joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008ea60
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100de486
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push esi
push edi
mov eax, dword [0x10107f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x1c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
xor edi, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 4], 1
cmp dword [ebp - 0x68], esi
jbe 0x1008eb46
nop dword [eax]
push 0x1c
lea eax, [ebp - 0x50]
mov dword [ebp - 0x38], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x50], xmm0
movq qword [ebp - 0x40], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1008eae9
add esi, dword [ebp - 0x70]
jmp 0x1008eb39
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x50]
lea eax, [ecx + edx]
cmp eax, dword [ebp + 0x18]
jb 0x1008eb37
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp + 0x14]
jb 0x1008eb37
test eax, 0x100
jne 0x1008eb37
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
cmp edi, dword [ebp - 0x10]
je 0x1008eb1e
mov dword [edi], edx
mov dword [edi + 4], ecx
add edi, 8
mov dword [ebp - 0x30], edi
jmp 0x1008eb34
lea eax, [ebp - 0x28]
push eax
push edi
lea ecx, [ebp - 0x34]
call fcn.10008430
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x44]
add esi, ecx
cmp esi, dword [ebp - 0x68]
jb 0x1008eac0
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x18], esi
jmp 0x1008eb48
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [ebp - 0x30]
mov edx, esi
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], edx
cmp edx, eax
je 0x1008ebe7
mov ecx, dword [edx]
mov esi, dword [ebp + 0x18]
cmp ecx, esi
mov edx, dword [edx + 4]
cmova esi, ecx
cmp esi, dword [ebp + 0x1c]
jae 0x1008ebd7
lea eax, [edx + ecx]
mov dword [ebp - 0x24], eax
nop word [eax + eax]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push eax
push 0
push esi
call fcn.1008e960
mov esi, eax
add esp, 0x18
test esi, esi
je 0x1008ebd4
mov eax, dword [edi + 4]
mov ecx, esi
inc esi
mov dword [ebp - 0x20], ecx
cmp eax, dword [edi + 8]
je 0x1008ebc0
mov dword [eax], ecx
add dword [edi + 4], 4
jmp 0x1008ebcc
lea ecx, [ebp - 0x20]
push ecx
push eax
mov ecx, edi
call fcn.10008350
mov eax, dword [ebp - 0x24]
cmp esi, dword [ebp + 0x1c]
jb 0x1008eb90
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x14]
add edx, 8
mov dword [ebp - 0x14], edx
cmp edx, eax
jne 0x1008eb72
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x1008ec17
mov ecx, dword [ebp - 0x10]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x1008ec0d
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008ec2a
push ecx
push esi
call fcn.100acd7c
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.100b8f1f
int3
Function at 0x1008ec30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, 0x5a4d
cmp cx, word [eax]
jne 0x1008ecb1
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x1008ecb1
mov ecx, dword [ecx + eax + 0x88]
test ecx, ecx
je 0x1008ecb1
add eax, ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
push ecx
push eax
call fcn.10092420
add esp, 0xc
test eax, eax
je 0x1008ecb1
mov edx, dword [ebp + 8]
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1008ec82
sub eax, esi
sar eax, 1
add eax, eax
push eax
mov eax, dword [ebp - 8]
push edx
add eax, 0xfffffffc
push eax
push dword [ebp - 4]
call fcn.10092470
add esp, 0x10
test eax, eax
setne al
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x1008ed60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10107f80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x5a4d
cmp ax, word [ebx]
jne 0x1008edae
mov ecx, dword [ebx + 0x3c]
cmp dword [ecx + ebx], 0x4550
jne 0x1008edae
mov eax, dword [ecx + ebx + 0xd8]
mov ecx, dword [ecx + ebx + 0xdc]
add eax, ebx
add ecx, eax
cmp eax, ecx
jae 0x1008edae
mov edx, dword [ebp + 8]
cmp dword [eax], edx
je 0x1008edbf
add eax, 4
cmp eax, ecx
jb 0x1008eda3
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ad0a4
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x1008edae
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0xa], eax
mov ax, word [ebp + 0x14]
mov word [ebp - 0xc], ax
je 0x1008ee35
push esi
push edi
mov edi, dword [ebp + 0x10]
add edi, 0xfffffffa
cmp edi, ebx
jb 0x1008ee20
mov esi, edi
lea eax, [ebp - 0xc]
sub esi, eax
xor eax, eax
nop dword [eax]
lea ecx, [ebp - 0xc]
add ecx, eax
mov dl, byte [ecx]
cmp dl, byte [esi + ecx]
je 0x1008ee01
cmp dl, 0x11
jne 0x1008ee1a
inc eax
cmp eax, 6
jl 0x1008edf0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ad0a4
mov esp, ebp
pop ebp
ret
dec edi
dec esi
cmp edi, ebx
jae 0x1008ede7
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ad0a4
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push ebx
push 6
push eax
call fcn.1008f660
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop ebx
call fcn.100ad0a4
mov esp, ebp
pop ebp
ret
Function at 0x1008eec0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10107f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x1008ef0d
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x1008ef0d
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x1008ef0d
mov edx, dword [ebp + 8]
cmp dword [eax], edx
je 0x1008ef1d
add eax, 4
cmp eax, ecx
jb 0x1008ef02
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ad0a4
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x1008ef0d
mov cl, byte [ebp + 0x1c]
test cl, cl
je 0x1008ef31
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], cl
jmp 0x1008ef37
mov word [ebp - 0xc], 0x15ff
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0xa], eax
je 0x1008efa5
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x14]
add edi, 0xfffffffa
cmp edi, ebx
jb 0x1008ef90
mov esi, edi
lea eax, [ebp - 0xc]
sub esi, eax
xor eax, eax
nop dword [eax]
lea ecx, [ebp - 0xc]
add ecx, eax
mov dl, byte [ecx]
cmp dl, byte [esi + ecx]
je 0x1008ef71
cmp dl, 0x11
jne 0x1008ef8a
inc eax
cmp eax, 6
jl 0x1008ef60
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ad0a4
mov esp, ebp
pop ebp
ret
dec edi
dec esi
cmp edi, ebx
jae 0x1008ef57
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ad0a4
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
push 6
push eax
call fcn.1008f660
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
call fcn.100ad0a4
mov esp, ebp
pop ebp
ret

Function at 0x1008efd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, 0x5a4d
sub esp, 0xc
cmp ax, word [edx]
jne 0x1008f013
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x1008f013
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x1008f013
mov edx, dword [ebp + 0xc]
cmp dword [eax], edx
je 0x1008f02e
add eax, 4
cmp eax, ecx
jb 0x1008f008
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x1008f013
mov cl, byte [ebp + 0x20]
test cl, cl
je 0x1008f042
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], cl
jmp 0x1008f048
mov word [ebp - 0xc], 0x15ff
push dword [ebp + 0x18]
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 6
push eax
push dword [ebp + 8]
call fcn.1008ea60
mov eax, dword [ebp + 8]
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x1008f740
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.1008f690
add esp, 0x18
test eax, eax
je 0x1008f769
inc eax
cmp byte [eax], 0xcc
je 0x1008f763
pop ebp
ret
Function at 0x1008f970
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.1008f8b0
add esp, 0x18
test eax, eax
je 0x1008f999
inc eax
cmp byte [eax], 0xcc
je 0x1008f993
pop ebp
ret

Function at 0x10092a60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10092c10
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10092b2d
mov edx, dword [ebp - 4]
cmp edx, dword [0x10107f18]
jb 0x10092aaa
mov eax, dword [ebp - 4]
cmp eax, dword [0x10107f1c]
ja 0x10092aaa
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10092a7a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100ae560
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10092ad0
jmp 0x10092b2d
cmp dword [ebp - 0x14], 0x10000
jne 0x10092b13
cmp dword [ebp - 0x18], 0x10000
jb 0x10092b13
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10092b06
mov eax, dword [ebp - 8]
jmp 0x10092b2f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10092b28
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10092c10
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10092a7a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10092b40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10092c40
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10092c05
mov edx, dword [ebp - 4]
cmp edx, dword [0x10107f18]
jb 0x10092b85
mov eax, dword [ebp - 4]
cmp eax, dword [0x10107f1c]
ja 0x10092b85
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10092b55
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100ae560
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10092bab
jmp 0x10092c05
cmp dword [ebp - 0x14], 0x10000
jne 0x10092bee
cmp dword [ebp - 0x18], 0x10000
jb 0x10092bee
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10092be1
mov eax, dword [ebp - 8]
jmp 0x10092c07
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10092c00
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10092c40
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10092b55
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1009a9cb
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x1009a9f2
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x1009a9f5
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1009a9a7
pop esi
leave
ret 8

Function at 0x1009fe60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x1009fe83
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x1009fe71
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x100acce1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.100c3c7a
mov eax, dword [eax + 0x14]
test eax, eax
je 0x100acd24
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 2
push ecx
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x100acd24
sub eax, 1
je 0x100acd1f
sub eax, 1
je 0x100acd1b
xor eax, eax
leave
ret
push 3
jmp 0x100acd26
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x100cbda5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100f34ec
push 0x100f34e4
push str.FlsAlloc
push 0x1e
call fcn.100cbbd2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100cbdd9
push dword [ebp + 8]
mov ecx, esi
call dword [0x100e2328]
call esi
jmp 0x100cbddf
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100cbe23
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100f34fc
push 0x100f34f4
push str.FlsGetValue
push 0x20
call fcn.100cbbd2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100cbe5a
push dword [ebp + 8]
mov ecx, esi
call dword [0x100e2328]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100cf28f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100cf32c
push ebx
push esi
call fcn.100cf258
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100cd9bf
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100cf2d9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100cf32b
push edi
push eax
call fcn.100ca580
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100cf2f9
call fcn.100ca546
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100cf32a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100cd9bf
add esp, 0x20
test eax, eax
jne 0x100cf318
push edi
call fcn.100ca546
jmp 0x100cf320
push ebx
call fcn.100ca546
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100cf32f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100cf340
pop esi
ret
push ebx
push edi
push esi
call fcn.100cf258
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100ca580
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100cf368
push ebx
push esi
push edi
call fcn.100ae880
add esp, 0xc
push 0
call fcn.100ca546
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100cf72c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100cf37d
Function at 0x100d74e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100d750d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100d750d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x760a93
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, 0xe9
call fcn.00760c15
add edx, 0xbfb9ef6f
jmp 0x760d75
add edx, 0xe577df21
jmp 0x761101
xor cx, bx
jmp 0x7618bc
mov cx, sp
lea ecx, [esi*4]
sub esp, 0xb
lea esp, [esp + 3]
jmp 0x761516
mov ecx, dword [esp]
lea ecx, [ebx + ebx]
mov cx, 0xccb7
push edx
ret
jg 0x760ed1
lea ecx, [eax*4]
jmp 0x760ed8
lea ecx, [eax*4]
mov esp, esi
mov cx, word [esp]
jmp 0x760dc6
mov ecx, 0x5c306f73
bsr ecx, ecx
jmp 0x760e13
jmp 0x760ab4
mov edx, dword [edx + reloc.MSVCRT.dll_strncpy]
clc
jle 0x7611ce
jg 0x760ab4
sub esp, 0xb
lea esp, [esp + 3]
jmp 0x761516
jle 0x760d7e
mov cx, sp
lea ecx, [esi*4]
jmp 0x76187f

Function at 0x766021
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf074ffc8
jmp 0x765f6f
push dword [esp + 1]
jmp 0x765eea
jg 0x765f00
lea esp, [esp + 2]
mov word [esp + 2], bp
jmp 0x765f4b
lea esp, [esp + 2]
mov word [esp + 2], bp
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x765f31
pushfd
jmp 0x764b36
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x765f31
lea edx, [edi*4]
setl bl
xchg edi, ebp
call fcn.00765f59
mov ebx, 0x2bd8b929
xchg edi, eax
enter 0x556b, 0xffffffffffffff88
push ebp
invalid
je 0x765fb0
add cl, byte [ecx - 0x7114dbfc]
mov bh, al
jmp 0x765fae
lea esi, [esp + 4]
and al, 4
sub esp, 1
jp 0x765fd1
jnp 0x765fda
mov edi, 0xcd204ded
lea esp, [esp + 1]
jmp 0x766060
mov cx, bp
jmp 0x765fb9
mov cx, bp
mov edi, 0xcd204ded
lea esp, [esp + 1]
jmp 0x766060
cpuid
mov ebx, ebp
not edx
call 0x766021
adc al, 0x8d
sbb eax, 0x9c229764
out dx, eax
mul cl
and byte [esi + 0xf], ah
mov esp, 0xfe47bdb
mov byte [0x8766e2eb], al
retf 0x67e8
bsf bx, bx
jnp 0x766001
cpuid
jmp 0x766003
sub esp, 0xbc
mov edi, esp
rdtsc
pushfd
jmp 0x766017

Function at 0x766a5c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp]
rdtsc
neg dx
xchg dword [esp], ecx
bt edx, esp
jmp 0x766a83
mov dx, 0xdd9d
rdtsc
add dl, 0xb9
dec dx
lea ecx, [ecx + 0x18]
bts eax, ebp
call fcn.00768536
cwde
Function at 0xf3ba23
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 1]
mov dword [esp], edx
pushfd
mov byte [esp + 1], dh
jmp 0xf3ba3f
push si
push cx
mov dword [esp + 4], ebx
pushfd
mov dword [esp], edx
pop word [esp]
jmp 0xf3ba74

Function at 0xf3ba39
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
push ebp
mov byte [esp], bl
lea esp, [esp + 2]
lea esp, [esp + 1]
mov dword [esp], ecx
push bp
jmp 0xf3ba68
lea esp, [esp + 1]
jmp 0xf3ba10
pop word [esp + 6]
lea esp, [esp + 2]
mov dword [esp + 0x18], ebp
push esp
jmp 0xf3bae5
lea esp, [esp + 1]
lea esp, [esp]
call fcn.00f3ba23
mov word [esp], bx
mov word [esp], bp
lea esp, [esp + 2]
mov dword [esp], esp
pushal
mov word [esp + 0x19], dx
jmp 0xf3ba51
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xf3baad
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
lea esp, [esp + 0x10]
jmp 0xf3bac3
Function at 0x41a320
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404c4c
push eax
mov eax, dword [ebp - 4]
call fcn.00404c4c
push eax
call sub.KERNEL32.DLL_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x41a358
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41a3c8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.004082f4
mov edx, dword [ebp - 0x108]
mov eax, dword [ebp - 4]
mov ecx, 0x41a3dc
call fcn.00404ab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a3cf
lea eax, [ebp - 0x108]
call fcn.004047ac
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x417a54
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4306a9
call fcn.00430290
sub esp, 0xc
push ebx
push esi
xor eax, eax
push edi
mov edi, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
push str.FILEPATH
mov byte [ebp - 4], 2
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0x6d
push dword [edi + 4]
call ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
call fcn.004069bd
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push str.FILEPATH
push 0x6e
push dword [edi + 4]
call ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040f1c4
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push str.FILEPATH
push 0x6f
push dword [edi + 4]
call ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040f1c4
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x14]
call fcn.0040ef32
lea ecx, [ebp - 0x18]
mov edx, eax
call fcn.0040ef32
mov ecx, eax
call fcn.004069cb
push str.FILEPATH
push 0x70
push dword [edi + 4]
call ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040f1c4
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x417b6e
xor ecx, ecx
cmp word [eax], cx
je 0x417b6e
lea ecx, [ebp - 0x10]
call fcn.0040ef32
mov ecx, eax
call fcn.00406a7a
push str.INFOEXE
push 0x7f
push dword [edi + 4]
call ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
test edi, edi
je 0x417ba1
mov ecx, dword [edi]
call fcn.00406aa2
lea ecx, [ebp - 0x10]
call fcn.0040eea9
lea ecx, [ebp - 0x14]
call fcn.0040eea9
lea ecx, [ebp - 0x18]
call fcn.0040eea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42c0b4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042bd74

Function at 0x450012
Capabilities:
Encode data using xor

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
xor ebx, ebx
push ebx
push ebx
push 0x80000000
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [0x44ff28]
sub edi, edi
sub ecx, ecx
mov cl, 0xe5
inc edi
loop 0x45003a
call 0x450042
pop esi
sub esi, 0xffffffc2
push esi
sub ebx, ebx
or ebx, 0x2394
mov al, byte [esi]
xor ax, di
xchg byte [esi], al
inc esi
sub ebx, 1
cmp ebx, 0
ja 0x450052
pop esi
mov esp, dword fs:[0]
pop dword fs:[0]
pop edi
pop ebp
jmp esi