joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466204
Capabilities:
Check os version
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd38
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x46621e
xor eax, eax
jmp 0x46633d
mov dword [ebp - 0xa0], 0x9c
lea edx, [ebp - 0xa0]
push edx
call sub.KERNEL32.DLL_GetVersionExA
mov ecx, dword [ebp - 0x9c]
cmp ecx, 5
jne 0x46629a
mov eax, dword [ebp - 0x98]
test eax, eax
jne 0x46629a
push esi
call fcn.00459b60
pop ecx
cmp eax, 0xf
jb 0x46629a
push esi
lea edi, [ebp - 0x1a0]
mov esi, 0x46d988
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop esi
xor eax, eax
push esi
mov edi, esi
or ecx, 0xffffffff
lea esi, [ebp - 0x1a0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
lea esi, [ebp - 0x1a0]
mov byte [esi + 0xf], 0
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4662b1
xor eax, eax
jmp 0x46633d
push esi
lea edi, [ebp - 0x2c8]
mov esi, 0x46da88
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
pop esi
xor edi, edi
mov dword [ebp - 0x2c8], 0x128
lea eax, [ebp - 0x2c8]
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x466335
push esi
lea edx, [ebp - 0x2a4]
push edx
call fcn.00459d0c
add esp, 8
test eax, eax
jne 0x466324
mov ecx, dword [ebp + 0xc]
cmp ecx, 0xffffffff
je 0x46631c
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 0x2c0]
push edx
call sub.KERNEL32.DLL_ProcessIdToSessionId
test eax, eax
je 0x466324
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
cmp ecx, eax
jne 0x466324
mov edi, dword [ebp - 0x2c0]
jmp 0x466335
lea eax, [ebp - 0x2c8]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4662e2
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x466360
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, dword [ebp + 8]
test eax, eax
jne 0x466371
xor eax, eax
jmp 0x4663ac
push eax
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov esi, eax
test esi, esi
jne 0x466388
xor eax, eax
jmp 0x4663ac
lea edx, [ebp - 4]
push edx
push esi
call sub.KERNEL32.DLL_GetExitCodeProcess
mov bl, 1
mov eax, dword [ebp - 4]
push eax
push esi
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
jne 0x4663a4
xor ebx, ebx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4664d8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0
call fcn.004658ec
pop ecx
test al, al
jne 0x4664f5
xor eax, eax
jmp 0x4665cc
mov edx, dword [ebp + 0x10]
test edx, edx
jne 0x466503
xor eax, eax
jmp 0x4665cc
push ebx
call fcn.004663b4
pop ecx
mov edi, eax
test edi, edi
jne 0x466517
xor eax, eax
jmp 0x4665cc
push 0x5c
push ebx
call fcn.00459c59
add esp, 8
mov esi, eax
test esi, esi
jne 0x46652f
xor eax, eax
jmp 0x4665cc
mov eax, dword [ebp + 0x14]
inc esi
xor ebx, ebx
dec eax
sub eax, 2
jb 0x466544
je 0x46656d
sub eax, 4
je 0x466553
jmp 0x466572
mov edx, dword [ebp + 0x10]
push edx
call fcn.00459b60
pop ecx
mov ebx, eax
inc ebx
jmp 0x466576
mov eax, dword [ebp + 0x10]
add eax, ebx
mov dl, byte [eax]
test dl, dl
jne 0x466565
mov cl, byte [eax + 1]
test cl, cl
je 0x466569
inc ebx
inc eax
jmp 0x466558
inc ebx
inc ebx
jmp 0x466576
mov ebx, dword [ebp + 0x18]
jmp 0x466576
xor eax, eax
jmp 0x4665cc
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push esi
push edi
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
je 0x466598
xor eax, eax
jmp 0x4665cc
push ebx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
je 0x4665c1
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
jmp 0x4665cc
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4665d4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0
call fcn.004658ec
pop ecx
test al, al
jne 0x4665ed
xor eax, eax
jmp 0x466669
push ebx
call fcn.004663b4
pop ecx
mov esi, eax
test esi, esi
jne 0x4665fe
xor eax, eax
jmp 0x466669
push 0x5c
push ebx
call fcn.00459c59
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x466613
xor eax, eax
jmp 0x466669
lea edx, [ebp - 4]
push 0
push edx
push 0
push 0x20006
push 0
push 0
inc ebx
push 0
push ebx
push esi
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
je 0x466636
xor eax, eax
jmp 0x466669
push 4
lea edx, [ebp + 0x10]
push edx
push 4
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
je 0x46665e
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
jmp 0x466669
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
mov al, 1
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4669e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
lea eax, [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call fcn.0045b6d0
add esp, 0x10
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret
Function at 0x40f160
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f18d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f18d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0xa94e2c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], esp
call fcn.00a94df5
pushal
mov word [esp + 8], dx
push esp
mov byte [esp + 0x14], ah
mov word [esp + 0x18], sp
jmp 0xa94e52
mov dword [esp + 0x64], edi
lea esp, [esp + 0x64]
jmp 0xa94e9b
mov ebp, dword [esp + 0x2c]
shr dh, 7
ja 0xa94ec2
lea ecx, [esp + ebx]
rdtsc
btc edi, edi
jmp 0xa94fbb
pushfd
lea ebx, [ecx*4]
push edx
xchg dword [esp], edi
xchg si, di
jmp 0xa94e7c
rdtsc
btc edi, edi
jmp 0xa94fbb
lea ecx, [esp + ebx]
jmp 0xa94eac
dec dx
jl 0xa94f21
xchg dh, al
mov al, byte [esp]
not bh
jmp 0xa94f09
xchg edi, ecx
sub esp, 0xbc
mov edi, esp
jmp 0xa94ec7
lea ecx, [ebx*4]
jmp 0xa94d4c
not bh
mov eax, ebp
mov bx, word [esp]
mov dx, sp
mov bx, 0x7b79
jmp 0xa94eec
xchg dh, al
mov al, byte [esp]
jmp 0xa94f07
jmp 0xa94ee0
lea esi, [esp + 4]
mov cx, di
xchg di, bx
rcl ax, cl
je 0xa94f52
xchg edi, ecx
jmp 0xa94ee2

Function at 0xa9a1b8
Capabilities:
Encode data using xor

Disassembly:
call 0xa99320
jmp 0xa9a1c9
mov ecx, dword [esp + 0x48]
lea esp, [esp + 0x5c]
jmp 0xa9a152
cmp dword [esp + 4], 0
jmp 0xa9a220
call 0xa9a1b8
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
xor eax, 0x5334a625
scasb al, byte es:[edi]
outsb dx, byte [esi]
push ebp
fisttp dword [ebx + 0x2e]
fstp qword [edx]
mov esi, 0x2d582889
daa
sub dl, 0x32
pop eax
sub eax, 0x32ea8227
jmp 0xa9a1a6
jne 0xa99fbd
pushal
jmp 0xa9931b
Function at 0xac2a48
Capabilities:
Encrypt data using aes

Disassembly:
mov bl, byte [esp]
jmp 0xac299c
lea esp, [esp + 2]
mov ebx, dword [ebx*4 + 0xa91e54]
jmp 0xac29ab
movzx ebx, byte [esi + 0x11]
clc
sub esp, 0x12
clc
push dword [esp + 8]
jmp 0xac297e
lea esp, [esp + 0x14]
add esi, 0x10
bsr dx, bp
mov dh, 0xba
bts edx, ebx
jmp 0xac2a30
inc bl
lea esp, [esp + 4]
mov ecx, 0xff
jmp 0xac2440
sub esp, 0x12
push word [esp + 0x11]
push word [esp + 5]
call 0xac29e4
and eax, 0x224648d
jmp 0xac2a0b
mov edx, dword [esi]
neg di
mov edi, 0xc7e2eaf0
mov edi, edx
jmp 0xac29d1
shr edi, 0x18
mov edi, dword [edi*4 + 0xa91e54]
push esp
pop word [esp]
jmp 0xac2ab4
xchg dx, di
jmp 0xac29fd
mov dword [ebp - 4], ecx
jmp 0xac29c1
sub esp, 0x14
jmp 0xac2a9d
lea edx, [edx*4]
lea edx, [edx + 0xa92254]
mov edi, dword [edx]
pop edx
jmp 0xac2a50
lea esp, [esp + 2]
push edx
mov edx, edi
jmp 0xac2a66
lea esp, [esp + 0x34]
xor edi, dword [ebx*4 + 0xa92a54]
bsr bx, bp
jmp 0xac2ae8
and ebx, ecx
jmp 0xac2a86
push word [esp + 1]
and edi, ecx
sub esp, 6
mov byte [esp + 1], ah
mov dword [esp], esi
jmp 0xac2a7d
lea esp, [esp + 3]
jmp 0xac2b90
movzx ebx, byte [esi + 2]
call fcn.00ac2ac7
and ebx, ecx
sub esp, 0x1e
lea esp, [esp + 0xf]
mov byte [esp + 9], dh
pop dword [esp]
jmp 0xac2ad2
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + 0xa92654]
call 0xac2b5b
sub esp, 0x18
call 0xac2c02
mov eax, esi
mov dword [eax], edi
pop eax
bsr di, bp
ror di, cl
mov edi, dword [esp]
jmp 0xac2be6
pushal
mov ebx, 0x5db0ed06
call fcn.00ac2c0f
rcl byte [edx - 0x40], cl
cmpsd dword [esi], dword es:[edi]
push edx
xchg ebx, eax
push eax
xlatb
inc edi
and dl, cl
or ecx, edx
lea edi, [esp + ebp]
