joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40241e
Capabilities:
Terminate process

Disassembly:
jmp 0x433fa4
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x433fb5
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.0040377e
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x4024aa
Capabilities:
Query environment variable

Disassembly:
jmp 0x43d16d
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x43d181
xor edi, edi
jmp 0x43d1b8
push ebx
push esi
call fcn.0043d077
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004029a0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x43d1a8
push ebx
push esi
push edi
call fcn.00403634
add esp, 0xc
push 0
call fcn.00403c38
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x4036a7
Capabilities:
Parse pe header

Disassembly:
jmp 0x4090f2
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409132
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409132
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409132
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409132
cmp dword [ecx + 0x74], 0xe
jbe 0x409132
cmp dword [ecx + 0xe8], 0
je 0x409132
mov al, 1
ret
xor al, al
ret
Function at 0x401011
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
push 0x104
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40108e
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [ebp - 0x104]
push eax
call esi
test eax, eax
je 0x40108e
lea eax, [ebp - 0x104]
push eax
call esi
test eax, eax
je 0x40108e
lea eax, [ebp - 0x104]
push str.powershape.exe
push eax
call fcn.004010b0
pop ecx
lea eax, [ebp - 0x104]
pop ecx
push 1
push 0
push dword [ebp + 0x10]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x401099
push str.Error_starting_PowerSHAPE.
jmp 0x401093
push str.Error_finding_PowerSHAPE.
call fcn.00401000
pop ecx
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x401f6d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x406130
cmp edx, dword [eax]
je 0x401f8f
add eax, 8
inc ecx
cmp eax, 0x4061c0
jl 0x401f80
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x406130]
jne 0x4020bd
mov eax, dword [0x408518]
cmp eax, 1
je 0x402097
test eax, eax
jne 0x401fc0
cmp dword [0x406084], 1
je 0x402097
cmp edx, 0xfc
je 0x4020bd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401ff7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004010a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402600
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40203a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402600
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4053c8
push edi
call fcn.00403ca0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004010a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004010b0
lea eax, [ebp - 0xa0]
push 0x4053a8
push eax
call fcn.004010b0
push dword [esi + 0x406134]
lea eax, [ebp - 0xa0]
push eax
call fcn.004010b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00403c14
add esp, 0x2c
pop edi
jmp 0x4020bd
lea eax, [ebp + 8]
lea esi, [esi + 0x406134]
push 0
push eax
push dword [esi]
call fcn.00402600
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x406010
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x43a426
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
mov eax, dword [0x44e848]
xor eax, esp
push eax
lea eax, [esp + 0x430]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
call fcn.0040ad12
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x406069
push 0x80004005
call fcn.00401020
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
push 0x104
lea ecx, [esp + 0x20]
push ecx
push ebx
mov dword [esp + 0x444], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x1c]
push 0x5c
push edx
call fcn.004276b8
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4060b0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x14]
call fcn.00403430
push str.TPMXUD.ini
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00405650
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x43c], 1
call fcn.004055d0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x438], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40611e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0xc]
push esi
push 0x104
lea ecx, [esp + 0x22c]
push ecx
push str.Mouse_Suite
push str.Product_Reg
push 0x43e660
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0x10]
push edx
push 0x20119
push ebx
lea eax, [esp + 0x230]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406192
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push str.CheckNetWork
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x14], ebx
jbe 0x406187
mov bl, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi - 0x10]
mov dword [esp + 0x438], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4061b9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x430]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00427533
add esp, 0x430
ret
Function at 0x407cd0
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [ecx + 0x39c]
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x407d2b
push str.TRUE
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp]
add eax, eax
push eax
push str.TRUE
push 1
push 0
push str.CheckNetWork
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x407d30
Capabilities:
Delete registry value

Disassembly:
push ecx
mov ecx, dword [ecx + 0x39c]
lea eax, [esp]
push eax
push 0xf003f
push 0
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407d6b
mov ecx, dword [esp]
push str.CheckNetWork
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
Function at 0x4119a9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4119f0
call fcn.00412396
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4119f0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x411a0c
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00411521
mov esi, eax
test edi, edi
je 0x411a0a
test ebx, ebx
je 0x411a0a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4134a3
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x43af8b
call fcn.004287eb
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4134c8
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41350e
lea ecx, [ebp - 0x10]
call fcn.004011d0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040a9d0
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401040
mov eax, esi
call fcn.004288c3
ret 8

Function at 0x427533
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e848]
jne 0x42753d
repz ret
jmp fcn.0042fe3a
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x11aa008], 0x8088405
inc edx
mov dword [ebx + 0x11aa008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f04c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x118e53a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f09b
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
jmp 0x41f0ba
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f12c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f115
test esi, esi
jbe 0x41f12c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f107
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f12c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0e4
jmp 0x41f12c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f12c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x118e541
ret
Function at 0x420284
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x118f89f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202bf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202d8
lea eax, [ebp - 0x10]
mov edx, dword [0x11ac348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202eb
lea eax, [ebp - 0x10]
mov edx, dword [0x11ac348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4202f7
adc edx, 0
mov edx, dword [edx*4 + 0x11ab178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420471
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420464
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420464
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420402
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420402
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420402
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420402
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420464
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420464
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420489
inc ebx
cmp ebx, 0x19
jne 0x4202b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x118f8a6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x401118
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x401134
movzx edx, byte [eax + ecx*2]
xor dx, word [esp + 4]
mov word [eax + ecx*2], dx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x401120
ret

Function at 0x401f16
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
add esi, 0x34
lea edi, [ebp + 0xc]
lea ebx, [ebp - 4]
call 0x402270
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp ecx, dword [eax + 0x38]
jne 0x401f3d
xor eax, eax
jmp 0x401f6a
cmp byte [ecx + 0x45], 0
mov eax, dword [ecx + 0x34]
je 0x401f4d
mov ecx, dword [ebp + 0x10]
add eax, dword [ecx]
jmp 0x401f6a
mov edx, dword [ebp + 0x10]
add eax, dword [edx]
mov esi, dword [ecx + 0x3c]
mov edx, dword [ecx + 0x1c]
xor edi, edi
test esi, esi
je 0x401f66
xor byte [edi + eax], dl
inc edi
cmp edi, esi
jb 0x401f5e
mov byte [ecx + 0x45], 1
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4f874b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf04ea0d4
jmp 0x4f8730
jnp 0x4f8710
lea esp, [esp + 3]
lea esp, [esp + 3]
jmp 0x4f8722
lea esp, [esp + 3]
lea esp, [esp + 3]
mov dword [esp + 0x18], esi
jmp 0x4f8768
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
jmp 0x4f8770
jmp 0x4f8752
bt bx, ax
rdtsc
jmp 0x4f878c
push word [esp + 1]
jmp 0x4f86fa
lea ebx, [edi*4]
stc
jb 0x4f8732
bt bx, ax
jmp 0x4f87e4
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
pushfd
jmp 0x4f86df
rcl si, cl
call fcn.004f87cd
add eax, 0x8a7f188a
dec ebx
movsd dword es:[edi], dword [esi]
das
mov edi, 0xc28629da
jge 0x4f8718
mov edi, dword [esp + 0x2c]
mov al, byte [esp]
jl 0x4f87b3
sub al, 0x8a
add al, 0x24
neg ebp
jp 0x4f8776
jnp 0x4f87b7
lea esi, [esp]
lea ecx, [ebx + ebp]
mov edx, 0xb06c2351
push sp
mov word [esp], bx
jmp 0x4f87e8
push ecx
rcl byte [ebx + 0x66]
rcl esi, cl
rcl si, cl
jmp 0x4f8799
rdtsc
jmp 0x4f878c
lea esp, [esp + 2]
call fcn.004f883d
jae 0x4f87d5
jo 0x4f880c
loop 0x4f8818
mov bh, 0x27
mov bh, 0xd2
and ecx, ebp
invalid
add byte [eax], al
hlt

Function at 0x4faed7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, reloc.kernel32.dll_DeleteCriticalSection
cmp eax, edi
jge 0x4fad7f
adc dl, al
jmp 0x4fad27
neg edi
sete ah
mov ax, 0xfc99
mov eax, 0x4775a091
mov dx, word [esp]
jmp 0x4faccc
lea esp, [esp + 1]
jmp 0x4face2
or dx, 0xc04c
inc dx
mov eax, edx
clc
xor edi, 0x6b491f94
setg bh
jmp 0x4fad31
xor ah, 0x77
jmp 0x4fad84
mov eax, edx
clc
jmp 0x4fad11
stc
jae 0x4fad58
not ax
mov bx, si
xchg dx, bx
xchg dx, ax
dec ax
jmp 0x4fadf7
jae 0x4fad07
or dx, 0xc04c
inc dx
jmp 0x4fad2c
not ax
mov bx, si
call fcn.004fae1e
scasb al, byte es:[edi]
xchg dx, bx
jmp 0x4fadf3
adc dl, al
xor ah, 0x77
ror edi, 0
xchg ebx, edx
not ax
bsr bx, dx
jmp 0x4fad4d
rdtsc
not dl
mov bx, 0x2630
rdtsc
stc
jmp 0x4fae30
xchg dx, ax
dec ax
not edi
jmp 0x4faddd
cmc
bswap eax
jmp 0x4fae8f
setg dl
mov edx, dword [esp]
mov ah, 0x94
jmp 0x4fae70
ja 0x4fadfb
cmc
bswap eax
jmp 0x4fadfe
mov dl, al
lea esp, [esp + 3]
neg ax
jl 0x4fad01
lea esp, [esp + 1]
jmp 0x4face2
mov edx, dword [esp]
mov ah, 0x94
jmp 0x4fae70
add edi, dword [esi]
xor ebx, 0x9a1fb4c6
jl 0x4faeb7
rdtsc
neg ax
jmp 0x4faebb
add edi, 0x49126e96
stc
jbe 0x4fae03
setg dl
jmp 0x4fae64
neg ax
jmp 0x4faebb
rdtsc
jmp 0x4faea1
jmp 0x4fae4c
Function at 0x4fddfd
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0xace4a29e
jmp 0x4fdc3a
add eax, 0x93ea260e
jmp 0x4fddc9
mov dx, word [esp]
jmp 0x4fdc44
inc dx
js 0x4fe011
sub dl, bl
lea edx, [eax + edi]
jmp 0x4fde67
pop edx
bswap edx
jmp 0x4fc75e
mov dword [esp + 0x14], eax
popal
jmp 0x4fdc96
dec dl
jo 0x4fdcf7
mov edx, 0x345d2eba
stc
call fcn.004fdcbb
outsd dx, dword [esi]
in al, 0x7a
sbb eax, 0x10912eec
xchg ebx, eax
or ah, byte [ebp + 0x244489d4]
adc al, 0x61
mov dword [esp + 0x14], eax
popal
lea edx, reloc.kernel32.dll_DeleteCriticalSection
mov eax, dword [edx]
mov dx, word [esp]
jmp 0x4fdc72
mov edx, 0x345d2eba
stc
jmp 0x4fc7b1
call 0x4fdd18
sub bl, 0xb7
mov dl, 0xbd
lea edx, reloc.kernel32.dll_DeleteCriticalSection
mov dx, 0xd83
jmp 0x4fddef
sub esp, 0x1a
jl 0x4fde3d
btc edx, edx
call fcn.004fde27
rcl byte [edx + 0xf15c483], 0x8e
xchg ebp, eax
add byte [eax], al
add byte [ebp - 0x16fedb9c], cl
in al, dx
add byte [eax], al
add byte [ebx + 0xf84153a], al
xchg esp, eax
ret 0xba66
btc edx, edx
call 0x4fddfd
rol ax, cl
xchg dword [esp], ebp
lea edx, [eax + edx]
dec al
bsf dx, si
cmp ax, 0xa1f6
jmp 0x4fdeb3
pushal
neg ecx
jg 0x4fdc91
jle 0x4fdc6b
neg eax
lea esp, [esp + 2]
push dword [esp + 8]
ret 0xc
lea ebp, [ebp + 0x44]
call fcn.004fde8c
je 0x4fded1
neg dx
neg al
jmp 0x4fdedf
neg dx
neg al
lea eax, [esp + esi]
jmp 0x4fdf82
lea eax, [esp + esi]
bts eax, ebx
rdtsc
jmp 0x4fdf87
jmp 0x4fdf54
push sp
lea eax, reloc.kernel32.dll_DeleteCriticalSection
mov edx, esi
xchg edx, eax
sub esp, 5
jge 0x4fdf07
xchg edx, eax
lea esp, [esp + 3]
jmp 0x4fdf59
not bl
rdtsc
rdtsc
dec ax
jo 0x4fdf5f
jno 0x4fdf67
adc eax, 0x8b781989
dec edx
mov ch, 0x2a
mov eax, 0xd5942adf
dec edi
fistp qword [edx - 0x629d19b7]
xchg edx, eax
lea esp, [esp + 3]
lea esp, [esp + 4]
jmp 0x4fdf34
rdtsc
jmp 0x4fdfe5
rdtsc
jmp 0x4fdfe5
mov dh, byte [esp]
jmp 0x4fdfa5
bts eax, ebx
rdtsc
dec bl
jmp 0x4fdf1d
mov dx, si
inc eax
js 0x4fdfc6
mov dl, bl
call fcn.004fdffb
daa
stosd dword es:[edi], eax
cmp ebx, dword [esi - 0x53]
outsd dx, dword [esi]
dec edi
int3
lea eax, [edx + ebx]
mov eax, dword [esp]
and ebx, 0x3c
jmp 0x4fdf8b
mov dl, bl
mov ax, dx
sub edi, 4
lea edx, [ecx + edx]
btc ax, di
jmp 0x4fe048
inc bl
bt edx, ebx
jns 0x4fdf6b
mov dh, byte [esp]
lea eax, [edx + ebx]
mov eax, dword [esp]
jmp 0x4fdfab
sub dl, bl
lea edx, [eax + edi]
jmp 0x4fde67
jae 0x4fe05e
inc edx
jmp 0x4fe05f
inc edx
mov eax, dword [ebx + ebp]
bswap edx
jmp 0x4fe080
lea esp, [esp + 1]
jmp 0x4fe08b
sub esp, 1
jne 0x4fe066
lea esp, [esp + 1]
jmp 0x4fe06a
mov ebx, edi
mov dword [ebx], eax
bsf dx, bx
js 0x4fe0fe
mov ebx, dword [esp]
mov ax, 0xe8ad
jmp 0x4fe0bc
neg ebx
ja 0x4fe0e8
push eax
lea edx, [ecx + edx]
mov ebx, 0xa270ca91
jmp 0x4fe121
mov ax, 0xe8ad
jmp 0x4fe0bc
push eax
jmp 0x4fe119
mov ebx, dword [esp]
jmp 0x4fe0d2
xor ah, dh
jle 0x4fe1ac
add al, 0x82
jmp 0x4fe1ae
lea edx, [ecx + edx]
mov ebx, 0xa270ca91
lea edx, [ebp + 0x50]
jmp 0x4fe103
add al, 0x82
cmp edi, edx
call fcn.004fe7ce
xchg dword [esi - 0x46], esp
push esp
cmp dword [ebx - reloc.kernel32.dll_DeleteCriticalSection], ecx