joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d420
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4645c8]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax + 0x1a30]
and ecx, 8
je 0x44d466
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x44d57f
cmp dword [ebp + 8], 0
je 0x44d57d
cmp dword [ebp + 0xc], 0
je 0x44d57d
cmp dword [ebp + 0x10], 0
jbe 0x44d57d
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x22
jne 0x44d4b8
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 2]
cmp edx, 0x25
jne 0x44d4b8
push 0x25
mov eax, dword [ebp + 8]
add eax, 4
push eax
call fcn.0042a8c4
add esp, 8
mov dword [ebp - 4], eax
jmp 0x44d4d7
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
cmp edx, 0x25
jne 0x44d4d7
push 0x25
mov eax, dword [ebp + 8]
add eax, 2
push eax
call fcn.0042a8c4
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44d569
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 2]
cmp edx, 0x5c
jne 0x44d569
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.0042a350
add esp, 0xc
mov ecx, dword [ebp - 4]
add ecx, 2
sub ecx, dword [ebp + 8]
sar ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.0042a6b1
add esp, 0xc
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0042a3cf
add esp, 4
mov edx, dword [ebp + 0x10]
sub edx, eax
push edx
mov eax, dword [ebp - 4]
add eax, 2
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0042b6f5
add esp, 0xc
xor eax, eax
jmp 0x44d57f
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0042a6b1
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042a8b5
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44d5b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4645c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x44d5d2
xor eax, eax
jmp 0x44d61e
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0042a6b1
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a8b5
mov esp, ebp
pop ebp
ret
Function at 0x44e700
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0x80
push 3
push 0
push 3
push closesocket
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0xffffffff
jne 0x44e737
jmp 0x44e7c9
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x44e764
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44e7c9
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
jne 0x44e791
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44e7c9
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov esp, ebp
pop ebp
ret 4
Function at 0x44ebf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4645c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x420], 0
mov word [ebp - 0x418], 0
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.0042a350
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0042a350
add esp, 0xc
push 0
push 0x1a
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44ecd8
push 0x5c
lea eax, [ebp - 0x210]
push eax
call fcn.00403c80
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x44ecd8
mov ecx, dword [ebp - 0x41c]
mov word [ecx], 0
call fcn.0044eb60
test eax, eax
je 0x44ecb8
lea edx, [ebp - 0x210]
push edx
push str._sRoamingMicrosoftWindowsCookies
push 0x103
lea eax, [ebp - 0x418]
push eax
call fcn.0042aa83
add esp, 0x10
jmp 0x44ecd8
lea ecx, [ebp - 0x210]
push ecx
push str._sCookies
push 0x103
lea edx, [ebp - 0x418]
push edx
call fcn.0042aa83
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401500
mov ecx, dword [ebp - 0x420]
or ecx, 1
mov dword [ebp - 0x420], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a8b5
mov esp, ebp
pop ebp
ret

Function at 0x44f360
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x4645c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x674], ecx
mov dword [ebp - 0x258], 0
push 0x24c
push 0
lea eax, [ebp - 0x254]
push eax
call fcn.0042a350
add esp, 0xc
mov dword [ebp - 0x464], 0xffffffff
mov word [ebp - 0x460], 0
push 0x206
push 0
lea ecx, [ebp - 0x45e]
push ecx
call fcn.0042a350
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str._s.txt
push 0x103
lea eax, [ebp - 0x460]
push eax
call fcn.0042aa83
add esp, 0x10
lea ecx, [ebp - 0x258]
push ecx
lea edx, [ebp - 0x460]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0xffffffff
je 0x44f4ac
mov word [ebp - 0x670], 0
push 0x206
push 0
lea eax, [ebp - 0x66e]
push eax
call fcn.0042a350
add esp, 0xc
lea ecx, [ebp - 0x22c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x45d7dc
push 0x103
lea eax, [ebp - 0x670]
push eax
call fcn.0042aa83
add esp, 0x14
lea ecx, [ebp - 0x670]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0xffffffff
jne 0x44f467
jmp 0x44f4ac
mov edx, dword [ebp - 0x468]
and edx, 0x10
jne 0x44f48d
cmp dword [ebp - 0x468], 0xffffffff
je 0x44f48d
lea eax, [ebp - 0x670]
push eax
mov ecx, dword [ebp - 0x674]
call fcn.0044f0c0
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x464]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44f4a7
jmp 0x44f4ac
jmp 0x44f3f9
mov eax, dword [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a8b5
mov esp, ebp
pop ebp
ret 4
Function at 0x6357fa
Capabilities:
Encode data using xor

Disassembly:
call fcn.00616d8b
push word [esp + 3]
jmp 0x635146
push dword [esp + 1]
push dword [esp + 7]
lea esp, [esp + 1]
lea esp, [esp + 0xc]
jmp 0x616da8
call fcn.0063516e
push edx
mov edx, ebp
jmp 0x635178
lea esp, [esp + 2]
lea esp, [esp + 4]
lea esp, [esp + 4]
jmp 0x635129
lea edx, [edx - 0x10]
mov ecx, dword [edx]
pop edx
mov si, 0xe31
xchg di, si
jmp 0x6351c0
mov edi, dword [esp]
mov bx, di
jmp 0x6357e7
mov dword fs:[0], ecx
mov di, 0xb7af
mov bl, bh
call 0x6357fa
mov eax, dword [reloc.WINMM.dll_waveOutUnprepareHeader]
jmp 0x635a35
bswap esi
lea esp, [esp + 4]
pop esi
mov bl, 0x92
not bx
jmp 0x635a65
lea esp, [esp + 4]
pop ecx
mov edi, dword [esp]
mov esi, dword [esp]
jmp 0x635a11
not bh
mov ebx, dword [esp]
mov ebx, dword [esp]
call fcn.00635a1f
jp 0x635a65
popal
add bl, dh
xor bh, byte [edx + esi*8 + 0x60]
pop es
inc eax
jle 0x635a77
add dh, cl
dec ecx
push 0xffffffffffffff85
sub byte [esi + 0x77c64b2c], bh
sbb dl, byte [ebx + 0x52956603]
adc byte [edx + ecx*4], 0xed
sbb al, 0xda
push ss
adc dword [ecx], reloc.WINMM.dll_waveOutUnprepareHeader
inc edx
sal byte [edi + 0x79a8442], 1
xchg edi, eax
add dword [eax + reloc.WINMM.dll_waveOutUnprepareHeader], esi
mov eax, 0x5950e7e
insb byte es:[edi], dx
lahf
sub ebx, dword [eax + reloc.WINMM.dll_waveOutUnprepareHeader]
mov cl, 0x2a
mov ebx, 0x4bd4e2b
add byte [edx + esi + 0x761ba455], bl
jmp 0x2e4e7347
Function at 0x644ec5
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, edi
mov ch, 0xd8
lea edi, [ecx*4]
jmp 0x644e60
mov edi, dword [esp]
bsr dx, bp
jmp 0x644eb5
mov edx, dword [eax + 0xc]
lea edi, reloc.WINMM.dll_waveOutUnprepareHeader
call fcn.00644e93
and ecx, esi
push esi
mov esi, ecx
jmp 0x644f1a
shr edi, 0x10
and edi, esi
push esp
jmp 0x644efc
lea esp, [esp + 0xc]
and ecx, 0xff0000
sub esp, 2
add esp, 1
lea esp, [esp + 1]
jmp 0x644f5d
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
push esp
cmc
jmp 0x644ed2
lea esi, [esi*4]
lea esi, reloc.WINMM.dll_waveOutUnprepareHeader
mov ecx, dword [esi]
pop esi
jmp 0x644eca
and edi, 0xff000000
call fcn.00644f3d
lea esp, [esp]
add esp, 0
lea esp, [esp + 1]
jmp 0x644fa3
and edx, esi
cmc
push edx
jmp 0x645060
lea esp, [esp + 3]
shr edi, 0x18
sub esp, 0xa
call fcn.00644fe8
xor ecx, edx
neg edx
mov edi, esi
mov dx, di
mov dl, dh
jmp 0x645043
lea esp, [esp + 0x20]
xor ecx, dword [ebx]
lea edx, [edx*4]
stc
setne dh
jmp 0x6460b6
mov edx, dword [edx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
sub esp, 0xa
stc
sub esp, 0x18
add esp, 3
jmp 0x64500b
mov dword [eax + 0x14], edx
sub esp, 0x1a
lea ecx, [esp + esi]
lea esp, [esp + 2]
jmp 0x6450fe
sets cl
jmp 0x64508c
push edx
push word [esp + 0x23]
lea esp, [esp + 2]
xor edx, ecx
setle cl
jmp 0x6450ad
mov ecx, dword [esi]
pop esi
cmc
pushal
xor ecx, edx
jmp 0x6450e2
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
jmp 0x64515b
push esi
mov esi, eax
lea esi, [esi + 8]
jmp 0x6450d5
lea esp, [esp + 0x20]
jne fcn.006176d8
push 0xa
call fcn.00645106
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x5c]
cmp ebx, 0x6237fc
pushal
jmp 0x64512e
lea edx, [eax*4]
mov dh, 0x46
lea edx, [edx*4]
mov edx, dword [eax + 4]
pushal
jmp 0x6450c4
lea esp, [esp + 0x20]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
jmp 0x6451d0
lea edi, [eax + 0x10]
rcr edx, 7
setge dh
pushal
jmp 0x645237

Function at 0x644eef
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ecx
pop word [esp]
lea esp, [esp + 2]
jmp 0x644ec3

Function at 0x644f3d
Capabilities:
Encrypt data using aes

Disassembly:
xor ecx, edi
mov di, 0x8233
dec di
jmp 0x644f7e
push edx
pop word [esp + 0xf]
lea esp, [esp + 0x18]
popal
push edx
lea esp, [esp + 3]
jmp 0x644f68
pushal
mov bp, di
not ecx
mov dword [esp], edx
sub esp, 0x16
jmp 0x644f47

Function at 0x644fe8
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
jmp 0x644ff3
lea esp, [esp + 5]
push word [esp + 2]
jmp 0x644fd1
lea esp, [esp + 0x2c]
movzx edi, byte [edi*4 + 0x621fd4]
cmc
pushal
jmp 0x645037
xor ecx, edi
mov edi, dword [esp]
lea edi, [eax - 0x39]
and edx, ebp
jmp 0x64501a
Function at 0x875d40
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 0x20]
pushal
neg ebx
neg dx
jmp 0x875d54
bsr dx, cx
inc ecx
lea ebp, [esp + esi]
xchg edi, eax
cpuid
rdtsc
jmp 0x875d74
xchg dh, al
neg dh
xchg bh, cl
mov dl, byte [esp]
mov al, ah
btc ebx, edi
jmp 0x875eec
mov bl, bh
call 0x875da1
daa
mov al, 0x26
inc ecx
mov al, 0x19
cmp ebp, dword [ebp + reloc.WINMM.dll_waveOutUnprepareHeader]
cmp al, 0xf
xchg esi, eax
add eax, eax
or dword [ebp - reloc.WINMM.dll_waveOutUnprepareHeader], 0xffffffa5
lea ebp, reloc.WINMM.dll_waveOutUnprepareHeader
lea eax, [esp + ebp]
ror ch, 5
add esp, 5
mov cx, 0xd7cd
xchg dh, al
jmp 0x875db7
xchg dword [esp + 8], ecx
xchg byte [esp], cl
rdtsc
mov cl, ch
push dword [esp + 0xc]
pop cx
jmp 0x875dd0
push dword [esp + 8]
push dword [esp + 4]
pop word [esp + 0x13]
xchg dword [esp + 0x10], edi
pop dword [esp + 0xc]
xchg word [esp + 0xb], si
jmp 0x875e2c
neg cx
stc
bswap ebx
sub esp, 0x10
xchg word [esp + 0xd], dx
xchg byte [esp], dl
jmp 0x875e6a

Function at 0x875f3b
Capabilities:
Execute anti-debugging instructions

Disassembly:
and eax, ecx
lea ebx, [esi - 0xd]
xchg byte [esp + 8], al
mov byte [esp + 0xd], bh
jmp 0x875f13

Function at 0x87679b
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg bp
stc
mov ch, byte [esp + 1]
sub esp, 0x1e
rdtsc
push word [esp + 0xb]
jmp 0x876732
xchg bp, cx
xchg dword [esp + 8], edi
xchg word [esp + 3], bp
lea esp, [esp + 0xb]
mov bx, 0x90df
mov di, word [esp]
jmp 0x876662
bsf bp, si
mov edi, dword [esp + 4]
mov al, ah
xchg bh, cl
mov ecx, ebp
rdtsc
jmp 0x876685
xchg dword [esp + 2], ecx
xchg bh, cl
mov byte [esp + 0xb], bh
mov edi, ebp
lea ebx, [edx + ebp]
setge ch
jmp 0x87670e
pop dx
pop esi
ror ecx, 9
pop edi
mov dl, dh
xchg ah, bl
jmp 0x8766c0
mov word [esp + 8], di
cpuid
pop dword [esp + 4]
mov esi, 0xe0ae590a
lea esp, [esp + 1]
xchg byte [esp], al
jmp 0x8766da
mov ebx, dword [esp + 5]
pop dword [esp + 4]
mov cl, ch
mov dword [esp], ebp
pop word [esp + 5]
push word [esp + 2]
jmp 0x87674a
xchg cx, bp
rcr esi, 0x13
bswap ebp
mov byte [esp + 0x1f], ch
pop word [esp + 5]
pop word [esp + 7]
jmp 0x8766f5
pop word [esp + 4]
lea ebp, [ecx*4]
xchg word [esp + 4], dx
xchg cx, ax
jmp 0x87677e
popal
xchg byte [esp], cl
xchg di, ax
lea eax, [ecx + 0xbb]
lea eax, [ebp*4]
xchg ah, bl
jmp 0x8766ae
clc
xchg ebx, eax
btc ebp, ebx
xor edx, esi
bswap eax
pop si
jmp 0x8767e7
xchg esi, eax
jmp 0x876763
lea esp, [esp + 0xe]
xchg dword [esp + 2], esi
mov esi, 0x2fd0a756
not edi
jmp 0x876813
btr ebp, esp
pop bx
lea ecx, [ebx + ebp]
mov cx, di
pushal
mov dword [esp + 0x14], esi
jmp 0x87679e
bswap edx
cpuid
pop word [esp]
inc bx
mov ax, word [esp]
not bp
jmp 0x8767b5
lea edi, [esp + ecx]
xchg byte [esp], dl
add esp, 2
xchg dword [esp], ebx
and edi, ecx
shl ax, cl
jmp 0x8767cd
lea esi, [esp + edx]
Function at 0x876bb6
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dh
xchg ch, dl
mov ax, word [esp + 0xe]
add esp, 0x1b
cpuid
xchg ch, dl
jmp 0x876bfe
mov dword [esp + 0xf], eax
rol dx, cl
mov ax, word [esp + 0x16]
mov edi, ecx
rdtsc
jmp 0x876b9a
mov ah, byte [esp + 3]
not ah
add esp, 3
xchg si, bp
btr esi, esp
cpuid
jmp 0x876c36
sub edi, eax
xchg dx, bp
mov cl, 0xea
setne dh
mov bl, bh
mov eax, 0xcda814fc
jmp 0x876be3
mov edi, 0x14596d12
push word [esp + 1]
bsr cx, cx
jmp 0x876c57

Function at 0x87a34b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 4], dx
lea esp, [esp + 6]
call fcn.0087a2d2
lodsd eax, dword [esi]
sub eax, 0xe137c4bd
mov esp, 0x6c8b168f
and al, 1
mov ebp, dword [esp + 1]
mov ebp, ecx
lea edx, [eax*4]
clc
bswap ebp
rdtsc
jmp 0x87a210
cld
mov dx, word [esp + 1]
xchg byte [esp], al
bswap ebp
sub esp, 4
xchg word [esp + 3], bp
jmp 0x87a227
add esp, 3
btr ebp, edx
neg dh
lea ebp, [eax - 0x21]
rdtsc
xchg ebp, eax
jmp 0x87a249
pop dword [esp]
btr ebp, esp
jmp 0x87a263

Function at 0x87a42b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 2]
jmp 0x87a47c
lea esp, [esp]
bsr bp, bp
xchg word [esp], bp
xchg byte [esp + 2], dh
mov bp, word [esp]
jmp 0x87a4c8
mov edx, edi
push word [esp + 7]
bsf dx, ax
mov dh, byte [esp + 2]
mov dword [esp + 3], ebp
pop bp
jmp 0x87a5a2
mov bp, 0xf687
setae dh
mov dword [esp], ebp
push dword [esp + 4]
mov bp, di
mov ebp, dword [esp + 5]
jmp 0x87a4ad
xchg dh, dl
pop ebp
shr ebp, 0x1d
not ah
rcr ebp, 5
add esp, 0x10
jmp 0x87a507
lea eax, [esi + edi]
pushal
xchg byte [esp + 0x1c], dh
bswap ebp
mov byte [esp + 0x1b], ah
call fcn.0087a52e
xchg ebx, eax
or ah, byte [ebp + 0xf310fd4]
xor ecx, edi
rdtsc
rdtsc
stc
rdtsc
add esp, 4
mov ebp, dword [esp + 0xc]
jmp 0x87a4f3
pop word [esp + 1]
lea ebp, reloc.WINMM.dll_waveOutUnprepareHeader
mov bp, sp
mov al, ah
pop bp
sub esp, 4
jmp 0x87a51e
mov edx, ebp
sub esp, 0xe
pop dx
xchg byte [esp + 0xc], dh
push dword [esp + 9]
push edx
jmp 0x87a54c
Function at 0x87ad41
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 0x17]
pop ax
pop word [esp + 5]
call fcn.0087ad0a
jmp 0x87ad57
mov byte [esp + 3], bh
bswap ebp
neg bp
mov edx, 0x134a0914
jmp 0x87ad75
pop word [esp]
xchg word [esp], bp
mov ax, bp
push dword [esp + 4]
clc
btc ebp, edi
jmp 0x87ada7
bswap ebp
cld
xchg dword [esp + 2], ebp
sub esp, 2
push dword [esp + 7]
lea edx, [ebx + esi]
jmp 0x87b0d7
mov ebp, dword [esp + 0x15]
mov ebp, 0xc3e53b8a
mov ebp, esi
mov dx, word [esp]
xchg dword [esp + 0x1c], ebp
xchg word [esp + 8], dx
jmp 0x87ad31
mov bp, 0xc69d
ror ebp, 5
xchg dh, al
lea eax, [edx*4]
bswap ebp
jmp 0x87ae80
mov bp, di
pop dword [esp + 9]
sete ah
mov dx, 0x29b5
pop word [esp + 9]
jmp 0x87adf8
mov bp, sp
mov dl, 0x3c
bswap edx
mov ebp, 0xb71b251e
xchg bp, dx
inc ebp
jmp 0x87ae10
mov al, ah
not eax
mov edx, dword [esp + 3]
sub esp, 0xc
lea eax, [ebx + edi]
push dword [esp + 6]
jmp 0x87ae2d
mov al, 0x7e
mov dh, byte [esp + 1]
mov dh, byte [esp + 7]
rdtsc
lea esp, [esp + 5]
lea esp, [esp + 1]
jmp 0x87aec2
rdtsc
rcr ebp, 5
lea esp, [esp + 0xa]
lea esp, [esp]
push word [esp]
neg dh
jmp 0x87ae59
lea esp, [esp + 3]
rdtsc
stc
btr edx, esp
mov bp, word [esp + 9]
pop edx
jmp 0x87ae45
mov edx, dword [esp]
bt ebp, esp
call 0x87aeaa
push esi
fisttp qword [ebp + 0x14]
out 0xa, eax
mov al, byte [0x36dbbc2e]
fdivr dword [edi + 0x74ffca0f]
and al, 4
bswap edx
push dword [esp + 4]
mov ah, byte [esp + 9]
push dword [esp + 8]
xchg edx, ebp
mov bp, di
jmp 0x87ae98
xchg dh, al
pushal
push esp
add esp, 0x31
mov dh, byte [esp + 5]
neg bp
jmp 0x87aeda
mov bp, word [esp + 0xd]
mov word [esp + 6], sp
lea ebp, [ebx + edi]
xchg word [esp + 5], ax
lea ebp, [ebx + esi]
mov ebp, esi
jmp 0x87af36
setb dh
mov ebp, 0x329c7a58
push word [esp + 6]
mov eax, dword [esp + 3]
push word [esp + 0xb]
mov dh, byte [esp + 0x10]
jmp 0x87af54
pop dx
jmp 0x87addb
Function at 0x87b25e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esi*4]
sub esp, 0xa
bswap ebp
mov dl, 0xfc
bsf bp, ax
xchg byte [esp + 0x10], dh
jmp 0x87b278
pop bp
jmp 0x87b236
mov al, 0x76
neg ebp
pop eax
mov dh, bh
mov edx, 0xb8a05af4
mov ah, byte [esp + 0x25]
jmp 0x87b28a
pushal
not eax
neg edx
mov bp, word [esp + 3]
neg edx
push dword [esp + 0x32]
jmp 0x87b262
pushal
lea esp, [esp + 0x53]
dec ebp
mov eax, 0x595b7bcc
mov ax, 0x5cd1
sub esp, 0xa
jmp 0x87b8a8
mov eax, dword [esp + 0x52]
mov dh, byte [esp]
lea edx, [edx*4]
xchg dh, dl
sub esp, 0x10
push dword [esp + 0xa]
jmp 0x87b346
pop dword [esp + 0x10]
xchg byte [esp + 0x17], al
xchg byte [esp + 4], dl
push dword [esp]
push dword [esp + 0x1a]
add al, dh
jmp 0x87b2be
mov ebp, dword [esp]
mov ebp, dword [esp + 0xd]
mov edx, dword [esp]
lea eax, [esi - 0x15]
dec eax
pushal
jmp 0x87b2e1
bsr bp, bp
not dx
not ebp
bswap eax
mov al, byte [esp]
mov ax, 0x31e3
jmp 0x87b2fc
neg dx
inc ebp
bswap eax
dec edx
mov ebp, dword [esp]
btr ebp, edx
jmp 0x87b31c
lea edx, [ebp + 0xc7]
bt edx, ebx
mov dword [esp + 7], esi
pop edx
cld
jmp 0x87b38f
lea ebp, [esi + 0xad]
rdtsc
mov edx, 0xb263c508
bswap edx
mov dh, 0xca
bswap ebp
jmp 0x87b337
mov edx, 0x124fa816
push esp
xchg dh, dl
call fcn.0087b371
mov dword [esp + 0xe], ecx
pop word [esp]
lea esp, [esp + 1]
mov dword [esp + 0x14], eax
call fcn.0087b3c2
push ss
lea esp, [esp + 4]
pushal
pop word [esp + 0x13]
lea esp, [esp + 3]
jmp 0x87b39c
not ebp
rdtsc
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
sub bp, 0xdfb0
lea edx, [ecx*4]
cmc
jmp 0x87b35c
push word [esp + 1]
setae ah
pushal
lea esp, [esp + 0x44]
btr ebp, edx
lea ebp, [ecx + 0xbb]
jmp 0x87b3e4
xchg dword [esp + 6], ebp
mov byte [esp + 0xe], dh
mov dword [esp + 0xd], esi
not ah
mov dx, si
xchg dh, al
jmp 0x87b4af
mov edx, 0xdfdd0614
xchg byte [esp + 4], dh
pushal
btr eax, edx
pop eax
pop ebp
jmp 0x87b519

Function at 0x87b5a3
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x876060
call fcn.00876065
movzx ebx, word [eax + 0x3c]
jmp 0x87b65d
lea esp, [esp + 5]
lea esp, [esp + 3]
mov dword [esp], eax
mov dword [esp + 0x50], esi
jmp 0x87b5c8
pushal
pop dword [esp + 4]
lea esp, [esp + 9]
pop word [esp + 0xa]
pop word [esp + 2]
mov word [esp + 0xc], sp
jmp 0x87b675
cmp word [eax], 0x5a4d
jmp 0x87b699
add ebx, eax
cmp word [ebx], 0x4550
jmp 0x87b683
push word [esp + 7]
mov byte [esp + 0xb], ah
call fcn.0087b658
je 0x875fd4
jne 0x87b69f
adc esp, dword [ebx + reloc.WINMM.dll_waveOutUnprepareHeader]
imul esp, esp, 0x7a
sbb eax, 0x10910eec
je 0x87a0cc
sub eax, 0x10000
jmp 0x87b601

Function at 0x87b5f1
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 1], ebp
mov word [esp], sp
call fcn.0087b5a3
jmp 0x87b5bb
Function at 0xa5f370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xa5f38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xa88074
push ecx
mov edi, eax
call fcn.00a73198
mov esi, eax
add esp, 8
test esi, esi
jne 0xa5f3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00a7302e
push esi
call fcn.00a72fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xa62850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xa628ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xa8d720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xa628ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00a731e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xa628ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xa8d720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xa6292a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00a74082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xa62957
mov word [eax], si
add eax, 2
push eax
call fcn.00a74030
add esp, 4
jmp 0xa62959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xa628ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xa628b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xa62ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret