joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d1610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x6d74cc]
cmp dword [eax + 0x28], 0
jne 0x6d1628
xor eax, eax
jmp 0x6d1757
mov ecx, dword [0x6d743c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x6d7430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x6d742c], eax
push 0
call dword [0x6d5138]
mov dword [ebp - 0x10], eax
push 1
call dword [0x6d5138]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x6d7430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x6d742c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x6d74b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x6d5680
push 0x6d56d0
push 0x88
call dword [0x6d5134]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x6d7428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x6d510c]
push eax
call fcn.006d1550
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [0x6d5148]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x6d512c]
push 0x6d15e0
mov edx, dword [0x6d74cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [0x6d513c]
mov dword [0x6d7434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [0x6d5130]
test eax, eax
je 0x6d1757
cmp dword [ebp - 0x38], 0x12
jne 0x6d174b
mov dword [0x6d7444], 0
call fcn.006d1760
xor eax, eax
jmp 0x6d1757
lea edx, [ebp - 0x3c]
push edx
call dword [0x6d5140]
jmp 0x6d171c
mov esp, ebp
pop ebp
ret 4

Function at 0x6d2b30
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [fcn.006d50dc]
call dword [fcn.006d5124]
call dword [fcn.006d5128]
call dword [fcn.006d5094]
call dword [fcn.006d50fc]
call dword [fcn.006d50f4]
call dword [fcn.006d5150]
call dword [fcn.006d500c]
call dword [fcn.006d5000]
call dword [fcn.006d5160]
call fcn.006d4674
mov eax, 1
pop ebp
ret 4
Function at 0x6d36cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x6d5168
sub eax, eax
test esi, esi
je 0x6d37a4
sub eax, 1
test ecx, ecx
je 0x6d37a2
test esi, 3
je 0x6d370a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x6d36ef
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x6d3789
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x6d3714
mov ecx, edx
test ecx, ecx
je 0x6d37a2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x6d378f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x6d37ac
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.006d382f
jae 0x6d37ba
xor ecx, ecx
call fcn.006d382f
jae 0x6d37e9
xor eax, eax
call fcn.006d382f
jae 0x6d37f9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.006d382f
adc al, al
jae 0x6d37db
jne 0x6d3825
stosb byte es:[edi], al
jmp 0x6d37bd
call fcn.006d383b
sub ecx, ebx
jne 0x6d3802
call fcn.006d3839
jmp 0x6d3821
lodsb al, byte [esi]
shr eax, 1
je 0x6d384b
adc ecx, ecx
jmp 0x6d381e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.006d3839
cmp eax, 0x7d00
jae 0x6d381e
cmp ah, 5
jae 0x6d381f
cmp eax, 0x7f
ja 0x6d3820
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6d37bd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x6d417c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d7000]
jne 0x6d4186
repz ret
jmp fcn.006d442d
Function at 0xa41f2e
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp fcn.00a69064
jmp 0xa41e72

Function at 0xa52ff9
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xa5308c
mov ah, al
add esp, 0
jnp 0xa52fe0
jp 0xa5308c
xchg bl, dh
lea edx, [ecx + ebx]
stc
jle 0xa53026
rdtsc
jmp 0xa5302e
mov edx, dword [esp]
mov dh, 0xd0
mov dword [ebx + esi], eax
jmp 0xa53006
rdtsc
jmp 0xa5302e
add ebp, 4
mov bh, ah
mov ax, word [esp]
mov dx, word [esp]
jmp 0xa5173d
jmp 0xa5301c
mov edx, ebp
mov eax, dword [edx]
xor edx, 0xc75ac429
jg 0xa53046
mov edx, dword [esp]
mov dh, 0xd0
jmp 0xa53021

Function at 0xa5424c
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x2057378e
jmp 0xa54955
add edx, 0xaed9dc6a
jmp 0xa54980
cmp ebp, ecx
jmp 0xa549cd
jmp 0xa54a06
bsf ecx, edi
js 0xa5496f
lea ecx, [esi + esi]
mov ch, byte [esp]
jmp 0xa54959
mov ecx, eax
jmp 0xa54938
mov edx, dword [edx - 0x1fb1fa7f]
mov ecx, esi
mov cl, 0xa1
mov ch, 0xe6
sub esp, 0x1e
jmp 0xa549bb
lea ecx, [esi + esi]
mov ch, byte [esp]
jmp 0xa54959
lea esp, [esp + 2]
jmp 0xa51544
bswap ecx
lea ecx, [edx + esi]
jmp 0xa549a5
ror ecx, 2
push edx
ret
aad 0xbc
dec edi
cld
je 0xa54a07
jmp 0xa514c0
mov esp, esi
lea ecx, [edi*4]
xor ch, 0xfd
jmp 0xa549c6
jbe 0xa54977
lea esp, [esp + 2]
jmp 0xa51544
jg 0xa54987
ror ecx, 2
jmp 0xa5498a
ja fcn.00a54295
bswap edx
lea edx, [eax + ecx]
stc
je 0xa54253
jne 0xa54253
pop ebx
mov dl, 0xad
mov esp, 0x245c898f
add ebp, ebx
xor al, 0x89
je 0xa54a17
mov dword [esp + 0x14], esi
call 0xa54a49
push ds
adc al, 0xe8
push eax
add byte [eax], al
add byte [esi], bl
xchg esp, eax
or ch, byte [ebp - 0x64]
sbb eax, dword [ecx + 0x3f09101]
mov cl, 0x40
pushal
mov ch, 0x76
bsf ebp, ecx
jge 0xa549f0
mov dword [esp + 0x14], esi
jmp 0xa54a59
jb 0xa5499a
mov edx, 0x9eb70495
jmp 0x3c9a6ad
push ecx
push ebp
lea esp, [esp + 8]
jmp 0xa54a81
popal
jmp 0xa54b4b
jmp 0xa54afa
lea ecx, [eax + ebp]
mov cx, word [esp]
mov cx, 0x3e20
mov ch, bh
lea ecx, [ebp - 0x80]
jmp 0xa54ade
and cl, 0xfc
push cx
call fcn.00a54ac8
das
mov bl, 0x23
inc esi
mov ch, 3
aaa
mov ah, 0x2a
dec ebp
mov esp, 0xa360210d
fidiv dword [0xfe98a24]
leave
mov ch, cl
bswap ecx
sub eax, edx
jmp 0xa54a89
lea ecx, [edi*4]
lea eax, [esi + 0x40]
and ch, ah
jno 0xa54a87
mov ch, cl
bswap ecx
jmp 0xa54afe

Function at 0xa67e5d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 4]
jmp fcn.00a41f2e

Function at 0xa91419
Capabilities:
Encrypt data using aes

Disassembly:
mov di, 0x64f8
jmp 0xa9143c
mov bp, sp
dec bl
jmp 0xa91403
Function at 0xa9180f
Capabilities:
Encrypt data using aes

Disassembly:
clc
mov edx, dword [esp]
jmp 0xa9179d
bswap ecx
jmp 0xa917c0
mov eax, edi
btc edi, ecx
shr dx, cl
mov edx, dword [eax + 0xc]
jmp 0xa91787
shr ecx, 8
jmp 0xa917e6
shl dword [eax - 0x30], cl
push ebx
retf 0x9465
mov ecx, edx
mov edi, ebx
jmp 0xa917aa
mov ebx, 0xa5047c
lea esp, [esp + 0x34]
jmp 0xa3ffe4
mov edi, edx
cmc
and ecx, esi
jmp 0xa9182d
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0xa4ec78]
call 0xa91817
das
mov bl, 0x23
inc esi
mov ch, 3
aaa
mov ah, 0x2a
dec ebp
mov esp, 0xa360210d
fidiv dword [0x89e8d366]
shr ax, cl
mov dword [ecx + 0x1c], edx
jmp 0xa917d8
jmp 0xa918dd
cmpsb byte es:[esi], byte es:[edi]
shr ax, cl
mov dword [ecx + 0x1c], edx
jmp 0xa917d8
xor al, 0x53
scasb al, byte es:[edi]
push ds
push esp
fisttp dword [ebx + 0x2e]
frstor dword [ebp - 0x42]
mov dword [eax], ebp
dec ebx
loop 0xa917b9
mov ecx, dword [ecx*4 + 0xa4ec78]
push dx
or al, 0x8d
js 0xa9181e
movsb byte es:[edi], byte [esi]
add byte [esi + 0x52], ah
lea esp, [esp + 2]
jmp 0xa917ed

Function at 0xa91817
Capabilities:
Encrypt data using aes

Disassembly:
clc
mov edx, dword [esp]
jmp 0xa9179d
bswap ecx
jmp 0xa917c0
mov eax, edi
btc edi, ecx
shr dx, cl
mov edx, dword [eax + 0xc]
jmp 0xa91787
shr ecx, 8
jmp 0xa917e6
shl dword [eax - 0x30], cl
push ebx
retf 0x9465
mov ecx, edx
mov edi, ebx
jmp 0xa917aa
mov ebx, 0xa5047c
lea esp, [esp + 0x34]
jmp 0xa3ffe4
mov edi, edx
cmc
and ecx, esi
jmp 0xa9182d
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0xa4ec78]
call 0xa91817
das
mov bl, 0x23
inc esi
mov ch, 3
aaa
mov ah, 0x2a
dec ebp
mov esp, 0xa360210d
fidiv dword [0x89e8d366]
shr ax, cl
mov dword [ecx + 0x1c], edx
jmp 0xa917d8
jmp 0xa918dd
cmpsb byte es:[esi], byte es:[edi]
shr ax, cl
mov dword [ecx + 0x1c], edx
jmp 0xa917d8
xor al, 0x53
scasb al, byte es:[edi]
push ds
push esp
fisttp dword [ebx + 0x2e]
frstor dword [ebp - 0x42]
mov dword [eax], ebp
dec ebx
loop 0xa917b9
mov ecx, dword [ecx*4 + 0xa4ec78]
push dx
or al, 0x8d
js 0xa9181e
movsb byte es:[edi], byte [esi]
add byte [esi + 0x52], ah
lea esp, [esp + 2]
jmp 0xa917ed

Function at 0xa919ec
Capabilities:
Encrypt data using aes

Disassembly:
lea eax, [0xa6b39fe1]
mov edi, 0xf408ac
jmp 0xa919f8
lea esp, [esp + 4]
jne 0xa3ffe4
je 0xa919d6
push 0xa
mov eax, dword [esp]
mov bl, byte [esp]
not esi
jmp 0xa91a34
mov bh, 0x5b
pushal
jmp 0xa91a62
xchg bh, bl
lea esp, [esp + 4]
and al, 4
pop edi
mov ebx, eax
lea ebx, [ebx + 0x5cb65e13]
jmp 0xa91a1e
sets bl
mov ebp, dword [esp]
call fcn.00a91a73
bnd jbe 0xa91a37
cmp dword [esi - 0x31], 0xffffffe0
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
fmul dword [esi]
cdq
clc
invalid
lea esp, [esp + 0x20]
pop esi
mov ebp, ebx
xchg ebp, ebx
lea ebx, [edx + 0xf1]
jmp 0xa91a45
Function at 0xaac952
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00aac9a7
mov ebx, 0x19d4f9c4
mov dx, ax
rdtsc
mov ax, 0xb626
lea esi, [esi + 0x45]
xchg edx, ebx
call fcn.00aac991
jle 0xaac965
push 0xd
cld
jnp 0xaac9d7
mov al, byte [0x64751ae3]
lea eax, [edi*4]
mov dl, byte [esp]
jmp fcn.00a60290
lea esi, [edi + 0x28]
out dx, eax
jb 0xaaca0f
adc ch, byte [esi - 0x2f9118ec]
xor al, 7
test eax, 0x56f8d8f4
or edx, dword [eax]
xor byte [ebx - 0x1221931a], 0x89
jecxz 0xaaca36
clc
mov eax, 0x4707bf24
cmp dword [edi], eax
lodsb al, byte [esi]
out 0xbf, al
imul esp, dword [edx + 0x265b463], 0x2d
pop esi
lcall 0xe6af, 0x2c10d2fd
cmp ecx, eax
jne 0xaac9da
out 0x39, al
sal dword [esi], 0x75
lds esi, [ecx]
pushal
sbb al, 0x44
xor dword [eax + 0x1c], esp
inc esp
into
lahf
jecxz 0xaaca43
lodsb al, byte ds:[esi]
out 0xb7, al
pop ebp
lcall 0x74e0, 0x76dc9b9a
and ecx, dword [ecx - 0x50c8d5e1]
out 7, al
test dword [edx], esi
mov ah, byte [esi + 0x75]
in al, dx
xor byte [edx + ecx*4 + 0x367dcf13], ah
scasb al, byte es:[edi]
out 0x64, al
out 0x2a, al
mov ch, 1
cmpsd dword [esi], dword es:[edi]
shl byte [ebp + 0x5a2f5908], 1
push ebx
lahf
lodsb al, byte [esi]
out 0x2a, al
ljmp 0x28f9

Function at 0xaac9a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
mov dl, byte [esp + 2]
mov byte [esp], ah
lea esp, [esp + 3]
xchg dword [esp], esi
jmp 0xaac957

Function at 0xad72d2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp + 0xc], eax
clc
je 0xad72f6
jne 0xad72f6
lodsb al, byte [esi]
sub al, 0xa2
lds esi, [esp + eax*4]
mov edx, 0x3bc8a939
xchg dword [eax + 0x245488fb], ebx
mov byte [esp + 2], dl
mov byte [esp + 2], cl
invalid
jge 0xad72e9
mov byte [esp + 2], dl
mov byte [esp + 2], cl
cmp dword [ebp + 0xc], 1
jmp 0xad72bc
add ebx, ebp
fmul qword [ebx - 0x29d4143b]
push eax
invalid
mov eax, ebp
jmp fcn.00ad730f
loope 0xad7333
int 0x5d
and al, 0xd7
fsubr qword gs:[edi]
and dword ss:[eax - 0x5d], esp
push eax
jmp 0xad72e0
dec ebp
cmp ch, byte [ebp + 0x46]
int1
Function at 0xb97384
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ecx + edx]
mov eax, edx
lea eax, [eax + esi]
mov edx, dword [esp + 0xf]
neg ah
jmp 0xb973ce
xchg ah, dh
cmc
mov dx, bp
push bp
pushal
mov byte [esp + 0x16], al
jmp 0xb97649
not dh
mov ax, sp
cld
xchg dword [esp + 0xc], eax
xchg ah, dh
not dh
jmp 0xb973b8
mov dx, si
xchg byte [esp + 0x16], dl
xchg al, dh
push dword [esp + 0x27]
mov dl, 0xca
jmp 0xb9742e
lea eax, [edx*4]
lea eax, [ecx + edi]
bswap eax
dec dx
bt eax, edx
pop dx
jmp 0xb97402
xchg dword [esp + 1], edx
mov dx, cx
mov eax, 0x375b9c6
mov byte [esp + 0xc], dl
mov byte [esp + 0x21], al
mov al, 0x13
jmp 0xb974a3
bt edx, eax
btr dx, di
mov al, bl
mov ax, word [esp + 0x2e]
xchg word [esp + 0x24], dx
mov word [esp + 0x27], sp
jmp 0xb97419
add esp, 0x16
lea esp, [esp + 0xf]
mov ax, cx
xchg word [esp + 5], ax
jmp 0xb9748c
neg ah
mov edx, ebp
rdtsc
cld
mov eax, ecx
pop ax
jmp 0xb97469
xchg ah, dl
sub esp, 0x1a
pop ax
mov eax, 0xc1891340
jmp 0xb974cf
cld
mov ax, bp
xor ax, 0x8fbd
mov dl, 0xee
mov word [esp + 0x15], bx
mov dx, word [esp + 5]
jmp 0xb9747f
mov dl, al
mov edx, dword [esp + 0x24]
not eax
rdtsc
xchg byte [esp + 0x1f], al
neg eax
call fcn.00b974e5
dec ebp
lea edx, [eax*4]
stc
inc dx
btc ax, di
mov edx, eax
mov dx, 0xcf4c
jmp 0xb974b9
push eax
setl al
neg dx
push dword [esp + 0x18]
shl eax, 0x15
setl ah
jmp 0xb9744f
xchg word [esp + 0x21], ax
mov al, 0xe3
sub esp, 1
xchg dl, al
mov ah, byte [esp + 0x20]
mov dl, byte [esp + 5]
jmp 0xb97511

Function at 0xb974e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xb974fb
add esp, 0x20
pop dword [esp + 9]
xchg word [esp + 0xa], dx
xchg byte [esp + 0xa], al
jmp 0xb9755a
not eax
call fcn.00b975ec
push edi
fisttp dword [ebx + 0x2e]
invalid
pop word [esp + 9]
lea esp, [esp + 7]
pop word [esp + 1]
mov edx, eax
rdtsc
not eax
jmp 0xb97527
mov word [esp + 5], bp
xchg byte [esp + 6], ah
bsr edx, edi
sub esp, 8
rdtsc
mov dword [esp + 0x11], edi
jmp 0xb9753d
Function at 0xbfa84a
Capabilities:
Execute anti-debugging instructions

Disassembly:
setne dl
not ax
mov dx, word [esp]
xchg dx, ax
sub dx, sp
cld
jmp 0xbfa810
pop word [esp]
pop dword [esp + 4]
rol ax, cl
bswap edx
not dh
mov dl, byte [esp + 6]
jmp 0xbfa7cf
pop dx
add esp, 0x11
mov al, bh
lea eax, [edi*4]
jmp 0xbfa822
neg eax
mov ax, 0xb8e3
inc ah
lea esp, [esp + 4]
cmc
bt edx, ebx
jmp 0xbfa7fa
mov dl, 0x4f
lea edx, [eax + ebp]
sub esp, 0x15
pop ax
mov dl, 0x10
mov eax, dword [esp + 0xf]
jmp 0xbfa870
xchg edx, eax
add esp, 2
btc eax, eax
push dword [esp + 0x11]
neg dx
jmp 0xbfa858
lea edx, [ecx + ecx]
push word [esp + 1]
not dl
pop dx
jmp 0xbfa7e5
mov dword [esp + 7], ecx
mov ax, word [esp + 0x15]
mov byte [esp + 8], bl
rdtsc
std
jmp 0xbfa886
neg ax
mov edx, dword [esp + 5]
mov ax, di
inc edx
mov word [esp + 0xc], sp
mov eax, dword [esp + 0xd]
jmp 0xbfa834
bt dx, ax
add esp, 6
mov edx, 0xfaa43e2e
mov byte [esp + 8], dh
bt edx, edi
jmp 0xbfa8ca
mov eax, dword [esp + 0x25]
inc dl
xchg byte [esp + 0x1f], al
jmp 0xbfa8dd
mov dx, sp
neg eax
mov edx, dword [esp + 0xf]
inc eax
mov ax, 0x1b7f
sub esp, 0x17
jmp 0xbfa8b4
lea eax, [edx*4]
seto dh
lea edx, [eax + ebx]
clc
jmp 0xbfaa37
pop dx
mov eax, dword [esp + 0xd]
sub esp, 0xc
bsf dx, cx
dec dx
pop dword [esp + 0x18]
jmp 0xbfa96a
xchg word [esp + 1], ax
mov byte [esp], ch
mov ax, word [esp + 6]
pop word [esp + 0x16]
btr dx, cx
lea edx, [ebp + 0x6060]
jmp 0xbfa90c
ror dx, 6
xchg dword [esp + 5], edx
push word [esp + 0x21]
jmp 0xbfa9ee
rdtsc
rdtsc
inc ah
mov dword [esp + 0xf], esi
mov dx, 0x7e31
sub esp, 8
jmp 0xbfa954
std
xchg word [esp + 0xb], ax
mov dx, sp
not dx
shr eax, 0xc
mov dword [esp + 0xe], esi
jmp 0xbfa936
mov dl, 0xca
mov word [esp + 2], ax
pop dword [esp + 0x1c]
xchg dx, ax
jmp 0xbfa9d1
std
bswap edx
lea edx, [ecx*4]
add esp, 1
push dword [esp + 5]
mov edx, ebp
jmp 0xbfa9a6
mov dh, 0xfe
mov ah, byte [esp + 7]
not eax
stc
mov ax, 0x50b3
mov word [esp + 0x1d], cx
jmp 0xbfaa1b
pop word [esp + 4]
mov dx, di
pop word [esp + 0x11]
xchg dx, ax
mov byte [esp + 0xd], bh
mov ah, cl
jmp 0xbfa9bc
neg ah
sub esp, 0xd
call fcn.00bfaa6c
add eax, dword [edi + 0x3f817217]
mov edx, 0x9eb70495
jmp 0xc972b985
btr ax, cx
mov eax, ecx
std
mov byte [esp + 2], al
mov byte [esp + 0x1c], cl
xchg edx, eax
jmp 0xbfaa05
bts ax, cx
lea eax, [edi*4]
pop edx
pop word [esp + 4]
pop dword [esp + 0xa]
inc eax
jmp 0xbfa991

Function at 0xbfd069
Capabilities:
Parse pe header

Disassembly:
call fcn.00b971bc
push eax
jmp 0xb971b7
movzx ebx, word [eax + 0x3c]
jmp 0xbfd053
add ebx, eax
jmp 0xbfd08e
lea esp, [esp + 0xc]
cmp word [eax], 0x5a4d
je 0xbfc09a
sub eax, 0x10000
jmp 0xbfd06d
cmp word [ebx], 0x4550
jmp 0xbfd0cb
or al, 0x8b
cmp byte [ecx + 0x36b34021], dh
xor byte [edx + 0x2b24720], dh
xor ebp, dword [edx]
inc ebp
je 0xb97242
jne 0xbfd078
cmc
jbe 0xbfd0ba
cmp dword [esi - 0x31], 0xffffffe5
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
fisttp dword [0x9465028c]
sub bl, byte [ebp + 0x1be88919]
test al, 0xfd
jp 0xbfd0d6
invalid
Function at 0x2f49af88
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ecx + 0x218]
call fcn.2f4ad759
test eax, eax
jne 0x2f49afa1
leave
ret
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x2f49b028
cmp dword [ebp - 8], 5
jl 0x2f49b028
push ebx
mov ebx, dword [eax + 0x10]
push esi
push edi
push dword [eax + 8]
mov edi, dword [eax + 0xc]
push dword [eax + 4]
call dword [sym.imp.MSO.dll_Ordinal_8700]
mov esi, dword [sym.imp.MSO.dll_Ordinal_639]
push 1
push 0x2f492b28
push edi
call esi
test eax, eax
je 0x2f49b007
call dword [sym.imp.MSO.dll_Ordinal_5365]
cmp eax, 2
je 0x2f49affe
push 3
mov ecx, 0x2f4b5df0
call fcn.2f49a86b
jmp 0x2f49b025
push ebx
call dword [sym.imp.MSO.dll_Ordinal_902]
jmp 0x2f49b01c
push 1
push 0x2f492c70
push edi
call esi
test eax, eax
je 0x2f49b025
push ebx
call dword [sym.imp.MSO.dll_Ordinal_9196]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c0], eax
pop edi
pop esi
pop ebx
xor eax, eax
inc eax
leave
ret

Function at 0x2f49d03c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
mov ebx, ecx
jne 0x2f49d055
push 0x80004005
call fcn.2f4984ca
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x2f49d057
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x2f49d5e4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x2f495dc8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], esi
call fcn.2f49cfaf
mov edi, eax
cmp edi, esi
je 0x2f49d644
lea ecx, [ebp - 0x208]
call fcn.2f49cf4a
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.2f4af470
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x2f49d662
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x208]
call fcn.2f49d5e4
cmp eax, esi
jne 0x2f49d6aa
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call edi
test eax, eax
je 0x2f49d64c
lea ecx, [ebp - 0x208]
call fcn.2f49cf4a
push dword [ebp - 0x210]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.2f49cf4a
mov eax, esi
jmp 0x2f49d633
Function at 0x2f49e611
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x2f4b0e13
call fcn.2f4aff90
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
call dword [0x2f4b6d00]
xor esi, esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x428], ebx
jne 0x2f49e680
call fcn.2f49ce63
mov esi, eax
jmp 0x2f49e782
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x2f49e6a3
call fcn.2f49ce63
jmp 0x2f49e774
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
mov dword [ebp - 0x420], eax
je 0x2f49e699
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
mov dword [ebp - 0x41c], edi
jae 0x2f49e6ff
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2f49e6e5
lea ecx, [ebp - 0x418]
call fcn.2f49d592
mov esi, 0x8007000e
lea ecx, [ebp - 0x424]
call fcn.2f49d4c2
mov eax, esi
call fcn.2f4affe9
ret 0x10
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2f49da36
mov dword [ebp - 4], 1
jmp 0x2f49e726
mov ebx, dword [ebp - 0x418]
cmp ebx, esi
jne 0x2f49e737
mov esi, 0x8007000e
jmp 0x2f49e776
call dword [0x2f4b6d00]
push edi
push ebx
push edi
push dword [ebp - 0x420]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x2f49e699
mov ecx, dword [ebp - 0x418]
push dword [ebp + 0x14]
mov word [ecx + eax*2], si
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.2f49e4d4
mov esi, eax
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2f49e6ea
lea ecx, [ebp - 0x418]
call fcn.2f49d592
jmp 0x2f49e6ea

Function at 0x2f49f62c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push 1
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.MSO.dll_Ordinal_403]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x2f49f660
mov edi, 0x80004005
jmp 0x2f49f68e
push esi
mov esi, dword [ebp + 0x10]
push ebx
lea ecx, [ebp - 4]
push ecx
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x2f49f67f
xor edi, edi
cmp esi, dword [ebp - 4]
je 0x2f49f684
mov edi, 0x80004005
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
cmp edi, ebx
pop edi
setge al
pop ebx
leave
ret 0xc