
inc eax
pushal
pushal
xchg edi, eax
cmc
mov edx, edx
popfd
or al, 0xa9
jnp 0x5ef055
rcr byte [ebp - 0x2c8456f4], cl
sar byte [edi], 0xe
sub cl, byte [0xa619b569]
test byte [edi - 0x46], bl
pushal
jo 0x5ef0e9
int1
ficomp dword [ebp - 0x79]
shr byte [ecx - 0x9bf68c8], 0xc3
sub ebx, ecx
cmpsd dword [esi], dword es:[edi]
ror byte [ebx], 1
mul dword [edx - 0x1f9e4746]
jle 0x5ef07c
add byte [eax - 0x5ddab5ed], dl
cmp al, byte [eax + 0x472a311a]
jmp 0x5cbefafa
push eax
arpl word [ebx], dx
lcall 0x628d, 0x36260564
retf 0x4a95

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x159ba20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0xf41015
lea edi, [esi - 0xb40015]
push edi
or ebp, 0xffffffff
jmp 0x159ba42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x159ba49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x159ba38
mov eax, 1
add ebx, ebx
jne 0x159ba5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x159ba6c
jne 0x159ba8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x159ba8b
dec eax
add ebx, ebx
jne 0x159ba78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x159ba50
add ebx, ebx
jne 0x159ba87
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x159badd
xor ecx, ecx
sub eax, 3
jb 0x159baa3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x159bb12
sar eax, 1
mov ebp, eax
jmp 0x159baae
add ebx, ebx
jne 0x159baae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x159ba7c
inc ecx
add ebx, ebx
jne 0x159babc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x159ba7c
add ebx, ebx
jne 0x159bac9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x159babe
jne 0x159bada
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x159babe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x159bafc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x159baee
jmp 0x159ba3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x159bafc
add edi, ecx
jmp 0x159ba3e
pop esi
mov edi, esi
mov ecx, 0x7e14f7
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x159bb37
cmp byte [edi], 0x3f
jne 0x159bb1c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x159bb1a
lea edi, [esi + 0x1167000]
mov eax, dword [edi]
or eax, eax
je 0x159bb7f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x119b000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x119b028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x159bb3d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x119b030]
or eax, eax
je 0x159bb79
mov dword [ebx], eax
add ebx, 4
jmp 0x159bb5a
call dword [esi + 0x119b02c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x159bbb9
cmp al, 0xef
ja 0x159bba3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x159bb85
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
or eax, eax
jne 0x159bb92
mov eax, dword [edi]
add edi, 4
jmp 0x159bb92
mov ebp, dword [esi + 0x119b034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x159bbed
sub esp, 0xffffff80
jmp 0x46e5d0
Function at 0x40324c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404a54
test esi, esi
jne 0x403282
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404b44
jmp 0x4032a0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403150
mov edi, eax
test esi, esi
je 0x4032a0
cmp dword [ebx], 0
je 0x4032a0
dec esi
jmp 0x403289
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4032d4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x461008], 0x8088405
inc edx
mov dword [ebx + 0x461008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403a40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x461024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403ad8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403ab8
xor eax, eax
push ebp
push 0x403ab1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403af4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ab8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x461024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x461024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4048d4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x465048], 0
je 0x404935
cmp word [0x46521c], 0xd7b2
jne 0x4048fd
cmp dword [0x465224], 0
jbe 0x4048fd
mov eax, 0x465218
call dword [0x465234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40495c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x461030], 0
jne 0x404951
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret