joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcb95ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x23
rdtsc
mov al, 0x6d
mov byte [esp], cl
jmp 0xcb95f6
bswap ebp
add esp, 0
xchg edi, ebx
mov ebp, 0xe5181b9a
xchg byte [esp], ch
cpuid
jmp 0xcb961d
mov ah, 0xa8
xchg ch, al
seto bl
lea ebx, [ecx + ebx]
neg eax
lea esp, [esp]
jmp 0xcb95da
xchg byte [esp], dl
bsr ecx, esp
mov ecx, 0x18b0c666
lea esp, [esp]
jmp 0xcb9780
cmc
mov dl, byte [esp]
bts bx, sp
mov cx, 0x1764
mov dx, 0x9d09
cmc
jmp 0xcb9607
stc
lea ecx, [ebp*4]
mov bh, 0x2c
lea edx, [esi + 0xbcb3]
dec bl
rdtsc
jmp 0xcb96f1
lea ebx, [ebp*4]
mov dx, word [esp]
clc
mov byte [esp], dl
cld
lea eax, [eax*4]
jmp 0xcb964a
mov dx, si
lea edi, [ebx*4]
mov edi, 0x18dbd17d
mov dx, word [esp]
mov esi, 0x4c974461
xchg edi, edx
jmp 0xcb966d
cpuid
lea ebp, [eax*4]
not ebp
mov dl, cl
stc
push eax
jmp 0xcb9745
xchg ebp, esi
mov ebp, 0x92541cc7
mov eax, dword [esp]
lea edi, [edx + ebx]
not bp
cmc
jmp 0xcb96b7
mov dh, 0x78
ror edi, cl
inc bx
not cx
rcr bp, 7
mov ebp, 0xc75757bc
jmp 0xcb96cd
xchg byte [esp], ah
add esp, 1
mov si, word [esp + 1]
pop si
mov bl, byte [esp]
jmp 0xcb972e
mov cx, 0x8d0b
rol cx, cl
sete bl
xchg bl, dh
clc
mov bx, 0x9169
jmp 0xcb9705
mov bl, 0x53
neg bl
sub esp, 7
not bp
push word [esp + 4]
rdtsc
jmp 0xcb975a
xchg dword [esp], esi
inc dx
btr ebx, esi
pop si
lea ebx, [ecx + edi]
lea edx, [ecx + 0xc7]
jmp 0xcb971b
mov ecx, 0xffb03f4a
mov byte [esp + 6], ch
mov bp, cx
dec bl
shr cx, cl
bswap edx
jmp 0xcb9887
not di
cmp ebp, esp
xchg dh, ch
lea edi, [esp + ebp]
rdtsc
mov esi, dword [esp]
jmp 0xcb969b
mov dx, bx
bswap edx
mov ch, byte [esp + 0xa]
mov edi, 0x7f99f317
std
pop ebx
jmp 0xcb97ee
mov dx, word [esp + 3]
xchg edx, eax
mov si, 0x1eaa
neg eax
lea edi, [edi*4]
mov edi, 0x870950ef
jmp 0xcb9794
mov word [esp + 3], bx
mov si, 0x4938
bsr ax, cx
mov byte [esp], al
pop edx
mov edx, dword [esp]
jmp 0xcb981e
shl ebp, cl
inc bx
pop word [esp + 3]
lea edx, [edx + edi]
setge ch
xchg word [esp + 3], dx
jmp 0xcb97c9
mov bx, word [esp + 0x12]
mov esi, 0x8f43d24
push esp
rdtsc
bsf edx, ebx
pop ecx
jmp 0xcb9849
mov di, ax
mov byte [esp + 1], ah
bswap edi
pop bx
lea eax, [esi*4]
pushal
jmp 0xcb9804
xchg byte [esp + 1], al
shr edx, 0
mov eax, dword [esp + 6]
add esp, 8
pop ax
jmp 0xcb986f
xchg dword [esp + 0x18], ecx
add esp, 0x17
push edi
pushfd
mov ah, cl
bt ebx, eax
jmp 0xcb9833
mov bh, 0xbb
mov dl, byte [esp + 0xa]
rdtsc
popal
pop word [esp + 1]
jmp 0xcb98c6
rdtsc
pushal
bsr edi, esp
pop si
dec di
pushfd
jmp 0xcb9859
mov byte [esp], cl
xchg dl, bl
xchg dword [esp], edi
neg di
push dword [esp + 6]
stc
jmp 0xcb97ae
not ebx
mov dword [esp + 0xe], edx
call 0xcb98a8
lea ecx, [edi - 0x75f7dbbc]
shl dword [esi - 1], cl
je 0xcb98d6
adc eax, 0x39ebf287
sbb byte [esi + 0x17a66b0c], bl
push 0xfffffffffffffff3
arpl word [esi], ax
cmc
inc ebx
jbe 0xcb9926
mov al, byte [0x83edbd0f]
in al, dx
adc esi, dword [ebp + 0x665a66a3]
xchg edx, edi
bsr ebp, ebp
sub esp, 0x13
mov ch, 0xa3
pop dx
xchg dx, di
pop word [esp + 9]
and al, 9
jmp 0xcb989c
Function at 0xcb9b4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, cx
push dword [esp + 6]
sub esp, 3
xchg word [esp + 0x10], di
jmp 0xcb9b7c
mov cl, byte [esp + 3]
push word [esp + 7]
pop bp
jmp 0xcb9b37
cmc
cld
xchg word [esp + 3], bx
mov bl, 0x58
mov dx, 0xe05e
xchg byte [esp + 9], cl
jmp 0xcb9b96
not bl
xchg word [esp + 0xd], cx
mov word [esp + 0xd], bp
mov word [esp + 5], sp
lea ecx, [esp + ebx]
lea esp, [esp + 4]
jmp 0xcb9b5a
xor ebx, eax
lea edi, [esp + eax]
setp cl
pop ax
rdtsc
mov edi, 0xdb4be5c
jmp 0xcb9ce3
pop word [esp + 9]
mov edi, 0x936aa4d
xchg al, bl
not ch
jmp 0xcb9c1a
add esp, 0xd
cpuid
neg esi
bswap ebp
mov byte [esp + 7], ah
push dword [esp + 2]
jmp 0xcb9bd6
mov eax, 0xb40f482c
mov ah, byte [esp + 0x12]
cld
mov esi, ebp
push edx
rdtsc
jmp 0xcb9bec
mov eax, 0x81c4a358
cmp ebp, 0xaadb56f0
pop dword [esp]
btr di, bp
lea ebx, [ecx + 0x8d75]
call fcn.00cb9cb5
push ebp
les esi, [edi + 0x5e]
test eax, 0x74ff66c8
and al, 0xc
push word [esp + 0xc]
xchg word [esp + 0xd], dx
mov bx, cx
sbb esi, edx
xchg dl, bl
mov ch, 2
jmp 0xcb9c09
xchg cl, bl
push dword [esp + 9]
lea esi, [ebp*4]
cpuid
mov eax, dword [esp]
not eax
jmp 0xcb9c3d

Function at 0xcb9cb5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, 0x7f
mov dh, dl
pop ecx
xchg byte [esp], bh
setle dl
xchg di, dx
jmp 0xcb9c8a
cmp bx, si
mov ebp, 0xed6f819f
pushfd
mov ax, 0x520c
add esp, 0xa
jmp 0xcb9cb8
setb dh
cpuid
pop dword [esp + 3]
pop ax
mov di, ax
xchg esi, edi
jmp 0xcb9c52
xchg cx, bp
pop dx
rdtsc
lea esi, [ebp*4]
lea ecx, [esp + edi]
sub esp, 0xb
jmp 0xcb9c62
cmc
jmp 0xcb9c78
mov bl, cl
lea ebx, [eax + ebp]
mov esi, edx
mov ax, si
bsf ax, bp
xchg dword [esp], edx
jmp 0xcb9d12
xchg cl, ah
adc byte [eax + 0x641d8d0b], ah
xchg edi, eax
and al, 0x9c
out dx, eax
rdtsc
call fcn.00cb9ccb
int1
je 0xcb9d06
lea edi, [edi + ecx*8 - 0x17]
popal
int1
nop
arpl si, sp
sub dword [edx + 0x25a25730], esp
arpl word [edx - 0x2c7437f1], bx

Function at 0xcb9d7f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop bp
push word [esp + 1]
lea ecx, [ecx*4]
jmp 0xcb9e0a
lea ebx, [edi - 0x773e5501]
setne ch
lea esp, [esp + 5]
jmp 0xcb9d69
mov bp, di
add esp, 2
std
mov dx, 0xab9e
not ecx
cmc
jmp 0xcb9dea
mov edx, 0x337e33be
std
lea ecx, [ecx + edi]
pop edx
btc di, ax
mov dword [esp], edi
jmp 0xcb9dab
mov eax, 0xc39819e7
xchg edx, eax
bsr ebp, eax
mov edi, ebp
mov word [esp], si
jmp 0xcbab6d
mov dx, 0x2fd9
pop esi
add di, ax
rdtsc
push ebx
bsf esi, ebx
jmp 0xcb9dd4
sbb edi, 0x30bb1637
mov dx, 0x8cff
mov edx, 0x3632f569
bswap edx
setno al
lea ecx, [edi + 0x32564e56]
jmp 0xcb9dc1
mov edx, dword [esp]
mov ax, word [esp]
push ecx
pop word [esp]
ror bp, 6
cmc
xchg cx, di
jmp 0xcba361
add esp, 1
pop si
mov esi, ecx
xchg byte [esp], bh
rdtsc
setnp al
jmp 0xcba716
mov dl, dh
cpuid
cmc
std
bt si, sp
add esp, 0
jmp 0xcbaaaf
Function at 0xcba0ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf ax, cx
jmp 0xcba0d4
dec edi
neg edx
stc
pop word [esp + 0x18]
mov eax, ecx
rdtsc
jmp 0xcba116
bsf ebx, edi
mov ax, 0x34e2
lea ecx, [esi + ebp]
rdtsc
bswap edi
jmp 0xcba136
cmc
bswap esi
pop esi
push dx
stc
pop eax
jmp 0xcba100
rdtsc
rol di, cl
inc di
add esp, 9
call fcn.00cba1a0
fcomp qword [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
jmp fcn.00cba171
xchg word [esp + 5], bx
add esp, 5
neg edx
neg ebx
pop dword [esp + 0x13]
mov di, 0xe06f
jmp 0xcba120

Function at 0xcba1e6
Capabilities:
Parse pe header

Disassembly:
pop dword [esp + 2]
mov cx, 0xdc37
mov ax, bp
xchg di, bx
shr al, cl
jmp 0xcba176
xchg byte [esp], ah
btc dx, di
cpuid
pop si
pop word [esp + 0xf]
invalid
bswap ebx
jmp 0xcba14c
mov cx, bx
xchg word [esp + 5], dx
neg esi
cpuid
std
xchg word [esp + 1], cx
jmp 0xcba1c1
lea esp, [esp + 3]
lea esp, [esp + 4]
popal
popfd
jmp 0xcba1ab
bsf si, bp
mov ebp, 0x73398abc
jmp 0xcba162
lea esp, [esp + 4]
jmp 0xcba1d3
push ecx
inc edi
pop word [esp + 0xc]
xchg byte [esp + 0xb], ah
pop bx
add esp, 0xd
jmp 0xcba18a
push di
lea esp, [esp]
push word [esp + 1]
mov dword [esp], eax
call 0xcba1e6
mov edi, edi
je 0xcba20d
add ch, cl
mov eax, dword [0x2a000000]
mov al, byte [0x27a05136]
push esp
fisttp qword [ebp + 0x14]
out 0x62, eax
lodsb al, byte [esi]
mov edi, 0x2474ff60
and eax, dword [edi - 0x1151723]
invalid
add dword [esi - 0x71], esp
add al, 0x24
Function at 0xcba209
Capabilities:
Parse pe header

Disassembly:
call fcn.00c545f2
push eax
jmp 0xc545ed
call fcn.00cb9055
jmp 0xcba2c2
movzx ebx, word [eax + 0x3c]
jmp 0xcba332
xchg byte [esp], dh
mov cx, word [esp]
lea ebp, [esp - 0x742cf951]
cld
jmp 0xcb9e67
mov dx, word [esp]
neg ebx
mov ah, 0xe9
lea edi, [esp + 0x136c5a6f]
xchg byte [esp], al
xchg edx, eax
jmp 0xcb9e26
pop eax
rdtsc
lea edx, [ebp + 0xd273]
mov word [esp + 0x11], di
jmp 0xcb9e79
xchg edx, ebx
sub esp, 0x1a
mov bl, byte [esp + 0x15]
mov bh, byte [esp + 0x12]
cmc
sbb al, ah
jmp 0xcb9e51
pop dword [esp + 0xd]
bsr dx, dx
pop word [esp + 0xe]
mov ah, byte [esp + 4]
mov ax, 0x1ab6
mov bp, word [esp + 6]
jmp 0xcba1fd
not si
setl cl
xchg word [esp + 2], bp
mov ax, word [esp + 4]
sub esp, 0x1c
popal
jmp 0xcb9e3c
pushal
push dword [esp + 0x23]
xchg ebp, ebx
call 0xcba0f3
mov word [esp + 1], ax
pop word [esp]
push word [esp]
jmp 0xcba243
mov dword [esp + 4], ebx
call fcn.00cba22d
mov dword [esp + 4], esp
pushal
push word [esp + 0xa]
mov byte [esp + 8], cl
jmp 0xcba268
lea esp, [esp + 2]
mov dword [esp + 0x20], ebp
push ax
lea esp, [esp + 2]
mov dword [esp + 0x1c], esi
pushfd
jmp 0xcba2e3
lea ecx, [ecx + 0x1c]
mov eax, dword [ecx]
pop ecx
jmp 0xcba2b7
mov eax, dword [eax + 0xc]
push ecx
mov ecx, eax
jmp 0xcba299
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xcb9050
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0xcb905a
jne 0xcba311
mov byte [edx - 0x30], 0xb7
inc edx
test byte [edi], al
xchg edi, eax
add dword [edx + edi - 0xc87beb], edi
je 0xcba30a
push dword [esp + 3]
push dword [esp + 5]
mov dword [esp + 0x24], edi
add edi, edi
je 0xcba30e
add eax, 0x24247c89
lea esp, [esp + 0x24]
mov eax, dword fs:[0x30]
jmp 0xcba2af
dec dword [edx]
mov edx, 0xccfd422b
inc edx
std
int3
sub eax, 0x10000
jmp 0xcba2c6
add ebx, eax
cmp word [ebx], 0x4550
je 0xc547d4
jne 0xcba311
loopne 0xcba3a8
cmc
pushfd
outsd dx, dword [esi]
fst qword [edx]
xchg esi, eax
add al, 0x63
sahf
das
or byte [ebx], 0x9b
dec byte [0x22ac26b8]
inc ebp
mov ah, 0x33
xor byte [ecx + 0x3ebb4829], bh
sbb byte [ebx - 0x75], bh
adc al, 0x24
lea ebx, [edx*4]
rdtsc
lea ebx, [esp + 0xba]
xchg dl, cl
push word [esp + 2]
jmp 0xcb9ea2
invalid

Function at 0xcba21f
Capabilities:
Parse pe header

Disassembly:
mov word [esp + 1], di
mov dword [esp + 4], edx
call 0xcba209

Function at 0xcba22d
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp]
lea esp, [esp + 1]
mov word [esp], di
mov word [esp], cx
call fcn.00cba262
xor byte [ebx], dh
Function at 0x10003420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000342f
pop dword [ebp - 0x20]
mov eax, 0x1000342f
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x38fe4
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xb0131951
add ecx, 0x4fed38b4
mov edi, eax
mov esi, 0x17fb6e56
sub esi, 0x7fafa56
add esi, dword [ebp - 0x20]
mov ebx, 0x4fa7735c
sub ebx, 0xe771dac3
add dword [ebp - 8], 0x33aaa5dc
mov edx, dword [esi]
sub dword [ebp - 0x14], 0x6a6bdb5c
add edx, ebx
xor dword [ebp - 0x1c], 0xe5054024
mov dword [edi], edx
add dword [ebp - 0x1c], 0xc43fcba5
add edi, 0xfbf07a4
add edi, 0xf040f860
add esi, 0xf8dfa1f6
sub esi, 0xf8dfa1f2
loop 0x10003484
add eax, 0xeb6865d6
add eax, 0x1498d511
mov ebx, eax
add eax, 5
mov ecx, 0xe42b9254
add ecx, 0x2bd46dac
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x10003ae0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 4]
sub ecx, 1
js 0x10003b0b
mov eax, dword [esi + 8]
lea edx, [eax + ecx*4]
mov eax, dword [edx]
movzx eax, word [eax + 6]
cmp eax, 4
je 0x10003b1e
cmp eax, 0xd
je 0x10003b1e
sub edx, 4
sub ecx, 1
jns 0x10003af3
mov eax, dword [esi]
sub eax, 1
je 0x10003b2c
sub eax, 2
je 0x10003b25
mov eax, 2
pop esi
ret
mov eax, 1
pop esi
ret
mov edx, 0x100040e0
jmp 0x10003b31
mov edx, 0x10004020
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x18]
sub edx, eax
sub edx, 0xa
mov dword [ecx + 1], eax
mov eax, dword [esp + 0x10]
mov byte [ecx], 0xb8
mov byte [ecx + 5], 0xe9
mov dword [ecx + 6], edx
mov dword [ecx + 0x10], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 0xc], esi
mov dword [ecx + 0x14], eax
xor eax, eax
pop esi
ret
Function at 0x40378d
Capabilities:
Get number of processors

Disassembly:
xor byte [eax], bh
bound esp, qword [ecx + 0x30]
sub dword [ebp + 0x73], esp
pop edi
outsb dx, byte [esi]
add byte [edi + 0x74], ch
loopne 0x40379d
adc al, 0xc0
add dword [esi], eax
add byte [esi], al
add byte [eax], bh
sbb eax, dword [eax]
add ah, dl
sldt word [eax]
add byte [esi], cl
ror dword [edi + 0x79b2fc], cl
fiadd dword [ecx]
jb 0x4037bc
mov bh, 0x9c
ja 0x403807
add byte [edx - 0x34c4cbb], dl
mov ecx, 0x8d804467
jae 0x4037cb
add byte [eax], al
add byte [eax + eax], al
add ecx, dword [eax]
push cs
add byte [edx], bl
add byte [0xa0015], al
adc al, byte [ebx]
add byte [edi], al
xor dword [eax], esi
xor ah, byte [eax]
Function at 0x40779a
Capabilities:
Authenticate hmac

Disassembly:
popal
sahf
mov eax, dword [0x79b200fd]
fiadd dword [ecx]
jb 0x40777c
mov bh, 0x9c
add byte [edi + 0x4b], dh
dec ebx
xchg edx, eax
inc ebp
mov bl, 0xb3
cld
mov ecx, 0x8d446710
jae 0x407789
xor al, 0
adc al, byte [eax]
and byte [eax], al
add byte [esi], cl
add byte [eax + eax], bl
add eax, 0xa08001a
add byte [ebx], al
invalid
add eax, dword [eax]
pop es
add byte [edi], al
xor byte [eax], al
insd dword es:[edi], dx
arpl word [eax], ax
sub eax, 0x682d7766
outsd dx, dword [esi]
jae 0x40781e
add byte [esi], ch
js 0x407814
pop esp
push ebx
jns 0x407826
add byte [edx + esi*2 + 0x61], dh
jns 0x407805
imul esp, dword [edx + 0x5c], 0x7a054602
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
arpl word cs:[eax + 0x2c], si
arpl word [eax + 0x2c], si
jo 0x40776d
add byte [edi], ch
add byte [0x2e210373], ch
pushal
insb byte es:[edi], dx
insb byte es:[edi], dx
and esi, dword [ecx]
add ch, cl
adc bh, dl
arpl word [eax], ax
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
bound esp, qword [ecx + 0x63]
imul esp, dword [eax], 1
pop ss
mov esi, 0x665f6d20
jne 0x40785d
arpl word [eax], ax
je 0x40785c
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0x407817
inc esp
dec ebx
push esp
fmul qword cs:[ebx + 0x4763aa8e]
test al, 0x63
cwde
add esp, dword [edi + 0x69cfb163]
outsb dx, byte [esi]
je 0x407873
cmpsd dword [esi], dword es:[edi]
arpl word [ecx + 0x746e69cf], si
jb 0x40787e
jb 0x40787e
xor byte [ecx + 0x6c], ah
pop edi
outsb dx, byte [esi]
sbb ah, 3
shr byte [ebp + 0x73], cl
test al, 0x20
inc ebx
add edx, edx
insd dword es:[edi], dx
jae 0x4077c4
and byte [ebx - 0x36], al
int3
retf 0x37cc
invalid
invalid
invalid
Function at 0x40e1b6
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
das
jne 0x40e1ce
push 0x65725f
jb 0x40e1c7
jae 0x40e1cc
pop edi
je 0x40e1d6
push eax
imul esp, dword [ebp + 0x6e], 0x29
mov al, byte [0x16ecdda3]
test eax, 0xfc0b7ff7
cld
jl 0x40e1f1
dec esi
jge 0x40e187
push dword [eax]
jg 0x40e1e4
sar dword [edi - 0x41], 0xff
xor byte [ebx], ah
jge 0x40e207
jg 0x40e1ed
jg 0x40e1ef
jg 0x40e1ef
jg 0x40e1f1
jb 0x40e1f3
popal
dec byte [0x8b702720]
add esi, dword [esi + 0x7d460dfc]
xlatb
jg 0x40e1b8
sti
mov bh, byte [ecx + 0x31]
and byte [edi + 0x19], bh
sub eax, 0x64ff7b85
pop ds
jg 0x40e22b
lahf
mov esp, dword [ebx + 0xe]
jg 0x40e1cd
jp 0x40e1cf
cmp eax, 0xfddd6b72
imul ebx, ebp, 0xfffffffd
jge 0x40e157
jg 0x40e1ca
jg 0x40e157
mul byte [ebx + ecx*2]
jge 0x40e1d1
push dword [ecx]
ja 0x40e22d
xor dword [edi + 0x63], esi
jge 0x40e22b
mov byte [edi + 0x24], bl
pop edi
and al, 0x73
jg 0x40e168
jae 0x40e250
xchg esi, eax
loopne 0x40e175
out dx, eax
push ss
sub dword [ebx - 0x6971cd41], edx
mov ah, 0xfc
sbb byte [edx], cl
jle 0x40e1e2
call [eax]
sbb bl, bh
sti
call [eax]
jne 0x40e21b
push ds
call [eax]
call [eax]
popal
sbb byte [ecx - 0x5d], ah
jmp dword [edx - 0x61]
mov dword [0xa49f62ff], eax
bound ebx, qword [edi - 0x5acef45c]
movsb byte es:[edi], byte [esi]
or esi, dword [ecx]
movsd dword es:[edi], dword [esi]
jg 0x40e243
sub byte [edx + 0x6363610d], al
lodsb al, byte gs:[esi]
jae 0x40e276
xor dh, byte fs:[ecx + 0xb7cdca8]
jl 0x40e28b
fdivr qword [ebx + ecx + 0x7c]
jg 0x40e218
or edi, ebx
sti
jg 0x40e242
jbe 0x40e275
dec ebp
jge 0x40e220
jg 0x40e249
jg 0x40e24b
xor bh, byte [edi + 0x32]
jg 0x40e24d
xchg dword [ebp - 0x61], edx
jg 0x40e252
jg 0x40e254
jg 0x40e256
ja 0x40e258
stc
or eax, 0xff27
add byte [eax], al
and al, 0
add byte [eax], al
add byte [eax + eax], ah
add byte [eax], ah
and al, byte [eax]
add byte [eax + ecx*2 + 0x20218028], cl
add byte [eax + edi*2], dh
adc dword [edx - 0x43], esi
add al, 0x93
xchg ebx, eax
xor esi, ebx
add byte [eax], ah
add byte [ebx - 0x6a3ff28c], bl
je 0x40e258
rcl byte [ebp + 0x1ffff], 0x1d
invalid
add byte [0x2b1bc92], bl
xchg edx, eax
mov esp, 0x204202b1
mov cl, 2
inc edx
and byte [eax + 0x5a503801], ah
mov al, byte [0x5a503801]
jbe 0x40e2d0
add dword [eax], edi
dec eax
shl bh, 1
js 0x40e2d7
add byte [0x3c1f007], ch
and al, byte [edx]
test cl, 0xfe
pop edi
push cs
stosb byte es:[edi], al
add byte [0xe054cccd], bl
adc dword [eax + 0x8c0af], edi
add dword [ecx + 0x6d000ec4], esi
add byte [ebx], ah
add byte [edx], dh
aad 0x90
Function at 0x418ba6
Capabilities:
Authenticate hmac
Get number of processors
Parse pe header

Disassembly:
sal byte [ebx - 0x52fe2587], 0x33
add dword [eax + 9], ebp
sbb byte [eax + 0x1d], bl
add byte [ebx], al
add byte [eax], bh
add dword [eax + 0x381c00], ebp
Function at 0x402ee4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404bec
test esi, esi
jne 0x402f1b
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404cdc
jmp 0x402f3c
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d80
mov dword [esp], eax
test esi, esi
je 0x402f3c
cmp dword [ebx], 0
je 0x402f3c
dec esi
jmp 0x402f23
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4035d8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x56e008], 0x8088405
inc edx
mov dword [ebx + 0x56e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4035f4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x56e008], 0x8088405
inc edx
mov dword [ebx + 0x56e008], edx
fld qword [ebx + 0x56e06c]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x403c48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x56e024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403ce0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403cc0
xor eax, eax
push ebp
push 0x403cb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403cfc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403cc0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x56e024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x56e024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4049e4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x57504c], 0
je 0x404a45
cmp word [0x575220], 0xd7b2
jne 0x404a0d
cmp dword [0x575228], 0
jbe 0x404a0d
mov eax, 0x57521c
call dword [0x575238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x56e07c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404a6c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x56e034], 0
jne 0x404a61
push 0
push 0x56e074
push 0x56e07c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404ba0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402b20
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x57504d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404b68
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406de0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406e46
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404e5c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040361c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406e30
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e4d
lea eax, [ebp - 0x10]
call fcn.00404bec
ret

Function at 0x409c64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004050ac
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409c7d
test al, 0x10
jne 0x409c81
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40cccc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cd05
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404cdc
jmp 0x40cd0e
mov eax, ebx
mov edx, esi
call fcn.00404c40
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40cd18
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cd39
mov al, byte [esp]
jmp 0x40cd3b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40d3d0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40d238
mov eax, dword [0x574094]
cmp byte [eax], 0
je 0x40d44c
mov eax, dword [0x573988]
call fcn.004033fc
call fcn.00402cac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409eb4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40d494
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40d482
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x573890]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x575668]
call fcn.00406230
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret