joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460210
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x49dd18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x118]
test eax, eax
jne 0x4602c0
mov eax, dword [0x4d9fa8]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.0048f2e0
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.0048f32f
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.0048f28c
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4602a7
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x4602a7
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x118], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.0048eefc
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4633c0
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49e1a0
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x463567
mov ecx, dword [0x4d9fa8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x4634bc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.004620e0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.0048efe9
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.0048eefc
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4cefc0
call fcn.0048ef6a
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.004624a0
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.0048efe9
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.0048eefc
lea ecx, [esp + 0xc]
call fcn.0048f3c4
mov ecx, dword [esp + 0xc]
push 0x4cf9fc
push ecx
call fcn.0047ea14
add esp, 8
test eax, eax
je 0x4634e4
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x46341d
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.0048eefc
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0048eefc
jmp 0x46356b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.00463160
test eax, eax
push 0
je 0x46354f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.00461800
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x463535
cmp eax, 0x64
jg 0x463523
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4634c0
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4634c0
cmp eax, 0x64
jge 0x4634bc
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4634c0
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.00461800
mov esi, eax
jmp 0x4634c0
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x463575
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x46e7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x46e911
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x46e8f5
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x46e847
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x46e825
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x46f359
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x46f3b0
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x46f3b0
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x46f3b0
xor eax, eax
inc eax
jmp 0x46f3b2
xor eax, eax
leave
ret 0x10
Function at 0x46f3db
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x46f449
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x4ade8c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46f440
cmp dword [ebp - 0xc], 4
jne 0x46f440
cmp dword [ebp - 0x10], edi
je 0x46f440
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x4d1a80], edi
xor eax, eax
jmp 0x46f488
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4d1a80], edi
jge 0x46f483
lea eax, [ebp - 0x34]
push eax
mov dword [0x4d1a80], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x46f483
cmp word [ebp - 0x14], 5
jb 0x46f483
call fcn.0046f3b6
test eax, eax
je 0x46f483
emms
mov dword [0x4d1a80], 1
mov eax, dword [0x4d1a80]
pop edi
leave
ret

Function at 0x4912dd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x491315
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048f357
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048f32f
jmp 0x491321
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4929d2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x492a14
call fcn.00498751
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x492a14
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x492a0b
xor eax, eax
jmp 0x492a1c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00492a22
pop edi
pop esi
pop ebx
ret 4

Function at 0x498c81
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x498caf
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x498ccd
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00498be7
jmp 0x498ccd
mov eax, dword [esi + 0x14]
test eax, eax
je 0x498ccd
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00498be7
test edi, edi
mov eax, edi
jne 0x498cb7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x61d7b6
Capabilities:
Encode data using xor

Disassembly:
push 0
jmp 0x61c1a0
call 0x61c17e
jmp 0x61d687
call 0x61c1a5
jmp 0x61d6cc
call 0x61c1c2
popal
je 0x61c22f
imul eax, dword [eax], reloc.WINMM.dll_waveOutUnprepareHeader
add byte [ebx - 0x1063f26e], bh
call 0x61c1ea
jmp 0x61d6f1
mov dword [esp + 0x24], eax
jmp 0x61d719
imul esi, dword [ebx + 0x69], reloc.WINMM.dll_waveOutUnprepareHeader
call 0x61c273
jmp 0x61d93f
call 0x61d671
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
out dx, al
cld
insd dword es:[edi], dx
out dx, al
test eax, eax
jmp 0x61d6aa
pop eax
sub eax, 0xee6fa351
jmp 0x61d661
pushal
jmp 0x61c179
je 0x61c126
jne 0x61c1b8
push eax
jmp 0x61d70f
pop eax
sub eax, 0x3aa6ad4
call dword [eax + 0x3a8c44a]
jmp 0x61d677
mov ch, bh
mov ecx, dword [esp]
call fcn.0061d6da
invalid
call fcn.0060e652
jmp 0x61c1e5
popal
call 0x61d720
add byte [eax], al
or byte [ebp - 0x14fbdb9c], 0x67
arpl di, ax
push edi
xor al, cl
dec eax
cli
js 0x61d71d
mov dword [eax - 0x39], edi
aad 0x44
neg esi
sub ecx, 0x10013082
mov dword [ecx + reloc.WINMM.dll_waveOutUnprepareHeader], eax
jmp 0x61d768
pushal
lea esp, [esp + 0x20]
cmp dword [esp + 4], 0
jne 0x61d60e
test dword [esi + edi*8 - reloc.WINMM.dll_waveOutUnprepareHeader], ebp
cmp al, 0xff
invalid
je 0x61d6a4
movzx ebx, byte [eax]
add ebx, 0x59eda02
cmp ebx, 0x59edace
jmp 0x61d78f
je 0x61d7d5
jne 0x61c214
push 0
pushfd
jmp 0x61d992
lea esp, [esp + 4]
push 0
pushfd
jmp 0x61d752
insb byte es:[edi], dx
loop 0x61d75d
je 0x61d79d
stc
fdivr dword [ebx]
call 0x61d84a
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
mov ch, bh
ret
pop eax
sub eax, 0xfd8a0c8e
jmp 0x61d83a
cmp dword [esp + 4], 0
jne 0x61db37
pushal
jmp 0x61c26e
inc dword [esp + 8]
popfd
jmp 0x61d8e5

Function at 0x72c6a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 0xc]
push 0
pushal
not dx
push dword [esp + 4]
push word [esp + 8]
push word [esp + 3]
pop dword [esp + 3]
push dword [esp + 6]
jmp 0x72c5ef

Function at 0x72f882
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x72fa06
xchg dx, ax
xchg byte [esp], al
mov dword [esp], eax
rdtsc
lea ebx, [edx*4]
rdtsc
jmp 0x72f9d6
bsf si, si
xchg ebx, esi
push esp
mov word [esp + 1], bx
rdtsc
xchg dword [esp], ebx
jmp 0x72f8eb
mov byte [esp + 3], ch
bswap edx
add esp, 0
xchg dword [esp], eax
add esp, 4
lea esp, [esp]
jmp 0x72f907
lea eax, [esi + 0xad]
xchg ebp, esi
cmc
mov bp, 0x727d
lea edi, [ebx + ebx]
bswap edx
jmp 0x72f91f
lea esp, [esp + 1]
mov dl, 0xe4
not ch
clc
mov bx, 0x62c5
rcl cx, cl
jmp 0x72f963
cpuid
setae ah
neg bh
rdtsc
neg ebx
mov cx, word [esp + 2]
jmp 0x72f887
Function at 0x72fbc4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, ah
lea eax, [eax + 0x39]
add esp, 0xb
add ebp, ebp
jmp 0x72fbf9
lea ebp, [ecx + edi]
bswap edx
xchg bh, cl
mov dh, byte [esp + 1]
lea eax, [edx + esi]
rdtsc
jmp 0x72fcbe
add esp, 0
lea esp, [esp]
add esp, 0
mov cl, ch
inc ebp
mov si, di
jmp 0x72fc9b
popal
mov eax, ecx
xchg dword [esp], ebp
xchg bp, cx
pop esi
lea edi, [esi*4]
jmp 0x72fc53
add esp, 1
btc esi, edi
shr dh, 7
xchg byte [esp], bl
pushal
push edx
jmp 0x72fc6e
btc esi, ebx
cpuid
inc ebp
pushal
inc dl
rcr bh, 3
jmp 0x72fd19
lea eax, [esi*4]
rdtsc
mov ax, 0x48a9
setne bh
lea edx, [esi*4]
setne ah
jmp 0x72fc8b
cpuid
pop word [esp + 0x15]
not ch
mov si, bx
xchg byte [esp + 0xe], bl
xchg ebx, eax
call fcn.0072fcf7
or esp, dword [edx + reloc.WINMM.dll_waveOutUnprepareHeader]
outsb dx, byte gs:[esi]
push eax
jb 0x72fda4
outsb dx, byte [esi]
je 0x72fda3
jb 0x72fd81
add byte [esi - 0x47], ah
and dword [esi - 0x2d], 0x8df960d7
sub al, 0x2f
lea edx, [eax + 0xb9]
jmp 0x72fe4f
xchg ah, bl
pop word [esp + 2]
pop ebp
not ebp
mov cl, 0x2a
pop dword [esp]
jmp 0x72fe2a
mov edx, 0xb14a6648
xchg word [esp + 0xb], ax
mov si, 0xe63b
setae ch
jmp 0x72fd7a
mov ds, word [ecx]
js 0x72fe02
sbb dword [eax + 0x5b], edi
rcl cx, cl
lea edx, [edx + ebx]
lea esp, [esp]
pop ebx
mov cl, ch
push dword [esp + 6]
jmp 0x72fd90
mov dl, dh
push dword [esp + 3]
cpuid
inc esi
pop dword [esp]
mov word [esp + 1], dx
jmp 0x72fdfe
mov cl, 0x4a
bswap ecx
push word [esp]
xchg dword [esp], esi
not edx
mov ax, word [esp]
jmp 0x72fdb9
rcr eax, 0x1d
xchg byte [esp], cl
xor si, 0x82bc
mov ax, word [esp + 2]
mov ecx, esi
rdtsc
jmp 0x72fe13
lea ebp, [ebp - 0x77]
stc
mov al, ah
mov ecx, 0x87517092
bsr cx, bp
lea esp, [esp + 2]
jmp 0x72fde3
push word [esp]
pop word [esp]
call fcn.0072fe87
popfd
adc eax, 0xff1fec85
add al, 0xb7
sahf
jmp 0x1977ab8
mov bh, byte [esp + 1]
pop dx
bsr di, bp
xchg dword [esp], edx
lea esp, [esp + 2]
add cx, 0x28a6
jmp 0x72fdd0
pop ecx
lea edx, [edi*4]
lea esp, [esp + 0x17]
cpuid
btr edx, edx
lea esi, [edi*4]
jmp 0x72fda7

Function at 0x72fcf7
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc cx
xor dl, ch
cpuid
rdtsc
bsr cx, cx
bsr bp, bp
jmp 0x72fcf9
jmp 0x72fcda
cpuid
mov ebp, 0x4b29e81e
mov edi, 0x1354e2cc
add esp, 0xd
mov si, 0xf4d3
setp ch
jmp 0x72ffd2
mov cx, 0x6481
rcl di, cl
pushal
stc
lea ebp, [edi + ebp]
pop eax
mov ch, byte [esp + 1]
inc dl
mov byte [esp + 0xa], ah
neg ecx
rdtsc
jmp 0x72fd41
btc ebx, edi
mov dword [esp + 7], esi
mov edx, esi
mov byte [esp + 4], dh
xchg byte [esp + 0xd], bl
rdtsc
jmp 0x72fd69
pop dword [esp + 0xa]
xchg edx, ebx
mov al, 0xd6
not bh
mov dl, 0xc4
xchg si, ax
jmp 0x72fe6f
lea esi, [esi*4]
xchg ebp, esi
btr edi, esp
pop word [esp + 0x11]
mov word [esp + 6], di
mov dword [esp + 1], ebp
jmp 0x72fea4
Function at 0x7302de
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov dl, dh
mov edx, dword [esp + 1]
clc
sub esp, 0xc
rdtsc
jmp 0x7302e0
jmp 0x7302c4
xchg cx, di
pop si
clc
mov bl, 0xe0
bsf cx, si
bsf dx, ax
jmp 0x73037a
pop word [esp + 0x1f]
mov word [esp], di
pop dword [esp + 0xa]
jmp 0x730392
mov edi, 0xcd02acb0
lea ecx, [ecx + 0x5b]
mov di, word [esp + 6]
push word [esp + 0x1d]
jmp 0x730310
pop word [esp]
pop dword [esp]
lea esp, [esp + 3]
push word [esp + 3]
not edx
pushal
jmp 0x730326
mov dword [esp + 2], ecx
sub esp, 2
lea ebx, [edx + edi]
pop dword [esp]
mov dword [esp + 7], ebp
lea esp, [esp + 2]
jmp 0x730342
lea esp, [esp + 1]
xchg di, ax
mov ebx, eax
push dword [esp + 3]
mov ecx, 0x8cca117c
mov word [esp + 0xa], bx
jmp 0x73035c
xchg word [esp + 5], ax
bsr ax, cx
xchg byte [esp + 9], al
mov cl, 0xda
xchg dword [esp + 0x1a], edx
mov edi, 0x261dff28
jmp 0x73049c
mov eax, 0x64e2cc96
rcr ecx, 9
mov dword [esp + 1], ebp
xchg dword [esp + 0x1a], esi
jmp 0x730432
lea eax, [esp + eax]
and esi, ecx
sub esp, 0x14
pushal
mov dword [esp + 0x1b], eax
mov cx, 0x322d
jmp 0x7303c4
shl cx, cl
mov bl, 0x48
inc esi
xchg ch, dl
mov si, word [esp]
bswap ebp
jmp 0x7303da
mov dh, byte [esp + 7]
btr edi, esp
call fcn.00730464
jmp 0x630af478
xchg ch, dl
pop dword [esp + 4]
pop dword [esp]
bswap ecx
setg ah
jmp 0x730405
push dword [esp + 0x20]
popal
push dword [esp + 0x12]
mov byte [esp + 6], ch
mov ah, byte [esp + 0x19]
pop dword [esp + 0xe]
jmp 0x73041b
mov ax, 0x521d
push word [esp + 0xb]
xchg byte [esp + 0x19], al
pushal
lea esp, [esp + 0x44]
mov bp, bx
jmp 0x7303f5

Function at 0x730464
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 0xd], bx
lea esp, [esp + 7]
bsr bp, cx
add cx, 0x778e
lea ebp, [edi + ebp]
jmp 0x730471
bswap ebx
clc
mov byte [esp + 7], ah
xchg byte [esp + 1], cl
jmp 0x730449
mov byte [esp + 5], dh
bsr bx, bp
sub esp, 0xc
rdtsc
bsf ax, ax
lea esp, [esp + 7]
jmp 0x7304d3
lea edx, [ebx + ebp]
rcr ah, 1
and cl, bh
xchg dh, al
cpuid
mov dx, word [esp + 0x12]
jmp 0x730ad4
push word [esp + 0x11]
sub esp, 0x1c
neg bh
mov byte [esp], ch
bsf ax, ax
lea esi, [edi*4]
jmp 0x7304b6
add esp, 3
xchg byte [esp + 8], al
pop dword [esp + 4]
cpuid
mov dx, word [esp + 2]
neg ax
jmp 0x730542
pop ecx
push esp
sub esp, 4
lea ebp, [eax - 0xa9]
mov word [esp + 6], di
xchg ebp, esi
jmp 0x73050c
rdtsc
mov esi, dword [esp + 7]
neg ah
pop bp
mov ecx, 0x690a91bc
xchg byte [esp + 2], al
jmp 0x730595
not ebp
xchg dx, ax
cpuid
xchg word [esp + 5], bp
mov ah, byte [esp + 1]
setg bh
jmp 0x73052e
sete bh
cmc
add esp, 0
xchg bp, ax
inc dx
mov bp, bx
call fcn.0073057d
sbb byte [esi + 0x23967b1c], cl
lahf
out 0x11, al
nop
lea esp, [esp + 0x17]
mov dx, word [esp]
xchg ecx, eax
mov word [esp + 2], dx
push dword [esp + 4]
xchg word [esp + 9], di
jmp 0x730569
cpuid
xchg edx, esi
bswap esi
rol cx, cl
mov dl, 0x3c
add esp, 0x11
jmp 0x7305b3
add dx, 0x9f66
xchg ch, dl
lea ebp, [ebp*4]
btc ebp, ebx
mov dx, 0xb575
xchg dh, al
jmp 0x7305e5
Function at 0x48582dad
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea eax, [ebp - 1]
push eax
push 1
push 1
push 0x13
call esi
cmp eax, 0xc000007c
jne 0x48582ddb
lea eax, [ebp - 1]
push eax
push 0
push 1
push 0x13
call esi
push 0x4858121c
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
push 6
lea eax, [ebp - 0x20]
push eax
push 1
push 4
push 0xc000021a
call dword [sym.imp.ntdll.dll_NtRaiseHardError]
mov eax, dword [esi]
push dword [eax]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
xor eax, eax
inc eax
pop esi
leave
ret 4
Function at 0x4858375b
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov ecx, dword [ebp + 8]
push esi
push edi
push 0x40
pop eax
push eax
mov dword [ebp - 0x1c], eax
push 7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
xor edi, edi
push 0x10000
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x28], 0x18
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
cmp esi, edi
jge 0x485837f1
xor eax, eax
mov ecx, 0x4858c644
inc eax
lock xadd dword [ecx], eax
inc eax
push 0x20
pop ecx
cdq
idiv ecx
push esi
push dword [ebp + 8]
push 0x485816b0
push 3
push 1
mov eax, edx
shl eax, 4
mov dword [eax + 0x4858c660], 0x7c6
mov dword [eax + 0x4858c664], esi
mov dword [eax + 0x4858c668], edi
mov dword [eax + 0x4858c66c], edi
call sub.ntdll.dll_DbgPrintEx
add esp, 0x14
jmp 0x48583882
push 0xd
push 1
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov byte [ebp - 1], 1
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov esi, eax
xor eax, eax
mov ecx, 0x4858c644
inc eax
lock xadd dword [ecx], eax
inc eax
cdq
push 0x20
pop ecx
idiv ecx
mov eax, edx
shl eax, 4
cmp esi, edi
mov dword [eax + 0x4858c66c], edi
mov dword [eax + 0x4858c668], edi
mov dword [eax + 0x4858c664], esi
jl 0x4858385a
push dword [ebp + 8]
mov dword [eax + 0x4858c660], 0x7db
push 0x4858167c
push 3
push 1
call sub.ntdll.dll_DbgPrintEx
add esp, 0x10
jmp 0x48583879
push esi
push dword [ebp + 8]
mov dword [eax + 0x4858c660], 0x7e4
push 0x48581640
push 3
push 1
call sub.ntdll.dll_DbgPrintEx
add esp, 0x14
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x4858388f
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push 0x48581744
push 3
push 1
call sub.ntdll.dll_DbgPrintEx
mov eax, dword [ebp + 0xc]
add esp, 0x10
push 0x18
pop ebx
xor edi, edi
push 0x20
mov dword [eax], edi
mov dword [eax + 4], edi
push 3
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x100080
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], 0x40
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov ecx, eax
cmp ecx, edi
jge 0x4858392e
xor eax, eax
mov edx, 0x4858c644
inc eax
lock xadd dword [edx], eax
inc eax
cdq
push 0x20
pop ebx
idiv ebx
mov eax, edx
shl eax, 4
mov dword [eax + 0x4858c660], 0x888
mov dword [eax + 0x4858c664], ecx
mov dword [eax + 0x4858c668], edi
mov dword [eax + 0x4858c66c], esi
mov eax, ecx
jmp 0x485839b5
push 5
push ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ebx, eax
cmp ebx, edi
jge 0x4858399c
xor eax, eax
mov ecx, 0x4858c644
inc eax
lock xadd dword [ecx], eax
inc eax
push 0x20
pop ecx
cdq
idiv ecx
push ebx
push esi
push 0x485816f8
push 3
push 1
mov eax, edx
shl eax, 4
mov dword [eax + 0x4858c660], 0x895
mov dword [eax + 0x4858c664], ebx
mov dword [eax + 0x4858c668], edi
mov dword [eax + 0x4858c66c], esi
call sub.ntdll.dll_DbgPrintEx
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
jmp 0x485839b5
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x34]
mov dword [eax + 4], ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x48583b8c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ecx
push eax
push 0x485817a4
mov dword [0x4858c880], eax
mov dword [0x4858c860], ecx
call sub.ntdll.dll_DbgPrint
add esp, 0xc
xor eax, eax
pop ebp
ret 8