joyce8/EMBER2024-capa huggingface dataset:
Function at 0x786032
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [eax]
pushal
mov eax, dword [eax + 4]
call 0x785ffd
loop 0x786064
mov dword [esp], esp
jmp 0x786103
lea esp, [esp + 0x20]
mov esp, ecx
mov cx, 0x3b6f
lea ecx, [ecx - 0x8b]
jmp 0x785ff1
lea esp, [esp + 4]
test dword [ecx], eax
pushal
jmp 0x78601a
inc edx
enter 0xffffffffffffc353, 0xffffffffffffffa6
push ebp
xchg edi, eax
pop esi
aam 0x4a
sub eax, 0x41c86adc
sal dword [eax + reloc.kernel32.dll_GetCurrentProcessId], 1
nop
mov al, 0x43
hlt
test dword [edx], reloc.kernel32.dll_GetCurrentProcessId
xor al, cl
jns 0x78607a
js 0x786074
mov dword [eax - 0x3a], edi
fcom dword [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
out dx, al
dec edx
invalid
mov edi, 0x2fdcb525
popfd
iretd
lea esp, [esp + 0x24]
push eax
call fcn.007860d4
and al, 0xbf
das
dec edx
mov ecx, 0x6903272
popal
nop
pop ss
lea ecx, reloc.kernel32.dll_GetCurrentProcessId
sbb eax, 0xa66b0c9e
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
arpl word [ebp - 0xd], bp
arpl word [esi], ax
cmc
dec ebp
jne 0x786121
push 0xd
cld
dec edi
loope 0x7861a5
adc bl, ah
push ecx
movsd dword es:[edi], dword [esi]
and dh, byte [eax - 0x1a69dd29]
not dword [bp + si - reloc.kernel32.dll_GetCurrentProcessId]
xchg edx, eax
popal
stosd dword es:[edi], eax
sbb eax, 0x98690e98
pop esp
jge 0x786140
or al, 0xff
dec ebx
insd dword es:[edi], dx
out 0x74, al
adc ebp, esi
pop ebx
popfd
sbb ecx, dword [ebx - 0xa25e212]
jl 0x786170
jne 0x7860e4
xor al, ch
dec ecx
fnstcw word [eax - 0x159a08b5]
js 0x78618a
ljmp 0x9fa:0x9f0f8559
cli
or dword [eax + reloc.kernel32.dll_GetCurrentProcessId], esp
mov al, byte [0x4ddd4d14]
adc al, 0xe7
and al, 0xbd
mov esp, 0xad8136db
inc ebx
sal dword [esi + reloc.kernel32.dll_GetCurrentProcessId], cl
lcall 0x21b1, 0x25ca0cfd
inc eax
mov bl, 3
and eax, 0xb24720b2
or al, 0x25
mov bh, 0x27
inc edx
mov cl, 0x7e
cmp eax, 0xa8593ea8
pop ds
not byte [ebp + 0xcfd9a04]
retf 0xb125
pop ecx
test al, 0x1f
pop ebp
lds edx, [ebp + 0x3c]
iretd

Function at 0x803b19
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 2]
mov di, 0x54f5
mov cx, word [esp + 4]
mov di, 0x7fb1
mov byte [esp + 1], bh
xchg ebx, ebp
jmp 0x803b03
mov dword [esp + 0xa], esi
mov dword [esp + 9], esi
mov dword [esp + 9], ecx
lea esp, [esp + 8]
pop edi
mov esi, ecx
int1
jmp 0x803a92
add esp, 0x19
pop bp
push dword [esp + 7]
shr edi, 0xd
neg ax
stc
jmp 0x803ab2
rdtsc
xchg ch, dl
pop ax
mov dword [esp + 0x1b], eax
mov ebx, esi
mov dword [esp + 0x15], ebp
jmp 0x803ada
pop ebx
and eax, ecx
lea eax, [ecx + edi]
mov ah, byte [esp]
mov ebp, 0xa9a469ca
mov al, ah
jmp 0x803b4a
mov ecx, 0x37715dc0
mov bx, dx
neg esi
jmp 0x803af1
xchg byte [esp], dl
lea edi, [ebp*4]
add byte [eax], al
add byte [eax], al
setle dh
xchg bh, cl
call fcn.00803ba3
std
insb byte es:[edi], dx
loop 0x803ac2
je 0x803ac4
in eax, dx
jns 0x803b2b
mov byte [ebx - 0x34], bh
fdivr dword [ebx]
adc cl, byte [ebp + 0x2c8b661c]
and al, 0x66
neg eax
mov bp, word [esp]
neg ax
rdtsc
mov bh, byte [esp]
lea ebp, [esp + edx]
rcr bh, 3
jmp 0x803b25
Function at 0x804599
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg di, si
add dx, 0x4e36
rol cx, cl
xchg edi, ebp
xchg dword [esp + 4], eax
jmp 0x8045e1
setp ch
pop word [esp + 2]
setae ah
mov edi, esi
push dword [esp]
xchg ah, bl
jmp 0x80461b
cld
xchg di, dx
xchg dword [esp + 1], edi
inc bx
mov bp, di
lea edi, [ecx*4]
jmp 0x8049cd
lea edx, [edi + edi]
xchg bh, cl
xchg bx, cx
mov edi, dword [esp]
neg eax
mov dl, 0x94
jmp 0x804683
pop ax
mov word [esp], di
pop ax
mov cx, word [esp]
rdtsc
xchg byte [esp], al
jmp 0x80464d
rdtsc
inc ebx
mov ebp, ecx
bswap eax
btc ecx, ebx
mov ebx, dword [esp]
jmp 0x8046e8
setnp ch
btr edx, esp
pop dword [esp]
sub edx, eax
mov ax, sp
stc
jmp 0x804670
pop dword [esp + 0xb]
clc
mov bp, bx
neg esi
sub esp, 4
rdtsc
jmp 0x8048f0
neg dx
btr ebx, esp
sub esp, 0x1e
xchg ecx, esi
mov eax, dword [esp + 0xd]
pop di
jmp 0x8046b2
xchg byte [esp], dl
setno ch
xchg ch, dl
mov bl, 0x48
mov edx, 0x7585468c
not ah
jmp 0x8046c9
mov al, 0xc6
cpuid
lea edi, [eax*4]
pop si
mov dword [esp], eax
push dword [esp + 2]
jmp 0x8046a1
mov ecx, ebp
push esp
pushal
xchg edi, edx
neg dx
rdtsc
jmp 0x804774
inc dl
mov byte [esp + 0x12], ch
mov ax, sp
xchg dx, ax
lea ebp, [esi + 0xbd]
call fcn.00804753
and al, 0x57
pushal
rcr ch, 5
sub esp, 0x16
lea esp, [esp + 0x47]
stc
cld
jmp 0x80471f
not eax
pop word [esp + 0x15]
neg bh
mov dword [esp + 5], esi
pop word [esp + 1]
neg ax
jmp 0x80472c
bswap edx
sete ah
mov eax, ecx
xchg ch, dl
xchg byte [esp + 8], al
lea eax, [edi + edi]
jmp 0x804744
clc
pop dword [esp + 8]
mov bx, 0xdd77
push dword [esp + 8]
setae bh
mov di, 0x59f
jmp 0x8047ee
xchg ch, dl
ror dh, 7
not ecx
bswap edi
rdtsc
cpuid
jmp 0x804820
mov ah, byte [esp + 9]
mov di, word [esp + 0xe]
not bh
sub esp, 0x14
rcr ah, 1
popal
jmp 0x80489b
btr edi, edx
xchg edx, ebx
pop word [esp + 3]
lea ecx, [ebp*4]
mov ax, word [esp + 3]
mov word [esp + 4], di
jmp 0x804709
bsf bx, ax
pop word [esp + 3]
xor edx, esi
clc
xchg word [esp + 4], ax
mov dh, byte [esp]
jmp 0x80491f
pop dword [esp]
neg ebp
clc
mov bp, word [esp + 2]
xchg byte [esp + 2], bl
push esp
jmp 0x80495d
Function at 0x804753
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 7
jmp 0x80475c
pushal
rdtsc
xchg word [esp + 0x2c], dx
pop word [esp + 0xf]
xchg dword [esp + 0x27], edi
jmp 0x8047d2
mov bp, sp
cpuid
inc eax
bswap ebx
xchg word [esp + 0xd], dx
mov word [esp + 6], di
jmp 0x8047bb
setne ah
pop dword [esp + 0xa]
btc edx, ebx
mov esi, dword [esp + 0xb]
mov cx, bx
not bh
jmp 0x80478b
mov dword [esp + 0x10], ebp
mov dword [esp + 9], ebp
rdtsc
xchg dword [esp + 2], ebp
setle ah
jmp 0x804803
inc bl
neg eax
xchg dword [esp + 2], ebp
btc edx, ebx
lea esp, [esp + 0x22]
xchg dword [esp + 8], eax
jmp 0x8047a6
xchg byte [esp + 0x10], cl
lea esi, [esi - 0xd]
push word [esp + 0xf]
pop ebx
push word [esp + 0x10]
mov word [esp + 0xb], dx
jmp 0x804868
mov dword [esp + 0xd], eax
neg ah
cld
cpuid
mov cl, 0xea
pop ecx
jmp 0x804878
bsf ax, si
rdtsc
lea esi, [esi - 0x65]
mov al, ah
shl bx, cl
bswap edi
jmp 0x804836
rdtsc
clc
bsf di, ax
mov eax, dword [esp + 0xe]
bswap eax
push edx
jmp 0x804850
push word [esp + 0x13]
cpuid
xchg esi, edx
pop word [esp + 7]
neg bp
mov byte [esp + 9], bh
jmp 0x8048ca
xchg di, bp
call fcn.008048ad
bsf si, si
mov dl, 0xf4
pop word [esp + 2]
add al, dh
sub esp, 0x1a
mov edi, 0xf1920184
jmp 0x804903
xchg byte [esp + 0x28], al
cpuid
mov edi, 0x599e3818
mov ch, byte [esp + 3]
inc ebp
xchg word [esp + 0x2a], dx
jmp 0x80493f
xchg di, dx
mov byte [esp + 0x2f], ch
mov cx, 0xa785
push dword [esp + 0x1b]
push dword [esp + 0x25]
mov bp, word [esp + 0x13]
jmp 0x80499b
mov word [esp + 3], di
mov ax, word [esp + 9]
mov ch, byte [esp + 2]
pop bp
xchg esi, edx
push word [esp + 1]
jmp 0x8049af
add esp, 0x26
bsr ax, bp
xchg dword [esp + 1], ecx
pop dword [esp]
ror ch, 5
pop esi
jmp 0x804973
lea esp, [esp + 7]
xchg dword [esp], eax
push word [esp + 1]
xchg dword [esp], edi
pop edx
btr ebx, esp
jmp 0x804a99
xchg dh, al
pushal
lea esp, [esp + 0x46]
mov eax, 0x2c386ef4
btr edx, edx
rdtsc
jmp 0x804a33
xchg bp, ax
bsf cx, ax
mov ebx, eax
inc ebx
btc esi, ebx
mov si, 0x1e75
jmp 0x8049fe
and esi, ecx
pushal
sub bl, ah
bswap edx
btc edx, ebx
mov cl, ch
jmp 0x804a79
inc bp
not edi
not bh
xchg ch, dl
lea edx, [edi*4]
btc eax, edi
jmp 0x804a20
lea ebx, [eax + 0xa1]
inc dx
mov word [esp + 0x16], bx
mov dword [esp + 0x15], ecx
push word [esp + 7]
call fcn.00804a61
popal
mov al, byte [0x83751ae3]
in al, dx
or bh, byte [ebx + 0x1db668ae]
sub esp, 0xa
mov ebx, 0x1db668ae
sub esp, 0x16
push dword [esp + 0xe]
clc
cmc
jmp 0x804a4d

Function at 0x8048ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
not esi
xchg bh, cl
cpuid
mov al, 0xfe
jmp 0x8048d2
Function at 0x804c20
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x16]
pop dword [esp + 8]
mov bl, bh
btr ecx, esp
popal
jmp 0x804065
xchg dx, bx
mov edi, ecx
mov cl, 0xfa
mov word [esp + 2], sp
bswap ecx
inc edx
jmp 0x803ffb
pop bx
xchg byte [esp + 0x18], cl
neg ch
xchg edi, eax
xchg cx, ax
lea eax, [ebp + 0x7f]
jmp 0x804011
xchg byte [esp], dl
push word [esp + 2]
mov bx, di
add esp, 0
mov dx, 0x5ed1
lea eax, [edi + edi]
jmp 0x804b7a
lea ebp, [edi + edi]
lea esp, [esp + 0xd]
mov edi, dword [esp]
mov word [esp], di
xchg byte [esp], dl
mov eax, 0xb40c032
jmp 0x80403a
pop dword [esp + 0x14]
setne ah
xchg cx, ax
shl bp, cl
setns dh
mov word [esp + 0x1a], dx
jmp 0x804028
jmp 0x804083

Function at 0x8056c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [esp]
mov al, byte [esp]
rdtsc
and cl, bh
mov si, bx
not bh
jmp 0x8056ef
bsf ax, si
xchg edi, edx
xchg dh, al
lea ebx, [ecx*4]
jmp 0x8056cf
mov byte [esp + 7], ah
cld
pushal
lea esp, [esp + 0x3c]
pushal
jmp 0x80569a
mov si, 0x5eb7
neg dx
push esp
sub bl, ah
xchg ch, dl
mov si, word [esp + 2]
jmp 0x805779
mov dl, 0xc
xchg edi, eax
mov dx, bx
cpuid
neg edi
btc ecx, ebx
jmp 0x8056ab
lea esp, [esp]
add esp, 0
mov al, 0x86
btc edi, edi
cpuid
neg ax
jmp 0x805753
sub ecx, eax
lea eax, [esi - 0xbd]
xchg bx, si
xchg byte [esp], al
add esp, 0
bsr si, bp
jmp 0x805726
lea ebp, [ebx + esi]
bswap edi
mov dx, bx
cpuid
pushal
cmc
jmp 0x8057a6
sub bl, ah
bswap ecx
popal
mov dx, di
lea edx, [edx*4]
lea eax, [edx + edx]
jmp 0x80578c
lea esp, [esp + 3]
mov bh, byte [esp]
cmc
mov ebx, dword [esp]
add esp, 0
btc ecx, edi
jmp 0x80573c
mov bx, word [esp]
lea edx, [edi + ebp]
mov ax, word [esp]
inc dl
mov si, dx
neg eax
jmp 0x805afe
mov ecx, 0x633c6b2e
btc ebx, ebx
mov eax, 0xc7959b3e
mov bl, bh
xchg ch, dl
jmp 0x805761
bsr bx, cx
add esp, 0
neg ebp
lea ebp, reloc.kernel32.dll_GetCurrentProcessId
xchg ebx, edx
not bp
jmp 0x805803
mov edx, dword [esp + 0x18]
pop edi
pop word [esp + 0x13]
xchg byte [esp + 0x16], dl
popal
btr ebx, esp
jmp 0x8057ce
setbe dh
mov ebp, dword [esp]
xchg ch, dl
mov ebp, dword [esp]
mov esi, dword [esp]
xchg ch, dl
call fcn.00805834
mov ah, byte [0x8d6ec754]
adc al, 0x85
add byte [eax], al
add byte [eax], al
lea edx, [eax*4]
mov di, 0xc3a7
rdtsc
mov dl, dh
xchg cx, ax
lea edi, [eax - 0x29]
jmp 0x8057ef
push word [esp + 4]
mov dword [esp], esi
and di, 0x6da
lea edi, [ebx + ebp]
pushal
rdtsc
jmp 0x80581d
bsr cx, bp
cpuid
mov bp, 0xcdab
mov cx, sp
push edx
mov dl, 0x94
jmp 0x805852
mov ecx, 0x27ecbde8
mov dl, dh
push esp
lea esp, [esp + 4]
xchg byte [esp], bl
add esp, 0
jmp 0x805908

Function at 0x805a9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, bh
lea ebp, [ecx + 0x13]
lea esp, [esp + 0x2a]
jmp 0x805ae0
ror ah, 1
push word [esp + 0xd]
add al, dh
mov di, word [esp + 0x14]
cld
jmp 0x805aca
pop ebx
sub esp, 0x16
bsr cx, cx
mov word [esp + 6], sp
mov cx, dx
neg edi
jmp 0x805aa6

Function at 0x805bf2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
cpuid
mov si, bx
jmp 0x805bfe
and eax, ecx
mov cl, 0xa
lea esi, [eax*4]
xchg word [esp + 0x1f], cx
mov cx, 0x63e3
mov dl, 0x64
jmp 0x805c28
Function at 0x80614c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], esi
xor dl, ch
mov dx, 0xfd67
lea ebx, [edx + edx]
pop di
mov bp, bx
jmp 0x806121
setg bh
mov bx, di
cmc
push esp
lea esp, [esp + 0x14]
sub esp, 0x1a
jmp 0x8060d6
btr ecx, esp
xchg byte [esp + 8], al
bswap esi
mov bh, 0xc3
mov dword [esp + 0xc], esi
neg edx
jmp 0x8060f0
and cl, bh
mov dword [esp + 0xe], ecx
pushal
pop bp
sub esp, 0xe
lea esp, [esp + 0x45]
jmp 0x80616d
stc
lea ecx, reloc.kernel32.dll_GetCurrentProcessId
mov cx, 0x7bbd
rdtsc
rdtsc
add al, dh
jmp 0x80614e
jmp 0x80610e
mov dx, di
lea esi, [esp + edi]
lea ecx, [eax*4]
inc dx
xchg ch, dl
mov eax, dword [esp]
jmp 0x806183
bswap edx
mov al, ah
bswap esi
lea eax, [eax - 0xf1]
bsf ax, si
mov si, 0x4659
jmp 0x806133
bsf bx, ax
lea ebx, [ecx + 0x2b]
lea ebp, [edx + edi]
xchg cx, dx
rcr ebx, 0xd
inc bl
jmp 0x8061b8
Function at 0x806459
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, dh
jmp 0x806461
mov dl, 0xd4
cld
xchg word [esp + 5], ax
xchg cx, ax
bswap edi
jmp 0x8064c7
xchg ah, bl
xchg ebp, edx
setp bh
add ecx, ebp
lea edi, [edi + edi]
rdtsc
jmp 0x8064dc
mov bl, 0x38
lea eax, [edi*4]
mov byte [esp + 7], ch
jmp 0x80653b
mov ax, word [esp + 9]
pop ax
xchg ecx, edi
lea esp, [esp + 0xa]
bswap eax
xchg word [esp], si
jmp 0x8064a0
xchg si, di
lea esi, [eax - 9]
sub esp, 0x10
xchg edx, ebx
pop word [esp + 0xb]
cpuid
jmp 0x8064b0
push dword [esp]
sub esp, 0x16
pop word [esp + 0x13]
push edx
popal
cpuid
jmp 0x80656f
ror bh, 3
rdtsc
lea esp, [esp + 1]
pop word [esp + 1]
mov dl, dh
jmp 0x80650d
pop word [esp + 7]
mov byte [esp + 5], dh
mov word [esp + 0xc], di
mov dword [esp + 6], ebp
add esp, 8
mov word [esp + 1], sp
jmp 0x806523
lea eax, [eax - 0xf1]
lea ebx, [ecx + edx]
xchg di, bp
xchg ch, dl
neg ah
bswap edx
jmp 0x806608
xchg dh, al
setle ah
not bh
mov ax, word [esp]
mov al, byte [esp]
mov cl, 0xe2
jmp 0x806557
inc cx
inc eax
mov eax, dword [esp]
neg ebx
mov cl, 0x52
not dh
jmp 0x8065b4
mov bp, word [esp]
sub ax, 0xc3a8
mov edi, 0x73883ec6
jmp 0x8065dd
neg ch
btr ecx, esp
cpuid
xchg ebp, edi
xchg si, bp
mov bl, bh
jmp 0x8065a2
lea esi, [ecx*4]
mov ebp, ecx
mov bx, word [esp]
neg ebp
bswap ecx
inc bl
jmp 0x806646
mov byte [esp + 0x1a], ah
rdtsc
pushal
bswap ebp
pushal
lea esp, [esp + 0x60]
jmp 0x80662d
rdtsc
cpuid
xchg dx, ax
mov dl, 0x1c
cld
mov eax, dword [esp]
jmp 0x8065cd
lea esi, [edx*4]
xchg bh, cl
inc ebp
lea ebp, reloc.kernel32.dll_GetCurrentProcessId
jmp 0x806657
sub si, 0xe440
btc esi, edi
xchg bh, cl
cpuid
mov bp, word [esp]
xchg ebp, edi
jmp 0x806616
xchg ebp, esi
bsr bx, bp
mov al, 0xf6
pushal
rdtsc
mov bx, 0xed17
jmp 0x8065f2
cpuid
xchg dh, al
mov bl, bh
bswap eax
inc eax
xchg dx, si
jmp 0x807afc
inc eax
mov bl, 6
sub esi, dword [edx + reloc.kernel32.dll_GetCurrentProcessId]
das
mov bh, 0x27
inc edx
mov cl, 0x38
sub ch, byte [eax + 0x7ca8593e]
inc esp
lds edx, [ebp + 0x3c]
iretd
dec ecx
mov eax, 0x595045a
insb byte es:[edi], dx
lahf
je 0x807a7e
aaa
push ds
btc esi, ebx
call fcn.008072a1
jnp 0x807aef
jns 0x807b20
jmp 0x807b58
xchg dword [ebx], esi
fisttp dword [esi - 0x24]
mov ebx, 0xe347ff56
jae 0x807b42
in eax, 0x5c
mov edi, 0x2cddba24
test ebx, ecx
push ecx
shl dword [eax - reloc.kernel32.dll_GetCurrentProcessId], 0x40
daa
rcl byte [ebp - 0x31], cl
push edi
invalid
test byte [ebx], cl
wait
dec byte [0x22ac2ae9]
inc ebp
mov ah, 0x5d
cmp al, 0xb9
sub dword [eax - 0x45], ecx
pop ecx
push ds
lcall 0xff7c, 0x749a6f08
outsd dx, dword [esi]
or bh, cl
out dx, al
pop edx
rol byte [esi + 0x21], 1
sal byte [edx], 1
les ecx, [ebp - 0x23]
movsb byte es:[edi], byte [esi]
push edi
push esi
fimul word [ebx + ebp - 0x1a]
xor ah, byte [ebx + esi - 0x23ca395d]
mov edx, 0x3ccdaa34
shr byte [ecx - 0x3cdc2f4f], cl
out dx, al
invalid
Function at 0x806b46
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dword [esp + 0xc8], ebp
call 0x806a34
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x806b26
mov word [esp + 0xd], sp
lea esp, [esp + 9]
push dword [esp]
pop word [esp + 0x17]
mov byte [esp + 0x1a], ch
push word [esp + 3]
jmp 0x806a4d
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x806082
lea esp, [esp + 0x23]
pushal
push word [esp + 0xc]
mov byte [esp + 0x15], bh
jmp 0x806af1
Function at 0x8072a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
lea eax, [eax + 0xc1]
mov ebp, eax
pop bx
inc bx
mov ebx, 0xb76d210
jmp 0x8066f3
mov di, sp
mov bx, word [esp]
mov eax, esi
lea esi, [ebx + ebp]
cmc
inc ax
jmp 0x806686
lea esp, [esp + 0x15]
btr ebp, esp
mov dl, dh
shl bp, cl
btr ecx, esp
lea eax, [eax*4]
jmp 0x8066a2
setae dh
not dh
mov byte [esp], dh
mov edi, dword [esp]
mov ecx, dword [esp]
mov word [esp], sp
jmp 0x80676f
xchg byte [esp], cl
add bp, 0xd676
bsr di, bp
xchg byte [esp], bl
bswap ebp
jmp 0x8066d2
push word [esp + 5]
and bp, 0x7ca2
sub esp, 0x14
mov byte [esp + 0x19], dh
popal
mov dword [esp + 3], ecx
jmp 0x8066ba
neg bh
rdtsc
sub esp, 8
mov ax, word [esp + 2]
jmp 0x80679a
lea ebx, reloc.kernel32.dll_GetCurrentProcessId
rdtsc
mov dl, 0xc
mov al, byte [esp]
inc cl
mov cx, bx
jmp 0x806722
mov bx, word [esp]
cpuid
mov cl, byte [esp]
rdtsc
not bx
lea eax, [ecx + edi]
jmp 0x806738
mov al, ah
xchg esi, ecx
pop si
btr eax, edx
setbe dh
xchg bh, cl
jmp 0x806751
rdtsc
lea esp, [esp + 0x13]
btr ebp, esp
xchg bp, cx
xchg edx, esi
xchg byte [esp], al
jmp 0x8067ac
mov word [esp + 4], sp
pop eax
rol bp, cl
mov bl, pe_nt_image_headers32
mov eax, esi
sub esp, 0x1e
jmp 0x80677f
inc cl
xchg word [esp + 2], cx
xchg dword [esp + 3], ecx
push dword [esp + 0xd]
jmp 0x806829
rol ax, cl
xchg ch, dl
neg dh
xchg word [esp], ax
pushal
rdtsc
jmp 0x80670a
xchg di, dx
rdtsc
mov dh, byte [esp + 3]
xchg word [esp + 1], ax
lea esp, [esp + 1]
jmp 0x806876
mov dx, word [esp + 2]
mov byte [esp + 1], bh
pop word [esp + 7]
push word [esp + 4]
add esp, 9
jmp 0x8067d5
xchg word [esp + 2], si
mov edx, 0xb2efd776
pop word [esp + 0xa]
xchg dword [esp + 3], ecx
mov dword [esp + 3], ebp
jmp 0x8067ed
setp ah
lea ecx, [edx + ebx]
pop word [esp + 6]
pop word [esp + 8]
mov ecx, ebp
xchg byte [esp + 4], cl
jmp 0x80680b
mov cl, 0x72
mov ebx, esi
not bp
stc
cld
call fcn.00806841
fmul qword [esi - 0x24]
mov ebx, 0xe34eb456
jae 0x806887
in eax, 0xa
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x75]
fisttp qword [ebp + 0x14863a1c]
and al, 0x87
aad 0x66
bsf ecx, esi
mov ebx, ebp
lea ebx, [edx + edi]
xchg byte [esp], dl
xchg ebp, edx
bsf cx, si
stc
jmp 0x806859
lea ebp, [edi*4]
pop cx
mov eax, 0x5830eb00
not ecx
btc ecx, ebx
mov ch, byte [esp]
jmp 0x8067c2
setp ah
mov dh, byte [esp + 2]
lea ecx, [esp + esi]
bswap esi
xchg word [esp + 2], bx
xchg dword [esp], ebp
jmp 0x806917
mov di, dx
push word [esp + 2]
xchg bh, cl
lea edi, [edi*4]
inc si
xchg esi, ebp
jmp 0x8069fa
xchg word [esp], bx
lea edx, [edi + edi]
rdtsc
mov ebp, esi
lea edi, [eax + 1]
xor dl, ch
jmp 0x806e86
xchg bx, cx
lea esi, [ebp*4]
xchg ebx, eax
bsf ax, ax
lea esp, [esp + 1]
jmp 0x806ffa
Function at 0x4030b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b5791
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00402f60
xor ebx, ebx
mov dword [esp + 0x18], ebx
lea ecx, [esi + 0x30]
call fcn.0042dec0
mov byte [esp + 0x18], 1
lea ecx, [esi + 0x1ef0]
call fcn.00459060
mov byte [esp + 0x18], 2
mov eax, dword [esp + 0x20]
mov byte [esi + 0x1eec], bl
mov byte [esi + 0x1eed], bl
mov dword [esi + 0x1ed8], ebx
mov dword [esi + 0x1ee0], ebx
mov dword [esi + 0x1ee4], ebx
mov dword [esi + 0x1ee8], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x1f4c], esi
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x406970
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2e0
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x2dc], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2fc]
push esi
push edi
mov edi, dword [esp + 0x2f4]
mov ebx, ecx
push 0x808
mov dword [esp + 0x38], ebx
call fcn.004a5934
mov ecx, dword [esp + 0x300]
mov esi, eax
mov eax, dword [esp + 0x2fc]
add esp, 4
push edi
mov dword [esi], eax
mov dword [esi + 4], ecx
call fcn.0046a8b0
lea edx, [esi + 8]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x4069c7
cmp dword [ebx + 4], 0x50000
jb 0x4069f7
call fcn.0043ee90
cmp eax, 0x400
je 0x4069f7
cmp byte [esp + 0x310], 0
jne 0x406a42
mov ebx, dword [esp + 0x300]
cmp ebx, 0xffffffff
je 0x406a07
test ebp, ebp
jne 0x406a49
cmp dword [esp + 0x2f8], 2
mov eax, 0x4201
jne 0x406a1b
mov eax, 0x4203
push eax
push 0x2b4
lea edx, [esp + 0x40]
push edx
push 0
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp ebx, 0xffffffff
jne 0x406a38
mov ebx, dword [esp + 0x3c]
test ebp, ebp
jne 0x406a49
lea ebp, [esp + 0x44]
jmp 0x406a49
mov ebx, dword [esp + 0x300]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], 0x37
mov dword [esp + 0x18], ebp
test ebp, ebp
jne 0x406a87
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x30c]
mov ecx, dword [esp + 0x308]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x38]
push 0
mov dword [esp + 0x34], ecx
mov ecx, dword [eax]
push 0x40b
push ecx
mov dword [esp + 0x40], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x2ec]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a4b43
add esp, 0x2e0
ret 0x20
Function at 0x407630
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x2d4
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x2d0], eax
push ebx
mov ebx, dword [esp + 0x2e0]
push esi
mov esi, ecx
cmp dword [esi + 4], 0
push edi
mov edi, dword [esp + 0x2e4]
jne 0x40766a
push str.comctl32.dll
call fcn.004849d0
mov dword [esi + 4], eax
mov eax, dword [esi]
test eax, eax
je 0x407677
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [esi + 8], 0xffffffff
mov eax, dword [0x4d76ac]
push eax
push ebx
push edi
push 0xdc
push 0x3c
push 0
push 0
push 0x44200046
push 0
push str.ComboBoxEx32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
mov dword [esi], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 0x10]
push 0x4209
push 0x2b4
lea edx, [esp + 0x1c]
push edx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0
push 0x402
push ecx
call edi
mov eax, dword [0x511094]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push ecx
push eax
call edx
mov ecx, dword [esp + 0x18]
push 0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x2c]
push eax
push ecx
push 0
push 1
mov edx, eax
push edx
mov ecx, esi
call fcn.00406970
mov eax, dword [esi]
push 0
push 4
push 0x408
push eax
call edi
mov ecx, dword [esi]
push 0
push 0
push 0x407
push ecx
call edi
test eax, eax
je 0x40773d
push eax
call fcn.00485d60
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jne 0x407766
push eax
push eax
mov eax, dword [esp + 0x14]
push eax
mov ecx, esi
call fcn.00406e10
test al, al
jne 0x4077bd
push ebp
call fcn.00484d10
mov ebp, eax
xor edi, edi
mov ebx, 1
test ebp, ebx
je 0x4077b4
lea ecx, [edi + 0x41]
push ecx
lea edx, [esp + 0x2d0]
push 0x4ba858
push edx
mov edx, 0xa
call fcn.0049c820
add esp, 0xc
push 1
push 0xffffffffffffffff
push 2
push 0
push 0xffffffffffffffff
push 0
push 0
lea eax, [esp + 0x2e8]
push eax
mov ecx, esi
call fcn.00406970
inc edi
rol ebx, 1
cmp edi, 0x20
jl 0x407775
pop ebp
mov ecx, esi
call fcn.00407390
mov ecx, dword [esp + 0x2dc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a4b43
add esp, 0x2d4
ret 8