joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5836a0
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x224
push esi
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x5836c1
xor eax, eax
pop esi
add esp, 0x224
ret
push edi
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x224
xor edi, edi
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x58371b
jmp 0x5836e0
lea ecx, [esp + 0x28]
push str..exe
push ecx
call fcn.00584e00
add esp, 8
test eax, eax
jne 0x583717
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x5836e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x224
ret
mov edi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x224
ret

Function at 0x5855e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5bfd18
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jb 0x5856b3
push ebx
push ebp
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
lea ebx, [eax + 1]
mov dword [esp + 0x24], ebp
mov eax, SysReAllocString
test ebx, ebx
js 0x58562e
shr eax, 1
test ebx, eax
je 0x585628
add eax, eax
push eax
lea ecx, [esp + 0x14]
call fcn.005854c0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edi, dword [esp + 0x10]
push eax
push ecx
push edi
call fcn.00585480
mov eax, dword [esi + 4]
lea edx, [eax + eax*2]
lea eax, [edi + edx*8]
add esp, 0xc
cmp eax, ebp
je 0x58567b
mov ecx, dword [esp + 0x2c]
movq xmm0, qword [ecx]
movq qword [eax], xmm0
movq xmm0, qword [ecx + 8]
movq qword [eax + 8], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [eax + 0x10], xmm0
mov eax, dword [esi]
mov ecx, dword [esp + 0x18]
push 1
mov dword [esi], edi
push 1
mov dword [esi + 4], ebx
push eax
mov dword [esi + 8], ecx
mov dword [esp + 0x30], 0xffffffff
call fcn.0056bb80
add esp, 0xc
pop edi
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
mov ecx, dword [esi]
lea edx, [eax + eax*2]
lea ecx, [ecx + edx*8]
inc eax
mov dword [esi + 4], eax
test ecx, ecx
je 0x5856e3
mov eax, dword [esp + 0x20]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
movq xmm0, qword [eax + 8]
movq qword [ecx + 8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x58a8c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
je 0x58a8f4
mov cl, byte [edx]
test cl, cl
je 0x58a8f4
mov eax, 0x811c9dc5
movsx ecx, cl
or ecx, 0x20
xor ecx, eax
imul ecx, ecx, 0x1000193
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x58a8d3
xor eax, 0x2a
imul eax, eax, 0x1000193
ret
xor eax, eax
ret
Function at 0x58fe87
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x690dfc]
jne 0x58fe91
repz ret
jmp fcn.005994ff

Function at 0x5900ae
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x5900df
call fcn.0059703a
mov dword [eax], esi
call fcn.00597027
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005910e6
add esp, 0x14
push 0x16
pop eax
jmp 0x590134
test dword [ebp + 0xc], 0xfffffff9
jne 0x5900bb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x59010c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0059704d
pop ecx
call fcn.00597027
mov eax, dword [eax]
jmp 0x590134
test al, 0x10
jne 0x590132
test al, 1
je 0x590132
test byte [ebp + 0xc], 2
je 0x590132
call fcn.0059703a
mov dword [eax], 5
call fcn.00597027
mov dword [eax], 0xd
jmp 0x590103
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5a4464
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00599677
and dword [ebp - 4], 0
cmp dword [0x73beb8], 0
mov ebx, eax
jne 0x5a4515
push 0x658708
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5a45c6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6586fc
push edi
call esi
test eax, eax
je 0x5a45c6
push eax
call fcn.00599605
mov dword [esp], 0x6586ec
push edi
mov dword [0x73beb8], eax
call esi
push eax
call fcn.00599605
mov dword [esp], 0x6586d8
push edi
mov dword [0x73bebc], eax
call esi
push eax
call fcn.00599605
mov dword [esp], 0x6586bc
push edi
mov dword [0x73bec0], eax
call esi
push eax
call fcn.00599605
pop ecx
mov dword [0x73bec8], eax
test eax, eax
je 0x5a4515
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00599605
pop ecx
mov dword [0x73bec4], eax
mov eax, dword [0x73bec4]
cmp eax, ebx
je 0x5a456d
cmp dword [0x73bec8], ebx
je 0x5a456d
push eax
call fcn.00599680
push dword [0x73bec8]
mov esi, eax
call fcn.00599680
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5a456d
test edi, edi
je 0x5a456d
call esi
test eax, eax
je 0x5a4564
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5a4564
test byte [ebp - 0xc], 1
jne 0x5a456d
or dword [ebp + 0x10], 0x200000
jmp 0x5a45a6
mov eax, dword [0x73bebc]
cmp eax, ebx
je 0x5a45a6
push eax
call fcn.00599680
pop ecx
test eax, eax
je 0x5a45a6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5a45a6
mov eax, dword [0x73bec0]
cmp eax, ebx
je 0x5a45a6
push eax
call fcn.00599680
pop ecx
test eax, eax
je 0x5a45a6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x73beb8]
call fcn.00599680
pop ecx
test eax, eax
je 0x5a45c6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5a45c8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5ae800
Capabilities:
Get common file path

