joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4428e0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46f6e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00462f43
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004685d9
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00469af5
test eax, eax
je 0x4429fc
mov ecx, dword [esp + 0x3c]
call fcn.00468606
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4429c0
push edi
mov ecx, esi
call fcn.00465c6a
mov ecx, esi
call fcn.00442b60
cmp dword [esp + 0x38], 1
jne 0x4429f5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00465da5
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x445410
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x445443
push esi
call fcn.00448500
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44543c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4454c9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4454b2
mov eax, dword [esi + 8]
test eax, eax
je 0x445467
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4454ae
cmp eax, 2
je 0x4454b2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44545a
cmp eax, 3
je 0x44548d
cmp eax, 1
jne 0x44545a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44545a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44545a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004454f0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4454d8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004454f0
add esp, 4
pop esi
ret

Function at 0x463d39
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x463d71
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00461ded
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00461dc5
jmp 0x463d7d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x465427
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x465469
call fcn.0046aee0
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x465469
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x465460
xor eax, eax
jmp 0x465471
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00465477
pop edi
pop esi
pop ebx
ret 4

Function at 0x46b410
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46b43e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46b45c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046b376
jmp 0x46b45c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46b45c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046b376
test edi, edi
mov eax, edi
jne 0x46b446
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5f2a53
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
call fcn.005f955c
mov eax, dword [reloc.RASAPI32.dll_RasHangUpA]
lcall 0xaf5c, 0xcd527b2d

Function at 0x7092ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bp, ax
xchg ebp, ecx
mov ch, byte [esp + 5]
clc
pop dword [esp]
rcr ch, 5
jmp 0x709360
push dword [esp + 1]
neg ebx
cpuid
lea edi, [edi + edi]
xchg ebx, ecx
lea esp, [esp + 0xb]
jmp 0x70927d
mov byte [esp + 0x17], ch
pop dword [esp]
pop dword [esp + 1]
jmp 0x709294
mov byte [esp + 0xb], dh
bsr di, bp
push esp
mov word [esp + 0xa], bx
rdtsc
neg ch
jmp 0x70933a
lea ecx, [esi - 0xd5]
lea edi, [esp + ebx]
mov cl, 0xa
mov ebx, ebp
lea edi, [edx + edx]
sub esp, 0x1c
jmp 0x7092bb
mov cl, 0xe2
mov eax, 0xa6292ea
mov ebp, 0xaafde1b8
pop esi
mov bp, 0x6acf
bswap ebp
jmp 0x7092e1
lea edi, [edx*4]
setle bh
neg bp
sub esp, 0x1e
pop ax
push dword [esp + 0x10]
jmp 0x709377
xchg word [esp + 0x15], ax
cmc
add esp, 0x17
neg edx
mov dword [esp + 8], esi
bsf di, ax
jmp 0x70931a
inc edx
push dword [esp + 6]
mov di, word [esp + 6]
xchg dword [esp + 2], ebx
xchg ch, dl
mov word [esp + 4], bx
jmp 0x709305
mov si, sp
mov ecx, dword [esp + 0x1d]
pop eax
sub bl, ah
pop dword [esp + 0x15]
mov bp, word [esp + 0x19]
jmp 0x7093cb
cpuid
push edx
push word [esp + 0x13]
xor ecx, esi
btr esi, edx
mov dl, dh
jmp 0x709419
neg bx
not dx
lea esp, [esp + 1]
pop edi
xchg byte [esp + 0xe], dl
mov bp, word [esp + 8]
jmp 0x7093ab
lea eax, [esi*4]
mov dword [esp + 3], esi
mov dl, 0x44
mov word [esp], bx
jmp 0x709461
mov ecx, dword [esp + 0x1d]
cpuid
mov word [esp + 0x20], dx
shr esi, 0x1f
popal
xchg bh, cl
jmp 0x7093e1
lea edi, [ecx - 3]
rdtsc
pop word [esp + 0x15]
mov edx, dword [esp + 5]
bswap eax
mov byte [esp + 0xe], ah
jmp 0x7093fa
lea edx, [edx*4]
mov ebp, dword [esp]
cpuid
lea ecx, [esp + ebx]
bswap edx
mov cl, 0x4a
jmp 0x709475
cpuid
pop ecx
bsr di, cx
mov bx, 0x96e7
jmp 0x70942f
sub esp, 2
xchg cx, dx
add esp, 5
bsf di, si
mov al, ah
mov dx, di
jmp 0x70944a
add ebp, ebp
lea edi, [ecx*4]
rdtsc
mov dh, byte [esp]
and cl, bh
mov byte [esp], dh
jmp 0x70981b
shr ah, 1
call fcn.007094c0
mov dx, 0x1f81
xchg dh, al
pop dword [esp + 2]
xchg ah, bl
cld
call fcn.0070961f
or byte [ecx + 0x38936001], dl
nop
adc ecx, dword [edx - reloc.RASAPI32.dll_RasHangUpA]
xchg byte [esp + 5], al
push word [esp + 7]
xchg byte [esp + 2], bl
mov bx, sp
jmp 0x70958e
mov dl, dh
xchg ecx, ebp
push esp
cpuid
push edx
mov edx, dword [esp + 2]
jmp 0x709587
push edx
mov eax, dword [esp + 4]
btc ebx, ebx
mov edx, esi
push dword [esp + 1]
btr ebp, edx
jmp 0x709646
Function at 0x70961f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 8]
lea eax, [esp + ebp]
btr ecx, esp
cpuid
rdtsc
jmp 0x709624
pop word [esp + 3]
sub esp, 4
xchg dword [esp], ebp
sub esp, 0xc
jmp 0x7095f2
pop dword [esp]
jmp 0x709608
xchg dword [esp + 0xc], esi
rdtsc
lea ecx, [ecx + edx]
mov ecx, 0x16409ed4
xchg dword [esp + 8], eax
pop dword [esp + 6]
jmp 0x7097e4
pushal
pop ebx
pop ebp
call fcn.00709678
mov ebx, dword [esp + 3]
jmp 0x7096b4
lea esp, [esp + 5]
call 0x70973c
push dword [esp + 5]
not dh
not dh
mov cx, word [esp + 8]
call fcn.0070971f
mov ds, word [bx + di]
js 0x70973a
xchg bp, di
xchg ebp, edi
cld
pop dword [esp]
pop edx
push word [esp + 1]
call 0x7096aa
pop ebx
mov dl, 0xad
mov esp, 0x24648d8f
add dword [esi - 0x75], esp
dec esp
and al, 8
xchg dword [esp], edi
lea ebp, [eax + ebx]
pop dword [esp]
mov si, word [esp + 2]
jmp 0x7096d3
xchg cx, di
setno ah
mov dword [esp + 5], eax
add esp, 1
cld
mov ah, byte [esp + 0xa]
jmp 0x7096a2
add al, 0xb7
xchg esi, edi
add al, dh
pushal
lea eax, reloc.RASAPI32.dll_RasHangUpA
cpuid
jmp 0x7096bd
pop dword [esp + 4]
mov bx, word [esp + 8]
not ecx
inc bl
inc dl
push edx
jmp 0x70970b

Function at 0x709937
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 4], cl
mov ebx, ebp
jmp 0x709943
sub esp, 0x10
shl dx, cl
not eax
mov edx, 0x897de47a
mov word [esp], sp
xchg word [esp + 1], bp
jmp 0x709983
Function at 0x709c14
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr dx, cx
bswap ebx
pop dword [esp]
bsf bx, ax
xor dl, ch
jmp 0x709c74
lea eax, [ebp*4]
rdtsc
xchg dword [esp], ebp
mov ecx, 0x285cede2
jmp 0x709cb3
push esp
mov edx, 0x60df144c
lea esp, [esp + 4]
xchg byte [esp + 2], dl
rcr ebx, 0x1b
jmp 0x709c3e
mov dx, word [esp + 6]
setge ah
xchg ecx, ebx
xchg byte [esp], bl
btr ebp, esp
mov bh, byte [esp + 3]
jmp 0x709c58
lea ebp, [eax + edx]
inc bl
rdtsc
add esp, 0
lea esp, [esp + 1]
mov ah, byte [esp + 3]
jmp 0x709ce2
mov word [esp + 3], sp
shl si, cl
mov dl, dh
btr edx, edx
mov ecx, dword [esp + 3]
jmp 0x709c8a
push dword [esp]
lea edi, [ecx - 0x8b]
mov ah, byte [esp + 7]
setns bh
not ax
lea ebx, [ecx - 0xdb]
jmp 0x709fb5
mov ecx, 0x5af37686
neg cx
sub esp, 0x1c
xchg dh, al
xchg byte [esp + 0x12], bl
jmp 0x709d4c
mov eax, ecx
bswap edx
cld
lea edi, [eax*4]
inc eax
xchg edx, ebp
jmp 0x709d0c
mov al, ah
xchg esi, ebp
mov cl, ch
btc ecx, ebx
mov cl, ch
mov al, 0xde
jmp 0x709d25
shl dx, cl
pop cx
xchg ebx, edi
xchg bp, si
pop dword [esp + 5]
jmp 0x709d73
inc ax
not bh
mov ax, word [esp]
mov edx, ecx
xchg ch, dl
btc eax, edi
jmp 0x709d3d
pop dword [esp + 0xd]
xchg edx, edi
inc cl
lea eax, [eax + 0x71]
bsf bx, si
mov edx, eax
jmp 0x709daa
not ah
lea esp, [esp]
mov ah, byte [esp]
neg ch
mov bl, bh
lea esi, [ebp*4]
jmp 0x709d62
setnp bh
pop ebx
push dword [esp + 0xb]
mov dword [esp + 0xd], esi
mov ecx, dword [esp + 0x11]
mov cl, 0x8a
jmp 0x709e30
xchg edx, ebp
lea esi, [edx*4]
neg cx
cpuid
sete dh
btc ebp, edi
jmp 0x709d95
pop dword [esp + 0x22]
rdtsc
xchg ah, bl
bsf bx, si
bsf ax, ax
pop edi
jmp 0x709ef4
push dword [esp + 0x32]
mov bh, byte [esp + 0x34]
mov ah, byte [esp + 0x18]
mov si, word [esp + 0x24]
xchg dword [esp + 0x28], ebp
lea ecx, [ecx + edx]
jmp 0x709dde
mov cx, bx
mov ah, byte [esp + 6]
mov si, bx
bsr bp, cx
pushal
bswap esi
jmp 0x709e09
push esp
lea esp, [esp + 3]
mov byte [esp], bh
mov ax, sp
sub esp, 0
rdtsc
jmp 0x709dc8
mov ecx, esi
lea esi, reloc.RASAPI32.dll_RasHangUpA
lea ebp, [esi - 0x15]
mov ah, byte [esp + 0x11]
jmp 0x709ed7
popal
xchg bp, si
mov ah, byte [esp + 0xa]
mov bp, word [esp + 4]
mov dh, byte [esp + 0x10]
push edx
jmp 0x709e65
mov al, 0x56
mov bp, word [esp + 0x29]
xchg dword [esp + 0x27], esi
rdtsc
mov eax, ecx
push esp
jmp 0x709e7b
push dword [esp + 2]
call fcn.00709eac
adc cl, byte [edi + 0x3e897a1f]
mov eax, 0x20d1b620
xchg edi, eax
invalid
pop word [esp + 0x16]
mov word [esp + 0x13], dx
mov dx, word [esp + 0x23]
mov word [esp + 7], sp
mov byte [esp + 3], ah
xchg dword [esp + 0x1e], edi
jmp 0x709e9a
mov byte [esp + 0x18], ch
sub esp, 0x1c
lea esp, [esp + 0x4a]
mov bx, di
mov cx, bx
neg esi
jmp 0x709e50
add al, dh
mov edi, 0x9acc3b84
mov dword [esp + 5], ecx
mov edx, dword [esp + 5]
push dword [esp + 2]
pushal
jmp 0x709f5c

Function at 0x709f12
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [esi*4]
lea esp, [esp + 0xb]
cpuid
pop dword [esp + 0xc]
mov dx, di
jmp 0x709f39

Function at 0x709ff2
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bp
add esp, 9
neg edi
jmp 0x70a073
Function at 0x70d93d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ebx
push word [esp + 3]
xchg dh, al
xchg si, di
bswap edi
jmp 0x70da1c
bswap ecx
mov byte [esp], ah
mov word [esp], di
rcr ah, 1
jmp 0x70d926
xchg word [esp + 5], bx
sub bl, ah
xchg dword [esp + 6], ebp
xchg dword [esp + 8], eax
pop dword [esp + 4]
lea edi, [edx + ebx]
jmp 0x70d986
bswap ecx
pop edx
sub esp, 0xc
bswap esi
lea ebp, [eax + edx]
mov byte [esp + 4], ch
jmp 0x70d99e
lea edi, [eax + 0x29]
mov dh, byte [esp + 5]
setbe ch
not ah
mov cl, 0x12
xchg byte [esp + 3], dl
jmp 0x70d9b9
Function at 0x70de0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, bh
mov bl, 0x20
jmp 0x70df8c
pop word [esp + 3]
lea ebp, [edi*4]
xchg bh, cl
mov dh, byte [esp + 3]
sub esp, 0
push dword [esp + 2]
jmp 0x70deb1
sub esp, 6
lea ebx, [edx*4]
mov al, 0x56
mov ax, 0xe343
mov ebx, 0x93ffe744
neg di
jmp 0x70de51
mov byte [esp + 0xb], dh
pop word [esp + 1]
pop word [esp + 4]
cpuid
mov al, 0x1e
mov esi, dword [esp + 8]
jmp 0x70df40
push dword [esp + 4]
lea esp, [esp + 5]
bswap eax
rdtsc
xchg byte [esp + 0xa], cl
jmp 0x70de92
pop bp
pop bp
neg ecx
mov byte [esp + 9], dh
pop ecx
lea esp, [esp + 5]
jmp 0x70de78
push dword [esp + 9]
rdtsc
btc eax, edi
neg di
bswap ecx
push dword [esp + 6]
jmp 0x70df02
rcr ebx, 0x1b
cpuid
lea esi, [edx + edi]
xchg edi, ebp
not edi
pop si
jmp 0x70ded9
sub esp, 6
lea ebp, [esp + edx]
not bp
clc
setg bh
pop word [esp + 0x12]
jmp 0x70dfc0
mov ax, 0xc0b5
add esp, 0x24
neg bh
pop dword [esp]
pop word [esp]
sub esp, 0xe
jmp 0x70def2
pop cx
bswap ebp
neg bh
push dword [esp + 4]
pushal
xchg word [esp + 5], di
jmp 0x70df26
mov dx, word [esp + 3]
lea ecx, [edx + ebx]
xchg bx, bp
xchg edx, esi
btc esi, ebx
xchg dword [esp + 7], ecx
jmp 0x70dec8
mov edx, esi
lea edi, [edx*4]
mov byte [esp + 1], dh
add esp, 0
mov ch, byte [esp + 0x10]
push dword [esp + 2]
jmp 0x70df63
setae bh
xchg si, dx
cpuid
lea ebp, [ebx + edi]
sub esp, 0xe
xchg edx, ebp
jmp 0x70dfe9
pop esi
add esp, 4
mov si, sp
rdtsc
add esp, 0xa
xchg dword [esp + 4], edi
jmp 0x70dfa6
mov edx, 0xc9e54d8c
xchg dword [esp + 0xa], edx
sub esp, 0x18
lea esi, [edx + edi]
jmp 0x70f532
lea eax, [edi*4]
mov cx, 0x50d5
pop dword [esp + 0xb]
jmp 0x70dfd2
mov cl, ch
bswap edi
and cl, bh
rol di, cl
mov eax, esi
xchg dh, al
call fcn.0070e01b
add esp, 5
sub esp, 0x1a
not si
pop cx
setg dh
mov ax, 0x4533
jmp 0x70e4d6
btr ebp, esp
setp dh
xchg dh, al
cpuid
rdtsc
mov cl, ch
jmp 0x70e53a
xchg esi, edx
add bp, 0x10e6
inc al
ror ch, 5
jmp 0x70e564
bsf cx, si
pop dword [esp]
mov ebx, 0xab4fda72
mov edi, dword [esp + 7]
mov byte [esp + 3], ah
not ch
jmp 0x70e508
shr ah, 1
mov bp, word [esp]
mov bl, 0xe0
lea esp, [esp + 0x10]
mov ebx, ebp
setae ah
jmp 0x70e51e
mov bl, 0x78
call fcn.0070e5b8
jle 0x70e551
add byte [eax], al
add byte [esi - 5], bh
imul ecx, dword [esi], reloc.RASAPI32.dll_RasHangUpA
pop esp
push esp
fdiv qword [edx + 0x15]
in al, 0x30
test eax, 0x66826bc8
mov dword [esp + 5], ebx
mov word [esp + 5], bx
mov edx, dword [esp]
push word [esp + 1]
lea eax, [ecx*4]
setno bh
xchg dword [esp + 1], eax
jmp 0x70e54d
sub esp, 0x16
lea esp, [esp + 0x41]
cpuid
btr ebx, edx
stc
mov si, dx
jmp 0x70e48b
Function at 0x70e01b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
xchg byte [esp], cl
mov eax, 0xf7c36ae4
add esp, 1
neg ecx
pop cx
jmp 0x70e1cd
jmp 0x70dffa
pop dword [esp + 4]
rdtsc
xchg word [esp + 7], cx
pop ebp
mov word [esp + 1], dx
mov dl, 0xb4
jmp 0x70e0fe
mov ebp, dword [esp]
mov edx, 0x36229c26
xchg bx, dx
sub esp, 0xe
rcl bp, cl
inc edi
jmp 0x70e01d
bswap eax
btr ecx, esp
call 0x70e05d
mov dl, 0xa4
mov di, 0x9e9d
lea edx, [esi + 0x85]
mov ebp, dword [esp + 2]
xchg ebx, edx
neg ecx
jmp 0x70e0e7
mov edi, 0x247c8b66
push es
mov di, word [esp + 6]
call int.0070e144
loope 0x70e149
std
test byte [edi - 0x65], dh
int1
jle 0x70e0cf
mov eax, dword [esi - reloc.RASAPI32.dll_RasHangUpA]
add byte [esi + 0xf042444], al
xor dword [edx - reloc.RASAPI32.dll_RasHangUpA], ecx
ficomp dword [eax - 0x2c]
dec edx
sub eax, 0x80c137dc
sub esp, 0
xchg byte [esp + 4], al
rdtsc
mov ah, byte [esp + 6]
jmp 0x70e0d0
cpuid
mov edx, 0x5b799a56
bswap ebp
btc ecx, ebx
xchg dword [esp], edi
mov word [esp + 2], sp
jmp 0x70e085
push esp
and al, 1
add esp, 0
cld
bswap eax
rdtsc
lea edx, [eax + edx]
mov dh, byte [esp]
jmp 0x70e049

Function at 0x70e277
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
sete bh
call 0x70e277
mov ecx, dword [edi]
mov byte [0x5d2204eb], al
lodsb al, byte [esi]
mov edi, 0x9247489
pop word [esp + 0xb]
cpuid
shl ax, cl
push dword [esp + 0xa]
jmp 0x70e2c3
inc di
sub esp, 0x1a
bswap edi
setno ch
mov bp, 0xda71
xchg bh, cl
jmp 0x70e365
lea ebp, [ebp*4]
xchg di, ax
btc edx, ebx
add esp, 0xd
xchg di, ax
sub esp, 0x18
jmp 0x70e29c
pop di
mov bl, bh
not esi
inc esi
pushal
mov dl, 0xbc
jmp 0x70e300
bsr bp, cx
pop dword [esp + 0xa]
popal
lea ecx, reloc.RASAPI32.dll_RasHangUpA
xchg di, cx
bswap ebx
jmp 0x70e31a
xchg si, dx
pop dword [esp + 0x22]
bswap edx
sete bh
lea edi, [esi*4]
rdtsc
jmp 0x70e33b

Function at 0x70e4b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 8], dh
mov bl, 0x10
cpuid
rdtsc
xchg word [esp + 1], cx
jmp 0x70e49d

Function at 0x70eb58
Capabilities:
Parse pe header

Disassembly:
mov word [esp + 0xa], dx
mov dword [esp + 9], eax
jmp 0x70eb9f
pop dword [esp]
pop dword [esp + 8]
push word [esp + 0x29]
mov dword [esp + 0x98], esi
call fcn.0070eb80
lea esp, [esp + 0x94]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x70ec1b

Function at 0x70eb80
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
pop word [esp]
mov byte [esp], ah
jmp 0x70ebdc
lea esp, [esp + 1]
mov dword [esp + 0x94], edi
jmp 0x70ebb7
mov byte [esp], ch
mov word [esp], di
mov word [esp], sp
mov byte [esp], ch
lea esp, [esp + 1]
mov byte [esp], ch
jmp 0x70eb89
Function at 0x402000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x70
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x4027e0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov word [ebp - 0x42], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x30]
jae 0x40219f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x68]
mov dword [esp], eax
call fcn.00402840
sub esp, 4
cmp dword [ebp + 8], 0
jbe 0x402164
cmp dword [ebp + 0xc], 3
jbe 0x402164
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], 0
mov eax, esp
lea ecx, [ebp - 0x68]
mov dword [eax], ecx
mov dword [eax + 4], 0x14d
call fcn.00401e70
mov dword [ebp - 0x74], eax
jmp 0x402103
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x40215f
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp + 0xc]
jne 0x40215a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x24]
mov ecx, dword [ebp - 0x48]
shl ecx, 1
add eax, ecx
mov ax, word [eax]
mov word [ebp - 0x42], ax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x1c]
movzx ecx, word [ebp - 0x42]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x70], 2
jmp 0x402174
jmp 0x40215f
jmp 0x402164
mov eax, dword [ebp - 0x2c]
add eax, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x68]
call fcn.00402900
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x402191
jmp 0x40218c
jmp 0x40219f
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
jmp 0x402098
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x38]
add eax, ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x70
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4021e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x49f400], eax
pop esi
pop edi
pop ebp
ret
Function at 0x403fe3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x404022
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404022
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404022
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404022
cmp dword [ecx + 0x74], 0xe
jbe 0x404022
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40a4db
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40a578
push ebx
push esi
call fcn.0040a4a4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040a3ed
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40a525
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a577
push edi
push eax
call fcn.00408ebb
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40a545
call fcn.00408f09
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a576
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040a3ed
add esp, 0x20
test eax, eax
jne 0x40a564
push edi
call fcn.00408f09
jmp 0x40a56c
push ebx
call fcn.00408f09
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40b770
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x413ed8
push 0x413ed0
push str.FlsAlloc
push 0x1e
call fcn.0040b631
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b7a4
push dword [ebp + 8]
mov ecx, esi
call dword [0x411138]
call esi
jmp 0x40b7aa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b7ee
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x413ee8
push 0x413ee0
push str.FlsGetValue
push 0x20
call fcn.0040b631
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b825
push dword [ebp + 8]
mov ecx, esi
call dword [0x411138]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]