joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412117
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
jbe 0x412192
push ebp
push edi
lea edi, [esi + 4]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x412250
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
jne 0x41216e
push str.CreateThread_failed
push 0x4430c4
call fcn.004076c9
pop ecx
pop ecx
mov ecx, 0x4430c4
call fcn.00407851
push 2
mov ecx, 0x4430c4
call fcn.004076c4
mov dword [edi], ebp
inc dword [esi + 0x104]
mov eax, dword [0x44a208]
test eax, eax
je 0x412188
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc ebx
add edi, 4
cmp ebx, dword [esi]
jb 0x412127
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x41acd5
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [esp + 0x14]
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, ecx
push esi
push 0
push ebp
mov dword [ebx + 8], ebp
mov byte [ebx + 0x2a], al
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 0x20]
mov ecx, ebx
call fcn.0041aa04
cmp dword [ebx + 0x20], 0
je 0x41ad0e
push dword [ebx + 0x20]
call fcn.00424e89
pop ecx
cmp dword [esp + 0x28], 0
jne 0x41ad19
xor eax, eax
jmp 0x41ad23
push dword [esp + 0x28]
call fcn.00428688
pop ecx
cmp dword [esp + 0x2c], 0
mov dword [ebx + 0x20], eax
jne 0x41ad31
xor eax, eax
jmp 0x41ad3b
push dword [esp + 0x2c]
call fcn.00428688
pop ecx
mov dword [ebx + 0x24], eax
lea eax, [esp + 0xc]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
cmp dword [ebx + 4], 0
je 0x41ad70
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
push edi
push ebx
push dword [ebx]
sub esi, eax
lea edi, [eax + 1]
push 0
push ebp
sub esi, 2
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
push eax
push esi
push dword [esp + 0x2c]
xor esi, esi
push edi
push 0x40000000
push esi
push 0x4355f0
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp byte [ebx + 0x1c], 0
mov dword [ebx + 4], eax
pop edi
jne 0x41adf8
cmp dword [ebx + 0x10], esi
jne 0x41adf8
test ebp, ebp
je 0x41ae0e
cmp dword [ebx + 0x24], esi
jne 0x41ae0e
cmp dword [ebx + 0x20], esi
je 0x41ae0e
push dword [ebx + 0x20]
mov ecx, ebx
call fcn.0041aafe
mov esi, eax
test esi, esi
je 0x41ae0e
push 5
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.00424e89
pop ecx
jmp 0x41ae0e
test eax, eax
je 0x41ae0e
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
Function at 0x41b27a
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x4364dc
push 1
push ebx
push 0x4365cc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x41b3af
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push esi
push ecx
push 0x4365bc
mov esi, dword [eax]
push eax
mov ecx, dword [esi]
call dword [0x434278]
call dword [esi]
test eax, eax
js 0x41b39b
cmp byte [ebp + 8], bl
je 0x41b2e0
mov eax, dword [ebp - 8]
push 2
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x434278]
call esi
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x50]
mov ecx, esi
call dword [0x434278]
call esi
cmp dword [ebp + 0x18], ebx
je 0x41b311
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x434278]
call esi
mov eax, dword [ebp - 4]
push ebx
mov ecx, dword [eax]
mov esi, dword [ecx + 0x44]
mov ecx, esi
cmp dword [ebp + 0x1c], ebx
jne 0x41b328
push 0x4345f4
jmp 0x41b32b
push dword [ebp + 0x1c]
push eax
call dword [0x434278]
call esi
cmp dword [ebp + 0x20], ebx
je 0x41b34f
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x2c]
mov ecx, esi
call dword [0x434278]
call esi
cmp dword [ebp + 0x14], ebx
je 0x41b36a
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x434278]
call esi
mov eax, dword [ebp - 8]
push 1
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x434278]
call esi
test eax, eax
js 0x41b388
mov bl, 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x434278]
call esi
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x434278]
call esi
pop esi
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x41b43d
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
setne al
ret 8
Function at 0x41b4b2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ecx
push esi
push edi
push 0x4357fc
push dword [esp + 0x18]
push dword [0x443068]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41b5cb
push esi
push dword [0x443068]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x41b5cb
push esi
push dword [0x443068]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41b5cb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41b5cb
push ebx
push ebp
push edi
xor ebp, ebp
push 2
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x41b5c3
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x41b5bc
push edi
push esi
push eax
call fcn.00422a30
add esp, 0xc
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x41b5b5
push ebp
push dword [esp + 0x14]
call fcn.0041b416
mov ecx, dword [esp + 0x10]
mov edi, eax
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x434278]
call esi
test edi, edi
je 0x41b5b5
mov eax, dword [edi + 8]
mov dword [edi + 8], ebp
test eax, eax
jne 0x41b5a3
push 0xffffff
lea eax, [esp + 0x18]
push eax
push dword [edi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x41b5a3
mov dword [edi + 8], eax
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x434278]
mov ecx, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
jmp 0x41b5cd
xor eax, eax
pop edi
pop esi
pop ecx
pop ecx
ret 4

Function at 0x41bcdf
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.0041fc40
cmp word [0x452892], 0
je 0x41bd7b
push esi
push 6
push dword [0x440724]
mov esi, 0x452892
push esi
call fcn.0040d489
push eax
call fcn.00413108
test eax, eax
jne 0x41bd7a
push 0x451890
call fcn.0041b9f9
push 0x800
push esi
lea eax, [ebp - 0x1024]
push eax
call fcn.00411708
lea eax, [ebp - 0x1024]
push eax
call fcn.00424c13
xor ecx, ecx
push 0x1e
push ecx
mov word [ebp + eax*2 - 0x1022], cx
lea eax, [ebp - 0x20]
push eax
call fcn.00420e20
add esp, 0x10
mov dword [ebp - 0x1c], 3
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1024]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop esi
leave
ret
Function at 0x41bdbf
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x44073c], 0
push ebx
push esi
push edi
mov ebx, 0x400
jne 0x41be0a
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x461ce8], ax
xor eax, eax
mov word [0x461cea], ax
mov dword [0x44073c], 0x461ce8
push 0x32
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004115c3
mov edi, dword [ebp + 0x10]
xor eax, eax
mov esi, dword [ebp + 0x14]
push esi
push edi
push 0x44072c
mov word [edi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
mov word [edi + esi*2 - 2], ax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x41c050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041fc40
cmp byte [0x453898], 0
je 0x41c0fe
push 0x800
lea eax, [ebp - 0x200c]
push eax
push dword [ebp + 8]
call fcn.0041d4d4
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c0fe
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1000
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c0f5
mov eax, dword [ebp - 4]
mov ecx, 0x7ff
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x41c0d9
mov eax, ecx
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.00411708
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8
Function at 0x41c1b4
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.0041fc40
mov ecx, dword [esp + 0x2014]
push ebx
xor ebx, ebx
push esi
test ecx, ecx
je 0x41c1cf
mov byte [ecx], bl
mov edx, dword [esp + 0x2020]
test edx, edx
je 0x41c1dc
mov byte [edx], bl
mov esi, dword [esp + 0x2010]
test esi, esi
je 0x41c2b8
movzx eax, word [esi]
test ax, ax
je 0x41c2b8
push ebp
mov ebp, dword [esp + 0x201c]
push edi
mov dword [esp + 0x10], ebx
mov edi, eax
add esi, 2
cmp di, 0x3d
jne 0x41c227
test ebp, ebp
je 0x41c233
test ebx, ebx
jne 0x41c233
test ecx, ecx
je 0x41c21e
mov byte [ecx], 1
mov ebx, dword [esp + 0x201c]
jmp 0x41c257
cmp di, 0xd
je 0x41c26c
cmp di, 0xa
je 0x41c26f
mov eax, dword [esp + 0x201c]
mov word [eax], di
add eax, 2
mov edi, dword [esp + 0x202c]
mov dword [esp + 0x201c], eax
lea eax, [edi - 2]
cmp dword [esp + 0x10], eax
jge 0x41c267
movzx eax, word [esi]
inc dword [esp + 0x10]
mov edi, eax
test ax, ax
jne 0x41c206
jmp 0x41c26f
mov byte [edx], 1
jmp 0x41c276
add esi, 2
mov edi, dword [esp + 0x202c]
mov eax, dword [esp + 0x201c]
xor ecx, ecx
mov word [eax], cx
test ebp, ebp
je 0x41c2b2
xor eax, eax
mov word [ebp], ax
test ebx, ebx
je 0x41c2b2
push 0x1000
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
lea eax, [esp + 0x18]
push eax
push ebp
call fcn.00411708
xor eax, eax
mov word [ebx], ax
pop edi
mov eax, esi
pop ebp
jmp 0x41c2ba
xor eax, eax
pop esi
pop ebx
add esp, 0x2004
ret 0x18
Function at 0x41e7e3
Capabilities:
Hide graphical window

Disassembly:
and dword [0x45188c], 0
push 1
push dword [esp + 8]
mov byte [0x44a46d], 1
mov byte [0x44a46e], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.004012b3
cmp dword [0x461cd4], 0
jne 0x41e823
cmp byte [0x44a47b], 0
je 0x41e82c
cmp dword [0x44a474], 0
jne 0x41e83f
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x41e93b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041fc40
cmp byte [0x453898], 0
je 0x41e9ca
cmp word [0x45389a], 0
je 0x41e9ca
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x45389a
call fcn.0041d4d4
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41e9c9
push dword [ebp + 8]
call fcn.00424c13
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4

Function at 0x41e9ce
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0041fc40
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.00411477
mov esi, eax
test esi, esi
je 0x41ea26
movzx ecx, word [esi]
push ecx
jmp 0x41ea11
add esi, 2
movzx eax, word [esi]
push eax
call fcn.00411593
test al, al
jne 0x41ea0a
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
leave
ret 4
Function at 0x4207cb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42080a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42080a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42080a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42080a
cmp dword [ecx + 0x74], 0xe
jbe 0x42080a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432f80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x432fad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x432fad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10002b30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10002b88
cmp byte [esi + ebx - 1], 0xa
je 0x10002b5c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x100080a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x403620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x403678
cmp byte [esi + ebx - 1], 0xa
je 0x40364c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x40d0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x404060
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0xe6016c
Capabilities:
Execute anti-debugging instructions

Disassembly:
add cl, bl
bsr dx, si
jl 0xe601a3
jge 0xe6018d
inc eax
invalid
rdtsc
jmp 0xe601a5
rdtsc
mov dl, cl
bswap eax
mov eax, edi
setg al
jmp 0xe601ca
add dl, 0xd2
bsr ax, cx
jno 0xe60202
mov ax, 0x4aa4
bswap eax
jmp 0xe61474
mov eax, 0x8810a5df
jmp 0xe601b0
bswap eax
mov eax, 0xb555d7ad
mov ah, 0x6f
mov eax, 0xf60007cc
jmp fcn.00e613fa
mov ax, 0x4aa4
jmp 0xe601ec
mov eax, 0xb555d7ad
mov ah, 0x6f
Function at 0xe6035a
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf ax, dx
jl 0xe6035c
pop word [esp]
cmp ah, 0x36
jmp 0xe604b7
jmp 0xe60344
pop word [esp]
cmp ah, 0x36
jmp 0xe60369
lea esp, [esp + 2]
not dl
push cx
mov ax, cx
shr ah, cl
jmp 0xe603b1
jmp 0xe603fc
jle 0xe60443
lea esp, [esp + 2]
jmp 0xe60447
mov ah, byte [esp]
sub esp, 0xc
jnp 0xe603e3
lea edx, [esp + esi]
jmp 0xe6041c
bsr ax, bp
inc esi
mov dx, 0x51a1
mov dh, 0x3a
jmp 0xe603c0
lea edx, [esp + esi]
dec eax
rdtsc
sub esp, 0xe
mov dword [esp + 3], esi
xchg word [esp + 3], ax
jmp 0xe604d6
btr ax, ax
neg eax
bswap eax
jmp 0xe603d6
dec eax
rdtsc
sub esp, 0xe
call 0xe60428
xor al, 0xf5
mov eax, esp
rol ax, cl
btr dx, ax
clc
jmp 0xe6047b
lea esp, [esp + 2]
add bl, dl
jg 0xe6039b
btr ax, ax
neg eax
bswap eax
bsr ax, bp
jmp 0xe603da
lea esp, [esp + 1]
lea esi, [esi - 0x21]
rdtsc
xchg dx, ax
bsr ax, ax
jmp 0xe60491
xchg dword [esp], esi
xchg dx, ax
mov eax, edi
sub eax, 0xab539e0f
sub esp, 0x1d
mov byte [esp + 0x11], dl
jmp 0xe60460
mov edx, 0xe5b48579
xchg dx, ax
xchg dword [esp + 0x1c], esi
ror edx, 0x1e
btc dx, si
bsr ax, dx
jmp 0xe604f6
lea esp, [esp + 2]
jmp 0xe6036d
cmc
jge 0xe60501
neg dx
neg edx
jmp 0xe6050c
lea esp, [esp + 2]
lea esp, [esp + 0xc]
dec cl
xchg edx, eax
mov dh, 0xa2
jmp 0xe604c0
pushfd
lea eax, [ecx + esi]
push dword [esp + 0x20]
ret 0x24
neg dx
neg edx
jmp 0xe6050c
ror cl, 0
clc
jmp 0xe60544
mov dh, 0x89
bswap eax
xchg dx, ax
mov edx, ecx
sete ah
mov eax, dword [esp]
jmp 0xe60656
je 0xe60516
mov dh, 0x89
bswap eax
jmp 0xe60550
xchg dx, ax
mov edx, ecx
sete ah
jmp 0xe60521
neg edx
jmp 0xe605b3
mov ax, sp
mov dh, byte [esp]
mov dx, word [esp]
jmp 0xe6057b
lea edx, [eax + ebx]
bt dx, ax
mov eax, ebx
not ax
jmp 0xe605ee
not cl
lea eax, [eax + edx]
mov dl, dh
lea edx, [edx*4]
bt edx, edx
jmp 0xe605ca
jl 0xe6059d
lea edx, [eax + ebx]
bt dx, ax
jmp 0xe6060f
xchg dx, ax
jmp 0xe60591
dec cl
xchg dx, ax
neg ah
jg 0xe6062c
jle 0xe60616
mov eax, 0x495d8cd9
xchg word [esp + 0x15], ax
dec ax
lea esp, [esp + 3]
call fcn.00e6068e
mov dl, 0xad
mov eax, ebx
not ax
jmp 0xe605ee
bswap eax
jmp 0xe6062e
bswap eax
mov edx, ecx
sub esp, 0x1b
jno 0xe605f8
jo 0xe6063f
or al, byte [esi + 0x398e7314]
mov bh, 0x9e
mov eax, 0x495d8cd9
xchg word [esp + 0x15], ax
dec ax
jmp 0xe6072c
not cl
neg al
je 0xe605ea
xchg dx, ax
mov ax, sp
mov dh, byte [esp]
mov dx, word [esp]
neg edx
jmp 0xe605b3
shl edx, 2
bswap eax
jmp 0xe606e2
mov ah, 0x55
call fcn.00e60713
jmp 0xe60750
ror ax, 8
jl 0xe606c8
mov ah, 0x55
jmp 0xe5fd10
lea esp, [esp + 3]
jmp 0xe606c1
bswap eax
mov ah, byte [esp]
bsf ax, sp
xchg dword [esp], ebp
bsr ax, sp
mov ax, word [esp]
jmp 0xe60776
pop edi
cmp cl, cl
imul edi, ebx, 0x6091f660
salc
sbb eax, 0x2c87c78a
and al, 0x66
shl eax, 8
lea eax, [edx*4]
mov eax, dword [esp]
lea ebp, reloc.gdiplus.dll_GdipAlloc
jmp 0xe60732
sub esp, 0x11
xchg byte [esp + 0xc], al
lea esp, [esp + 1]
push dword [esp + 0x10]
ret 0x14
Function at 0xe61023
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebx + esi]
jmp 0xe60ff0
lea esp, [esp + 0x14]
not cl
cmc
jb 0xe60faf
lea eax, [ebx + esi]
rdtsc
lea edx, [ecx + ebp]
lea eax, [esi*4]
call fcn.00e6103f
mov word [0xab17e49d], cs
sbb al, 0x6f
jbe 0xe61050
mov al, byte [0x148d310f]
sub dword [ebp + reloc.gdiplus.dll_GdipAlloc], ecx
add byte [eax], al
rdtsc
lea edx, [ecx + ebp]
lea eax, [esi*4]
jmp 0xe61002
not cl
jmp 0xe6100a
mov dx, word [esp]
mov eax, dword [esp]
sub esp, 0xb
jbe 0xe61068
mov ax, sp
lea esp, [esp + 3]
jmp 0xe61075
lea esp, [esp + 2]
jmp 0xe60fc8
je 0xe61076
or dl, al
or al, 0
xor dword [edi + reloc.gdiplus.dll_GdipAlloc], esi
sub al, byte [ebp - 0xc]
out 0x87, eax
sbb al, 0x24
xchg dword [esp], ebx
call fcn.00e6104a
mov ax, sp
jmp 0xe61071
lea esp, [esp + 3]
lea esp, [esp + 8]
and al, 8
dec cl
bswap eax
call fcn.00e610a4
xor dword [eax + reloc.gdiplus.dll_GdipAlloc], esi
sub eax, 0x48d0f3c
popfd
add byte [eax], al
add byte [eax], al
lea ebx, [ebx + 0x1d]
bsf eax, ebx
mov ax, word [esp]
mov ax, word [esp]
mov eax, ecx
jmp 0xe61060

Function at 0xe6fe3d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0x4a3d4cc2
lea edx, [edx*4]
mov edx, dword [esp + 1]
jmp 0xe6fe76
pushfd
mov dword [esp + 3], eax
xchg dh, ah
lea eax, [esi + edi]
rdtsc
mov al, dh
jmp 0xe6fe60

Function at 0xe702a0
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0xe544ea
Function at 0xf37c3e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 3]
std
jmp 0xf37fab
pop dword [esp + 5]
sub esp, 0x17
mov word [esp + 0x18], bx
pop word [esp + 6]
mov byte [esp + 9], ah
dec edi
mov dl, ah
pop ecx
mov ebp, edi
dec cx
jmp 0xf37cb4
btr bp, ax
lea edx, reloc.gdiplus.dll_GdipAlloc
cpuid
stc
adc bh, 0xbe
sub esp, 0x14
jmp 0xf37d42
lea esp, [esp + 2]
lea esp, [esp + 4]
pushal
mov edx, ebx
xchg dl, dh
bts ax, si
jmp 0xf37db8

Function at 0xf38467
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x10], eax
lea edi, [edi - 0xab]
xchg dh, cl
jmp 0xf38482
pop dword [esp + 0x1b]
mov ax, 0x8355
mov dh, 0x34
mov cl, byte [esp + 0x14]
rdtsc
jmp 0xf3843a
sub esp, 6
jmp 0xf38450
lea esi, [edx*4]
pushfd
xchg dword [esp + 0x15], ebx
jmp 0xf384fb
mov edi, 0x8976ef25
mov byte [esp + 0x19], al
cpuid
xchg si, ax
lea esp, [esp + 7]
jmp 0xf3846c
setl bl
bsr dx, si
lea eax, [ebp - 0x13]
sub esp, 0xd
pop dword [esp + 9]
xchg byte [esp + 0x1d], bl
jmp 0xf384b6
push word [esp + 0xe]
mov di, word [esp + 0x1d]
mov ah, 0x16
lea ebx, [ecx + 0xe1]
push dword [esp + 3]
xchg si, bp
jmp 0xf384cc

Function at 0xf388f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [ebp*4]
pushfd
xchg word [esp + 8], ax
bswap eax
jmp 0xf38913