Disassembly:
push ebp
push esi
push edi
xor edi, edi
test ebx, ebx
je 0x5ae87b
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call ebp
push ebx
mov esi, eax
call fcn.005ad502
add eax, esi
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x5ae837
pop edi
pop esi
pop ebp
ret
push esi
push edi
call ebp
mov ebp, eax
cmp word [edi + ebp*2 - 2], 0x5c
je 0x5ae84e
mov word [edi + ebp*2], 0x5c
add ebp, 1
push ebx
xor esi, esi
call fcn.005ad502
add esp, 4
test eax, eax
jbe 0x5ae87b
lea ebp, [edi + ebp*2]
mov cx, word [ebx + esi*2]
mov word [ebp], cx
push ebx
add esi, 1
add ebp, 2
call fcn.005ad502
add esp, 4
cmp esi, eax
jb 0x5ae860
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x5af9b0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor esi, esi
cmp dword [0x73c4e8], esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x24
mov dword [esp + 0x14], 0x26
mov dword [esp + 0x18], 0x2a
jne 0x5afa46
push 3
push 0x20
push 3
push 1
push 3
push 2
push esi
push esi
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
push 0x23
push 0x73c4e8
mov dword [0x73c4e8], 0x11c
mov dword [0x73c4ec], 6
mov dword [0x73c4f0], 1
mov word [0x73c5fc], si
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb eax, eax
add eax, 1
mov dword [0x6922b4], eax
jmp 0x5afa4b
mov eax, dword [0x6922b4]
cmp eax, esi
je 0x5afa5a
pop esi
mov eax, 1
pop ebp
add esp, 0x14
ret
cmp ebp, esi
je 0x5afb7a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push edi
push esi
push esi
push esi
push ebp
call ebx
mov edi, eax
test edi, edi
je 0x5afb78
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esp + 0x10], eax
je 0x5afb78
push 0
mov ecx, eax
push ecx
push edi
push ebp
call ebx
cmp edi, eax
jbe 0x5afb78
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ebx, ebx
jmp 0x5afab0
mov eax, dword [esp + ebx*4 + 0x18]
cmp eax, 0x26
jne 0x5afb2f
push 0
push 0
push str._ProgramW6432_
call ebp
mov edi, eax
test edi, edi
je 0x5afb78
lea edx, [edi + edi + 2]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x5afb78
push edi
push esi
push str._ProgramW6432_
call ebp
cmp edi, eax
jne 0x5afb78
push esi
push str._ProgramW6432_
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x5afb16
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x641a4c
push 0x26
jmp 0x5afb35
cmp word [esi + edi*2 - 4], 0x5c
je 0x5afb43
push 0x662cc8
add edi, 1
push edi
push esi
call fcn.005af800
jmp 0x5afb43
push 0x641a4c
push eax
call fcn.005af8a0
mov esi, eax
add esp, 8
test esi, esi
je 0x5afb78
push esi
call fcn.005ad502
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
call fcn.005b0c24
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
jne 0x5afb78
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, 1
xor esi, esi
cmp ebx, 3
jl 0x5afab0
pop edi
pop ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov eax, dword [esp + 0xc]
pop esi
pop ebp
add esp, 0x14
ret

Function at 0x5aff20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
call fcn.005afdb0
mov esi, eax
add esp, 4
test esi, esi
je 0x5aff62
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5aff44
test al, 0x50
je 0x5aff62
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x5aff57
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x7d282b4
Capabilities:
Encode data using base64

Disassembly:
ror dword [esp], 0x1e
test ebx, ebx
not dword [esp]
lea esp, [esp + 4]
je 0x84ade33
mov dword [esp], 0x53ac6ba0
adc eax, edx
rol word [esp], 0xa8
mov dword [ebp - 4], eax
shl byte [esp + 3], 0x46
js 0x7ce39da

Function at 0x7d524ce
Capabilities:
Encode data using xor

Disassembly:
and al, 8
jb 0x7d8a2bb
xor bh, byte [ebx]
push 0x1c9ca53
mov eax, 0x82d9608b
pop edx
inc ebx
jo 0x7d524c7
push 0xffffffffffffff89
inc ecx
fsubr st(3)
dec eax
sal dword [edx], 0xfa
mov ebx, 0x812a5398
jns 0x7d5255c
dec ebx
nop
mov dl, 0xcf
cmpsb byte [esi], byte es:[edi]
aad 0xec
sub dword [esi], ecx
add byte [eax], al
add byte [eax - 0x45f8649], al
or dword [eax], eax
add byte [eax], al
add byte [edx + 0x303f0c26], bl
test al, 0xd
adc ebx, dword [edx]
les edx, [edi - 0x318ef3aa]
inc edi
mov esi, ebx
lodsb al, byte [esi]
mov cl, 0xc1
sar byte [edi + 0x78059028], cl
mov byte [0xbc65a74f], al
xor dword [esi], esi
std
xchg ebx, eax
jle 0x7d52507
das
sbb al, 0xdf
push esi
cmp eax, 0x8c3714c5
adc eax, 0x3c0fd60e
pop ss
scasb al, byte es:[edi]
or eax, 0x5cd7f4c5
movsd dword es:[edi], dword [esi]
push cs
test byte [edi + 0x64], 0x37
mov esi, 0x2f0c1dc5
sub al, 0xf5
pop eax
or al, 0x3e
cmp eax, 0xd8c8b9b
mov esp, 0xd4f667f6
push ds
retf 0xbddf
jb 0x7dc3a79
dec ebp
mov ebp, dword [eax]
dec ecx
add eax, 8
inc ecx
mov edx, 0x903081a2
inc ebp
movsx esp, dx
dec ebp
mov esp, ebp
inc ebp
movzx esi, dl
inc ebp
xchg dl, dh
jmp fcn.07dcb83c
mov dword [ecx], eax
push 0x9f3e58ad
mov dword [esp + 4], 0x3693b616
lea esp, [esp + 0x24]
jbe fcn.07cdee50

Function at 0x7d6f4dc
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x2b9489d
jl 0x7d5b52c
test bx, 0x77a9

Function at 0x7d7ca98
Capabilities:
Encode data using base64

Disassembly:
call fcn.07dbf0d7
mov dword [esp + edx - 0x601d2218], edx
movzx edx, byte [ebp + edx - 0x601d2218]
jg 0x80e79e9
shl byte [esp + 8], 7
adc dl, 0x2e
jmp 0x7ceeea9
xor dl, bl
shl dword [esp], 0xe6
push 0x689de536
dec dl
not dl
neg dl
push 0x45b9b721
shr dword [esp + 2], 0xc4
jp fcn.07e44c48
xor dl, 0xf
jmp 0x7d7f573

Function at 0x7d87e8d
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp + ebx*4]
call fcn.07d87e8d
jmp 0x84ade24
mov dword [esp], 0x6b3e109d
mov dword [esp], eax
dec ebx
jmp 0x7d055b8
mov eax, dword [ebp]
call fcn.07e766fb
mov eax, 0x6129598d
movsx edx, ax
btr edx, 0x1a
mov dx, word [edi + edx - 0x598d]
ror eax, 0xf
not ax
push 0xa2aa8e3c
lea esp, [esp + 4]
jne 0x7ce39ef
jmp 0x80eb3ea
Function at 0x7d9c086
Capabilities:
Encode data using base64

Disassembly:
push 0x568bf9b7
dec eax
mov dword [esp + 8], 0x4ab9aa7
not ecx
rol dword [esp + 4], 0x44
push 0xf99492b3
not edi
inc dword [esp + 0x12]
jno 0x7e6758c
sysenter
push ecx
mov dword [esp], 0xbdb95580
call fcn.07d1f14e
jecxz 0x7e675c7
ret
dec ebx
mov ch, 0x2c
jno 0x7e675e7
sub dword [edx - 0x59], 0xffffffc0
dec eax
mov byte [ebx], cl
iretd
or ecx, edi
call fcn.07d7f5b7
jne 0x7e67581
fbstp tbyte [ecx*4 - 0x2370f932]
jbe 0xcfcb5adf
insb byte es:[edi], dx
aad 0xce
push ss
das
sbb al, 0xf
xchg byte [ebp + 0x7cb79435], cl
add eax, 0xccef5e96
pop ss
xor eax, 0x54e93918
aas
rcr dword [edi], 0x37
mov ds, eax
out 0xa4, al
dec esp
jbe 0x7e67551
aas
outsb dx, byte [esi]
sbb al, 0xb1
dec edi
adc ah, ah
push ebp
mov esp, 0xa2ab42aa
xchg esi, eax
ficomp dword [esi - 0x345218f5]
adc ecx, ecx
insd dword es:[edi], dx
pop es
sbb esp, eax
ret 0xa6dc
jge 0x7e6765d
push ebx
dec esi
invalid
mov bh, 0xac
int3

Function at 0x7da657d
Capabilities:
Encode data using xor

Disassembly:
neg ax
shl dword [esp + 4], 0xa1
rol ax, 1
shl word [esp + 5], 0x4d
not ax
sal dword [esp + 4], 0xe6
mov byte [esp + 3], 7
inc ax
sar dword [esp + 4], 0xfd
jae 0x7e1d9df
jmp 0x7dd1cee
mov dword [esp], 0xfa82da11
xor ax, bx
push 0x29368e31
shl word [esp + 6], 0xee
ja 0x7d620fc
cmp dword [edi + 0x29], esp
xchg esi, eax
sub dword [esi + 0x10f9e5e8], edx
aad 0x7d
push eax
call 0xdcee16f8
jge 0x7dd1d65
cmp ch, byte [ecx + 0x40]
jne 0x7dd1d57
fsub dword [edx]
jp 0x7dd1d0e
and bh, byte [edx - 0x10]
xor al, 0xca
xchg ecx, eax
mov ebp, 0x5c4d0939
and al, 0x86
jnp 0x7dd1d1b
pop edx
jge 0x7dd1d0c
enter 0xffffffffffffdedc, 0xfffffffffffffff7
int3
cmp byte [ecx], 0x4e
push ecx
das
pushal
dec ebx
in al, 0xb0
and ebx, ecx
xchg ebx, edx
xor al, 0xff
cmpsb byte [esi], byte es:[edi]
ljmp 0xc2fb
add dword [esp + 2], 0x94bd4412
xor bx, ax
call fcn.0849efbe

Function at 0x7dc10b5
Capabilities:
Encode data using xor

Disassembly:
push 0x5a2d52b3
lea esp, [esp + 0x10]
je 0x7dc10e4
mov eax, 0x25a53c16
inc eax
cwde
mov eax, dword [ebp + ebx*4]
push 0x4682f9b5
xor byte [esp + 3], 0x2b
mov dword [esp], eax
dec ebx
jne 0x7dc10c4
push 0x7b905fb3
mov eax, dword [esp]
not eax
mov eax, dword [ebp]
lea esp, [esp + 4]
call eax
call fcn.07df4adb

Function at 0x7dda930
Capabilities:
Encode data using base64

Disassembly:
inc esi
sar dword [esp + 4], 0x98
jne 0x80dcaf0
xor eax, edi
inc byte [esp + 6]
sal word [esp + 5], 0x6e
jbe 0x7cfa5e7
shr eax, 8
jmp 0x7d44d3c
ror dword [esp + 4], 0x1c
xor eax, 0x28916323
shr byte [esp + 6], 0xa7
push 0xfe19ef24
dec edx
lea esp, [esp + 0xc]
jne 0x7cf65ba
push 0x700c1ab9
mov edi, dword [esp + 4]
lea esp, [esp + 8]
Function at 0x7e496e3
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov dword [eax], edx
call fcn.07e3bde4
dec esp
add edx, esp
inc ecx
mov edx, dword [edx + edx - 0x313a6455]
dec ecx
sub eax, 4
jmp 0x7d7f9bd
dec eax
mov dword [esp + 8], 0xeccd359a
dec eax
lea esp, [esp + 8]
call fcn.07dbcab0
inc ecx
mov edx, 0x1993d48c
inc edi
movzx edx, byte [esp + edx*4 - 0x664f5230]
dec ecx
add esp, 1
mov edx, 0xd5ae8b01
dec eax
dec edx
inc esp
xor dl, dh
neg dx
inc ecx
sbb dl, 0x98
dec eax
lea edx, [edx + edx*2 + 0x4827e780]
dec eax
and edx, edx
dec eax
sbb edx, 0xe43f5ebc
inc ecx
ror dl, 1
dec eax
sub edx, edx
bts dx, dx
xchg dh, dl
inc ecx
inc dl
dec eax
add edx, 0x332a9785
or dl, dh
ror edx, 0xaf
inc ecx
not dl
inc ecx
xor dh, dl
btc dx, 0x19
jb 0x7e11660

Function at 0x7e5460d
Capabilities:
Encode data using base64

Disassembly:
xor eax, eax
inc word [esp + 1]
xor dword [esp + 2], 0x8fbe41a6
sar dword [esp + 1], 0xc
test edx, edx
lea esp, [esp + 8]
je 0x7d7b20a
push 0xd8e8c1f
neg word [esp + 1]
mov dword [esp], ebx
mov dword [esp], 0xad187a0c
add word [esp], 0x3296
adc edi, 4
push 0x3e8c9da3
neg dword [esp + 4]
jne 0x7d1d932
Function at 0x7e5e5bf
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
jmp 0x7d4a81d
rep stosd dword es:[edi], eax
jmp 0x847fa01
mov eax, edx
shl edx, 0x10
or eax, edx
test dx, 0xb22b
jmp 0x7dc7ffd
mov dword [ebp - 0x2c], edi
je 0x847fa09
mov ecx, eax
and edi, 0x70300e03
or al, 0x8d
mov eax, 0x400
mov edi, 0x86347f19
sal di, 0x90
cmovne edi, edi
mov edi, edx
adc dx, 0x5aa2
cwd
movzx edx, ax
jmp 0x7d2d28a
sub esi, edi
cmc
mov dword [ebp - 0x44], esi
not si
mov si, 0x8423
xadd si, si
mov esi, edi
cmp bp, 0xc813
shl esi, cl
mov ecx, dword [ebp + 0xc]
jmp 0x7dcadb1
shr ecx, 1
jmp 0x7d148b7
mov dword [ebp - 0x18], ebx
mov byte [ebp - 1], bl
test ax, 0x2b97
jmp 0x7de1433
sub esi, edi
mov dword [ebp - 0x48], esi
sbb esi, ebp
mov si, 0x9c82
mov esi, dword [eax]
mov dword [ecx], ebx
mov ecx, dword [ebp + 0x14]
stc
cmp dh, 0x26
mov dword [ecx], ebx
btc cx, bx
bswap cx
mov ecx, dword [eax + 4]
and ax, sp
add eax, esi
lea ecx, [ecx + esi]
xor al, dl
adc eax, esp
bsf eax, edi
mov eax, 0x300
test al, 0xb3
shl eax, cl
stc
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], ebx
cmp esp, esi
clc
mov dword [ebp - 0x10], edi
add eax, 0x736
jmp 0x7d0fb6c
lea esp, [esp + 8]
ja fcn.084a022e
mov ecx, 0x97215f33
neg ecx
lea edx, [ecx*4 + 0x17291c94]
mov edx, esp
lea ecx, [ecx - 0x68dea055]
mov edi, 0x536da2b
not edi
mov eax, edi
lea eax, [esi - 0x80]
imul edi, edi
btr edi, edi
ror edi, 0xb7
and eax, 0xfffffffc
push edi
sub eax, ecx
call fcn.07d1af6b
push ebp
shld dx, bp, 0xe
bt ecx, ebp
mov ebp, esp
shl ch, 0xa4
lea esp, [esp - 0x48]
rcl cx, cl
rcl dx, 0xad
mov ecx, dword [eax + 8]
btr dx, 0x21
mov edx, dword [eax + 0xc]
push ebx
cmp cl, 0x29
push esi
push edi
cmp eax, 0xab691b6
mov edi, 1
test di, 0x491a
dec esi
mov esi, edi
test esp, 0x6485e481
shl esi, cl
mov ecx, dword [eax + 4]
xor ebx, ebx
mov dword [ebp - 0x20], edx
cmc
stc
jmp 0x7d7ac5d
adc ecx, ecx
rep stosw word es:[edi], ax
ror al, 0x17
mov ecx, dword [ebp + 8]
xor ax, ax
cmove eax, esp
lea eax, [ecx - 1]
test dh, 0xb7
clc
mov dword [ebp - 0x40], eax
cmc
cmp cl, 0x95
xor esi, esi
cmp ah, 0xd
cmc
test edi, esp
or eax, 0xffffffff
clc
xor edi, edi
cmp esi, 0xec14a999
Function at 0x7fd1e27
Capabilities:
Authenticate hmac

Disassembly:
sal ebp, 0xde
mov eax, dword [0x217312cf]
sal byte [0xe31715c5], 1
jecxz 0x7fd1dde
push ecx
rcl byte [si - 0x1c85], cl
inc eax
push edi
adc eax, 0x7de48619
in al, 0x7d
sbb bh, byte [ebp + eax*4 - 0x6e]
xchg dword [esi + ebx*8], edi
or byte [eax + esi*8 - 0x465c61aa], 0xf1
pushal
lodsb al, byte [esi]
pop ds
sbb dword [esi], ebx
out dx, eax
cmp eax, 0xf9a422d4
pop ebx
pop es
fldcw word [ebx]
enter 0xffffffffffffe598, 0x65
xchg edx, eax
or byte [esi - 0x7950ff9d], dl
adc byte [ecx], bh
stosb byte es:[edi], al
loop 0x7fd1e14
mov al, 0xf6
insb byte es:[edi], dx
push edi
cmp ecx, esp
and al, 0xca
pop edx
fidivr word [edx]
out 0x36, eax
invalid
movsd dword es:[edi], dword [esi]
out 0xca, eax
out 0x64, al
sbb al, 0xb6
jg 0x7fd1dc3
sbb cl, byte [ecx + 0x6a]
push 0xd527fc2c
out 0x81, eax
cdq
mov ch, 0x76
mov dword [esi + eax*8 + 0x773d26cd], ebx
xchg edi, eax
xor dh, al
sub eax, 0xe1fc805c
pushfd
ror byte [0x6b363eac], 0x5f
invalid

Function at 0x849815e
Capabilities:
Encode data using base64

Disassembly:
adc ebp, 1
shr dl, cl
call 0x7e71c5c
push 0x29b9a781
jp 0x7d9644b

Function at 0x84b1bdd
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
call eax
call fcn.07e851a5
Function at 0x402930
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x40296d
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x40298d
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404714
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402b54
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404494
test esi, esi
jne 0x402b8a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404584
jmp 0x402ba8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a08
mov edi, eax
test esi, esi
je 0x402ba8
cmp dword [ebx], 0
je 0x402ba8
dec esi
jmp 0x402b91
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402ec8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x55f008], 0x8088405
inc edx
mov dword [ebx + 0x55f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4034b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x55f024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40354c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40352c
xor eax, eax
push ebp
push 0x403525
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403568
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40352c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x55f024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x55f024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404274
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x57304c], 0
je 0x4042d5
cmp word [0x573220], 0xd7b2
jne 0x40429d
cmp dword [0x573228], 0
jbe 0x40429d
mov eax, 0x57321c
call dword [0x573238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x55f078
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4042fc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x55f034], 0
jne 0x4042f1
push 0
push 0x55f070
push 0x55f078
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404448
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402754
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x57304d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404410
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc