joyce8/EMBER2024-capa huggingface dataset:
Function at 0x661660
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push edi
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 0
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x124]
rep stosd dword es:[edi], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffff
jne 0x6616b3
xor eax, eax
jmp 0x661732
mov dword [ebp - 0x128], 0x128
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x6616e5
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x661732
mov eax, dword [ebp - 0x120]
push eax
call fcn.00661737
add esp, 4
test eax, eax
je 0x66170c
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x661732
lea edx, [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x130]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x6616e5
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x661f12
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x18], 0
jne 0x661f46
mov ecx, dword [ebp - 0x18]
call fcn.00662702
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
je 0x661f3c
xor eax, eax
jmp 0x661fe1
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x18], 1
mov edx, dword [ebp + 0xc]
shl edx, 0xb
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
imul edx, edx, 0x30
mov eax, dword [ecx + edx + 0x1c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x661f73
xor eax, eax
jmp 0x661fe1
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 8]
jbe 0x661faa
push 0
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
push 1
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x661fbc
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x661fdc
xor eax, eax
jmp 0x661fe1
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x663420
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push edi
mov dword [ebp - 0x220], ecx
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x208], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x210], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], 0
jmp 0x663493
mov eax, dword [ebp - 0x20c]
add eax, 1
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x1a
jae 0x66358d
mov edx, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x20c]
shr edx, cl
and edx, 1
test edx, edx
jne 0x6634b7
jmp 0x663484
mov eax, dword [ebp - 0x20c]
add eax, 0x41
movsx ecx, al
push ecx
push 0x6e2fcc
lea edx, [ebp - 0x104]
push edx
call fcn.00642944
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
je 0x6634ec
jmp 0x663484
push 0x104
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x66350e
jmp 0x663484
push 0x5c
lea eax, [ebp - 0x208]
push eax
call fcn.00642e90
add esp, 8
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x208]
sub ecx, edx
add ecx, 1
mov dword [ebp - 0x21c], ecx
lea eax, [ebp - 0x208]
push eax
call fcn.00642f60
add esp, 4
sub eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x21c]
lea edx, [ebp + ecx - 0x208]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0064b210
add esp, 0xc
test eax, eax
jne 0x663572
jmp 0x66358d
mov byte [ebp - 0x104], 0x30
mov ecx, dword [ebp - 0x210]
add ecx, 1
mov dword [ebp - 0x210], ecx
jmp 0x663484
mov al, byte [ebp - 0x104]
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x6699a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
push edi
je 0x669a0e
push ebx
call fcn.0066996d
test eax, eax
pop ecx
jne 0x6699df
call fcn.006463c3
mov dword [eax], 0xf
call fcn.006463ba
mov dword [eax], 0xd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
and byte [ebp + 0xb], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
mov esi, 0x104
push esi
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x669a21
lea eax, [ebp - 0x108]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x6699d8
inc eax
cmp eax, esi
ja 0x6699d8
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x669a53
cmp eax, dword [ebp + 0x10]
jg 0x669a39
mov eax, dword [ebp + 0x10]
push eax
call fcn.006436c9
mov edi, eax
test edi, edi
pop ecx
jne 0x669a68
call fcn.006463ba
mov dword [eax], 0xc
jmp 0x6699d8
cmp eax, dword [ebp + 0x10]
jle 0x669a68
call fcn.006463ba
mov dword [eax], 0x22
jmp 0x6699d8
mov esi, edi
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x108]
sub esi, eax
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x669a78
mov eax, edi
jmp 0x6699da

Function at 0x67fed0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x67ff08
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0067d2b6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0067d28e
jmp 0x67ff14
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4060b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021ba
and dword [ebp - 4], 0
cmp dword [0x40b654], 0
mov ebx, eax
jne 0x406167
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406218
push eax
call fcn.00402148
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b654], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b658], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b65c], eax
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b664], eax
test eax, eax
je 0x406167
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b660], eax
mov eax, dword [0x40b660]
cmp eax, ebx
je 0x4061bf
cmp dword [0x40b664], ebx
je 0x4061bf
push eax
call fcn.004021c3
push dword [0x40b664]
mov esi, eax
call fcn.004021c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bf
test edi, edi
je 0x4061bf
call esi
test eax, eax
je 0x4061b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b6
test byte [ebp - 0xc], 1
jne 0x4061bf
or dword [ebp + 0x10], 0x200000
jmp 0x4061f8
mov eax, dword [0x40b658]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f8
mov eax, dword [0x40b65c]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b654]
call fcn.004021c3
pop ecx
test eax, eax
je 0x406218
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40621a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6d8481
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
jmp 0x6d84a6
xor edx, esi
not bp
lea ebp, [ecx + esi]
mov esi, 0x2bc297a9
jmp 0x6d84e1
mov dword [ecx], edx
mov bx, word [esp]
mov edi, ecx
mov bp, si
movzx edx, byte [eax + 4]
jmp 0x70ae2c
adc bl, dh
mov bl, ch
jmp 0x70ae5a
movzx esi, byte [edi]
pop edi
mov di, dx
mov bx, word [esp]
jmp 0x70ae62
push edi
mov edi, eax
add edi, 5
jmp 0x70ae44
shl edx, 8
lea ebp, [edx*4]
xor edx, esi
bsf ebx, edx
jmp 0x70ae77
movzx esi, byte [eax + 6]
adc bx, 0xd2a6
lea ebp, [esp + 0x5b03]
jmp 0x70aeac
xchg si, bx
push esi
jmp 0x70aeb9
shl edx, 8
mov bp, word [esp]
mov bl, ah
xor edx, esi
jmp 0x70ae96
movzx esi, byte [eax + 7]
sub esp, 0xb
pop word [esp + 1]
lea esp, [esp + 1]
jmp 0x70af4d
xor edx, esi
jmp 0x70af21
movzx edx, byte [eax + 8]
movzx esi, byte [eax + 9]
shl edx, 8
jmp 0x70aee3
mov eax, ecx
lea eax, [eax + 4]
mov dword [eax], edx
pop eax
jmp 0x70aef9
movzx esi, byte [eax + 0xa]
shl edx, 8
xor edx, esi
jmp 0x70af30
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
jmp 0x70b00f
shl edx, 8
xor edx, esi
push eax
jmp 0x70af17
pushal
bswap esi
seto ch
mov dword [esp + 0x1c], edx
push ecx
jmp 0x70af75
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
jmp 0x70af55
lea esp, [esp + 4]
popal
jmp 0x70af97
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
jmp 0x70af6b
shr eax, 0x10
mov esi, 0xff
and eax, esi
jmp 0x70afa7
mov eax, dword [eax*4 + 0x6e3638]
jmp 0x70afe4
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
jmp 0x70af8c
lea esp, [esp + 0x40]
xor eax, 0x1000000
call fcn.0070afce
mov edi, edx
xchg bp, bx
mov bl, dl
adc bx, 0x5e78
clc
jmp 0x70b01c
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
movzx esi, byte [eax + 0xd]
jmp 0x70afc3
shr edi, 8
mov bh, 0xf9
and edi, esi
jmp 0x70b129
lea ebx, [ebx*4]
lea ebx, [ebx + 0x6e3638]
mov edi, dword [ebx]
pop ebx
lea esp, [esp + 4]
jmp 0x70b04e
push ebx
pushal
mov dword [esp + 0x10], edi
popal
jmp 0x70b064
Function at 0x6e5c10
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], sp
push dword [esp]
jno 0x6e5c45
jo 0x6e5c2f
push 0xf06d7600
jmp 0x6e5d5a
mov dword [esp + 8], esp
mov ebx, 0x5adf9ed7
jmp 0x6e5d63
setb ah
mov cl, 0x4c
rdtsc
jmp 0x6e5d44
mov ebp, dword [esp + 0x2c]
not eax
mov esi, edi
neg dh
jmp 0x6e5dad
xchg bh, al
lea esi, [esp]
rdtsc
jmp 0x6e5d97
inc edx
jno 0x6e5db3
mov dl, byte [esp]
jmp 0x6e5db6
jge 0x6e5d73
xchg bh, al
jmp 0x6e5d75
mov dl, byte [esp]
sub esp, 0xc0
jmp 0x6e5dea

Function at 0x6e5e61
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.006e5c10
mov dword [esp + 8], esp
jmp 0x6e5c49
call fcn.006e5c4f
push 0x2434ff66
push word [esp]
and al, 2
push dword [esp + 1]
mov dword [esp + 4], ebx
jmp 0x6e5c2a
call fcn.006e5ecb
in eax, 0x6e
cld
wait
jbe 0x6e5e21
cmc
adc dword [ebx], 0x76
test dword [eax], esi
invalid

Function at 0x6e7ccf
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
xor esi, 0x6782175d
xor eax, 0x18d9b813
jmp 0x6e7d6b
mov dx, ax
xchg ecx, eax
xchg dx, ax
neg ah
jmp 0x6e7d0f
xchg dx, ax
jb 0x6e7cea
mov dx, ax
xchg ecx, eax
jmp 0x6e7d28

Function at 0x6f722e
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg cx
jg 0x6f7260
jle 0x6f724a
salc
push edi
invalid
mov byte [esp + 1], ah

Function at 0x6f7992
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 2]
jb 0x6f79b2
inc eax
xchg dl, ah
btr dx, bx
jmp 0x6f79d5
lea esp, [esp + 2]
jmp 0x6f79b8
Function at 0x704273
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0xa19bb063
dec dh
jle 0x7017c4
sub esp, 0xb
mov ch, 0x1f
lea esp, [esp + 3]
jmp 0x701784
lea eax, [ebp + 0x50]
push eax
lea ecx, [eax + eax]
dec edx
jl 0x7017a5
jge 0x7017a5
ja 0x701786
or al, 0xff
cmp dword [edi + edx*4 - 2], esp
leave
push 0xb50bec83
pop ds
sub esp, 0xb
mov ch, 0x1f
lea esp, [esp + 3]
jmp 0x701784
call fcn.0070180e
cmp edi, eax
ja 0x6e7e5c
rdtsc
call fcn.007017de
mov byte [edi], cl
lahf
cli
or ebx, edx
and bl, byte [ebp - 0x54]
mov edi, 0xbad4eb86
inc esi
enter 0xffffffffffffcce5, 0xffffffffffffffeb
inc ebx
xor eax, 0xb34021b1
jo 0x701809
jmp 0x70179a
mov dl, 0x20
inc edi
mov dl, 6
xor ebp, dword [edx]
inc ebp
hlt
sbb al, 0x99
clc
invalid
bswap ecx
pushal
mov word [esp + 0x1c], dx
mov byte [esp + 0x14], al
jmp 0x7041c6
jmp 0x704198
sub esp, 0
jmp 0x70456b
lea edx, [ebp + 0x50]
and cx, 0x42e1
jns 0x7041b0
sub esp, 0
jmp 0x70456b
mov cl, byte [esp]
lea esp, [esp + 1]
mov dword [esp + 0x14], ebp
mov al, byte [esp]
jmp 0x704219
pushal
sub esp, 1
jbe 0x7041f8
mov cl, byte [esp]
jmp 0x704233
sete ch
mov cx, word [esp]
popal
xchg ecx, eax
mov ax, cx
jmp 0x704309
lea esp, [esp + 1]
mov dword [esp + 0x14], ebp
mov al, byte [esp]
sete ch
jmp 0x70421c
jbe 0x704368
lea edx, [edx*4]
mov cx, word [esp]
jmp 0x704373
js 0x70428a
dec ax
call 0x704273
test byte [esi - 0x73], dl
add al, 0x2b
jmp 0x7042cf
dec ax
jmp 0x7042e7
mov ah, al
xchg byte [esp + 2], ah
xchg dword [esp + 4], ecx
call fcn.007042b8
xchg dword [esp + 0xc], ecx
call fcn.00704332
sub ecx, edx
bsf ax, si
jmp 0x70431c
btr ax, dx
mov eax, dword [esp]
shl ah, 3
jmp 0x7043e6
mov cx, 0xe07c
lea ecx, [ebp + 0x40]
setne al
mov al, byte [esp]
inc eax
jmp 0x704269
jle 0x7042f3
btr ax, dx
mov eax, dword [esp]
jmp 0x704347
shl ah, 3
jmp 0x7043e6
lea edx, [edx*4]
mov cx, word [esp]
jmp 0x70420e
lea eax, [edi - 0x80]
and al, 0xfc
call fcn.0070434f
mov ax, word [esp]
mov eax, 0x65bed09
jmp 0x70440d
setae ah
mov eax, dword [edi]
mov dx, bx
inc dx
jmp 0x704450
mov edx, 0x7cd1ebb2
inc dl
jmp 0x70443a
mov cl, byte [edi + 4]
shl dh, 5
jle 0x704471
mov dh, 0x94
jmp 0x704475
jg 0x70441d
mov edx, 0x7cd1ebb2
inc dl
jmp 0x70443a
lea edx, [ebp*4]
add edx, edi
jmp 0x7044b5
mov dh, 0x94
jmp 0x70445b
lea edx, [ebp*4]
add edx, edi
jmp 0x7044b5
sub edi, 2
call 0x704480
mov dh, 0x94
jmp 0x7044f9
pushfd
pop dword [edi]
rdtsc
bswap eax
jmp 0x704506
setnp ch
mov ah, byte [esp]
jmp 0x70175e
cmp edi, edx
ja fcn.006e86c3
rdtsc
bsr ax, si
jmp 0x704253

Function at 0x7042b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, 0x1a
push bx
sub eax, ecx
mov eax, 0xa3148018
push eax
lea esp, [esp + 2]
jmp 0x7042de
mov al, bh
rcl al, 5
lea ecx, [ecx + 0x1a]
jmp 0x7042a2

Function at 0x70b07a
Capabilities:
Encrypt data using aes

Disassembly:
neg bp
jmp 0x70b0ad
pushal
neg esi
mov di, 0xd013
lea ecx, [ebx + esi]
dec cx
jmp 0x70b097

Function at 0x70b1df
Capabilities:
Encrypt data using aes

Disassembly:
bsr ebx, edi
xchg ebx, ecx
jmp 0x70b1f7
jmp 0x70b1c9
mov ebx, 0x6e4e3c
lea esp, [esp + 8]
jmp 0x6d83bd
Function at 0x70b2c2
Capabilities:
Encrypt data using aes

Disassembly:
clc
add esp, 3
lea esp, [esp + 1]
jmp 0x70b327
mov edi, dword [esp]
push di
lea esp, [esp + 2]
jmp 0x70b34d
movzx edi, byte [edi*4 + 0x6e3638]
push sp
lea esp, [esp + 2]
xor ecx, edi
jmp 0x70b2ea
mov edx, dword [edx*4 + 0x6e3638]
stc
shr edi, 0x18
clc
jmp 0x70b300
or edx, esi
xor ecx, dword [ebx]
jmp 0x70b358
and edx, ebp
xor ecx, edx
and edi, edi
mov edi, dword [esp]
jmp 0x70b335
lea edi, [eax + 0x10]
mov dh, 0xf6
inc dh
xor ecx, dword [eax]
jmp 0x70b39d
mov dword [edi], ecx
jmp 0x70b387
push ebx
jmp 0x70b3c3
mov edx, 0x249d57e8
add ebx, 4
push ax
lea esp, [esp + 2]
jmp 0x70b363
xor edx, ecx
mov ecx, dword [esp]
jmp 0x70b3cd
mov ebx, eax
add ebx, 4
mov edx, dword [ebx]
pop ebx
jmp 0x70b3ad
mov dword [eax + 0x14], edx
lea ecx, [eax*4]
mov ecx, dword [eax + 8]
stc
jmp 0x70b4df

Function at 0x70b469
Capabilities:
Encrypt data using aes

Disassembly:
sbb eax, esi
jmp 0x70b1e1
mov eax, edi
jmp 0x70b2dc
mov edx, dword [eax + 0xc]
mov cl, 0x8c
mov ch, 0x42
mov ecx, edx
jmp fcn.0070b257
lea esp, [esp + 4]
jne 0x6d83bd
bswap ebp
mov bh, byte [esp]
jmp 0x70b49b
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x70b453
pop eax
lea edi, [eax*4]
pushal
push dword [esp + 0x12]
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0x70b4bd
push 0xa
mov bh, byte [esp]
lea edi, [edx + ebp]
mov ah, 0x6f
jmp 0x70b474
mov esi, dword [esp]
jmp 0x70b526
lea esp, [esp + 0x20]
pop edi
mov bp, word [esp]
mov bh, byte [esp]
mov ebx, 0x97ec21d0
jmp 0x70b4a7
mov ebp, dword [esp + 4]
not bx
lea esp, [esp + 8]
pop ebx
ret

Function at 0x70b5b4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
mov ax, word [esp + 0x1a]
lea eax, [esi*4]
jmp 0x70b5d7
pop word [esp]
lea esp, [esp + 2]
mov dword [ecx - 8], eax
jmp 0x70b59e
mov eax, dword [edx - 4]
call fcn.0070b5c1
mov dword [edx - 8], edi
cmc
bsf edi, edi
neg di
jmp 0x70b61a
push ebx
mov ebx, ecx
add ebx, 0xfffffffc
jmp 0x70b604
Function at 0x70bb3e
Capabilities:
Encrypt data using aes

Disassembly:
add ecx, 0xd
movzx ebx, byte [ecx]
pop ecx
jmp 0x70bb45
lea esp, [esp + 4]
popal
jmp 0x70bb28
and edx, ecx
pushal
jmp 0x70bb95
lea esi, [esi + 0x6e3638]
mov edx, dword [esi]
pop esi
and edx, ecx
jmp 0x70bbb7
pushfd
mov edx, dword [esi + 0xc]
push ebp
push esi
mov esi, edx
lea esi, [esi*4]
jmp 0x70bb6c
lea esp, [esp + 0x20]
xor edi, dword [edx*4 + 0x6e4638]
mov dx, 0x74eb
rol edx, 0x16
jmp 0x70bb79

Function at 0x70d822
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], ecx
pop word [esp]
lea esp, [esp + 2]
jbe 0x6d9017
ja 0x6d902d

Function at 0x710c40
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 2]
xchg edx, ecx
stc
jns 0x710cba
js 0x710c80
inc eax
fisttp qword [ebp + 0x14]
out 0x54, eax
lodsb al, byte [esi]
jmp 0x710c2a
inc cx
mov edx, 0xdfda9206
adc dx, bp
call fcn.00710c9c
mov eax, dword [0x45b6d343]
xchg dword [esi + 0x648de8eb], eax
and al, 0xc
jmp 0x710c42
lea esp, [esp + 0xc]
add ax, 0xaf37
bswap ecx
jmp 0x710c6a
lea edx, [eax + eax]
bswap edx
sub esp, 8
jge 0x710d29
jl 0x710da2
inc ebp
hlt
lea esp, [esp + 3]
jmp 0x710cbe
lea esp, [esp + 3]
ror ax, 0
setns dh
bsf dx, si
ja 0x710c58
inc cx
mov edx, 0xdfda9206
adc dx, bp
jmp 0x710c5a
mov dh, byte [esp + 6]
jmp 0x710d76
neg edx
stc
call 0x710df1
push esp
pop es
mov eax, dword [0x9ca8bdce]
mov dh, 0x46
das
adc al, 0x87
cmp dword cs:[esi - 0x3f], esp
enter 0x6600, 0xffffffffffffff8b
rol ecx, 1
ficom dword [esp + esi*2]
fidiv word [ebp + 8]
ror ax, 0
mov dx, cx
rcr edx, 0x14
je 0x710d60
jne 0x710d8c
cmp byte [edx + 0x1d9a6f08], bl
jnp 0x710dde
neg edx
stc
jmp 0x710d63
mov dh, byte [esp + 6]
jmp 0x710d76
dec ecx
jmp 0x710dd0
not ax
setg dl
sub esp, 0x10
jg 0x710da8
dec ecx
jmp 0x710e12
lea ecx, [ecx + edx]
cwde
bt edx, edi
jl 0x710dfc
jge 0x710e96
add byte [ecx], cl
stc
or ecx, edi
and dword [ebx + 0x57], ebp
sub ebx, dword [edx + edi*8 + 0x10]
cmp eax, 0x21c94b78
or dword [eax - 0x74999d35], ebp
push esp
and al, 3
lea esp, [esp + 0xc]
jmp 0x710dbe
sub esp, 0
mov edx, 0x6309c7b0
mov dl, ah
jmp 0x710e5f
lea ecx, [ecx + edx]
jmp 0x710dd3
mov dword [edi], eax
sub esp, 0
mov edx, 0x6309c7b0
mov dl, ah
jmp 0x710e5f

Function at 0x7cf3f5
Capabilities:
Parse pe header

Disassembly:
push dword [esp]
call fcn.007cf68a
mov dword [esp + 4], esi
push edi
mov dword [esp + 4], edi
lea esp, [esp + 4]

Function at 0x7cf68a
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push word [esp + 5]
lea esp, [esp + 2]
mov dword [esp + 8], ebp
jmp 0x7cf3fd
Function at 0x10001000
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, eax
mov al, 0x6c
mov dl, 0x65
mov byte [esp + 0xc], al
mov byte [esp + 0xd], al
mov byte [esp + 0xf], al
mov cl, 0x74
mov al, 0x73
push 0x10003118
mov byte [esp + 0xc], 0x47
mov byte [esp + 0xd], dl
mov byte [esp + 0xe], cl
mov byte [esp + 0xf], 0x44
mov byte [esp + 0x12], 0x43
mov byte [esp + 0x14], 0x61
mov byte [esp + 0x15], al
mov byte [esp + 0x16], al
mov byte [esp + 0x17], 0x4f
mov byte [esp + 0x18], 0x62
mov byte [esp + 0x19], 0x6a
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], 0x63
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], 0
call edi
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000108a
call eax
push 0x10003118
call edi
pop edi
pop esi
add esp, 0x14
ret