joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ce6ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xa
lea eax, [eax*4]
mov dword [esp + 1], ecx
mov al, ah
jmp 0x4ce738

Function at 0x4ce72c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, si
lea edx, [ebp + 0x50]
call fcn.004ce6ef
dec esi
mov al, 0xfa
lea esp, [esp + 2]
xchg dword [esp + 8], ebp
call 0x4ce7f9
enter 0xffffffffffffc959, 0xffffffffffffffa8
pop ebx
out dx, al
cmp byte [ebx], bl
jb 0x4ce7be
neg dh
jmp 0x4ce6e3
mov al, 0x5a
lea esp, [esp + 2]
push dword [esp + 0x28]
ret 0x2c
mov bx, di
xchg dword [esp + 0x10], ebp
pushal
mov bl, bh
pop dword [esp + 0x14]
pop bx
jmp 0x4ce755
cmp ax, 0xef22
lea ebp, [ebp - 0x32]
not bh
add al, dh
bswap ebx
btr ebx, esp
jmp 0x4ce76f
mov dl, dh
jmp 0x4ce7da
neg ebx
jl 0x4ce79b
mov dl, dh
jmp 0x4ce7da
pop es
adc al, 0x8e
sbb al, 0x7b
xchg esi, eax
push eax
lahf
out 0x11, al
cmp edi, edx
ja fcn.004cdc82
lea edx, [ebp + 0xc7]
bswap edx
jmp 0x4ce7b1
mov edx, ebp
xchg al, ah
not al
mov ebx, dword [esp]
call 0x4ce807
mov dword [edx], edx
and bh, 0x12
add byte [ecx + 0x12e78012], cl
lodsb al, byte [esi]
or dword [edi + 0x5a916207], edx
mov ah, byte [0xff6ec754]
je 0x4ce820
add al, byte [edi + 0x66032444]
mov eax, 0x82ebc475
jmp 0x4cec75
and al, 3
mov ax, 0xc475
jmp 0x4ce789
bswap ebx
bsf bx, ax
add bx, 0x4642
jmp 0x4cec26
sti
dec ebx
pop eax
mov ebx, 0x92ad0d92
test dword [ebx], esp
jb 0x4ce87e
mov ah, byte [ebx]
and dh, byte [ebx + 0x120a2388]
xchg byte [ebx], ah
pop es
test al, 0x88
and ebx, ebp
rol byte [ebp - 0x7738a5dd], 1
and ebx, esp
xor ecx, dword [edx - 0x7a7bfddd]
and ebp, edx
mov edi, 0x5a272388
mov dword [ebx], esp
adc esp, eax
mov dword [ebx], esp
mov edi, 0x2a238698
jl 0x4ce7e3
and esp, edi
jge 0x4ce7e7
and edi, dword [ecx - 4]
test dword [ebx], esp
jns 0x4ce864
test dword [ebx], esp
cmp eax, 0x6c23870a
cdq
mov byte [ebx], ah
cmp bh, byte [edi - 0x7a]
and esi, dword [edi]
jmp 0x4ce7ff
aad 0x1a
mov dword [ebx], esp
invalid
sub eax, edx
push edx
xchg dword [esp], ebx
add esp, 3
jp 0x4cec49
mov ebx, 0x740768a8
jmp 0x4cece8
bsf bx, ax
add bx, 0x4642
jmp 0x4cec26
jmp 0x4cec5f
mov ebx, 0x740768a8
lea esp, [esp + 1]
jmp 0x4cecb5
lea eax, [ebp + 0x40]
dec ebx
jns 0x4ce80c
bswap ebx
jmp 0x4cec3e
lea ebx, [edi - 0x80]
push esp
call fcn.004cec9e
pop word [esp + 7]
call 0x4cecc9
sbb ecx, ebp
mov esp, 0xe8000000
xchg esp, eax
add byte [eax], al
add byte [ecx - 6], bh
push 0x5944fa0f
fisttp word [edi + 0x2a]
fldenv [esi]
mov cl, 0x30
cmpsb byte [esi], byte es:[edi]
sal dword [eax], 0x81
lodsd eax, dword [esi]
mov esp, 0x24648d8f
add ebx, ebp
invalid
lea esp, [esp + 1]
jmp 0x4cecb5

Function at 0x4df0d1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, ax
mov dword [ebp - 4], eax
jmp 0x4bf4e1
lea esp, [esp + 1]
mov byte [esp + 1], bh
lea esp, [esp + 3]
jmp 0x4df0b1

Function at 0x4eca74
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
popal
jmp 0x4ecab4
bswap ebp
bsr bp, bp
pushal
push dword [esp + 0x18]
shr edi, 0x18
jmp 0x4eca98
Function at 0x4f6164
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], dh
pop ax
lea esp, [esp + 1]
popal
mov eax, esi
call fcn.004f6238
push ebp
les esi, [edi + 0x5e]
setbe ah
mov dword [esp + 0x10], edi
mov byte [esp + 1], dh
add esp, 1
jns 0x4f60f7
js 0x4f614c
Function at 0x4f7040
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc ebx, edi
ja 0x4f7004
jbe 0x4f7004
sbb byte [edx + esi*4], 0xd5
and al, 0x91
imul byte [ecx - 7]
cwde
imul ebp, dword [eax + 0x7dc2ab08], 0xf
mov ebx, 0xc8a0fe3
invalid
Function at 0x4f72ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl dx, cl
inc ebx
bsr dx, bp
jmp 0x4f69b9
jp 0x4f69aa
mov ebx, 0xf2a34fa2
mov bl, 0x8e
jmp 0x4f68c4
mov ebx, 0xf2a34fa2
mov bl, 0x8e
rcl dx, cl
inc ebx
bsr dx, bp
bsf bx, si
jmp 0x4f68ad
mov ebx, dword [esp + 1]
jmp 0x4f6cd0
pop bx
setp bh
not bl
mov ebx, dword [esp]
lea esp, [esp + 2]
jmp 0x4f6d06
add ecx, edx
bsr dx, bp
jmp 0x4f6d8c
call fcn.004f6d73
pop ss
xchg esi, eax
add al, 0x63
sahf
das
or dword [ebx], 0xffffff9b
dec byte [0x18392eca]
jnp 0x4f6d7a
mov dx, 0xd27
neg ebx
mov ax, 0x629f
mov eax, dword [esi - 4]
and edx, eax
jmp 0x4f68df
sub esi, 4
rcr dx, cl
jne 0x4f6e4a
sbb edx, ebp
mov ebx, dword [esp]
lea ebx, [ebp - 0xaf]
jmp 0x4f6d90
lea esp, [esp + 2]
jmp 0x4f6d3c
js 0x4f6d12
jns 0x4f6d12
mov dx, word [esp]
xor dx, 0x42ec
jmp 0x4f6dc5
lea esp, [esp + 2]
jmp 0x4f6dd2
mov ebx, dword [esp]
lea ebx, [ebp - 0xaf]
mov dx, word [esp]
xor dx, 0x42ec
mov edx, 0xa2c2876a
mov dl, byte [esp]
sub esp, 0x1a
jmp 0x4f6df8
lea esp, [esp + 0x18]
not eax
sub esp, 8
jmp 0x4f6e1e
mov edx, 0x86873fb0
setae bh
sub esp, 0x1e
mov dh, byte [esp + 1]
neg dh
jmp 0x4f6e2a
jne 0x4f6d9b
lea esp, [esp + 2]
jmp 0x4f6dd2
sub esp, 0x1e
mov dh, byte [esp + 1]
neg dh
call fcn.004f6e82
in ax, dx
jge 0x4f6e16
div dword [eax + esi*2]
invalid
insb byte es:[edi], dx
or eax, dword [esi]
ret
jno 0x4f6de1
mov edx, 0x86873fb0
setae bh
jmp 0x4f6e00
clc
lea esp, [esp + 7]
push word [esp + 0xb]
lea esp, [esp + 1]
jmp 0x4f6ed1
sbb edx, ebp
jmp 0x4f6db3
mov dl, 0xbc
mov bx, word [esp]
sub esp, 0xc
jg 0x4f6f2b
xchg bl, bh
setge bh
jmp 0x4f6ef0
ror eax, 0
lea ebx, [eax*4]
mov edx, 0x11ffdcaa
setae dh
jmp 0x4f6ebb
add esp, 1
xchg dword [esp + 4], ebx
push word [esp + 2]
jmp 0x4f6f21
setge bh
add esp, 1
xchg dword [esp + 4], ebx
push word [esp + 2]
add esp, 0
jmp 0x4f7057
xchg bl, bh
jmp 0x4f6f12
lea esp, [esp + 0x28]
xor eax, 0x66b204c9
lea edx, [esp + edi]
jmp 0x4f6fdd
pop bx
lea esp, [esp + 3]
call fcn.004f6f2f
or ecx, dword [ebp + 0xbd1c]
add byte [eax], al
lea ebx, [edi*4]
bsr bx, cx
call fcn.004f6ff4
mov byte [0x63f2cdd], al
mov cl, 0x8d
and al, 3
xchg dword [esp], ebp
lea edx, [eax + 0x69045c41]
mov dh, 0x82
jmp 0x4f6f78
clc
jge 0x4f701f
inc ebx
lea ebx, [esi - 0x1d]
mov dx, 0x92f3
jmp 0x4f6fff
mov dx, 0x92f3
call fcn.004f7040
call fcn.004f7025
sub eax, 0xf6dc9197
xchg ebx, edx
mov edx, eax
xchg bh, dh
lea edx, [edx + ebx]
cmc
jmp 0x4f7369
inc ebx
lea ebx, [esi - 0x1d]
jmp 0x4f6ffb
btc ebx, esp
jp 0x4f6f6c
pop bx
lea esp, [esp + 3]
jmp 0x4f6f51
lea edx, [ebx + edi]
bsf bx, ax
shr bx, cl
jmp 0x4f72a5
neg dx
jmp 0x4f728e
ror dh, 7
btc ebx, ebx
jmp 0x4f72bc
rol eax, 0
shr dh, 5
jp 0x4f7285
neg dx
ror dh, 7
btc ebx, ebx
jmp 0x4f72bc
mov dword [edi], eax
lea eax, [ecx + 0xab]
call 0x4f72ca
and dword [ebx + 0x677401c4], eax
jne 0x4f7302
invalid
shr bx, cl
jmp 0x4f72a5
sub esp, 0xe
lea esp, [esp + 1]
jmp fcn.004ce6b3
jb 0x4f706b
lea edx, [ebx + edi]
bsf bx, ax
jmp 0x4f72e1
Function at 0x4f789a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0x9f2df80a
mov ax, bx
neg dx
mov dl, dh
cmc
jmp 0x4f78e0
xchg dword [esp], edi
push edx
push dword [esp + 2]
inc dl
mov dword [esp + 3], eax
mov word [esp], di
jmp 0x4f792e
lea edi, [edi + 0x2a]
mov dh, ch
neg edx
mov edx, dword [esp]
mov edx, 0xe6d5066a
bswap eax
jmp 0x4f790d

Function at 0x4f7a10
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, bh
xchg ah, dh
add esp, 1
js 0x4f795f
stc
ror ah, 1
mov byte [esp + 1], dh
bsr ax, cx
add esp, 1
jmp 0x4f7968

Function at 0x4f7a3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
sub bl, 0x97
jmp 0x4f7a75

Function at 0x5d2d29
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, 0x60c9
mov al, ah
cpuid
cpuid
add ecx, ebp
xchg edx, ecx
jmp 0x5d2d39
lea edx, [eax + 0x65cade91]
xchg esi, ebp
mov ax, word [esp]
xchg edi, ebx
jmp 0x5d2cc0
xchg ah, bl
mov bl, 0xb8
bsf cx, si
mov al, byte [esp]
bsr si, cx
jmp 0x5d2cd6
neg bp
mov al, ah
rcl si, cl
mov bx, word [esp]
lea esi, [eax - 0x62574677]
bsf si, si
jmp 0x5d2ced
lea esp, [esp + 4]
pushal
mov eax, dword [esp]
bsr bp, bp
and ebp, ecx
jmp 0x5d2d05
mov esi, ebp
add ax, 0x6da6
sub esp, 0x18
rdtsc
not di
bswap ebp
jmp 0x5d2d4f
lea esi, [edx + ebx]
xchg ecx, eax
pushal
pop dx
xchg word [esp + 9], si
mov edi, dword [esp + 0xd]
jmp 0x5d2d6d
pop dx
mov edi, dword [esp + 9]
mov ch, byte [esp + 1]
xchg esi, edx
not edx
sub esp, 0x14
jmp 0x5d2e3a
mov dx, word [esp + 6]
cpuid
mov bl, 0xf0
mov word [esp + 0x18], di
bswap ebp
rcr ebx, 0x1b
jmp 0x5d2dda
mov ax, word [esp + 0x14]
lea edi, [esi + edi]
mov bp, 0x32fb
setl ch
pop edi
lea eax, [edi*4]
jmp 0x5d2d99
not ecx
mov byte [esp + 8], ch
push esp
not ah
btc edi, edi
cpuid
jmp 0x5d2e0e
btr eax, esp
pop ax
sub bl, ah
mov cx, word [esp]
sub esp, 0x1e
push dword [esp + 0xe]
jmp 0x5d2dc1
xchg esi, ebx
mov eax, dword [esp + 0x11]
inc esp
and al, 0x11
bsf dx, ax
mov word [esp + 0xc], di
clc
rdtsc
jmp 0x5d2eb7
lea esp, [esp + 0x48]
rcl dx, cl
mov si, dx
mov cl, byte [esp]
lea ecx, [ecx + ebx]
sub esp, 2
jmp 0x5d2dfa
mov dword [esp + 2], ebp
xchg byte [esp + 0xa], al
cld
call fcn.005d2e4f
cpuid
add esp, 0
call 0x5d2e86
jle 0x5d2e11
int 0xf5
setnp ch
neg di
jmp 0x5d2ecd
lea esp, [esp + 0x13]
not di
bswap edi
mov byte [esp + 5], dh
lea esp, [esp]
mov dx, 0x5215
jmp 0x5d2e6d
lea edi, [ebx + edi]
mov dword [esp], ecx
push word [esp + 3]
pop word [esp + 2]
mov dx, 0x493f
mov byte [esp + 3], ah
jmp 0x5d2f13
lea esi, [edx*4]
xchg dword [esp], ebx
neg si
pushal
pop si
xchg bh, cl
jmp 0x5d2efa
Function at 0x5d391c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, byte [esp + 0x25]
popal
mov dword [esp + 8], esi
jmp 0x5d39cd
mov al, 0xae
mov ecx, dword [esp]
xchg dx, bp
rcr bh, 3
cld
mov bx, word [esp]
jmp 0x5d3a89
lea esp, [esp + 6]
add esp, 6
mov si, 0xd07d
mov byte [esp], dh
xchg ebp, esi
neg ch
jmp 0x5d39b7
xchg cx, dx
lea esp, [esp]
mov cx, sp
cpuid
inc dl
mov bx, word [esp]
jmp 0x5d3a72
xchg byte [esp], bl
cmc
mov cx, 0xcb83
mov byte [esp], ch
xchg byte [esp], al
mov bx, di
jmp 0x5d3a03
lea esp, [esp]
rcr ah, 1
mov ebx, ecx
xchg ch, dl
mov edi, dword [esp]
add esp, 0
jmp 0x5d3a23
xchg ah, bl
mov bl, bh
lea esi, [edi*4]
btc ecx, ebx
jmp 0x5d3ab2
xchg byte [esp], dl
mov byte [esp], ch
mov ebp, esi
stc
cpuid
setne bh
jmp 0x5d3a5c
xchg bh, cl
mov al, ah
neg ch
inc di
mov ebx, 0xd639d902
add esp, 0
jmp 0x5d3a4b
sub esp, 0
push dword [esp + 0x15]
setge ch
mov di, dx
lea esp, [esp + 0x18]
jmp 0x5d3c80
mov dh, byte [esp]
lea esi, [esi*4]
rdtsc
bsf di, ax
sub esp, 0x16
jmp 0x5d3a9b
mov bl, 0x98

Function at 0x5d4d74
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
btr edx, esp
mov ebx, dword [esp + 3]
setbe ch
mov ebx, dword [esp + 3]
jmp 0x5d4d94
ror ch, 5
xchg dword [esp], ecx
mov byte [esp + 1], bh
not dh
setle ah
xchg dx, ax
jmp 0x5d4dfe
mov ax, 0xe15d
xchg byte [esp + 2], cl
cld
add esp, 0xa
lea esp, [esp]
xchg ah, bl
jmp 0x5d4dbf
lea esi, [edx + ebx]
pop word [esp + 1]
lea eax, [ebp - 0x1373d491]
push word [esp + 4]
lea edi, [esp + edi]
push edx
jmp 0x5d4dd9
Function at 0x5d4fdd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ebp - 7]
xchg dh, al
xchg byte [esp + 0x10], al
pop bp
sub esp, 0xc
rdtsc
jmp 0x5d4fdf
jmp 0x5d4fc4
push edx
popal
xchg word [esp], bp
pop ax
bswap ebp
lea edx, [ebp*4]
jmp 0x5d6c36
lea ecx, [eax*4]
pop dword [esp + 0xf]
mov dh, byte [esp + 0xc]
setns ah
call fcn.005d5060
neg esi
ror ecx, 0xb
pop word [esp + 0x1e]
mov word [esp + 0x1f], sp
xchg ah, bl
mov cx, 0x8c6d
jmp 0x5d512a
mov dx, bx
pop word [esp + 4]
xchg esi, ebx
cpuid
inc esi
inc ebp
jmp 0x5d5196
btc esi, ebx
not edx
pop dx
inc bp
xchg word [esp + 0x10], cx
neg edx
jmp 0x5d510a
not cx
pushal
lea edi, [edi*4]
pop dword [esp + 0x12]
mov ax, word [esp + 0x24]
add esp, 0xd
jmp 0x5d50c1
lea ebp, [ecx + edi]
pop di
mov ecx, 0x93b451da
push word [esp + 9]
pop edx
mov edx, dword [esp + 0xf]
jmp 0x5d51f2
bswap eax
call fcn.005d51cf
out 0x6a, eax
clc
lahf
push 0xffffffffffffff89
sbb ecx, dword [edi + 0x75897a1f]
mov byte [0x8eb82cdd], al
shl byte [ebx - 0x7e4f720e], cl
push ds
add eax, 0x8b66f5bb
push esp
and al, 0xb
mov eax, 0xf2a3d28e
lea esi, [eax - 0x44fae17f]
cmc
mov dx, word [esp + 0xb]
mov word [esp + 5], sp
bswap ebx
jmp 0x5d516a
mov dl, 0x6c
push dword [esp + 5]
pop eax
lea eax, [edx*4]
mov edx, 0xc09d4980
sub esp, 4
jmp 0x5d5180
pop dword [esp + 4]
pop di
xchg byte [esp + 2], cl
ror ah, 1
lea edi, [esi*4]
xchg word [esp + 9], bx
jmp 0x5d514e
push word [esp + 3]
xchg word [esp + 6], cx
add esp, 5
add edx, ebp
xchg bh, cl
xchg dx, bp
jmp 0x5d521d
bsr ax, cx
pop dx
neg eax
rdtsc
not dh
mov ax, word [esp + 1]
jmp 0x5d52a1
bswap ebx
cmc
mov ah, byte [esp]
sub esp, 0x1a
stc
xchg dh, al
jmp 0x5d52bd
lea ebp, [esi + 0x4d]
lea ebx, [edx + edi]
add esp, 0
mov dx, 0x7b7f
mov bl, 0xf0
mov cl, ch
jmp 0x5d52ed
inc di
xchg dx, bp
btc eax, edi
add esp, 0
xchg edi, ecx
add edi, ebp
jmp 0x5d593a

Function at 0x5d551b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
mov edi, 0xa11b2d46
xchg ecx, edx
mov word [esp + 1], bx
mov si, word [esp + 3]
jmp 0x5d553a
neg bx
xor dl, ch
pop bp
shl bp, cl
push word [esp]
cpuid
jmp 0x5d54ea
lea esp, [esp + 1]
lea edx, [ecx + 3]
pop word [esp]
bsf di, ax
jmp 0x5d5503
Function at 0x5d5743
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg di
call fcn.005d551b
mov al, 0x56
lea ebp, [ebp*4]
pop di
xchg ebx, edx
cpuid
lea esp, [esp + 1]
jmp 0x5d55b1
mov dword [esp], esi
jmp 0x5d5532
xor si, 0xf6a4
add dx, 0xcdc6
bswap esi
shr eax, 0xd
mov al, ah
stc
jmp 0x5d5761
pushal
pop edx
mov word [esp + 0x1f], di
rdtsc
cpuid
mov eax, 0x731cdfe0
jmp 0x5d5558
mov eax, esi
neg ax
push esp
lea edi, [edi*4]
rdtsc
lea eax, [ebx*4]
jmp 0x5d5578
add esp, 1
lea edi, [edx + ebx]
neg bp
mov edi, 0xc92ef222
lea esp, [esp]
push edx
jmp 0x5d5591
neg bh
bsr cx, cx
rcl si, cl
mov dword [esp + 1], ebp
call fcn.005d55ed
mov bx, dx
mov word [esp + 3], bx
neg dh
setae ah
xchg dword [esp + 0x17], ecx
xchg word [esp + 0x10], bx
jmp 0x5d5727
push word [esp + 0x25]
neg edx
shl cx, cl
inc di
rcl si, cl
mov byte [esp + 0xb], dh
jmp 0x5d5604
mov word [esp + 0x18], dx
xchg word [esp + 0x26], ax
call fcn.005d5686
mov dl, 0x4c
not ebx
mov esi, dword [esp]
call 0x5d5743
inc edx
pop word [esp + 1]
mov eax, esi
mov al, 0x46
jmp 0x5d5847
xchg ch, dl
lea ebp, [ebp - 0xd1af661]
inc esi
push dword [esp + 0x1f]
bswap esi
push esp
jmp 0x5d5633
lea ecx, [ecx + edi]
inc cx
xchg ebp, eax
sub ax, 0x4c18
rdtsc
add esp, 1
jmp 0x5d582f
mov cl, ch
setns ch
xchg dword [esp + 0x16], ecx
lea edx, [edx + ebx]
mov cx, sp
mov word [esp + 8], bx
jmp 0x5d5776
pushal
inc ebx
mov ax, bx
pop word [esp + 0x1b]
mov edi, esi
shr edx, 1
jmp 0x5d578c
pop edx
mov esi, eax
push word [esp + 4]
pop word [esp + 0xf]
lea esp, [esp + 0x13]
mov ebx, esi
jmp 0x5d58d3
neg ch
bsf bx, si
pop dword [esp + 4]
lea ecx, [edx + ebx]
xchg bh, cl
bsr cx, bp
jmp 0x5d57c5
neg ch
xchg word [esp + 0x19], bx
mov eax, 0x93f7585e
mov esi, ecx
inc edx
xchg edx, ebx
jmp 0x5d57ea
bsf si, ax
mov eax, dword [esp + 0x1c]
pop dword [esp + 2]
xchg word [esp + 0x16], bx
jmp 0x5d5808
push word [esp + 3]
pop word [esp + 1]
mov dx, 0x4ec1
push dword [esp + 2]
push dword [esp + 4]
inc edi
jmp 0x5d57b5
mov ax, 0xbf3
rdtsc
pop dword [esp]
lea edx, [ecx*4]
mov eax, 0x87ee09fa
xchg dword [esp], ecx
jmp 0x5d58b8
pop dword [esp + 4]
pop word [esp + 2]
bsr bp, bp
lea esp, [esp]
xchg si, ax
mov dx, bx
jmp 0x5d5863
mov bl, 0x68
mov ah, byte [esp]
stc
rdtsc
popal
setle ch
call fcn.005d58ec
bound ebx, qword [ebp + 0x71c6ffec]
sub eax, eax
xchg dword [esp], edi
rcl di, cl
pushal
btr ebp, edx
xchg byte [esp + 2], dl
jmp 0x5d58a1
mov byte [esp + 5], dh
mov ecx, dword [esp + 9]
push word [esp + 7]
add esp, 1
mov eax, dword [esp]
push dword [esp + 2]
jmp 0x5d588a
Function at 0x5d5b00
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0xd], esi
xchg edi, ecx
lea edx, [ebp + 0xb7]
mov ax, 0xbcab
jmp 0x5d5a52
pop word [esp + 2]
mov eax, dword [esp + 4]
sub esp, 2
sub esp, 0xc
btc eax, ebx
add esp, 6
jmp 0x5d5a23
setne ch
mov cx, word [esp + 3]
mov dword [esp + 9], ecx
xchg dword [esp + 8], ebx
push edx
xchg dword [esp + 0xc], ecx
jmp 0x5d5a9f
pop word [esp + 4]
xchg ebx, eax
pop si
push dword [esp + 2]
lea ebp, [ecx + ebx]
mov edx, 0x90456992
jmp 0x5d5a3b
mov dx, sp
xchg dword [esp + 0x23], edx
mov bx, word [esp + 0x21]
pop esi
pop word [esp + 0x1b]
lea esp, [esp + 2]
jmp 0x5d5ae8
btc ebx, ebx
setae ah
sub esp, 0x18
xchg ebx, edi
pop esi
sub edi, eax
jmp 0x5d5a83
pop ax
sub bp, 0x5e70
mov dword [esp + 7], eax
pop word [esp + 0xa]
neg ebp
xchg word [esp + 9], bx
jmp 0x5d5a6d
mov ah, byte [esp + 0x1a]
bswap esi
add esp, 2
bsf dx, ax
mov cl, ch
jmp 0x5d5bd0
pop eax
mov cl, 0x1a
mov dl, 0xac
xchg di, cx
xchg bh, cl
pop word [esp + 0xe]
jmp 0x5d5ad2
shr ebx, 0xd
pop dx
rcl si, cl
jmp 0x5d5ab9
mov word [esp + 0x2e], di
setns bh
clc
xchg ebx, edx
mov ecx, dword [esp + 0x29]
push edx
jmp 0x5d5bb8
sub esp, 0x1c
lea ecx, [esp + edx]
mov ecx, ebp
btr esi, edx
neg eax
push edx
jmp 0x5d5b0a
mov eax, dword [esp + 7]
sub esp, 2
mov ax, dx
mov dx, 0xf285
mov ebp, 0xf3caa34e
xchg cx, ax
jmp 0x5d5b27
btc ebx, edi
add esp, 5
lea esi, [esi - 0xed]
xchg dword [esp + 2], esi
lea eax, [edx + edi]
jmp 0x5d5b9f
lea edi, [esi - 0x7d]
sub esp, 0x14
pop ebx
btc ebx, ebx
bsf cx, si
xchg dword [esp + 4], ebx
jmp 0x5d5b5a
mov dl, dh
lea edi, [esp + edi]
mov ax, bx
mov bl, bh
mov byte [esp + 5], ch
mov edx, eax
jmp 0x5d5e07
pop ax
pop word [esp]
sub esp, 0x14
rdtsc
neg ah
mov cx, di
jmp 0x5d5b88
lea esp, [esp + 0x41]
mov dl, dh
mov ebx, ebp
lea edi, [ecx + 3]
mov ecx, ebp
rdtsc
jmp 0x5d5b74
xchg dh, al
mov ebx, dword [esp + 9]
bswap esi
xchg ebp, edx
cpuid
mov byte [esp + 0x11], bh
jmp 0x5d5b43
Function at 0x5d5efe
Capabilities:
Parse pe header

Disassembly:
push edx
push word [esp + 0xb]
call fcn.005d5edd

Function at 0x5d5f34
Capabilities:
Parse pe header

Disassembly:
pop dword [esp + 0xc]
call fcn.005d5ea5
Function at 0x5d5fd2
Capabilities:
Parse pe header

Disassembly:
push word [esp + 1]
push esp
lea esp, [esp + 3]
jmp 0x5d5f9e

Function at 0x5d5fde
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 3]
mov dword [esp + 0x8c], edi
lea esp, [esp + 0x8c]

Function at 0x5d6377
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 0x38]
mov byte [esp], dh
mov byte [esp], dh
call fcn.005d5fd2
pop dword [esp + 0x1a]
pop word [esp + 0x15]
lea esp, [esp + 0xd]
push dword [esp + 6]
push dword [esp + 0x12]
pushal
jmp 0x5d6001
mov byte [esp + 0xa], bh
lea esp, [esp + 0x2d]
lea esp, [esp + 3]
mov dword [esp + 0x64], esp
pushal
push dword [esp + 0x18]
jmp 0x5d602b
push word [esp + 0x17]
jmp 0x5d6318
Function at 0x40ff70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x473d7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00468168
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40fff2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00465e4a
mov eax, dword [eax]
push 0x48d204
push eax
call fcn.00458154
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004683f3
test bl, bl
je 0x40fff2
push 0x48d204
lea ecx, [esp + 0xc]
call fcn.00468783
push 0x490d7c
lea ecx, [esp + 0xc]
call fcn.00468783
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41002e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004683f3
jmp 0x4100f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4100b2
lea edx, [esp + 0x7c]
push 0x490d78
push edx
call fcn.00458154
add esp, 8
test eax, eax
je 0x4100b2
lea eax, [esp + 0x7c]
push 0x490d74
push eax
call fcn.00458154
add esp, 8
test eax, eax
je 0x4100b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410042
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004683f3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x411350
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4113b2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4113c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x473edb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4993e8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4114f8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x411426
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004683f3
xor eax, eax
jmp 0x41156f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00468530
push esi
lea ecx, [esp + 0xc]
call fcn.004687bf
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41154d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00411350
test eax, eax
jne 0x41154d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00411350
test eax, eax
jne 0x41154d
lea eax, [esp + 0x14]
push 0x490d90
push eax
call fcn.00459190
mov esi, eax
add esp, 8
test esi, esi
jne 0x41152c
lea ecx, [esp + 0x14]
push 0x490d8c
push ecx
call fcn.00459110
mov esi, eax
add esp, 8
test esi, esi
jne 0x41152c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41152f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004684e0
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41143e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004683f3
xor eax, eax
jmp 0x41156f
mov byte [esi], 0
push 0x490d88
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004683f3
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4