joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9b80
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406e54
mov eax, dword [ebp - 8]
call fcn.00406e54
xor eax, eax
push ebp
push 0x4a9c4f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00406ef8
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x4a9c2d
push 0x24
mov eax, dword [ebp - 8]
call fcn.00406ef8
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x4a9c27
lea eax, [ebp - 0x24]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x4a9c21
lea eax, [ebp - 0x24]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4a9c21
jmp 0x4a9c1b
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x24]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4a9c21
cmp edi, dword [ebp - 0x10]
ja 0x4a9c21
cmp dword [ebp - 0x20], 1
jne 0x4a9bfc
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x20], 1
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9c56
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406e64
ret

Function at 0x4aa840
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406e54
mov eax, dword [ebp - 8]
call fcn.00406e54
xor eax, eax
push ebp
push 0x4aa8fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
dec esi
je 0x4aa87b
dec esi
je 0x4aa8a3
dec esi
je 0x4aa8c5
jmp 0x4aa8e2
mov eax, dword [ebp - 8]
call fcn.0041195c
test al, al
je 0x4aa8e2
mov eax, dword [ebp - 8]
call fcn.004119a4
mov edx, eax
and edx, 0xfffffffe
mov eax, dword [ebp - 8]
call fcn.004119b8
test eax, eax
sete bl
jmp 0x4aa8e2
mov eax, dword [ebp - 8]
call fcn.0041195c
test al, al
je 0x4aa8e2
mov eax, dword [ebp - 8]
call fcn.00406ef8
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4aa8e2
mov eax, dword [ebp - 8]
call fcn.00406ef8
push eax
mov eax, dword [ebp - 4]
call fcn.00406ef8
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa904
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406e64
ret
Function at 0x4aa90c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffd84
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x127c], ecx
mov dword [ebp - 0x1270], ecx
mov dword [ebp - 0x1274], ecx
mov dword [ebp - 0x1278], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406e54
xor eax, eax
push ebp
push 0x4aaa95
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
lea eax, [ebp - 0x1010]
mov edx, 0x1000
call fcn.004aa140
mov eax, dword [ebp - 0xc]
shr eax, 2
mov edi, eax
dec edi
test edi, edi
jl 0x4aaa6f
inc edi
lea ebx, [ebp - 0x1010]
mov eax, dword [ebx]
push eax
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x4aaa65
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, esi
call fcn.004aa164
push 0x25a
lea ecx, [ebp - 0x126a]
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.004aa194
cmp byte [ebp - 5], 0
je 0x4aaa16
lea edx, [ebp - 0x1270]
mov eax, dword [ebp - 4]
call fcn.00411c90
mov eax, dword [ebp - 0x1270]
push eax
lea eax, [ebp - 0x1278]
lea edx, [ebp - 0x126a]
mov ecx, 0x12d
call fcn.00407054
mov eax, dword [ebp - 0x1278]
lea edx, [ebp - 0x1274]
call fcn.00411c90
mov eax, dword [ebp - 0x1274]
pop edx
call fcn.004107b0
test eax, eax
sete al
jmp 0x4aaa3f
lea eax, [ebp - 0x127c]
lea edx, [ebp - 0x126a]
mov ecx, 0x12d
call fcn.00407054
mov eax, dword [ebp - 0x127c]
mov edx, dword [ebp - 4]
call fcn.004107b0
test eax, eax
sete al
test al, al
je 0x4aaa5f
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle_1
add ebx, 4
dec edi
jne 0x4aa980
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aaa9c
lea eax, [ebp - 0x127c]
mov edx, 4
call fcn.00406e64
lea eax, [ebp - 4]
call fcn.00406e5c
ret
Function at 0x4aaef4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov edi, eax
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x20]
push eax
mov eax, edi
call fcn.00406ef8
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4aaf92
mov eax, ebx
call fcn.00404204
mov esi, eax
push esi
push ebx
push 0
mov eax, edi
call fcn.00406ef8
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4aafa0
push esi
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 8]
shr edx, 0x10
mov ecx, dword [ebp - 8]
mov word [ecx], dx
movzx edx, word [eax + 8]
and dx, 0xffff
mov ecx, dword [ebp - 0x10]
mov word [ecx], dx
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov ecx, dword [ebp + 0xc]
mov word [ecx], dx
movzx eax, word [eax + 0xc]
and ax, 0xffff
mov edx, dword [ebp + 8]
mov word [edx], ax
mov edx, ebx
mov eax, esi
call fcn.00404220
mov byte [ebp - 0x11], 1
movzx eax, byte [ebp - 0x11]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401abb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f090]
jne 0x401ac5
repz ret
jmp fcn.00402ea8

Function at 0x40c092
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d19
and dword [ebp - 4], 0
cmp dword [0x433b00], 0
mov ebx, eax
jne 0x40c143
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c1f4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40c1f4
push eax
call fcn.00404ca7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x433b00], eax
call esi
push eax
call fcn.00404ca7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x433b04], eax
call esi
push eax
call fcn.00404ca7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x433b08], eax
call esi
push eax
call fcn.00404ca7
pop ecx
mov dword [0x433b10], eax
test eax, eax
je 0x40c143
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404ca7
pop ecx
mov dword [0x433b0c], eax
mov eax, dword [0x433b0c]
cmp eax, ebx
je 0x40c19b
cmp dword [0x433b10], ebx
je 0x40c19b
push eax
call fcn.00404d22
push dword [0x433b10]
mov esi, eax
call fcn.00404d22
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c19b
test edi, edi
je 0x40c19b
call esi
test eax, eax
je 0x40c192
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c192
test byte [ebp - 0xc], 1
jne 0x40c19b
or dword [ebp + 0x10], 0x200000
jmp 0x40c1d4
mov eax, dword [0x433b04]
cmp eax, ebx
je 0x40c1d4
push eax
call fcn.00404d22
pop ecx
test eax, eax
je 0x40c1d4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c1d4
mov eax, dword [0x433b08]
cmp eax, ebx
je 0x40c1d4
push eax
call fcn.00404d22
pop ecx
test eax, eax
je 0x40c1d4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433b00]
call fcn.00404d22
pop ecx
test eax, eax
je 0x40c1f4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c1f6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d9d3
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x1baa12c], 0x930
jne 0x40d9ed
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp dword [0x1baa12c], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x1ba9e48], eax
jne 0x40da0d
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
leave
ret
Function at 0x40da17
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor edx, edx
cmp dword [ebp + 0xc], edx
jle 0x40da54
and dword [ebp - 4], 0
and dword [ebp - 8], 0
lea ecx, [ebp - 8]
call fcn.0040da0f
mov eax, dword [ebp - 8]
add eax, 0x46
mov dword [ebp - 4], eax
sub dword [ebp - 4], 0x28
sub dword [ebp - 4], 0x1e
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edx
xor byte [eax], cl
inc edx
cmp edx, dword [ebp + 0xc]
jl 0x40da23
cmp dword [ebp + 0xc], 0x2d
jne 0x40da6b
or dword [0x1baa13c], 0xffffffff
mov dword [0x1baa138], 0xa62e7790
leave
ret
Function at 0xefdf7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, ch
mov cx, word [esp]
dec esi
lea eax, [eax*4]
jmp 0xefdfa7
xchg dword [esp], eax
pushal
mov si, bx
btr ecx, edi
btc esi, ecx
lea eax, [eax + 0x2b]
jmp 0xefdff3
mov cx, word [esp]
rcl edi, 7
mov ch, byte [esp]
not bh
xchg dword [esp + 0x20], eax
rcr ebx, 9
jmp 0xefdfd4

Function at 0xefdfc3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0eef394
jmp 0xefdf41
mov byte [esp + 2], dl
lea esp, [esp + 2]
mov dword [esp + 0x3c], esi
jmp 0xefdf1c
mov byte [esp + 2], dl
lea esp, [esp + 2]
mov dword [esp + 0x3c], esi
call fcn.00efdf3e
mov byte [esp + 2], dh
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0xefdf57
btr si, dx
jg 0xefdf75
mov bx, word [esp]
clc
bsf edx, esp
jmp 0xefdf91
pushfd
jmp 0xefde8f
clc
bsf edx, esp
call fcn.00efdf7b
mov bx, word [esp]
jmp 0xefdf5d
mov ebp, dword [esp + 0x2c]
call 0xefdfdc
add edx, 0x78857c01
jmp 0xeff340
push word [esp + 3]
js 0xefdf10
jns 0xefdefa
neg cx
call fcn.00efe008
mov byte [esp + 1], ch
jmp 0xefe07c
add edx, 0x79615207
jmp 0xeff379
mov esi, esp
bsf dx, ax
jno 0xefe057
inc edx
jmp 0xefe058
cpuid
lea edx, [ebp*4]
bswap edx
sub esp, 0xbc
jmp 0xefe02e
inc edx
mov ecx, ebp
jmp 0xefe060
mov edx, dword [esp]
bswap edx
mov dx, 0x74bd
pushfd
mov ah, byte [esp + 1]
push dword [esp]
jmp 0xefe090
pop word [esp]
push ebp
lea esp, [esp + 2]
lea edi, [esp + 4]
mov esi, 0xbcc9ca2a
jmp 0xefe044
jp 0xefe0a6
pop dword [esp]
sub esp, 0xb
jmp 0xefe2d0
pop dword [esp]
sub esp, 0xb
lea esp, [esp + 3]
jmp 0xefe21f
lea esp, [esp + 0xc]
xor ebp, 0x43568f03
xchg al, bh
xchg ah, al
call fcn.00efe1d9
mov dx, 0x56bb
rdtsc
jmp 0xefe276
add ebp, dword [edi]
call fcn.00efe255
bsf ebx, esi
lea esp, [esp + 1]
jmp fcn.00efe2b9
lea esp, [esp + 3]
jmp 0xefe21f
bswap eax
neg al
jno 0xeff374
lea eax, [edx + ebx]
jmp 0xeff35e
mov edx, dword [edx - reloc.WINMM.dll_PlaySoundA]
mov ax, bx
mov ax, word [esp]
jmp 0xeff38f
lea eax, [edx + ebx]
jmp 0xeff35e
call 0xeff3e9
inc edi
rol dword [ebx + 0x26], cl
aad 0x17
fist word [edx + ecx*8 - 0x53]
pop esp
lahf
inc ecx
ret
mov ax, word [esp]
jmp 0xefdfe5
Function at 0xefdfdc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0eef394
jmp 0xefdf41
mov byte [esp + 2], dl
lea esp, [esp + 2]
mov dword [esp + 0x3c], esi
jmp 0xefdf1c
mov byte [esp + 2], dl
lea esp, [esp + 2]
mov dword [esp + 0x3c], esi
call fcn.00efdf3e
mov byte [esp + 2], dh
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0xefdf57
btr si, dx
jg 0xefdf75
mov bx, word [esp]
clc
bsf edx, esp
jmp 0xefdf91
pushfd
jmp 0xefde8f
clc
bsf edx, esp
call fcn.00efdf7b
mov bx, word [esp]
jmp 0xefdf5d
mov ebp, dword [esp + 0x2c]
call 0xefdfdc
add edx, 0x78857c01
jmp 0xeff340
push word [esp + 3]
js 0xefdf10
jns 0xefdefa
neg cx
call fcn.00efe008
mov byte [esp + 1], ch
jmp 0xefe07c
add edx, 0x79615207
jmp 0xeff379
mov esi, esp
bsf dx, ax
jno 0xefe057
inc edx
jmp 0xefe058
cpuid
lea edx, [ebp*4]
bswap edx
sub esp, 0xbc
jmp 0xefe02e
inc edx
mov ecx, ebp
jmp 0xefe060
mov edx, dword [esp]
bswap edx
mov dx, 0x74bd
pushfd
mov ah, byte [esp + 1]
push dword [esp]
jmp 0xefe090
pop word [esp]
push ebp
lea esp, [esp + 2]
lea edi, [esp + 4]
mov esi, 0xbcc9ca2a
jmp 0xefe044
jp 0xefe0a6
pop dword [esp]
sub esp, 0xb
jmp 0xefe2d0
pop dword [esp]
sub esp, 0xb
lea esp, [esp + 3]
jmp 0xefe21f
lea esp, [esp + 0xc]
xor ebp, 0x43568f03
xchg al, bh
xchg ah, al
call fcn.00efe1d9
mov dx, 0x56bb
rdtsc
jmp 0xefe276
add ebp, dword [edi]
call fcn.00efe255
bsf ebx, esi
lea esp, [esp + 1]
jmp fcn.00efe2b9
lea esp, [esp + 3]
jmp 0xefe21f
bswap eax
neg al
jno 0xeff374
lea eax, [edx + ebx]
jmp 0xeff35e
mov edx, dword [edx - reloc.WINMM.dll_PlaySoundA]
mov ax, bx
mov ax, word [esp]
jmp 0xeff38f
lea eax, [edx + ebx]
jmp 0xeff35e
call 0xeff3e9
inc edi
rol dword [ebx + 0x26], cl
aad 0x17
fist word [edx + ecx*8 - 0x53]
pop esp
lahf
inc ecx
ret
mov ax, word [esp]
jmp 0xefdfe5

Function at 0xefe255
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
rol ax, 2
jg 0xefe296
jle 0xefe27d
pop ebx
int3
bsf ebx, esi
lea esp, [esp + 1]
jmp fcn.00efe2b9
Function at 0xefeac4
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, eax
mov ah, byte [esp]
mov dx, 0x7137
mov dx, 0xce59
jmp 0xeff13c
rdtsc
bsr eax, ebx
mov eax, 0xb0b0986a
pushfd
xchg dword [esp + 4], ebx
jmp 0xefeaae
btr edx, ebp
lea eax, reloc.WINMM.dll_PlaySoundA
lea ebx, reloc.WINMM.dll_PlaySoundA
bswap eax
mov edx, ecx
bswap edx
xchg dword [esp + 4], ebx
jmp 0xefed0c

Function at 0xeff159
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, esp
push si
jmp 0xeff163
mov dl, 0xc2
not dx
pushal
lea esp, [esp + 2]
jmp 0xeff1a3
mov edx, dword [esp]
jmp 0xeff1ef
lea esp, [esp + 0x20]
xor bl, 0x9f
mov dh, byte [esp]
mov dh, byte [esp]
bt ax, bp
jmp 0xeff1ba
jns 0xeff18d
mov edx, dword [esp]
jmp 0xeff1ef
setg dl
rol al, 2
setp ah
rcr dl, cl
jmp 0xeff235
inc bl
mov dl, byte [esp]
neg ah
js 0xeff1d9
jns 0xeff264
rcr dl, cl
jmp 0xeff235
inc dl
jae 0xeff21f
lea eax, reloc.WINMM.dll_PlaySoundA
jmp 0xeff242
lea eax, reloc.WINMM.dll_PlaySoundA
jmp 0xeff242
not bl
rdtsc
xchg dl, dh
rdtsc
lea edx, [edx + ebp]
jmp 0xeff1fe
xor bl, 0x2c
mov dh, al
sete dl
lea eax, [edx*4]
rdtsc
jmp 0xeff285
setg dl
rol al, 2
setp ah
jmp 0xeff1fa
dec bl
lea edx, [ebp*4]
not ax
jmp 0xeff28c
ror al, 2
ja 0xeff26f
jbe 0xeff26f
sete al
setp ah
jmp 0xeff3aa
shl edx, 2
jp 0xeff2e0
mov al, byte [esp]
mov ah, 0x60
mov ax, word [esp]
jmp 0xeff327
not ah
push bx
mov eax, 0x5d8a7bcb
lea esp, [esp + 2]
jmp 0xeff2bb
mov al, byte [esp]
mov ah, 0x60
jmp 0xeff2ec
mov ax, word [esp]
lea eax, [edi + 0xfe]
xchg ah, al
setne al
neg al
jmp 0xeff356
setne al
popal
lea eax, [ecx*4]
jmp 0xeff2d1
jmp 0xefdf9a
lea eax, [edi + 0xfe]
xchg ah, al
jmp 0xeff2f8
jmp 0xeff304
jp 0xeff311
jnp 0xefdf9a
pushal
mov al, 0x93
mov dword [esp + 0x14], ebx
stc
jns 0xeff33e
setne al
popal
lea eax, [ecx*4]
not ah
jmp 0xeff2d3
Function at 0xf00159
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0eef394
jmp 0xf001e2
push word [esp + 3]
jle 0xf001bd
mov word [esp + 3], cx
jmp 0xf00198
mov dword [esp + 0x48], esi
jmp 0xf001d2
mov word [esp + 1], bp
push dword [esp]
lea esp, [esp + 2]
jmp 0xf00182
mov word [esp + 3], cx
mov word [esp + 1], bp
push dword [esp]
lea esp, [esp + 2]
mov dword [esp + 0x48], esi
pushfd
lea esp, [esp + 3]
call fcn.00f001a6
pushfd
jmp 0xeffe80
or ebx, 0x8b695eba
jne 0xf00271
je 0xf00271
xchg esp, eax
pop es
scasb al, byte es:[edi]
call fcn.00f00221
dec bx
jmp 0xf002af
jmp 0xf002c6
les ebx, [edx + 0x3d]
int3
sub esp, 0xac
mov ebp, esp
bsf ecx, esp
jge 0xf00299
jl 0xf00301
out dx, al
ja 0xf002a8
xor byte [ecx - 0x37], 0xea
add eax, 0xb5148d
add byte [eax], al
add byte [ebp + 0x8d1c], cl
add byte [eax], al
lea edx, [esi*4]
lea ebx, [ecx*4]
mov ebx, edi
jmp 0xf002eb
rdtsc
push dx
bsf edx, ebp
jo 0xf0033b
neg cx
lea esp, [esp + 2]
jmp 0xf00386
lea edx, [esi*4]
lea ebx, [ecx*4]
jmp 0xf002d4
neg cx
jmp 0xf00344
lea esp, [esp + 2]
neg al
btr edx, edx
mov dl, byte [esp]
xchg ecx, eax
jmp 0xf00370
neg ecx
jae 0xf00445
lea ecx, [edi*4]
jmp 0xf0044c
neg al
btr edx, edx
mov dl, byte [esp]
jmp 0xf00350
bts cx, bp
jbe 0xf003c4
xchg ch, ah
jmp 0xf003c6
lea ecx, [ebx - 0xd7]
neg dx
jo 0xf003c9
bswap ecx
jmp 0xf003fd
cmc
ror edi, 0
setle cl
bswap edx
jmp 0xf00390
xchg ch, ah
inc edi
jmp 0xf0039a
bswap ecx
mov ah, bh
mov dx, word [esp]
mov ax, bx
jmp 0xf003e7
jmp 0xf003b9
add edi, 0x7fb91256
clc
jne 0xf0042a
rdtsc
mov ecx, edx
jmp 0xf00501
mov ah, bh
mov dx, word [esp]
mov ax, bx
jmp 0xf003e7
setge ah
mov ch, cl
mov cx, 0xfcc7
xchg ecx, eax
neg eax
jg 0xf003e5
cmc
jmp 0xf003ba
rdtsc
jmp 0xf004ff
lea ecx, [edi*4]
add edi, 0x60b15599
jmp 0xf00419

Function at 0xf001a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
jmp 0xf001dc

Function at 0xf00221
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [esp + 0x30]
sub esp, 0x15
jle 0xf0023f
add esp, 3
jmp 0xf00229
lea ebx, reloc.WINMM.dll_PlaySoundA
jmp 0xf0020b
mov bp, word [esp + 8]
pop word [esp + 0xb]
jmp 0xf0024c
add esp, 3
mov bp, word [esp + 8]
pop word [esp + 0xb]
lea esi, [esp + 0x14]
rol bx, 0xc
jmp 0xf0028f
mov bp, sp
setle dh
dec bx
jmp 0xf002af
jle 0xf0025a
mov bp, sp
setle dh
jmp 0xf00276

Function at 0xf659e8
Capabilities:
Encode data using xor

Disassembly:
call 0xf659d2
popal
mov al, byte [0xd7c1ae3]
jl 0xf65a00
loopne 0xf65a0e
xlatb
test al, 0x12
xor al, 0x95
jae 0xf659f1
or al, 0xff
cmp byte [edi + edx*4 - 2], ah
leave
xchg edi, eax
dec cl
ret 4
dec ebx
pushal
push di
fistp word [edi - 0x272af1dd]
lea edx, reloc.WINMM.dll_PlaySoundA
mov edi, 0x8a016a86
mov dx, 0x1c2
Function at 0xfa1911
Capabilities:
Execute anti-debugging instructions

Disassembly:
and eax, 0x9ee69d61
rdtsc
xchg ecx, eax
rdtsc
add esp, 2
not eax
jmp 0xfa18f4
mov ax, 0x5ca6
btr ecx, edx
pop dword [esp]
cmp cl, bh
dec cl
lea eax, [ecx + esi]
jmp 0xfa189c
bts eax, esp
mov dx, bp
mov dl, 0xb9
push eax
bt ecx, edi
mov dx, sp
jmp 0xfa18b2
xchg ah, al
neg dl
mov edx, 0x5002e782
dec ax
sub esp, 0xc
pop edx
jmp 0xfa19a2
bts cx, cx
pop cx
mov cx, word [esp]
mov ecx, dword [esp]
lea edx, [ebp*4]
dec edx
jmp 0xfa18de
mov ecx, dword [esp + 1]
mov edx, 0x9b9ace3b
xchg al, dh
jmp 0xfa18cd
dec dh
not cl
std
not edx
and edx, esp
bsf edx, ebx
jmp 0xfa1960
lea edx, [ebp + ebp]
mov eax, 0x6e95707f
xchg dl, al
mov dh, byte [esp + 1]
clc
lea esp, [esp + 7]
jmp 0xfa191e
mov dh, byte [esp]
lea eax, [edx + 0x93]
btr ecx, ecx
mov byte [esp], bh
jmp 0xfa1985
cmc
not cl
btc eax, eax
shl ch, 1
mov edx, dword [esp]
xchg cl, dl
jmp 0xfa194a
push dword [esp]
sub esp, 7
bswap eax
push dword [esp + 6]
mov ah, bh
jmp 0xfa19f0
not eax
xchg byte [esp], ch
lea esp, [esp]
pushfd
mov dl, byte [esp]
dec cl
jmp 0xfa196f
mov dword [esp + 3], esp
mov cx, di
xchg word [esp + 2], dx
mov byte [esp + 1], ah
xchg dx, ax
lea edx, [eax + edi]
jmp 0xfa1934
add esp, 4
lea edx, [ecx*4]
btc edx, esi
mov dword [esp + 1], ebx
push dword [esp]
pop dword [esp + 9]
jmp 0xfa19da
Function at 0xfa1a43
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 4], ecx
xor ah, dl
push cx
add esp, 6
push edx
pop dword [esp + 5]
jmp 0xfa1a68
mov cx, 0xa2c6
mov dl, byte [esp + 0xa]
rdtsc
pop ecx
mov edx, ebx
jmp 0xfa1a2c
cld
mov dword [esp + 5], esi
pop dx
lea ecx, reloc.WINMM.dll_PlaySoundA
setle dh
jmp 0xfa1ab3
btc ecx, edx
xchg dword [esp + 3], ecx
xchg dword [esp + 3], edx
mov edx, ecx
inc dx
mov eax, dword [esp + 5]
jmp 0xfa1a52
mov edx, ecx
mov edx, 0x13ea53a1
add ah, 0x42
lea ecx, reloc.WINMM.dll_PlaySoundA
jmp 0xfa1ac4
mov al, 0x4a
xchg dword [esp], eax
xchg dword [esp], ecx
mov dx, bp
dec ah
mov dx, 0x9115
jmp 0xfa1a7d
pop cx
cld
xchg byte [esp + 3], cl
neg eax
pop word [esp + 2]
cld
jmp 0xfa1a93
btc ax, bx
push edx
xchg cx, ax
ror edx, 0xd
xchg dh, ah
xchg dword [esp + 5], ecx
jmp 0xfa1c65
inc ch
xchg edx, ecx
mov ecx, 0x81d73fe1
pop dword [esp]
rdtsc
std
jmp 0xfa1be3
pop cx
mov ecx, dword [esp]
mov dh, byte [esp + 5]
btr ecx, ecx
mov byte [esp + 6], bh
mov edx, 0x8985c10
jmp 0xfa1afa
sbb ah, 0x96
mov word [esp + 2], dx
mov ch, 0xbc
push word [esp + 9]
mov al, bl
not dl
jmp 0xfa1b10
mov cl, byte [esp]
mov ax, word [esp]
mov cx, 0x6ca6
bswap edx
sub esp, 8
mov cx, word [esp + 1]
jmp 0xfa1b91
add esp, 3
pop edx
mov dl, byte [esp]
lea ecx, [eax*4]
setne ah
btc edx, edi
jmp 0xfa1b48
lea ecx, [eax + edi]
xchg dx, cx
bsr dx, ax
mov byte [esp + 2], al
jmp 0xfa1bbf
bswap edx
xchg ah, dl
xchg dx, ax
rol cl, 0
bswap ecx
clc
jmp 0xfa1b7b
mov byte [esp + 3], cl
xchg dword [esp + 3], ecx
mov ax, 0x13b
cmp ax, 0xd10b
setle dl
mov dh, 0xa7
jmp 0xfa1b65
xchg dword [esp], edx
lea ecx, [ebp*4]
pushfd
rdtsc
xchg dword [esp + 3], ecx
push dword [esp + 3]
jmp 0xfa1c1f
daa
mov bh, 0xd2
and esi, eax
enter 0xffffffffffffce58, 0xffffffffffffffa9
pop eax
push dword [0x24548766]
add ah, byte [esi - 1]
je 0xfa1c10
xchg word [esp + 2], dx
push word [esp + 2]
mov edx, 0xca8cbf30
add bh, byte [edx - 0x357340d0]
lea ecx, [edx + 0xae]
mov ax, cx
rdtsc
jmp 0xfa1ba8
pop dword [esp + 1]
bswap ecx
ror dx, 0xa
mov edx, dword [esp + 5]
lea ecx, [ecx*4]
add byte [eax], al
add byte [eax], al
not ax
jmp 0xfa1c49
lea edx, reloc.WINMM.dll_PlaySoundA
xchg ah, ch
pop eax
mov word [esp + 6], di
neg eax
mov eax, edi
jmp 0xfa1bff
mov byte [esp], bh
mov edx, 0x4fc4e945
call fcn.00fa1c95
int1
pushal
not byte [ecx + 0x6c1d9160]
jg 0xfa1bd7
lea ecx, reloc.WINMM.dll_PlaySoundA
lea esp, [esp + 5]
mov ecx, 0xa9ea4363
setns al
pop word [esp]
jmp 0xfa1c33
lea ebp, [eax - 0x2b]
invalid
neg ax
stc
mov dx, 0x2b1
bsf ax, bx
rol ax, cl
adc cx, 0xce28
jmp 0xfa1b33

Function at 0xfa1fb6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0x3b92628
mov dword [esp + 3], edx
jmp 0xfa1fd6
Function at 0xfa2336
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0xa36e2319
mov ah, byte [esp + 1]
mov ax, di
jmp 0xfa2352

Function at 0xfa24fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, al
bswap eax
std
add esp, 1
std
jmp 0xfa24ce

Function at 0xfa27cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov eax, dword [esp + 0x19]
cld
mov dx, 0x6236
mov dh, 0xf6
jmp 0xfa27d5
pop word [esp]
jmp 0xfa27b9
lea edx, [eax*4]
mov dx, word [esp]
mov edx, esi
mov dl, bh
mov edx, dword [esp + 0x22]
lea esp, [esp + 0x28]
jmp 0xfa280d
Function at 0x401590
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
mov eax, 0x2aaaaaab
push ebx
mov ebx, dword [0x40b55c]
mov dword [ebp - 4], ecx
mov ecx, ebx
push esi
mov esi, dword [0x40b558]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x401606
push edi
xor edi, edi
cmp dword [edi + esi + 0x14], 0xf
lea eax, [edi + esi]
jbe 0x4015cd
mov eax, dword [eax]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ebx, dword [0x40b55c]
mov eax, 0x2aaaaaab
mov esi, dword [0x40b558]
mov ecx, ebx
inc dword [ebp - 4]
sub ecx, esi
imul ecx
mov ecx, dword [ebp - 4]
add esp, 4
sar edx, 2
add edi, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jb 0x4015c1
pop edi
cmp esi, ebx
je 0x401621
push ecx
mov edx, ebx
mov ecx, esi
call fcn.00402ab0
mov eax, dword [0x40b558]
add esp, 4
mov dword [0x40b55c], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret