joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9ebc7c
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ecx
jmp 0x9ebbad
xor edx, esi
ror esi, 0xd
mov edi, 0x70451ee0
xchg esi, ebx
neg bl
jmp 0x9ebce2
btr edi, esp
mov bl, 6
shl edx, 8
setne bl
bswap edi
call fcn.009ebc3f
push esi
mov esi, ecx
lea esi, [esi + 0xc]
jmp 0x9ebcbe
btr edi, edx
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
xchg bl, bh
jmp 0x9ebc6a
mov dword [esi], edx
pop esi
ror esi, 9
mov esi, dword [esp]
add al, dh
rcr ebp, 5
jmp 0x9ebdbe
lea esp, [esp + 4]
movzx esi, byte [eax + 0xd]
mov bx, 0x3b6d
bsf di, ax
inc di
jmp 0x9ebcb0
and eax, esi
mov edi, esi
neg bl
mov edi, dword [esp]
mov bx, 0xcf6f
jmp 0x9ebd74
lea esp, [esp + 0x20]
xor eax, 0x1000000
call fcn.009ebd5c
mov ch, 0x2f
mov edi, 0xc2f329da
jge 0x9ebd68
fisttp word [ebp - 0x41f7db9c]
inc dword [eax]
add byte [eax], al
lea esp, [esp + 8]
mov esi, 0xff
neg di
jmp 0x9ebcf6
shr eax, 0x10
lea esi, [eax - 0x21]
mov bl, bh
xchg bp, bx
xchg bl, bh
jmp 0x9ebd1d
lds esi, [ebx + eax*4]
mov eax, 0x3bc8a939
mov byte [eax + 0x48bd2fb], bl
test dword [esi + edi*2 - 0x323eff64], ebp
adc dword [ebx - 0x52d3720c], esi
add byte [eax], al
add byte [eax], al
mov eax, dword [eax*4 + 0x9c7eac]
ror ebp, 0x11
mov bl, 0xf4
lea ebp, [ebp*4]
pushal
jmp 0x9ebd05
mov eax, edx
mov si, 0xfa81
rcl bl, 5
xchg bl, bh
jmp 0x9ebd34

Function at 0x9ec9af
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
pop dword [esp + 0xc]
shr edi, 0x18
jmp 0x9ec9ec
and ebx, ecx
jmp 0x9ec9fe
mov edi, dword [edi*4 + 0x9c7eac]
and edi, ecx
mov edi, dword [edi*4 + 0x9c82ac]
jmp 0x9ec9b9
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + 0x9c8aac]
jmp 0x9ecaad
movzx ebx, byte [esi + 9]
sub esp, 0x16
push dword [esp + 6]
lea esp, [esp + 5]
call fcn.009eca46
inc eax
add edi, dword [edx + 0x60b70495]
pushal
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + 0x9c86ac]
clc
jmp 0x9eca6a
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + 0x9c7eac]
and ebx, ecx
jmp 0x9eca84

Function at 0x9ecadb
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
lea esp, [esp + 0x40]
xor edi, dword [edx*4 + 0x9c8eac]
jmp 0x9ecb32
mov dword [esp], esi
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x9ecabc
mov edx, dword [ebx]
pop ebx
cmc
mov dword [esi + 4], edi
jmp 0x9ecb67
lea esp, [esp + 2]
mov dword [esp + 0xc], edx
stc
call fcn.009ecb50
mov bl, 0x39
test eax, 0x93ff3bc8
sbb cl, byte [eax - 0x427e511]
ror byte [ebp - 0x24], cl
push ebx
mov ebx, esi
lea ebx, [ebx + 8]
jmp 0x9ecb0b
mov ebx, dword [ebx*4 + 0x9c7eac]
sub esp, 4
pushal
sub esp, 0xe
bswap eax
jmp 0x9ecb14
Function at 0x9ed08f
Capabilities:
Encrypt data using aes

Disassembly:
inc esi
mov ch, 0x75
and dword ss:[ebp - 0x17fcdb9c], ecx
invalid
dec dword [ecx + 0x39eb242c]
imul esp, edx, 0x70
pop ss
loop 0x9eccb8
scasd eax, dword es:[edi]
daa
mov bh, 0xd2
and edx, ebp
xlatb
pop eax
into
test eax, 0x8d359b58
adc al, 0x95
add byte [eax], al
add byte [eax], al
lea edx, [edx*4]
lea edx, [edx + 0x9c7eac]
mov edi, dword [edx]
pop edx
call 0x9ecc8d
sub ah, byte [esi + 0x68ae5334]
push edi
mov esi, 0x18efc189
push edx
mov edx, edi
cmp bl, byte [edx - 0x18]
sar edi, cl
invalid
push ebx
scasb al, byte es:[edi]
push 0xc189be57
out dx, eax
sbb byte [edx - 0x75], dl
xlatb
jmp 0x9ecca5
mov edi, edx
call 0x9ecc84
loopne 0x9ecd6e
loope 0x9ecc7f
jae 0x9eccb3
loop 0x9ecd75
loopne 0x9ecc8c
jb 0x9eccbd
ljmp 0x87e:0x89a7b405
mov dword [esi + 8], edi
mov edi, 0xe67947f0
lea edi, [edx*4]
out 0x8d, al
cmp al, 0x95
add byte [eax], al
add byte [eax], al
lea edi, [esp + esi]
mov ebx, dword [ebx*4 + 0x9c7eac]
jmp 0x9eccf4
add eax, 0x148bca21
xchg ebp, eax
lodsb al, byte [esi]
jle 0x9ecd13
add bl, ch
inc esp
push ebp
invalid
mov edx, dword [esi + 0xc]
pushal
add esp, 1
stc
lea esp, [esp + 3]
jmp 0x9ecd0c
push esp
xor ebx, ebx
jmp 0x9ecf31
pushal
lea esp, [esp + 0x19]
call fcn.009edb97
dec esi
lds edx, [ebp + 0x3c]
iretd
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + 0x9c8eac]
mov dl, byte [esp]
btc edx, edx
jmp 0x9ecdd5
call 0x9edc36
pop esi
rol byte [eax + 0x27], cl
rcl byte [esp + ebx*8], cl
push edi
invalid
push esp
lea esp, [esp + 3]
lea esp, [esp]
jmp 0x9edc2c
cmp al, 0x2f
push esp
jmp 0x9edc0a
pushal
lea esp, [esp + 0x20]
cmp al, 0x2b
push edx
jmp 0x9ed079
lea esp, [esp + 4]
jne 0x9ed010
call fcn.009edc6d
clc
outsb dx, byte [esi]
or eax, edi
cmp eax, 0x5e77c455
test eax, 0x662434ff
push dword [esp]
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x9ecf7b
lea esp, [esp + 2]
jmp 0x9edb22
jne 0x9ecf28
pushal
jmp 0x9edbda
lea esp, [esp + 4]
cmp dl, 0x3d
jmp 0x9edb07
lea esp, [esp + 0x20]
mov dword [edi], 1
jmp 0x9ed06b
lea esp, [esp + 4]
jne 0x9ecfb7
pushal
pop dword [esp + 0x14]
jmp 0x9edc4c
lea esp, [esp + 1]
pop eax
jmp 0x9ecf91
lea esp, [esp + 0x1c]
push 0x3f
jmp 0x9ecfce
Function at 0x9f542d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
pop ebx
inc esi
jmp 0x9f651a
pop ebp
stc
call fcn.009f4f46
lea edx, [eax + 0xd9]
lea edx, [esi + 0x3d]
not dx
push esp
pop dx
jmp 0x9f5196
xchg byte [esp], dh
mov edx, 0x66961b40
lea edx, [eax - 0xe9]
neg dx
ja 0x9f51d2
jbe 0x9f51bc
das
lodsd eax, dword [esi]
cmp eax, 0x3c03b744
setbe byte [esi - 9]
rcl byte [esi + 0x5a], cl
jmp 0x9f5196
lea esp, [esp + 2]
jmp 0x9f5452
lea esp, [esp + 2]
jmp 0x9f5452
xchg byte [esp + 1], ch
xor cx, 0xbff2
jmp 0x9f5426
pop dword [esp]
jmp 0x9f5404
inc ebp
call 0x9f542d
xchg dword [ebx - 0x5516fe3c], eax
add byte [eax], al
add byte [esi], ch
bsf cx, si
xchg ch, dl
lea esp, [esp + 3]
lea edx, [eax - 0x716d4e67]
mov dx, bx
jmp 0x9f548a
add bl, cl
sub esp, 8
jbe 0x9f5421
pop dword [esp]
xchg byte [esp + 1], ch
xor cx, 0xbff2
jmp 0x9f5426
bt edx, esp
setno dh
jmp 0x9f59cc
lea ecx, [esi + 0xe5]
and dx, 0x83a8
jo 0x9f5467
bt edx, esp
call 0x9f54a0
mov eax, dword [0x863e148d]
jmp 0xcaaea909
bswap esi
pop esi
dec ebp
mov ebp, dword [esp]
jmp 0x9f5143
pop ecx
jmp 0x9f5578
pop cx
bsr dx, bp
not cx
jmp 0x9f564e
mov edx, esp
add edx, ebp
jmp 0x9f55f0
add edx, ebp
lea edx, [ebp*4]
jmp 0x9f55f7
sete ch
neg edx
jp 0x9f55c1
mov edx, esp
jmp 0x9f55cb
lea edx, [ebp*4]
call 0x9f5656
lea esp, [esp + 4]
sub al, 0x70
stc
je 0x9f57bc
jne 0x9f5783
out 0x11, al
nop
adc ecx, dword [edx + 0x24648d25]
adc al, 0xc0
enter 0x6600, 0xffffffffffffffb9
out 0x55, eax
mov edx, 0x813dfff8
bswap ecx
jmp 0x9f55e5
setp cl
call 0x9f562d
mov dword [esp], eax
jmp 0x9f55fc
mov ch, byte [esp]
call 0x9f576a
lds ecx, [edx - 0xa14dbd4]
lea esp, [esp + 4]
add al, 0xc6
setne ch
lea ecx, [ebp - 0x273bbd49]
xchg dx, cx
jmp 0x9f5742
mov ch, byte [esp]
jmp 0x9f56e3
mov dl, 0xec
mov edx, dword [esp]
btc edx, edi
jg 0x9f56e0
jle 0x9f56e9
scasb al, byte es:[edi]
or al, 0x82
in eax, 0x14
xchg ebx, eax
sbb dword [ecx + 0x2e9b6809], ebx
js 0x9f577e
mov dl, 0xad
mov esp, 0x15968d8f
lea edx, [esi + 0x233c6915]
mov cx, ax
mov edx, 0xbb155e2e
bsr cx, bp
mov cl, ch
invalid
je 0x9f5762
add al, 0xc2
or byte [eax], al
mov edx, dword [esp]
push edx
rcr ch, 5
jmp 0x9f5793
cmc
mov cx, dx
add ecx, ebp
jmp 0x9f586a
test esp, ebp
pop ds
stosd dword es:[edi], eax
add al, 0xb7
sahf
jmp 0x66c383f6
mov bh, byte [ebx]
stosd dword es:[edi], eax
ret 0x8d7d
lea edx, [eax + 0x49]
neg cx
mov edx, 0x10407478
call fcn.009f56ae
jg 0x9f574f
cmc
mov cx, dx
jmp 0x9f579f
add ecx, ebp
jmp 0x9f586a
setg ch
jmp 0x9f580b
lea edx, [eax + 0x49]
neg cx
mov edx, 0x10407478
mov dl, dh
jmp 0x9f5709
cbw
call 0x9f57f4
sete ch
mov edx, esi
jmp fcn.009cc255
lea esp, [esp + 4]
dec al
lea edx, [ecx*4]
mov edx, esi
pushal
jmp 0x9f57a6
dec al
sub esp, 0x16
jb 0x9f5571
pop ecx
pop cx
bsr dx, bp
not cx
setp cl
jmp 0x9f5651
mov edx, dword [esp]
xor dl, ch
mov edx, 0x2202180e
jmp 0x9f5932
lea esi, [ecx + 0x93]
pop edi
cmc
btr ebp, ebx
mov si, word [esp]
jmp 0x9f553c
Function at 0x9f5656
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
pop ebx
inc esi
jmp 0x9f651a
pop ebp
stc
call fcn.009f4f46
lea edx, [eax + 0xd9]
lea edx, [esi + 0x3d]
not dx
push esp
pop dx
jmp 0x9f5196
xchg byte [esp], dh
mov edx, 0x66961b40
lea edx, [eax - 0xe9]
neg dx
ja 0x9f51d2
jbe 0x9f51bc
das
lodsd eax, dword [esi]
cmp eax, 0x3c03b744
setbe byte [esi - 9]
rcl byte [esi + 0x5a], cl
jmp 0x9f5196
lea esp, [esp + 2]
jmp 0x9f5452
lea esp, [esp + 2]
jmp 0x9f5452
xchg byte [esp + 1], ch
xor cx, 0xbff2
jmp 0x9f5426
pop dword [esp]
jmp 0x9f5404
inc ebp
call 0x9f542d
xchg dword [ebx - 0x5516fe3c], eax
add byte [eax], al
add byte [esi], ch
bsf cx, si
xchg ch, dl
lea esp, [esp + 3]
lea edx, [eax - 0x716d4e67]
mov dx, bx
jmp 0x9f548a
add bl, cl
sub esp, 8
jbe 0x9f5421
pop dword [esp]
xchg byte [esp + 1], ch
xor cx, 0xbff2
jmp 0x9f5426
bt edx, esp
setno dh
jmp 0x9f59cc
lea ecx, [esi + 0xe5]
and dx, 0x83a8
jo 0x9f5467
bt edx, esp
call 0x9f54a0
mov eax, dword [0x863e148d]
jmp 0xcaaea909
bswap esi
pop esi
dec ebp
mov ebp, dword [esp]
jmp 0x9f5143
pop ecx
jmp 0x9f5578
pop cx
bsr dx, bp
not cx
jmp 0x9f564e
mov edx, esp
add edx, ebp
jmp 0x9f55f0
add edx, ebp
lea edx, [ebp*4]
jmp 0x9f55f7
sete ch
neg edx
jp 0x9f55c1
mov edx, esp
jmp 0x9f55cb
lea edx, [ebp*4]
call 0x9f5656
lea esp, [esp + 4]
sub al, 0x70
stc
je 0x9f57bc
jne 0x9f5783
out 0x11, al
nop
adc ecx, dword [edx + 0x24648d25]
adc al, 0xc0
enter 0x6600, 0xffffffffffffffb9
out 0x55, eax
mov edx, 0x813dfff8
bswap ecx
jmp 0x9f55e5
setp cl
call 0x9f562d
mov dword [esp], eax
jmp 0x9f55fc
mov ch, byte [esp]
call 0x9f576a
lds ecx, [edx - 0xa14dbd4]
lea esp, [esp + 4]
add al, 0xc6
setne ch
lea ecx, [ebp - 0x273bbd49]
xchg dx, cx
jmp 0x9f5742
mov ch, byte [esp]
jmp 0x9f56e3
mov dl, 0xec
mov edx, dword [esp]
btc edx, edi
jg 0x9f56e0
jle 0x9f56e9
scasb al, byte es:[edi]
or al, 0x82
in eax, 0x14
xchg ebx, eax
sbb dword [ecx + 0x2e9b6809], ebx
js 0x9f577e
mov dl, 0xad
mov esp, 0x15968d8f
lea edx, [esi + 0x233c6915]
mov cx, ax
mov edx, 0xbb155e2e
bsr cx, bp
mov cl, ch
invalid
je 0x9f5762
add al, 0xc2
or byte [eax], al
mov edx, dword [esp]
push edx
rcr ch, 5
jmp 0x9f5793
cmc
mov cx, dx
add ecx, ebp
jmp 0x9f586a
test esp, ebp
pop ds
stosd dword es:[edi], eax
add al, 0xb7
sahf
jmp 0x66c383f6
mov bh, byte [ebx]
stosd dword es:[edi], eax
ret 0x8d7d
lea edx, [eax + 0x49]
neg cx
mov edx, 0x10407478
call fcn.009f56ae
jg 0x9f574f
cmc
mov cx, dx
jmp 0x9f579f
add ecx, ebp
jmp 0x9f586a
setg ch
jmp 0x9f580b
lea edx, [eax + 0x49]
neg cx
mov edx, 0x10407478
mov dl, dh
jmp 0x9f5709
cbw
call 0x9f57f4
sete ch
mov edx, esi
jmp fcn.009cc255
lea esp, [esp + 4]
dec al
lea edx, [ecx*4]
mov edx, esi
pushal
jmp 0x9f57a6
dec al
sub esp, 0x16
jb 0x9f5571
pop ecx
pop cx
bsr dx, bp
not cx
setp cl
jmp 0x9f5651
mov edx, dword [esp]
xor dl, ch
mov edx, 0x2202180e
jmp 0x9f5932
lea esi, [ecx + 0x93]
pop edi
cmc
btr ebp, ebx
mov si, word [esp]
jmp 0x9f553c
Function at 0x9f576a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
pop ebx
inc esi
jmp 0x9f651a
pop ebp
stc
call fcn.009f4f46
lea edx, [eax + 0xd9]
lea edx, [esi + 0x3d]
not dx
push esp
pop dx
jmp 0x9f5196
xchg byte [esp], dh
mov edx, 0x66961b40
lea edx, [eax - 0xe9]
neg dx
ja 0x9f51d2
jbe 0x9f51bc
das
lodsd eax, dword [esi]
cmp eax, 0x3c03b744
setbe byte [esi - 9]
rcl byte [esi + 0x5a], cl
jmp 0x9f5196
lea esp, [esp + 2]
jmp 0x9f5452
lea esp, [esp + 2]
jmp 0x9f5452
xchg byte [esp + 1], ch
xor cx, 0xbff2
jmp 0x9f5426
pop dword [esp]
jmp 0x9f5404
inc ebp
call 0x9f542d
xchg dword [ebx - 0x5516fe3c], eax
add byte [eax], al
add byte [esi], ch
bsf cx, si
xchg ch, dl
lea esp, [esp + 3]
lea edx, [eax - 0x716d4e67]
mov dx, bx
jmp 0x9f548a
add bl, cl
sub esp, 8
jbe 0x9f5421
pop dword [esp]
xchg byte [esp + 1], ch
xor cx, 0xbff2
jmp 0x9f5426
bt edx, esp
setno dh
jmp 0x9f59cc
lea ecx, [esi + 0xe5]
and dx, 0x83a8
jo 0x9f5467
bt edx, esp
call 0x9f54a0
mov eax, dword [0x863e148d]
jmp 0xcaaea909
bswap esi
pop esi
dec ebp
mov ebp, dword [esp]
jmp 0x9f5143
pop ecx
jmp 0x9f5578
pop cx
bsr dx, bp
not cx
jmp 0x9f564e
mov edx, esp
add edx, ebp
jmp 0x9f55f0
add edx, ebp
lea edx, [ebp*4]
jmp 0x9f55f7
sete ch
neg edx
jp 0x9f55c1
mov edx, esp
jmp 0x9f55cb
lea edx, [ebp*4]
call 0x9f5656
lea esp, [esp + 4]
sub al, 0x70
stc
je 0x9f57bc
jne 0x9f5783
out 0x11, al
nop
adc ecx, dword [edx + 0x24648d25]
adc al, 0xc0
enter 0x6600, 0xffffffffffffffb9
out 0x55, eax
mov edx, 0x813dfff8
bswap ecx
jmp 0x9f55e5
setp cl
call 0x9f562d
mov dword [esp], eax
jmp 0x9f55fc
mov ch, byte [esp]
call 0x9f576a
lds ecx, [edx - 0xa14dbd4]
lea esp, [esp + 4]
add al, 0xc6
setne ch
lea ecx, [ebp - 0x273bbd49]
xchg dx, cx
jmp 0x9f5742
mov ch, byte [esp]
jmp 0x9f56e3
mov dl, 0xec
mov edx, dword [esp]
btc edx, edi
jg 0x9f56e0
jle 0x9f56e9
scasb al, byte es:[edi]
or al, 0x82
in eax, 0x14
xchg ebx, eax
sbb dword [ecx + 0x2e9b6809], ebx
js 0x9f577e
mov dl, 0xad
mov esp, 0x15968d8f
lea edx, [esi + 0x233c6915]
mov cx, ax
mov edx, 0xbb155e2e
bsr cx, bp
mov cl, ch
invalid
je 0x9f5762
add al, 0xc2
or byte [eax], al
mov edx, dword [esp]
push edx
rcr ch, 5
jmp 0x9f5793
cmc
mov cx, dx
add ecx, ebp
jmp 0x9f586a
test esp, ebp
pop ds
stosd dword es:[edi], eax
add al, 0xb7
sahf
jmp 0x66c383f6
mov bh, byte [ebx]
stosd dword es:[edi], eax
ret 0x8d7d
lea edx, [eax + 0x49]
neg cx
mov edx, 0x10407478
call fcn.009f56ae
jg 0x9f574f
cmc
mov cx, dx
jmp 0x9f579f
add ecx, ebp
jmp 0x9f586a
setg ch
jmp 0x9f580b
lea edx, [eax + 0x49]
neg cx
mov edx, 0x10407478
mov dl, dh
jmp 0x9f5709
cbw
call 0x9f57f4
sete ch
mov edx, esi
jmp fcn.009cc255
lea esp, [esp + 4]
dec al
lea edx, [ecx*4]
mov edx, esi
pushal
jmp 0x9f57a6
dec al
sub esp, 0x16
jb 0x9f5571
pop ecx
pop cx
bsr dx, bp
not cx
setp cl
jmp 0x9f5651
mov edx, dword [esp]
xor dl, ch
mov edx, 0x2202180e
jmp 0x9f5932
lea esi, [ecx + 0x93]
pop edi
cmc
btr ebp, ebx
mov si, word [esp]
jmp 0x9f553c
Function at 0xaf269c
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc ebp, ebx
xchg dh, al
jmp 0xaf26cb
rdtsc
mov edx, dword [esp + 1]
xchg byte [esp + 1], al
lea eax, [ebp*4]
setle dh
xchg dword [esp], esi
jmp 0xaf27ae
pop cx
inc cx
xchg di, bp
bswap edi
xchg ah, bl
lea esp, [esp]
jmp 0xaf2774
push edx
mov esi, 0x85af2960
pop ebp
add esp, 0
lea esp, [esp]
xchg bx, si
jmp 0xaf2706
mov eax, 0x805f14bc
not dh
mov eax, 0xa5ca6a4c
mov ah, byte [esp + 2]
push word [esp + 1]
xchg cx, ax
jmp 0xaf271e
mov word [esp], sp
mov dx, word [esp + 2]
call fcn.00af2750
daa
mov ah, 0x2a
dec ebp
mov esp, 0x31a13355
push eax
mov dword [0xdaa36006], eax
xor eax, 0xc4835724
add ecx, dword [edi]
xchg ebx, eax
invalid
add esp, 3
setae bh
rdtsc
not ch
setnp dh
mov bh, byte [esp + 2]
jmp 0xaf2736
bsf cx, si
xchg di, dx
setno ah
push word [esp + 1]
not eax
xchg word [esp + 3], ax
jmp 0xaf2794
Function at 0xaf2c85
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
sub esp, 0x1e
rcr ecx, 0xb
jmp 0xaf2ccc
mov eax, ebp
rdtsc
mov dl, 0xfc
lea esp, [esp + 0x21]
push word [esp + 3]
bsf bp, si
jmp 0xaf2d20
lea edi, [ecx*4]
lea eax, [ebx + ebp]
mov byte [esp + 2], ah
xor ecx, esi
bswap eax
jmp 0xaf2d81
cpuid
neg ch
mov ebp, 0x9b66f0c6
rdtsc
mov bp, word [esp]
bswap eax
jmp 0xaf2db3
bswap edx
not ah
lea esp, [esp + 1]
mov dh, byte [esp]
mov bl, 0x18
lea esp, [esp]
jmp 0xaf2d4f
xchg word [esp + 1], cx
inc ebx
xor dl, ch
mov bp, word [esp]
pop esi
xchg byte [esp], dl
jmp 0xaf2d68
mov dl, dh
push esp
xchg bh, cl
pop dx
add esp, 2
lea ecx, [ebx + esi]
jmp 0xaf2e53
xchg ecx, eax
mov ebx, 0x3d3a2400
mov byte [esp], ah
inc cl
cmc
btr edi, edx
jmp 0xaf2d93
mov di, bx
not dh
mov di, word [esp]
inc edi
lea ebx, [esp + eax]
push edx
jmp 0xaf2e03
lea eax, [esp + edi]
ror dh, 7
lea ebp, [eax + 0x54847899]
cpuid
push dword [esp + 3]
jmp 0xaf2f67
xchg byte [esp], cl
neg di
mov cl, ch
inc bx
lea esi, [esi + 0xed]
not cx
jmp 0xaf2def
setp dh
stc
neg eax
mov byte [esp], bh
lea esp, [esp]
xchg bp, di
jmp 0xaf2e1b
rdtsc
lea ecx, [edi*4]
mov edi, 0x88c8d6b2
xchg di, ax
btr edi, edx
cpuid
jmp 0xaf2e35
mov cl, 0x52
btc edi, edi
pop word [esp]
call fcn.00af2ef1
cmc
mov dword [esp + 1], ecx
btr edi, esp
mov bx, di
add esp, 0
mov word [esp + 2], bx
jmp 0xaf2f3e
Function at 0xaf3262
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ch, dl
bsf cx, si
xchg dword [esp + 0x16], ebx
sub esp, 0x12
lea edx, [esp + ecx]
jmp 0xaf3290

Function at 0xaf354b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap esi
setae ch
xchg dword [esp + 6], ebx
xchg ah, bl
xchg dword [esp + 4], esi
xchg edx, eax
jmp 0xaf3550
setge ah
jmp 0xaf3531
cpuid
mov ebp, 0xc025428e
mov byte [esp + 0xa], ch
lea esp, [esp + 1]
not ax
jmp 0xaf357f
mov dl, 4
pop word [esp + 0xa]
mov edx, dword [esp + 7]
mov cx, word [esp + 1]
not bp
push esp
jmp 0xaf363d
rdtsc
mov cx, word [esp]
ror ah, 1
xor dl, ch
mov bp, word [esp]
mov ebx, dword [esp]
jmp 0xaf35a7
mov esi, dword [esp + 0xd]
mov ecx, esi
pop ecx
not ebx
lea ebx, [ecx - 0x17dc7a15]
add esp, 0xc
jmp 0xaf35d1
pop ebx
lea ebp, [ebp*4]
mov edx, dword [esp]
rol bx, cl
pop dword [esp + 0xa]
rdtsc
jmp 0xaf35ec

Function at 0xaf43c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xf]
pop dword [esp + 2]
lea esp, [esp + 1]
jmp 0xaf440e
lea esp, [esp + 0x14]
pushal
mov ebp, eax
lea esi, [esi - 0x5d]
cpuid
xchg edi, edx
jmp 0xaf43f2

Function at 0xaf4ce3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, eax
pushal
push dword [esp + 0x1a]
mov bx, word [esp + 0x22]
mov dl, dh
jmp 0xaf490f
Function at 0xaf5861
Capabilities:
Parse pe header

Disassembly:
mov byte [esp], dh
lea esp, [esp + 3]
call fcn.00af5846

Function at 0xaf588e
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.00af501a
lea esp, [esp + 2]
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
jmp 0xaf58d1
jmp 0xaf586d
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xaf5015
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xaf58b3
Function at 0x406ab8
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jge 0x406ada
mov eax, 0xfffffffd
jmp 0x406b52
mov ebx, dword [0x5d528c]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x406b20
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x5d528c]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x406b48
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x406b52
mov esp, ebp
pop ebp
ret 4
Function at 0x4176ec
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, dword fs:[0x30]
mov al, byte [ecx + 2]
leave
ret
Function at 0x429d70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48753b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047bec6
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x429df2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00479ddd
mov eax, dword [eax]
push 0x5c7260
push eax
call fcn.0046c8c4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047c151
test bl, bl
je 0x429df2
push 0x5c7260
lea ecx, [esp + 0xc]
call fcn.0047c4e1
push 0x5caddc
lea ecx, [esp + 0xc]
call fcn.0047c4e1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x429e2e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047c151
jmp 0x429ef9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x429eb2
lea edx, [esp + 0x7c]
push 0x5cadd8
push edx
call fcn.0046c8c4
add esp, 8
test eax, eax
je 0x429eb2
lea eax, [esp + 0x7c]
push 0x5cadd4
push eax
call fcn.0046c8c4
add esp, 8
test eax, eax
je 0x429eb2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x429e42
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047c151
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x42a6f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42a752
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x42a760
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4875bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5d12e8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x42a898
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x42a7c6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047c151
xor eax, eax
jmp 0x42a90f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0047c28e
push esi
lea ecx, [esp + 0xc]
call fcn.0047c51d
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x42a8ed
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0042a6f0
test eax, eax
jne 0x42a8ed
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0042a6f0
test eax, eax
jne 0x42a8ed
lea eax, [esp + 0x14]
push 0x5cadf0
push eax
call fcn.0046d940
mov esi, eax
add esp, 8
test esi, esi
jne 0x42a8cc
lea ecx, [esp + 0x14]
push 0x5cadec
push ecx
call fcn.0046d8c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x42a8cc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x42a8cf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0047c23e
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x42a7de
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047c151
xor eax, eax
jmp 0x42a90f
mov byte [esi], 0
push 0x5cade8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0047c151
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4