joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c310
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4a61c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov eax, dword [0x4dd690]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0xb0], ebx
call fcn.004954bd
mov edx, dword [0x4dd690]
mov dword [esp + 0x3c], edx
cmp esi, ebx
mov byte [esp + 0xac], 1
jne 0x47c36a
mov dword [esp + 0x1c], ebx
jmp 0x47c371
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x1c], eax
push edi
mov ecx, esi
call fcn.00497603
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x40]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
mov edi, 1
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], 0xffffff96
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], edx
call fcn.00493170
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x1c]
cmp eax, ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x1c], ecx
jne 0x47c3c2
mov dword [esp + 0x14], ebx
jmp 0x47c3c9
mov edx, dword [eax + 0x1c]
mov dword [esp + 0x14], edx
cmp dword [esi + 0x44], 0xd
jne 0x47c3e4
mov eax, dword [eax + 0x3c4]
cmp eax, edi
je 0x47c3de
cmp eax, 2
jne 0x47c3e4
mov dword [esp + 0x18], edi
jmp 0x47c3e8
mov dword [esp + 0x18], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
jne 0x47c3f6
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00494af2
mov edi, eax
cmp edi, ebx
jne 0x47c406
xor eax, eax
jmp 0x47c409
mov eax, dword [edi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x47c431
mov ecx, esi
call fcn.00497603
mov edx, dword [edi + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push eax
push 0x4e
push edx
call ebp
mov eax, dword [esp + 0x1c]
push eax
call ebx
test eax, eax
pop edi
je 0x47c44d
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x47c46c
mov esi, dword [esp + 0x10]
push esi
call ebx
test eax, eax
je 0x47c46c
push 1
push 0xd
push pe_nt_image_headers32
push esi
call ebp
lea ecx, [esp + 0x3c]
mov byte [esp + 0xac], 0
call fcn.00493083
lea ecx, [esp + 0xc]
mov dword [esp + 0xac], 0xffffffff
call fcn.00493083
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4
ret
Function at 0x47e180
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x47e1e6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x47e1e6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x47e1c7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x47e570
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x47e5a8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x47f1e0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x47f229
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x47f6a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a6690
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0047f250
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0047f2d0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0047f2d0
lea ecx, [esi + 0xc]
call fcn.0049300e
lea ecx, [esi + 0x10]
call fcn.0049300e
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00480860
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00480860
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00480860
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00493083
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00493083
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4954bd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4954f5
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004934de
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004934b6
jmp 0x495501
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x496d32
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x496d74
call fcn.0049d506
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x496d74
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x496d6b
xor eax, eax
jmp 0x496d7c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00496d82
pop edi
pop esi
pop ebx
ret 4

Function at 0x49da36
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49da64
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49da82
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049d99c
jmp 0x49da82
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49da82
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049d99c
test edi, edi
mov eax, edi
jne 0x49da6c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4a031e
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x4a0346
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x4a0357
push 2
call edi
test ax, ax
jge 0x4a0357
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.00494af2
cmp dword [esi + 0x30], ebx
jne 0x4a0431
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, pe_nt_image_headers32
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.00494af2
cmp eax, dword [esp + 0x34]
jne 0x4a0431
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x4a03cd
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x4a0412
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x4a0431
cmp eax, 0x205
je 0x4a0431
cmp eax, 0x201
je 0x4a0431
cmp eax, 0x204
je 0x4a0431
cmp eax, ebx
jne 0x4a03f8
cmp dword [esp + 0x1c], 0x1b
je 0x4a0431
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x50b614]
jbe 0x4a0427
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x4a038a
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x61fdd7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], ecx
call 0x61fd5f
pushfd
jmp 0x61fe0e
mov dword [esp + 0xc], esp
call fcn.0061fe34
push 0xf0611760
jmp 0x621e22
push dword [esp + 8]
jb 0x61fdf8
mov dword [esp + 0xc], esp
jmp 0x61fdfc
mov dword [esp], esp
lea esp, [esp]
lea esp, [esp + 2]
jmp 0x61fdce
sbb edi, dword [ebx + 0x193c8d92]
lea edi, [ecx + ebx]
lea ebp, [esp]
call fcn.00621c76
add ecx, dword [ebp + reloc.iphlpapi.dll_GetAdaptersInfo]
xchg ebx, eax
push ds
mov ebx, gs
jecxz 0x621ca3
push dword [ebx - 0x1d]
jae 0x621c89
xchg byte [ebp - 0x4e], dh
test byte [edx + 0xbfe9e6], 0
add byte [esp + edx - 0x45], dh
sbb eax, 0xf496f15
xor ebx, ebp
adc dh, al
popal
int1
nop
arpl word [edx - 0xa659ce0], sp
in al, 0xbb
sbb eax, 0xf496f15
xor dword [ebx + reloc.iphlpapi.dll_GetAdaptersInfo], ecx
mov eax, esi
jmp 0x621cd6
pop ss
jle 0x621d1e
mov ah, dh
jmp 0x621d70
call 0xcf01860
sub cl, byte [edi]
mov esp, 0x874178de
retf 0x348a
add eax, 0xca87b106
setb al
mov ah, dh
mov esi, dword [esp + 0x2c]
rdtsc
xchg dx, bx
rdtsc
jmp 0x621c8c
inc ebx
jae 0x621d6b
setb al
jmp 0x621caa

Function at 0x621c76
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ah, bl
bswap eax
xchg bx, ax
jmp 0x621cf6
je 0x621cc7
mov ebx, 0x496f151d
rdtsc
jmp fcn.00621cce
mov ebx, 0x496f151d
rdtsc
sub esp, 0xbc
mov edi, esp
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
neg bx
jmp 0x621cb1
Function at 0x6241b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0611760
jmp 0x62419b
lea esp, [esp + 2]
jmp 0x62410b
lea esp, [esp + 2]
mov dword [esp + 4], edx
pushfd
push dword [esp + 2]
jmp 0x624147
push word [esp + 2]
je 0x6240ba
jne 0x6240c4
push word [esp + 2]
pop word [esp + 3]
mov dword [esp + 8], ebx
pushal
push word [esp + 9]
ja 0x62412c
pop word [esp + 0x18]
pushal
pop word [esp + 0x13]
jmp 0x62414e
mov dword [esp + 4], edx
pushfd
push dword [esp + 2]
jmp 0x6240e3
pop word [esp + 0x18]
pushal
pop word [esp + 0x13]
jmp 0x62412e
jmp 0x624116
mov byte [esp + 0x30], cl
lea esp, [esp + 2]
mov dword [esp + 0x40], esp
mov dword [esp + 0x3c], ebp
jmp 0x624158
push word [esp + 2]
jmp 0x6240e8
mov byte [esp + 0x30], cl
lea esp, [esp + 2]
jmp 0x624136
mov dword [esp + 0x38], esi
pushal
mov dword [esp + 0x14], edx
lea esp, [esp + 0xb]
mov byte [esp + 0xb], bh
lea esp, [esp + 1]
jmp 0x6241cc
mov dh, dl
jmp 0x6241a4
rdtsc
mov ecx, 0x87129137
jmp 0x624185
mov ebp, dword [esp + 0x2c]
rdtsc
lea eax, [edx + ebx]
call 0x6241b3
stc
stc
jl 0x62421f
jge 0x6241f0
aam 0x5a
enter 0x5aaf, 0xffffffffffffffea
mov edi, 0x6b94a2f
sbb al, 0x90
push es
popal
nop
push esp
lea ebx, [ecx + ecx*4]
jl 0x6241f3
mov dword [esp + 0x48], edi
dec eax
lea esp, [esp + 0x48]
pushfd
jmp 0x623e0a
not ecx
jmp 0x624201
lea esi, [esp + 4]
and dh, 0xef
add al, 0x80
out 0xef, al
js 0x6241da
not ecx
jmp 0x624242
bswap eax
sub esp, 0xbc
mov edi, esp
mov bx, word [esp]
jmp 0x624287
jmp 0x6241f0
bswap eax
call 0x624221
push ebx
lds edx, [ebp + 0x3c]
iretd
not ebx
inc bh
jmp 0x6242e5
mov ebx, ebp
mov ecx, esp
pushfd
mov dx, sp
not dx
jmp 0x6242cc
bsf dx, cx
mov ecx, esp
jmp 0x6242e9
btr dx, bp
jg 0x6242b6
bsf dx, cx
mov ecx, esp
lea eax, [eax*4]
jmp 0x6242f9
jb 0x624291
jae 0x624291
lea eax, [eax*4]
sub esp, 5
jmp 0x624333
sub esp, 5
lea esp, [esp + 1]
jmp 0x624337
jmp 0x624571
lea esp, [esp + 1]
rol ebp, 0
clc
jg 0x62431d
rdtsc
sete cl
xor cx, 0x54ab
bswap eax
jmp 0x6243a9
bswap eax
call fcn.0062437a
rdtsc
xchg byte [esp + 0x14], al
jmp 0x624430
lea esp, [esp + 2]
jmp 0x624400
jmp 0x6243d2
jmp 0x624484
lea esp, [esp + 0x38]
dec ebp
mov edx, edi
bt cx, sp
jle 0x6243ea
mov eax, esi
mov cx, 0xf2e0
jmp 0x62448a
lea ecx, [eax + 0x72]
dec ecx
js 0x6243e8
lea esp, [esp + 2]
jmp 0x624400
add ebp, dword [esi]
jmp 0x62445e
bswap edx
not ax
add ax, dx
jp 0x62443c
jnp 0x62443c
sbb ax, 0x5130
je 0x6244c4
bsf eax, ecx
mov ch, byte [esp]
rdtsc
jmp fcn.00624501
mov eax, esi
mov cx, 0xf2e0
xor ebp, 0x5911b0be
jmp 0x624452
bsf eax, ecx
mov ch, byte [esp]
call fcn.00624492
adc edi, eax
mov dh, 0x22
mov dl, bh
xchg dword [esp + 4], eax
push bp
xchg word [esp], dx
jmp 0x624520
mov cx, 0x9067
xchg dx, cx
mov ax, sp
lea esp, [esp + 2]
push dword [esp + 4]
ret 8
rdtsc
sete cl
xor cx, 0x54ab
jmp 0x6243a7
Function at 0x62437a
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
mov eax, dword [esp]
pushal
lea ecx, [esi*4]
jmp 0x624388
lea esp, [esp + 8]
xor ebp, 0x341dabe7
mov dl, ah
jmp 0x624364
lea ecx, [edx*4]
rol ebp, 0
sub esp, 9
jns 0x62441e
js 0x6243c4
and dword [edi + reloc.iphlpapi.dll_GetAdaptersInfo], esp
pop edx
mov ch, 0xa4
xlatb
mov word [esp + 6], bx
bts cx, ax
sub esp, 0x11
jmp 0x6243ae
mov word [esp + 6], bx
bts cx, ax
sub esp, 0x11
rdtsc
xchg byte [esp + 0x14], al

Function at 0x650eb9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x650ed3
jmp 0x651486
xchg dh, cl
mov bx, bp
lea ecx, [eax - 1]
mov edx, 0x22a8300d
not edx
jmp 0x650ec8
lea esp, [esp + 4]
cmp eax, 1
jle 0x612c87
jg 0x650e97
setno bh
push eax
mov eax, ebp
jmp 0x651108
push edi
mov edi, esi
add edi, 0x11
movzx ebx, byte [edi]
jmp 0x651028
pop ebp
mov dl, 0x46
jmp 0x650f4a
mov ebp, ebx
lea ebp, [ebp*4]
lea ebp, reloc.iphlpapi.dll_GetAdaptersInfo
mov ebx, dword [ebp]
jmp 0x650f06
bsr di, ax
rcr di, cl
jmp 0x650f7a
add esi, 0x10
setnp dh
add edi, 0x36130ab7
mov edx, dword [esi]
jmp 0x650f30
cmc
cmc
and edi, ecx
mov edi, dword [edi*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x650f9e
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x650f5a
push si
lea esp, [esp + 2]
jmp 0x650fc8
and ebx, ecx
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
mov bh, byte [esp]
mov bl, 0x2e
jmp 0x650f88
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x650fed
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
and ebx, ecx
jmp 0x650fae
mov edx, dword [edx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
sub esp, 4
jmp 0x65100c
movzx ebx, byte [esi + 5]
and edx, ecx
pushal
jmp 0x650fd7
mov edx, dword [esi + 4]
cmc
cmc
push si
lea esp, [esp + 2]
jmp 0x651081
and edx, ecx
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x650ff6
pop edi
lea edx, [eax - 0x6e]
mov dh, 0x9b
mov di, word [esp]
push ebp
jmp 0x650f1c
lea esp, [esp + 1]
jmp 0x651063
lea ecx, [ecx*4]
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
mov ebx, dword [ecx]
pop ecx
sub esp, 0x1d
jmp 0x651038
mov edi, edx
shr edi, 0x18
pushfd
mov word [esp], ax
call fcn.006510d3
cmc
pushfd
outsd dx, dword [esi]
rol byte [ebx], cl
xchg esi, eax
add al, 0x63
sahf
sub byte [edi + 0x3e89392e], al
mov dword [esi], edi
push ecx
mov ecx, ebx
jmp 0x65104e
add eax, 0xfffffffc
mov dword [eax], ecx
pop eax
mov ecx, 0xff
jmp 0x612c71
pop esi
jmp 0x6514b0
pop edi
mov si, word [esp]
lea ebx, [esp + ebx]
not si
lea esi, [ebp*4]
jmp 0x651470
pop ebx
leave
ret

Function at 0x65116c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x651126

Function at 0x6512a5
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push word [esp + 2]
lea esp, [esp + 2]
and edx, ecx
jmp 0x6512d5
Function at 0x65143f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 1]
jmp 0x651446
lea esp, [esp + 3]
pushal
jmp 0x651429
mov dword [esi + 0xc], edi
lea esp, [esp + 0x20]
jne 0x612c71
je 0x612c87
fistp dword [eax - 0x32]
test eax, 0x2435e858

Function at 0x653fd5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 8]
pop edi
call fcn.0065428e
add byte [ecx + 0x52936001], dl
adc byte [edx], 0x80
out 0x12, eax
cmpsd dword [esi], dword es:[edi]
add byte [edi + 0x5a916207], dl
mov ah, byte [0x24648d54]
and byte [edi], cl
sub dword [ebx], reloc.iphlpapi.dll_GetAdaptersInfo
sti
invalid

Function at 0x6666ae
Capabilities:
Encode data using xor

Disassembly:
push eax
pushfd
lea esp, [esp + 4]
call ecx
jmp 0x66624a
push dword [esi + 4]
push bp
lea esp, [esp + 2]
add eax, edx
jmp 0x666588
mov word [esp + 1], ax
lea esp, [esp + 4]
push ebx
jmp 0x6665a5

Function at 0x75619c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], sp
jmp 0x7561fc
cpuid
bsf eax, esi
bt ecx, edx
mov ebx, eax
lea esi, [eax + edx]
std
jmp 0x7561e4
add esp, 3
lea esp, [esp + 1]
pushal
mov edx, 0xb530b61
rdtsc
lea eax, [edi + 0xde]
jmp 0x7561a3

Function at 0x7562b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edx
lea ebx, reloc.iphlpapi.dll_GetAdaptersInfo
xchg byte [esp + 5], dl
not dh
jmp 0x7562f6
cpuid
lea ecx, [ecx*4]
add esp, 6
xchg byte [esp + 0xb], dh
lea ebp, [ebx*4]
jmp 0x75629d
xchg ebx, esi
mov ah, byte [esp + 5]
not ax
lea ecx, [ebp*4]
cpuid
bsr ebp, esp
jmp 0x7562e0

Function at 0x75676e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 3], ah
mov edi, dword [esp + 4]
pushfd
xchg bx, dx
add esp, 2
jmp 0x7567c6
mov word [esp + 2], si
jmp 0x756758
mov edi, esi
shl ah, cl
mov byte [esp + 1], al
xchg dword [esp], ebx
mov al, ah
mov bp, di
jmp 0x7567a0
sub esp, 7
xchg bx, di
lea esp, [esp + 0xb]
lea esi, [ecx + edx]
bswap edi
mov bx, 0x3e58
jmp 0x756775
pop word [esp]
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
mov dl, byte [esp + 1]
inc di
cmc
mov bx, 0x5760
jmp 0x7567fa
lea esi, [eax + esi]
mov dh, byte [esp + 7]
mov byte [esp + 1], al
mov word [esp + 1], di
inc ebx
inc bh
jmp 0x75678b
xchg ebx, ecx
bswap edi
rdtsc
push dword [esp + 4]
mov cx, 0x6b8
mov edi, eax
jmp 0x75680c
mov edx, esi
mov dl, byte [esp + 1]
xchg di, cx
mov word [esp], ax
mov bl, 0x27
pushfd
jmp 0x7567db
xchg byte [esp + 6], cl
cmc
mov dl, 0xfa
mov esi, 0x693be1d0
push word [esp + 3]
add esp, 8
jmp 0x7568b8
mov ebp, 0xdaf52c59
lea esp, [esp + 3]
xchg byte [esp], al
mov ebx, ecx
pop cx
mov dh, bh
jmp 0x756898
setbe ch
xchg bx, ax
push word [esp]
lea edx, [eax + eax]
mov cx, word [esp]
mov ebp, 0x1e5861bf
jmp 0x756848
lea ecx, [ecx + ecx]
xchg esi, ecx
std
rdtsc
lea ebx, reloc.iphlpapi.dll_GetAdaptersInfo
bswap eax
call fcn.007569f4
int3
mov ah, 0x81
cmc
add esp, 0
xchg byte [esp], ah
add esp, 0
xchg byte [esp], bh
jmp 0x756882
mov si, 0x5f95
sbb edi, 0xf26826da
mov bh, byte [esp + 2]
inc ebp
mov byte [esp + 1], al
bsr eax, edx
jmp 0x75686b
Function at 0x756b5c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], bp
bts ebx, edx
jmp 0x756bdf
lea ebx, [ebx*4]
bswap ecx
cmc
xchg dl, dh
xchg dh, ah
xchg ecx, edi
jmp 0x756bc6
push dword [esp + 3]
pop ecx
mov ah, dh
neg ecx
lea esp, [esp]
push esp
jmp 0x756ba1
pop bx
lea eax, [esp - 0xb9]
mov ebp, dword [esp + 3]
sete al
jmp 0x756c07
mov dl, byte [esp + 4]
std
rdtsc
neg ah
mov esi, 0xace88cea
xchg edx, ebp
jmp 0x756bb7
xchg byte [esp + 2], ch
and dh, ch
inc bx
mov cx, 0x4fa3
rdtsc
cpuid
jmp 0x756c5a
push word [esp + 5]
push word [esp + 4]
std
mov ecx, dword [esp + 7]
pop word [esp + 4]
mov dx, word [esp + 4]
jmp 0x756bf1
pop di
setbe dl
rdtsc
inc ebp
adc bh, 0xe
cld
jmp 0x756cd8
lea edx, [ecx*4]
mov dword [esp + 4], eax
cmp dl, bl
pop ebx
dec bp
dec edx
jmp 0x756c44
rcl ch, 0
pop dword [esp + 0xb]
mov byte [esp + 0x1b], bh
xchg word [esp + 0x18], ax
jmp 0x756ca9
mov dh, cl
btr ax, sp
bswap ecx
btc edx, ebx
pushal
rdtsc
jmp 0x756c6d
sub esp, 4
push dword [esp + 0x12]
xchg word [esp + 7], ax
bsr ebx, ecx
jmp 0x756cbb
neg cx
setg dl
cpuid
cpuid
mov ah, ch
mov ecx, dword [esp + 2]
jmp 0x756c93
mov al, byte [esp + 0xc]
xor bx, si
popal
xchg dword [esp], ebx
lea edx, [eax*4]
cpuid
jmp 0x756d0c
mov bx, 0x790
lea ebp, [edx*4]
not edx
mov word [esp], di
mov edx, 0x42ebc1f7
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
jmp 0x756c83
mov ecx, 0x1facb21
pop dword [esp]
lea esi, [ecx*4]
jmp 0x756d21
mov ecx, 0x5701a936
mov eax, ecx
mov ah, dl
lea esi, [edx + edx]
push word [esp + 1]
rdtsc
jmp 0x756cf6
pop ax
mov word [esp], dx
call fcn.00756d7f
pop edi
rol dword [ecx + 0x20], 1
sar dword [edx], cl
fist word [edx - 0x40]
cmpsd dword [esi], dword es:[edi]
push edx
mov cl, 0x53
retf 0xf965

Function at 0x757d99
Capabilities:
Execute anti-debugging instructions

Disassembly:
not esi
bswap edi
mov bp, si
xchg dword [esp], esi
sub esp, 3
xchg bl, bh
jmp 0x757dd5
push word [esp + 9]
xchg esi, eax
xchg cl, bl
setne ah
add esp, 5
jmp 0x757d83
mov cx, 0x5093
bsr bp, ax
not ebx
lea ebx, [ebx*4]
jmp 0x757dbf
Function at 0x757f3e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x10], si
mov word [esp + 2], bp
mov word [esp + 0x1d], sp
push esi
mov dword [esp + 4], edx
push word [esp + 0x11]
jmp 0x757f5a
btc ax, bx
jmp 0x757f1f
pop dword [esp + 0x16]
push dword [esp + 0x2a]
popal
mov byte [esp + 0x15], bh
mov dx, bp
jmp 0x757fc1
mov di, word [esp + 0xa]
xchg word [esp + 0xa], si
bswap ebp
mov cx, di
push dword [esp + 0x27]
bts edx, esp
jmp 0x757f44
mov esi, dword [esp + 0xe]
rdtsc
mov word [esp + 1], sp
dec di
xchg dword [esp + 0x16], ebp
cld
jmp 0x757fd6
setg ch
push dword [esp + 0xd]
bswap edi
xchg dword [esp + 5], ebp
lea edx, [esp + edx]
btc ebp, esi
jmp 0x757fa1
btr edi, eax
mov bh, dh
bsr edx, edx
pop word [esp + 7]
xchg bp, bx
inc dl
jmp 0x7584c7
add esp, 3
bts si, cx
btr cx, si
cld
sbb esi, eax
cpuid
jmp 0x75804b
xchg ebp, eax
rcl bl, cl
pop word [esp + 1]
pop dword [esp]
mov esi, 0x8382bfac
mov bx, si
jmp 0x757fee
bswap esi
xchg bl, cl
seto al
cld
mov bl, byte [esp + 3]
mov ah, ch
jmp 0x758004
cmc
sub esp, 0x1f
rol bx, cl
lea esp, [esp + 3]
lea esp, [esp + 0x20]
popal
jmp 0x758063
mov si, 0xa5
cpuid
mov ebx, 0xd52727ab
add esp, 0
push word [esp + 1]
sub dh, 0x31
jmp 0x758035
sub esp, 0x1d
mov byte [esp + 0xd], dl
sub esp, 7
mov dword [esp + 0x18], ebx
jmp 0x7580fd
mov ah, ch
rdtsc
pop word [esp + 3]
mov bl, byte [esp + 3]
xchg ebx, edx
mov esi, esp
jmp 0x758025
pop word [esp + 3]
lea esp, [esp + 0xf]
cld
mov eax, dword [esp + 0xa]
mov ecx, edi
pop dx
bswap edi
jmp 0x75807b
push dword [esp + 0x11]
xchg byte [esp + 7], dl
mov bl, 0xff
dec ebp
cpuid
not esi
jmp 0x7581c6
bsr ecx, ecx
mov bp, 0x489
lea ecx, [eax + eax]
mov ax, 0x8f75
lea eax, [edx + ebp]
and edx, 0x8b1f1d47
jmp 0x7583b1

Function at 0x758121
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
lea esp, [esp + 2]
push edi
mov dword [esp], esp
pop word [esp + 1]
jmp 0x75814c