joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403166
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406160
push 0x403960
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x468
push ebx
push esi
push edi
push str.RegCloseKey
mov ebx, str.ADVAPI32.dll
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [ebp - 0x340], eax
push str.OpenSCManagerA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x364], eax
push str.OpenServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x234], eax
push str.CloseServiceHandle
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x34c], eax
push str.GetModuleFileNameA
push 0x407144
call esi
push eax
call edi
mov dword [ebp - 0x370], eax
push str.GetWindowsDirectoryA
push 0x407144
call esi
push eax
call edi
mov dword [ebp - 0x35c], eax
push str.CopyFileA
push 0x407144
call esi
push eax
call edi
mov dword [ebp - 0x228], eax
push str.RegSetValueExA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x354], eax
push str.StartServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x230], eax
jmp loc.004129cc

Function at 0x403930
Capabilities:
Packed with generic packer

Disassembly:
cmp cl, 0x40
jae 0x40394a
cmp cl, 0x20
jae 0x403940
jmp loc.0041393f
mov eax, edx
xor edx, edx
and cl, 0x1f
shr eax, cl
ret
xor eax, eax
xor edx, edx
ret

Function at 0x403ad0
Capabilities:
Packed with generic packer

Disassembly:
push 0x30000
push 0x10000
jmp loc.004123c7

Function at 0x403b00
Capabilities:
Packed with generic packer

Disassembly:
push esi
push str.GetTickCount
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov esi, eax
jmp loc.00412377

Function at 0x403b40
Capabilities:
Packed with generic packer

Disassembly:
push esi
push edi
push str.gethostbyname
push str.WS2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [esp + 0xc]
mov esi, eax
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x403b7b
push edi
call esi
test eax, eax
jne 0x403b74
pop edi
pop esi
ret
jmp loc.0041368f
pop edi
pop esi
ret
Function at 0x403b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.GetSystemDirectoryA
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.lstrcatA
push str.KERNEL32.dll
mov ebx, eax
call esi
push eax
call edi
push str.lstrcpyA
push str.KERNEL32.dll
mov ebp, eax
call esi
push eax
call edi
mov esi, eax
lea eax, [esp + 0x40]
push 0x104
push eax
call ebx
mov al, 0x65
mov dl, 0x74
mov byte [esp + 0x1c], al
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], al
mov byte [esp + 0x25], al
mov byte [esp + 0x26], dl
mov byte [esp + 0x2e], al
mov byte [esp + 0x32], al
mov byte [esp + 0x38], al
mov byte [esp + 0x3a], al
mov byte [esp + 0x3c], al
mov cl, 0x72
mov bl, 0x6c
mov dl, 0x78
xor al, al
mov byte [esp + 0x10], 0x5c
mov byte [esp + 0x11], 0x50
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], 0x6f
mov byte [esp + 0x14], 0x67
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x17], 0x6d
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], 0x46
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0x49
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 0x45
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x70
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x30], 0x5c
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], 0x70
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x6f
mov byte [esp + 0x37], cl
mov byte [esp + 0x39], 0x2e
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3d], al
mov byte [esp + 0x42], al
lea ecx, [esp + 0x10]
lea edx, [esp + 0x40]
push ecx
push edx
call ebp
mov ecx, dword [esp + 0x148]
lea eax, [esp + 0x40]
push eax
push ecx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x134
ret

Function at 0x4055b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ce
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40560f
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x412a8a
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409f80
push 0x406e60
push eax
push ebx
push edi
xor ebx, ebx
push 2
pop ecx
mov ecx, dword [0x4082b1]
mov ecx, dword [0x408655]
add esp, 0x18
leave
popal
popfd
mov eax, dword [esp + 4]
test eax, eax
jmp loc.00404376
Function at 0x402b1b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push 8
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402ba7
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x402b92
cmp dword [ebp + 0x10], ebx
jne 0x402b84
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402b1b
test eax, eax
jne 0x402b92
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
jmp 0x402b57
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x402ba7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x402fa0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402fcd
mov ecx, dword [0x4254d8]
push edi
add eax, ecx
push edi
push eax
mov dword [0x418244], eax
push dword [0x40a024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.004030cb
cmp eax, edi
jl 0x4030c4
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x40a024]
call ebx
test eax, eax
je 0x4030c1
cmp dword [ebp - 4], esi
jne 0x4030c1
push dword [ebp + 8]
add dword [0x418244], esi
call fcn.004030cb
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x4030c4
cmp dword [ebp + 0x10], edi
jne 0x403090
cmp dword [ebp + 8], edi
jle 0x4030bc
mov esi, 0x414200
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x403040
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x40a024]
call ebx
test eax, eax
je 0x4030c1
cmp edi, dword [ebp - 4]
jne 0x4030c1
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40308c
cmp dword [ebp + 0x14], edi
jne 0x40308c
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x418244], eax
cmp dword [ebp + 8], 0
jg 0x403033
jmp 0x4030bc
push 0xfffffffffffffffe
jmp 0x4030c3
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40309b
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a024]
call ebx
test eax, eax
je 0x4030c1
mov eax, dword [ebp - 4]
add dword [0x418244], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4030c4
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4030cb
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x418244]
mov edi, eax
sub esi, dword [0x40c034]
add edi, 0x1f4
add esi, dword [esp + 0x1c]
cmp esi, ebx
jle 0x4032ab
push dword [0x420250]
call fcn.004032ed
push ebx
push ebx
push dword [0x40c034]
push dword [0x40a024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x42024c], esi
mov dword [0x418240], ebx
mov eax, dword [0x418248]
mov ebp, 0x4000
sub eax, dword [0x420250]
cmp eax, ebp
jg 0x40313e
mov ebp, eax
mov esi, 0x414200
push ebp
push esi
call fcn.004032bb
test eax, eax
je 0x40326c
add dword [0x420250], ebp
mov dword [0x40c05c], esi
mov dword [0x40c060], ebp
cmp dword [0x425488], ebx
je 0x4031cf
cmp dword [0x425520], ebx
jne 0x4031cf
cmp dword [esp + 0x10], ebx
je 0x40319c
mov eax, dword [0x42024c]
push ebx
sub eax, dword [0x418244]
sub eax, dword [esp + 0x20]
add eax, dword [0x40c034]
mov dword [0x418240], eax
call fcn.00405fa3
jmp 0x4031cf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jbe 0x4031cf
mov eax, dword [0x425484]
neg eax
sbb eax, eax
not eax
and eax, str.unpacking_data:__d__
push eax
push 0x402bf8
push ebx
push 0x6f
push dword [0x425480]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
mov eax, dword [0x420250]
xor edx, edx
cmp dword [0x418248], eax
mov ecx, 0x40c038
mov dword [0x40c064], 0x40c200
mov dword [0x40c068], 0x8000
sete dl
call fcn.00406e83
test eax, eax
jl 0x4032b6
mov esi, dword [0x40c064]
mov eax, 0x40c200
sub esi, eax
je 0x403246
lea ecx, [esp + 0x14]
push ebx
push ecx
push esi
push eax
push dword [0x40a024]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403271
cmp esi, dword [esp + 0x14]
jne 0x403271
add dword [0x40c034], esi
cmp dword [0x40c060], ebx
jne 0x403164
jmp 0x403252
cmp dword [0x40c060], ebx
jne 0x4032b6
cmp ebp, ebx
je 0x4032b6
mov eax, dword [0x418244]
mov ecx, eax
sub ecx, dword [0x40c034]
add ecx, dword [esp + 0x1c]
test ecx, ecx
jle 0x403275
jmp 0x403128
or eax, 0xffffffff
jmp 0x4032ad
push 0xfffffffffffffffe
jmp 0x4032b8
push ebx
push ebx
push eax
push dword [0x40a024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x10]
cmp esi, ebx
je 0x4032ab
mov eax, dword [0x42024c]
push ebx
push ebx
push 0x113
push esi
mov dword [0x418240], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
push 0xfffffffffffffffd
pop eax
jmp 0x4032ad
Function at 0x40549b
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x423a90], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x4054bf
test al, 0x10
jne 0x4054c2
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x423a90
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4054ed
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x40556d
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00405813
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x4055a1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x425508], eax
jmp 0x40572b
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x4055bf
test eax, eax
je 0x4056dc
test byte [ebp + 0xc], 2
je 0x4056dc
mov esi, 0x422a90
push edi
push esi
call fcn.00405c2e
test ebx, ebx
je 0x4055dc
push str..
push esi
call fcn.00405c51
jmp 0x4055e2
push edi
call fcn.00405778
push 0x40a010
push edi
call fcn.00405c51
push edi
call fcn.00405c44
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4056d2
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.0040575c
cmp byte [eax], 0
je 0x405633
cmp byte [ebp - 0x18], 0
je 0x405633
lea esi, [ebp - 0x18]
mov al, byte [esi]
cmp al, 0x2e
jne 0x40564e
cmp byte [esi + 1], 0
je 0x4056b1
cmp al, al
jne 0x40564e
cmp byte [esi + 1], al
jne 0x40564e
cmp byte [esi + 2], 0
je 0x4056b1
push esi
push ebx
call fcn.00405c2e
mov eax, dword [ebp - 0x148]
test al, 0x10
je 0x405674
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4056b1
push dword [ebp + 0xc]
push edi
call fcn.0040556d
jmp 0x4056b1
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4056a9
test byte [ebp + 0xc], 4
je 0x4056a1
push edi
push 0xfffffffffffffff1
call fcn.00404fac
push 0
push edi
call fcn.00405975
jmp 0x4056b1
inc dword [0x425508]
jmp 0x4056b1
push edi
push 0xfffffffffffffff2
call fcn.00404fac
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405611
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4056dc
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x40572b
cmp dword [ebp - 8], esi
jne 0x4056f1
inc dword [0x425508]
jmp 0x40572b
push edi
call fcn.00405f3b
test eax, eax
je 0x40572b
push edi
call fcn.00405731
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405723
test byte [ebp + 0xc], 4
je 0x4056e9
push edi
push 0xfffffffffffffff1
call fcn.00404fac
push esi
push edi
call fcn.00405975
jmp 0x40572b
push edi
push 0xffffffffffffffe5
call fcn.00404fac
pop edi
pop esi
leave
ret 8
Function at 0x405813
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x422e90
push esi
call fcn.00405c2e
push esi
call fcn.004057c4
mov edi, eax
test edi, edi
jne 0x405834
xor eax, eax
jmp 0x405886
push edi
call fcn.00405ea2
test byte [0x425490], 0x80
je 0x40584d
mov al, byte [edi]
test al, al
je 0x405830
cmp al, 0x5c
je 0x405830
sub edi, esi
push esi
call fcn.00405c44
cmp eax, edi
push esi
jle 0x405870
call fcn.00405f3b
test eax, eax
je 0x405868
test byte [eax], 0x10
je 0x405830
push esi
call fcn.00405778
jmp 0x40584f
call fcn.00405731
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4058fd
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x40592c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405971
mov eax, edi
dec edi
test eax, eax
jne 0x405937
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x40596b
Function at 0x405975
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.00405f79
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4059a1
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405ae7
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x423c18], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x423c18
je 0x4059e5
push 1
push 0
push esi
call fcn.004058fd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405aed
cmp eax, edi
jg 0x405aed
mov esi, 0x423690
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405aed
cmp eax, edi
jg 0x405aed
push esi
push ebp
push str._s_s_r_n
push 0x423290
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call fcn.00405c51
xor eax, eax
push eax
push 0x8000080
push 4
push eax
push eax
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x405ae7
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405ae0
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405ae0
cmp edi, dword [esp + 0x18]
jne 0x405ae0
push str._Rename__r_n
push esi
call fcn.0040588b
test eax, eax
jne 0x405af4
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405c2e
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x423290
push eax
call fcn.004058d7
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x425510]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40a31c
push eax
call fcn.0040588b
test eax, eax
je 0x405aab
inc eax
lea edx, [esi + edi]
cmp eax, edx
mov ecx, eax
jae 0x405b1d
mov dl, byte [ecx]
mov byte [ecx + ebx], dl
inc ecx
lea edx, [esi + edi]
cmp ecx, edx
jb 0x405b10
sub eax, esi
jmp 0x405aad

Function at 0x405b21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x75e7738e
xor ecx, ebp
loop 0x405b29
pop ebp
ret
Function at 0x405fe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x42401c], esi
push edi
jne 0x40601a
mov ecx, 0x424018
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405ff6
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x424418
jl 0x405ff1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x40604f
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x424018]
xor eax, esi
inc ecx
dec edx
jne 0x406032
pop edi
pop esi
not eax
ret 0xc
Function at 0x56ff6e
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, ecx
push dword [esp + 2]
jmp 0x56ffed
jg 0x56ff91
jle 0x56ff91
bt dx, di
bsf ax, si
lea edx, reloc.KERNEL32.dll_HeapFree
jmp 0x570012
sub esp, 0x10
jnp 0x570081
xchg dl, ah
jmp 0x570083
rdtsc
not cx
mov dx, cx
jmp 0x570062
lea esp, [esp + 0x10]
add ebp, 0x1855a317
not cx
rol dx, 0xd
jge 0x57004c
jl 0x57009e
wait
pop ds
invalid
xchg dl, ah
rol ebp, 0
jmp 0x57001b
rdtsc
bswap eax
jmp 0x5700d1
lea ecx, [edx*4]
sete dh
rdtsc
jmp 0x570088

Function at 0x56ffc2
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x570007
mov ebx, ebp
mov eax, 0xc7ca8618
lea edx, [edi - 0xed]
stc
je 0x56ffac
inc dl
mov ecx, 0x5454331d
xchg cl, al
bt dx, di
bsf ax, si
jmp 0x56fff9
inc dl
mov ecx, 0x5454331d
xchg cl, al
jmp 0x56fff1
Function at 0x58cb37
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi], eax
lea ecx, [esi*4]
mov cx, dx
mov cl, byte [esp]
jmp 0x573dcd
jmp 0x58cb0c
Function at 0x60df19
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
not bx
xchg dword [esp + 0xf], edi
rdtsc
xchg dword [esp + 0xd], ebx
jmp 0x60df2b
std
mov word [esp + 0xc], bx
bts eax, edx
pop dword [esp + 2]
lea edx, [esi + 0x59]
jmp 0x60df03
bsf bp, sp
mov word [esp + 7], bx
pop eax
inc ecx
xchg word [esp + 0xc], bp
inc edi
jmp 0x60df6f
neg ebp
add esp, 1
mov al, 0x14
xchg byte [esp + 1], dh
not cl
shl esi, 0x19
jmp 0x60df59

Function at 0x60e31e
Capabilities:
Execute anti-debugging instructions

Disassembly:
sets ah
mov edx, ebx
adc cx, bx
jmp 0x60e344
clc
mov bp, dx
xchg ah, dh
xchg ah, dh
pop ebx
xchg dl, cl
jmp 0x60e391
sub esp, 0x11
push dword [esp + 3]
xchg word [esp + 0xb], bp
mov ah, 0x67
bt ebx, edi
pop ax
jmp 0x60e3ac
lea esi, [ebx*4]
lea edx, reloc.KERNEL32.dll_HeapFree
push word [esp + 4]
add esp, 0x12
xchg bx, di
cmc
jmp 0x60e376
neg bh
mov word [esp + 6], sp
push si
lea esi, [ebp*4]
mov word [esp + 1], bx
mov ecx, dword [esp + 0xb]
jmp 0x60e529
neg cl
lea esp, [esp + 5]
xchg dh, dl
mov cx, word [esp + 6]
cmc
jmp 0x60e44e
mov edx, 0x8ec86bc5
mov al, byte [esp + 4]
mov al, 0x90
mov ebp, dword [esp + 4]
mov esi, esp
rdtsc
jmp 0x60e3ed
mov edi, dword [esp + 0xb]
pop dword [esp + 6]
cld
mov ecx, dword [esp + 0xb]
mov di, word [esp + 0xf]
xchg bx, si
jmp 0x60e403
lea esp, [esp + 1]
mov dword [esp + 3], ecx
cmc
xchg dword [esp + 3], eax
call fcn.0060e438
xor byte [ecx + 0x1ebb4829], bh
sbb byte [edi - 0x7227093a], al
adc al, 0x85
add byte [eax], al
add byte [eax], al
xchg esi, eax
neg al
lea edx, [eax*4]
inc di
dec bl
mov word [esp + 0xe], ax
jmp 0x60e421
rdtsc
mov bh, 0x2e
ror bx, cl
mov ebp, dword [esp + 0x10]
mov dword [esp + 9], ecx
xchg byte [esp + 0xd], cl
jmp 0x60e467
mov dword [esp + 7], esp
xchg word [esp + 6], ax
sub esp, 0
cpuid
lea esp, [esp + 1]
mov word [esp + 1], bx
jmp 0x60e495

Function at 0x60eaf3
Capabilities:
Parse pe header

Disassembly:
push dword [esp + 5]
lea esp, [esp + 2]
mov dword [esp + 8], ebp
jmp 0x60eb12

Function at 0x60eb09
Capabilities:
Parse pe header

Disassembly:
call fcn.0060e047
pop word [esp]
call fcn.0060eaf3
push esp
push dword [esp + 2]
push ax
push dword [esp + 8]
lea esp, [esp + 2]
mov dword [esp + 0x10], esi
jmp 0x60ec81
mov eax, dword [eax + 8]
push eax
jmp 0x60e042
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x60eb6b
pushfd
mov word [esp + 1], si
mov dword [esp + 0x10], edi
lea esp, [esp + 0x10]
mov eax, dword fs:[0x30]
jmp 0x60ebd7

Function at 0x60ef45
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ecx*4]
lea edi, [esi + esi]
xchg word [esp], si
pop dword [esp]
lea ebx, [ebx*4]
xchg dword [esp], edi
xchg ebx, esi
mov word [esp + 3], ax
xchg word [esp + 1], cx
jmp 0x60e11d
mov byte [esp + 6], ah
neg bx
lea edx, [ebx*4]
bsf ebx, esi
inc eax
mov ebp, 0x8a18989a
jmp 0x60e133
jmp 0x60e160