joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b2a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x58
mov dword [esp + 0x48], 0x3b95
mov dword [esp + 0x4c], 0x33e
mov dword [esp + 0x40], 0x3889
mov dword [esp + 0x44], 0x5f0
mov dword [esp + 0x38], 0x7ad6
mov dword [esp + 0x3c], 0x12f0
mov dword [esp + 0x18], 0x4b9c
mov dword [esp + 0x1c], 0x1a2a
mov dword [esp + 0x10], 0x5a7b
mov dword [esp + 0x14], 0x2d1f
mov dword [esp + 8], 0x5ceb
mov dword [esp + 0xc], 0x787c
mov dword [esp + 0x20], 0x12fa
mov dword [esp + 0x24], 0x1916
mov dword [esp], 0x73cf
mov dword [esp + 4], 0x352a
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x20]
push ebx
push esi
mov esi, dword [esp + 0x2c]
add eax, edx
adc ecx, esi
add eax, 0xffffddb0
adc ecx, 0xffffc18f
or eax, 0x7f8b
or ecx, 0x1f3a
add eax, 0x1b9d15c
mov dword [esp + 8], eax
adc ecx, 0x21a5107b
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push esi
push edx
push ecx
push eax
call fcn.00406328
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
xor eax, ecx
mov ecx, dword [esp + 8]
xor edx, esi
xor eax, 0x45fd
xor edx, 0x6523
add eax, 0xffffdee9
adc edx, 0x2f04
xor edx, 0x1b539370
xor eax, 0x216d79ef
cmp dword [esp + 0xc], edx
ja 0x40b4e1
jb 0x40b3c4
cmp ecx, eax
ja 0x40b4e1
mov esi, 0x31c9
mov dword [esp + 0x38], 0x1009
mov dword [esp + 0x3c], 0x19cc
mov dword [esp + 0x30], 0x7ff1
mov dword [esp + 0x34], 0x4eb5
mov dword [esp + 0x28], 0x1b0a
mov dword [esp + 0x2c], esi
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
or edx, ecx
mov ecx, dword [esp + 0x38]
or eax, ebx
mov ebx, dword [esp + 0x3c]
xor edx, 0x6f70
xor eax, 0x7c4a
add edx, ecx
adc eax, ebx
mov dword [esp + 0x58], edx
mov dword [esp + 0x5c], eax
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
push 0xece
xor eax, ebx
push 0x14f7
xor edx, ecx
xor eax, 0x330b
xor edx, 0x2e30
push eax
push edx
call fcn.00406328
mov ecx, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
sub eax, ecx
mov ecx, dword [esp + 8]
sbb edx, ebx
mov ebx, dword [esp + 0xc]
add eax, ecx
adc edx, ebx
add eax, 0xf71ef07d
mov dword [esp + 8], eax
adc edx, 0xf6c70d4e
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
push ebx
push ecx
push eax
push edx
call fcn.00406328
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
xor eax, ecx
mov ecx, dword [esp + 8]
xor edx, ebx
xor eax, 0x45fd
xor edx, 0x6523
add eax, 0xffffdee9
adc edx, 0x2f04
xor edx, 0x1b539370
xor eax, 0x216d79ef
cmp dword [esp + 0xc], edx
jb 0x40b3c9
ja 0x40b4e1
cmp ecx, eax
jbe 0x40b3c9
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov dword [esp + 0x4c], 0x303
mov dword [esp + 0x50], 0x2d0f
mov dword [esp + 0x44], 0x4f104dff
mov dword [esp + 0x48], 1
mov dword [esp + 0x3c], 0x52b4
mov dword [esp + 0x40], 0x25fc
mov dword [esp + 0x34], 0x52c7
mov dword [esp + 0x38], 0x5107
mov dword [esp + 0x1c], 5
mov dword [esp + 0x20], 0
mov dword [esp + 4], 0x7a6a
mov dword [esp + 8], 0x2bdb
mov dword [esp + 0x14], 0x5f05
push esi
mov dword [esp + 0x1c], 0x47c8
mov dword [esp + 0x10], 0x4eba
push 0
mov dword [esp + 0x18], 0x767d
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push 0x697fc511
push ecx
push eax
call fcn.0040632e
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
push esi
push ecx
push edx
push eax
call fcn.0040632e
xor eax, 0x1c189daa
mov dword [esp + 8], eax
xor edx, 0x582b37e5
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push esi
add edx, 0x1ea3
push ecx
adc eax, 0x14d3
push eax
push edx
call fcn.00406328
mov ecx, 0x44b02d44
sub ecx, eax
mov eax, 0xaa8adc1d
sbb eax, edx
mov edx, dword [esp + 8]
mov esi, dword [esp + 0xc]
cmp edx, ecx
jne 0x40d480
cmp esi, eax
je 0x40d5a4
lea ebx, [ebx]
mov dword [esp + 0x30], 0x57c
mov dword [esp + 0x34], 0x4ca9
mov dword [esp + 0x28], 0x6763
mov dword [esp + 0x2c], 0x4053
mov dword [esp + 0x20], 0x31d8
mov dword [esp + 0x24], 0x3769
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
and edx, 0x1926
and eax, 0x2949
or edx, ecx
mov ecx, dword [esp + 0x30]
or eax, esi
mov esi, dword [esp + 0x34]
push 1
push 0x205a7444
or eax, esi
or edx, ecx
push eax
push edx
call fcn.0040632e
xor eax, 0xf06
mov dword [esp + 0x58], eax
xor edx, 0x4b40
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
add edx, ecx
mov ecx, dword [esp + 0x48]
adc eax, esi
mov esi, dword [esp + 0x4c]
push esi
add edx, 0x4e43
push ecx
adc eax, 0x1b54
push eax
push edx
call fcn.0040632e
mov ecx, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
xor eax, ecx
xor edx, esi
mov ecx, 0x6ccb
sub ecx, eax
mov eax, 0x2d0f
sbb eax, edx
mov edx, dword [esp + 8]
mov esi, dword [esp + 0xc]
add ecx, edx
adc eax, esi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push esi
add eax, 0x1ea3
push edx
adc ecx, 0x14d3
push ecx
push eax
call fcn.00406328
mov ecx, 0x44b02d44
sub ecx, eax
mov eax, 0xaa8adc1d
sbb eax, edx
mov edx, dword [esp + 8]
mov esi, dword [esp + 0xc]
cmp edx, ecx
jne 0x40d480
cmp esi, eax
jne 0x40d480
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40dc10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x40], 0x4b7f
mov dword [ebp - 0x3c], 0x37e
mov dword [ebp - 0x38], 0x1ac0
mov dword [ebp - 0x34], 0x2828
mov dword [ebp - 0x30], 0x47eb
mov dword [ebp - 0x2c], 0x6ff1
mov dword [ebp - 0x20], 0x1676
mov dword [ebp - 0x1c], 0x112a
mov dword [ebp - 0x18], 0xa60
mov dword [ebp - 0x14], 0x35e
mov dword [ebp - 8], 0x7ffa
mov dword [ebp - 4], 0x239f
mov dword [ebp - 0x10], 0x3b8c
mov dword [ebp - 0xc], 0xf9f
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
push ebx
push esi
mov esi, dword [ebp - 0x14]
or ecx, 0x5409
or eax, 0x63e4
add eax, edx
mov edx, dword [ebp - 0x20]
adc ecx, esi
mov esi, dword [ebp - 0x1c]
add eax, 0xfffffec6
push 0
adc ecx, 0xffffe8f9
push 0x3031307
and ecx, esi
and eax, edx
push ecx
push eax
call fcn.0040632e
add eax, 0x68b66b8b
adc edx, 0x3d8765d0
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
push 0xd3fc92f
add eax, 0x46a7
push 0x12c3ddb
adc ecx, 0x4cb3
push ecx
push eax
call fcn.00406328
mov ecx, dword [ebp - 8]
xor edx, 0x73c212cb
xor eax, 0xdb8f426e
cmp dword [ebp - 4], edx
jb 0x40de05
ja 0x40dd0c
cmp ecx, eax
jbe 0x40de05
mov esi, 0x4ed9
mov dword [ebp - 0x28], 0x5572
mov dword [ebp - 0x24], 0x6a00
mov dword [ebp - 0x18], 0x296d
mov dword [ebp - 0x14], 0x5c0b
mov dword [ebp - 0x20], 0x5143
mov dword [ebp - 0x1c], esi
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
push 0
or eax, 0x45d9
push 0x399d98d5
or edx, 0x4f0a
xor eax, ebx
xor edx, ecx
push eax
push edx
call fcn.0040632e
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
xor eax, 0x15ee
xor edx, 0x1929
sub eax, ecx
sbb edx, ebx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x34]
add edx, 0xffff88e7
adc eax, 0xffffb7a3
xor edx, ecx
mov ecx, dword [ebp - 0x40]
xor eax, ebx
mov ebx, dword [ebp - 0x3c]
push 0x14a
xor eax, 0x6af6
push 0x926
xor edx, 0x53b4
and eax, ebx
and edx, ecx
push eax
push edx
call fcn.0040632e
sub dword [ebp - 8], eax
push 0xd3fc92f
push 0x12c3ddb
sbb dword [ebp - 4], edx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add edx, 0x46a7
adc eax, 0x4cb3
push eax
push edx
call fcn.00406328
mov ecx, dword [ebp - 8]
xor edx, 0x73c212cb
xor eax, 0xdb8f426e
cmp dword [ebp - 4], edx
ja 0x40dd11
jb 0x40de05
cmp ecx, eax
ja 0x40dd11
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
mov eax, 0x4340
mov word [ebp - 0x20], ax
mov ecx, 0x3936
mov word [ebp - 0x1c], cx
mov edx, 0x5897
mov word [ebp - 0x18], dx
mov eax, 0x1f0a
mov word [ebp - 0xc], ax
mov ecx, 0x1135
mov word [ebp - 8], cx
mov edx, 0x73dd
mov word [ebp - 0x10], dx
mov eax, 0x259b
mov word [ebp - 0x14], ax
mov ecx, 0x1f2f
mov word [ebp - 4], cx
movzx edx, word [ebp - 4]
mov eax, 0x3b1
imul dx, ax
movzx eax, word [ebp - 0x10]
mov ecx, 0xf434
and dx, cx
mov cx, word [ebp - 0x14]
sub dx, ax
sub dx, cx
mov eax, 0x14a0
mov ecx, 0x220f
and edx, 0x3eeb
sub edx, 0x2660
mov word [ebp - 4], dx
movzx edx, word [ebp - 8]
xor dx, ax
movzx eax, word [ebp - 0xc]
sub dx, cx
xor dx, ax
mov ecx, 0x202a
add dx, cx
mov eax, 0x2b14
xor dx, ax
movzx eax, word [ebp - 4]
mov ecx, 0x2217
sub dx, cx
cmp ax, dx
ja 0x412ac5
mov esi, 1
mov dword [ebp - 0x40], 0x252e
mov dword [ebp - 0x3c], 0x4d55
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0x90c53a18
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0x3ce7
mov dword [ebp - 0x24], 0x5a01
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
push ebx
add ecx, 0x2f04
push eax
adc edx, 0x5de5
push edx
push ecx
call fcn.0040632e
mov ecx, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x34]
push ebx
push ecx
push edx
push eax
call fcn.0040632e
mov ecx, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x3c]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
movzx edx, word [ebp - 0x18]
movzx eax, word [ebp - 0x1c]
sub ax, dx
movzx edx, word [ebp - 0x20]
mov ecx, 0x1f48
xor ax, cx
imul ax, dx
movzx edx, word [ebp - 4]
mov ecx, 0x3ac1
sub cx, ax
add ecx, edx
mov word [ebp - 4], cx
movzx eax, word [ebp - 8]
mov ecx, 0x14a0
xor ax, cx
movzx ecx, word [ebp - 0xc]
mov edx, 0x220f
sub ax, dx
xor ax, cx
mov edx, 0x202a
add ax, dx
mov ecx, 0x2b14
xor ax, cx
movzx ecx, word [ebp - 4]
mov edx, 0x2217
sub ax, dx
cmp cx, ax
jbe 0x4129e8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x597156
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 1]
push esp
push word [esp + 9]
lea esp, [esp + 0xc]
push ebx
jmp 0x5648f6
jmp 0x5648bb
lea edx, [ebx + esi]
push ebp
lea ebp, [edx + edi]
btc ebp, ebx
jmp 0x564925
push esi
bswap edx
cmc
inc bp
mov bx, word [esp]
jmp 0x56498f
movzx esi, byte [eax + 1]
dec bp
jmp 0x564979
lea esi, [edx + edx]
shl edx, 8
sub ebx, eax
clc
jmp 0x564942
xor edx, esi
bsf si, si
mov bl, byte [esp]
mov edi, dword [esp]
xchg bp, bx
jmp 0x5649b7
push edi
pushal
lea esp, [esp + 0x20]
movzx edx, byte [eax]
jmp 0x56495a
lea esp, [esp + 2]
jmp 0x596b77
movzx esi, byte [eax + 2]
pushal
pop bx
xchg dword [esp + 0xd], ebx
bsf di, si
jmp 0x56499e
shl edx, 8
xor edx, esi
mov bl, 0x32
neg bl
jmp 0x596c10
xor edx, esi
xchg si, di
lea ebx, [esp + esi]
lea ebx, [ecx*4]
neg si
jmp 0x596bf2
shl edx, 8
sub esp, 0xc
lea esp, [esp + 5]
not edi
lea esp, [esp + 3]
jmp 0x596ba2
mov dword [ecx], edx
movzx edx, byte [eax + 4]
sub bl, ch
clc
jmp 0x596bdb
setge bl
btr edi, edx
jmp 0x596c1e
lea esp, [esp + 4]
movzx esi, byte [eax + 5]
inc di
stc
bswap edi
jmp 0x596bcc
not bl
lea esp, [esp + 0x1c]
movzx esi, byte [eax + 3]
mov bl, bh
jmp 0x596bba
shl edx, 8
xor di, 0xbd6c
btr edi, esp
neg edi
jmp 0x596cbc
lea ebp, [esp + edx]
xor edx, esi
neg bl
mov si, word [esp]
jmp 0x596ca4
shl edx, 8
bsf di, si
jmp 0x596c79
movzx esi, byte [eax + 6]
shl edx, 8
add bp, 0x7bfe
not edi
setle bl
jmp 0x596c43
xor edx, esi
mov esi, dword [esp]
mov bl, byte [esp]
inc bl
jmp 0x597152
lea esi, [esi + 4]
mov dword [esi], edx
pop esi
lea edi, [edx + edx]
jmp 0x596f31
movzx esi, byte [eax + 7]
mov edi, eax
mov ebx, eax
jmp 0x596c50
xor edx, esi
sub esp, 0xc
mov ebx, eax
lea esp, [esp + 0xc]
jmp 0x596c66
lea edi, [ebx + esi]
neg bx
jmp 0x596ce8
xchg byte [esp], bl
lea esp, [esp + 4]
movzx esi, byte [eax + 0xa]
shl edx, 8
jmp 0x596d03
xchg bl, bh
sets bl
bswap edi
xor edx, esi
push esp
jmp 0x596d1b
movzx edx, byte [eax + 8]
mov bp, ax
shl edx, 8
xchg ebx, edi
jmp 0x596d40
movzx esi, byte [eax + 9]
push esi
mov esi, ecx
jmp 0x596c88

Function at 0x59ca45
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax + 0xc], reloc.kernel32.dll_DeleteCriticalSection
pushal
pop dword [esp + 0xe]
push dword [esp + 0xc]
jmp 0x59cbc1
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
jmp 0x59ca11
lea esp, [esp + 4]
jmp 0x59ca27
mov byte [esp + 7], bh

Function at 0x59e862
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x59e8a7
pushal
mov dword [esp + 0x19], ebp
pop word [esp + 5]
lea esp, [esp + 2]
jmp 0x59eb54
cmp dword [esp + 0x10], ebx
push edx
jmp 0x59e8f4
lea esp, [esp + 8]
jge 0x59e19f
call fcn.0059e845
lea esp, [esp + 4]
or ecx, reloc.kernel32.dll_DeleteCriticalSection
jmp 0x59e2ff
jle 0x59e386
mov cx, 0x55d
mov ecx, 1
jmp 0x59e2ff
lea ebx, [esi - 1]
pushal
call 0x59e8cc
lea esp, [esp + 4]
test ecx, ecx
push esp
call fcn.0059e9ba
or ebp, dword [edi + reloc.kernel32.dll_DeleteCriticalSection]
inc edx
rcl byte [esi + 0x31], 0xc0
jle 0x59e90a
sar byte [esi - 3], 0xcc
int3
jle 0x59e1b5
lea ebx, [eax + 0xb9]
bswap ebx
setg bl
not bl
jmp 0x59e8eb
lea esp, [esp + 0x1c]
inc esi
mov dword [esp + 0x10], esi
jmp 0x59e3e9
Function at 0x6a30ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
xchg dword [esp], ebp
mov cx, word [esp + 1]
jmp 0x6a315a
lea ebx, [ecx + 0x43]
bswap eax
mov byte [esp + 1], bh
stc
bswap edi
xchg word [esp], si
jmp 0x6a3185
pop cx
push word [esp + 4]
pop eax
mov bh, byte [esp + 1]
mov dh, byte [esp + 1]
jmp 0x6a312d
mov word [esp], di
mov ch, byte [esp + 1]
xchg si, dx
rdtsc
mov ecx, ebp
cmc
jmp 0x6a3143
rdtsc
xchg word [esp], cx
cpuid
btc eax, ebx
bsr si, bp
mov word [esp], dx
jmp 0x6a319b
xchg word [esp], cx
mov ebp, dword [esp]
cpuid
btc eax, edi
inc eax
lea ebx, [ecx*4]
jmp 0x6a316c
mov word [esp], di
add esp, 0
push edx
neg ch
mov byte [esp + 5], dh
and bx, 0x6d62
jmp 0x6a455d
mov eax, 0x355ec55e
mov dx, 0x4c3d
mov ebx, 0xda5e2054
xchg byte [esp + 8], al
setne bh
sub esp, 6
mov bp, word [esp + 4]
lea edi, [ecx - 0x1b]
bsr cx, bp
push word [esp + 5]
xchg byte [esp + 8], cl
jmp 0x6a4083

Function at 0x6a34e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esi, ebp
rdtsc
mov byte [esp + 1], dh
mov di, sp
xchg bp, cx
btc eax, edi
jmp 0x6a3511
xchg ebx, ebp
xchg edi, edx
setg bh
xchg si, ax
push dword [esp]
mov cx, word [esp]
jmp 0x6a3489
neg bp
mov bx, 0xfb4d
bsr bp, cx
mov word [esp + 2], bx
xchg bh, cl
xchg di, bp
jmp 0x6a34a1
rdtsc
neg edi
xchg dh, al
add esp, 0xa
jmp 0x6a34b9
or ch, bl
int3
ror eax, 0xb
pop ebp
btr ecx, esp
add esp, 0x13
call fcn.006a35a4
cmc
or al, 0xff
pop edx
ja 0x6a34ea
je 0x6a3519
out dx, al
pop ds
sbb dword [ebx], 0xffffff8b
out dx, al
sbb eax, 0x68c9feae
add esp, 7
rdtsc
mov dl, dh
mov di, word [esp]
mov edi, dword [esp]
xchg byte [esp], cl
sub esp, 0x1e
jmp 0x6a34ed
Function at 0x6a3756
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
lea edx, [ebp - 0xcf]
mov dl, byte [esp]
neg ah
xchg bh, cl
mov dl, byte [esp]
jmp 0x6a3221
mov byte [esp + 7], ch
pop ax
mov edi, esi
pushal
sub esp, 0x10
lea esp, [esp + 0x47]
jmp 0x6a31d3
bswap edi
cpuid
popal
xchg edi, esi
xchg byte [esp + 3], al
mov edx, 0x975d7b3a
jmp 0x6a32b1
mov edx, eax
lea edi, [edx*4]
xchg si, bx
inc ecx
pushal
sub esp, 8
jmp 0x6a3204
pop ax
pop si
xchg dword [esp + 0x14], edx
xchg ah, bl
lea eax, [ebp - 7]
lea ebp, [edx*4]
jmp 0x6a31f2
lea esi, [esp + edx]
mov dword [esp + 5], esi
sub esp, 4
push dword [esp + 0xc]
sub esp, 8
mov cl, 0x82
jmp 0x6a3294
push word [esp + 7]
not edi
pop dword [esp]
neg ax
bswap esi
push dword [esp]
jmp 0x6a325c
mov dl, dh
add al, dh
lea esp, [esp + 0xb]
pop word [esp + 1]
bsf di, ax
mov dword [esp + 1], esi
jmp 0x6a32fa
add al, dh
lea edx, [ecx*4]
mov si, word [esp + 2]
mov word [esp], sp
bswap edi
mov ebx, 0xa6a26952
jmp 0x6a3280
bsf bx, ax
pop edx
mov edx, dword [esp + 0x20]
xchg bh, cl
xchg dword [esp + 9], edx
jmp 0x6a370b
inc ebp
xchg cx, ax
mov cl, ch
xchg edx, ebx
not bh
push esp
jmp 0x6a32cc
pop word [esp + 4]
mov dword [esp + 3], ebp
mov ebp, esi
mov al, 0x16
cpuid
sub esp, 0x1a
jmp 0x6a32e3
pushal
mov dword [esp + 0x23], esi
popal
sub esp, 0xe
setp ah
xchg dx, ax
jmp 0x6a3246
mov ax, di
lea esp, [esp + 2]
cld
push word [esp + 0x1d]
lea esp, [esp + 0x25]
pushal
jmp 0x6a3393
xchg word [esp + 0x24], dx
mov ebx, 0x2926ed74
mov byte [esp + 0x27], ch
neg ah
jmp 0x6a3330
pop bp
bsf cx, ax
rcl dx, cl
lea ecx, [esp + esi]
sub esp, 8
sub esp, 2
jmp 0x6a334a
rdtsc
bswap ecx
pop word [esp + 0x17]
xchg byte [esp + 0xf], al
push dword [esp + 0xa]
pop cx
jmp 0x6a33e4
mov ax, dx
mov bl, 0x60
mov dx, word [esp + 8]
xchg byte [esp + 0x12], cl
btc esi, ebx
mov cx, 0xf505
jmp 0x6a3376
mov al, ah
mov eax, dword [esp]
bswap esi
rdtsc
xchg byte [esp], cl
pushal
jmp 0x6a3362
pop word [esp + 0x1d]
lea esi, [eax*4]
setge ah
pop word [esp + 0x19]
add esp, 0xf
jmp 0x6a3471
setne dh
xchg word [esp + 0xb], dx
lea esi, [ebp - 0x6f]
cpuid
rdtsc
mov dword [esp + 0xb], eax
jmp 0x6a33c6
xchg word [esp + 9], si
lea esp, [esp + 0x14]
cpuid
mov bl, 0x70
add esp, 0xe
pop edx
jmp 0x6a33b7
setae bh
mov edx, dword [esp + 0xe]
mov di, dx
pop ebp
add cx, 0x347e
rcr edi, 0x1d
jmp 0x6a3443
push dword [esp + 3]
mov cl, ch
btr esi, esp
bsr dx, cx
push word [esp + 9]
mov word [esp + 4], bx
jmp 0x6a3411
and edx, ecx
setbe bh
call fcn.006a34e2
dec ebx
invalid
btc esi, ebx
inc cx
pop bp
push esp
mov ah, byte [esp + 3]
push dword [esp + 3]
jmp 0x6a342a
lea edx, [ebp*4]
mov dl, 0x84
add esp, 0xd
add esp, 1
mov ebx, dword [esp]
mov word [esp], di
jmp 0x6a3459
ror bh, 3
lea edi, [ebp*4]
push dword [esp + 0x16]
xchg bh, cl
mov dh, byte [esp + 0xe]
mov cl, ch
jmp 0x6a33fe
bsr bp, bp
xchg word [esp + 0x20], di
xor bp, 0xc3c
bswap ebx
mov byte [esp + 0x1f], bh
mov esi, dword [esp + 0x22]
jmp 0x6a352c
shl bp, cl
pop ax
lea ebx, [edx + esi]
mov byte [esp + 0x21], ch
bsf dx, ax
pop edi
jmp 0x6a364e
push dword [esp + 0x15]
mov dl, 0xfc
not ch
lea esi, reloc.kernel32.dll_DeleteCriticalSection
mov cl, ch
rcl di, cl
jmp 0x6a3674
jmp 0x6a331c
Function at 0x6a3856
Capabilities:
Execute anti-debugging instructions

Disassembly:
setbe ah
pushal
bswap edi
mov byte [esp + 0x12], bh
call 0x6a3856
sbb byte [edx - 0x15], 0x4f
lea edi, [esi*4]
mov dword [esp + 3], esi
bswap eax
xchg dh, al
pop eax
neg edi
jmp 0x6a3ba4
bsr dx, cx
mov dword [esp], esi
xchg word [esp + 1], ax
pop word [esp]
rdtsc
neg ah
jmp 0x6a3b77
rcl bx, cl
mov cx, sp
xchg word [esp + 1], bp
xchg si, di
xchg word [esp + 2], dx
cld
jmp 0x6a38c4
xchg di, bx
bswap ecx
shr esi, 0xb
not dh
and dx, 0xb0ca
add esp, 2
call fcn.006a3ae4
mov si, 0xc73
xchg ah, bl
push dword [esp + 0xc]
xchg bh, cl
lea esp, [esp + 0x21]
jmp 0x6a3cb8
mov cx, bx
lea esp, [esp + 7]
add esp, 7
mov eax, esi
bsf bx, ax
mov cl, ch
jmp 0x6a38ed
mov edi, eax
mov eax, 0x37daa80c
xchg word [esp + 5], bp
bsr bx, bp
call fcn.006a3be7
not bp
cmc
bsr bx, cx
mov esi, dword [esp + 3]
mov byte [esp + 0xb], ah
mov cx, 0xcee5
jmp 0x6a3d1f
pop dword [esp + 8]
push dword [esp + 0xc]
xchg byte [esp + 2], dl
mov si, word [esp + 5]
xchg dword [esp + 9], esi
pushal
jmp 0x6a3d6c
xchg dh, al
not bp
pop dword [esp + 2]
pop di
xchg ch, dl
not si
jmp 0x6a3d01
inc si
inc si
bsf ax, si
lea ecx, [edi*4]
xchg word [esp + 0x28], di
mov dl, dh
jmp 0x6a3df5
inc ax
call fcn.006a3dd7
setle bh
xchg dword [esp + 0x25], edx
mov bl, 0x98
pop word [esp + 3]
jmp 0x6a3f47
xchg byte [esp + 2], dl
inc cl
xor bp, 0x9f6c
xchg word [esp + 0x12], bp
cpuid
lea ecx, [eax - 0x59]
call fcn.006a3ebb
lea ebx, [ecx + 0x83]
mov esi, ecx
neg edi
pushal
lea esp, [esp + 0x4b]
sub esp, 0x14
jmp 0x6a3ff3
push dword [esp + 2]
push dword [esp + 0x12]
push word [esp + 1]
mov byte [esp + 5], dh
call 0x6a3fb8
and bh, byte [edx + edx*2 + 0x943c435]
test al, 0xf9
stc
mov dl, dh
not ch
lea esp, [esp + 0x14]
popal
sub esp, 0x10
jmp 0x6a3fd5

Function at 0x6a3c88
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edi, eax
xchg dx, si
mov edx, 0xb34227c6
mov cx, 0x3173
jmp 0x6a4050
setno dh
sub esp, 0x1c
lea esp, [esp + 0x52]
jmp 0x6a3c71
pop si
push word [esp + 0xd]
mov edi, dword [esp + 0xf]
xchg dh, al
inc edx
rdtsc
jmp 0x6a3ccd
sub esp, 0x1e
mov word [esp + 0xf], sp
pop ecx
mov dl, dh
xchg edx, eax
mov word [esp + 0x18], di
jmp 0x6a3cef
not cx
rdtsc
mov cx, bx
setae dh
xchg si, bp
mov dx, word [esp]
jmp 0x6a3d38
cpuid
lea edx, [ecx*4]
mov ax, word [esp]
lea esp, [esp + 1]
mov si, 0x634d
mov al, 0x36
jmp 0x6a3d58
neg dx
mov ax, 0x367
lea esi, reloc.kernel32.dll_DeleteCriticalSection
bsr cx, cx
lea edx, [edx*4]
mov byte [esp], ah
jmp 0x6a3d91
lea esi, [ebp*4]
pop di
btr ebx, esp
mov ax, 0xda63
clc
ror eax, 9
jmp 0x6a3dba
mov dx, word [esp]
xchg bh, cl
cld
not dx
push edx
mov bp, word [esp]
jmp 0x6a3e12

Function at 0x6a41ac
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 3]
push dword [esp + 7]
lea esp, [esp + 1]
mov dword [esp + 0xa8], edi
jmp 0x6a42d6
push eax
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x6a422f
lea esp, [esp + 0xa8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x6a4248
Function at 0x408820
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x463fab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00458bf9
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4088a2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00456b10
mov eax, dword [eax]
push 0x4791f0
push eax
call fcn.00449744
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00458e84
test bl, bl
je 0x4088a2
push 0x4791f0
lea ecx, [esp + 0xc]
call fcn.00459214
push 0x47cd5c
lea ecx, [esp + 0xc]
call fcn.00459214
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4088de
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00458e84
jmp 0x4089a9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x408962
lea edx, [esp + 0x7c]
push 0x47cd58
push edx
call fcn.00449744
add esp, 8
test eax, eax
je 0x408962
lea eax, [esp + 0x7c]
push 0x47cd54
push eax
call fcn.00449744
add esp, 8
test eax, eax
je 0x408962
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4088f2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00458e84
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4091a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x409202
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc