joyce8/EMBER2024-capa huggingface dataset:
Function at 0x566db0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c0dbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.005676d0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xea650c
call fcn.005b08da
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x566e43
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005b08da
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x566e3c
push 0
mov ecx, eax
call fcn.0055dee0
mov dword [esi + 0xc], eax
jmp 0x566e45
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x566e45
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x58308e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5830ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00581aaa
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x5830d1
test byte [esp + 8], 2
je 0x5830d1
call fcn.00581b1d
mov dword [eax], 0xd
call fcn.00581b26
mov dword [eax], 5
jmp 0x5830aa
xor eax, eax
ret

Function at 0x596b30
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
jne 0x596b40
mov esi, 1
push esi
call fcn.00580ff7
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x596b92
call fcn.00581b1d
mov edi, eax
call fcn.00599680
mov ecx, dword [edi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edi, eax
and edi, 8
je 0x596b76
mov edx, dword [0xfdc7d8]
mov dword [0xfdc7d4], edx
test al, 0x18
je 0x596b87
push esi
push 0x24
push 5
call fcn.00599ed0
add esp, 0xc
test edi, edi
je 0x596bad
push 1
call fcn.00582f9b
test byte [esp + 0x14], 0x20
je 0x596bad
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x597cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, dword [ebp + 0x10]
test edx, edx
push ebx
push esi
push edi
je 0x597da4
cmp byte [edx], 0
je 0x597d97
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, 8
or ecx, 0xffffffff
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x20]
push ecx
mov esi, ebx
call fcn.00597c30
mov edi, dword [ebp + 0xc]
push 8
lea edx, [esp + 0x20]
push edi
push edx
call fcn.00597c30
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor eax, edx
push eax
xor ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00597ba0
mov eax, dword [esp + 0x30]
add esp, 0x24
cmp edi, eax
jae 0x597d61
sub eax, edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.00597be0
fmul qword [0xf71fd8]
push ecx
fstp qword [esp]
call fcn.0057f948
fadd qword [0xf71fd0]
add esp, 8
call fcn.0057fa18
mov byte [ebx], al
inc ebx
dec edi
jne 0x597d34
lea ecx, [esp + 0x20]
push ecx
call fcn.00597be0
fmul qword [0xf71fd8]
push ecx
fstp qword [esp]
call fcn.0057f948
add esp, 8
call fcn.0057fa18
cmp esi, ebx
je 0x597d8d
xor byte [esi], al
inc esi
cmp esi, ebx
jne 0x597d86
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x598170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x5981a0
mov byte [edi + esi], 2
jmp 0x5981d7
test al, 4
je 0x5981aa
mov byte [edi + esi], 0xd
jmp 0x5981d7
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x5981c3
mov byte [edi + esi], 2
jmp 0x5981d7
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x5981d3
mov byte [edi + esi], 0x19
jmp 0x5981d7
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x598187
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x59824b
cmp dl, 0xd
je 0x59824b
xor edx, edx
jmp 0x598250
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x59823b
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x598270
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.00596b30
mov esi, eax
add esp, 8
test esi, esi
jne 0x598291
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.005998c0
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x5982b6
push esi
call fcn.00596bc0
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.0058c28b
push ebx
push edi
mov ebp, eax
call fcn.00599930
push 0x5982f0
push ebp
push esi
call fcn.0059ac60
push esi
call fcn.00596bc0
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x5995f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x10e94c0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10e93e8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x59966b
push 0x4c
push 1
call fcn.00581f45
mov esi, eax
add esp, 8
test esi, esi
jne 0x599633
push 0x10e94c0
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x10e93e8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x10db9c4]
inc eax
lea edx, [esi + 0xc]
mov dword [0x10db9c4], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.0059d120
add esp, 8
mov byte [esi + 0x3c], 1
push 0x10e94c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x599af0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.00581b1d
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.0058c28b
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x599bea
call fcn.00581b1d
cmp dword [eax], 0
je 0x599b37
call fcn.00581b1d
mov ebp, dword [eax]
jmp 0x599b3a
or ebp, 0xffffffff
call fcn.00599680
test esi, esi
mov dword [eax], ebp
jne 0x599b4f
call fcn.00581b1d
cmp dword [eax], 4
je 0x599b9f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x599b82
cmp esi, 0xffffffff
je 0x599bc4
test al, 6
je 0x599b82
call fcn.00599680
mov ecx, dword [eax]
push ecx
push ebx
call fcn.0059d150
add esp, 4
push eax
push 0x24
push 9
call fcn.00599ed0
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x599be2
test al, 6
je 0x599b90
test ah, 2
je 0x599be2
test esi, esi
jbe 0x599bee
test ah, 2
je 0x599bee
add dword [esp + 0x18], esi
sub edi, esi
call fcn.00581b1d
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.0058c28b
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x599bea
jmp 0x599b24
call fcn.00599680
mov eax, dword [eax]
push eax
push ebx
call fcn.0059d150
add esp, 4
push eax
push 0x24
push 2
call fcn.00599ed0
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x599bfb
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x599c04
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x5b2f67
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5b2f9f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005b0ff4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005b0fcc
jmp 0x5b2fab
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x5b4659
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5b469b
call fcn.005ba314
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5b469b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5b4692
xor eax, eax
jmp 0x5b46a3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005b46a9
pop edi
pop esi
pop ebx
ret 4

Function at 0x5ba844
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5ba872
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5ba890
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005ba7aa
jmp 0x5ba890
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5ba890
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005ba7aa
test edi, edi
mov eax, edi
jne 0x5ba87a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x6c0e00
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ecx
or al, 0x24
call fcn.006c0dcc
xchg dword [esp + 8], ecx
call fcn.006c0e07
imul esi, edi, 0x67
add dh, cl
inc ecx
jae 0x6c0de3
jle 0x6c0e16
call 0x89d29359
and al, 1
jmp 0x6c0dea
and bp, 0xfa69
rdtsc
jmp 0x6c0e3a
mov esi, dword [esp + 0x2c]
jmp 0x6c0e78
call fcn.006c0ea2
neg ch
jae 0x6c0e84
mov bh, 0x7b
xchg bx, di
mov dl, 0xee
jmp 0x6c0eaa
rdtsc
setnp bl
or cx, si
jne 0x6c0e57
je 0x6c0e57
mov bh, 0x7b
xchg bx, di
jmp 0x6c0ea8
bsr bx, cx
jnp 0x6c0eb4
bswap eax
mov ecx, 0x3d835aad
jmp 0x6c0f51
mov dl, 0xee
sub esp, 0xbc
mov edi, esp
jmp 0x6c0e8b
bswap eax
mov ecx, 0x3d835aad
jmp 0x6c0f51

Function at 0x6c10e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 3]
push word [esp + 2]
mov cx, word [esp]
jmp 0x6c10cc
mov eax, dword [esp + 3]
push word [esp + 2]
mov cx, word [esp]
sete cl
jmp 0x6c1107
sete cl
mov ecx, 0xcfba68a6
jmp 0x6c110c
bts ax, di
jo 0x6c10b6
jno 0x6c10a0
ror esi, 0
lea ecx, [ebx + edi]
not eax
bt ax, cx
jmp 0x6c119a
mov ecx, 0xcfba68a6
xchg edx, eax
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
lea esp, [esp + 2]
call fcn.006c1238
cmp esp, dword [ecx + reloc.iphlpapi.dll_GetAdaptersInfo]
pushal
mov dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
mov dword [ecx - 1], ebp
invalid
add esi, dword [ebp]
mov ecx, 0x892db4fc
mov ch, cl
lea eax, [esp + eax]
jmp fcn.006c11d3
je 0x6c11ba
adc al, 0xc2
sbb byte [eax], al
jns 0x6c1179
js 0x6c1179
add byte [ebp + 0x1ba7540d], bl
jb 0x6c1194
jl 0x6c11c3
test byte [ebx + 0x7f], 0x46
int1
ljmp 0xec83
or ebx, ebp
movsd dword es:[edi], dword [esi]
sar byte [ebp + 0x25], cl

Function at 0x6c1238
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ecx
mov ch, 0x83
call 0x6c11b0

Function at 0x6c1887
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov ah, bh
clc
jmp 0x6c18aa
jg 0x6c1865
lea esp, [esp + 2]

Function at 0x6ec199
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [esi*4]
mov cl, 0x50
mov cx, word [esp]
sub esp, 0x1b
jmp 0x6ec1a0
xchg edx, ecx
mov dword [ebp], ecx
jmp 0x6ec183
jp 0x6ec1b6
lea esp, [esp + 3]
jmp 0x6ec1ba
lea esp, [esp + 3]
mov dword [ebp + 4], eax
lea eax, [edx*4]
jmp 0x6ec1e0
mov eax, 0xda2e34d
jmp fcn.006e06ec
clc
jl 0x6ec1c6
mov eax, 0xda2e34d
jmp fcn.006e06ec
Function at 0x75e9d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap esi
push word [esp + 3]
mov dx, bx
push dword [esp + 4]
mov eax, dword [esp]
bswap edx
jmp 0x75ea0f
not edx
lea edx, [esi*4]
std
clc
stc
jmp 0x75e9b6
mov word [esp], dx
pushfd
pushal
xchg ah, dl
sub esp, 0x18
lea esp, [esp + 0x4e]
jmp 0x75e9f8
bswap esi
rdtsc
xchg al, ah
mov al, 0xfd
bswap edx
sub esp, 8
jmp 0x75ea25
mov edx, dword [esp + 0xd]
mov al, 0xbc
pop word [esp + 0xa]
push dword [esp + 7]
dec esi
xchg byte [esp + 4], al
jmp 0x75e9e3
mov si, bp
rdtsc
pop word [esp + 1]
mov ax, dx
pushal
rdtsc
jmp 0x75ed4a
mov dl, byte [esp + 9]
push dword [esp + 0xe]
mov ah, dh
lea eax, [ecx + esi]
mov ax, 0x45af
mov eax, dword [esp + 0xc]
jmp 0x75eac2
mov si, 0xdd5
bt dx, dx
lea esi, [ebp + 0x93]
pop dword [esp + 3]
mov dword [esp + 0x16], ebp
add esp, 0x19
jmp 0x75ea63
mov dx, bp
not ah
mov si, word [esp + 0x14]
std
lea eax, [esi + edi]
mov eax, ebx
jmp 0x75ea80
std
add esp, 0
not edx
lea edx, [ecx - 0xe7]
mov ah, 0x36
setp dl
jmp 0x75eb14
bsf esi, edi
bswap edx
mov al, ah
mov byte [esp + 0xd], al
mov eax, edx
push bx
jmp 0x75eab0
xchg ah, dh
xchg ah, dh
cld
mov dword [esp], esi
setae ah
lea edx, [ecx + edx]
jmp 0x75eb29
xchg dword [esp + 0x10], eax
xchg byte [esp + 0x11], dl
pop dword [esp + 0xb]
pop dword [esp + 2]
bswap esi
cld
jmp 0x75eaf8
bswap eax
mov esi, 0xedb918f
mov dh, ah
lea esp, [esp + 2]
bswap edx
lea esp, [esp + 1]
call fcn.0075eb77
and eax, 0x24448a54
sbb al, 0xf
retf 0x8966
mov al, byte [esp + 0x1c]
bswap edx
mov word [esp + 2], ax
lea esi, [ebx*4]
xchg ah, al
push dword [esp + 0x1c]
jmp 0x75eae7
push word [esp + 0x16]
mov eax, edi
setno dh
rdtsc
rcl dl, 0
mov ax, sp
jmp 0x75eb43
push dword [esp + 0xe]
pop dword [esp + 2]
lea esi, reloc.iphlpapi.dll_GetAdaptersInfo
bsr si, ax
mov al, byte [esp + 6]
mov byte [esp + 0x1c], cl
jmp 0x75ec0d

Function at 0x75ec3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc esi, esi
pop dx
mov dx, cx
sub esp, 0x10
mov dx, word [esp + 0xf]
jmp 0x75ec9a
xchg al, dl
bts esi, esp
pop dx
jmp 0x75ec24
xchg al, dh
mov ah, byte [esp + 3]
xchg esi, edx
pop si
xchg dword [esp + 0xa], eax
mov byte [esp + 7], cl
jmp 0x75ec66
bts eax, edi
push word [esp + 6]
xchg word [esp + 0x14], dx
neg esi
rol edx, cl
pop dword [esp + 4]
jmp 0x75ec7c
Function at 0x75f03c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp]
mov ah, byte [esp + 1]
or al, 0xf9
mov si, word [esp]
std
push di
jmp 0x75f060
lea esp, [esp + 3]
xor al, ch
bswap esi
inc dx
mov dh, bl
lea edx, [edx*4]
jmp 0x75effc
jmp 0x75f012
sub esp, 0x13
mov edx, dword [esp + 9]
pop word [esp + 0x12]
mov ax, 0x5341
btc si, bp
lea esp, [esp + 0xb]
jmp 0x75f074
mov al, byte [esp + 3]
xchg dl, ah
mov ah, dh
lea eax, [ecx + ecx]
mov eax, 0x3f45ebdd
not dh
jmp 0x75f03e
xchg byte [esp + 8], dl
setnp dh
add esp, 1
xchg dh, al
adc eax, 0xbedb64a4
inc edx
jmp 0x75f212
pop edx
mov dh, byte [esp + 1]
stc
mov edx, 0x74b1c06a
push dword [esp + 2]
jmp 0x75f0e8
xchg word [esp + 1], ax
mov si, bp
xchg edx, eax
mov dl, cl
mov ah, dh
lea edx, [ebp + ebp]
jmp 0x75f0a8
bswap eax
xchg word [esp], si
lea esi, reloc.iphlpapi.dll_GetAdaptersInfo
setb dl
jmp 0x75f1c6
mov dx, bx
pop eax
lea edx, [edi*4]
setns dl
ror ax, cl
xchg esi, eax
jmp 0x75f0d2
rdtsc
bsr edx, ebp
lea esp, [esp]
add esp, 1
xchg word [esp + 5], ax
lea edx, [ebp*4]
jmp 0x75f0be
add esp, 0
cmp ax, 0xee81
mov ah, byte [esp]
push si
jmp 0x75f18b
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
stc
not ah
lea esp, [esp + 3]
lea esp, [esp]
add esp, 0
jmp 0x75f12a
lea edx, [edx*4]
lea esp, [esp]
not ax
jmp 0x75f1a0
bt eax, esp
not dx
xchg byte [esp], al
xchg byte [esp + 1], al
xchg byte [esp + 1], dl
neg dx
jmp 0x75f156
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
and dh, 0x1d
xchg esi, eax
bsr edx, ebp
mov dl, byte [esp + 2]
stc
jmp 0x75f16c
mov esi, 0x6f0926d2
xchg edx, eax
sub esp, 0xa
lea eax, [eax + esi]
rcl edx, 0x15
std
jmp 0x75f1f9
btc ax, di
mov ah, byte [esp]
lea esi, reloc.iphlpapi.dll_GetAdaptersInfo
xchg word [esp + 1], si
xchg word [esp], dx
mov dh, ah
jmp 0x75f141
rcl edx, cl
cld
sub esp, 3
lea esp, [esp + 3]
mov ah, byte [esp]
btr eax, ebp
jmp 0x75f24c
add esp, 0xc
lea edx, [edi*4]
std
mov edx, ebx
not ah
lea eax, [eax + ebp]
jmp 0x75f1e3
mov edx, ebx
mov word [esp + 3], si
xchg byte [esp], dh
rdtsc
mov edx, dword [esp + 2]
mov ah, 0xb4
jmp 0x75f111
mov esi, dword [esp + 4]
mov dword [esp + 9], ebx
push dword [esp + 8]
lea esp, [esp + 7]
pop edx
bswap edx
jmp 0x75f288
lea eax, [esi*4]
lea esp, [esp]
sub esp, 1
xchg esi, eax
pop ax
lea eax, [esi + esi]
call fcn.0075f229
bswap eax
xchg si, dx
push word [esp + 2]
mov dword [esp + 5], ecx
jmp 0x75f233
xchg si, dx
mov ax, bx
rol dl, cl
bt edx, edx
std
cmc
jmp 0x75f29b
mov si, word [esp + 3]
add esp, 4
pop si
sub esp, 0x1a
cmc
jmp 0x75f2da
xchg dword [esp + 0x10], esi
call 0x75f2c4
mov dword [esp + 0x17], esp
lea esi, [esp + ecx]
mov byte [esp + 0x23], dh
xchg al, ah
xchg dh, al
jmp 0x75f307
add si, ax
xchg byte [esp + 0xc], al
pop dword [esp + 0x13]
not esi
mov si, 0xfdfc
mov word [esp + 0xc], si
jmp 0x75f3ce
mov al, ah
mov dx, si
not al
xchg byte [esp + 0xd], al
call fcn.0075f331
pop word [esp + 0x13]
pop word [esp + 9]
bt si, sp
xchg word [esp + 3], ax
lea esi, [eax*4]
pop word [esp + 0xc]
jmp 0x75f354
Function at 0x7636b8
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.0076305f
push dword [esp + 8]
push word [esp + 2]
mov dword [esp + 0x30], edi
jmp 0x7636d9
push word [esp + 4]
mov dword [esp + 2], esi
jmp 0x7636a2
mov eax, dword [eax + 0x1c]
jmp 0x7636e8
lea esp, [esp + 0x30]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x7636c3
mov eax, dword [eax]
jmp 0x763726
mov eax, dword [eax + 8]
push eax
jmp 0x76305a
Function at 0x4dde14
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00484424
xor edx, edx
push ebp
push 0x4dde86
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x70]
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 4]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 8]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0xc]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x10]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x14]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x1c]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov eax, dword [eax + 0x20]
mov byte [eax + 0x30], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dde90
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404300
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040438f
jae 0x40430e
xor ecx, ecx
call fcn.0040438f
jae 0x40433d
xor eax, eax
call fcn.0040438f
jae 0x40434d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040438f
adc al, al
jae 0x40432f
jne 0x404379
stosb byte es:[edi], al
jmp 0x404311
call fcn.0040439b
sub ecx, ebx
jne 0x404356
call fcn.00404399
jmp 0x404375
lodsb al, byte [esi]
shr eax, 1
je 0x404383
adc ecx, ecx
jmp 0x404372
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00404399
cmp eax, 0x7d00
jae 0x404372
cmp ah, 5
jae 0x404373
cmp eax, 0x7f
ja 0x404374
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x404311
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x10979e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf1082040
jmp 0x1097a02
lea esp, [esp + 1]
mov byte [esp], cl
lea esp, [esp]
jmp 0x1097a2c
setnp dh
mov esi, ebp
jmp 0x1097a0d
rdtsc
sub esp, 0x11
jge 0x1097a59
lea esp, [esp + 1]
jmp 0x1097a5d
lea esp, [esp + 3]
push edi
pushfd
jmp 0x1096c0f
mov esi, dword [esp + 0x3c]
clc
jmp 0x1097a86
mov edx, edi
bswap eax
jmp 0x1097a5f
lea esp, [esp + 1]
jmp 0x1097a37
lea ebp, [esp + 0x10]
xchg bx, dx
mov ch, 0x94
mov al, byte [esp]
jmp 0x1097a8e
mov edx, esi
push sp
xchg ebx, eax
add esp, 1
jb 0x1097b85
jae 0x1097ad1
lodsb al, byte [esi]
cmp eax, 0x8447b4ad
mov word [edi], ds
jnp 0x1097a42
jnp 0x1097a42
mov edx, edi
bswap eax
jmp 0x1097a5f
sub esp, 0xb0
mov edi, esp
mov cl, byte [esp]
rdtsc
mov ecx, dword [esp]
jmp 0x1097a6d
add esp, 0
lea esp, [esp + 1]
mov ebx, esi
jmp 0x1097abb

Function at 0x109fc28
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x1085bfe
pushfd
or dword [esp], reloc.iphlpapi.dll_GetAdaptersInfo
popfd
cpuid
nop
jmp 0x1085c15
pop ebx
ret
jmp 0x1085bf2

Function at 0x117b6a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 0x1c]
pushal
jmp 0x117b6e1
bts ebx, esp
shr cx, 0xb
cld
bts cx, bp
cpuid
not edx
jmp 0x117b732
mov dx, 0x61b7
xchg cx, di
lea edi, [edi*4]
jmp 0x117b71c
mov eax, 0xf1fd9498
inc dh
lea ebx, [edx + esi]
mov edx, 0x4ebdcd3f
jmp 0x117b777
mov edi, dword [esp]
std
xchg cx, di
xchg bp, ax
lea esi, [eax - 0xa9]
mov bh, al
jmp 0x117b6f3
mov dl, byte [esp]
cmc
dec edx
mov bx, word [esp]
setae ah
mov dl, 0x4f
jmp 0x117b78b
mov ebp, 0x9eb8f703
bsr di, sp
neg ch
not esi
lea ecx, [ecx + ebx]
xchg al, bl
jmp 0x117b761
mov edx, 0x786c57e7
shr eax, 0x14
cpuid
lea esi, [ebp*4]
mov cx, si
rdtsc
jmp 0x117b7db
mov bh, ch
shl dh, cl
cpuid
sub esp, 0x11
mov bp, 0x95eb
lea edi, [esi + esi]
jmp 0x117b9f0
mov di, cx
mov bl, 0xa1
xchg edi, ebp
rdtsc
bsf edx, ebx
dec bl
jmp 0x117b7c5
bswap ebp
bswap ebx
add esp, 5
call fcn.0117b895