joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014a0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x41ad0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov dword [esp + 0x14], 0
mov eax, dword [0x4242e0]
mov dword [esp + 0x20], 1
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea ecx, [esp + 4]
mov byte [esp + 0x20], 3
call fcn.00413174
mov ecx, dword [esp + 0x2c]
xor esi, esi
mov eax, dword [ecx - 8]
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x401560
push edi
mov al, byte [ecx + esi*2]
mov cl, byte [ecx + esi*2 + 1]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], cl
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and eax, 0xff
and ecx, 0xff
push str.1w_
lea edx, [eax + eax*2]
lea eax, [eax + edx*4]
lea edi, [ecx + eax*2 - 0x6db]
lea ecx, [esp + 0x10]
call fcn.00413326
push edi
push 0
lea ecx, [esp + 0x14]
call fcn.00413623
lea edx, [esp + 0xc]
lea ecx, [esp + 8]
push edx
call fcn.00413574
mov ecx, dword [esp + 0x30]
inc esi
mov eax, dword [ecx - 8]
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jl 0x4014f7
pop edi
lea eax, [esp + 4]
lea ecx, [esp + 0x2c]
push eax
call fcn.004132d6
mov edx, dword [esp + 0x2c]
xor esi, esi
mov eax, dword [edx - 8]
test eax, eax
jle 0x4015c3
push ebx
mov ebx, dword [esp + 0x34]
mov dl, byte [esi + edx]
xor ecx, ecx
mov cl, bh
xor cl, dl
push ecx
push esi
lea ecx, [esp + 0x10]
call fcn.00413623
mov edx, dword [esp + 0x30]
movzx ax, byte [esi + edx]
add eax, ebx
mov ebx, 0x58bf
lea ecx, [eax + eax*2]
shl ecx, 4
sub ecx, eax
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*8]
lea eax, [eax + ecx*2]
sub ebx, eax
mov eax, dword [edx - 8]
inc esi
cmp esi, eax
jl 0x401580
pop ebx
mov esi, dword [esp + 0x28]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00412f5e
mov dword [esp + 0x14], 1
lea ecx, [esp + 8]
mov byte [esp + 0x20], 2
call fcn.004131e9
lea ecx, [esp + 4]
mov byte [esp + 0x20], 1
call fcn.004131e9
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call fcn.004131e9
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x401cf0
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x41ae28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
push edi
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
and ecx, 0xffff
push eax
push ecx
push 0
mov dword [esp + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [esp + 0xc]
mov ebp, eax
call fcn.004025e8
mov edx, dword [esp + 0x40]
push 0
push edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 2
call fcn.004026ab
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.00402661
test edi, edi
jne 0x401db0
mov eax, dword [esp + 0x40]
push edi
push edi
push 1
push edi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
call fcn.004199cd
mov eax, dword [eax + 0xc]
lea ecx, [esp + 0x3c]
push 0
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401db0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.00402625
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 0
call fcn.004131e9
lea ecx, [esp + 0x40]
mov dword [esp + 0x30], 0xffffffff
call fcn.004131e9
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc

Function at 0x401e00
Capabilities:
Access peb ldr_data
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41ae50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0
call fcn.004025e8
mov eax, dword [esp + 0x30]
push 0
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.004026ab
lea ecx, [esp + 4]
mov esi, eax
call fcn.00402661
test esi, esi
je 0x401e8e
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 4]
mov esi, eax
mov byte [esp + 0x28], 0
call fcn.00402625
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.004131e9
mov eax, esi
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
lea ecx, [esp + 4]
mov byte [esp + 0x28], 0
call fcn.00402625
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.004131e9
mov ecx, dword [esp + 0x20]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4

Function at 0x4127f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x412812
cmp dword [edi + 0x3c], 0
jne 0x412812
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.004199cd
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0041283f
pop edi
pop esi
pop ebx
ret 8
Function at 0x412b7f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x41af88
call fcn.0040427c
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.004199cd
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x412bbe
call fcn.004199cd
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x412bcc
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x412bda
or eax, 0xffffffff
jmp 0x412cc2
mov ecx, esi
call fcn.00412af5
mov dword [ebp - 0x14], eax
call fcn.004149b2
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x412c11
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x412c11
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.00414966
push dword [ebp - 0x14]
call fcn.00414498
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0041288d
cmp eax, edi
je 0x412c84
test byte [esi + 0x24], 0x10
je 0x412c52
push 4
mov ecx, esi
pop ebx
call fcn.00416a5c
test ah, 1
je 0x412c4a
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.004164bc
cmp dword [esi + 0x1c], edi
je 0x412c84
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00416a90
jmp 0x412c84
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x412c98
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x412cb1
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x412cb1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.00412b2f
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x41636a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4163ac
call fcn.004199cd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4163ac
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4163a3
xor eax, eax
jmp 0x4163b4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004163ba
pop edi
pop esi
pop ebx
ret 4
Function at 0x41a1f3
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41a221
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41a23f
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041a159
jmp 0x41a23f
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41a23f
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0041a159
test edi, edi
mov eax, edi
jne 0x41a229
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401740
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x401766
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4017fa
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x4017b5
cmp eax, 0x40
je 0x4017b5
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401759
cmp eax, 0x40
je 0x401759
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x401759
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sym.__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x67995a
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
shr ch, 5
pop word [esp + 1]
pop word [esp + 1]
mov cx, 0xef73
mov ecx, 0x28c9de34
jmp 0x67998c
jmp 0x679938
sub esp, 0xa
lea ecx, [ecx + edx]
cpuid
mov dword [esp + 3], ecx
xchg byte [esp + 2], al
jmp 0x679a2b
xchg dx, si
add esp, 1
mov dword [esp], esi
btc ebx, ebx
xchg dx, bx
mov esi, dword [esp + 1]
jmp 0x67995c
lea ebp, [ebp*4]
inc bp
shl ax, cl
lea ecx, [esi + 0x3d]
not ah
xchg word [esp], di
jmp 0x679973
pop bp
mov di, 0x2bf1
rdtsc
cpuid
xchg ah, bl
cld
call fcn.006799c2
lea esp, [esp + 0x4a]
bswap edi
cpuid
lea ebp, [ebp - 0x1c2786c9]
mov edi, ecx
neg eax
jmp 0x679b13
xchg ebx, edi
lea edi, [ecx - 0x53]
mov edi, esi
pop dword [esp + 4]
xchg word [esp + 3], bp
xor eax, esi
jmp 0x6799e7
mov cx, di
xchg si, cx
mov word [esp], dx
cpuid
mov byte [esp], ch
call fcn.00679adc
sub dword [eax - 0x15], ecx
add dl, byte [edx - 1]
xor al, 0x24
push edx
push dword [esp]
pop ecx
mov esi, dword [esp + 1]
bswap eax
pop di
jmp 0x679a3f
mov ax, 0x43cb
lea ecx, [ebx + esi]
mov ebx, 0xbe815f4e
cmc
inc dx
lea ebx, [esp + esi]
jmp 0x679a57
mov bl, 0x50
mov eax, 0x70418b2e
xchg ch, dl
mov dx, 0x68a1
mov cl, 0x5a
mov edi, dword [esp]
jmp 0x679a7a
Function at 0x679adc
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp], bl
btr edi, edx
setne bh
mov edx, ebp
mov word [esp], dx
mov cx, 0xa505
jmp 0x679abc
xchg cx, di
add esp, 3
mov ebp, 0xc28986d0
cld
mov word [esp], sp
cld
jmp 0x679a8e
inc al
mov al, ah
stc
btr eax, esp
xchg byte [esp], bl
inc bx
jmp 0x679af7
clc
jmp 0x679aa9
lea edx, [ebp - 0x4708ec41]
add al, dh
lea esp, [esp]
push edx
xchg cx, bp
xchg dh, al
jmp 0x679b54
mov edx, 0xf84991d8
pop bx
mov dx, bx
lea edx, [eax*4]
jmp 0x679adf
push word [esp + 1]
not ah
mov byte [esp + 1], dh
lea esp, [esp + 3]
mov ch, byte [esp]
lea edi, [eax - 0xd9]
jmp 0x679b88
pop word [esp]
mov bx, 0x67d1
lea edx, [esp + edi]
inc bl
xchg ch, dl
lea esp, [esp + 1]
jmp 0x679b2a
rol bp, cl
mov ax, word [esp]
mov ax, word [esp]
setg ch
mov edi, 0xa1853eb0
mov ebx, 0x2994f674
jmp 0x679c49
xor ebx, esi
lea ebx, [ecx + 0x6b]
rdtsc
lea esp, [esp]
mov eax, dword [esp]
mov bl, bh
jmp 0x679b69
mov ebp, dword [esp + 3]
mov bx, word [esp + 4]
bsr bx, bp
lea esp, [esp]
mov ch, byte [esp]
mov ax, bx
jmp 0x679c32
rdtsc
neg di
lea esi, [esp + eax]
push edx
not ch
setne dh
jmp 0x679bb5
mov si, word [esp]
mov byte [esp], ch
rcr ebx, 0x15
mov ah, byte [esp]
inc edx
lea edx, [ebx + esi]
jmp 0x679c9e
mov byte [esp], ch
sub esp, 4
lea esp, [esp + 4]
not di
mov esi, 0x5c88b450
lea esp, [esp]
jmp 0x679be3
sete ah
xchg esi, ecx
neg ch
bswap ebx
stc
mov di, word [esp]
jmp 0x679bfa
mov word [esp], dx
neg cx
mov ax, dx
add esp, 2
lea esp, [esp + 2]
jmp 0x679c19
btr edx, edx
inc bl
setns bh
inc edi
lea ebp, [edx + edi]
clc
jmp 0x679bd3
push dword [esp + 0xc]
cmc
push dword [esp + 0x12]
xchg bh, cl
add esp, 3
mov bx, 0xaa19
jmp 0x679ec7
mov di, bx
btc edi, ebx
sub esp, 0x12
sub esp, 0x1c
stc
sub esp, 0
jmp 0x679c5b
pushal
pushal
lea esp, [esp + 0x41]
lea edx, [ebp - 0x4f]
mov esi, dword [esp]
lea esi, [ebp*4]
jmp 0x679c82
add esp, 0x1c
xchg byte [esp], al
call fcn.00679cb3
mov eax, dword [esp]
inc di
lea edx, [ebx*4]
mov dx, word [esp + 2]
bsf cx, ax
neg ch
jmp 0x679d82
cmc
lea esi, [edx + edi]
add esp, 0
lea ebx, [esi - 0x191f1c1b]
lea esp, [esp]
push word [esp + 2]
call fcn.00679d59
btc ebx, edi
pop dword [esp + 6]
stc
xchg edx, ebp
mov di, 0x6ddf
setns ah
jmp 0x679cdd

Function at 0x67a0d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xd
mov ebx, ebp
stc
push edx
ror ah, 1
not ch
jmp 0x67a157
lea ebp, [esi + edi]
xchg dword [esp + 0xa], esi
xchg word [esp + 0x11], di
jmp 0x67a0c1
rol si, cl
setae ah
rol dx, cl
mov byte [esp + 1], ch
lea esp, [esp + 1]
mov edx, dword [esp]
jmp 0x67a13c
xchg dx, si
lea esp, [esp + 3]
not di
rcl dx, cl
inc cl
rdtsc
jmp 0x67a106
inc edi
xchg ch, dl
rcl ax, cl
mov byte [esp], dh
add esp, 1
call fcn.0067a1ac
sbb eax, 0x8d7e1b8b
cmp al, 0xae
mov ecx, 0xc686fb98
xchg dh, al
add esp, 5
neg edx
setge dh
mov cx, 0x4ceb
rdtsc
jmp 0x67a129

Function at 0x67af25
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
jmp 0x67af6d
lea esp, [esp + 1]
mov eax, esi
xor esi, esi
mov edi, 0x7ffee938
not bp
jmp 0x67af50
pop word [esp]
lea edi, [eax*4]
not si
xchg word [esp], bx
btr eax, edx
jmp 0x67af28
Function at 0x67b06b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [ebx*4]
xchg edi, edx
lea esp, [esp + 5]
jmp 0x67b0d2
mov bh, byte [esp + 1]
btr ebx, edx
mov bl, bh
mov edi, 0x3a295d44
cpuid
mov edi, 0xf87ce348
jmp 0x67b13f
sub ax, 0x1068
mov bp, 0xb633
sub esp, 0xe
rdtsc
neg esi
rcr ebp, 0xf
jmp 0x67b0fd
neg ch
mov edi, dword [esp]
mov dl, dh
lea ebx, [ebp*4]
setp ch
jmp 0x67b11e

Function at 0x67bab3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xa], di
mov bp, word [esp]
pop eax
mov ebp, dword [esp + 5]
xchg word [esp + 5], bx
mov edi, ebp
jmp 0x67b67b
lea ebx, [edx + ebx]
mov dl, dh
mov byte [esp + 0x10], ah
jmp 0x67b99e

Function at 0x67bb7f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edx*4]
bswap ecx
mov bp, word [esp + 2]
pop word [esp]
jmp 0x67bba8
lea esp, [esp + 1]
not di
lea ebx, [ebp - 0x17]
cpuid
mov cl, 0xa2
mov edi, dword [esp]
jmp 0x67bbdd
mov al, ah
xchg edx, ecx
xchg ebx, edx
inc ecx
sub esp, 8
xchg word [esp + 1], bx
jmp 0x67bc4c
pop ebx
xchg word [esp + 0x10], bp
btc edi, edi
mov word [esp + 1], bx
pushal
jmp 0x67bc34
mov ebx, 0xc044a41a
mov bh, byte [esp + 1]
rdtsc
pop ebp
neg dx
mov di, sp
jmp 0x67bc76
mov byte [esp + 0x2d], ch
lea edi, [esp + eax]
cmc
inc dx
mov ebp, 0x791ad812
not si
jmp 0x67bc18
mov dh, byte [esp]
pop edi
sub esp, 0x16
mov cx, dx
neg bx
rcr ah, 1
jmp 0x67bbee
setno ah
bsf bp, ax
cpuid
rdtsc
xchg byte [esp + 6], bl
mov byte [esp + 0x2f], ch
jmp 0x67bca3
mov al, ah
xchg dword [esp + 0x25], edi
mov ah, byte [esp + 0x1a]
push dword [esp + 4]
stc
sub esp, 6
jmp 0x67bc5d

Function at 0x67c1ab
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
pop dword [esp + 2]
lea esp, [esp + 5]
jmp 0x67c18d
Function at 0x187bb80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1438000]
push edi
or ebp, 0xffffffff
jmp 0x187bba2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x187bba9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x187bb98
mov eax, 1
add ebx, ebx
jne 0x187bbbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x187bbcc
jne 0x187bbeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x187bbeb
dec eax
add ebx, ebx
jne 0x187bbd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x187bbb0
add ebx, ebx
jne 0x187bbe7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x187bc3d
xor ecx, ecx
sub eax, 3
jb 0x187bc03
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x187bc72
sar eax, 1
mov ebp, eax
jmp 0x187bc0e
add ebx, ebx
jne 0x187bc0e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x187bbdc
inc ecx
add ebx, ebx
jne 0x187bc1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x187bbdc
add ebx, ebx
jne 0x187bc29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x187bc1e
jne 0x187bc3a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x187bc1e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x187bc5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x187bc4e
jmp 0x187bb9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x187bc5c
add edi, ecx
jmp 0x187bb9e
pop esi
mov edi, esi
mov ecx, 0x2f7f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x187bc7a
cmp byte [edi], 0x1b
jne 0x187bc7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x187bc7f
lea edi, [esi + 0x1476000]
mov eax, dword [edi]
or eax, eax
je 0x187bcf7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2855390]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x28554bc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x187bcac
mov ecx, edi
jns 0x187bcdb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x28554c0]
or eax, eax
je 0x187bcf1
mov dword [ebx], eax
add ebx, 4
jmp 0x187bcc9
call dword [esi + 0x28554d0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x187bd28
cmp al, 0xef
ja 0x187bd1b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x187bcfd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x187bd0a
mov ebp, dword [esi + 0x28554c4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x187bd5c
sub esp, 0xffffff80
jmp 0x43c050
Function at 0x412ab0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47131b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00465aa4
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x412b32
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046381a
mov eax, dword [eax]
push 0x55c1e0
push eax
call fcn.004564f4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00465d2f
test bl, bl
je 0x412b32
push 0x55c1e0
lea ecx, [esp + 0xc]
call fcn.004660bf
push 0x55fd54
lea ecx, [esp + 0xc]
call fcn.004660bf
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x412b6e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00465d2f
jmp 0x412c39
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x412bf2
lea edx, [esp + 0x7c]
push 0x55fd50
push edx
call fcn.004564f4
add esp, 8
test eax, eax
je 0x412bf2
lea eax, [esp + 0x7c]
push 0x55fd4c
push eax
call fcn.004564f4
add esp, 8
test eax, eax
je 0x412bf2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x412b82
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00465d2f
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x413450
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4134b2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc