joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1a23f55
Capabilities:
Encode data using base64

Disassembly:
inc esp
mov ebx, esi
call fcn.01796051
mov ecx, 0x498abd98
jmp 0xe55cba
mov edx, dword [edi]
dec eax
add edi, 4
mov ebp, 0xf93b3b91
inc ecx
xor edx, ebp
movzx esi, bp
dec eax
ror dword [esp + esi - 0x3b91], 0xf8
bswap edx
ror edx, 3
jmp 0xd49b55
mov dword [esp + edx*8 - 0x6000000], ebx
call fcn.01924914
inc ecx
xor ebx, eax
call fcn.0192f23f
push ecx
mov eax, dword [edi + ecx - 0x498abd98]
shl ecx, 0xaa
lea edi, [edi + ecx*2 - 0x55ecbffc]
shl dword [esp + ecx - 0x2af66000], 0xbf
xor eax, ebx
not eax
rol eax, 2
lea eax, [eax + ecx*4 - 0x2d8f866]
sub word [esp + ecx - 0x2af66000], cx
movsx edx, cx
inc cl
xor eax, 0xf104e326
xor ebx, eax
shl edx, 9
adc esi, eax
mov eax, dword [ecx + ebp - 0x2af66001]
jmp 0xe245d2
shr al, 0xc3
adc edi, 6
mov byte ss:[edx], cl
movzx ecx, ax
mov eax, dword [ebp + ecx*4 - 0x3a000]
lea edx, [ecx + ecx*4 + 0x45ae4a80]
inc dl
lea ebp, [ebp + ecx*2 - 0x1cffc]
sal dl, 0x47
rol cl, 0xa1
xor eax, ebx
lea edx, [ecx*2 + 0x6e073bbf]
bswap edx
not eax
rol cl, 0xe2
sbb eax, 0xcc2aa22f
xor ecx, edx
sal cl, 0x22
ror eax, 1
shl dl, 6
sub eax, 0x6a06eaa0
sal cx, 0x6b
ror edx, 0xab
lea ecx, [ecx*4 - 0x6fe59578]
xor ebx, eax
add esi, eax
movsx eax, cx
call fcn.01766a66
add ebp, 4
xor eax, ebx
neg eax
mov ecx, 0x30ba710e
not eax
neg eax
call fcn.00e168e3
call fcn.01a11c0c
mov ecx, 0x4308d218
movsx eax, cl
mov edx, dword [edi + eax*8 - 0xc0]
ror eax, cl
neg eax
mov cl, byte [edi + ecx - 0x4308d214]
js 0x1916725
push 0xf8a401ad
jmp 0xd74b6e

Function at 0x1a243a6
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x3c
or ecx, dword [esp + ecx*2 - 0x16ffffff]
jl 0x19b4f8e
xor bl, al
lea edx, [ecx + ecx*8 - 0x37459f2]
add dl, byte [esp + 1]
or word [esp + 2], cx
lea eax, [esp + eax + 8]
mov dx, word [eax]
js 0x18e5f1b
xor dword [esp + 4], 0x73bbcaa7
sbb edi, 2
mov word [edi], dx
movsx edx, cl
xadd dword [esp + edx - 0x11], edx
add cl, ch
pop ecx
pop edx
ja fcn.019124b2
sal ecx, cl
lea edx, [ecx*4 + 0x36221514]
inc al
mov dword [esp + ecx*2 - 0x17000000], edx
not al
jmp 0xda13ef
Function at 0xa54d6f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0xa53625
call fcn.00a5362a
jmp 0xa54cb0
test eax, eax
jmp 0xa54d09
pop eax
sub eax, 0xa9fd2fb6
jmp 0xa54d2d
call 0xa54d02
inc edi
je 0xa54d38
jne 0xa54d69
jb 0xa54d5e
outsb dx, byte [esi]
je 0xa54d50
push 0x64616572
add bl, ch
or eax, 0x5a23e0a1
mov ch, 0xf
test byte [edi - 0x18], cl
invalid
je 0xa5355e
jne 0xa54cec
push eax
call fcn.00a4a646
push eax
jmp 0xa54d38
