joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb7daa8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x300]
mov eax, dword [ebp - 8]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00672a4c
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00652ce4
mov edx, 0xb7db58
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.004e35a4
mov edx, 0xb7db8c
mov eax, dword [ebp - 0xc]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
mov edx, dword [0xba1fd4]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
call fcn.004e35b0
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.0040429c
mov eax, dword [ebp - 8]
call fcn.0040429c
mov esp, ebp
pop ebp
ret
Function at 0xb7e11c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xb7e300
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
je 0xb7e2e2
lea eax, [ebp - 0xc]
mov edx, 0xb7e318
call fcn.00405284
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
call fcn.004e51c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
call fcn.004e5ca0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
jle 0xb7e1ef
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
push dword [ebp - 0xc]
mov edx, 0xb7e364
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
lea edx, [ebp - 0x20]
call fcn.0040ae2c
push dword [ebp - 0x20]
push 0xb7e378
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040556c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
call fcn.004e5fbc
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0xb7e1a1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
call fcn.004e5ca0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
call fcn.004e51e4
mov eax, dword [ebp - 0xc]
call fcn.004054ac
mov edx, dword [ebp - 0xc]
cmp byte [edx + eax - 1], 0x2c
jne 0xb7e234
mov eax, dword [ebp - 0xc]
call fcn.004054ac
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, 1
call fcn.0040574c
lea eax, [ebp - 0xc]
mov edx, 0xb7e384
call fcn.004054b4
lea eax, [ebp - 0xc]
mov edx, 0xb7e390
call fcn.004054b4
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x300]
mov eax, dword [ebp - 0x14]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00672a4c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x18]
call fcn.00652ce4
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x18]
call fcn.004e35a4
mov eax, dword [ebp - 0x18]
call fcn.00676a48
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
call fcn.004e35b0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x18]
call fcn.0040429c
mov eax, dword [ebp - 0x14]
call fcn.0040429c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb7e307
lea eax, [ebp - 0x20]
call fcn.004051ec
lea eax, [ebp - 0xc]
call fcn.004051ec
ret
Function at 0xb82434
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x661654]
call fcn.00662c60
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x300]
mov eax, dword [ebp - 0xc]
call fcn.00692cf0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64fe28]
call fcn.006505ec
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00672a4c
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x10]
call fcn.00652ce4
mov edx, 0xb824e0
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x10]
call fcn.004e35a4
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
setg byte [ebp - 5]
mov eax, dword [ebp - 0x10]
call fcn.004e35b0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x10]
call fcn.0040429c
mov eax, dword [ebp - 0xc]
call fcn.0040429c
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0xb87aa8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
cld
Function at 0xb8cdfc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xb8cf25
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 8]
call fcn.004051ec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00652ce4
mov edx, 0xb8cf40
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb8cf88
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00652db0
mov edx, dword [ebp - 0xc]
call fcn.00682cb8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.004e35a4
mov edx, 0xb8cf9c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.004e35b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov edx, dword [eax]
call dword [edx + 0x3c]
cmp dword [ebp + 8], 0
jne 0xb8cedd
cmp dword [ebp - 0x14], 0
jle 0xb8cedd
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0040ae2c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov edx, 0xb8cfac
call fcn.004054f8
jmp 0xb8cf0a
cmp dword [ebp + 8], 1
jne 0xb8cf06
cmp dword [ebp - 0x14], 1
jle 0xb8cf06
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0040ae2c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov edx, 0xb8cfac
call fcn.004054f8
jmp 0xb8cf0a
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb8cf2c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405210
ret
Function at 0xb8cfe8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00652ce4
mov edx, 0xb8d124
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0xb8d1bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00652db0
mov edx, dword [0xba1a84]
mov edx, dword [edx]
call fcn.0068332c
mov edx, 0xb8d1d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00652db0
mov edx, dword [ebp - 0xc]
call fcn.00682cb8
mov edx, 0xb8d1ec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00652db0
mov edx, dword [ebp + 0xc]
call fcn.00682cb8
mov edx, 0xb8d200
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00652db0
xor edx, edx
call fcn.00682cb8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.004e35a4
mov edx, 0xb8d214
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.004e481c
mov edx, dword [eax]
call dword [edx + 0x58]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.004e35b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov edx, dword [eax]
call dword [edx + 0x3c]
cmp dword [ebp + 8], 0
jne 0xb8d0f1
cmp dword [ebp - 0x14], 0
jle 0xb8d0f1
mov eax, dword [ebp - 8]
mov edx, 0xb8d224
call fcn.00405240
jmp 0xb8d110
cmp dword [ebp + 8], 1
jne 0xb8d10c
cmp dword [ebp - 0x14], 1
jle 0xb8d10c
mov eax, dword [ebp - 8]
mov edx, 0xb8d224
call fcn.00405240
jmp 0xb8d110
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1310bcc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
push dword [esp + 0x18]
mov dword [esp + 0xe], eax
clc
jmp 0x1310ba2
pop esi
cmc
jmp 0x13112aa
lea esp, [esp + 0x20]
dec eax
jmp 0x1310bc4
cmp eax, esi
call fcn.01310bcc
adc cl, byte [ebp - 0x72fedb9c]
lea esp, [esp + 1]
lea esp, [esp + 3]
lea esp, [esp + 1]
lea esp, [esp + 3]
je 0x1310b2b
jne 0x1310c0b
lea ebx, [edi + ebp*2]
jbe 0x1310c07
add ch, ah
pop es
adc byte [esi], cl
das
xchg ecx, eax
xor al, 0x61
mov al, byte [0x33751ae3]
shr al, 0xa3
invalid
xchg edi, eax
dec cl
clc
cmp byte [eax], cl
call fcn.01310bf5
lea esp, [esp + 8]
jne 0x1310b14
je 0x1310b2b
push 0xac5d228b
mov edi, 0x2245c89
mov word [esp + 5], sp
jmp 0x1310c13
pushfd
mov dword [esp], edi
mov word [esp + 1], si
jmp 0x1311356
stc
cmp byte [eax], cl
call fcn.01310ea7
add ebx, 0x3c
mov eax, dword [ebx]
pop ebx
jmp 0x1311332
lea esp, [esp + 0x10]
cmp word [eax + 0x18], dx
jmp 0x1311312
add eax, ecx
sub esp, 0x10
mov edx, 0x652b3f63
mov edx, 0x10b
jmp 0x13112d5
xor eax, eax
jmp fcn.013110b7
je 0x13110cd
ror eax, 0x1d
dec ax
lea eax, [edx + ebp]
jmp 0x13112fc
and dword [ebp - 0xc], 0
lea edx, [esi - 0x24]
mov dx, bp
mov edx, eax
jmp 0x13112eb
lea esp, [esp + 4]
push esi
call fcn.01311340
mov esi, dword [eax + 0x78]
add esi, ecx
push si
lea esp, [esp + 2]
jmp 0x1311371
mov eax, dword [eax + 0x7c]
push ax
lea esp, [esp + 2]
jmp 0x13113d1
mov dword [ebp - 0x18], eax
call fcn.013113a8

Function at 0x1310bf5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x1310c29
inc esp
in al, dx
fcom dword [eax]
xor al, 0x69
invalid

Function at 0x13f40d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 0x10]
mov ch, 0x19
mov si, bx
rdtsc
mov byte [esp + 0x15], dh
jmp 0x13f411a
mov cx, word [esp + 0xf]
neg ebx
push word [esp + 5]
pop dword [esp + 0xf]
jmp 0x13f40c2
mov al, 0xc6
xchg dword [esp + 7], edi
pop word [esp + 2]
mov esi, 0x82be40ad
sub esp, 0x1b
mov bl, 0xd
jmp 0x13f4104
Function at 0x13f45da
Capabilities:
Execute anti-debugging instructions

Disassembly:
sets cl
lea edx, [eax + edi]
mov ch, dh
lea esi, [esi + edi]
xchg dword [esp], eax
pushal
jmp 0x13f46f9
mov word [esp + 8], sp
xchg ebp, ecx
mov ax, 0x1e36
add esp, 0xd
jmp 0x13f45c4
bswap eax
mov edx, edi
mov edx, dword [esp]
rdtsc
mov ebp, esi
mov ch, byte [esp]
jmp 0x13f4625
add esp, 1
cpuid
mov ebp, edi
rdtsc
mov dh, al
xchg dh, dl
jmp 0x13f45ea
lea esi, [ebp*4]
pushfd
sete dl
pop si
setb dh
jmp 0x13f466d
rcl cl, 1
push word [esp + 1]
pop word [esp]
jmp 0x13f460f
mov ax, 0x8207
mov bh, bl
pop word [esp]
mov ecx, 0xe9796c0c
mov esi, 0x88208695
mov word [esp], bp
jmp 0x13f4600
mov bh, byte [esp + 5]
inc esi
bsf si, cx
bswap edx
sub esp, 7
mov bp, si
jmp 0x13f46a8
push word [esp]
mov dh, byte [esp + 5]
rcr al, 5
xchg dword [esp], edx
add di, 0x5ce6
xchg dword [esp], edx
jmp 0x13f4656
rcr dl, 2
xchg word [esp + 8], di
add al, 0xf3
sub esp, 0x11
rcr dh, cl
mov cl, byte [esp + 3]
jmp 0x13f46d4
mov ah, byte [esp + 0xc]
xchg byte [esp + 5], dh
cpuid
mov dword [esp + 3], ecx
pop si
mov dword [esp + 3], esp
jmp 0x13f4685
setge cl
setbe dl
xchg dword [esp + 0xd], esi
xchg byte [esp + 0xf], bh
call fcn.013f46be
insb byte es:[edi], dx
imul esp, dword [edx + 0x63], 0x74707972
outsd dx, dword [esi]
sub eax, 0x2e315f31
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx + 0xf], ah
wait
ret
popal
setnp bl
xchg dword [esp], ecx
mov si, ax
bswap esi
lea edi, [esi + ebp]
jmp 0x13f463c

Function at 0x13f46be
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop di
lea ebx, [ebp + 0xee]
jmp 0x13f4723
dec dx
neg bh
not eax
setg ah
mov byte [esp + 4], ch
mov bh, 0xa0
jmp 0x13f4c69
xchg ch, dh
mov dword [esp + 0xc], ecx
mov bp, cx
push si
xchg dword [esp + 0x13], esi
pop word [esp + 0xc]
jmp 0x13f470d
mov edx, edi
mov ebp, edx
rdtsc
mov cx, 0xc67c
xchg byte [esp + 3], ch
xchg bx, ax
jmp 0x13f4757
pop word [esp + 0x12]
mov edi, ecx
mov al, 0x73
xchg dword [esp + 0xa], eax
add esp, 0xd
add esp, 4
jmp 0x13f476d
mov ebp, ecx
mov word [esp + 0x19], di
add ebx, 0x37f46118
pop word [esp + 0x13]
sub bp, 0x6d87
mov dh, bl
jmp 0x13f48f7
pop dx
push word [esp + 0x16]
mov bh, byte [esp + 8]
pop di
setb bl
dec ah
jmp 0x13f495a

Function at 0x13f4938
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebx
jmp 0x13f493f
pop cx
add esp, 0
mov eax, dword [esp]
rdtsc
cpuid
bswap ebp
jmp 0x13f4af4
xchg edx, edi
mov al, ch
mov dl, ch
mov bl, cl
mov esi, dword [esp + 6]
bswap esi
mov word [esp + 0xe], dx
lea edx, reloc.WS2_32.dll_WSAWaitForMultipleEvents
mov ecx, ebp
xchg ch, bl
pop bp
jmp 0x13f498b
mov eax, esp
mov cx, bx
rol al, 6
push di
sub esp, 0x16
setae bh
jmp 0x13f49b8
Function at 0x13f4ba4
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x10
pop edx
mov dword [esp + 0xe], ebp
pushfd
lea edi, [ecx + ebx]
pop dx
jmp 0x13f4bb2
cpuid
lea esp, [esp + 5]
shl bh, cl
lea ebp, [esp + edx]
push si
shl edx, 0xb
jmp 0x13f4bc8
mov cl, 0x6c
rdtsc
mov al, 0x5b
sub esp, 0x14
add esp, 0x18
jmp 0x13f4b7e
not bx
neg di
mov esi, 0x74f78215
xchg dword [esp + 0xc], ecx
bswap edi
xchg bx, di
jmp 0x13f4b8e
not ch
lea edi, [esi*4]
mov dword [esp + 4], ebx
lea ebp, [ecx - 0x58]
jmp 0x13f4bfc
mov byte [esp + 0x17], ch
cmc
neg si
xchg dword [esp + 0x10], ecx
mov bx, word [esp + 0xb]
mov byte [esp + 0x13], bh
jmp 0x13f4be6

Function at 0x13fa9cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
popal
jmp 0x13faa09
xchg dl, bh
pop esi
adc edi, esi
mov esi, ecx
pop ax
pop dx
jmp 0x13faa35
mov ebp, 0xdc6bd9e4
xchg word [esp + 5], bx
bswap ebx
rdtsc
lea ebx, [ebp*4]
xchg byte [esp + 2], ah
jmp 0x13fa9f3

Function at 0x13fac23
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
mov al, dh
btc edi, esi
pop dx
std
xchg bl, dl
jmp 0x13fac4a
lea esp, [esp + 0x42]
xchg dh, bh
push di
mov word [esp], bp
mov ah, byte [esp]
jmp 0x13fac0d
sub esp, 0x19
xchg di, cx
xchg cl, ch
xchg edx, ebp
lea esi, [edx + edx]
rdtsc
jmp 0x13fad06
mov ebp, dword [esp]
add cx, 0x906c
not ebp
bsr si, cx
mov edx, 0x6126be1e
dec di
jmp 0x13fac34
rdtsc
bsf cx, si
mov si, di
push dword [esp + 0x1b]
add esp, 0xc
not al
jmp 0x13facba
cpuid
mov esi, 0xab77b27e
mov dword [esp + 0xf], edi
not ebp
push dword [esp + 0x1a]
not bx
jmp 0x13fac61
pushfd
xor ah, 0x20
pop word [esp + 0xa]
xchg dword [esp + 2], edi
rdtsc
mov word [esp + 0xf], sp
jmp 0x13face5
lea eax, [eax + ebx]
not ebx
clc
pop dword [esp + 0xe]
mov esi, 0x997d14a6
mov dword [esp + 0xc], eax
jmp 0x13fac9e
setnp dh
xchg dword [esp + 0xa], edi
dec cl
call fcn.013fad2d
outsb dx, byte [esi]
out 0x74, al
adc ebp, esi
cmp dl, byte [edi - 0x20090202]
std
neg bh
rdtsc
mov cl, byte [esp + 6]
mov bp, si
clc
jmp 0x13faccf
clc
mov ah, dh
mov al, ah
xchg cx, ax
setp bh
dec ax
jmp 0x13fac88

Function at 0x13fad4c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x13], dl
push dword [esp + 0xb]
mov byte [esp + 0xd], dl
mov cl, byte [esp + 0x10]
mov dx, bx
dec di
jmp 0x13fa4d7
lea esp, [esp + 5]
mov ch, ah
mov word [esp + 2], bx
mov di, 0x9efd
mov byte [esp + 1], ch
pop dword [esp + 0x10]
jmp 0x13fa4ed
push dword [esp + 5]
mov ecx, 0xc19152a4
mov esi, ebp
mov ecx, dword [esp + 0x20]
push esp
mov byte [esp + 0x24], bh
jmp 0x13fa50c
mov byte [esp + 0xa], ah
not esi
pushal
pop di
pop edx
rdtsc
jmp 0x13fa58a
mov edi, 0x754c2c80
xchg bx, di
rcl ax, 0
mov dword [esp], edx
xchg bx, si
sub esp, 0xd
jmp 0x13fa5cf
cpuid
cpuid
xchg ah, cl
jmp 0x13fa66b
Function at 0x13fae8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xd], esp
bt ax, sp
xchg bp, ax
mov dh, byte [esp + 0xf]
mov dword [esp + 2], eax
jmp 0x13fae68
mov ax, word [esp + 0xe]
mov word [esp], di
dec dh
mov bp, word [esp + 5]
mov dword [esp + 0xb], edi
dec di
jmp 0x13fae1f
mov si, dx
sub esp, 5
bsr dx, si
btc bp, sp
jmp 0x13faf26
mov dx, 0x5bad
push dword [esp + 0xf]
mov ebx, dword [esp + 3]
neg di
cld
mov bp, dx
jmp 0x13fae52
pop dword [esp + 0x10]
lea ebx, reloc.WS2_32.dll_WSAWaitForMultipleEvents
lea ebp, [edi - 0xe2]
jmp 0x13fae3a
mov esi, 0x5b17eb19
neg dl
xchg bx, di
rdtsc
jmp 0x13faec6
mov edx, ecx
shl dl, cl
mov dx, word [esp]
mov cx, 0xad50
cmc
mov edi, 0xf06b2649
jmp 0x13fae9c
mov ebx, 0x1aa3738
cpuid
rdtsc
sub esp, 3
xchg byte [esp], ah
mov bh, cl
jmp 0x13faefb
push di
lea esp, [esp + 0x42]
mov edi, 0x3c70ec5
xchg bh, cl
std
seto ch
jmp 0x13faeb2
bsr eax, eax
cmc
setns dh
rdtsc
neg bx
push si
jmp 0x13faf0f
xchg byte [esp + 2], ah
lea ebx, [eax*4]
bsr si, bx
jmp 0x13faf52
mov word [esp + 0x10], ax
pushal
pop eax
mov bp, 0x2d95
push word [esp + 0xc]
push dword [esp + 0x2c]
jmp 0x13faee8
rdtsc
rdtsc
cmc
bsr ebp, ebp
bts bx, si
clc
call fcn.013fb0cc
or dword ds:[eax + reloc.WS2_32.dll_WSAWaitForMultipleEvents], ebp
add bh, byte [ebp + 0x464240fc]
mov byte [esp + 2], bh
mov ebp, 0x464240fc
add esp, 4
mov edx, esp
bsf bx, bp
mov dl, cl
jmp 0x13faf3c

Function at 0x13fafd0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
jmp 0x13fafda
bswap edx
pop word [esp]
lea esp, [esp]
mov ax, dx
bswap ecx
xchg word [esp], si
jmp 0x13fb05a
sub esp, 7
xchg di, bx
setb dh
mov al, 0x55
rcr cx, cl
cmc
mov bx, 0xb83c
jmp 0x13fb005
xchg edi, eax
add esp, 1
xchg dl, al
bsr edx, ecx
xchg ecx, edx
mov esi, dword [esp]
jmp 0x13fb01b

Function at 0x13fb318
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 0xa]
bswap edx
pop word [esp + 0x26]
lea esi, reloc.WS2_32.dll_WSAWaitForMultipleEvents
jmp 0x13fb302

Function at 0x13fb50f
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.013fa3b3
push word [esp + 3]
mov byte [esp], al
mov word [esp + 1], bx
mov byte [esp], bl
jmp 0x13fb55d
lea esp, [esp + 0x20]
jmp 0x13fb622
push dword [esp + 3]
pop word [esp]
mov dword [esp + 0x20], esi
pushfd
mov byte [esp], bl
mov dword [esp + 0x20], edi
jmp 0x13fb547
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x13fa3ae
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x13fb5c9
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0xb01204
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00b01204
ret
Function at 0x4010a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x4010a8
mov eax, esi
pop esi
ret

Function at 0x401258
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x237
cmp dword [ebp - 0x18], 0x1f2d
jle 0x40132a
lodsb al, byte [esi]
pushfd
ret
mov dword [ebp - 0xc], 0x1f
jmp 0x40133a
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x401410
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 8]
je 0x401357
mov byte [ebp - 1], 1
jmp 0x40135b
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 3], al
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 0xc]
je 0x401374
mov byte [ebp - 2], 1
jmp 0x401378
mov byte [ebp - 2], 0
mov al, byte [ebp - 2]
mov byte [ebp - 4], al
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
and eax, ecx
je 0x401390
and dword [ebp - 0x14], 0
jmp 0x40139d
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
or eax, ecx
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 0x14]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0x11d
cmp dword [ebp - 0x1c], 0x2385
jle 0x401401
movzx eax, byte [ebp - 5]
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x401333
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret