joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4309fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
movzx ecx, byte [eax + 0x457048]
mov byte [ecx + 0x45cef8], al
inc eax
cmp eax, 0x100
jb 0x430a02
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov esi, 0xff
movzx ebx, byte [edi + 0x457048]
mov eax, ebx
and al, 0x80
neg al
lea ecx, [ebx + ebx]
sbb eax, eax
and eax, 0x1b
xor eax, ecx
and eax, esi
mov ecx, eax
mov edx, ecx
xor edx, ebx
mov dword [ebp - 8], edx
shl edx, 8
or edx, ebx
shl edx, 8
or edx, ebx
shl edx, 8
or edx, ecx
mov eax, edi
shl eax, 2
mov dword [eax + 0x45aef8], edx
mov edx, ebx
shl edx, 8
mov edi, edx
or edi, ebx
or edx, ecx
shl edi, 8
or edi, ecx
shl edx, 8
or edx, dword [ebp - 8]
shl edi, 8
or edi, dword [ebp - 8]
shl ecx, 8
or ecx, dword [ebp - 8]
shl edx, 8
shl ecx, 8
mov dword [eax + 0x45b2f8], edi
mov edi, dword [ebp - 0x10]
movzx ebx, byte [edi + 0x457048]
or edx, ebx
or ecx, ebx
mov dword [eax + 0x45b6f8], edx
shl ecx, 8
or ecx, ebx
mov dword [eax + 0x45baf8], ecx
movzx ecx, byte [edi + 0x45cef8]
mov edx, ecx
and dl, 0x80
neg dl
lea ebx, [ecx + ecx]
mov dword [ebp - 0x18], ecx
sbb edx, edx
and edx, 0x1b
xor edx, ebx
and edx, esi
mov ebx, edx
and bl, 0x80
neg bl
mov dword [ebp - 0x10], edx
sbb ebx, ebx
and ebx, 0x1b
add edx, edx
xor ebx, edx
and ebx, esi
mov edx, ebx
and bl, 0x80
neg bl
mov dword [ebp - 0x14], edx
sbb ebx, ebx
add edx, edx
and ebx, 0x1b
xor ebx, edx
and ebx, esi
mov edx, ebx
xor edx, ecx
mov dword [ebp - 8], edx
mov edx, ebx
xor edx, dword [ebp - 0x10]
xor edx, ecx
mov dword [ebp - 0xc], edx
shl edx, 8
mov ecx, ebx
xor ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
xor ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
or edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0x10]
shl edx, 8
or edx, dword [ebp - 8]
shl edx, 8
or edx, ecx
mov dword [eax + 0x45bef8], edx
mov edx, dword [ebp - 4]
shl edx, 8
or edx, dword [ebp - 8]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, dword [ebp - 0xc]
mov dword [eax + 0x45c2f8], edx
mov edx, dword [ebp - 8]
shl edx, 8
or edx, ecx
shl ecx, 8
or ecx, dword [ebp - 0xc]
shl edx, 8
or edx, dword [ebp - 0xc]
shl ecx, 8
or ecx, dword [ebp - 4]
shl edx, 8
or edx, dword [ebp - 4]
shl ecx, 8
or ecx, dword [ebp - 8]
inc edi
cmp edi, 0x100
mov dword [eax + 0x45c6f8], edx
mov dword [eax + 0x45caf8], ecx
mov dword [ebp - 0x10], edi
jb 0x430a24
mov dword [0x45e304], 0x43096f
mov dword [0x45e30c], 0x4309c8
mov dword [0x45e308], 0x430a4b
call fcn.00411129
test eax, eax
pop edi
pop esi
pop ebx
je 0x430bd4
mov dword [0x45e304], 0x4316f2
mov dword [0x45e30c], 0x4316f7
mov dword [0x45e308], 0x4316fc
leave
ret
Function at 0x402230
Capabilities:
Create thread

Disassembly:
sub esp, 0x424
mov eax, dword [str.Init__]
mov ecx, dword [0x40f080]
mov dword [esp], eax
mov ax, word [0x40f088]
push esi
push edi
mov dword [esp + 0xc], ecx
mov word [esp + 0x14], ax
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x1c]
mov edx, dword [0x40f084]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x224]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x430]
mov dword [esp + 0x10], edx
push ecx
call fcn.00402f20
mov esi, eax
add esp, 4
test esi, esi
jne 0x4022e3
push 0x40f068
lea edx, [esp + 0x20]
push 0x103
push edx
call fcn.004051ce
mov edx, dword [0x4138a0]
add esp, 0xc
lea eax, [esp + 0x1c]
lea ecx, [esp + 8]
push eax
mov eax, dword [0x40c2d0]
push 0x259
push ecx
push edx
push eax
push 0x40ef78
push 3
push 0x412858
call fcn.00404600
add esp, 0x20
xor eax, eax
pop edi
pop esi
add esp, 0x424
ret
lea ecx, [esp + 0x18]
push ecx
push 0
push esi
push 0x4036d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x402379
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
lea edx, [esp + 0x228]
push 0x104
push edx
call fcn.00403ba0
add esp, 0xc
push eax
call edi
push eax
push 0x40f034
lea eax, [esp + 0x28]
push 0x103
push eax
call fcn.004051ce
mov eax, dword [0x4138a0]
add esp, 0x14
lea ecx, [esp + 0x1c]
lea edx, [esp + 8]
push ecx
mov ecx, dword [0x40c2d0]
push 0x262
push edx
push eax
push ecx
push 0x40ef78
push 3
push 0x412858
call fcn.00404600
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x424
ret
pop edi
mov eax, 1
pop esi
add esp, 0x424
ret
Function at 0x403c50
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [str.SOFTWAREBaosightlsagentgeneral]
sub esp, 0x18
lea eax, [esp + 8]
push eax
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x403d9d
lea edx, [esp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
push edx
mov edx, dword [str.logfiletype]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x20], 1
call esi
test eax, eax
je 0x403cba
mov ecx, dword [0x40c2e8]
push 4
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.00405174
add esp, 0xc
lea eax, [esp + 0x14]
mov ecx, 0x412858
push eax
call fcn.00404a90
lea ecx, [esp + 0x10]
lea edx, [esp + 4]
push ecx
mov ecx, dword [str.loglevel]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 0x14]
push eax
push 0
push ecx
push edx
mov dword [esp + 0x20], 4
call esi
test eax, eax
je 0x403cfc
mov dword [esp + 4], 6
mov eax, dword [esp + 4]
mov ecx, 0x412858
push eax
call fcn.004048e0
lea ecx, [esp + 0x10]
lea edx, [esp + 4]
push ecx
mov ecx, dword [str.backupcount]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 0x14]
push eax
push 0
push ecx
push edx
mov dword [esp + 0x20], 4
call esi
test eax, eax
je 0x403d3e
mov dword [esp + 4], 7
mov eax, dword [esp + 4]
mov ecx, 0x412858
push eax
call fcn.00404960
lea ecx, [esp + 0x10]
lea edx, [esp + 4]
push ecx
mov ecx, dword [str.encryptcode]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 0x14]
push eax
push 0
push ecx
push edx
mov dword [esp + 0x20], 4
call esi
test eax, eax
pop esi
je 0x403d81
mov dword [esp], 0
mov eax, dword [esp]
mov ecx, 0x412858
push eax
call fcn.004049f0
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403dd2
mov edx, dword [0x40c2e8]
mov ecx, 0x412858
push edx
call fcn.00404a90
push 6
mov ecx, 0x412858
call fcn.004048e0
push 7
mov ecx, 0x412858
call fcn.00404960
push 0
mov ecx, 0x412858
call fcn.004049f0
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x40c208]
push eax
push ecx
mov ecx, 0x412858
call fcn.00403f40
add esp, 0x18
ret
Function at 0x404560
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c368
push 0x4056a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [esi + 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x804]
cmp eax, ebx
je 0x4045c3
cmp eax, 0xffffffff
je 0x4045c3
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [esi + 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x804], ebx
mov byte [esi + 0x808], bl
mov dword [ebp - 4], 0xffffffff
call fcn.004045e9
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49ca74
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [reloc.iphlpapi.dll_GetAdaptersInfo], 0
je 0x49cb13
mov dword [reloc.iphlpapi.dll_GetAdaptersInfo], 0
rdtsc
rol eax, 3
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
rol edx, 0x11
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], edx
lea eax, [ebp - 8]
push eax
call fcn.0049cf88
mov eax, dword [ebp - 8]
rol eax, 5
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
mov eax, dword [ebp - 4]
rol eax, 0xf
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
mov eax, dword fs:[0x20]
rol eax, 9
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
mov eax, dword fs:[0x24]
rol eax, 0xb
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
call fcn.0049cf8e
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
jmp 0x49caf4
rdtsc
rol eax, 9
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
rol eax, 0x17
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], edx
movzx ecx, word [0x10033000]
test ecx, ecx
je 0x49caf4
mov esp, ebp
pop ebp
ret
Function at 0x4b62b4
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 0xc], 0
test edx, edx
jle 0x4b6401
mov edi, dword [ebp + edx*4 - reloc.iphlpapi.dll_GetAdaptersInfo]
lea esi, [edi + ecx]
lea ebx, [ecx*4]
add ecx, ecx
add ecx, edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edi
lea esi, [edi*4]
jmp 0x4b62f4
movss xmm3, dword [esi + eax]
movss xmm1, dword [esi + eax + 4]
mov ecx, dword [ebp + ecx*4 - reloc.iphlpapi.dll_GetAdaptersInfo]
mov edi, dword [ebp - 4]
add edx, edx
add ecx, edx
movss xmm2, dword [eax + ecx*4 + 4]
fld dword [eax + ecx*4]
fstp dword [esi + eax]
add edi, edi
xorps xmm2, xmm0
movss dword [esi + eax + 4], xmm2
movss dword [eax + ecx*4], xmm3
xorps xmm1, xmm0
movss dword [eax + ecx*4 + 4], xmm1
add edi, edi
add ecx, edi
movss xmm2, dword [eax + ecx*4 + 4]
fld dword [eax + ecx*4]
mov edi, dword [ebp - 4]
lea edx, [ebx + esi]
movss xmm3, dword [edx + eax]
fstp dword [edx + eax]
movss xmm1, dword [edx + eax + 4]
xorps xmm2, xmm0
movss dword [edx + eax + 4], xmm2
movss dword [eax + ecx*4], xmm3
add edx, ebx
xorps xmm1, xmm0
movss dword [eax + ecx*4 + 4], xmm1
movss xmm3, dword [edx + eax]
movss xmm1, dword [edx + eax + 4]
add edi, edi
sub ecx, edi
movss xmm2, dword [eax + ecx*4 + 4]
fld dword [eax + ecx*4]
fstp dword [edx + eax]
xorps xmm2, xmm0
movss dword [edx + eax + 4], xmm2
movss dword [eax + ecx*4], xmm3
add edx, ebx
add edi, edi
xorps xmm1, xmm0
movss dword [eax + ecx*4 + 4], xmm1
movss xmm1, dword [edx + eax + 4]
movss xmm3, dword [edx + eax]
add ecx, edi
fld dword [eax + ecx*4]
movss xmm2, dword [eax + ecx*4 + 4]
lea edi, [edx + eax + 4]
fstp dword [edx + eax]
mov dword [ebp - 0x14], edi
mov edx, edi
lea edi, [eax + ecx*4 + 4]
xorps xmm2, xmm0
movss dword [edx], xmm2
mov edx, 2
add dword [ebp - 0x1c], edx
add dword [ebp - 8], edx
add dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x20]
movss dword [eax + ecx*4], xmm3
mov ecx, dword [ebp - 0xc]
inc ecx
add esi, 8
cmp ecx, edx
xorps xmm1, xmm0
movss dword [edi], xmm1
mov dword [ebp - 0xc], ecx
jl 0x4b62f4
mov edi, dword [ebp - 4]
mov ecx, dword [ebp + edx*4 - reloc.iphlpapi.dll_GetAdaptersInfo]
lea esi, [ecx + edx*2]
movss xmm1, dword [eax + esi*4 + 4]
xorps xmm1, xmm0
movss dword [eax + esi*4 + 4], xmm1
lea ecx, [edi + edi]
lea ebx, [esi + ecx]
movss xmm3, dword [eax + ebx*4]
cwde
movss xmm1, dword [eax + ebx*4 + 4]
lea esi, [ebx + ecx]
movss xmm2, dword [eax + esi*4 + 4]
fld dword [eax + esi*4]
mov dword [ebp - 0x14], ebx
lea ebx, [eax + ebx*4 + 4]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x14]
fstp dword [eax + ebx*4]
mov ebx, dword [ebp - 0x18]
xorps xmm1, xmm0
xorps xmm2, xmm0
movss dword [ebx], xmm2
movss dword [eax + esi*4 + 4], xmm1
movss dword [eax + esi*4], xmm3
add esi, ecx
movss xmm1, dword [eax + esi*4 + 4]
inc edx
cmp edx, edi
xorps xmm1, xmm0
movss dword [eax + esi*4 + 4], xmm1
mov dword [ebp - 0x20], edx
jl fcn.004b62b4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cfff7
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[ecx + 0x6e], cl
je 0x4d0065
jb 0x4d0070
je 0x4d0058
je 0x4d004b
outsd dx, dword [esi]
outsd dx, dword [esi]
imul ebp, dword [ecx + 0x65], 0x41
add byte [ecx], al
add byte [eax], al
add byte [eax + 0x4d000344], ah
pop edx
nop
add byte [ebx], al
add byte [eax], al
add byte [eax + eax], al
add byte [eax], al
invalid
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
call 0xe4d0058
pop ds
mov edx, 0x9b4000e
int 0x21
mov eax, 0x21cd4c01
push esp
push 0x70207369
jb 0x4d00dc
jb 0x4d00d1
insd dword es:[edi], dx
and byte [ebx + 0x61], ah
outsb dx, byte [esi]
outsb dx, byte [esi]
outsd dx, dword [esi]
je 0x4d0099
bound esp, qword [ebp + 0x20]
jb 0x4d00f3
outsb dx, byte [esi]
and byte [ecx + 0x6e], ch
and byte [edi + ecx*2 + 0x53], al
and byte [ebp + 0x6f], ch
or eax, 0x240a0d
add byte [eax], al
add byte [eax], al
add byte [eax], al
ret
pmulhw mm0, qword [edi - 0x78499e76]
mov ah, byte [ecx - 0x4a]
xchg dword [edx - 0x2766499f], ecx
in eax, 0xb6
test byte [edx - 0xd71499f], cl
mov dh, 0x8c
mov ah, byte [ecx - 0x4a]
xchg dword [edx - 0x75fe49a0], ecx
popal
mov dh, 0x8e
loop 0x4d0079
xchg byte [edx - 0xd71499f], cl
call 0x61d7b084
mov dh, 0x8e
mov dh, 0x86
mov dh, 0x86
mov ah, byte [ecx - 0x4a]
cdq
fdiv st(5)
mov dh, 0x86
mov ah, byte [ecx - 0x4a]
invalid
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push eax
inc ebp
add byte [eax], al
dec esp
add dword [edx], edx
add byte [edx + 0x4d9d3d], ch
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ah
add byte [edx], al
and dword [ebx], ecx
add dword [ecx], ecx
add byte [eax], al
and al, byte [edx]
add byte [eax], al
sbb al, 1
add byte [eax], al
mov word [eax], es
add byte [eax + 0x22], al
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax + 2], al
add byte [eax], dl
add byte [eax], dl
add byte [eax], al
add byte [edx], al
add byte [eax], al
add eax, 0
add byte [eax], al
add byte [0], al
add byte [eax], al
add byte [eax], al
add byte [eax + eax], 0
push es
add byte [eax], al
xchg edi, eax
and byte [eax + eax], al
add al, byte [eax]
add byte [0x100000], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
invalid
Function at 0x4d1377
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [reloc.iphlpapi.dll_GetAdaptersInfo], 0
je 0x4d1416
mov dword [reloc.iphlpapi.dll_GetAdaptersInfo], 0
rdtsc
rol eax, 3
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
rol edx, 0x11
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], edx
lea eax, [ebp - 8]
push eax
call fcn.004d188b
mov eax, dword [ebp - 8]
rol eax, 5
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
mov eax, dword [ebp - 4]
rol eax, 0xf
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
mov eax, dword fs:[0x20]
rol eax, 9
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
mov eax, dword fs:[0x24]
rol eax, 0xb
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
call fcn.004d1891
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
jmp 0x4d13f7
rdtsc
rol eax, 9
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
rol eax, 0x17
xor dword [reloc.iphlpapi.dll_GetAdaptersInfo], edx
movzx ecx, word [0x10033000]
test ecx, ecx
je 0x4d13f7
mov esp, ebp
pop ebp
ret
Function at 0x4eabb7
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 0xc], 0
test edx, edx
jle 0x4ead04
mov edi, dword [ebp + edx*4 - reloc.iphlpapi.dll_GetAdaptersInfo]
lea esi, [edi + ecx]
lea ebx, [ecx*4]
add ecx, ecx
add ecx, edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edi
lea esi, [edi*4]
jmp 0x4eabf7
movss xmm3, dword [esi + eax]
movss xmm1, dword [esi + eax + 4]
mov ecx, dword [ebp + ecx*4 - reloc.iphlpapi.dll_GetAdaptersInfo]
mov edi, dword [ebp - 4]
add edx, edx
add ecx, edx
movss xmm2, dword [eax + ecx*4 + 4]
fld dword [eax + ecx*4]
fstp dword [esi + eax]
add edi, edi
xorps xmm2, xmm0
movss dword [esi + eax + 4], xmm2
movss dword [eax + ecx*4], xmm3
xorps xmm1, xmm0
movss dword [eax + ecx*4 + 4], xmm1
add edi, edi
add ecx, edi
movss xmm2, dword [eax + ecx*4 + 4]
fld dword [eax + ecx*4]
mov edi, dword [ebp - 4]
lea edx, [ebx + esi]
movss xmm3, dword [edx + eax]
fstp dword [edx + eax]
movss xmm1, dword [edx + eax + 4]
xorps xmm2, xmm0
movss dword [edx + eax + 4], xmm2
movss dword [eax + ecx*4], xmm3
add edx, ebx
xorps xmm1, xmm0
movss dword [eax + ecx*4 + 4], xmm1
movss xmm3, dword [edx + eax]
movss xmm1, dword [edx + eax + 4]
add edi, edi
sub ecx, edi
movss xmm2, dword [eax + ecx*4 + 4]
fld dword [eax + ecx*4]
fstp dword [edx + eax]
xorps xmm2, xmm0
movss dword [edx + eax + 4], xmm2
movss dword [eax + ecx*4], xmm3
add edx, ebx
add edi, edi
xorps xmm1, xmm0
movss dword [eax + ecx*4 + 4], xmm1
movss xmm1, dword [edx + eax + 4]
movss xmm3, dword [edx + eax]
add ecx, edi
fld dword [eax + ecx*4]
movss xmm2, dword [eax + ecx*4 + 4]
lea edi, [edx + eax + 4]
fstp dword [edx + eax]
mov dword [ebp - 0x14], edi
mov edx, edi
lea edi, [eax + ecx*4 + 4]
xorps xmm2, xmm0
movss dword [edx], xmm2
mov edx, 2
add dword [ebp - 0x1c], edx
add dword [ebp - 8], edx
add dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x20]
movss dword [eax + ecx*4], xmm3
mov ecx, dword [ebp - 0xc]
inc ecx
add esi, 8
cmp ecx, edx
xorps xmm1, xmm0
movss dword [edi], xmm1
mov dword [ebp - 0xc], ecx
jl 0x4eabf7
mov edi, dword [ebp - 4]
mov ecx, dword [ebp + edx*4 - reloc.iphlpapi.dll_GetAdaptersInfo]
lea esi, [ecx + edx*2]
movss xmm1, dword [eax + esi*4 + 4]
xorps xmm1, xmm0
movss dword [eax + esi*4 + 4], xmm1
lea ecx, [edi + edi]
lea ebx, [esi + ecx]
movss xmm3, dword [eax + ebx*4]
cwde
movss xmm1, dword [eax + ebx*4 + 4]
lea esi, [ebx + ecx]
movss xmm2, dword [eax + esi*4 + 4]
fld dword [eax + esi*4]
mov dword [ebp - 0x14], ebx
lea ebx, [eax + ebx*4 + 4]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x14]
fstp dword [eax + ebx*4]
mov ebx, dword [ebp - 0x18]
xorps xmm1, xmm0
xorps xmm2, xmm0
movss dword [ebx], xmm2
movss dword [eax + esi*4 + 4], xmm1
movss dword [eax + esi*4], xmm3
add esi, ecx
movss xmm1, dword [eax + esi*4 + 4]
inc edx
cmp edx, edi
xorps xmm1, xmm0
movss dword [eax + esi*4 + 4], xmm1
mov dword [ebp - 0x20], edx
jl fcn.004eabb7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6d01b4
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 2]
shr eax, cl
jmp 0x6d0692
pushal
pop word [esp + 0xf]
lea esp, [esp + 2]
jmp 0x6d05ac
lea esp, [esp + 3]
mov byte [esp], bh
call fcn.006d00d4
lea esp, [esp + 1]
jmp 0x6d0130
lea esp, [esp + 0x10]
sub esi, 4
jmp 0x6d01ad
sub esp, 0x14
sub esp, 0x16
lea esp, [esp + 2]
lea esp, [esp + 0x28]
popal
push esp
jmp 0x6d00f7
rol cl, 3
xchg cl, ch
mov ecx, dword [esp]
pushal
mov dword [esp + 0x18], ebx
jmp 0x6d014c
and eax, edx
call 0x6d0192
mov eax, dword [ebp - 4]
lea esp, [esp + 4]
pop edi
jmp 0x6cf97f
mov dword [esi], eax
mov ax, 0x94cb
inc al
mov eax, ecx
jmp 0x6d0167
pushal
mov word [esp + 0x1c], sp
pushal
lea esp, [esp + 0x48]
or eax, dword [ebp - 4]
jmp 0x6cfe87

Function at 0x6f58e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
add esi, 4
ror edi, 0xf
not edi
jmp 0x6f58a3

Function at 0x7d32a0
Capabilities:
Parse pe header

Disassembly:
mov word [esp], di
mov word [esp], bx
push dword [esp + 2]
lea esp, [esp + 7]
jmp 0x7d3325
lea esp, [esp + 1]
mov dword [esp + 0x30], ebx
call fcn.007d330a
pop word [esp]
push word [esp + 1]
mov dword [esp + 0x48], ebp
push esp
pop word [esp]
mov byte [esp], bh
jmp 0x7d33c6
mov byte [esp], ah
lea esp, [esp + 1]
call fcn.007d33ab
mov eax, dword fs:[0x30]
jmp 0x7d36b1
mov eax, dword [eax + 8]
push eax
jmp 0x7d203e
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x7d3669

Function at 0x7d330a
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 0x11]
push esp
pop word [esp + 0x10]
push word [esp + 7]
lea esp, [esp + 1]
jmp 0x7d3368
push word [esp + 1]
push word [esp + 1]
pushal
push word [esp + 0xb]
jmp 0x7d32f1
pop word [esp + 0x15]
mov word [esp + 0x1b], dx
push edx
pushal
lea esp, [esp + 0x43]
push edx
jmp 0x7d3332
mov dword [esp + 0x48], esp
pushal
push word [esp + 7]
pop dword [esp + 0xa]
lea esp, [esp + 0x1d]
pushal
jmp 0x7d334e

Function at 0x7d338a
Capabilities:
Parse pe header

Disassembly:
jmp 0x7d33ff
push word [esp + 3]
mov byte [esp + 6], ch
pop dword [esp + 8]
push dword [esp + 0x16]
mov word [esp + 4], bx
jmp 0x7d33e8
mov dword [esp + 0x68], edi
lea esp, [esp + 0x68]
mov word [esp + 8], sp
mov byte [esp + 9], ch
lea esp, [esp + 3]
mov dword [esp + 0x4c], esi
pushal
pop word [esp + 0xb]
jmp 0x7d338c

Function at 0x7d33ab
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 2]
push word [esp + 2]
push word [esp + 4]
mov dword [esp], ebp
call fcn.007d338a
loop 0x7d33e0
insb byte es:[edi], dx
jg 0x7d340c
xor byte [ebx - 0x61], 0xf0
ljmp 0x6824
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x4358f0
push 0x67
push esi
call edi
push 0x64
push 0x435828
push 0x6d
push esi
call edi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp word [esp + 0xc], 0x7dd
jb 0x401074
push 0x40
push 0x1000
push 0x298cd
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x298cd
mov edi, eax
push 0x409260
push edi
call fcn.00403a50
add esp, 0xc
call edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
call fcn.00401140
push 0
push esi
push 0
push 0
push 0
push 0
push 0xfffffc18
push 0xfffffc18
push 0xcf0000
push 0x4358f0
push 0x435828
push 0x80
mov dword [0x4359b8], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
je 0x401135
mov ecx, dword [ebp + 0x14]
push ecx
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
mov esi, eax
call edi
test eax, eax
je 0x401128
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push eax
push esi
push ecx
call ebx
test eax, eax
jne 0x401117
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
call edi
test eax, eax
jne 0x4010f0
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10