call dword [eax - 0x560428ee]
jmp 0xa54ca8
sti
test eax, 0xffff70e9
invalid
call 0xa54d4c
add byte [eax], al
add byte [eax], al
mov eax, 0xcb992adf
bound esp, qword [eax + 0x66]
bsr edx, ebp
movsd dword es:[edi], dword [esi]
std
invalid
outsb dx, byte [esi]
cld
wait
jbe 0xa54d31
jmp dword [esi - 1]

Function at 0xa7b32e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ecx + 4]
mov dword [ecx], eax
pop ecx
mov eax, esi
call fcn.00a7b2b3
neg ax
jae 0xa7b303
rdtsc
jmp 0xa7b305
lea eax, [ecx + ebx]
lea eax, [ebp*4]
cmc
jno 0xa7b30a
mov dl, 0xfc
call fcn.00a7b34a
mov eax, dword [0x3ec3a436]
invalid
rdtsc
sub edi, 4
jmp 0xa7b2e0
mov dl, 0xfc
jmp 0xa7b313
jmp 0xa7bd8e
bsr ax, cx
mov eax, 0x796c4af0
lea eax, [edx + edx]
push ecx
mov ecx, esi
jmp 0xa7b2ca
mov eax, 0x796c4af0
lea eax, [edx + edx]
mov cl, ch
sete ah
jmp 0xa7b73a
movzx edx, byte [ebp]
bsr ax, bp
jb 0xa7b318
bsr ax, cx
jmp 0xa7ba3f
Function at 0xb7e337
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl ax, cl
mov ecx, dword [esp + 1]
setg ah
jmp 0xb7e39b
btr edi, esp
bswap ecx
sete dh
rdtsc
neg si
lea eax, [eax + 0x61]
jmp 0xb7e3e7
pop esi
rol cx, cl
mov ecx, ebp
mov edi, ecx
lea ebp, [ebp - 0xcf]
cpuid
jmp 0xb7e381
xchg edx, eax
not dx
rdtsc
shr ebx, 7
bsr bx, cx
jmp 0xb7e3f7
mov bh, byte [esp]
bsr dx, cx
mov bl, bh
lea esp, [esp]
mov ah, byte [esp]
lea esi, [edx*4]
jmp 0xb7e3ad
xchg byte [esp], cl
inc edi
add ebx, ebp
stc
mov si, word [esp]
mov bp, bx
jmp 0xb7e3c6
lea ebp, [eax - 0x7e193bf]
sub eax, eax
mov si, 0x9611
mov cl, ch
mov al, ah
jmp 0xb7e480
mov dx, word [esp + 6]
xchg byte [esp + 2], bl
mov al, 0xce
mov ebp, dword [esp + 8]
jmp 0xb7e48f
mov bl, 0xd0
mov si, word [esp + 0xa]
add esp, 9
and ax, 0x32da
bswap ebp
cmc
jmp 0xb7e423
mov esi, 0xd283438e
lea esi, [ebx + esi]
bsr di, bp
mov byte [esp + 0xd], bh
cpuid
pop cx
jmp 0xb7e439
pushal
xchg di, si
cld
lea esp, [esp + 0xb]
sub bl, ah
pop bp
jmp 0xb7e455
pop dword [esp]
mov edi, ecx
mov dword [esp], ecx
rdtsc
mov ebx, ebp
mov dword [esp], eax
jmp 0xb7e4e3
btr edx, edx
mov word [esp], dx
inc bl
pop cx
bswap ebx
bswap edx
jmp 0xb7e520
xchg byte [esp + 2], bl
xchg dword [esp], eax
pop word [esp]
push edx
mov eax, dword [esp]
pop di
jmp 0xb7e4ad
mov esi, 0xa457c0a
setno bh
bswap ebx
rdtsc
not esi
sete dh
jmp 0xb7e4c4
mov cx, di
inc cl
pop bx
setno ah
call fcn.00b7e4f6
pop cx
lea edi, [ecx + 3]
mov ecx, esi
rdtsc
xchg dword [esp + 0x10], edi
btc edx, edi
jmp 0xb7e5a1
add al, dh
pop dword [esp + 0xe]
call fcn.00b7e58a
fadd dword [edx - 0x30]
mov bh, 0x42
cld
lcall 0x3aa6, 0x1f29707
adc eax, 0x24148b66
mov dx, word [esp]
bswap ebx
lea ecx, [eax + ebx]
jmp 0xb7e52f
xchg dword [esp + 0x18], eax
mov bx, 0x8021
xchg word [esp + 7], bp
pop edx
cpuid
mov dword [esp + 0x15], ecx
jmp 0xb7e541

Function at 0xb7e58a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp + 0x10]
not dx
mov word [esp + 4], sp
rdtsc
xchg dword [esp + 0xa], edx
push esp
jmp 0xb7e5ff
mov ebx, 0x55b56b80
pop dword [esp + 0x10]
lea ecx, [esi + 0xbd]
jmp 0xb7e565
mov al, ah
mov di, word [esp + 0xc]
xchg dword [esp + 0x10], ebp
sub esp, 0xe
rdtsc
jmp 0xb7e5d9
Function at 0xb7ea02
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp], al
mov si, word [esp]
bsr bp, bp
mov bp, 0x7f53
lea esi, [ebp + 7]
cpuid
jmp 0xb7e9c1
mov byte [esp], ch
add esp, 0
xchg ebx, ecx
add esp, 0
mov ax, 0x5d19
btc esi, edi
jmp 0xb7e95d
lea esp, [esp + 1]
mov di, dx
mov cx, 0xb979
mov dl, 0x9c
xchg byte [esp], al
mov si, word [esp]
jmp 0xb7e97a
cmc
pop dword [esp + 0xd]
pushal
mov si, word [esp + 0xe]
mov esi, eax
mov cl, 2
jmp 0xb7ed66
mov ecx, 0x6d46e3d2
sub esp, 0x1a
xchg word [esp + 0xe], ax
mov edx, ebp
rdtsc
mov ebx, dword [esp + 4]
jmp 0xb7e9ab
mov ebx, dword [esp + 7]
not esi
pop dword [esp]
lea ecx, [esi*4]
ror edx, 1
add esp, 5
jmp 0xb7e995
rdtsc
xchg di, cx
mov di, bx
jmp 0xb7e9de
setnp dh
setge dh
mov ax, bx
call fcn.00b7eaed
mov esp, 0x29dabf2f
sahf
fiadd dword [eax - 0x2a]
mov cl, 0x40
invalid
mov ebx, ecx
cld
inc al
mov eax, 0xd2035f6a
neg bx
neg eax
jmp 0xb7ea0c
xchg ch, dl
mov edi, dword [esp]
lea ebp, [edi*4]
mov ebx, 0x5eadb54a
add bx, 0x9d2e
bsr bx, bp
jmp 0xb7ea27
bsr dx, cx
mov ebp, 0xd9d2b68
mov ebp, ecx
lea edx, [esp + eax]
mov bx, dx
cpuid
jmp 0xb7ea48
push word [esp + 0xa]
inc cl
pushal
lea esp, [esp + 0x59]
bswap edi
mov al, 0x76
jmp 0xb7eb40

Function at 0xb7ec83
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0x10]
push word [esp + 0xb]
cld
mov ch, byte [esp + 0xc]
push dword [esp + 9]
jmp 0xb7eca7
mov edi, ecx
cpuid
mov bl, bh
mov si, sp
cpuid
mov di, word [esp + 0x1d]
jmp 0xb7ec0e
xchg esi, ebp
xchg bh, cl
mov ax, sp
mov al, ah
rcr ebp, 5
push word [esp + 6]
jmp 0xb7ec27
pop dword [esp + 0x13]
mov ax, word [esp + 9]
mov ax, 0xaed1
inc dx
clc
push dword [esp + 0x18]
jmp 0xb7ec40
jmp 0xb7ec5a
sub dx, 0x8f08
rdtsc
rol cx, cl
shr esi, 0xd
pop esi
mov bp, 0xbaa3
jmp 0xb7ecb6
btr edx, edx
popal
xchg bx, ax
btc ecx, edi
mov cl, 0xba
pop esi
jmp 0xb7ec85
inc esi
lea eax, [ebx + edi]
mov edx, dword [esp]
xor bp, 0xdafc
push edx
pop word [esp]
jmp 0xb7ed21
rdtsc
pop bp
inc edi
mov bl, bh
call fcn.00b7ecc9

Function at 0xb7eddd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 0x16], cx
popal
mov dword [esp + 3], ebp
pop word [esp + 2]
xor dl, ch
jmp 0xb7efba
mov ax, sp
rdtsc
not esi
bswap ebp
jmp 0xb7edc6
add esp, 2
call 0xb7ee33
cpuid
bsf bx, ax
mov bl, 0x48
xchg cx, si
clc
mov ax, word [esp + 9]
jmp 0xb7eeb8
rdtsc
mov ch, byte [esp]
push esp
xchg dword [esp + 4], ecx
inc eax
mov dx, bx
jmp 0xb7ef8b
Function at 0xb8053d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xb805d5
mov word [esp + 0x22], di
cpuid
mov dword [esp + 9], esi
bsf cx, ax
xchg dword [esp + 0x1b], eax
jmp 0xb805b3
mov di, word [esp + 0x16]
mov ebx, dword [esp + 0xc]
shr ah, 1
cpuid
xchg ch, dl
pop word [esp + 0x1c]
jmp 0xb80659
xchg word [esp + 0x12], bp
bswap esi
btr eax, esp
mov bp, 0x8fa3
mov dword [esp + 0x18], esi
lea edi, [ecx*4]
jmp 0xb80590
lea ecx, [edi*4]
bswap edi
pushal
mov edi, 0xf0e8e2b0
lea esi, [edx*4]
lea ebp, [eax - 0x7b8dbee7]
jmp 0xb80542
mov eax, dword [esp + 7]
mov esi, 0xb861d23c
pop word [esp + 7]
mov eax, dword [esp + 5]
mov dword [esp + 3], ecx
jmp 0xb80640
lea esi, [ebx*4]
mov cl, 0x1a
cmc
sub esp, 6
push edx
push word [esp + 1]
jmp 0xb805f6
pop edx
lea edx, [ecx*4]
mov di, 0x4727
mov dword [esp + 3], eax
jmp 0xb808f1
mov si, 0xb75f
add eax, ebp
mov esi, dword [esp + 7]
clc
xchg esi, eax
push word [esp + 5]
jmp 0xb8062a
mov ebx, ecx
sub esp, 0x1e
lea esp, [esp + 0x41]
bsf dx, ax
rdtsc
bsr si, bp
jmp 0xb80615
bswap ebp
xchg word [esp + 0x26], ax
xchg byte [esp + 0xc], cl
mov edx, 0xa125f546
xchg cx, ax
lea edx, [ebp + 0xa7]
jmp 0xb80726
mov dx, 0xa5e9
lea edx, [ebx*4]
mov bp, 0x5307
sub esp, 0x18
sub esp, 0x12
bswap edi
jmp 0xb80692
mov al, 0x86
mov dh, byte [esp + 5]
neg di
mov dword [esp + 0x11], eax
xchg dword [esp + 0x2a], eax
stc
jmp 0xb80706
xchg byte [esp + 0x18], cl
lea edi, [eax*4]
mov dx, 0x8375
btc esi, ebx
push word [esp + 0x26]
cpuid
jmp 0xb806cc
xchg word [esp + 0x27], si
pop word [esp + 0x1d]
push word [esp + 0x1c]
xchg dword [esp + 0x10], edi
mov dword [esp + 0x1e], esi
jmp 0xb807ae
bsr di, cx
rdtsc
bswap ecx
sub esp, 2
lea edx, [esp + edi]
mov bp, word [esp + 0x19]
jmp 0xb806eb
mov ah, byte [esp + 3]
lea esp, [esp + 5]
cpuid
xchg si, bx
mov esi, 0x47f32a40
mov di, 0xe695
jmp 0xb806b3
lea esp, [esp + 0x53]
stc
xchg ecx, ebp
not edx
sub esp, 0x1e
mov bp, dx
jmp 0xb8085a
lea edi, [ebx*4]
mov bh, byte [esp + 0x14]
xchg di, bx
xchg word [esp + 0x21], bx
not edi
pushal
jmp 0xb80767
xchg byte [esp + 0x24], al
push dword [esp + 0x26]
and bp, 0xd662
btc ebx, ebx
cpuid
rcr ecx, 7
jmp 0xb80781
pop di
lea ebp, [edx + edx]
pop dx
sete ch
xchg word [esp + 0x11], bx
call fcn.00b8082e
and al, 0x57
mov esi, 0x648a2889
and al, 9
mov ah, byte [esp + 9]
xchg edi, esi
pop bx
mov dword [esp + 0x13], ecx
pop word [esp + 0x15]
neg cx
jmp 0xb807c5
pop bx
mov ch, byte [esp + 0xd]
mov ax, 0xfe65
mov al, 0xae
xchg dword [esp + 0xa], eax
mov dl, 0xdc
jmp 0xb807de
xchg si, ax
mov byte [esp + 0xc], ah
bsf si, ax
mov ch, byte [esp + 9]
xchg word [esp + 0xd], bp
lea eax, [edx*4]
jmp 0xb807fd
pop si
cld
bswap edx
rdtsc
mov edi, dword [esp + 3]
lea ecx, [esi + 0x6f2261dd]
jmp 0xb8074c
xor ebp, esi
cpuid
xchg byte [esp + 4], cl
inc dx
mov edx, 0x57c14d8a
mov ebp, dword [esp + 7]
jmp 0xb808a5
Function at 0xb8067d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ecx + edi]
rcr dh, 7
mov byte [esp], dh
lea edx, [ebp*4]
xchg ebp, esi
mov al, ah
jmp 0xb8019c
rdtsc
neg esi
lea ecx, [edi*4]
inc si
xchg ch, dl
mov ah, byte [esp]
jmp 0xb8015e
mov byte [esp], bh
mov edi, 0xedcdb68
btc edx, ebx
not edx
bswap ecx
jmp 0xb80212
bsr si, bp
add esp, 0
bsr di, cx
mov dh, byte [esp]
sub esp, 0
mov byte [esp], bh
jmp 0xb80188
pop word [esp]
push word [esp + 3]
not dx
mov ax, word [esp + 1]
not ebx
bswap esi
jmp 0xb801fc
lea ebp, [esp + ebx]
not eax
push dword [esp + 0xa]
ror bh, 3
lea ecx, [ecx*4]
rdtsc
jmp 0xb801ca
lea ebx, [eax + ebx]
btc esi, ebx
rdtsc
mov dx, 0xfd0d
inc ebx
jmp 0xb80241
lea edi, [eax + 0x35058b01]
sub esp, 8
push dword [esp + 8]
xchg esi, edi
cpuid
bswap edx
jmp 0xb801e5
lea esi, [ebx*4]
xchg dword [esp + 1], eax
mov di, 0xf7ab
xchg word [esp + 0xd], bx
jmp 0xb802a8
push dword [esp + 5]
xchg dword [esp], ebx
sete ah
mov cl, ch
mov ecx, 0x8426b98e
jmp 0xb80227
push word [esp + 0xb]
add esp, 0xf
lea ebp, [edi + ebp]
rdtsc
xchg edi, edx
lea esp, [esp]
jmp 0xb801b4
bsf dx, si
pop ax
call fcn.00b80273
ret 0xc757
sub bl, ah
push word [esp + 0x14]
sub bl, ah
xchg ch, dl
not ah
rdtsc
jmp 0xb8028f
mov dword [esp + 1], esi
pop dword [esp + 4]
cld
mov bp, 0x80dd
btc edx, ebx
mov byte [esp + 3], dh
jmp 0xb8025c
mov esi, 0xa4d8617a
mov ebp, eax
mov di, dx
lea edx, [esp + ecx]
rdtsc
sub esp, 0x12
jmp 0xb80319
xchg word [esp + 1], bx
pop word [esp]
pop si
mov dx, di
xchg edi, ebx
jmp 0xb8043d
Function at 0xb80fdd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
jmp 0xb7f010
call fcn.00b7f015
setno bh
lea esp, [esp + 5]
sub bp, 0x2b60
lea edx, [esp + ebx]
xchg cx, ax
xchg ch, dl
jmp 0xb80fc4
pop word [esp + 1]
rdtsc
cpuid
sub esp, 2
mov esi, 0x34804c4c
mov word [esp], bx
jmp 0xb80f70
bsr bx, bp
cld
pushal
mov edx, 0x7d1e8da0
popal
sub esp, 4
jmp 0xb80fe8
lea ecx, [ecx*4]
mov bx, dx
mov bl, bh
xchg ch, dl
mov bl, bh
jmp 0xb80fac
bswap eax
mov dword [esp + 2], eax
add esp, 5
jmp 0xb80f95
setbe dh
lea edi, [ebx*4]
mov ecx, eax
push dword [esp + 1]
jmp 0xb8208b
mov di, sp
mov ecx, 0x39ecdc4
lea eax, [eax + edi]
rdtsc
jmp 0xb8105f
mov edi, dword [esp + 5]
push word [esp + 3]
lea ebp, [edx*4]
stc
jmp 0xb80ffe
not bp
mov ah, byte [esp + 3]
mov edi, 0x10be17b6
mov word [esp + 2], dx
xchg ecx, eax
xchg ah, bl
jmp 0xb81014
mov dword [esp + 1], ecx
neg ecx
neg bh
lea esp, [esp + 1]
lea ecx, [eax*4]
jmp 0xb811a8
mov ah, byte [esp + 1]
lea ebp, [edi*4]
mov word [esp], bx
jmp 0xb81044
bswap edi
sub ecx, eax
mov cl, ch
mov byte [esp + 1], dh
mov word [esp + 2], dx
mov byte [esp + 3], ch
jmp 0xb8102d
setp ch
mov di, 0xa33b
pop word [esp]
mov di, 0x3197
mov bl, bh
push esp
jmp 0xb81077
lea esp, [esp + 5]
lea edx, [edi*4]
mov bx, di
xchg byte [esp + 0xc], dl
jmp 0xb8116b
lea esp, [esp + 1]
xchg word [esp], cx
inc bp
sub esp, 0x16
mov di, word [esp]
jmp 0xb810a6
xchg cx, ax
lea esp, [esp]
mov word [esp + 2], di
xchg ecx, ebx
lea esp, [esp + 7]
lea esp, [esp + 1]
jmp 0xb810c2
mov dword [esp], ecx
mov dx, 0xae21
mov dh, byte [esp]
btr ebp, edx
mov dh, byte [esp + 6]
push edx
jmp 0xb810da
neg cx
xchg cx, bx
call fcn.00b8112b
movzx ebx, word [eax + 0x3c]
jmp 0xb81520
mov bp, word [esp + 0xe]
xchg di, ax
mov di, 0x5615
mov bp, bx
add esp, 2
push word [esp + 0xc]
jmp 0xb81150
mov al, 0x16
mov ecx, esi
lea esi, [edi*4]
inc cx
setne ch
mov di, 0x8ab9
jmp 0xb810f5
add ebx, eax
cmp word [ebx], 0x4550
jmp 0xb8156c
sub eax, 0x10000
jmp 0xb81547
cmp word [eax], 0x5a4d
je 0xb8115b
jne 0xb8152d
and al, 0xbd
sub eax, 0x166cc734
mov ds, word [ebx + edi*2]
xchg esi, eax
and dword [ebx - 0x5bda294d], eax
out 0x11, al
nop
adc ecx, dword [edx + 0x34840f25]
iretd
je 0xb7e4a6
jne 0xb8152d
dec eax
salc
inc esp
and ebx, esi
pop ecx
invalid
pop ebx
neg edi
not dx
mov edi, 0x123ace8c
lea esp, [esp + 1]
mov bh, byte [esp + 3]
jmp 0xb81092
lea esi, [eax + 0x5377fd89]
mov ecx, eax
cpuid
xchg word [esp + 5], bp
not di
mov byte [esp + 7], ch
jmp 0xb81970
mov dword [esp + 3], esi
mov bx, word [esp + 2]
neg dx
mov di, word [esp + 7]
mov ebp, eax
rol si, cl
jmp 0xb81fbf
Function at 0xb81361
Capabilities:
Execute anti-debugging instructions

Disassembly:
and al, 0x66
mov eax, edi
mov dl, dh
jmp 0xb8122f
xchg dword [esp], ebp
call fcn.00b811c1
jg 0xb811c8
jp 0xb81203
in al, dx
inc ebp
mov edx, dword [ecx]
and eax, 0x9310a613
or ah, byte [ebp - 0x3d010a2c]
cmc
inc dl
cpuid
stc
sub esp, 0xe
mov dword [esp + 7], eax
jmp 0xb811da
retf
add esi, ebp
neg ah
and edi, ecx
mov esi, dword [esp]
and cl, bh
rdtsc
jmp 0xb811f3
sub esp, 0xe
xchg word [esp + 0x19], cx
xchg bh, cl
mov cx, 0x5617
jmp 0xb8125b
mov bl, 0x38
mov byte [esp + 1], ah
lea ebp, [ecx + 0x6b]
xchg dword [esp + 4], ebx
setne ah
mov edx, esi
jmp 0xb81219
clc
pop di
mov cl, ch
mov si, bx
pop word [esp + 7]
neg ch
jmp 0xb8129e
mov dword [esp + 3], eax
push word [esp + 5]
mov edx, eax
mov eax, 0x7e74d9b2
xchg si, ax
jmp 0xb81243
rdtsc
mov si, 0x34f7
xchg cx, bp
lea ebp, [ecx + 0x93]
mov esi, eax
xchg bh, cl
jmp 0xb8120a
add esp, 0xb
mov cl, ch
xchg ecx, edx
neg ah
xchg word [esp + 3], di
jmp 0xb81305
stc
pop word [esp + 0x13]
mov bp, word [esp]
neg bx
mov ax, word [esp + 0xe]
jmp 0xb81288
xchg word [esp + 0x34], bp
lea ebp, [ecx*4]
push dword [esp + 0x30]
lea esp, [esp + 0x41]
xchg edi, ebp
mov bp, 0x27ed
jmp 0xb81273
lea esp, [esp + 0x20]
popal
call fcn.00b81348
xor dword [ecx + 0x65b34021], esi
xor dword [edx + 0x54b24720], esi
xor ebp, dword [edx]
inc ebp
hlt
not ch
lea esp, [esp]
mov eax, esi
pushal
mov ecx, 0x442983f8
lea esp, [esp + 1]
jmp 0xb812d3
add esp, 0xd
pop ax
btr edx, esp
neg bh
push esp
add esp, 5
jmp 0xb812ee
bswap edi
pop bx
jmp 0xb812b7

Function at 0xb8141f
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 0x20]
push word [esp + 0xf]
pop word [esp + 0x23]
lea esp, [esp + 0x1d]
jmp 0xb818e0
adc eax, 0xa1388f7c
movsb byte es:[edi], byte ss:[esi]
ret
lea esp, [esp + 2]
mov dword [esp + 0x2c], ebx
call fcn.00b814a5
in eax, 0x70
out 0x81, al
jo 0xb8178f
cmc
insd dword es:[edi], dx
std
test byte [edi - 0x35], dh
in eax, 0x7e
in al, dx
mov eax, dword [esi - 0x3cac2ad1]
cmpsb byte [esi], byte es:[edi]
push ebp
in al, 0x4d
aam 0x4a
sub eax, 0x41dd5bdc
sal dword [eax + 0x280c643], 1
nop
test dword [edx], 0x57c742d6
xor al, cl
sub eax, edi
mov al, 0x43
mov byte [eax + 0x2f79002], 0xd6
inc edx
invalid
clc
js 0xb817d1
mov dword [eax - 0x67], edi
salc
push ebp
lds ebp, [edi + ebx*2 + 0x54c640bf]
xor ecx, esi
daa
bnd jnp 0xb817e0
invalid
mov byte [esp], bh
mov word [esp], di
push word [esp + 1]
pushal
push word [esp + 9]
pop dword [esp + 0x1a]
jmp 0xb817a3
lea esp, [esp + 1]
mov dword [esp + 0x10], edx
push edx
pop word [esp]
mov byte [esp], ch
mov word [esp], dx
jmp 0xb818ae
Function at 0xb81509
Capabilities:
Check for peb beingdebugged flag
Parse pe header

Disassembly:
call fcn.00b81121
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0xb81592
push dword [esp + 8]
lea esp, [esp + 2]
mov dword [esp + 0x50], edi
lea esp, [esp + 0x50]
mov eax, dword fs:[0x30]
jmp 0xb814aa
lea esp, [esp + 7]
push dword [esp + 3]
push word [esp + 7]
lea esp, [esp + 1]
jmp 0xb814c8
push dword [esp + 2]
mov word [esp + 4], bx
push dword [esp + 2]
mov byte [esp + 7], ch
mov dword [esp + 5], ecx
jmp 0xb814f1
mov eax, dword [eax + 8]
push eax
jmp 0xb8111c
Function at 0x403014
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x483008], 0x8088405
inc edx
mov dword [ebx + 0x483008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403720
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x483024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4037b8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403798
xor eax, eax
push ebp
push 0x403791
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4037d4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403798
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x483024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x483024], ax
mov esp, ebp
pop ebp
ret

Function at 0x40460c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48e04c], 0
je 0x40466d
cmp word [0x48e220], 0xd7b2
jne 0x404635
cmp dword [0x48e228], 0
jbe 0x404635
mov eax, 0x48e21c
call dword [0x48e238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404694
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x483030], 0
jne 0x404689
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40600c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40623c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40608f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40623c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40608f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406258
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406118
xor eax, eax
push ebp
push 0x406111
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405e48
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4060f6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406278
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4060f6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406118
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406232
cmp byte [ebp - 0xd], 0
jne 0x40615f
cmp byte [ebp - 0x12], 0
je 0x406232
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406178
dec ebx
cmp byte [ebx], 0x2e
je 0x406187
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406177
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406232
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4061c4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406232
cmp byte [ebp - 0xd], 0
je 0x406232
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406232
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret