joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4970b1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.004a00c0
mov dword [esp + 0x28], 0
test esi, esi
jne 0x4970f7
xor eax, eax
jmp 0x4970fa
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.004a06f5
lea eax, [edi + 0x7c]
test eax, eax
je 0x497115
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.004a0a5a
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x497153
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.004a0a5a
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0049fdda
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004a0776
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a00c0
Capabilities:
Encode data using xor

Disassembly:
sub dword [edi - 0x7d9190bb], ebp
sub eax, 0x7adb0772
cmp dh, bh
pop ss
inc dword [0x7d153598]
int1
daa
xor eax, 0x6c53c902
mov edx, 0xdb0785c9
jl 0x4a0072
hlt
test dword [ecx - 0x76], 0xdff8c3f0
xchg ebp, eax
xor byte [edi], ah
sub edx, dword [eax + 0x3b07aa8c]
or byte ds:[esi], 0x55
fist word [ebp - 0x6fd4d8d0]
mov word [edx - 0x7fc1c4f9], gs
push cs
push ebp
shl dword [esi], cl
sar dword [0x80c6dd9c], cl
mov byte [0xbedb261c], al
daa
mov bh, 0xcb
mov al, byte [0x26095887]
loopne 0x4a0038
add dword [edx + 0x26], eax
fdiv qword [esp + ebp*4]
daa
jp 0x4a010e
int 0xc4
invalid
sar al, 0x26
mov cl, 0x43
push es
cwde
cmp byte [eax + 0x11f2c4c3], 0xda
jge 0x4a0085
dec esp
fldcw word [edx]
rcr eax, 0xb7
xchg dword [eax], edx
into
out 0x21, eax
pop ss
daa
mov byte [edx + 0x17a9fc85], dl
cmp al, 0xb9
jne 0x4a007e
imul esi, dword [ebp + 0x42], 0xc
jmp 0x4a0078
test dword [ebx - 0x6c], ebp
lcall 0xdcf, 0xbb922742
imul ecx, dword [ecx], 0x47d930d1
invalid
Function at 0x4a94db
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
xchg edi, eax
push eax
ret 0xfd02
mov edx, 0x65e377a2
push ecx
cmpsd dword [esi], dword es:[edi]
insd dword es:[edi], dx
add ecx, dword [edi]
leave
rcl byte [0x8519696c], cl
cmp bl, byte [esi + 0x693193a]
out dx, al
xor eax, 0x2327cce2
xchg edx, eax
dec edx
stosb byte es:[edi], al
sahf
inc ecx
push ecx
adc edx, dword [edi]
not byte [ebp - 0xdd8b581]
lds eax, [ebx - 0x21]
insd dword es:[edi], dx
xor al, 0x41
and eax, dword [esi + 0x198550fc]
and eax, dword [edx]
scasb al, byte es:[edi]
dec ecx
loop 0x4a9483
jb 0x4a94ac

Function at 0x4e39bd
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x5d8676
push esi
insd dword es:[edi], dx
inc esp
fstp dword [edx + 0x4d]
mov dword [ecx + edi], ecx
adc dword [ecx + 0x50], ecx
cwde
sub al, 0x16
nop
rcr bh, 1
ficomp dword [0xbcc725ce]
jns 0x5d870d
sbb al, 0xd3
cli
mov byte [0x619daf26], al
popfd
popal
movsb byte es:[edi], byte [esi]
dec eax
wait
std
dec ecx
lodsd eax, dword [esi]
inc esi
mov dword [eax - 0xfbf07f4], eax
test cl, bl
push dword [0x9bed7e69]
pop ecx
push es
add esi, ecx
into
or al, 0xf8
inc eax
invalid
sal byte [ebx + 0x872767a], 0x90
or cl, 0x71
push 0x43eabfaa
lahf
jge 0x5d8696
and bh, byte [eax]
inc ecx
fstp xword [ebx - 0x1c17f6e8]
push edi
cmp cl, byte cs:[ebp + 0x46]
push 0x78
mov al, 0xb8
mov ebp, 0x9d7d8144
mov bh, 0xbe
or dword [ebp - 0x39], ecx
inc eax
stosb byte es:[edi], al
sal eax, 0x51
dec esp
mov al, 0x1e
enter 0xd41, 0xffffffffffffffec
in eax, 0xcb
stc
sal dword [0xc44f41c2], cl
mov ah, bl
pop ebx
loope 0x5d86a1
invalid
hlt
Function at 0x4f7ca5
Capabilities:
Encode data using xor

Disassembly:
add al, 0x47
invalid
wait
sbb dword [edi + 0x25], ebp
inc eax
pop ds
jns 0x4f7c71
mov byte [0x539e4bdd], al
aaa
aaa
fldenv [ebp + eax*8 - 0x2f97756]
dec ebp
in eax, dx
mov dh, 4
adc al, 0x71
mov bl, 0xe4
xor dword [0xae62290], 0xcdb2258d
xchg edi, eax
nop
and ah, dh
or cl, byte [ebp - 0x68324ddb]
int 0xb4
fucom st(0)
mov cl, 0xe9
add edi, ecx
mov ecx, 0x15910e03
jecxz 0x4f7cee
adc eax, 0x4ac5567a
cmp eax, 0xbdd0b12b
rcr byte [esi + 0x214a2a95], 0x60
retf 0x4c53
mov ebp, 0x2a959ec0
dec edx
and dword [eax - 0x36], esp
push ebx
dec esp
rol byte [ebp + 0x1d], 1
push 0x22
wait
enter 0x1c80, 0xffffffffffffff97
and ch, 0x6f
jle 0x4f7d43
xchg ecx, eax
jecxz 0x4f7d38
adc bh, byte [ecx + edx*8 - 0x4ab574fb]
mov ecx, dword [edx - 0x4b]
pop esp
insb byte es:[edi], dx
cmpsd dword ds:[esi], dword es:[edi]
lodsd eax, dword [esi]
xor eax, 0xcfa9ed8c
inc esp
xor byte [ecx + esi + 0x70], ch
xchg edx, eax
cmp ch, byte [edx + 0x2d]
or al, 0xec
insb byte es:[edi], dx
jp 0x4f7c7a
or byte [ebx + 0x1d66d38c], ch
je 0x4f7c96
mov edi, 0x43782ce
xchg ebp, eax
push esp
jecxz 0x4f7cbb
and ah, byte [ecx + edx*4]
outsd dx, dword [esi]
loop 0x4f7c9a
sub byte [ecx], 0xe1
in al, dx
mov esi, 0x32802225
loopne 0x4f7cdc
and eax, 0xe0328022
xor ah, al
ret
jns 0x4f7d16
test byte [esi - 0x4fa80ea6], bl
mov dl, 0xfa
imul edi, ebx, 0xffffffcc
pop ss
sbb al, 0x23
cmpsd dword [esi], dword es:[edi]
inc eax
or al, 0x19
mov dword [ecx - 0x16], edx
int 0x20
jno 0x4f7d88
mov bl, 0x16
and dword [edi + edx*2], esp
loope 0x4f7d13
add al, 0xc3
mov bh, 0x1d
pop edx
pop ebx
and dl, 0xed
movsb byte es:[edi], byte [esi]
mov bl, 0x40
add eax, 0x6c372f4c
invalid
inc eax
dec esp
lcall 0x72e2, 0x492992e9
outsd dx, dword [esi]
jmp esi

Function at 0x52e3c8
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x623081
insd dword es:[edi], dx
inc esp
or ebx, dword [ebx]
mov ebp, 0xec70284
daa
or ch, ah
xor esi, dword [edi - 0x2bff49dd]
wait
ja 0x623082
insb byte es:[edi], dx
dec edi
xchg byte [edx], dl
lock xor byte [eax + ebp*4 - 0x73b9762c], dl
retf
Function at 0x53ecee
Capabilities:
Encode data using xor

Disassembly:
inc esi
invalid
dec edi
adc bh, byte [ecx + 0x2b]
pop edx
rcl dword [esi - 0x76]
push esp
outsb dx, byte [esi]
dec ecx
in eax, dx
pop ebp
pop ds
clc
sub dword [ebx + 0x5a6a41db], esp
out dx, eax
jp 0x53ed6d
rep lodsb al, byte [esi]
arpl ax, dx
stosd dword es:[edi], eax
jp 0x53ed4d
in al, dx
sbb dh, ah
salc
push es
and byte [ecx + 9], al
loope 0x53ecf7
pop ecx
mov esi, 0xbb1eab2c
test cl, dl
aas
mov ch, 0x30
adc al, 0xdc
or byte [edx], 0xc5
push ebp
mov cl, 0x69
test dword [eax - 0x68], ebx
pop eax
cwde
jnp 0x53ece9
invalid
or al, 0x63
dec ebp
jg 0x53ed8c
inc dword [esi - 0x25018eac]
dec ebx
mov ch, 0x30
mov dword [0xa5f73843], eax
aas
insd dword es:[edi], dx
inc ecx
jns 0x53eda3
sbb ebp, dword [esi + ebx*4 - 0x10]
sub ebp, esi
jmp 0x53edc3
sub edx, dword [edx + 0x5f510a8e]
jnp 0x53ed2d
mov dh, 0x68
dec ebx
invalid
dec edx
sbb al, 0xbd
xor al, 0xef
dec ebx
add bl, byte [ebx - 0x66]
mov ecx, 0x9b972b99
mov al, byte [0xd5ba00f2]
imul esp, dword [ebx + 0x39], 0x9ed39d2e
outsb dx, byte [esi]
dec edi
aas
les esp, [eax]
invalid
cdq
sub edx, dword [edi + 0xf2a09b]
mov edx, 0x396369d5
popfd
rcr dword [esi - 0x3bc0b092], cl
and byte [edi - 0x659a44d0], cl
outsd dx, dword [esi]
sub ah, byte cs:[eax + ebx*2 - 0x22]
mov ebx, 0x646f9a65
sub ah, byte cs:[eax + ebx*2 - 0x22]
and dword [eax + 0x78], ecx
mov ebx, 0x4d1b5b1f
push 0x3da2208e
lds esi, [ecx - 0x4c82bb6b]
lodsd eax, dword [esi]
wait
pop ebx
shr edi, 0x6b
pop edi
in al, dx
mov ds, word [ecx - 0x70]
jno 0x53ed82
inc ebp
pop esi
cld
mov edi, 0x4fa4ad55
push 0xd96ffd51
or al, 0xae
dec eax
mov byte ds:[0xabcf32f], al
in eax, dx
insb byte es:[edi], dx
fst qword [ebp + 0x38]
salc
sahf
and ah, al
fidivr word [edx + 0x30d4637e]
inc eax
invalid
Function at 0x5537c0
Capabilities:
Encode data using xor

Disassembly:
pop esi
mov ebx, dword [ecx - 0x1e]
iretd
sahf
mov ecx, 0x83071adf
sub edi, dword [edx - 0x78]
fistp dword [esi]
loope 0x5536e0
retf
adc dl, cl
cmpsd dword [esi], dword es:[edi]
ljmp 0xca8
jl 0x5536ec
je 0x553714
invalid
cld
push cs
cmpsd dword [esi], dword es:[edi]
pop edi
fild qword [ebx - 0x67]
mov ds, word [esi - 0x6404b652]
push 0xd9baf619
sbb dword [edi - 0x12], ecx
fistp dword [edi - 0x65]
push ds
imul ebx, edx, 0xb
cmp dword [ebx + 0x10], edx
dec esi
cmp esp, dword [eax - 0x2a65acb3]
insb byte es:[edi], dx
jmp 0x553723
xor ebp, ebp
and byte [edi], ah
mov bl, 0xbb
cmp dword [edi], 0x499847fe
pop dword [edx]
jp 0x553768
sub ecx, dword [edx]
jmp 0x5537fc
leave
loop 0x55383c
lcall 0xf18f, 0x6fbf0f96
movsx ebp, word [edi - 0x71]
int1
mov eax, dword [0xdbce6b81]
dec esi
mov al, byte [0xb9a4d4b]
fisubr dword [esi]
mov esp, 0x5ceb23ae
jg 0x5537f7
wait
xor dword [ecx - 0x4108cd40], edi
push ecx
xchg ebx, eax
mov eax, 0x4bc02e73
mov esp, esi
adc bl, byte [edi + edx*2 - 1]
pop ss
push edi
call dword [edi]
mov ebp, 0x2aa40eb5
sahf
add bl, byte [edi + 0x19]
mov esi, 0x6a7160ed
stosd dword es:[edi], eax
pop ds
cld
mov dword [ebx + 0x45ba883f], esp
ror byte [edi - 3], 1
mov edx, 0xbb3c1260
into
cmp edx, esi
das
loope 0x5537fa
mov byte [edx + 0x6b57cead], bl
scasb al, byte es:[edi]
mov ebx, 0x5752d62b
and byte [eax - 0x75de5412], bh
xor byte [ebx - 0x7d], bh
push 0x71
sbb al, 0xfc
adc ecx, dword [ebx + 0x99ac773]
add bl, dh
inc edi
fsubr st(2)
push edi
std
jg 0x553827
cmp byte [edi - 0x572076c1], 0x1a
jp 0x553888
xchg edx, eax
dec ecx
mov al, byte [0x66c65f6d]
or byte [ebx - 2], bl
mov byte [ebp + 0x1e938f0a], cl
pop ebx
dec esi
stc
push esp
inc ebx
jge 0x5538d2
and eax, 0xdd42f4c
aas
ffree st(6)
out dx, al
stc
fisubr word [ebx + 0x45b9799a]
in eax, dx
dec edx
add al, 0x75
mov edi, 0x183ace35
xchg esp, eax
mov ch, 0x15
sahf
invalid
push ss
stosd dword es:[edi], eax
sbb eax, 0xb4e8b190
adc dword [eax - 0x4f04a147], ebx
push edi
and edx, edx
xchg esi, eax
sub bl, bl
mov edx, 0x7ac55dfe
invalid
Function at 0x5806ce
Capabilities:
Encode data using xor

Disassembly:
clc
mov edx, 0x7ad0ef5
cmp al, 0x73
jle 0x580682
jae 0x5806f0
jle 0x580682
pop edx
shl edx, 1
sar dl, 1
in al, dx
std
wait
mov dl, ah
popal
mov ah, byte [ebp - 0x36b2ca4c]
into
insd dword es:[edi], dx
push ds
jo fcn.005806ce
cmc
push cs
xchg edx, eax
pop edx
and ax, 0xcb86
xor al, 0x47
invalid
sal byte fs:[ebx], cl
mov dh, 0x9a
std
test dword [edi + 0x411a8ba8], ebx
cwde
sub dword [edx + 0xc653860], 0xfffffff5
daa
jo 0x580764
test byte [ecx + edi*2 - 0x3bd1dac4], bl
js 0x5806f2
pushfd
inc ebx
ja 0x580689
ja 0x580689
movsd dword es:[edi], dword [esi]
les edx, [0xad2a03ec]
cwde
fcmove st(0), st(2)
xor eax, 0x2548514f
mov bh, 0x23
fidiv dword [ecx]
jns 0x580730
daa
lodsb al, byte [esi]
aad 0xc2
daa
xchg ebx, eax
iretd
fucomp st(3)
mov ebp, 0x86db7ed5
in al, 0x53
inc al
sti
loope 0x580708
inc esi
sub byte [ebx], bl
xor esi, dword [ebp + 0x2e]
les esi, [ebx - 0xc]
imul ebp, dword [ecx + 0x72572947], 0xd9f88a0a
xor ebp, esi
sbb al, 0x99
invalid
jne 0x5807db
sbb bl, byte [esi + ebp*8]
mov edx, 0x4a734ae6
xchg ecx, eax
fdivr st(5), st(0)
test al, 0x96
dec ebp
jae 0x58076f
or dword [edi], esi
lodsb al, byte fs:[esi]
cmpsb byte [esi], byte es:[edi]
int1
mov ah, 0xde
push ecx
mov word [ebx + 0x29], es
cmc
mov esp, 0xbd151f14
ret 0x40ab
push ecx
in eax, 0xcf
push ebp
xor ecx, dword [ecx + 0x36]
and eax, 0x159ea784
jg 0x580814
xor dword gs:[ecx - 0x5078f6c5], esp
invalid

Function at 0x5836c6
Capabilities:
Encode data using xor

Disassembly:
inc ecx
xchg ebx, eax
pop ds
lea edi, [eax - 0x23926a74]
mov eax, 0xdc6d958c
mov word [ebp - 0x3fca2393], ss
invalid
xor eax, 0xdef1f0c0
mov esp, 0x12fac2ce
sal byte [edx], 0x51
lcall 0xc49f, 0x2e23aeca
out dx, eax
imul edx, esi, 0x13
add edx, dword [edi]
inc edx
invalid
invalid

Function at 0x5c132d
Capabilities:
Access peb ldr_data

Disassembly:
in al, 0
add byte [eax], al
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005ca8ea
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5d1dcb
Capabilities:
Encode data using xor

Disassembly:
cmp byte [eax + 0x3bcb27c3], ah
cmp al, 0xa
sub dword [edx], edi
jg 0x5d1dff
or edx, ebx
in al, 0xc5
les ecx, [ecx]
jp 0x5d1da9
dec esp
pop edx
lodsb al, byte [esi]
invalid
xchg esp, eax
mov word [edx + ebx + 0x30], cs
dec esp
sbb dh, byte [eax]
xor eax, 0x4ebc7c5a
cwde
push ebp
aaa
fmul dword [eax + 0x6a]
out dx, al
or eax, 0x3e7adc09
and ebp, dword [eax]
mov bl, byte [edx]
lcall 0x14a8, 0x394f93b3
push ebx
push ds
jae 0x5d1dfd
adc al, 0x12
xchg byte [eax + 0xf], ah
sahf
cmpsb byte [esi], byte es:[edi]
dec ebx
adc al, 0x90
mov esp, 0x8305286d
inc edx
scasb al, byte es:[edi]
sbb dl, byte [eax - 0x55875e10]
push dword [esi]
fucomi st(1)
jnp 0x5d1e63
jmp 0xed87f2a5
sub al, 0x26
sub eax, dword [esi + 0x1c]
sbb ch, ah
cmp eax, 0x3e11ea15
int3
Function at 0x60c2e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.006152f7
mov dword [esp + 0x28], 0
test esi, esi
jne 0x60c32e
xor eax, eax
jmp 0x60c331
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.0061592c
lea eax, [edi + 0x7c]
test eax, eax
je 0x60c34c
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.00615c91
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x60c38a
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.00615c91
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.00615011
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.006159ad
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x65a2fc
Capabilities:
Read file via mapping

Disassembly:
push edi
push esi
sub esp, 0x14
call sub.KERNEL32.DLL_GetCurrentProcessId
mov ecx, eax
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b96], cl
mov ecx, eax
shr ecx, 4
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b95], cl
mov ecx, eax
shr ecx, 8
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b94], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b93], cl
mov ecx, eax
shr ecx, 0x10
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b92], cl
mov ecx, eax
shr ecx, 0x14
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b91], cl
mov ecx, eax
shr ecx, 0x18
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b90], cl
shr eax, 0x1c
mov al, byte [eax + str.0123456789ABCDEFL]
mov byte [0x665b8f], al
mov dword [esp + 8], str.LocalFastMM_PID________
mov dword [esp + 4], 0
mov dword [esp], 4
call sub.KERNEL32.DLL_OpenFileMappingA
sub esp, 0xc
mov esi, eax
test esi, esi
je 0x65a407
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov edi, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
jmp 0x65a409
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
ret

Function at 0x65a41c
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x18
xor eax, eax
mov ecx, fcn.0065ace6
cmp dword [0x66542c], ecx
jne 0x65a521
mov ecx, fcn.0065b06a
cmp dword [0x665430], ecx
jne 0x65a521
mov ecx, fcn.0065b262
cmp dword [0x665434], ecx
jne 0x65a521
mov ecx, fcn.0065b57c
cmp dword [0x665438], ecx
jne 0x65a521
mov ecx, 0x65961c
cmp dword [0x66543c], ecx
jne 0x65a521
xor eax, eax
mov ecx, 0x65962c
cmp dword [0x665440], ecx
jne 0x65a521
mov ecx, dword [0xa6860c]
test ecx, ecx
jne 0x65a521
call fcn.0065a2fc
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x65a521
mov dword [esp + 0x14], str.LocalFastMM_PID________
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
sub esp, 0x18
mov dword [0xa6860c], eax
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov dword [eax], fcn.0065ace6
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov eax, 1
add esp, 0x18
ret
Function at 0x660d34
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
call sub.KERNEL32.DLL_CreateFileA
sub esp, 0x1c
mov esi, eax
test esi, esi
je 0x660e57
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetLocalTime
sub esp, 4
movzx eax, word [esp + 0x2e]
mov dword [esp + 0x24], eax
movzx ecx, word [esp + 0x32]
movzx edx, word [esp + 0x2c]
movzx ebx, word [esp + 0x34]
movzx ebp, word [esp + 0x36]
movzx edi, word [esp + 0x38]
movzx eax, word [esp + 0x3a]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str._02d__02d__04d__02d:_02d:_02d._03d
mov dword [esp], 0xa6ab8c
call sub.USER32.DLL_wsprintfA
mov dword [esp], 0xa6ab8c
call fcn.0065b9f8
lea ebx, [esp + 0x28]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0xa6ab8c
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov edi, dword [esp + 0x54]
mov dword [esp], edi
call fcn.0065b9f8
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x660e68
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x9c
mov ecx, dword [0xa6abac]
mov eax, dword [0xa6abb0]
mov edi, dword [esp + 0xac]
test eax, eax
jne 0x660f5d
test ecx, ecx
jne 0x660f5d
cmp dword [0x667260], 0
je 0x660f9f
lea esi, [esp + 0x18]
mov dword [esp + 4], esi
mov dword [esp + 8], 0x80
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], 0x5c
call fcn.00660bfc
test eax, eax
jne 0x660eea
mov dword [esp], esi
mov dword [esp + 4], 0x3a
call fcn.00660bfc
test eax, eax
je 0x660eed
inc eax
mov esi, eax
mov dword [esp + 0x98], 0
call sub.KERNEL32.DLL_GetVersion
mov ecx, 0x12010
test eax, eax
jns 0x660f3d
call sub.KERNEL32.DLL_GetCurrentThreadId
lea ecx, [esp + 0x98]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], 0x661068
call sub.USER32.DLL_EnumThreadWindows
sub esp, 0xc
mov ecx, 0x12010
cmp dword [esp + 0x98], 0
jne 0x660f3d
mov ecx, 0x11010
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.USER32.DLL_MessageBoxA
sub esp, 0x10
jmp 0x661029
test ecx, ecx
je 0x660f74
cmp ecx, 0xffffffff
je 0x661029
mov dword [esp], edi
call ecx
mov eax, dword [0xa6abb0]
test eax, eax
je 0x661029
cmp eax, 0xffffffff
je 0x661029
cmp byte [eax], 0
je 0x661029
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00660d34
jmp 0x661029
mov dword [esp], 0xfffffff4
call sub.KERNEL32.DLL_GetStdHandle
sub esp, 4
mov esi, eax
lea ebx, [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x6670b0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp], edi
call fcn.0065b9f8
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x6670b0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
add esp, 0x9c
pop esi
pop edi
pop ebx
ret
Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
invalid