mov ebx, dword [ebx*4 + 0xa91e54]
bswap edi
mov edi, 0x55b16e
btr edi, esp
jmp 0xac2bce

Function at 0xac2ac7
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [ebx*4 + 0xa91e54]
cmc
cmc
jmp 0xac2af1
Function at 0xac2d1d
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + 0xa91e54]
push edx
sub esp, 0x16
lea esp, [esp + 2]
jmp 0xac2dc2
lea esp, [esp + 3]
jmp 0xac2cff
mov edi, 0xdb18a7ee
cmp edi, ecx
jmp 0xac2da7
btr edx, edx
mov edx, dword [esi + 8]
mov dword [esi + 4], edi
mov edi, dword [esp]
jmp 0xac2d7d
mov ebx, dword [ebx*4 + 0xa91e54]
clc
neg edi
neg di
lea edi, [esi*4]
jmp 0xac2dff
and edx, ecx
lea esp, [esp + 0x54]
xor edi, dword [edx*4 + 0xa92e54]
bts edx, edi
jmp 0xac2d99
shr edi, 0x18
call fcn.00ac2e0d
mov edi, dword [edi*4 + 0xa91e54]
stc
push edx
mov dword [esp], ebp
jmp 0xac3255
mov edi, edx
sub esp, 6
add esp, 3
lea esp, [esp + 3]
jmp 0xac2dd4
lea esp, [esp + 0x5c]
xor edi, dword [ebx*4 + 0xa92a54]
mov bl, bh
jmp 0xac3136
and ebx, ecx
sub esp, 0x1c
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0xac2e2d
mov edi, dword [edi*4 + 0xa92254]
pushal
mov dword [esp + 7], eax
add esp, 0x1f
lea esp, [esp + 1]
jmp 0xac2e46
movzx ebx, byte [esi + 0xd]
and edx, ecx
cmc
call fcn.00ac2eb4
mov di, 0x9d87
mov edi, dword [esp]
bts edi, ebx
mov edi, edx
pushal
jmp 0xac2f0d
push esp
pop dword [esp + 0xa]
lea esp, [esp + 0x1f]
lea esp, [esp + 1]
shr edi, 0x18
jmp 0xac2ff8
and ebx, ecx
sub esp, 0x1e
lea esp, [esp + 2]
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + 0xa92654]
jmp 0xac2ece
mov edi, dword [edi*4 + 0xa91e54]
and edi, ecx
sub esp, 0x18
mov dword [esp + 0x11], ecx
call fcn.00ac2f9b
lea esp, [esp + 1]
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + 0xa92a54]
movzx ebx, byte [esi + 0xe]
call fcn.00ac3007
sub dword [edi + 0x76a95a3f], ebp
inc ecx
rcl byte [esi + 0x31], 0xc0
adc al, 0xfd
int3
pushal
add esp, 0x11
pop dword [esp + 6]
cmc
lea esp, [esp + 3]
jmp 0xac2fb9
mov ebx, dword [ebx*4 + 0xa91e54]
push esp
mov dword [esp], ecx
stc
mov dword [esp], ebp
jmp 0xac2f69
movzx ebx, byte [esi + 0xa]
cmc
stc
cmc
jmp 0xac3033
and edi, ecx
cmc
clc
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0xac2e5e

Function at 0xac2e0d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 4
add esp, 3
lea esp, [esp + 1]
jmp 0xac2ddc

Function at 0xac2eb4
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + 0xa91e54]
stc
pushal
add esp, 1
lea esp, [esp + 3]
jmp 0xac2f4d
add esp, 1
lea esp, [esp + 2]
jmp 0xac2e73
lea esp, [esp + 1]
jmp 0xac2e9a
mov dword [esi + 8], edi
bsf di, ax
lea edi, [ecx - 0x2b]
mov ebx, dword [ebx*4 + 0xa91e54]
jmp 0xac2eda
mov edx, dword [esi + 0xc]
pushal
pop dword [esp + 2]
lea esp, [esp + 0x17]
lea esp, [esp + 1]
jmp 0xac2efa
and edx, ecx
lea esp, [esp + 0x1c]
xor edi, dword [edx*4 + 0xa92e54]
lea edx, [eax*4]
jmp 0xac2f33

Function at 0xac2f9b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + 0xa92254]
push esp
add esp, 1
sub esp, 0xe
lea esp, [esp + 1]
jmp 0xac2fa1
mov dword [esp + 7], esi
jmp 0xac2f82
and ebx, ecx
clc
pushal
pop word [esp + 0x15]
lea esp, [esp + 0x15]
jmp 0xac2fce
Function at 0xac3007
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0xac301d
push dword [esp]
jmp 0xac30cb
sub esp, 0x16
lea esp, [esp + 2]
jmp 0xac308f
and edx, ecx
cmc
pushal
mov edx, dword [edx*4 + 0xa91e54]
jmp 0xac3047
lea esp, [esp + 0x68]
xor edi, dword [ebx*4 + 0xa92654]
sub esp, 0x10
push dword [esp + 0xa]
jmp 0xac30fb
and ebx, ecx
pushal
push dword [esp + 0x1c]
push dword [esp + 4]
push dword [esp + 2]
jmp 0xac306f
lea ecx, [ecx + 0xa91e54]
mov ebx, dword [ecx]
pop ecx
jmp 0xac3062
push ecx
mov ecx, ebx
lea ecx, [ecx*4]
jmp 0xac30ae
pop word [esp + 0x11]
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
dec dword [ebp - 4]
push edx
jmp 0xac310b
and edx, ecx
lea esp, [esp + 0x14]
xor edi, dword [edx*4 + 0xa92e54]
pushal
jmp 0xac30d7
mov dword [esi + 0xc], edi
call 0xac3114
jl 0xac317b
mov dword [esp], esp
push dword [esp]
lea esp, [esp + 0xc]
jmp 0xac31a3
jne 0xac2440
je 0xac24cc

Function at 0xac3114
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0xac301d
push dword [esp]
jmp 0xac30cb
sub esp, 0x16
lea esp, [esp + 2]
jmp 0xac308f
and edx, ecx
cmc
pushal
mov edx, dword [edx*4 + 0xa91e54]
jmp 0xac3047
lea esp, [esp + 0x68]
xor edi, dword [ebx*4 + 0xa92654]
sub esp, 0x10
push dword [esp + 0xa]
jmp 0xac30fb
and ebx, ecx
pushal
push dword [esp + 0x1c]
push dword [esp + 4]
push dword [esp + 2]
jmp 0xac306f
lea ecx, [ecx + 0xa91e54]
mov ebx, dword [ecx]
pop ecx
jmp 0xac3062
push ecx
mov ecx, ebx
lea ecx, [ecx*4]
jmp 0xac30ae
pop word [esp + 0x11]
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
dec dword [ebp - 4]
push edx
jmp 0xac310b
and edx, ecx
lea esp, [esp + 0x14]
xor edi, dword [edx*4 + 0xa92e54]
pushal
jmp 0xac30d7
mov dword [esi + 0xc], edi
call 0xac3114
jl 0xac317b
mov dword [esp], esp
push dword [esp]
lea esp, [esp + 0xc]
jmp 0xac31a3
jne 0xac2440
je 0xac24cc
Function at 0xe3d5a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
bt edx, edi
push esp
xor bx, 0x9b50
push edx
not ebx
jmp 0xe3d3c7
bsr dx, cx
push dword [esp]
pushal
sub esp, 0xc
mov byte [esp + 0x32], dh
xchg byte [esp + 0x1b], bl
jmp 0xe3d3e2
inc dh
inc bl
not ebx
dec dx
add esp, 1
mov bx, 0x3247
jmp 0xe3d3fa
mov dl, 0x6c
xchg bh, dh
xchg dx, ax
jmp 0xe3d464

Function at 0xe3d715
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 6]
mov eax, 0x19710b34
xchg byte [esp + 0xc], al
mov byte [esp + 1], bh
add al, dh
pushal
jmp 0xe3d6b3
mov dh, ch
mov dh, byte [esp + 9]
mov ebx, edi
xchg byte [esp + 2], dl
sub esp, 8
mov bx, word [esp + 0xa]
jmp 0xe3d67c
bswap eax
rdtsc
mov dword [esp + 0x29], ecx
neg eax
pop dword [esp + 0x22]
lea edx, [esp + edx]
jmp 0xe3d6f0
pushal
xchg word [esp + 0x27], ax
xchg edx, eax
bswap ebx
lea esp, [esp + 0x13]
mov dx, sp
jmp 0xe3d760
mov bh, byte [esp + 7]
xchg byte [esp], bl
setnp ah
xchg dword [esp + 7], edx
cmc
rdtsc
jmp 0xe3d69d
mov bl, 0xe8
add esp, 0x1d
mov eax, dword [esp + 7]
xchg ebx, edx
lea eax, [esi*4]
mov bx, word [esp + 0xe]
jmp 0xe3d6c6
mov word [esp + 4], bx
clc
mov edx, 0xd6d9b212
mov ax, bx
pop bx
jmp 0xe3d6dd
bswap ebx
setae dh
and edx, eax
setne dh
mov bh, byte [esp + 0x23]
shl ebx, 0x17
jmp 0xe3d788
pop word [esp + 3]
xchg ebx, edx
sub esp, 0x16
pop bx
rdtsc
mov eax, dword [esp + 0x15]
jmp 0xe3d727
sub bl, ah
mov dx, ax
pop bx
mov bx, 0xf2c1
mov bl, bh
push esp
jmp 0xe3d741

Function at 0xe3dd5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 5]
jmp 0xe3dd65
mov bh, byte [esp + 7]
mov byte [esp + 3], ah
rdtsc
rdtsc
add esp, 5
mov dh, byte [esp + 1]
jmp 0xe3df17
pop word [esp]
call fcn.00e3ddc4
xchg dword [esp], ebx
mov byte [esp + 0x26], ah
bswap eax
mov dh, 0x8a
xchg dword [esp + 0xf], edx
call fcn.00e3de88
retf 0x9465
lea edx, [eax - 0x61df6d47]
bswap eax
xchg byte [esp + 1], dh
bt eax, ebx
lea ebx, [ebx + esi]
mov dh, 0xea
jmp 0xe3ddee

Function at 0xe3de88
Capabilities:
Execute anti-debugging instructions

Disassembly:
and eax, ecx
ror edx, 0x1d
xchg dh, al
pop word [esp + 0x1b]
pop word [esp + 0x23]
mov al, 0x36
jmp 0xe3de6f
mov dword [esp + 0x11], esi
clc
pop bx
shr edx, 0x19
xor dx, 0x34bc
rdtsc
jmp 0xe3de40
bts eax, edi
mov ax, 0xba7f
xchg dx, bx
mov eax, ebx
push word [esp + 3]
pop edx
jmp 0xe3deba
sete dh
jmp 0xe3de5c
xchg byte [esp + 6], dh
mov byte [esp + 5], bh
mov dword [esp + 3], eax
jmp 0xe3def7
dec edx
stc
xchg edx, ebx
push edx
bsf dx, si
add esp, 0x27
jmp 0xe3de8d
bt eax, ebx
not dx
rdtsc
xchg byte [esp + 0x18], al
mov byte [esp + 0xc], bh
bsr dx, bp
jmp 0xe3dea3
lea ebx, [ebx*4]
mov bx, 0x84ff
mov ax, 0x61d9
add esp, 9
cld
and dx, 0xdd7a
jmp 0xe3df6f
pop ax
bswap eax
call int.00e3df49
mov eax, dword [esp + 6]
push dword [esp + 3]
not bx
neg bx
mov byte [esp + 9], ch
call fcn.00e3dfdb
push esp
aam 0x4a
sub eax, 0x41c21ddc
sal dword [eax + 0x2849543], 1
nop
test dword [edx], 0x66fa43c9
not dx
jmp 0xe3df78
Function at 0xe3dfa8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xe3dfe0
pop ax
adc ax, 0x6742
add esp, 0x13
pop word [esp + 1]
mov word [esp + 0xa], dx
pop dx
jmp 0xe3edd6
lea esp, [esp + 0x43]
call 0xe3dffb
clc
neg eax
rdtsc
lea esp, [esp + 0xa]
lea eax, [ecx*4]
pushal
jmp 0xe3e011
sub esp, 0xa
mov word [esp + 0x21], dx
mov word [esp + 2], bx
push dword [esp + 5]
jmp 0xe3e028
mov ebx, dword [esp + 3]
sub esp, 0x12
shr eax, 3
bswap eax
rdtsc
neg ebx
jmp 0xe3e03f
mov ebx, 0xd3f5e872
mov ax, 0x9041
setno bh
pop edx
cld
lea eax, [edi*4]
jmp 0xe3e056
lea esp, [esp + 3]
mov dh, byte [esp + 3]
sub esp, 0x10
setg bh
xchg byte [esp + 0xe], dl
pop dword [esp + 7]
jmp 0xe3e149
mov dx, word [esp + 2]
mov bx, 0x6969
pop word [esp + 1]
neg edx
xchg bh, dh
xchg bx, ax
jmp 0xe3e450
mov ebx, 0xf9b98a1a
lea ebx, [edi*4]
lea ebx, [esi + 0x45]
mov al, ah
inc dh
bswap edx
jmp 0xe3e58a
xchg dh, al
pop word [esp + 1]
not ax
pop bx
shr dh, 5
push word [esp + 1]
jmp 0xe3ec42

Function at 0xe3f36e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, word [esp + 7]
xchg byte [esp + 6], dl
rcr esi, 0xb

Function at 0xe3f5f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 4]
mov dl, dh
inc bl
jmp 0xe3f654
mov si, 0xa835
xchg edx, ecx
mov dword [esp + 4], ecx
mov edx, dword [esp + 8]
rdtsc
mov byte [esp + 9], bh
jmp 0xe3f734
xchg dword [esp], eax
setle bh
xchg word [esp], bx
xchg si, ax
mov bp, word [esp + 0xa]
jmp 0xe3f620
ror dh, 7
bswap edx
bswap esi
bswap esi
lea ecx, [ebx + edi]
mov ebp, 0xd48c8d9e
jmp 0xe3f63b
setne ah
mov word [esp + 8], bx
pop ebx
pop word [esp + 3]
add esp, 0x27
bsf cx, si
jmp 0xe3f6b3
cpuid
push word [esp + 0x1d]
mov word [esp + 0x16], dx
cmc
push dword [esp + 0x18]
jmp 0xe3f667
mov al, ah
lea edi, [ecx*4]
mov bp, sp
mov dx, di
mov cx, 0xb437
lea esi, [ecx - 0x2b]
jmp 0xe3f684
sub edx, eax
pop si
xchg byte [esp], bl
cmc
setnp dh
mov si, 0x4c13
jmp 0xe3f70f
mov byte [esp + 2], ah
lea ecx, [ecx + 0x3b]
push word [esp + 3]
mov cl, ch
sub esp, 0x1e
pop word [esp + 0x15]
jmp 0xe3f69b
mov ebp, dword [esp]
bswap edx
mov eax, 0x943b8004
cld
mov edx, ecx
xchg ecx, esi
jmp 0xe3f6f9
mov word [esp], bx
rdtsc
pop si
mov ebp, dword [esp]
cld
neg si
jmp 0xe3f761
lea ebx, [esp + edi]
mov byte [esp + 1], dh
xchg byte [esp], dl
shr bh, 3
xchg cx, si
mov byte [esp + 1], ah
jmp 0xe3f6e4
lea esp, [esp + 2]
lea esp, [esp + 5]
xchg dh, al
bswap ebp
sub esp, 0xc
pop dword [esp + 2]
jmp 0xe3f6cc
pop dx
push dword [esp + 0xf]
pop edx
call fcn.00e3f794
pop eax
fisttp qword [ebp + 0x14]
out 0x62, eax
lodsb al, byte [esi]
mov edi, 0x33303186
push edx
sub esp, 0x10
pop word [esp]
cld
mov word [esp + 0xa], sp
rcl si, cl
jmp 0xe3f749

Function at 0xe3fc19
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, edi
pop word [esp + 7]
push word [esp + 6]
add esp, 0x12
jmp 0xe3fbfc
Function at 0xe40457
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 7]
jmp 0xe40461
lea esp, [esp + 2]
mov dword [esp + 0x94], esi
pushal
pushal
lea esp, [esp + 0x39]
push word [esp + 6]
jmp 0xe404ba
push dword [esp + 3]
pop dword [esp + 2]
pop word [esp + 1]
lea esp, [esp + 3]
jmp 0xe40499

Function at 0xe40544
Capabilities:
Parse pe header

Disassembly:
push eax
jmp fcn.00e3e01a
pop word [esp]
jmp 0xe4054e
lea esp, [esp + 1]
mov byte [esp], ah
lea esp, [esp + 1]
jmp 0xe4061c
cmp word [ebx], 0x4550
je 0xe3da4a
jne 0xe405e7
insb byte es:[edi], dx
call 0x70cc1fad
test dword [0xc60ffc95], eax
xor eax, 0xbe4324b6
jle 0xe40661
stosd dword es:[edi], eax
cmp ebx, dword [esi - 0x53]
push 0x4d
int3
jge 0xe40667
div dword [0xb6cfe7e]
push es
insb byte es:[edi], dx
or eax, dword [esi]
invalid
Function at 0x410990
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48055b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00474fa9
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x410a12
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00472ec0
mov eax, dword [eax]
push 0x684240
push eax
call fcn.00465794
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00475234
test bl, bl
je 0x410a12
push 0x684240
lea ecx, [esp + 0xc]
call fcn.004755c4
push 0x687dc4
lea ecx, [esp + 0xc]
call fcn.004755c4
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x410a4e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00475234
jmp 0x410b19
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x410ad2
lea edx, [esp + 0x7c]
push 0x687dc0
push edx
call fcn.00465794
add esp, 8
test eax, eax
je 0x410ad2
lea eax, [esp + 0x7c]
push 0x687dbc
push eax
call fcn.00465794
add esp, 8
test eax, eax
je 0x410ad2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410a62
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00475234
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x411310
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x411372
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc