joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4866b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x78], ebp
je 0x48686d
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x4867e6
mov ecx, dword [esi + 0x94]
sub ecx, eax
mov eax, dword [esp + 0x14]
sar ecx, 4
cmp eax, ecx
jae 0x4867e6
xor ebx, ebx
mov edx, dword [esi + 0x90]
mov eax, dword [esp + 0x10]
add eax, edx
mov ecx, dword [eax + 4]
cmp ecx, ebp
je 0x4867cd
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jae 0x4867cd
mov eax, ecx
mov ecx, esi
mov edi, dword [eax + ebx*4]
push edi
call fcn.00487920
mov ebp, eax
test ebp, ebp
je 0x4867c5
push ebp
mov ecx, esi
call fcn.00488e40
test eax, eax
je 0x4867c5
mov edx, dword [esi + 0x74]
cmp edi, edx
je 0x4867c5
mov eax, dword [esp + 0x10]
xor ecx, ecx
test ebx, ebx
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x90]
add eax, ecx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x486786
xor eax, eax
jmp 0x48678e
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
dec eax
xor ecx, ecx
cmp ebx, eax
lea eax, [edi + 1]
sete cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, edx
sete cl
dec edi
mov dword [esp + 0x30], ecx
xor eax, eax
cmp edi, edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x18]
sete al
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x3c], eax
call fcn.004897e0
inc ebx
xor ebp, ebp
jmp 0x486717
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x4866f0
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
call fcn.00487c30
test eax, eax
pop ebx
je 0x48686d
mov ecx, dword [esi + 0x74]
push ecx
mov ecx, esi
call fcn.00487920
mov edi, eax
cmp edi, ebp
je 0x48686d
push edi
mov ecx, esi
call fcn.00488e40
test eax, eax
je 0x48686d
mov eax, 1
lea edx, [esi + 0x1f8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
call fcn.00487e70
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.00487ee0
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push eax
call fcn.004897e0
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x48f520
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4bf011
push eax
mov dword fs:[0], esp
sub esp, 0xec
push edi
mov edi, ecx
mov eax, dword [edi + 0x5c]
test eax, eax
jne 0x48f55d
xor eax, eax
pop edi
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
add esp, 0xf8
ret
push esi
push 0x400
lea ecx, [esp + 0xc]
call fcn.004b413c
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x10c], 0
call fcn.004b3484
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 1
push ecx
mov ecx, dword [edi + 0x5c]
call fcn.00488230
lea ecx, [esp + 8]
call fcn.004b43e7
lea ecx, [esp + 0x30]
call fcn.004b35e8
mov edx, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x10]
call dword [edx + 0x28]
push 0
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x84]
call fcn.004b3484
lea ecx, [esp + 0x74]
lea esi, [edi + 0x60]
push ecx
mov ecx, esi
mov byte [esp + 0x100], 2
call fcn.004886a0
lea ecx, [esp + 0x74]
call fcn.004b35e8
lea ecx, [esp + 8]
call fcn.004b43e8
mov eax, dword [edi + 0x5c]
lea edx, [esp + 0xb8]
push edx
push 0x3c
mov eax, dword [eax + 0xc8]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call fcn.00485e40
mov edx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [edx + 0xdc]
mov dword [esi + 0xdc], eax
call fcn.00488140
mov ecx, esi
call fcn.00488d80
mov eax, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [eax + 0xe0]
mov dword [esi + 0xe0], eax
call fcn.00488140
mov ecx, esi
call fcn.00488d80
mov ecx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov eax, dword [ecx + 0xe4]
mov ecx, esi
mov dword [esi + 0xe4], eax
call fcn.00488140
mov ecx, esi
call fcn.00488d80
mov ecx, dword [edi + 0x5c]
call fcn.00485620
push eax
mov ecx, esi
call fcn.00485630
mov ecx, dword [edi + 0x5c]
call fcn.00485be0
push eax
mov ecx, esi
call fcn.00485b80
mov ecx, dword [edi + 0x5c]
call fcn.00485d00
push eax
mov ecx, esi
call fcn.00485cb0
mov ecx, dword [edi + 0x5c]
push 0
call fcn.00484f00
push eax
mov ecx, esi
call fcn.00484f10
mov edx, dword [edi + 0x7c]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x74]
mov byte [esp + 0xfc], 1
call fcn.004b3560
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 0
call fcn.004b3560
lea ecx, [esp + 8]
mov dword [esp + 0xfc], 0xffffffff
call fcn.004b4201
mov ecx, dword [esp + 0xf4]
pop esi
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x490da0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4bf237
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.004aa228
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.004aa228
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.004918c0
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x491910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4bf310
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004b6542
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x491943
xor al, al
jmp 0x491a6f
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x491965
xor al, al
jmp 0x491a6f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x491978
xor al, al
jmp 0x491a6f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x49198c
xor al, al
jmp 0x491a6f
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.004aa2d8
test eax, eax
jne 0x4919c0
xor al, al
jmp 0x491a6f
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x5eb334
mov dword [esp + 0x20], ebp
call fcn.004b6542
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.004b3139
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.004b3190
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x491a54
mov ax, word [ebx]
test ax, ax
je 0x491a46
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.00491a90
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x491a2a
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.004b3190
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x491fd0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.004b4825
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x492016
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.0049ae58
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x608af4
push ecx
call fcn.0049c4f1
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x4ae61f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4ae657
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ac69a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ac672
jmp 0x4ae663
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4afe1e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4afe60
call fcn.004b6542
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4afe60
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4afe57
xor eax, eax
jmp 0x4afe68
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004afe6e
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b6a72
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b6aa0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b6abe
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b69d8
jmp 0x4b6abe
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b6abe
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b69d8
test edi, edi
mov eax, edi
jne 0x4b6aa8
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x400400
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
lea eax, [edi + 1]
shr eax, 1
push eax
push esi
push 0
call fcn.0040048d
add esp, 0xc
cmp word [esi], 0x5a4d
movzx ecx, ax
jne 0x400486
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x400486
mov dx, word [eax + 0x18]
cmp dx, 0x10b
je 0x400444
cmp dx, 0x20b
jne 0x400486
mov edx, dword [eax + 0x58]
mov esi, 0xffff
cmp cx, dx
jb 0x40045a
push ebx
movzx ebx, dx
sub ecx, ebx
pop ebx
jmp 0x40045f
sub ecx, edx
and ecx, esi
dec ecx
shr edx, 0x10
cmp cx, dx
jb 0x40046e
movzx edx, dx
sub ecx, edx
jmp 0x400473
sub ecx, edx
and ecx, esi
dec ecx
mov edx, dword [esp + 0x18]
add ecx, edi
mov dword [edx], ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [eax + 0x58]
mov dword [edx], ecx
jmp 0x400488
xor eax, eax
pop edi
pop esi
ret 0x10

Function at 0x4004c3
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4004ef
push 1
pop eax
jmp 0x40054f
push esi
push esi
push esi
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x400508
push 2
pop esi
jmp 0x400546
push edi
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
jne 0x400520
push 3
pop esi
jmp 0x40053c
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push edi
call section.sect_0
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x6628e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
push esp
xchg word [esp], ax
cpuid
mov dword [esp + 4], eax
add esp, 7
jmp 0x662900
jmp 0x6628b8
mov bp, word [esp]
xchg bh, cl
cmc
rdtsc
setnp dh
mov dx, 0x97db
jmp 0x662953
lea ebx, [ebx*4]
pop dx
mov di, sp
mov dx, 0xe461
pop cx
jmp 0x6628e2
xchg ecx, eax
mov esi, 0xeb6261e
sub esp, 0xc
sub esp, 6
stc
push dword [esp + 0xa]
jmp 0x66292d
Function at 0x663225
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 8], edi
rdtsc
pop bp
inc edx
bswap edx
mov dword [esp + 5], ecx
jmp 0x66320e
mov byte [esp + 5], bh
mov cl, 0xba
mov word [esp + 2], dx
xchg word [esp + 0xf], si
mov ah, byte [esp + 3]
setae bh
jmp 0x663190
xchg word [esp + 1], bp
bswap esi
mov ebp, 0xbaaa572c
sub bl, ah
mov byte [esp + 8], ch
mov word [esp + 8], bx
jmp 0x6631b4
pop ebx
xchg dword [esp + 6], ebp
pop bx
mov byte [esp + 0xb], ah
xchg byte [esp + 4], cl
jmp 0x663238
cpuid
mov edx, dword [esp + 5]
xchg dword [esp], ebx
xchg dh, al
mov bp, 0x7b43
push esp
jmp 0x6631f7
neg ax
mov bl, bh
xchg word [esp + 7], cx
mov eax, 0xfd6bdd58
not ebx
jmp 0x6631de
lea ebp, [edx + ebx]
mov ax, bx
mov byte [esp + 8], dh
neg edi
xchg ch, dl
bsf ax, ax
jmp 0x663460
push dword [esp + 0xc]
neg di
xchg dh, al
call fcn.006632cf
mov bx, word [esp + 8]
mov ebx, eax
setns dh
bsr dx, cx
xchg bp, cx
xchg edi, eax
jmp 0x663394
mov ax, word [esp + 2]
cld
pop dword [esp + 6]
rdtsc
mov ebp, ecx
lea ebp, [esp + edi]
jmp 0x663327
mov ebx, dword [esp + 5]
pop dword [esp + 6]
mov word [esp + 6], bx
pushal
clc
pushal
jmp 0x6633ed
xor dx, 0xee3c
pop dword [esp + 8]
lea edx, [ebp - 0x5f]
not bh
lea ebp, [esp + ecx]
mov bx, dx
jmp 0x663371
mov al, ah
xchg word [esp + 3], dx
pop word [esp + 1]
add esp, 1
jmp 0x6633d1
stc
rcl bx, cl
pushal
xchg ah, bl
add esp, 0x15
add esp, 4
jmp 0x6633aa
lea esp, [esp + 3]
sete ah
xchg dx, di
bswap ecx
mov esi, 0xf27a1126
mov ebp, ecx
jmp 0x663449
lea esp, [esp + 0x50]
rdtsc
bswap esi
stc
btr edx, edx
neg ecx
jmp 0x6633c2
lea edx, [ebp - 0x1f]
neg eax
bswap esi
rdtsc
add esp, 0x15
mov edi, esi
jmp 0x663427
mov ebx, ecx
mov bh, byte [esp]
rcl ax, cl
rdtsc
neg edi
pushal
jmp 0x6633fd
mov al, 0xfe
push word [esp + 3]
push dword [esp + 8]
cmc
pop cx
setns bh
call fcn.006634be
insb byte es:[edi], dx
std
insd dword es:[edi], dx
hlt
mov ebx, dword [esp]
xchg ebp, ebx
xchg byte [esp], dl
mov edx, eax
add esp, 0
xchg byte [esp], dl
jmp 0x663418
xchg byte [esp + 6], cl
xchg edx, ebx
push edx
lea ebx, [esi*4]
rdtsc
xchg byte [esp], al
jmp 0x66335e

Function at 0x6632ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, ax
push esp
lea ecx, [esi - 0xed]
pop word [esp + 0x11]
pop edi
jmp 0x663303
mov dword [esp + 1], ebp
mov ecx, 0x2a3eb660
xchg dword [esp + 2], ecx
lea esi, [edx + ebx]
mov si, di
jmp 0x6632d8
not ebp
xchg bh, cl
mov dl, 0xd4
xchg di, ax
xchg edi, eax
xchg dword [esp + 0xe], edi
jmp 0x663335
Function at 0x663629
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 2], bl
bswap ebp
xchg byte [esp + 0x10], al
mov di, word [esp + 0x17]
mov dh, byte [esp + 0x10]
cmc
jmp 0x663670
xchg dword [esp + 0xf], ecx
xchg word [esp], si
cmc
setae ah
xchg dx, ax
jmp 0x663652
sete dh
xchg edi, esi
push word [esp + 0x14]
jmp 0x6635fd
mov dword [esp + 0xf], eax
sub bl, ah
mov esi, ecx
mov cx, sp
pop word [esp + 0xb]
lea esp, [esp + 0xb]
jmp 0x663685
bswap eax
pop dword [esp + 0xe]
mov ecx, ebp
rdtsc
push word [esp + 8]
xor dl, ch
jmp 0x663635
xchg word [esp + 0x10], si
bswap ebx
mov dword [esp + 3], eax
mov ch, byte [esp + 5]
pop di
rdtsc
jmp 0x663613
xchg dword [esp], eax
inc cl
lea ecx, [ebp + 0xb7]
mov word [esp + 2], dx
rol si, cl
jmp 0x6636b5
push dword [esp]
pop dword [esp + 2]
lea edx, [esp + ebp]
mov edx, 0xa9cada60
add esp, 7
mov si, 0x8489
jmp 0x6637a4
xchg byte [esp + 0x30], cl
neg esi
xchg byte [esp + 0x10], cl
xchg ebp, eax
push word [esp + 5]
call fcn.006636ed
sbb byte [esi + 0x4fa66b0c], bl
outsd dx, dword [esi]
jbe 0x66378a
mov al, byte [0x74ff66e3]
and al, 0x17
push word [esp + 0x17]
pop bx
rdtsc
mov word [esp + 0x25], di
mov di, word [esp + 0x1b]
push word [esp + 0x19]
jmp 0x66370a
stc
push word [esp + 0x29]
inc bl
xchg ch, dl
mov eax, dword [esp + 0x2b]
xchg edi, esi
jmp 0x66372b
xchg edi, ebp
mov dl, 0x8c
push word [esp + 0x2d]
mov ecx, eax
lea esi, [esi + 0x17933a8d]
xchg dx, di
jmp 0x66374e
mov edx, edi
call fcn.00663c02
sub ah, byte [eax + 0x42a05136]
push esp
fisttp qword [ebp + 0x14]
out 0x42, eax
cmpsb byte [esi], byte es:[edi]
mov esp, 0xbfe236db
xchg bh, cl
and cx, 0xaea
sub esp, 0x12
sub esp, 0x1c
xchg word [esp + 0x26], di
neg edi
jmp 0x66376e
Function at 0x663c02
Capabilities:
Execute anti-debugging instructions

Disassembly:
setnp ah
mov al, ah
pop dword [esp]
mov edi, 0xb9ade02a
mov esi, dword [esp + 3]
lea ebp, [edx + ebx]
jmp 0x66384f
neg eax
setae ch
pop word [esp + 0xd]
not ax
mov dword [esp + 1], ecx
mov esi, dword [esp + 0xf]
jmp 0x6637db
xchg bx, di
mov bp, word [esp + 2]
mov byte [esp + 4], ah
neg edx
rcr ebp, 9
mov ch, byte [esp + 5]
jmp 0x66387b
cpuid
not ch
lea ebx, [ebx*4]
mov byte [esp + 1], ah
jmp 0x663817
mov di, word [esp]
mov ax, sp
mov word [esp], di
btc ebx, ebx
neg edi
shr ebx, 0x1b
jmp 0x663838
pop dword [esp]
mov byte [esp + 2], dh
mov eax, ebp
inc ax
mov bx, sp
mov ebp, eax
jmp 0x6638e8
clc
xchg dword [esp + 6], eax
rdtsc
mov al, ah
mov cx, di
lea ecx, [edi*4]
jmp 0x663864
mov byte [esp + 0x10], ah
push edx
xchg bp, cx
pop dword [esp + 4]
lea ebx, [ebx + edi]
btc eax, edi
jmp 0x663800
mov esi, 0x62a8bcd0
rdtsc
xchg dword [esp + 6], edx
setns ah
lea edi, [ebx*4]
push dword [esp + 0xa]
jmp 0x663894
rcl ax, cl
bswap ebx
sub esp, 6
mov byte [esp + 0x1a], ah
neg ch
btc eax, ebx
call fcn.0066395f
ficom word [ecx - 0x3f]
mov al, byte [0x8750b253]
fbld tbyte [esi - 0x75]
insb byte es:[edi], dx
and al, 2
xchg edi, ebx
mov bp, word [esp + 2]
sub esp, 0xa
inc di
push edx
not si
jmp 0x6638cb
xchg bp, ax
lea esi, [esp + edi]
pop eax
mov ecx, dword [esp + 0xd]
mov cl, 0xc2
xchg byte [esp + 3], dl
jmp 0x6638b0
mov byte [esp + 7], ah
mov dx, word [esp + 6]
add esp, 3
lea esp, [esp + 9]
neg di
xchg word [esp + 7], cx
jmp 0x663900
lea esp, [esp + 0x1f]
push word [esp + 0x11]
mov ecx, dword [esp + 0x19]
rdtsc
pop word [esp + 5]
xchg dword [esp + 0x14], eax
jmp 0x6639a6
mov bl, 0xc8
rdtsc
jmp 0x6639d6

Function at 0x665aea
Capabilities:
Parse pe header

Disassembly:
push word [esp + 0x17]
push word [esp + 0x1d]
mov dword [esp + 0x13], eax
mov word [esp + 8], sp
jmp 0x665b70
mov dword [esp + 0x13], eax
pop word [esp + 0xf]
mov word [esp + 0x1c], di
call fcn.00665b39

Function at 0x665b13
Capabilities:
Parse pe header

Disassembly:
call fcn.00665aea
push dword [esp + 2]
jmp 0x665b22
mov dword [esp + 1], ecx
call 0x665b46
arpl si, sp
je 0x665b42
out dx, al
pop es
lahf
sbb ecx, dword [ebx - 0x106e212]
leave
sar bh, cl
invalid

Function at 0x665b18
Capabilities:
Parse pe header

Disassembly:
call fcn.00665aea
push dword [esp + 2]
jmp 0x665b22
mov dword [esp + 1], ecx
call 0x665b46
arpl si, sp
je 0x665b42
out dx, al
pop es
lahf
sbb ecx, dword [ebx - 0x106e212]
leave
sar bh, cl
invalid

Function at 0x665b39
Capabilities:
Parse pe header

Disassembly:
call fcn.0066500c
lea esp, [esp + 2]
mov dword [esp + 0x78], esi
call 0x665b18
pop word [esp + 5]
lea esp, [esp + 2]
mov dword [esp + 0x7c], edi
lea esp, [esp + 0x7c]
jmp 0x665b83
mov eax, dword [eax]
jmp 0x665d7a
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x665b59
mov eax, dword [eax + 8]
push eax
jmp 0x665007
Function at 0x665b46
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.0066500c
lea esp, [esp + 2]
mov dword [esp + 0x78], esi
call 0x665b18
pop word [esp + 5]
lea esp, [esp + 2]
mov dword [esp + 0x7c], edi
lea esp, [esp + 0x7c]
jmp 0x665b83
mov eax, dword [eax]
jmp 0x665d7a
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x665b59
mov eax, dword [eax + 8]
push eax
jmp 0x665007
Function at 0x401e40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
imul eax
mov ebx, 0xd9
sub edi, 0xf6
sub edx, 0xbf
imul eax
dec esi
mov esi, 0x9f
not esi
bswap ebx
rcl eax, 7
sbb esi, 0x6a
dec edi
rol edi, 0x55
sub edi, 0x58
rcl edi, 0x15
neg esi
imul esi
rol ebx, 0x82
mov ebx, 0xad
neg eax
neg eax
dec esi
ror eax, 0x63
imul edx
imul esi
and ebx, 0x31
inc eax
dec edx
rol edi, 0xe6
mov ebx, 0xfb
rcl esi, 0x4c
and esi, 0x33
inc edx
sbb edi, 0x81
ror edi, 0xca
rol edi, 0x4e
dec edi
ror edi, 0x50
mov edi, 0xb6
or edx, 0xa0
sub edx, 0xaf
dec ebx
inc esi
imul eax
neg ebx
inc edx
or esi, 0xdb
dec eax
imul edx
rol edx, 0x55
xor ecx, ecx
xor edi, edi
inc eax
dec ebx
add eax, 0xfd
sbb esi, 0x4a
sbb edi, 0x48
dec edi
rol edx, 0xef
sbb ebx, 0x3d
sub edx, 0x8f
inc edx
add ebx, 0x94
and esi, 0x1b
and edi, 0x2f
imul ebx
ror edi, 0xfc
mov edi, 0xa6
dec esi
dec esi
neg edx
sub esi, 0x5b
inc edi
sub ebx, 0xe7
add ebx, 0x8a
inc esi
neg esi
mov eax, 0xd2
or ebx, 0x21
neg eax
rcr esi, 0xb
not eax
ror ebx, 0x5d
sub eax, 0x8b
not ebx
add ebx, 0xf4
sbb edx, 0xca
bswap eax
inc edi
mov eax, 0x72
sbb eax, 0x99
or esi, 0xfc
or edi, 0x98
dec esi
rcl ebx, 0xe9
neg edi
rcr eax, 0x56
dec esi
neg ebx
and esi, 0x3d
imul eax
not eax
mov ecx, dword [ebp + 0xc]
sbb ebx, 0xc0
not edi
dec edi
imul esi
and esi, 0xc5
imul edi
imul esi
neg eax
inc edi
or eax, 0xca
rcr ebx, 0x8d
add ebx, 0xe9
and edx, 0x92
inc esi
neg esi
dec eax
add ebx, 0xd8
sub eax, 0x96
neg edx
bswap edx
neg eax
dec edi
rcr ebx, 0xcd
inc eax
or eax, 0xb3
imul edx
rcl ebx, 0x8a
imul eax
sbb eax, 0x12
not esi
mov ebx, 0xe2
not edx
mov esi, 0x24
inc eax
imul esi
imul eax
bswap esi
rcr edx, 0xd9
not esi
not edx
bswap eax
imul ebx
imul edi
mov eax, 0xe6
sub edx, 3
rcr esi, 0x61
bswap edx
dec eax
mov edi, 0xeb
sbb esi, 0xf5
mov edi, dword [ebp + 8]
mov eax, ebx
xor esi, eax
mov ebx, ebx
not byte [edi]
mov esi, eax
mov esi, ebx
mov esi, ebx
xor esi, ebx
mov esi, eax
mov eax, esi
xor esi, eax
xor eax, eax
xor esi, eax
add byte [edi], 0x87
mov eax, ebx
mov esi, esi
mov eax, ebx
xor ebx, eax
xor eax, ebx
xor esi, ebx
xor esi, eax
xor ebx, eax
mov ebx, ebx
sub byte [edi], 0x54
mov esi, ebx
mov esi, eax
xor ebx, esi
mov ebx, ebx
xor eax, eax
xor eax, ebx
mov esi, eax
xor esi, ebx
xor ebx, ebx
imul byte [edi]
inc edi
loop 0x40200e
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40782a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x438694]
jne 0x407834
repz ret
jmp fcn.0040c205