joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7bdd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x7bdd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x7bdd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x7bdd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x7bdd94
push eax
push esi
call fcn.007c020b
add esp, 8
pop esi
ret 0x10

Function at 0x7bdda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7bde22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x7bde15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x7d6320
push ecx
mov dword [esp + 0x1c], 4
call fcn.007bfdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x7bddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x7bde30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7bdec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x7bdeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x7d6320
push ecx
mov dword [esp + 0x1c], 4
call fcn.007bfdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x7bdeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x7bde6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x7be000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x7be131
push esi
call fcn.007c1145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.007b0080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x7be131
push 0
push ebp
call fcn.007b03a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.007b0260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x7be08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.007b02f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x7be121
push 0x7d6918
push edi
call fcn.007bf3f0
push eax
push ebx
push esi
call fcn.007bdf60
push 0x7d68f8
push edi
call fcn.007bf3f0
push eax
push ebx
push esi
call fcn.007bdf60
push 0x7d68d8
push edi
call fcn.007bf3f0
push eax
push ebx
push esi
call fcn.007bdf60
push 0x7d68c0
push edi
call fcn.007bf3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.007bdf60
push 0x7d68a0
push edi
call fcn.007bf3f0
push eax
push ebx
push esi
call fcn.007bdf60
push 0x7d6888
push edi
call fcn.007bf3f0
push eax
push ebx
push esi
call fcn.007bdf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x7bf1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.007bf140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.007bf140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.007bf140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.007bf140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x7bf230
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x218]
push ebp
mov ebp, dword [esp + 0x218]
push esi
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7bf2d6
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
push edx
call edi
mov esi, eax
test esi, esi
jne 0x7bf2ae
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.007bf230
mov esi, eax
add esp, 8
test esi, esi
jne 0x7bf2ae
lea edx, [esp + 0x14]
push 0x104
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call edi
mov esi, eax
test esi, esi
je 0x7bf27e
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
pop edi
je 0x7bf2ce
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0x7bfbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7bfc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x7d187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7bfc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x7bfc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x5d25ed
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
lea esp, [esp + 2]
jmp 0x5d2626
lea esp, [esp + 0xc]
movzx edi, byte [edi*4 + 0x5b0638]
stc
btc ebp, edi
jmp 0x5d267a
pushal
mov al, byte [esp]
mov dword [esp], edx
pushal
lea esp, [esp + 0x20]
popal
jmp 0x5d26c4
xor eax, edi
inc di
lea edi, [edi*4]
xchg bp, di
jmp 0x5d2656
lea esp, [esp + 4]
mov ebp, 0xff00
cmc
sub esp, 0x10
sub esp, 0x12
jmp 0x5d26d7
mov edi, dword [edi*4 + reloc.KERNEL32.dll_DuplicateHandle]
and ebp, ebp
mov bp, word [esp]
jmp 0x5d268a
mov ebp, 0xdd05e8a8
lea ebp, [esp + edx]
sub esp, 4
and edi, esi
mov bp, word [esp]
jmp 0x5d26a4
lea esp, [esp + 2]
and edi, ebp
cmc
jmp 0x5d2a8e
sub esp, 4
pop edi
xor edi, ecx
lea edi, [ecx + 0x10]
call fcn.005d2762
neg edi
mov ecx, edx
btc edi, ebx
shr ecx, 8
jmp 0x5d2799
lea edi, [eax - 0x31]
or di, 0xa584
jmp 0x5d2855
sub esp, 0x12
mov byte [esp + 7], bh
lea esp, [esp + 2]
jmp 0x5d27f1
lea ebp, [ebp*4]
lea ebp, reloc.KERNEL32.dll_DuplicateHandle
mov ecx, dword [ebp]
pop ebp
shr edi, 0x10
jmp 0x5d27bd
and edi, esi
mov edi, dword [edi*4 + reloc.KERNEL32.dll_DuplicateHandle]
pushal
sub esp, 0xc
jmp 0x5d281a
lea esp, [esp + 1]
push ebp
mov ebp, ecx
jmp 0x5d27db
mov dword [esp + 0x1d], ecx
jmp 0x5d288d
and ecx, esi
sub esp, 0x12
push word [esp + 3]
lea esp, [esp + 0x13]
lea esp, [esp]
jmp 0x5d2811
mov edi, edx
sub esp, 8
mov word [esp + 4], sp
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x5d2831
lea esp, [esp + 0x44]
and ecx, 0xff0000
call fcn.005d286a
inc ebp
int 0x5d
and al, 0xd7
invalid
xor eax, edi
lea esp, [esp + 0x20]
xor eax, dword [ecx]
mov di, word [esp]
jmp 0x5d277b

Function at 0x5d2d41
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push esp
push edx
jmp 0x5d2f23
lea esp, [esp + 0x20]
jmp 0x5a6385
mov ax, word [esp + 0x1e]
mov byte [esp + 6], dh
lea esp, [esp + 2]
mov eax, dword [ebp - 8]
jmp 0x5d2dc2
mov byte [esp + 2], ch
lea esp, [esp + 0xc]
jl 0x5a636e
pushal
push word [esp + 0x17]
jmp 0x5d2e0f

Function at 0x5d2d7d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push word [esp + 3]
mov word [esp], bx
lea esp, [esp + 2]
jmp 0x5d2da9

Function at 0x5d301f
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_DuplicateHandle]
sub esp, 0xa
push word [esp + 5]
add esp, 9
lea esp, [esp + 3]
jmp 0x5d2fa2
jmp 0x5d2fc5

Function at 0x5d3021
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp], dx
pop word [esp]
jmp 0x5d3064
push word [esp + 1]
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_DuplicateHandle]
jmp 0x5d3046

Function at 0x5d3255
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
mov edi, dword [edi*4 + reloc.KERNEL32.dll_DuplicateHandle]
and ebx, ecx
jmp 0x5d3203
shr edi, 0x18
mov edi, dword [edi*4 + reloc.KERNEL32.dll_DuplicateHandle]
jmp 0x5d321c
pushal
mov dword [esp + 7], esi
jmp 0x5d323c
Function at 0x5d32c9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and ebx, ecx
sub esp, 0x10
mov dword [esp + 7], eax
jmp 0x5d327c
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_DuplicateHandle]
sub esp, 0xa
mov byte [esp + 5], ch
lea esp, [esp + 2]
jmp 0x5d3292
push dword [esp + 2]
add esp, 5
lea esp, [esp + 3]
jmp 0x5d32a9

Function at 0x5d32d6
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edx, ecx
jmp 0x5d32de
sub esp, 0x18
lea esp, [esp + 0x13]
call fcn.005d334e
cld
invalid

Function at 0x5d334e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop edi
cmc
cmc
push edx
stc
jmp 0x5d3305
mov edi, edx
lea edi, [edi*4]
lea edi, reloc.KERNEL32.dll_DuplicateHandle
mov edx, dword [edi]
jmp 0x5d331d
pushal
lea esp, [esp + 1]
push edi
jmp 0x5d3336

Function at 0x5d3483
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
jmp 0x5d33f4
mov byte [esp + 8], ch
mov word [esp + 0x16], di
mov edi, dword [edi*4 + reloc.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0x5d3417
jmp 0x5d342e

Function at 0x5d3491
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
call fcn.005d34cb
mov byte [edx + eax*4], cl
in eax, 0x14
mov dword [reloc.KERNEL32.dll_DuplicateHandle], eax
wait
or dword [eax - 0x65], ebp
pop eax
jo 0x5d349e
push 0x5b4dfa0f

Function at 0x5d34cb
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_DuplicateHandle]
pushal
jmp 0x5d34f0
and ebx, ecx
stc
jmp 0x5d34b5
Function at 0x5d3511
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov word [esp], di
shr edi, 0x18
sub esp, 0x18
call fcn.005d3483

Function at 0x5f61f2
Capabilities:
Encode data using xor

Disassembly:
add esp, 3
add esp, 0
jmp 0x5f62b2
outsb dx, byte [esi]
popfd
and al, 0x7e
dec ecx
call 0x8e3d04be
and al, 1
lea esp, [esp + 1]
test dl, dl
call fcn.005f6273
daa
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 5
xor eax, ebx
push ebx
lds esi, ss:[ebx + ecx - 0x7c]
sbb bh, byte [ebp - 0x74]
xor dh, byte [ecx - 0xe944c50]
or al, 0xa2
inc ebp
insd dword es:[edi], dx
pop ds
pop edx
clc
mov bh, 0x9e
js 0x5f62a9
xor al, 0x7a
test al, 0x53
pop edi
outsd dx, dword [esi]
inc esp
cmp eax, 0xf159aeb9
xchg byte [edx + esi*2 - 0xdc5ea53], dl
invalid

Function at 0x5f6e18
Capabilities:
Encode data using xor

Disassembly:
cli
call fcn.005f6dff
aad 0x55
lds ebp, [edi + ebx*2 + 0x54c645e8]
xor ecx, esi
js 0x5f6e1f
jnp 0x5f6e17
invalid

Function at 0x6cd3de
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], bh
mov ebp, ecx
mov word [esp + 2], dx
rcr bp, cl
push word [esp + 3]
bswap eax
jmp 0x6cd385
inc bp
add eax, esi
xchg byte [esp + 1], dh
mov bp, word [esp + 4]
xchg dword [esp], ebp
jmp 0x6cd2e3
btr ebp, esp
neg edx
neg dh
stc
sub esp, 2
xchg word [esp + 2], bp
jmp 0x6cd306
mov dword [esp + 1], ecx
pop eax
mov ebp, dword [esp + 3]
lea ebp, [ebp + 0x9f]
lea esp, [esp + 3]
neg dh
jmp 0x6cd396
mov ebp, 0xfab63ae0
rcl eax, 0xb
xchg byte [esp + 3], dh
mov dl, 0x34
mov word [esp + 4], bx
jmp 0x6cd32f
add bp, 0x111e
push word [esp + 3]
mov ah, byte [esp + 1]
rdtsc
inc ax
jmp 0x6cd351
pop bp
pop word [esp + 1]
mov dh, bh
not eax
bswap eax
rdtsc
jmp 0x6cd36a
mov ax, dx
mov bp, 0xc1e1
xchg dh, al
bswap ebp
mov ax, sp
not eax
jmp 0x6cd449
pop dword [esp]
rdtsc
bsr bp, bp
mov word [esp + 2], dx
inc dl
inc ebp
jmp 0x6cd31d
mov byte [esp + 3], dh
mov ebp, 0x4013eb0
mov word [esp], di
push dword [esp]
jmp 0x6cd3b3
xchg byte [esp], dl
and bp, 0x46ba
call fcn.006cd42d

Function at 0x6cd42d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
pop ebp
cmc
mov dh, 0x48
xchg dx, bp
sub esp, 0x10
jmp 0x6cd456
rdtsc
mov dh, 0xda
add esp, 3
push edx
xchg bp, ax
xchg ebp, edx
jmp 0x6cd3f0
mov dword [esp], esi
and bp, 0xedca
mov byte [esp + 1], dh
mov word [esp + 2], dx
jmp 0x6cd40d
mov dh, 0xa
mov eax, dword [esp + 5]
xchg dword [esp + 4], edx
mov byte [esp + 0xb], ch
call fcn.006cd4b8
mov bl, 0xaa
lds esi, [esi + 0xf]
mov esp, 0x242c8be8

Function at 0x6cd4b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ah
mov ebp, dword [esp + 0x11]
bsf bp, ax
pop word [esp + 3]
pop eax
pop ebp
jmp 0x6cd479
bts eax, edi
bsf ax, si
jmp 0x6cd49e
Function at 0x6cd6c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xb]
lea ebp, [eax + edi]
mov ebp, 0xb24db0be
jmp 0x6cd6f4
lea eax, reloc.KERNEL32.dll_DuplicateHandle
inc edx
rdtsc
mov edx, ecx
xchg word [esp], bp
jmp 0x6cd70d
lea ebp, [edi*4]
lea eax, [ecx*4]
jmp 0x6cd6cf
mov word [esp], bx
mov dh, byte [esp]
inc dl
lea ebp, reloc.KERNEL32.dll_DuplicateHandle
mov dh, byte [esp + 1]
setge ah
jmp 0x6cd76c
xchg ebp, edx
xchg bp, ax
sub esp, 0x12
mov bp, bx
lea ebp, [edi + ebp]
mov bp, word [esp + 6]
jmp 0x6cd784
pop bp
lea eax, [eax - 0x99]
mov byte [esp], dh
sub esp, 0
lea edx, reloc.KERNEL32.dll_DuplicateHandle
mov ebp, eax
jmp 0x6cd747
mov byte [esp + 7], ch
not ebp
xchg dword [esp + 0xc], ebp
pop dx
lea eax, [edx + edx]
mov dl, dh
jmp 0x6cda68
xchg dh, dl
bswap ebp
lea esp, [esp + 0x28]
lea esp, [esp]
call fcn.006cd7b0
push dword [esp + 0x21]
mov bp, word [esp + 5]
pop ebp
mov byte [esp + 3], ah
xor edx, esi
mov dx, cx
jmp 0x6cd7cc
pop ebp
mov ebp, 0xd856ff04
mov ebp, esi
rdtsc
or ax, 0x4d98
mov edx, ebp
jmp 0x6cd811
pop word [esp + 0x1c]
mov word [esp + 5], di
lea ebp, [esp + edi]
bsf bp, si
xchg byte [esp], al
shr ax, cl
jmp 0x6cd8a4
xchg ah, dh
pushal
cld
mov dh, byte [esp]
mov dword [esp + 0x16], eax
pop word [esp + 9]
jmp 0x6cd916

Function at 0x6cd7b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebp*4]
sub esp, 0x1c
jmp 0x6cd7f3
mov byte [esp + 1], dh
lea esp, [esp + 7]
xchg word [esp + 5], bp
add al, dh
jmp 0x6cd858
btc ebp, ebx
mov ax, word [esp + 0x12]
lea ebp, [ebx + esi]
mov dh, 0x2a
mov bp, word [esp + 0x1d]
inc dh
jmp 0x6cd7dc
pop dword [esp]
pushal
lea esp, [esp + 0x14]
lea esp, [esp + 0xa]
bt edx, esp
mov dh, 0xa2
jmp 0x6cd88a
rdtsc
lea eax, [edx + ebx]
mov dl, dh
mov bp, word [esp + 6]
xchg byte [esp + 6], dl
jmp 0x6cd826
mov bp, di
ror dh, 5
pop bp
xchg edx, ebp
lea esp, [esp + 0xb]
xchg dx, bp
jmp 0x6cd840
bsr bp, bp
mov dl, dh
neg ebp
xchg word [esp + 6], bp
pop bp
xchg byte [esp + 8], al
jmp 0x6cd8ea
xchg byte [esp], dl
stc
mov al, ah
bswap edx
push esp
shr ebp, 0xb
jmp 0x6cd86b
sete dh
mov ax, dx
xchg word [esp], bp
mov word [esp], di
mov byte [esp], dh
jmp 0x6cda18
mov dh, byte [esp + 1]
mov word [esp], di
rdtsc
mov ebp, ecx
mov ax, 0xb547
bt ebp, edx
jmp 0x6cd8b9
sub esp, 2
lea esp, [esp + 4]
add esp, 8
lea esp, [esp + 1]
mov dh, byte [esp + 1]
setge ah
jmp 0x6cd8d1
lea ebp, [edx + edi]
cmc
mov word [esp], di
lea esp, [esp + 1]
call fcn.006cd932
mov word [esp], dx
neg edx
lea eax, [eax*4]
mov eax, 0xb66ab6a6
lea ebp, [eax + 0x39]
lea ebp, [eax*4]
jmp 0x6cd951

Function at 0x6cd9b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, word [esp + 6]
xchg dx, bp
jmp 0x6cd967
Function at 0x6ce360
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dh
lea eax, [esi - 0xed]
mov eax, dword [esp + 3]
pushal
mov bp, word [esp]
jmp 0x6ce31d

Function at 0x6ce717
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.006cd091
jmp 0x6ce818
mov dword [esp + 0xd4], edi
lea esp, [esp + 0xd4]
jmp 0x6ce7b8
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x6cd08c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x6ce784
push dword [esp + 2]
pop word [esp + 3]
mov byte [esp + 7], bh
pushal
mov byte [esp + 0x17], ah
lea esp, [esp + 2]
jmp 0x6ce71c
Function at 0x100120f
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
xor ebx, ebx
inc ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 4
lea eax, [ebp - 0x14]
push eax
push 0x22
push 0xffffffffffffffff
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
mov eax, dword [ebp + 8]
inc esi
mov dword [0x100504c], eax
lea eax, [esi + esi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x1001361
push dword [ebp + 0x10]
push esi
push eax
call fcn.01001d52
test eax, eax
jl 0x1001358
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
call fcn.0100162e
test eax, eax
je 0x1001358
test byte [ebp - 0x18], bl
jne 0x10024e7
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], edi
call fcn.010019f3
push eax
mov dword [ebp - 0x24], eax
call fcn.01001c54
test eax, eax
je 0x10024ca
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 8], edi
push dword [ebp - 0x1c]
mov dword [ebp - 4], edi
push dword [ebp + 8]
push dword [0x100504c]
call fcn.01001df7
mov ebx, dword [ebp - 8]
test eax, eax
je 0x1001346
cmp ebx, edi
jne 0x10021ed
push dword [ebp - 4]
call fcn.01001473
push 0x100136c
push dword [0x100504c]
call fcn.010013c5
push dword [ebp + 0x14]
mov esi, eax
push dword [ebp + 0x10]
push dword [0x100504c]
push esi
push dword [ebp - 0x20]
call fcn.01001450
cmp esi, edi
je 0x100133d
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xc]
push dword [ebp - 0x24]
call fcn.01001397
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp + 0x10], ebx
jmp 0x1001303
push 0x10024f8
push dword [ebp + 8]
push 0x403
push dword [0x100504c]
call fcn.010038c6
jmp 0x100134d
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0100397d
jmp 0x1001358
Function at 0x1001473
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x18]
push esi
push dword [ebp + 8]
mov esi, dword [eax + 0x30]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp word [eax + 0x14], 0
je 0x100149d
cmp dword [eax + 0x4c], 0
jne 0x10023c8
lea eax, [ebp - 4]
push eax
push 0xa
push 1
push dword [esi + 8]
call dword [sym.imp.imagehlp.dll_ImageDirectoryEntryToData]
test eax, eax
je 0x10014bf
movzx eax, word [eax + 0x34]
test ax, ax
jne 0x1002405
pop esi
leave
ret 4
movzx ecx, byte [eax + 0x4c]
mov dword [esi + 0xa4], ecx
movzx ecx, byte [eax + 0x4d]
mov dword [esi + 0xa8], ecx
mov cx, word [eax + 0x4e]
mov edx, 0x3fff
and cx, dx
mov word [esi + 0xac], cx
mov eax, dword [eax + 0x4c]
xor eax, 0xbfffffff
shr eax, 0x1e
mov dword [esi + 0xb0], eax
jmp 0x100149d
mov word [esi + 0xae], ax
jmp 0x10014bf

Function at 0x10014c9
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1005040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
xor ebx, ebx
push ebx
push esi
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x214], eax
cmp eax, ebx
je 0x1002411
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, ebx
je 0x1001525
mov ecx, 0x100
test word [eax + 0x5e], cx
je 0x1001525
push 3
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001195
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0xc1
cmp eax, edi
jne 0x1002454
push esi
call fcn.01003a0d
test eax, eax
je 0x1002431
xor eax, eax
jmp 0x100152b
lea eax, [ebp - 0x218]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
push ebx
mov dword [ebp - 0x218], esi
push 0x3000
jmp 0x1002469
push ebx
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push ebx
push eax
push ebx
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp eax, ebx
je 0x1001525
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x401
push dword [ebp - 0x210]
call fcn.010038c6
jmp 0x1001525