joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452180
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4521b3
push esi
call fcn.00455270
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4521ac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x452239
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x452222
mov eax, dword [esi + 8]
test eax, eax
je 0x4521d7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45221e
cmp eax, 2
je 0x452222
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4521ca
cmp eax, 3
je 0x4521fd
cmp eax, 1
jne 0x4521ca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4521ca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4521ca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00452260
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x452248
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00452260
add esp, 4
pop esi
ret

Function at 0x45dde0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x45de83
test eax, eax
jbe 0x45de83
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x45de83
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45de2e
xor esi, esi
jmp 0x45de34
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x45de5f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0045fea0
add esi, eax
push esi
mov ebx, esi
call fcn.0045fea0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x45de40
pop ebp
test edi, edi
pop edi
jne 0x45de83
test ebx, ebx
je 0x45de83
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004624a0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x45dfc5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45e0dd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45e0dd
mov eax, dword [esi + 0x3c]
push eax
call fcn.00472b1e
mov esi, eax
test esi, esi
je 0x45e0dd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x45e0dd
mov ecx, esi
call fcn.0045df30
cmp edi, eax
jge 0x45e0dd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x45e063
mov dword [esp + 0x34], 1
jmp 0x45e0be
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x45e0dd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0045d4d0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x4734c2
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4734fa
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00471576
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047154e
jmp 0x473506
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x474bb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x474bf2
call fcn.0047a669
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x474bf2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x474be9
xor eax, eax
jmp 0x474bfa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00474c00
pop edi
pop esi
pop ebx
ret 4
Function at 0x47ab99
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47abc7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47abe5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047aaff
jmp 0x47abe5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47abe5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047aaff
test edi, edi
mov eax, edi
jne 0x47abcf
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x675c96
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ebx
jmp 0x675d28
mov al, ah
mov word [esp], dx
mov byte [esp + 2], ch
bsr ax, bp
jmp 0x675cd8
jmp 0x675d11
lea esp, [esp + 4]
add dl, 0x8d
mov eax, ecx
sub esp, 0xc
jnp 0x675cc1
xchg dword [esp + 2], eax
jmp 0x675cfa
mov byte [esp + 2], ch
bsr ax, bp
jmp 0x675cd8
mov word [esp + 2], di
mov word [esp + 2], sp
push dword [esp + 6]
jmp 0x675dc4
xchg dword [esp + 2], eax
mov word [esp + 2], di
mov word [esp + 2], sp
call fcn.00675d72
and dword [eax - 0x5d], esp
fimul dword [edi]
sub byte [edi - 1], 0xff
dec dword [edx + 0x148966c4]
and al, 0xeb
mov edx, 0x4c25b52d
mov edi, 0x34a63d0b
push ebx
scasb al, byte es:[edi]
sbb al, 0x57
invalid
jb 0x675c9d
mov al, ah
mov word [esp], dx
jmp 0x675cf0

Function at 0x67f964
Capabilities:
Encode data using xor

Disassembly:
jmp 0x669b52
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x669b6e
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x669b5a
jmp 0x669b79
ret
lea esp, [esp + 4]
jmp 0x669b47

Function at 0x694e9b
Capabilities:
Encrypt data using aes

Disassembly:
push edx
push dword [esp + 2]
pop dword [esp]
lea esp, [esp + 4]
popal
jmp 0x694e85
push ebx
pushal
mov dword [esp + 0x10], edi
stc
jmp 0x694e60
lea ebx, [ebx*4]
lea ebx, [ebx + 0x671f58]
mov edi, dword [ebx]
pop ebx
jmp 0x694f00
sub esp, 2
lea esp, [esp + 2]
and edi, esi
jmp 0x694e7c
lea esp, [esp + 0x44]
and ecx, 0xff0000
sub esp, 0x1a
mov byte [esp + 2], ch
call fcn.00694ec1
aam 0x60
pushal
lea esp, [esp + 0x11]
push edx
mov dword [esp + 2], ebp
lea esp, [esp + 3]
jmp 0x694ee9

Function at 0x694ec1
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp + 0xd]
jmp 0x694f8c
xor ecx, edi
lea edi, [eax + ebx]
sub esp, 8
mov edi, edx
jmp 0x694f60
mov edx, dword [edx*4 + 0x671f58]
call fcn.00694f70
xchg ebx, eax
or eax, 0xaa17e49d
add ebx, dword [esi + 0x64a66b0c]
dec edi
arpl word [esi], ax
cmc
je 0x694fd5
popal
push edx
mov byte [esp + 1], ch
sub esp, 0x1e
lea esp, [esp + 2]
and edx, esi
jmp 0x694f40
lea esp, [esp + 0x1c]
and edi, 0xff000000
sub esp, 2
cmc
add esp, 1
lea esp, [esp + 1]
jmp 0x694ecb
mov dh, 0x45
xacquire xchg byte [ecx], dh
xor byte [ebp + 0xf342464], cl
mov dh, 0x3c
mov ebp, 0x671f58
call fcn.00694fc0
and edx, ebp
lea edi, [eax - 0x29]
cmc
btr edi, edx
jmp 0x69501f
lea edi, [eax + 0x10]
clc
jmp 0x695066
xor ecx, edx
lea esp, [esp + 4]
xor ecx, dword [ebx]
bswap edi
setae dh
jmp 0x694ff7
pop word [esp + 3]
lea esp, [esp + 8]
add ebx, 4
not dh
rcl dx, cl
jmp 0x69509b
xor ecx, dword [eax]
lea edx, [ebp*4]
sub esp, 0xa
mov dword [esp + 1], esi
jmp 0x695043
mov dword [edi], ecx
btc edx, ebx
bsf dx, ax
xor edx, esi
not dx
jmp 0x6950bb
lea edx, [eax + 0x10e1e2d9]
mov edx, 0x18de3400
jmp 0x695084
mov edx, dword [eax + 4]
xor edx, ecx
lea ecx, [esi*4]
jmp 0x69521c
push ecx
mov ecx, eax
lea ecx, [ecx + 0x14]
mov dword [ecx], edx
jmp 0x695192
Function at 0x69524c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop esi
lea ebp, [ecx*4]
mov ebp, dword [esp]
mov bl, byte [esp]
jmp 0x6954ff
lea esp, [esp + 4]
jmp 0x695229
lea esp, [esp + 4]
pop ebx
call fcn.00695342

Function at 0x6956b0
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
jmp 0x695756
mov byte [esp + 2], ch
add esp, 3
cmc
jmp 0x695699
lea esp, [esp + 1]
and edx, ecx
pushal
mov edx, dword [edx*4 + 0x671f58]
jmp 0x69573e
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + 0x672f58]
mov dh, ch
jmp 0x695715
lea esp, [esp + 4]
movzx ebx, byte [esi + 5]
pushal
lea esp, [esp + 9]
lea esp, [esp + 0x12]
jmp 0x6956da
mov edx, dword [esi + 4]
call 0x69571e
xor esp, dword [esi - 0x77]
cmp al, 0x24
mov dword [esi], edi
neg edi
jmp 0x6958aa
clc
cmc
and edx, ecx
jmp 0x6956ea
lea esp, [esp + 4]
xor edi, dword [ebx*4 + 0x672758]
push edx
jmp 0x695702
push ebp
movsb byte es:[edi], byte [esi]
bound ebp, qword [ecx - 0x78]
sub eax, dword [edx - 3]
shr edi, 0x18
call fcn.00695794
into
dec esi
fdivr qword [ebx - 0x1ca317aa]
jae 0x6957d5
in eax, 0x57
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x7d]
in al, dx
or cl, byte [ebp - 0x14fddb9c]
loopne 0x6957a5
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x6957ad
push edi
invalid
pop esi
cmp eax, ecx
jnp 0x6957bf
adc al, 0x87
cmp dword cs:[eax], ebx
pop edi
mov di, word [esp]
clc
neg edi
mov edi, edx
jmp 0x6957c4
lea esp, [esp + 8]
popal
lea edi, [edi*4]
lea edi, [edi + 0x671f58]
mov ebx, dword [edi]
jmp 0x6957df
mov dword [esp], ebx
cmc
sub esp, 0x1a
add esp, 0xd
pop word [esp + 2]
lea esp, [esp + 3]
jmp 0x695854
dec edi
clc
push edi
pushal
jmp 0x695888

Function at 0x69571e
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
jmp 0x695756
mov byte [esp + 2], ch
add esp, 3
cmc
jmp 0x695699
lea esp, [esp + 1]
and edx, ecx
pushal
mov edx, dword [edx*4 + 0x671f58]
jmp 0x69573e
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + 0x672f58]
mov dh, ch
jmp 0x695715
lea esp, [esp + 4]
movzx ebx, byte [esi + 5]
pushal
lea esp, [esp + 9]
lea esp, [esp + 0x12]
jmp 0x6956da
mov edx, dword [esi + 4]
call 0x69571e
xor esp, dword [esi - 0x77]
cmp al, 0x24
mov dword [esi], edi
neg edi
jmp 0x6958aa
clc
cmc
and edx, ecx
jmp 0x6956ea
lea esp, [esp + 4]
xor edi, dword [ebx*4 + 0x672758]
push edx
jmp 0x695702
push ebp
movsb byte es:[edi], byte [esi]
bound ebp, qword [ecx - 0x78]
sub eax, dword [edx - 3]
shr edi, 0x18
call fcn.00695794
into
dec esi
fdivr qword [ebx - 0x1ca317aa]
jae 0x6957d5
in eax, 0x57
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x7d]
in al, dx
or cl, byte [ebp - 0x14fddb9c]
loopne 0x6957a5
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x6957ad
push edi
invalid
pop esi
cmp eax, ecx
jnp 0x6957bf
adc al, 0x87
cmp dword cs:[eax], ebx
pop edi
mov di, word [esp]
clc
neg edi
mov edi, edx
jmp 0x6957c4
lea esp, [esp + 8]
popal
lea edi, [edi*4]
lea edi, [edi + 0x671f58]
mov ebx, dword [edi]
jmp 0x6957df
mov dword [esp], ebx
cmc
sub esp, 0x1a
add esp, 0xd
pop word [esp + 2]
lea esp, [esp + 3]
jmp 0x695854
dec edi
clc
push edi
pushal
jmp 0x695888
Function at 0x695794
Capabilities:
Encrypt data using aes

Disassembly:
push eax
pushal
xchg dx, bp
setle ch
jmp 0x69581f
lea esp, [esp + 3]
cmc
add esp, 0
lea esp, [esp + 1]
jmp 0x69577d
mov edi, dword [eax]
pop eax
call fcn.006957eb
cmpsb byte [esi], byte es:[edi]
xor esp, dword [ebx - 0x4309ca3a]
xor al, 0xaa
int 0x3c
invalid
neg ah
mov dword [esp + 0x1c], edi
popal
lea eax, [eax*4]
lea eax, [eax + 0x671f58]
jmp 0x695808

Function at 0x695a2d
Capabilities:
Encrypt data using aes

Disassembly:
lea ecx, [ecx*4]
lea ecx, [ecx + 0x671f58]
mov edx, dword [ecx]
pop ecx
push edx
jmp 0x695a4f
push ecx
mov ecx, edx
jmp 0x695a16
pop word [esp]
lea esp, [esp + 2]
and edx, ecx
jmp 0x695a88
push ebp
jmp 0x695ad5
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + 0x672f58]
sub esp, 6
lea esp, [esp + 2]
jmp 0x695a72
mov ebp, esi
lea ebp, [ebp + 0xc]
mov edx, dword [ebp]
pop ebp
jmp 0x695ab9

Function at 0x695b93
Capabilities:
Encrypt data using aes

Disassembly:
push edx
lea esp, [esp + 3]
call fcn.00695b18
lea esp, [esp + 2]
and ebx, ecx
call 0x695b93
add byte [eax], al
mov ecx, 0xeb04ec83
xor byte [edx + ebx - 0x20e51078], cl
out dx, al
jg 0x695b90
mov bh, byte [ecx + 0x42]
ror byte [ebp - 0x24], cl
das
and dword ss:[ebx + 0x2358bd3c], ecx
mov edi, dword [edi*4 + 0x672358]
sub esp, 0xc
pop word [esp + 3]
jmp 0x695b87
pushal
lea ebx, [edx*4]
lea esp, [esp + 0x20]
movzx ebx, byte [esi + 9]
stc
jmp 0x695b7d
and ebx, ecx
cmc
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + 0x672758]
neg ebx
jmp 0x695c6b
mov ebx, dword [ebx*4 + 0x671f58]
pushal
jmp 0x695cae

Function at 0x695be0
Capabilities:
Encrypt data using aes

Disassembly:
and edi, ecx
call fcn.00695baa
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + 0x672b58]
mov ebx, 0x88c2004e
jmp 0x695c4d
mov byte [esp + 2], ch
clc
mov dword [esp], eax
add al, 0x24
jmp 0x695bc1
mov edx, dword [edx*4 + 0x671f58]
call fcn.00695c97
jp 0x695be6
jl 0x695c15
test byte [eax + 0x68], 3
xchg ebx, eax
test byte [0x5ac45ec2], 0x3d
int3
lea esp, [esp + 3]
and edx, ecx
push edx
sub esp, 0x10
jmp 0x695bea
jmp 0x72f13c8c
mov ebx, dword [ebx*4 + 0x671f58]
sub esp, 0x10
push dword [esp + 4]
pushal
lea esp, [esp + 0x31]
jmp 0x695c09
lea ebx, [esp + ecx]
mov bl, 0xc
movzx ebx, byte [esi + 0xe]
jmp 0x695c29

Function at 0x695c97
Capabilities:
Encrypt data using aes

Disassembly:
call 0x667ed8
call fcn.00697771
and ebx, ecx
jmp 0x695cdf
stc
cmc
jmp 0x695c81
and edx, ecx
clc
pushal
mov byte [esp + 0x14], ch
add esp, 1
lea esp, [esp + 3]
jmp 0x695d42
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + 0x672758]
clc
sub esp, 0x18
jmp 0x695cc0
lea esp, [esp + 0x34]
xor edi, dword [edx*4 + 0x672f58]
call fcn.00695d0d
add al, ch
mov ebx, 0xe8ffffff
ljmp 0x2bfa
call fcn.00696741
cmp dl, 0x2b
call fcn.00696729
bnd jns 0x695d4b
mov byte [ebx - 0x31], bh
aam 0x5a
enter 0x5aaf, 0xffffffffffffffef
cmp edx, dword [edx]
lea ecx, [ebp - 0x3cfbdb9c]
jmp 0x667fc3

Function at 0x695d0d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
push edx
push dword [esp + 2]
jmp 0x695d17
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x695cf0
lea esp, [esp + 8]
jne 0x667d19
je 0x667d64
Function at 0x795350
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, bx
lea esp, [esp + 0xb]
mov eax, esi
pop dword [esp + 6]
inc bl
xchg word [esp + 5], bp
jmp 0x79556a
rdtsc
mov word [esp + 0x17], dx
pop dword [esp + 0xc]
lea ebp, [eax - 0x6fbfd787]
xchg di, dx
jmp 0x795331
xchg ah, bl
lea ebp, [esi*4]
cmc
rcr esi, 9
neg ch
jmp 0x79540e
rdtsc
mov byte [esp], dh
xchg byte [esp + 0x18], al
pushal
bswap edx
cmc
jmp 0x7953a7
mov bp, word [esp + 8]
sub esp, 0x10
mov dh, byte [esp + 0x17]
inc bl
bswap edi
pop dword [esp + 0x12]
jmp 0x7953be
push dword [esp + 0xe]
setg ah
popal
rdtsc
not bh
pop si
jmp 0x79549a
mov al, 0xa6
setnp dh
push word [esp + 9]
lea edx, [ebx*4]
xchg word [esp + 0x27], cx
neg ax
jmp 0x7953f0
lea ebx, [ebx + edi]
mov bp, sp
push esp
mov ah, byte [esp + 0xd]
rdtsc
xor dl, ch
jmp 0x7953da
lea edx, [ecx - 0x53]
and dx, 0xdfd2
add esp, 3
pop word [esp + 3]
cpuid
mov esi, 0x2fffb8be
jmp 0x7954ce
pop ebp
sub esp, 0x1c
mov edx, ebp
cmc
mov dword [esp + 0x2b], ecx
lea edi, [eax*4]
jmp 0x795441
mov word [esp + 0x20], dx
mov bx, 0x9e63
pop si
setae ch
mov ah, byte [esp + 0x15]
mov bx, di
jmp 0x795463
lea ebp, [ebx + ebp]
lea edi, [ebp + 0x77]
sub esp, 6
mov ebx, 0x5c71e990
mov word [esp + 0x10], di
mov dword [esp + 0x19], ebp
jmp 0x79547e
lea esp, [esp + 0x53]
setno ch
xchg dx, di
rdtsc
and ebp, ecx
lea ebp, [eax - 0x61]
jmp 0x795511
xchg dword [esp + 6], ecx
bswap edx
mov word [esp + 0x19], dx
btr esi, esp
and ecx, ecx
sub esp, 0x1e
jmp 0x7954b3
mov bx, 0x41b5
rdtsc
rdtsc
neg ch
call fcn.00795549
in eax, dx
insd dword es:[edi], dx
std
test byte [edi - 0x5f], dh
cld
iretd
mov cl, ch
mov bx, word [esp]
mov bp, 0xe087
lea ecx, [edi + edi]
shr edi, 1
jmp 0x7954e3
mov cl, byte [esp]
neg ecx
not dh
rcl ax, cl
mov dx, sp
neg eax
jmp 0x7954fa
not ch
mov ch, byte [esp + 1]
cpuid
pop dx
ror ah, 1
mov word [esp + 4], di
jmp 0x795430
xchg dword [esp + 2], ecx
mov al, 0x16
mov word [esp], sp
inc esi
mov dl, 0x4c
xchg ebp, eax
jmp 0x795533

Function at 0x7955aa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ah
mov byte [esp], ah
mov byte [esp], ah
lea ecx, [ecx*4]
stc
jmp 0x7955bb
and dx, 0x94da
rdtsc
lea esp, [esp + 7]
add esp, 3
mov dl, dh
jmp 0x79557a
xchg word [esp + 5], bp
lea ebx, [ebx*4]
mov cx, bx
jmp 0x795593
lea ebx, [edx + ebx]
push edx
stc
mov dl, dh
mov bl, 0x68
bsf bx, si
jmp 0x7955fd
xchg dx, bp
bsf ax, ax
mov al, ah
xchg ebp, eax
pop word [esp + 1]
cpuid
jmp 0x7955e4
Function at 0x795862
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor si, 0x590c
xchg word [esp + 0xc], si
add esp, 7
bsf bx, ax
jmp 0x79586e
lea ecx, [edi*4]
setae ah
jmp 0x795847
mov word [esp + 0xe], sp
pop ax
pushal
push esp
lea esp, [esp + 0x42]
mov bl, bh
jmp 0x7958d3
mov al, ah
bsf si, ax
stc
setae ch
rdtsc
mov ebp, dword [esp]
jmp 0x795913
lea edx, [ebx*4]
rdtsc
clc
inc dl
inc bl
setae ch
jmp 0x7958b2
mov bh, byte [esp + 0xb]
mov bx, word [esp + 0x10]
mov si, 0x4b99
sub esp, 0x12
jmp 0x795a78
setnp ch
mov ecx, 0x94e08f1c
cld
mov ebx, esi
pushal
rdtsc
jmp 0x7958e6
mov cx, 0x1459
lea edx, [eax + edx]
mov si, word [esp]
mov ebp, 0xa5a9ff02
lea ecx, [ebx*4]
setp ah
jmp 0x7958fc
xchg ch, dl
mov dx, word [esp + 0xa]
call fcn.00795951
rdtsc
and cl, bh
add esp, 7
lea esp, [esp + 0x15]
mov byte [esp + 3], bh
jmp 0x795a1a
lea edi, [esi - 0xe5]
pop ebx
sub dx, 0xcae0
mov cx, sp
xchg dword [esp + 0x18], edx
bswap ecx
jmp 0x795970
xor ax, 0xc5b4
neg dh
pushal
xchg word [esp + 0xc], bp
popal
btr ecx, esp
jmp 0x795a01
clc
lea eax, [ecx + 0x2ea9b0a3]
add esp, 0
xchg byte [esp], cl
bsr dx, bp
cpuid
jmp 0x7959a9
mov bl, bh
mov bl, bh
setl ch
add esp, 0
mov cl, ch
bswap ecx
jmp 0x7959d2
pushal
pop dword [esp + 0x18]
mov byte [esp + 7], ah
call fcn.007959bb
clc
outsb dx, byte [esi]
or eax, edi
jg 0x795a6b
les esi, [edi + 0x5e]
test eax, 0x852c8d
add byte [eax], al
add byte [esi + 0x5d], ah
lea ebp, [eax*4]
pop bp
lea ebx, [eax - 0x7bc27c4f]
add esp, 9
lea esp, [esp + 3]
add esp, 0
jmp 0x7959f1
invalid
push dword [esp + 0x1a]
ror edx, 3
lea esp, [esp + 0xf]
not ch
bswap ebp
push dword [esp + 0xc]
jmp 0x795992

Function at 0x79604c
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub bx, 0xaff0
ror ah, 1
inc al
btr edx, esp
not ah
xchg ebp, ebx
cmc
btc ecx, edi
jmp 0x795392
add esp, 5
shl dx, cl
setp ah
mov bp, sp
mov ebp, eax
inc ecx
jmp 0x795653
xchg edi, ebx
cpuid
stc
mov bl, 0xe8
neg edx
sub esp, 6
jmp 0x79589e
mov bp, word [esp]
mov byte [esp], ah
xchg esi, ebx
not ecx
lea ebp, [eax + 0x11]
xor ecx, esi
jmp 0x795940
inc cx
bswap ebp
push word [esp + 3]
bsr bp, cx
add esp, 0xa
neg cx
jmp 0x795b83
push dword [esp + 3]
mov edx, dword [esp + 7]
xchg word [esp], di
mov dh, byte [esp + 4]
jmp 0x795e19

Function at 0x797cc0
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
lea esp, [esp + 1]
call fcn.00797d26
jmp 0x797d44
lodsb al, byte [esi]

Function at 0x797d26
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
call int.0079703c
pop word [esp + 1]
jmp 0x797dae
lea esp, [esp + 2]
lea esp, [esp + 1]
mov dword [esp + 0xc], esp
pushal
push word [esp + 0x13]
push esp
call fcn.00797d73
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x797e27
push eax
jmp 0x797037

Function at 0x797d45
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov dword [esp], ecx
call 0x797ca7
jmp 0x797d1e

Function at 0x797d5a
Capabilities:
Execute anti-debugging instructions
Get number of processors
Parse pe header

Disassembly:
mov word [esp], dx
push word [esp + 1]
Function at 0x797d73
Capabilities:
Execute anti-debugging instructions
Get number of processors
Parse pe header

Disassembly:
pop dword [esp + 0xe]
pushal
lea esp, [esp + 2]
mov dword [esp + 0x4c], ebp
call fcn.00797d5a
mov edi, 0x24148966
mov word [esp], dx
jmp 0x797d47
Function at 0x40a590
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48b7bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047e379
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40a612
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047bd8e
mov eax, dword [eax]
push 0x4adc9c
push eax
call fcn.0046e4c4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047e604
test bl, bl
je 0x40a612
push 0x4adc9c
lea ecx, [esp + 0xc]
call fcn.0047e9e0
push 0x4adca8
lea ecx, [esp + 0xc]
call fcn.0047e9e0
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40a64e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047e604
jmp 0x40a719
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40a6d2
lea edx, [esp + 0x7c]
push 0x4adca4
push edx
call fcn.0046e4c4
add esp, 8
test eax, eax
je 0x40a6d2
lea eax, [esp + 0x7c]
push 0x4adca0
push eax
call fcn.0046e4c4
add esp, 8
test eax, eax
je 0x40a6d2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a662
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047e604
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40af10
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40af72
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc