joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4405b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4405e3
push esi
call fcn.004436a0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4405dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x440669
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x440652
mov eax, dword [esi + 8]
test eax, eax
je 0x440607
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44064e
cmp eax, 2
je 0x440652
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4405fa
cmp eax, 3
je 0x44062d
cmp eax, 1
jne 0x4405fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4405fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4405fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00440690
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x440678
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00440690
add esp, 4
pop esi
ret

Function at 0x45eca8
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45ece0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045cd5c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045cd34
jmp 0x45ecec
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x460396
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4603d8
call fcn.00465e4f
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4603d8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4603cf
xor eax, eax
jmp 0x4603e0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004603e6
pop edi
pop esi
pop ebx
ret 4

Function at 0x46637f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4663ad
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4663cb
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004662e5
jmp 0x4663cb
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4663cb
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004662e5
test edi, edi
mov eax, edi
jne 0x4663b5
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x6146ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, esi
mov cl, ch
mov edx, ebp
btr edi, edx
jmp 0x6146d6
lea edi, [esp]
add eax, ebp
jbe 0x614836
ja 0x61476b
lea edx, [edi + ebp]
mov di, word [esp]
xchg bp, cx
lea edx, [eax - 0x2c57a6f]
mov esi, dword [esp + 0x28]
jmp 0x614695
je 0x6146a4
jne 0x6146a4
lea esp, [esp + 3]
mov dword [esp + 0x64], edi
lea esp, [esp + 0x64]
pushfd
jmp 0x6146c0
rdtsc
mov al, 0x5e
mov ebx, esi
rdtsc
jmp 0x614720
jmp 0x6146fd
xchg edx, ecx
mov ax, word [esp]
push esp
jmp 0x614495
sub esp, 0xc0
mov ebp, esp
mov cl, 0x6a
add cx, 0xd14e
jbe 0x61471e
rdtsc
mov al, 0x5e
jmp 0x614701
mov dl, byte [esp]
mov dl, dh
lea ecx, [eax - 0xa1]
jmp 0x614841
mov dl, byte [esp]
mov dl, dh
lea ecx, [eax - 0xa1]
jmp 0x614739

Function at 0x614c33
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx*4]
setl dh
mov edx, 0xbf559c76
jmp 0x614bcc
add bl, al
not ax
mov dh, ch
lea edx, [eax - 0x19b416ff]
call fcn.00614bd2
xchg esi, eax
or al, 0x82
in eax, 0x14
cmpsb byte [esi], byte es:[edi]
add byte [ecx + 0x269b6809], bl
js 0x614c23
mov dl, 0xad
mov esp, 0x24648d8f
add ebx, ebp
salc
lea esp, [esp + 1]
jmp 0x614ba8
jmp 0x614ca2
sete dh
call 0x614c33
or al, 0x94
or ch, byte [ebp - 0x64]
pop ecx
lcall 0x40b3, 0x3f09101
add esp, dword [esi - 9]
rol al, cl
mov byte [ebx], 0x79
sahf
bswap edx
jmp 0x614b73
pop edx
mov dh, 0x20
rdtsc
jmp 0x614c3a
add eax, esi
call fcn.00614c73
cmpsb byte [esi], byte es:[edi]
cmp byte [esi - 0x7774c737], ch
adc eax, 0xaf1fec85
add al, 0xb7
sahf
pop edx
mov dh, 0x20
rdtsc
jmp 0x614c3a
cwde
imul ebx, edi, 0x17
mov bl, byte [eax]
jg 0x614bb5
mov ebp, dword ds:[edi]
mov edi, 0xc2b029da
bts edx, edx
jne 0x614c19
je 0x614bfc
dec cl
bswap eax
sub esp, 0
ja 0x614c03
jbe 0x614c8a
inc ebp
jge 0x614c44
insd dword es:[edi], dx
hlt
jno 0x614bd7
sete dh
jmp 0x614bda
add eax, esi
jmp 0x614c05
dec esi
mov eax, dword [esp]
xchg dx, ax
mov ax, word [esp]
cmc
jmp 0x614c50

Function at 0x615ce9
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00615b9e
add esp, 3
jl 0x615b45
pushal
lea esp, [esp + 1]
jmp 0x615b1e
mov byte [esp + 0x26], dh
sub edx, ecx
cmc
jne 0x615af4
je 0x615af4
mov esp, edx
pushfd
lea ebp, [ecx + edx - 0x40]
jmp 0x615b2b
push esi
push edi
push ecx
jmp 0x615b72
pushal
lea esp, [esp + 1]
jmp 0x615b1e
inc dl
jmp 0x615b54
mov dword [esp + 4], eax
stc
popal
jmp 0x615b85
cld
jmp 0x615bc0
pushal
inc bp
ja 0x615b4c
inc dl
mov dword [esp + 4], eax
stc
popal
jmp 0x615b85
mov edi, edx
mov ecx, ecx
jmp 0x615b5c
pop esi
popfd
jmp fcn.00614757
rep movsb byte es:[edi], byte [esi]
pop ecx
pop edi
jmp 0x615ba3
pushal
jmp 0x615b13
sub esp, 4
jno 0x615bdb
pushal
mov byte [esp + 0x26], dh
jmp 0x615b17

Function at 0x62140c
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x609c2b
pushfd
or dword [esp], 0x100
jmp 0x62147d
push word [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x609c1f
Function at 0x63606d
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [ecx + 8], edx
jmp 0x6360c9
lea esp, [esp + 4]
movzx edx, byte [eax + 0xc]
shl edx, 8
mov bx, word [esp]
jmp 0x636126
xchg dh, dl
not dx
jmp 0x6360a9
xor edx, esi
rcl bx, cl
mov si, 0x1bdd
bswap edi
jmp 0x636254
sub esp, 6
mov edi, dword [esp + 5]
lea esp, [esp + 2]
jmp 0x636108
neg esi
mov si, word [esp]
mov dword [ecx + 0xc], edx
mov eax, edx
jmp 0x63619c
lea esp, [esp + 2]
jmp 0x636184
mov di, dx
lea ebx, [ecx + 0x93]
neg bx
neg bx
xor edx, eax
jmp 0x63614d
lea esp, [esp + 0x18]
mov esi, 0xff
mov bl, byte [esp]
jmp 0x6361ae
btc ebx, edi
inc ebx
lea esi, [ecx - 0x2f689d85]
shr eax, 0x10
sub esp, 0x1a
jmp 0x63615a
and eax, esi
mov ebx, ebp
jmp 0x6361d6
xor edx, esi
cmc
lea ebp, [ecx + 0x9b]
mov edi, dword [esp]
shl edx, 8
jmp 0x636171
mov eax, dword [eax*4 + 0x6116b8]
bsf bx, si
push edx
lea esp, [esp + 4]
jmp 0x636239
mov ebx, 0x589ff094
movzx eax, byte [eax + 0xf]
shl edx, 8
jmp 0x6361c5
mov edi, edx
xchg bp, bx
shl bx, cl
jmp 0x6362e6
mov byte [esp + 0xf], ah
lea esp, [esp + 2]
jmp 0x636207
xor eax, 0x1000000
lea ebp, [edx + edx]
lea edi, [ebp*4]
sub esp, 0x16
jmp 0x63621f
lea esp, [esp + 4]
movzx esi, byte [eax + 0xe]
lea ebx, [esi - 0x4ee49f6b]
mov edi, edx
bswap edi
jmp 0x6361f9
shr edi, 8
xchg ebx, ebp
call 0x6362b2
lea edi, [edi + 4]
mov ebx, dword [edi]
pop edi
lea ebp, [eax + edx]
jmp 0x636368
and eax, 0xff000000
xor eax, edi
call fcn.0063634d
lea ebp, [ebx*4]
mov ebp, 0x4c10b0da
jmp 0x6363c3
and edi, esi
call 0x6363e5
mov edi, dword [edi*4 + 0x6116b8]
shl ebp, 0x1f
clc
mov ebp, 0xd07b920e
jmp 0x6363ce
xor eax, edi
mov edi, edx
sbb bp, 0xb756
jmp 0x6363a5
lea esp, [esp + 4]
mov ebp, 0xff00
sub esp, 0x16
call 0x63643b
jns 0x636439
mov ebx, 0x669c0d92
inc ebp
not bp
jmp 0x6363ac
bsr di, cx
push edx
push word [esp + 3]
add di, 0x2bbc
jmp 0x636458
and edi, ebp
xor eax, edi
lea esp, [esp + 0x18]
xor eax, dword [ecx]
jmp 0x636409
sub al, 0x3f
lea esp, [esp + 2]
jmp 0x636420
push edx
push word [esp + 1]
sub esp, 0xc
lea esp, [esp + 2]
jmp 0x636467
lea esp, [esp + 2]
lea esp, [esp + 4]
lea edi, [ecx + 0x10]
xor ebx, eax
jmp 0x636441
push ebx
pushal
rdtsc
mov esi, 0xb688d3fa
jmp 0x637dac
mov dword [esp + 0x10], edi
pushal
call 0x6365f1
je 0x60775b
cmc
call fcn.00637e43
in al, 0x7e
in al, dx
mov eax, dword [esi - 0x3ea930cc]
or byte [ebp - 0x7ffbdb9c], 0xfa
das
jmp 0x637db6

Function at 0x63fd1d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, word [esp]
xchg edx, ecx
mov cl, byte [esp]
jmp 0x63fd41
mov cx, si
bt edx, edi
xchg dword [esp], ecx
neg dh
stc
mov edx, dword [esp]
jmp 0x63fe1c
xchg dh, dl
neg dx
lea ecx, [ecx + 0x59]
call fcn.0063fd55

Function at 0x63fd55
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], di
mov dx, 0xdd37
xchg dword [esp], edx
call fcn.0063fdb5
lea ebx, [edi + ebp*2]
jbe 0x63fdcb
mov al, byte [0x74e9c5fe]
sal dword [esi + 0x3186f745], cl
xor byte [ebx], dh
Function at 0x640085
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
setns dh
sub esi, 4
call 0x63fcc0
mov cl, byte [esp]
lea ecx, [ebp*4]
inc edx
jmp 0x63fd37
dec edx
sub esp, 0x18
jmp 0x63fd79
inc ch
jmp 0x63fce6
push word [esp + 0x17]
lea esp, [esp + 2]
jmp 0x63fd9f
lea esp, [esp + 0x18]
xor eax, 0x6e19b3c9
mov dl, 0x2c
mov ch, byte [esp]
jmp 0x63fdd3
call fcn.0063fe04
xchg word [esp], cx
lea ecx, [edi*4]
jmp 0x63fde3
mov cl, byte [esp]
mov dl, dh
mov ch, 0x9e
sub cx, 0xe24c
jne 0x63fdb7
je 0x63fdb7
rol eax, 0
clc
jmp 0x63ffdf
mov edx, dword [esp]
lea ecx, [edx*4]
bswap edx
mov cx, word [esp]
jmp 0x63fea1
not ch
mov dx, 0x5d73
jmp 0x63fe36
shl cl, 3
mov ecx, dword [esp]
xchg ch, dl
jmp 0x63fe83
bt edx, ebx
jne 0x63fe29
not ch
mov dx, 0x5d73
shl cl, 3
mov ecx, dword [esp]
xchg ch, dl
jmp 0x63fe83
mov ecx, ebx
xchg cl, ch
sub esp, 4
jmp 0x63ff97
mov ch, byte [esp]
inc ch
jno 0x63fe67
mov ecx, ebx
jmp 0x63feb0
mov ch, 0x86
sub cx, 0x693c
lea esp, [esp + 4]
neg eax
jmp 0x63fe52
xchg cl, ch
sub esp, 4
jmp 0x63ff97
bswap edx
mov cx, word [esp]
mov ch, 0x86
jmp 0x63fea3
jb 0x63feef
jae 0x63feef
jmp 0x63ff12
mov dword [edi], eax
not cx
rcr ax, cl
jbe 0x63fed6
xchg dx, cx
xchg ecx, eax
jmp fcn.006154cf
neg eax
not ecx
pushal
xchg edx, ecx
neg edx
jmp 0x63fed2
xchg dx, cx
xchg ecx, eax
jmp fcn.006154cf
mov dx, word [esp]
jmp 0x63ff07
mov cl, 0xe2
neg edx
jnp 0x63ff2a
mov dx, word [esp]
jmp 0x63ff07
lea esp, [esp + 4]
sub eax, 0xda2f581a
xchg dx, cx
mov ecx, dword [esp]
lea edx, [esp + edx]
jmp 0x63ff41
jns 0x63fded
mov edx, dword [esp]
lea ecx, [edx*4]
jmp 0x63fec8
add ebx, ecx
sub ecx, esi
je 0x63fd6b
inc ch
push edx
setns dh
jmp 0x63fcea
mov word [esp], dx
lea esp, [esp + 1]
jmp 0x63fff9

Function at 0x641e33
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x641e72
sub esp, 0xc
jne 0x641e5a
mov word [esp + 2], bx
sub esp, 0x1e
push dword [esp + 6]
lea esp, [esp + 2]
clc
jmp 0x641e7c
push word [esp + 3]
pushal
clc
jle 0x641e0a
lea esp, [esp + 2]
jmp 0x641e76
push dword [esp + 6]
lea esp, [esp + 2]
clc
jmp 0x641e7c
mov word [esp + 2], bx
sub esp, 0x1e
jmp 0x641e42
lea esp, [esp + 2]
mov dword [edi], edx
xchg edx, ecx
jmp 0x641e0c
bswap ecx
setbe ch
clc
jae 0x641f7e
jb 0x641f7e
xchg esi, eax
or byte [esi + 0x25bb08f9], bl
push esp
invalid
mov al, 0x94
jmp fcn.006154cf
lea ecx, [ecx - 0x4109eba5]
mov al, ah
inc al
jo 0x641eee
mov al, 0x94
jmp fcn.006154cf
mov dword [edi + 4], eax
jmp 0x641f26
Function at 0x7b3bfe
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0x2e]
jmp 0x7b3c5b
mov bl, bh
inc si
mov word [esp + 0x1b], di
rdtsc
not ah
bswap ecx
jmp 0x7b3c9f
mov byte [esp + 7], dh
mov dh, byte [esp + 0x2c]
lea esi, [ebx*4]
jmp 0x7b3d1d
mov di, word [esp + 0xf]
mov ebp, 0xc6e9c1dc
rdtsc
not edi
mov bp, dx
xchg byte [esp + 0x26], cl
jmp 0x7b3c89
xchg esi, edi
mov di, 0xb10f
pop dword [esp + 0x12]
pushal
lea esp, [esp + 0x55]
xchg ah, bl
jmp 0x7b3dc0
xchg word [esp + 0x13], dx
inc cl
mov cl, 0x22
push word [esp + 0x19]
not ebx
lea eax, [edi + edi]
jmp 0x7b3cd8
lea ecx, [eax - 0xc1]
bsr bx, bp
cpuid
rcl dx, cl
mov byte [esp + 0x2d], ch
not ah
jmp 0x7b3cf9
mov dh, byte [esp + 5]
bsr bp, bp
cmc
setl dh
mov edi, dword [esp + 0xd]
ror dh, 7
jmp 0x7b3da6
rdtsc
mov cl, ch
lea esp, [esp + 0xb]
lea esp, [esp + 4]
push word [esp + 7]
push word [esp + 6]
jmp 0x7b3d34
xchg word [esp + 3], si
lea ecx, [eax + 0x59]
mov si, bx
cld
not esi
jmp 0x7b3df4
push dword [esp + 5]
add esp, 0x26
pop ebx
not edi
lea edx, [ebp + 0xb7]
mov cl, 0xc2
call fcn.007b3d6a
pushal
loope 0x7b3e10
adc bl, ah
pop es
mov al, byte [0x83751ae3]
les ecx, [eax]
add esp, 8
mov bl, 0x20
push dword [esp + 1]
pushal
push esp
neg ebp
jmp 0x7b3d85
bsf si, si
mov ebx, 0xa12e4a
sub esp, 0x1c
lea ecx, [eax + 0xa1]
inc edi
jmp 0x7b3d52
mov edx, 0xfb922de
pop word [esp]
call fcn.007b3e27
pop esi
fisttp qword [ebp + 0x14]
out 7, eax
test al, 0x2e
mov esp, 0xbfdf36db
xchg byte [ecx], dh
xor dword [edi], ecx
int 0xb1
shl byte [esi - 9], cl
fimul word [edi + 0xf022444]
mov ebx, 0x24248afe
bswap ebp
mov cl, 0xd2
neg si
pop dword [esp + 2]
btc esi, edi
mov ah, byte [esp]
jmp 0x7b3d6f

Function at 0x7b3e27
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 1]
mov dh, byte [esp + 5]
pop dword [esp + 2]
bswap ecx
jmp 0x7b3f33
mov al, ah
ror ah, 1
neg ch
ror ah, 1
bsf ax, si
add esp, 0xa
jmp 0x7b3e93
pushal
not ebp
mov ch, byte [esp + 0x14]
mov cx, word [esp + 0x17]
mov ebx, ecx
mov cx, word [esp + 0x14]
jmp 0x7b3e67
not bh
xchg ecx, eax
xchg bh, cl
neg dh
xchg word [esp + 0x12], ax
mov edx, esi
jmp 0x7b3f1a
mov esi, ecx
pop word [esp + 0x1a]
xchg dword [esp + 9], edi
bswap edi
push dword [esp + 0x19]
jmp 0x7b3f01
lea edx, [ebp - 0xf]
mov ch, byte [esp + 1]
mov dword [esp + 2], ecx
xchg byte [esp + 8], dl
xchg ah, bl
not ch
jmp 0x7b3e7e
pop word [esp + 0x16]
add esp, 0x13
mov si, word [esp + 6]
jmp 0x7b3f9d
pop si
xchg cx, dx
xchg ah, bl
lea edi, [eax*4]
rdtsc
jmp 0x7b3ed2
pop dword [esp + 8]
mov eax, 0xcd0322da
mov word [esp + 0xe], di
push dword [esp + 0xd]
jmp 0x7b3ee9
mov dword [esp + 5], ebp
bswap edx
xchg si, bp
rdtsc
mov edx, ecx
btr ebp, esp
jmp 0x7b3ea4
btr eax, esp
push word [esp + 5]
mov bl, 0x30
not bp
setg dh
mov bl, bh
jmp 0x7b3ebd
lea edx, [eax*4]
setp bh
bsf cx, si
xchg byte [esp + 2], al
inc cl
mov al, 0x86
call fcn.007b3f63
add esp, 8
clc
xchg dh, al
mov ecx, dword [esp]
call 0x7b3fc7
and ecx, dword [ebx - 0x16ab4d3b]
mov edx, 0x9000000
test al, 0x56
fmul dword [esi + 0x29]
fdiv dword [esi]
mov eax, 0x3fcca535
fbld tbyte [edi + edx*8 + 0x66fdbb0f]
and eax, 0x2c8d60e2
popfd
add byte [eax], al
add byte [eax], al
Function at 0x7b40e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 7
not ebp
mov dl, 0x84
lea edi, [ebx*4]
rdtsc
lea esp, [esp]
jmp 0x7b4100
btc esi, ebx
mov bl, bh
mov byte [esp + 3], bh
mov ebp, dword [esp + 7]
bswap ebx
mov byte [esp + 1], bh
jmp 0x7b409f
jmp 0x7b40c1
cmc
mov dx, di
sub esp, 0x1c
xchg dh, al
pop ebx
push word [esp + 8]
jmp 0x7b4322
bsf ax, ax
rdtsc
mov bp, bx
and ebx, ecx
stc
xchg si, bp
jmp 0x7b40e8
inc edx
push word [esp + 9]
pop dword [esp + 2]
lea eax, [ebp - 0x49a35221]
call fcn.007b418d
mov cl, 0x9a
pop word [esp + 0xa]
add al, dh
mov cl, 0xaa
lea esp, [esp + 3]
mov ah, byte [esp + 9]
jmp 0x7b4231
bsr ax, bp
mov ebp, dword [esp + 3]
mov cx, 0xea25
rol dx, cl
btc esi, edi
xchg byte [esp + 0x16], al
jmp 0x7b4298

Function at 0x7b418d
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc al
lea esp, [esp + 1]
inc dx
rcr ch, 5
xchg si, ax
lea esi, [esi + edi]
jmp 0x7b4130
lea esi, [esp + edi]
mov cl, ch
jmp 0x7b4157

Function at 0x7b4774
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
xchg ecx, eax
sub esp, 6
setae ah
neg ch
pushal
jmp 0x7b475b
lea esp, [esp + 0x4b]
inc dl
cpuid
mov bl, 0x28
btr eax, esp
lea ecx, [ebp + 0x14424ba7]
jmp 0x7b4780
mov bh, byte [esp + 1]
mov ch, byte [esp]
cmc
bswap ebp
jmp 0x7b4749
xchg cx, si
lea edi, [ecx + 0x5a226343]
cpuid
setno ah
xor ax, 0xd48c
setns ah
jmp 0x7b47ad
Function at 0x7b4c96
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [eax + 0x190b1ad9]
push word [esp + 0xd]
xchg dword [esp], edi
xchg edx, edi
neg edi
push edx
jmp 0x7b48a0
sub esp, 0xe
add al, dh
mov dword [esp + 0xa], eax
bsf cx, si
not ah
inc eax
jmp 0x7b486d
cld
mov eax, dword [esp + 1]
mov dword [esp + 7], ecx
mov ebx, dword [esp + 0x11]
mov di, dx
pop ecx
jmp 0x7b48f9
mov bx, word [esp]
lea esp, [esp + 1]
bswap ebp
neg ebp
not bp
lea edx, [ecx + 0xd3]
jmp 0x7b488e
pop dword [esp + 0xa]
rdtsc
pushal
push dword [esp + 5]
mov dx, di
add al, dh
jmp 0x7b4950
push word [esp + 4]
lea ebx, [ebp - 0x67]
mov edi, 0x781e52bc
mov al, ah
jmp 0x7b48d7
xchg byte [esp], cl
xchg ah, bl
mov ch, byte [esp + 1]
mov byte [esp], dh
xchg bh, cl
mov ax, 0xcde7
jmp 0x7b48c0
mov cx, word [esp + 0x32]
mov si, 0x2d43
pop dword [esp + 0x21]
ror dh, 7
lea esp, [esp + 9]
mov dh, byte [esp + 9]
jmp 0x7b4968
btc esi, edi
clc
mov ecx, dword [esp + 0xf]
bswap edi
xchg word [esp + 0x1e], bp
lea ecx, [edi*4]
jmp 0x7b4924
pop dword [esp + 8]
btc eax, ebx
xchg dword [esp + 2], ecx
xchg bh, cl
mov ecx, ebp
pop bp
jmp 0x7b49ec
btc edi, edi
sub esp, 2
neg bp
xchg ch, dl
mov al, ah
rdtsc
jmp 0x7b4910
btr esi, edx
mov eax, ecx
pop dword [esp + 0xa]
inc eax
mov bh, 0xc3
rdtsc
jmp 0x7b4a1b
rdtsc
pop dx
lea edx, [ecx*4]
sub esp, 0
mov byte [esp + 0x1d], bh
mov dl, dh
jmp 0x7b49a2
mov dword [esp + 0x11], ecx
xchg bh, cl
mov esi, 0xe7b8f73a
push word [esp + 0x17]
sub bl, ah
stc
jmp 0x7b49c6
mov di, 0x120d
neg di
setge bh
add esp, 0
add esp, 0
btc ebp, edi
jmp 0x7b4b4b
pop esi
inc bx
add esp, 0xd
pop word [esp + 3]
add esp, 4
pop edi
jmp 0x7b4a01
cpuid
mov cl, byte [esp]
lea eax, [edi*4]
inc al
lea ebx, [edi + ebp]
xchg edx, ebp
jmp 0x7b498e
mov ax, sp
mov edx, dword [esp]
xchg byte [esp], cl
xchg dh, al
btc eax, edi
btr eax, edx
jmp 0x7b4b2e
popal
xchg ecx, eax
mov bp, bx
bsr cx, cx
xchg byte [esp], dl
xchg dx, cx
jmp 0x7b4a56
mov eax, dword [esp + 2]
pushal
clc
mov byte [esp + 0x29], ch
lea esp, [esp + 3]
lea esp, [esp + 0x28]
jmp 0x7b4ad0
mov edx, dword [esp + 0x21]
not ah
add esp, 0x1c
push word [esp + 4]
xchg dx, ax
xchg dh, al
jmp 0x7b4a81
mov ebp, dword [esp]
lea edi, [ebp + 0x87]
mov ch, byte [esp]
mov di, bx
pushal
push esp
jmp 0x7b4aa2
popal
sub esp, 0x1c
pushal
sub esp, 0xc
lea esp, [esp + 0x48]
pushal
jmp 0x7b4b17
sub bl, ah
setae bh
mov edi, esi
btc edi, ebx
neg edx
ror esi, 9
jmp 0x7b4abd
stc
mov word [esp + 0x1a], sp
lea esp, [esp + 0xf]
push word [esp + 0xd]
call fcn.007b4afe
pop ds
xchg cx, ax
lea ebx, [ecx + ebx]
xchg bp, cx
lea esp, [esp]
cpuid
lea edx, [edx + edi]
xchg ebx, edx
jmp 0x7b4aed
mov bl, 0x78
cpuid
bsr bx, bp
inc cx
pushal
mov bx, word [esp + 0x17]
jmp 0x7b4a6f
setg ah
mov esi, ebp
pushal
lea esp, [esp + 0x44]
lea edi, [edx + ebp]
mov dl, byte [esp]
jmp 0x7b4a3e
cld
jmp 0x7b4be7

Function at 0x7b4df4
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.007b402d
lea esp, [esp + 3]
mov dword [esp + 0xa8], edi
lea esp, [esp + 0xa8]
jmp 0x7b4e3a
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x7b4028
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x7b4e1b
Function at 0x40af20
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4738fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00468068
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40afa2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00465c7d
mov eax, dword [eax]
push 0x4b21d0
push eax
call fcn.00458124
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004682f3
test bl, bl
je 0x40afa2
push 0x4b21d0
lea ecx, [esp + 0xc]
call fcn.00468683
push 0x4b5d4c
lea ecx, [esp + 0xc]
call fcn.00468683
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40afde
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004682f3
jmp 0x40b0a9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40b062
lea edx, [esp + 0x7c]
push 0x4b5d48
push edx
call fcn.00458124
add esp, 8
test eax, eax
je 0x40b062
lea eax, [esp + 0x7c]
push 0x4b5d44
push eax
call fcn.00458124
add esp, 8
test eax, eax
je 0x40b062
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40aff2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004682f3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40b8a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40b902
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40b910
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47397b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4bcb88]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40ba48
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40b976
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004682f3
xor eax, eax
jmp 0x40babf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00468430
push esi
lea ecx, [esp + 0xc]
call fcn.004686bf
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40ba9d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040b8a0
test eax, eax
jne 0x40ba9d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040b8a0
test eax, eax
jne 0x40ba9d
lea eax, [esp + 0x14]
push 0x4b5d60
push eax
call fcn.00459160
mov esi, eax
add esp, 8
test esi, esi
jne 0x40ba7c
lea ecx, [esp + 0x14]
push 0x4b5d5c
push ecx
call fcn.004590e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40ba7c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40ba7f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004683e0
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40b98e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004682f3
xor eax, eax
jmp 0x40babf
mov byte [esi], 0
push 0x4b5d58
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004682f3
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4