joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fa420
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
cmp dword [esp + 8], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x100fa4da
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100fa56a
push esi
mov dword [ebx + 0x58], esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100fa56a
push dword [ebx + 4]
push dword [ebx + 0x58]
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0x100fa56a
push 0xfffffffffffffff0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0x39ffffff
or ecx, 0x46000000
cmp eax, ecx
je 0x100fa492
push ecx
push 0xfffffffffffffff0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [ebx + 0x58]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetParent]
mov edi, dword [ebx + 4]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
push 0
push dword [ebx + 0x58]
call esi
push eax
push 0
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0x57
push 0
push 0
push 0
push 0
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
push ebp
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [ebx + 4]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push dword [ebx + 0x58]
call esi
push 0
push edi
mov ebp, eax
call esi
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, eax
push 0
push ebp
push esi
call edi
test eax, eax
je 0x100fa51a
nop
push 0
push ebp
push esi
call edi
test eax, eax
jne 0x100fa510
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetParent]
push 0xfffffffffffffff0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0x39ffffff
or ecx, 0x80000000
pop ebp
cmp eax, ecx
je 0x100fa54f
push ecx
push 0xfffffffffffffff0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 5
push 0
push 0
push 0x7d00
push 0x7d00
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
Function at 0x10103610
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1010361b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.10103630
Function at 0x10107500
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10199008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x101075fa
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x101075f3
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x101075d9
call ebx
cmp dword [ebp - 0x14], eax
jne 0x101075d9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x101075d9
mov edx, dword [esi]
test edx, edx
jne 0x101075a2
push 0x200
push edx
push dword [0x1019f17c]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x101075f3
jmp 0x101075cd
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x101075cd
shl eax, 3
push eax
push edx
push 0
push dword [0x1019f17c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x101075f3
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10107561
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1010763f
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1010763f
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10107639
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.10107390
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10107606
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010a4b0
mov esp, ebp
pop ebp
ret

Function at 0x10107650
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx]
test eax, eax
je 0x1010769e
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x1010768e
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10107685
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x10107662
mov eax, dword [ebx]
pop edi
push eax
push 0
push dword [0x1019f17c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x101076a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x101a0000]
mov al, byte [esi + 0x14]
mov edi, dword [esi]
and al, 1
je 0x101076bc
sub edi, 5
movzx eax, al
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x101076e4
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x101076ff
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10107730
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x101a0008]
push ebx
push esi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x1010780d
mov eax, dword [0x101a0000]
add eax, 0x14
test byte [eax], 2
je 0x1010776a
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x10107755
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x1010780d
push edi
push 1
or edx, 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10107500
mov ecx, dword [0x101a0008]
add esp, 4
cmp esi, ecx
jae 0x101077bb
imul edi, esi, 0x2c
mov eax, dword [0x101a0000]
test byte [edi + eax + 0x14], 2
jne 0x101077b0
mov ecx, esi
call fcn.101076a0
mov ebx, eax
test ebx, ebx
jne 0x101077b8
mov ecx, dword [0x101a0008]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10107791
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1010780c
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x101077fd
mov ebx, eax
jmp 0x101077d0
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x101077f1
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x101077d0
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x1019f17c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x21856091
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x3ed43e21
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x40320c
push 0x80000002
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401063
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x403434
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
test eax, eax
je 0x401069
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
jne 0x401063
sub esp, 0x10
call fcn.00401090
add esp, 0x10
test al, al
je 0x401063
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x401090
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x405020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push edi
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor edi, edi
push edi
push 0x40320c
push 0x80000002
mov dword [ebp - 0x118], 0
xor ebx, ebx
mov dword [ebp - 0x11c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401200
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x120]
push eax
push edi
push 0x403440
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
test eax, eax
je 0x40113f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004019ef
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push str...SMDB
push eax
call dword [sym.imp.MSVCR110.dll__mbstok_s]
add esp, 0xc
test eax, eax
je 0x401200
mov ecx, dword [sym.imp.MSVCR110.dll_atoi]
push esi
or esi, 0xffffffff
inc esi
cmp esi, 3
ja case.default.0x401179
jmp dword [esi*4 + 0x401214]
push eax
call ecx
mov dword [ebp - 0x114], eax
jmp 0x4011a2
push eax
call ecx
mov ebx, eax
jmp 0x4011a2
push eax
call ecx
mov edi, eax
jmp 0x4011a2
push eax
call ecx
mov dword [ebp - 0x110], eax
add esp, 4
lea eax, [ebp - 0x118]
push eax
push 0x40344c
push 0
call dword [sym.imp.MSVCR110.dll__mbstok_s]
mov ecx, dword [sym.imp.MSVCR110.dll_atoi]
add esp, 0xc
test eax, eax
jne 0x401173
mov eax, dword [ebp - 0x114]
pop esi
cmp eax, 4
jle 0x4011e4
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004019ef
mov esp, ebp
pop ebp
ret
jne 0x401200
test ebx, ebx
jg 0x4011d2
jne 0x401200
cmp edi, 0x766f
jg 0x4011d2
jne 0x401200
mov eax, dword [ebp - 0x110]
test eax, eax
jns 0x4011d2
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor al, al
pop ebx
call fcn.004019ef
mov esp, ebp
pop ebp
ret
Function at 0x401650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x405020]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x168], ecx
push 0x104
lea ecx, [ebp - 0x164]
push ecx
push eax
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401808
lea ecx, [ebp - 0x164]
call fcn.00401230
push 8
mov edi, eax
call dword [sym.imp.MSVCR110.dll___2_YAPAXI_Z]
mov esi, eax
add esp, 4
test esi, esi
je 0x4016cd
push 0
push 0x80
push 4
push 0
push 3
push 4
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4016cf
mov byte [esi + 4], 1
jmp 0x4016cf
xor esi, esi
lea ecx, [ebp - 0x178]
mov dword [0x432bd0], esi
mov dword [ebp - method._com_error.virtual_0], vtable._com_error.0
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0
call fcn.00401820
push 4
mov edi, eax
push 0x403710
push edi
call dword [sym.imp.MSVCR110.dll_strncat]
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.MSVCR110.dll__time64]
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.MSVCR110.dll__localtime64]
push eax
push str._d__m__Y__H:_M:_S
lea eax, [ebp - 0x5c]
push 0x50
push eax
call dword [sym.imp.MSVCR110.dll_strftime]
lea ecx, [ebp - 0x5c]
add esp, 0x24
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401750
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x17c]
push eax
sub ecx, edx
push ecx
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [0x432bd0]
push dword [eax]
call esi
mov edx, dword [ebp - 0x168]
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401781
push 0
lea eax, [ebp - 0x168]
push eax
mov eax, dword [0x432bd0]
sub ecx, ebx
push ecx
push edx
push dword [eax]
call esi
push 0
lea eax, [ebp - 0x17c]
push eax
mov eax, dword [0x432bd0]
push 1
push 0x403728
push dword [eax]
call esi
mov ecx, edi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4017c0
push 0
lea eax, [ebp - 0x168]
push eax
mov eax, dword [0x432bd0]
sub ecx, edx
push ecx
push edi
push dword [eax]
call esi
mov ecx, dword [ebp - 0x170]
mov dword [ebp - method._com_error.virtual_0], vtable._com_error.0
test ecx, ecx
je 0x4017f7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x16c]
test eax, eax
je 0x401808
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004019ef
mov esp, ebp
pop ebp
ret
Function at 0xa39acb
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0xa39ab5
sub esp, 8
seto dh
mov edx, dword [esp]
mov dh, 0xec
lea ecx, [ecx + 0x31]
shl ax, 0
jmp 0xa39b49
xchg edx, eax
bts dx, bp

Function at 0xa3ce20
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
not bl
bsf ebx, esi
jno 0xa3cdab
jo 0xa3ce03
mov word [esp + 0x10], bp
mov word [esp + 2], ax
mov dword [esp + 0x1a], ebx
lea esp, [esp + 1]
mov dword [esp + 0x68], edi
lea esp, [esp + 0x68]
jmp 0xa3cdc1
rdtsc
not al
jmp 0xa3cdcb
pushal
pop dword [esp + 0x10]
pop word [esp + 0x1d]
jmp 0xa3cde7

Function at 0xa51b1d
Capabilities:
Encrypt data using aes

Disassembly:
mov bp, si
cmc
bsf edi, edi
jmp 0xa51b50
mov edi, edx
mov ebp, 0x109ceb7c
cmc
neg ebp
bt bp, si
jmp 0xa51b3a
Function at 0xb6327c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 8], dx
pop eax
lea ebp, reloc.RASAPI32.dll_RasHangUpA
cpuid
cpuid
pop dword [esp + 0xd]
jmp 0xb631ce
mov dword [esp], ecx
mov esi, edx
lea edx, [ebx - 0xea]
sub esp, 0x1b
mov byte [esp + 2], dh
lea edx, [ebx + ebp]
jmp 0xb631f5
pop ecx
ror bh, cl
jmp 0xb6324f

Function at 0xb633d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, 0x9c
seto bl
pushfd
mov bp, dx
clc
cpuid
jmp 0xb633be
rdtsc
neg bp
pop bp
mov cl, byte [esp + 0x1e]
mov esi, eax
not ecx
jmp 0xb633f6
push dword [esp + 0x10]
mov dx, word [esp + 0x10]
jmp 0xb633ac
rdtsc
push bx
add esp, 0x23
btc cx, si
xchg word [esp + 3], bx
jmp 0xb6343f
xchg cl, bl
xor dl, 0xf0
mov byte [esp + 0xe], bl
push word [esp + 0x24]
sbb di, ax
jmp 0xb633e0
mov dword [esp + 1], edx
mov ax, 0x7621
mov dx, 0x1233
call fcn.00b63454
cli
aad 0x44
neg esi
push dword [esp + 3]
mov bh, dl
neg ecx
mov ah, 0x3e
push word [esp + 5]
mov cx, 0x6e0d
jmp 0xb63429

Function at 0xb6357e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
xchg al, cl
mov ebx, eax
bsr bx, sp
lea eax, [edx*4]
jmp 0xb635c0
sub esp, 3
xor bh, bh
lea ebp, [eax*4]
mov ecx, dword [esp + 3]
jmp 0xb63568
xchg si, bp
push word [esp + 0x29]
mov eax, ebp
pop cx
mov eax, ecx
clc
jmp 0xb635aa
Function at 0xb63c39
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, ax
jmp 0xb63c95
mov ch, dl
mov eax, edx
lea esi, [edi*4]
mov esi, dword [esp + 8]
jmp 0xb63c6d
mov byte [esp + 0xd], ch
bsr edx, ebp
mov edi, 0xa5dfcef8
bsr si, bx
xchg dword [esp + 0xb], ebp
bts ebp, esi
jmp 0xb63c3d

Function at 0xb63df7
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf eax, ecx
push ax
mov word [esp + 3], sp
push word [esp + 5]
jmp 0xb63dc3
mov bl, byte [esp + 8]
pop word [esp + 2]
lea esp, [esp + 0xb]
mov dl, 0x2d
xchg bx, cx
mov byte [esp + 2], bl
jmp 0xb63d65
rdtsc
push dword [esp + 1]
pop dword [esp + 0xa]
mov ebp, dword [esp + 8]
mov di, bx
xchg ecx, ebx
jmp 0xb63d7b
mov ebx, 0xa8d7f378
mov ch, 0xb9
mov ebx, ebp
lea esp, [esp + 2]
jmp 0xb63dd9
setg al
pop eax
mov word [esp], cx
mov esi, 0x2dffbdb2
xchg byte [esp + 1], bl
btr edi, ebx
jmp 0xb63dad
push word [esp]
xchg dh, bl
mov word [esp], cx
not esi
sub esp, 0x18
lea edx, [ebx*4]
jmp 0xb63e47
lea esi, [edx + esi]
mov dx, 0x94b9
mov ah, dl
xchg bx, cx
bsf eax, ebp
jmp 0xb63d98
lea edi, [eax + ecx]
bsf edi, ebx
rdtsc
setp cl
jmp 0xb63e2c
xchg ebp, edx
mov ch, 0x36
add esp, 0x10
inc ecx
ror al, cl
rdtsc
jmp 0xb63e08
lea esi, [esi*4]
rdtsc
xchg ebx, edi
not bp
ror bx, cl
bswap ebx
jmp 0xb63e74
bts bp, dx
mov dword [esp + 0xc], ebp
lea esp, [esp + 5]
mov ax, 0xfba
add esp, 6
xchg esi, eax
jmp 0xb63e1e
rdtsc
mov esi, dword [esp + 0x16]
xchg ebp, edi
popal
setg bl
xchg dx, ax
jmp 0xb63eb1
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov si, ax
dec si
pushal
rdtsc
not cx
jmp 0xb63e5e
lea ecx, reloc.RASAPI32.dll_RasHangUpA
inc dl
mov cx, 0x9513
mov byte [esp], dh
neg edi
btc ebx, esp
jmp 0xb63e9b

Function at 0xb63edd
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
xchg di, cx
xchg si, ax
push dword [esp + 8]
mov dword [esp + 5], esp
jmp 0xb63ee4
sub esp, 0x15
xchg ebp, eax
jmp 0xb63ec7
mov ah, byte [esp + 1]
cpuid
xor edi, ebp
mov cl, byte [esp + 0x1b]
mov ebp, dword [esp + 0x1b]
add esp, 0x16
jmp 0xb63f75
bswap eax
sub esp, 5
push edi
pop word [esp + 6]
mov ax, word [esp]
jmp 0xb63f5d
shr edx, 0x1d
xchg esi, edi
stc
mov esi, dword [esp + 5]
rdtsc
setge bl
jmp 0xb63f20
neg si
xchg byte [esp + 5], cl
shr di, 0
sub esp, 4
xchg ebp, eax
xchg esi, eax
jmp 0xb63fa0
xchg byte [esp + 4], al
mov ebp, dword [esp + 0xb]
mov word [esp + 8], di
setno bl
cpuid
jmp 0xb63f47
pop word [esp + 4]
mov dx, si
add esp, 1
cmc
mov si, word [esp]
ror dl, 6
jmp 0xb63f36
bsf esi, esi
mov bx, 0x69f2
not eax
xchg dword [esp], ebp
xchg byte [esp + 9], bh
jmp 0xb63fe0
setbe ah
rdtsc
pop word [esp + 3]
mov dl, byte [esp + 0xa]
shl cl, cl
jmp 0xb63f8a
rdtsc
bt esi, esi
bsf ax, bp
push dword [esp + 2]
add esp, 0
mov word [esp + 0xc], ax
jmp 0xb63fc0
Function at 0xb6440d
Capabilities:
Get number of processors
Parse pe header

Disassembly:
mov word [esp + 1], bp
pushfd
mov dword [esp + 0x54], edi
lea esp, [esp + 0x54]
mov eax, dword fs:[0x30]
jmp 0xb6420f
push word [esp]
pushfd
push bp
pop word [esp]
lea esp, [esp + 4]
lea esp, [esp + 2]
jmp 0xb64242
mov dword [esp], ebx
mov word [esp + 3], si
mov byte [esp + 1], bh
lea esp, [esp + 3]
mov dword [esp + 0x50], esi
pushfd
jmp 0xb64297
push word [esp + 3]
jmp 0xb64396

Function at 0x100113e
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov ax, word [esi]
cmp ax, 0x22
push 2
pop ecx
jne 0x1001171
add esi, ecx
mov ax, word [esi]
test ax, ax
je 0x1001169
cmp ax, 0x22
jne 0x1001159
cmp word [esi], 0x22
jne 0x1001189
jmp 0x1001187
cmp ax, 0x20
jbe 0x1001189
add esi, ecx
cmp word [esi], 0x20
ja 0x1001177
jmp 0x1001189
cmp ax, 0x20
ja 0x1001191
add esi, ecx
mov ax, word [esi]
test ax, ax
jne 0x1001181
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x18], 1
je 0x10011ab
movzx eax, word [ebp - 0x14]
jmp 0x10011ae
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]