joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004c255
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004c273
push 0
push 0x11d5
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x1004c293
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1004c293
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret

Function at 0x1004c52a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004c54b
push 0
push 0xa6e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x1004c596
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1004c579
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1004c596
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001a3f7
mov dword [eax], 0x13b91020
jmp 0x1004c56e
mov esp, ebp
pop ebp
ret

Function at 0x1004c6e4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004c73f
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1004c720
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1004c73d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001a3f7
mov dword [eax], 0xa17913da
jmp 0x1004c715
jmp 0x1004c749
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret

Function at 0x1004d90d
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004d924
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1004d941
push 0
push 0
push 0
push 0
push 0xe19
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop ebp
ret
Function at 0x1004deec
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004df33
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x1004df53
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1004df53
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x10061d90
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100903ac]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20], ax
xor ecx, ecx
mov word [ebp - 0x1e], cx
cmp dword [ebp + 8], 0xffffffff
jne 0x10061db4
jmp 0x10061e23
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x10061dc8
jmp 0x10061e23
movsx ecx, word [ebp - 0x1c]
movsx edx, word [ebp - 0x1a]
imul ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
jne 0x10061df4
jmp 0x10061e23
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x10061e15
jmp 0x10061e23
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call main
mov esp, ebp
pop ebp
ret

Function at 0x10062ee0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 5]
and ecx, 0xf
movzx edx, byte [0x1067bc18]
or ecx, edx
mov byte [ebp - 1], cl
movzx ax, byte [ebp - 1]
movzx ecx, ax
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
push ecx
push 0x1067bdf8
call fcn.100621c0
add esp, 8
mov esp, ebp
pop ebp
ret 4

Function at 0x100644e0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 5]
and ecx, 0xf
movzx edx, byte [0x1067bbdc]
or ecx, edx
mov byte [ebp - 1], cl
movzx ax, byte [ebp - 1]
movzx ecx, ax
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
push ecx
push 0x1067bdf8
call fcn.100621c0
add esp, 8
mov esp, ebp
pop ebp
ret 4
Function at 0x10068b50
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100903ac]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20], ax
xor ecx, ecx
mov word [ebp - 0x1e], cx
cmp dword [ebp + 8], 0xffffffff
jne 0x10068b74
jmp 0x10068be3
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x10068b88
jmp 0x10068be3
movsx ecx, word [ebp - 0x1c]
movsx edx, word [ebp - 0x1a]
imul ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
jne 0x10068bb4
jmp 0x10068be3
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x10068bd5
jmp 0x10068be3
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call main
mov esp, ebp
pop ebp
ret
Function at 0x100853f4
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100903ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1007796c
mov dword [ebp - 0x14], eax
cmp dword [0x1067cde4], esi
jne 0x100854e7
push 0x800
push esi
push 0x10007c5c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10085474
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100855c7
push esi
push esi
push 0x10007c5c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100855c7
push 0x10007c74
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100855c7
push eax
call ebx
push 0x10007c80
push edi
mov dword [0x1067cde4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007c90
push edi
mov dword [0x1067cde8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007ca4
push edi
mov dword [0x1067cdec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067cdf4], eax
test eax, eax
je 0x100854e4
push 0x10007cc0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067cdf0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1008550c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100854ff
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10085521
push 4
pop eax
jmp 0x100855c9
cmp dword [ebp - 0x14], esi
je 0x10085521
push dword [0x1067cde4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10085506
mov eax, dword [0x1067cdf0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1008557f
cmp dword [0x1067cdf4], edi
je 0x1008557f
push eax
call ebx
push dword [0x1067cdf4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1008557f
test eax, eax
je 0x1008557f
call ecx
test eax, eax
je 0x10085574
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10085574
test byte [ebp - 8], 1
jne 0x1008557f
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100855af
mov eax, dword [0x1067cde8]
cmp eax, edi
je 0x100855ac
push eax
call ebx
test eax, eax
je 0x100855ac
call eax
mov esi, eax
test esi, esi
je 0x100855ac
mov eax, dword [0x1067cdec]
cmp eax, edi
je 0x100855ac
push eax
call ebx
test eax, eax
je 0x100855ac
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1067cde4]
call ebx
test eax, eax
je 0x100855c7
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100855c9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0xc5cc1a
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp], ebp
mov eax, 0xe96021d2
lea edx, [edx - 0x68]
jmp 0xc5cc4f
lea esi, [esp + ebx]
xor al, 0x1c
xchg ebx, ebp
call 0xc5cc39
popfd
or dword [ecx + reloc.d3d9.dll_Direct3DCreate9], ebx
stosb byte es:[edi], al
cmp byte [edi - 0x56], bl
pop ds
dec ebx
loop 0xc5cc50
jge 0xc5cc69
invalid
invalid

Function at 0xca9228
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ecx + ebx]
mov dx, word [esp + 1]
rdtsc
mov byte [esp], dl
call fcn.00ca9288
in al, dx
mov eax, dword [esp + 2]
jmp 0xca92a8
lea esp, [esp + 4]
add bl, 0xe
inc edx
js 0xca92ec
jns 0xca92d6
js 0xca92b4
insb byte es:[edi], dx
or eax, dword [esi]
mov al, 0x4a
rol dword [ebx + 0x26], cl
aad 0x12
salc
inc ecx
ret
bswap eax
bts ax, di
mov ah, byte [esp]
jmp 0xcaa43f
bswap eax
bts ax, di
mov ah, byte [esp]
rdtsc
mov edx, dword [esp]
jmp 0xcaa1dc
lea esp, [esp + 1]
jmp 0xcaa111
jmp 0xcaa0a2
mov dx, word [esp]
cbw
lea edx, reloc.d3d9.dll_Direct3DCreate9
mov edx, ebp
jmp 0xcaa0f4
jmp 0xcaa0ba
mov edx, dword [esp]
jmp 0xcaa15d
out dx, eax
mul cl
xchg ebx, eax
mov dh, byte [esp]
shr dh, cl
jno 0xcaa0de
jo 0xcaa1a0
das
mov byte [0x14a25730], al
jae 0xcaa0f1
ja 0xcaa11e
loope 0xcaa15e
lcall 0xd08b, 0x6693e4f5
xchg ebx, eax
mov dx, ax
lea edx, [ebx + ebp]
shl edx, cl
jae 0xcaa0dc
mov dx, word [esp]
adc al, 0x24
jmp 0xcaa0be
mov word [ebp], bx
mov dword [ebp], ebx
mov dh, byte [esp]
pushal
setb dl
jmp fcn.00c60235
mov edx, dword [esp]
jmp 0xcaa15d
ror bl, 0
mov al, bl
mov ax, 0x9bc2
sub esp, 0xd
jbe 0xcaa0b8
lea esp, [esp + 1]
jmp 0xcaa111
rdtsc
mov edx, dword [esp]
jmp 0xcaa1dc
Function at 0xd03efa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, byte [esp + 3]
mov byte [esp + 0xb], dh
mov edx, ebx
neg eax
cld
pop ecx
jmp 0xd03f00
push dword [esp + 0xb]
jmp 0xd03ee4
add esp, 0x11
cld
pop word [esp]
mov cx, 0x1ea4
lea edx, [eax + 0x52]
mov cx, sp
jmp 0xd03f5a
xchg ah, dh
lea edx, reloc.d3d9.dll_Direct3DCreate9
rdtsc
xchg dword [esp], ecx
xchg edi, ebp
mov byte [esp], cl
jmp 0xd03f44
mov esi, 0x6071ac6a
mov esi, dword [esp + 1]
mov bh, byte [esp + 2]
lea esi, [ecx + edx]
jmp 0xd04023
lea esp, [esp + 2]
rdtsc
push edx
shl cx, 7
mov ch, 0xd8
setle cl
jmp 0xd03f14
rdtsc
xchg edi, ebx
mov dh, dl
lea ebx, [ebx + edi]
ror edx, 0xb
lea ebp, [esi + esi]
jmp 0xd03fb2
clc
pop ax
xchg ecx, edi
bswap eax
cpuid
stc
jmp 0xd03f90
lea esp, [esp + 1]
bswap ebp
mov word [esp + 6], dx
and cx, 0x40aa
push dword [esp + 4]
inc cl
jmp 0xd04006
push dword [esp + 2]
lea esi, reloc.d3d9.dll_Direct3DCreate9
bswap ebx
mov esi, dword [esp + 6]
push dword [esp + 7]
xchg esi, edi
jmp 0xd03fa6
mov esi, 0x4ebed151
bts bx, sp
mov ebx, 0xd0ae955b
bswap ebx
jmp 0xd04050
clc
lea ecx, [eax + esi]
pushal
pop ebx
mov ah, 0x18
xchg byte [esp + 0xd], dh
jmp 0xd03ff0
mov si, 0x5d45
not cx
cpuid
sbb bl, bl
mov bp, word [esp + 1]
mov edi, 0x7fdd88cd
jmp 0xd03fd7
lea edi, [ecx*4]
mov esi, 0x99ddec16
popal
shl bl, cl
jmp 0xd04117
mov word [esp + 6], di
mov esi, 0x81b9ed74
mov bp, word [esp + 0xa]
mov dl, 0x50
bswap edx
pop dword [esp + 9]
jmp 0xd0403a
rdtsc
mov edi, esi
mov al, byte [esp]
sub ebp, 0x23416e44
jmp 0xd040e3
or bh, ah
mov ecx, dword [esp]
add esp, 3
neg bh
mov byte [esp], dl
mov bl, 0x2d
jmp 0xd04086
mov ax, word [esp]
xchg byte [esp], dl
lea ecx, reloc.d3d9.dll_Direct3DCreate9
btc ax, bx
call fcn.00d040c3
mov bx, 0xc730
mov eax, dword [esp + 0xa]
xchg dh, ah
add esp, 8
bsr ax, dx
bswap ecx
jmp 0xd041eb
bswap edx
inc edi
pop cx
xor ebx, 0xb3a9810b
xchg ah, al
lea edi, reloc.d3d9.dll_Direct3DCreate9
jmp 0xd0409c
pop ebp
neg dx
mov ebx, dword [esp + 3]
neg al
jmp 0xd0417c
bt edx, esp
mov dh, al
bsr bp, ax
bsr di, dx
mov ebx, dword [esp]
sub esp, 0xe
jmp 0xd0412f
pop di
push eax
lea ecx, reloc.d3d9.dll_Direct3DCreate9
xchg esi, edx
mov byte [esp + 1], dh
std
call fcn.00d04198
push esi
imul esi, dword [edx + 0x74], 0x416c6175
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
lea edi, [edi*4]
lea ebp, [eax*4]
bswap ebp
mov byte [esp + 3], ch
pop bx
mov word [esp], bp
jmp 0xd0415a
mov di, ax
inc ecx
mov dl, 0xf2
mov dh, cl
mov esi, edx
xchg esi, ebx
jmp 0xd04145
mov word [esp], dx
add esp, 2
neg edi
lea edx, [edi + edi]
not esi
mov ah, 0x94
jmp 0xd041bb
Function at 0xd04198
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xd041cc
mov cx, 0x99e6
mov bh, 0x48
shl ecx, 0x17
cpuid
setnp ch
mov bx, 0x47d3
jmp 0xd04213
cmp dh, 0xfd
sub esp, 0x1a
pop edx
pop bp
pushal
lea esp, [esp + 0x43]
jmp 0xd0419a
add esp, 1
shr al, 2
std
mov bx, sp
mov bx, word [esp]
jmp 0xd04227
rcl ax, cl
lea ebx, [ecx + edx]
mov di, si
push bp
bts cx, bp
xchg byte [esp], ah
jmp 0xd041fd
add esp, 0
xchg ebp, edx
mov al, byte [esp]
cmp dl, dl
cpuid
clc
jmp 0xd04929
setp ah
bsf bp, sp
rcr si, cl
sbb edi, ecx
xchg esi, ebx
lea eax, reloc.d3d9.dll_Direct3DCreate9
jmp 0xd0424b
lea eax, [edi + ebp]
shl cl, cl
mov ebp, dword [esp]
lea esi, [esi + 0xa5]
cld
xchg esi, ebp
jmp 0xd0426f
mov dx, 0xfe85
btr eax, ebp
mov ax, cx
lea edx, [ebp*4]
rdtsc
not ch
jmp 0xd04342
not ah
mov ecx, 0xac672b09
lea esi, [esi + ebp]
mov si, 0x167a
pop bp
lea ecx, [edi - 0x87]
jmp 0xd043d2
cmc
bswap ebp
sub esp, 2
mov edx, ebx
neg dh
mov word [esp], bp
jmp 0xd0447e
xchg byte [esp], cl
mov eax, esi
xchg edx, esi
xchg cl, ah
bswap ecx
mov ebx, eax
jmp 0xd047e5

Function at 0xd042d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
bsr dx, ax
jmp 0xd04319
ror eax, cl
push dword [esp + 5]
push dx
mov byte [esp + 0x12], dl
mov bh, 0xb5
mov dword [esp + 1], edi
jmp 0xd043a4
sub esp, 0x1d
xchg word [esp + 0x34], si
bswap edi
add esp, 0x1f
xchg bx, si
call fcn.00d04382
cdq
rdtsc
mov byte [esp + 0xe], ch
cpuid
setle ah
neg esi
mov ebx, 0x5003f543
jmp 0xd04358
inc al
push dword [esp]
push ecx
pushal
add esp, 0x1c
sub esp, 2
jmp 0xd0436e

Function at 0xd04578
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bp, si
mov ah, al
add esp, 7
mov esi, ebx
mov dh, byte [esp + 3]
jmp 0xd045b3
xchg bh, bl
xchg cx, ax
pushal
rdtsc
std
xchg dword [esp + 0x1f], edi
jmp 0xd04597

Function at 0xd0cb33
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00d0bffb
pop word [esp]
mov word [esp], di
jmp 0xd0cb57
mov byte [esp], al
mov word [esp], si
lea esp, [esp + 2]
push esi
pushal
lea esp, [esp + 0x13]
jmp 0xd0cb93
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0xd0cbaa
mov dword [esp + 5], esi
pop word [esp + 2]
pop dword [esp]
mov dword [esp], eax
push sp
lea esp, [esp + 1]
jmp 0xd0cb7d
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xd0cbf4
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xd0bff6
Function at 0x402260
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
cmp byte [ebx], 0
jne 0x402292
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call fcn.004020c0
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.00403e40
pop ecx
mov esi, eax
test esi, esi
je 0x4022e7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*4]
push eax
push esi
push ebx
call fcn.004020c0
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x40850c], eax
mov dword [0x408510], esi
jmp 0x4022ef
push 1
call fcn.00401d80
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402300
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edx, eax
mov dword [ebp - 4], edx
test eax, eax
jne 0x402320
mov eax, dword [0x4085e0]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ebx, eax
xor ecx, ecx
jmp 0x402341
mov edx, ebx
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x40232e
lea esi, [eax + 1]
cmp byte [ebx], 0x3d
je 0x40233f
add ecx, esi
add ebx, esi
cmp byte [ebx], 0
jne 0x402329
inc ecx
push ecx
call fcn.00403e40
pop ecx
mov edi, eax
mov dword [0x408518], eax
cmp dword [0x408518], 0
je 0x4023ae
mov eax, dword [ebp - 4]
mov ebx, eax
jmp 0x40238f
mov edx, ebx
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x40236a
lea esi, [eax + 1]
cmp byte [ebx], 0x3d
je 0x40238d
mov ecx, edi
mov edx, ebx
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x402380
pop eax
add edi, esi
add ebx, esi
cmp byte [ebx], 0
jne 0x402365
mov byte [edi], 0
mov eax, dword [ebp - 4]
cmp eax, dword [0x4085e0]
je 0x4023b6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x4023b6
push 1
call fcn.00401d80
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407684
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040a39c
test esi, esi
jne 0x4076ba
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040a534
jmp 0x4076d8
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004075c8
mov edi, eax
test esi, esi
je 0x4076d8
cmp dword [ebx], 0
je 0x4076d8
dec esi
jmp 0x4076c1
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x408f28
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004093e8
mov byte [esp], al
cmp byte [esp], 0
jne 0x4090b1
test edi, edi
je 0x4090b1
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408ff1
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x408fcc
cmp edi, 0xffffffff
je 0x408f8d
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408f8d
mov byte [esp], 0
jmp 0x4090b1
cmp dword [esi], 1
jg 0x408fcc
cmp dword [esi], 0
jne 0x408fbe
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x408fbe
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4090b1
lea eax, [esp + 0xc]
call fcn.00408bdc
dec ebp
test ebp, ebp
jg 0x408f72
cmp edi, 0xffffffff
je 0x408ff1
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408fef
mov byte [esp], 0
jmp 0x4090b1
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408f36
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408ff1
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040912c
mov edx, eax
mov ebx, dword [0x54e8f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x409055
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x409053
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x409055
xor edi, edi
cmp byte [esp], 0
je 0x40907b
mov ebx, dword [esi]
test bl, 1
jne 0x409091
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40905b
mov byte [esp + 1], 1
jmp 0x409091
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40907b
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x409008
cmp byte [esp], 0
je 0x4090b1
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret