joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bf23
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x41360f
call fcn.0041249c
sub esp, 0x514
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x400
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x41a630
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x520]
push ecx
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
push eax
mov eax, dword [edi]
mov dword [ebp - 4], 1
add eax, 0xc
push eax
push dword [ebx]
call esi
cmp eax, 0xea
jne 0x40bfdf
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
mov dword [ebp + 0xc], eax
jne 0x40bfab
mov esi, dword [ebp + 8]
push dword [ebp - 0x10]
mov ecx, esi
and dword [esi], eax
call fcn.00403e21
mov dword [ebp - 0x1c], 1
jmp 0x40c090
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi]
add eax, 0xc
push 0
push eax
push dword [ebx]
call esi
cmp dword [ebp - 0x14], 1
jne 0x40bfd1
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.00404084
push dword [ebp + 0xc]
call fcn.004121ae
pop ecx
jmp 0x40c071
test eax, eax
jne 0x40c071
cmp dword [ebp - 0x14], 1
jne 0x40bff5
lea eax, [ebp - 0x520]
jmp 0x40c068
cmp dword [ebp - 0x14], 4
jne 0x40c01e
lea eax, [ebp - 0x520]
push 4
push eax
lea eax, [ebp + 0xc]
push eax
call sub.MSVCRT.dll_memcpy
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.00405e8c
add esp, 0x14
jmp 0x40c071
cmp dword [ebp - 0x14], 2
jne 0x40c071
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x40c046
cmp eax, esi
jbe 0x40c062
push 0x419e10
push 0x419df4
push 0x419df0
push 0x419cbc
call fcn.004054c0
add esp, 0x10
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x10]
call fcn.00404084
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
push dword [ebp - 0x10]
mov dword [eax], ecx
mov ecx, esi
and dword [esi], 0
call fcn.00403e21
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x10]
and byte [ebp - 4], 0
call fcn.00404bf6
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x40c0b0
Capabilities:
Set registry value

Disassembly:
mov eax, 0x413624
call fcn.0041249c
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add eax, 0xc
inc ecx
push ecx
push eax
mov eax, dword [ebp + 8]
push 1
push 0
mov eax, dword [eax]
add eax, 0xc
push eax
mov eax, dword [ebp + 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test edi, edi
jne 0x40c0ee
mov al, 1
jmp 0x40c157
mov dword [ebp + 0xc], 0x41a630
and dword [ebp - 4], 0
push 0x419e70
lea ecx, [ebp + 0xc]
call fcn.00404084
add esi, 4
lea eax, [ebp + 0xc]
push esi
push eax
call fcn.00405dd6
lea eax, [ebp + 0xc]
push 0x419d04
push eax
call fcn.00405df1
lea eax, [ebp + 0xc]
push edi
push eax
call fcn.00405e15
mov eax, dword [ebp + 0xc]
add eax, 0xc
push eax
push 0x4192cc
push 0x419e6c
push 0x419cbc
call fcn.004054c0
push dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
call fcn.00404bf6
add esp, 0x2c
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x40c167
Capabilities:
Set registry value

Disassembly:
mov eax, 0x413638
call fcn.0041249c
push esi
push edi
lea eax, [ebp + 0xc]
push 4
push eax
mov eax, dword [ebp + 8]
push 4
push 0
mov eax, dword [eax]
mov esi, ecx
add eax, 0xc
push eax
mov eax, dword [ebp + 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test edi, edi
jne 0x40c19d
mov al, 1
jmp 0x40c206
mov dword [ebp + 8], 0x41a630
and dword [ebp - 4], 0
push 0x419e70
lea ecx, [ebp + 8]
call fcn.00404084
add esi, 4
lea eax, [ebp + 8]
push esi
push eax
call fcn.00405dd6
lea eax, [ebp + 8]
push 0x419d04
push eax
call fcn.00405df1
lea eax, [ebp + 8]
push edi
push eax
call fcn.00405e15
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
push 0x4192cc
push 0x419e80
push 0x419cbc
call fcn.004054c0
push dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
call fcn.00404bf6
add esp, 0x2c
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x40c286
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x914
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40c3b4
mov eax, 0x400
and dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push 0
push eax
lea eax, [ebp - 0x914]
push eax
push dword [esi + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x40c391
lea eax, [ebp - 0x914]
lea ecx, [esi + 4]
push eax
call fcn.00404084
cmp dword [ebp - 4], 1
jne 0x40c302
lea eax, [ebp - 0x514]
mov ecx, esi
push eax
call fcn.00404084
jmp 0x40c38a
cmp dword [ebp - 4], 4
jne 0x40c336
lea eax, [ebp - 0x514]
push 4
push eax
lea eax, [ebp - 8]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, esi
push 0x41a630
call fcn.00403e21
push dword [ebp - 8]
push esi
call fcn.00405e8c
pop ecx
pop ecx
jmp 0x40c38a
cmp dword [ebp - 4], 2
jne 0x40c38a
push edi
mov edi, 0x104
lea eax, [ebp - 0x114]
push edi
push eax
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x40c35f
cmp eax, edi
jbe 0x40c37b
push 0x419e8c
push 0x419df4
push 0x419e84
push 0x419cbc
call fcn.004054c0
add esp, 0x10
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.00404084
pop edi
inc dword [esi + 0xc]
mov al, 1
jmp 0x40c3b6
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [esi + 8], 0
push 0x41a614
mov ecx, esi
call fcn.00404084
push dword [esi]
lea ecx, [esi + 4]
call fcn.00403e21
xor al, al
pop esi
leave
ret

Function at 0x40cf58
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x413844
call fcn.0041249c
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x40cf88
push 0x41a614
push 0x41a038
push 0x41a034
push 0x41a014
call fcn.004054c0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
test eax, eax
mov dword [esi], eax
jbe 0x40cff9
push 0x41a008
lea ecx, [ebp - 0x14]
call fcn.00403b3f
and dword [ebp - 4], 0
push 0x41a010
lea ecx, [ebp - 0x10]
call fcn.00403b3f
push dword [esi]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405dd6
pop ecx
pop ecx
push eax
call fcn.00405e8c
push dword [ebp - 0x10]
and byte [ebp - 4], 0
call fcn.00404bf6
mov eax, dword [ebp - 0x14]
and dword [ebp - 0x10], 0
add eax, 0xc
push eax
call dword [sym.imp.MSVCRT.dll__putenv]
push dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
call fcn.00404bf6
add esp, 0x14
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x410ef2
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x413ff3
call fcn.0041249c
sub esp, 0xa8
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, 1
mov edi, ecx
mov byte [ebp - 0xd], bl
je 0x410f4c
cmp esi, 2
je 0x410f4c
cmp esi, 4
je 0x410f4c
cmp esi, 0x100
je 0x410f4c
cmp esi, 8
je 0x410f4c
cmp esi, 0x10
je 0x410f4c
push 0x41a614
push 0x41a3cc
push 0x41a3c8
push 0x41a3a8
call fcn.004054c0
add esp, 0x10
push dword [ebp + 0x18]
lea ecx, [ebp - 0xb4]
call fcn.0040afad
movzx eax, word [ebp + 0x14]
cmp eax, ebx
mov dword [ebp - 4], ebx
jle 0x410fac
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
cmp dword [ebp + 0xc], ebx
je 0x410fa1
mov eax, dword [esi]
cmp eax, ebx
je 0x410fa1
push eax
lea ecx, [ebp + 0x14]
call fcn.00403b3f
lea eax, [ebp + 0x14]
lea ecx, [ebp - 0xb4]
push eax
mov byte [ebp - 4], 1
call fcn.0040b0b2
push dword [ebp + 0x14]
mov byte [ebp - 4], bl
call fcn.00404bf6
pop ecx
mov dword [ebp + 0x14], ebx
add esi, 4
dec dword [ebp - 0x18]
jne 0x410f6b
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
lea ecx, [ebp - 0xb4]
push eax
call fcn.0040b1bc
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], ebx
call fcn.00403e21
push dword [ebp + 8]
mov byte [ebp - 4], 4
call fcn.00404bf6
fldz
push ecx
mov dword [ebp + 8], ebx
fstp qword [esp]
call fcn.004115f0
pop ecx
test al, al
pop ecx
je 0x41102c
mov eax, dword [edi + 0x118]
cmp eax, ebx
je 0x4110bb
mov ecx, dword [ebp - 0x14]
push dword [ebp + 0x24]
add ecx, 0xc
mov dword [ebp + 0x14], ecx
lea ecx, [ebp + 0x14]
push ecx
push dword [ebp + 0x20]
push 1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
setne byte [ebp - 0xd]
jmp 0x4110bb
mov eax, 0x41a630
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x14], eax
lea eax, [ebp + 0xc]
push esi
push eax
mov byte [ebp - 4], 6
call fcn.00405e15
movzx eax, word [ebp + 0x10]
push eax
lea eax, [ebp + 0x14]
push eax
call fcn.00405f03
add esp, 0x10
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.004112cd
push ecx
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp + 0x10], esp
mov dword [ecx], ebx
push dword [ebp + 0x18]
call fcn.00403e21
mov ecx, edi
call fcn.00411589
push dword [ebp + 0x18]
mov byte [ebp - 0xd], al
mov byte [ebp - 4], 6
call fcn.00404bf6
push dword [ebp + 0x14]
mov dword [ebp + 0x18], ebx
mov byte [ebp - 4], 5
call fcn.00404bf6
push dword [ebp + 0xc]
mov dword [ebp + 0x14], ebx
mov byte [ebp - 4], 4
call fcn.00404bf6
add esp, 0xc
mov dword [ebp + 0xc], ebx
push dword [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00404bf6
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x14], ebx
call fcn.0040b048
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x20
Function at 0x4110ed
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x414020
call fcn.0041249c
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, 1
mov esi, ecx
mov byte [ebp - 0xd], bl
je 0x411142
cmp edi, 2
je 0x411142
cmp edi, 4
je 0x411142
cmp edi, 0x100
je 0x411142
cmp edi, 8
je 0x411142
cmp edi, 0x10
je 0x411142
push 0x41a614
push 0x41a3cc
push 0x41a448
push 0x41a3a8
call fcn.004054c0
add esp, 0x10
push ecx
push ecx
fldz
fstp qword [esp]
call fcn.004115f0
pop ecx
test al, al
pop ecx
je 0x411188
mov esi, dword [esi + 0x118]
cmp esi, ebx
je 0x41122f
push dword [ebp + 0x1c]
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x18]
push 1
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
setne byte [ebp - 0xd]
jmp 0x41122f
mov eax, 0x41a630
mov dword [ebp + 0x18], eax
mov dword [ebp - 4], ebx
mov dword [ebp + 8], eax
lea eax, [ebp + 0x18]
push edi
push eax
mov byte [ebp - 4], 1
call fcn.00405e15
movzx eax, word [ebp + 0x10]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00405f03
add esp, 0x10
lea ecx, [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00403b3f
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
mov byte [ebp - 4], 2
call fcn.004112cd
push dword [ebp + 0x10]
mov byte [ebp - 4], 4
call fcn.00404bf6
mov ecx, esp
mov dword [ebp + 0x14], esp
mov dword [ebp + 0x10], ebx
mov dword [ecx], ebx
push dword [ebp + 0x1c]
call fcn.00403e21
mov ecx, esi
call fcn.00411589
push dword [ebp + 0x1c]
mov byte [ebp - 0xd], al
mov byte [ebp - 4], 1
call fcn.00404bf6
push dword [ebp + 8]
mov dword [ebp + 0x1c], ebx
mov byte [ebp - 4], bl
call fcn.00404bf6
push dword [ebp + 0x18]
or dword [ebp - 4], 0xffffffff
mov dword [ebp + 8], ebx
call fcn.00404bf6
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x18
Function at 0x4116cd
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0x41a630
xor ebx, ebx
call fcn.00403e21
lea eax, [ebp - 0x14c]
push 0x104
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x411727
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x14c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
je 0x411727
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x41172b
xor al, al
jmp 0x4117a9
push esi
push edi
lea eax, [ebp - 0x14c]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4117a0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x41a4ac
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4117a0
cmp dword [ebp - 0x14], ebx
je 0x4117a0
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x48]
push 0x41a480
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x48]
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4117a0
cmp dword [ebp - 4], ebx
je 0x4117a0
push dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
call fcn.00404084
mov bl, 1
push esi
call fcn.004121ae
pop ecx
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x68595c
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
push esp
jmp 0x6858aa

Function at 0x69a35e
Capabilities:
Encrypt data using aes

Disassembly:
mov di, word [esp]
bswap esi
movzx esi, byte [eax + 0xb]
adc ebx, esi
sub esp, 0x16
jmp 0x69a2d4
shl edx, 8
mov ebx, esi
xor edx, esi
btc ebp, edi
xchg si, bx
jmp 0x69a2a5
pop di
lea esp, [esp + 4]
movzx esi, byte [eax + 0xa]
xchg bp, di
mov ebx, 0xd63050b8
jmp 0x69a2c5
mov bp, di
xor edx, esi
inc bl
jmp 0x69a2ea

Function at 0x7a402f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop si
rdtsc
sub esp, 2
bswap ebx
mov al, 6
xchg bx, bp
jmp 0x7a4037
lea eax, [edi + edi]
not edx
pop dword [esp]
bswap ebp
xchg edx, ebx
pop word [esp]
jmp 0x7a3ff0
xchg ah, bl
xchg dword [esp + 4], edx
jmp 0x7a4008
inc dl
mov esi, 0x8d7053bc
lea esp, [esp]
mov ecx, ebp
push edx
mov ebp, dword [esp + 2]
jmp 0x7a408e
rcr bh, 3
pop edi
bswap edx
btr edi, esp
add esp, 0
add esp, 4
jmp 0x7a4074
xchg word [esp + 4], si
setbe dh
push esp
mov bl, bh
clc
bswap esi
jmp 0x7a404a

Function at 0x7a439f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, word [esp + 3]
pop esi
xchg ebp, eax
cpuid
mov bx, dx
add esp, 2
jmp 0x7a4346
inc bl
mov bl, bh
lea esp, [esp + 0xd]
mov edi, ebp
inc bl
pop dword [esp + 1]
jmp 0x7a4300
clc
pushal
btr eax, edx
xchg byte [esp + 0x1d], dl
setle ah
xor si, 0x4f04
jmp 0x7a431b
mov dl, dh
clc
xchg si, ax
setbe ch
mov ah, byte [esp + 2]
lea esi, [eax + edi]
jmp 0x7a437d
lea esp, [esp + 0x45]
neg ecx
bsr di, bp
rdtsc
mov cl, ch
inc al
jmp 0x7a4333
rdtsc
neg edx
xchg bx, ax
push edx
mov dx, 0x85d
sub esp, 6
jmp 0x7a43a4
mov bl, 0xc8
pushal
jmp 0x7a436b
rdtsc
neg dh
mov edi, eax
setae bh
add esp, 4
sub ecx, eax
jmp 0x7a4420
sete ch
mov dword [esp + 5], esi
call 0x7a43fb
Function at 0x7a4d11
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc ecx, edi
lea ebp, [ecx + edi]
jmp 0x7a4d1d
btc edx, ebx
mov ecx, eax
pop dword [esp + 0x12]
pop dword [esp + 0xe]
ror eax, 0x1f
rcl bx, cl
jmp 0x7a4da0
lea edx, [eax*4]
not si
setne dh
lea ebp, [ecx + edi]
xchg ecx, edi
neg bh
jmp 0x7a4d4f
pop dword [esp + 0xd]
pop word [esp + 5]
mov di, 0x7235
lea edi, [ebx + edi]
xchg word [esp + 0xe], bx
jmp 0x7a4d70

Function at 0x7a4f22
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7a4f38
cld
mov byte [esp + 2], dh
pop word [esp + 1]
xchg byte [esp + 1], bl
xchg ch, dl
jmp 0x7a5929
lea esp, [esp + 4]
setbe ch
push word [esp + 2]
lea esp, [esp + 1]
lea esp, [esp + 4]
popal
call fcn.007a4fce
bswap eax
rdtsc
btr edi, esp
mov edi, dword [esp]
rol bx, cl
btr edi, edx
jmp 0x7a4fe7
lea edi, [esi*4]
lea esp, [esp + 1]
xchg word [esp], di
push edx
xchg dword [esp], ebx
mov word [esp + 2], sp
jmp 0x7a503a
pop dx
xchg dword [esp], ebp
pop word [esp + 1]
mov dl, dh
shl dx, cl
setp ch
jmp 0x7a50aa
mov eax, esi
xchg word [esp + 1], bp
mov ebp, dword [esp + 1]
mov dword [esp + 1], ecx
bsr bx, bp
mov bp, 0xb04b
jmp 0x7a50dc
add esp, 1
mov dx, 0x3db7
mov ch, byte [esp + 3]
rdtsc
push word [esp + 5]
lea esp, [esp + 3]
jmp 0x7a5802

Function at 0x7a7188
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov byte [esp + 2], bh
lea esp, [esp + 1]
push word [esp + 1]
push dword [esp]
lea esp, [esp + 1]
Function at 0xc5ead0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
jmp 0xc8d0b2
jmp 0xc8c8c3
mov edi, ebp
movzx ebx, byte [esi + 0x11]
jmp 0xc8c8fe
lea esp, [esp + 0x24]
cmp eax, 1
jmp 0xc8c9a1
xchg edx, edi
mov ecx, 0xff
jmp 0xc5eb00
lea edi, [ebp + 0xe7]
rol di, cl
jmp 0xc8c964
lea ecx, [eax - 1]
mov dword [ebp - 4], ecx
mov bl, 0xde
mov edx, esp
lea edi, [esi*4]
jmp 0xc8c8f2
mov edx, dword [esi]
mov edi, 0x66a64b0c
lea edi, [edx + esi]
lea edi, [esp + ecx]
jmp 0xc8c97d
add esi, 0x10
lea edi, [eax*4]
mov dh, ch
jmp 0xc8c929
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_GetProcAddress]
mov edi, 0x4780d50
neg edi
bts edx, edi
lea edi, [ecx + 0xcb]
jmp 0xc8c944
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + reloc.KERNEL32.dll_GetProcAddress]
jmp 0xc8ca13
jle 0xc5ea92
lea edi, [ecx + edx]
lea edi, [esp + ebx]
and cl, bh
jmp 0xc8c916
push word [esp + 0xb]
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_GetProcAddress]
jmp 0xc8c9ef
mov byte [esp + 9], dh
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.KERNEL32.dll_GetProcAddress]
sub esp, 0x10
sub esp, 0xa
jmp 0xc8c9b4
inc bl
movzx ebx, byte [esi + 2]
cmc
sub esp, 4
pop word [esp]
jmp 0xc8caa3
clc
and edi, ecx
sub esp, 0x14
mov byte [esp + 5], dh
sub esp, 0x12
jmp 0xc8c9d8
push esp
lea edx, [eax + 0x39]
mov word [esp], di
mov dword [esp + 0x18], ebx
sub esp, 0xc
call fcn.00c8ca3d
add esp, 0xd
pop word [esp + 1]
lea esp, [esp + 1]
and ebx, ecx
pushal
jmp 0xc8cab0
push word [esp + 1]
push edx
pushal
mov cx, 0xf2b
jmp 0xc8ca56
mov byte [esp + 4], ah
lea esp, [esp + 0x19]
sub esp, 0x1c
lea esp, [esp + 3]
jmp 0xc8cbca
and edx, ecx
sub esp, 0xe
mov dword [esp + 7], eax
lea esp, [esp + 2]
jmp 0xc8cb2a
lea eax, [eax*4]
lea eax, reloc.KERNEL32.dll_GetProcAddress
mov edx, dword [eax]
pop eax
jmp 0xc8cadf
mov byte [esp + 1], dh
lea esp, [esp + 3]
push eax
mov eax, edx
jmp 0xc8cafb
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_GetProcAddress]
xor dx, 0x6388
lea edx, [ebp*4]
jmp 0xc8cb7a
clc
and edx, ecx
clc
push edx
add esp, 1
jmp 0xc8cb1d
push ebx
pushal
rcr edi, 3
neg ebx
jmp 0xc8cb5e
mov dword [esp + 0x10], esi
pushal
push dword [esp + 0x1c]
mov byte [esp + 0x19], bh
lea esp, [esp + 0x24]
popal
jmp 0xc8cb9b
mov edx, dword [esi + 4]
cmc
stc
stc
sub esp, 0xc
jmp 0xc8cb51
lea esp, [esp + 2]
jmp 0xc8cbaf
mov dword [ebx], edi
pop ebx
sub esp, 6
lea edi, [eax + edx]
mov edi, dword [esp + 1]
xchg word [esp + 3], di
jmp 0xc8cb85
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_GetProcAddress]
sub esp, 0x18
jmp 0xc8cc14
lea esp, [esp + 0x34]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_GetProcAddress]
shr bx, cl
movzx ebx, byte [esi + 5]
jmp 0xc8cb47
shr edi, 0x18
call fcn.00c8cc1e
test byte [eax], al
xchg esi, eax
int1
add byte [ebp + 0x342dbd3a], dh
invalid
clc
push esp
mov word [esp], sp
jmp 0xc8cbe1
pushal
bswap esi
mov dword [esp], edx
popal
cmc
jmp 0xc8cbfd
lea esp, [esp + 9]
lea esp, [esp + 3]
mov edi, dword [esp + 0x14]
mov bl, bh
bswap ebx
jmp 0xc8d0f6
lea esp, [esp + 0x18]
pop esi
mov ebx, dword [esp]
pop ebx
jmp 0xc8d136
Function at 0xc67b30
Capabilities:
Encode data using xor

Disassembly:
sub ecx, 0x1000
cmc
pushal
call fcn.00c67b5b
lodsd eax, dword [esi]
iretd
lea esp, [esp + 0xc]
jae 0xc67a18
jb 0xc67a32
daa
dec esi
fnstcw word [eax]
sbb esi, dword [edx + 0x1f]
invalid

Function at 0xc8c6ae
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push word [esp + 1]
call fcn.00c8c6d7
les ecx, [eax - 0x22]
mov ecx, 0xe56af748
jne 0xc8c6de
out dx, eax
push edx
xchg esp, eax
dec eax
mov edi, 0x34c5a22c
int1
stosd dword es:[edi], eax
cmp dword [ecx - reloc.KERNEL32.dll_GetProcAddress], ebp
sti

Function at 0xc8c6d7
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
mov eax, dword [edx - 8]
not di
jmp 0xc8c758
pushal
call fcn.00c5ead0
push ecx
sub esp, 0xe
lea esp, [esp + 2]
lea esp, [esp + 0x40]
test ebx, ebx
call fcn.00c8c6ae
jmp 0xc8c729
mov ebx, ebp
lea ebx, [ebx - 8]
mov dword [ebx], eax
pop ebx
jmp 0xc8c6c5
lea ecx, [esi + 8]
jmp 0xc5eaa8
lea edx, [esi + ebx*4 + 8]
mov al, ah
seto al
jmp 0xc8c6f7
lea esp, [esp + 2]
lea esp, [esp + 8]
jle 0xc5eac9
mov dl, 0xec
jmp 0xc8c70d
lea esp, [esp + 2]
push ebx
jmp 0xc8c6ed
mov edi, dword [ecx - 8]
stc
call fcn.00c8cacf
je 0xc8c751
jl 0xc8c780
test byte [ecx + 0x66], 3
xchg ebx, eax
test byte [0xf0f146c1], 0xf3
cmc
clc
stc
sub esp, 0x1c
jmp 0xc8c798
fistp word [esi]
test dword [reloc.KERNEL32.dll_GetProcAddress], edx
cmpsd dword [esi], dword es:[edi]
into
pop ecx
mov dword [edx - 8], edi
cmc
pushal
sub esp, 4
mov edi, dword [ecx - 4]
jmp 0xc8c773
mov dword [ecx - 4], eax
jmp 0xc8c7ea
lea ecx, [ecx - 4]
mov dword [ecx], edi
pop ecx
jmp 0xc8c85b
push ecx
mov ecx, edx
jmp 0xc8c7bb
mov eax, dword [edx]
jmp 0xc8c7d3
mov dword [edx], edi
mov edi, dword [ecx + 4]
mov dword [ecx + 4], eax
jmp 0xc8c837
mov dword [esi], edi
pop esi
lea esp, [esp + 0x50]
sub ebx, 4
clc
jmp 0xc8c83f
mov ebp, edx
lea ebp, [ebp + 4]
mov eax, dword [ebp]
pop ebp
jmp 0xc8c809
push esi
mov esi, edx
lea esi, [esi + 4]
jmp 0xc8c813
sub esp, 0xa
pop word [esp + 1]
jmp 0xc8c8a7
mov edi, dword [ecx]
mov dword [ecx], eax
push ebp
jmp 0xc8c82c
lea esp, [esp + 8]
add ecx, 0x10
sub edx, 0x10
call fcn.00c8c87d
pushal
mov eax, dword [ebp - 8]
lea esp, [esp + 0x20]
jmp 0xc5eac9

Function at 0xc8c801
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esi], eax
pop esi
mov eax, dword [edx - 4]
sub esp, 0xc
jmp 0xc8c78b
push esi
mov esi, ecx
lea esi, [esi - 8]
jmp 0xc8c7b0
lea esp, [esp + 0x20]
add dword [ebp - 4], 4
push edx
push word [esp + 1]
lea esp, [esp + 2]
jmp 0xc8c801
lea esp, [esp + 1]
add esp, 0
lea esp, [esp + 3]
jmp 0xc8c8db

Function at 0xc8c87d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
lea esp, [esp + 1]
lea esp, [esp + 0x20]
cmp dword [ebp - 4], ebx
call fcn.00c8c882
sbb dl, byte [eax + 0x21906106]
lea ebx, [edi + ebp*2]
jbe 0xc8c801
invalid
add esp, 3
les eax, [ebx]
jmp 0xc8c862

Function at 0xc8c882
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push dword [esp + 2]
jmp 0xc8c88c
mov dword [esp + 3], eax
lea esp, [esp + 8]
jl 0xc5eaa8
mov eax, dword [esp]
lea eax, [esi + edi]
jmp 0xc8c8b6