joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8a04
Capabilities:
Encode data using xor

Disassembly:
call 0x4c767a
jmp 0x4c7c52
push 0
jmp 0x4c7c9e
lea esp, [esp + 2]
lea esp, [esp + 0x10]
push 0
pushfd
call fcn.004c780d
jne 0x4c7c99
pushal
jmp 0x4c7675
mov eax, dword [esp]
pushal
pop dword [esp + 0x16]
lea esp, [esp + 0x20]
sub eax, 0x43410c9
jmp 0x4c7c70
pushfd
call 0x4c7c43
call 0x4c7c82
dec ecx
push eax
dec eax
dec esp
push eax
inc ecx
push eax
dec ecx
inc esp
dec esp
dec esp
add bl, ch
pop ebx
call 0x4c7c93
ja 0x4c7cfe
jo 0x4c7cff
imul ebp, dword [esi + 0x74], 0xe9005766
rol byte [edx], 1
add byte [eax], al
xor al, 0xe9
push ebx
add dword [eax], eax
add al, ch
add byte [eax], al
add byte [eax], al
jmp 0x4c7df1
call 0x4c7ca3
jmp 0x4c85ad
push ebp
les edx, [esi - 0x77]
sbb al, 0x24
lea esp, [esp + 4]
push 0
jmp 0x4c7c6a
call 0x4c7d92
jmp 0x4c8a10
popfd
ret
mov word [esp], di
mov dword [esp + 9], ebp
push word [esp + 0xb]
jmp 0x4c7c15
pop eax
sub eax, 0x2f4c66b7
jmp 0x4c871f
call 0x4c8642
inc esi
imul ebp, dword [esi + 0x64], 0x646e6957
outsd dx, dword [esi]
ja 0x4c8682
add byte [eax - 0x15], dl
lds esp, [ecx - 0x17]
popal
invalid
inc ecx
invalid
jmp 0x104df0b6
call dword [eax + 0x2f4a7e3e]
jmp 0x4c88c2
add dword [esp + 8], 1
push esp
lea esp, [esp + 4]
popfd
jmp 0x4c8acf
test eax, eax
je 0x4c7bb9
jne 0x4c8631
mov edi, dword [esp + 1]
mov dword [esp], esi
sets ch
mov ch, byte [esp]
mov cx, word [esp]
pushal
jmp 0x4c894e
lea ecx, [ebp + 0x3ac1913f]
not ch
lea edi, [eax*4]
jmp 0x4c8994
mov cx, di
mov di, ax
not di
mov cl, ch
mov cl, byte [esp]
mov ch, bh
jmp 0x4c8904
mov ecx, 0x12dc265a
push dword [esp + 2]
not cl
lea esp, [esp + 2]
mov esi, dword [esp + 0x28]
jmp 0x4c891a
mov esi, 0x466b643c
mov byte [esp + 0x1e], dh
mov di, sp
push edx
pop word [esp + 5]
push edx
jmp 0x4c8935
mov edi, 0x373177ce
not di
push esp
mov edi, dword [esp + 0x34]
lea esp, [esp + 0x38]
jmp 0x4c8a9e
mov edi, dword [esp]
mov edi, 0x3b239746
mov di, word [esp]
jmp 0x4c8963
not di
lea edi, [ebp + 0xdf]
mov ecx, dword [esp + 0x2c]
lea edi, [ebp - 7]
lea edi, [ebp - 0x725fb0d1]
mov di, word [esp]
jmp 0x4c897d
call 0x4c8a04
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
mov byte [eax + 0x22d7b022], 0xa5
jecxz 0x4c8a28
jne 0x4c8a74
pop eax
sub eax, 0x4fd8e32a
jmp 0x4c89f4
dec ecx
fnstcw word [eax - 0x179701b5]
or al, 0
add byte [eax], al
cmp dword [esp + 4], 0
jne 0x4c8833
pushal
jmp 0x4c7d8d
lea esp, [esp + 4]
push dword [esp]
lea esp, [esp + 8]
jmp 0x4c8b87
mov esi, dword [0x33f05377]
lea esp, [esp - 4]
ret

Function at 0x4ca30b
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4b45f7
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x4b4613
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x4b45ff
jmp 0x4b461e
ret
jmp 0x4b45ec
Function at 0x4dfff9
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0
mov edi, dword [ecx - 8]
call fcn.004dff21
mov edi, dword [esi]
pop esi
mov dword [ecx + 4], eax
mov dword [edx + 4], edi
jmp 0x4dffb7
lea esp, [esp + 2]
lea esp, [esp + 0xc]
add ecx, 0x10
pushal
push dword [esp + 0x1e]
jmp 0x4e022b
lea esp, [esp + 0x48]
sub ebx, 4
sub esp, 2
sub esp, 0xc
mov dword [esp + 9], ecx
jmp 0x4dff90
pop di
lea esp, [esp + 2]
mov eax, dword [edx - 8]
jmp 0x4dff5e
cmc
lea esp, [esp + 0x24]
sub edx, 0x10
cmp dword [ebp - 4], ebx
call fcn.004e017e

Function at 0x4e00eb
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
lea esp, [esp + 0x1b]
lea esp, [esp + 1]
jmp 0x4e079f
xchg ebx, edi
jmp 0x4e00f5
lea esp, [esp + 0x24]
lea ecx, [eax - 1]
mov di, bx
mov ebx, 0xd8e06992
lea ebx, [ebp*4]
mov ebx, ebp
jmp 0x4e00d0
jle 0x4b2750
mov cl, 0x72
sub esp, 4
pushal
xchg ecx, ebx
jmp 0x4e00a0
push edi
pushal
lea esi, [ebp + 0x6c78438f]
lea ecx, [esi*4]
jmp 0x4e0156
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x4e00c0
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + 0x4bc734]
mov dh, byte [esp]
mov di, word [esp]
jmp 0x4e0139
mov dword [edi], ecx
pop edi
mov edi, 0xe7a778c
mov ecx, 0xff
jmp 0x4b27ac
xchg dh, dl
mov edx, dword [esp]
jmp 0x4e0166
inc dx
mov edi, dword [esp]
add esi, 0x10
ror edx, 0x13
lea edi, [eax + edx]
jmp 0x4e0123
mov dword [esp], ebp
sub esp, 0x18
lea esp, [esp + 0x18]
popal
lea edi, [edi - 4]
jmp 0x4e0111
push eax
mov eax, esi
mov edx, dword [eax]
pop eax
jmp 0x4e0211
push ebp
mov ebp, edi
lea ebp, [ebp*4]
jmp 0x4e01f5
and edi, ecx
jmp 0x4e0183
lea esp, [esp + 2]
shr edi, 0x18
pushal
mov edi, dword [edi*4 + 0x4bc734]
jmp 0x4e01a2
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + 0x4bd334]
mov bl, pe_nt_image_headers32
jmp 0x4e03d3
lea ebp, [ebp + 0x4bcb34]
mov edi, dword [ebp]
pop ebp
jmp 0x4e01ca
mov edi, edx
clc
clc
pushal
push word [esp + 3]
jmp 0x4e01b9
sub bl, ch
lea ebx, [ecx*4]
setbe bh
movzx ebx, byte [esi + 2]
clc
call fcn.004e01de
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + 0x4bcf34]
clc
stc
movzx ebx, byte [esi + 9]
jmp 0x4e0417
and edx, ecx
stc
sub esp, 2
lea esp, [esp + 2]
jmp 0x4e047d
mov edx, dword [edx*4 + 0x4bc734]
push esp
push dword [esp + 2]
and edx, ecx
jmp 0x4e045a
mov edi, dword [esp + 4]
mov bl, 0xa8
mov bl, 0xec
jmp 0x4e0be9
lea ebx, [ebx + ebp]
lea esp, [esp + 4]
lea esp, [esp + 8]
pop esi
lea ebx, [esi*4]
push esp
xchg dword [esp], ebx
jmp 0x4e0bd0

Function at 0x4e0430
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and ebx, ecx
cmc
push edx
mov word [esp], di
jmp 0x4e03e9
pop word [esp]
mov byte [esp], bh
lea esp, [esp + 2]
jmp 0x4e040d
Function at 0x4e0506
Capabilities:
Encrypt data using aes

Disassembly:
cmc
setle bl
movzx ebx, byte [esi + 0xa]
jmp 0x4e04b5
movzx ebx, byte [esi + 0xd]
pushal
mov word [esp + 0xc], sp
mov dword [esp + 5], ebp
add esp, 1
jmp 0x4e054a
lea esp, [esp + 3]
lea esp, [esp + 1]
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + 0x4bcf34]
jmp 0x4e04eb
lea esp, [esp + 3]
and edx, ecx
cmc
call fcn.004e0532
sti
outsd dx, dword [esi]
call [edx - 0x7fec4e97]
push ss
jno 0x4e04e1
xor al, 0xbd
mov word [edi], ds
lea di, [edi*4]

Function at 0x4e0532
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x4e059b
clc
pop word [esp]
jmp 0x4e051b
clc
stc
sub esp, 2
lea esp, [esp + 1]
lea esp, [esp + 1]
jmp 0x4e05ee
mov edx, dword [edx*4 + 0x4bc734]
sub esp, 0xe
lea esp, [esp + 2]
and edx, ecx
jmp 0x4e057c
pushal
mov dword [esp + 8], esi
push esp
stc
push dword [esp]
jmp 0x4e0638
lea esp, [esp + 0x28]
xor edi, dword [edx*4 + 0x4bd734]
mov edx, 0xa45d4e36
push ebp
jmp 0x4e05d0
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + 0x4bc734]
call fcn.004e0646
cli
not dword [bp + si - 0x549f]
add byte [eax + 0x2c98690e], bl
jne 0x4e0682
pop ebp
cmc
push edx
push esp
cmc
jmp 0x4e0601
push edx
lea esp, [esp + 0xc]
popal
lea ebp, [ebp + 0xc]
mov edx, dword [ebp]
jmp 0x4e061e
shr edi, 0x18
pushal
push dword [esp + 8]
jmp 0x4e06b0
or al, 0xce
xor esi, dword [ecx + 0x6b34021]
xor byte [eax - 0x79], ah
out dx, al
rcr ebx, 0x19
mov dword [esp], edx
popal
jmp 0x4e066e
mov edi, dword [edi*4 + 0x4bc734]
sub esp, 0x1c
and edi, ecx
jmp 0x4e07f4
and edx, ecx
call fcn.004e06e8
lea esp, [esp + 8]
xor edi, dword [ebx*4 + 0x4bcf34]
call 0x4e0727
shr al, 0x39
add byte [eax], al
add byte [ecx + 0x1f29707], cl
mov esp, 0x492eb831
mov eax, 0x5951979
insb byte es:[edi], dx
lahf
das
test byte [edi], dh
add esp, 1
lea esp, [esp + 3]
and ebx, ecx
cmc
jmp 0x4e0716
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + 0x4bc734]
push esp
mov word [esp], bx
jmp 0x4e070f
bswap ebx
xchg bl, bh
mov bl, byte [esp]
neg ebx
jmp 0x4e078a
mov edi, dword [edi*4 + 0x4bcb34]
and ebx, ecx
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + 0x4bd334]
jmp 0x4e07d8

Function at 0x4e4fca
Capabilities:
Hash data with md5

Disassembly:
pop edi
bt ebx, edx
sub bl, ch
jmp 0x4e5536
cmc
call fcn.004e4fe4
lea esp, [esp + 4]
je 0x4e4e91
jne 0x4e4fce
movsb byte es:[edi], byte [esi]
xor al, 0xaa
int 0x3c
mov dword [edx + 0x23d0b121], esi
xchg edx, eax
loopne 0x4e4fea
pop edx
mov ch, 0xa4
mov dword [esi], edx
jmp 0x4e4fa7
push ebp
jmp 0x4e4f2d
push esp
jmp 0x4e4fad
setp bl
mov bl, byte [esp]
jmp 0x4e555b
pop ebx
sub esp, 4
jmp 0x4e55d3
lea esp, [esp + 4]
add esp, 0x40
call 0x4e55a3

Function at 0x4e5551
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 0x24]
pop ebp
jmp 0x4e4e91
bswap ebp
lea ebp, [eax + 0x37917a61]
jmp 0x4e552c
Function at 0x4e5d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], eax
pop word [esp]
jmp 0x4e5dd7
lea esp, [esp + 0x20]
lea eax, [esp + 0xc]
pushal
pop dword [esp + 0xa]
call 0x4e5e26
pop esp
aad 0x45
sub al, 0xdf
sbb esp, eax
ja 0x4e5e1d
lea esp, [esp + 0x20]
lea ecx, [esi + 8]
lea eax, [esi*4]
mov eax, dword [esp]
pushal
jmp 0x4e5da4
lea esp, [esp + 2]
jb 0x4e581e
push esp
pop ecx
pushal
jmp 0x4e5dbf
jmp 0x4e5e2b
pop ecx
salc
inc esp
and ebx, esi
sbb bh, al
outsb dx, byte [esi]
jns 0x4e5e0f
sar edi, 1
invalid
lea esp, [esp + 0x18]
movzx eax, byte [ecx]
mov edi, ecx
jmp 0x4e5f9e
lea esp, [esp + 8]
mov byte [esi + 0x59], cl
call fcn.004e5e8a
mov byte [esi + 0x58], al
mov dl, byte [esp]
movzx ecx, byte [esi + 9]
sub esp, 8
jmp 0x4e5f01

Function at 0x4e5df2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add eax, 8
stc
cmp ecx, 0xe
call fcn.004e5d80
clc
lea esp, [esp + 4]
add ecx, 2
jmp 0x4e5d98

Function at 0x61d565
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 6
push esp
mov edi, 0x715d9a76
xchg dword [esp + 0xc], edi
mov dx, word [esp + 4]
mov si, 0x9bc9
jmp 0x61d400
mov ax, dx
cpuid
xchg ch, dl
push word [esp + 1]
xchg byte [esp + 8], bl
pop si
jmp 0x61d389
lea ebp, [esp + edi]
mov edx, 0x74891eec
xchg di, bp
mov dx, sp
xchg byte [esp + 0xb], al
mov dword [esp + 5], ecx
jmp 0x61d419
xchg dword [esp + 8], ebp
xchg ebp, edx
rdtsc
and ebx, ecx
mov edi, 0xf3573ab6
not ax
jmp 0x61d3c5
mov byte [esp + 9], bh
xchg dx, ax
mov ecx, 0x20341232
xchg byte [esp + 7], al
pop dword [esp + 8]
sete ch
jmp 0x61d3e4
cld
rdtsc
btr ebp, edx
not dh
push edx
lea esp, [esp + 3]
jmp 0x61d478
ror esi, 1
pop word [esp + 7]
mov word [esp + 4], di
pop bp
bswap ecx
xchg dword [esp + 2], ecx
jmp 0x61d3b1
push word [esp + 0xe]
xchg dword [esp + 4], edx
xchg dh, al
call 0x61d460
cwde
xchg bx, di
mov cx, 0xfbab
btr ebp, esp
jmp 0x61d544
mov edx, ebp
not bx
xchg ebx, esi
lea ebp, [ebx*4]
lea edi, [esp + ebp]
mov dword [esp + 9], eax
jmp 0x61d44f
mov eax, dword [esp + 0x17]
rcr eax, 0x1f
not cx
bswap ecx
mov dword [esp + 0x1d], ecx
popal
jmp 0x61d436
and cl, bh
push dword [esp + 7]
push word [esp + 3]
add esp, 9
mov ch, byte [esp + 9]
mov al, 0xbe
call fcn.0061d515
scasd eax, dword es:[edi]
cmp ch, byte [eax - 0x646cc531]
bnd jmp 0x61d4a4
jmp 0x61d4a4
jmp 0x61d4a4
Function at 0x61d976
Capabilities:
Execute anti-debugging instructions

Disassembly:
popal
jmp 0x61d9c1
lea ecx, [edi + edi]
pop dx
xchg word [esp + 0xa], ax
pop word [esp + 8]
jmp 0x61d9f5
lea esp, [esp + 3]
cpuid
xchg byte [esp + 6], dl
clc
mov dl, dh
clc
jmp 0x61d979
xchg dword [esp + 8], eax
push dword [esp + 7]
add esp, 0x10
mov dh, byte [esp]
mov byte [esp], ah
bswap ebx
jmp 0x61da88
mov ebp, 0xb2668652
mov ebp, ecx
inc edx
mov esi, 0xfd93f4ec
lea ebx, [ebx*4]
lea ebx, [ecx + edi]
jmp 0x61da5e
mov ax, bx
mov al, 0x1e
rdtsc
mov al, ah
lea ebx, [esi - 0xe5]
mov ebp, dword [esp + 0x23]
jmp 0x61da27
inc al
xchg ecx, edi
pop word [esp + 0x19]
neg ebx
rdtsc
neg si
jmp 0x61daf8
sub esp, 4
mov ebx, dword [esp]
xchg ebx, eax
mov ah, byte [esp + 2]
pushal
cmc
jmp 0x61da49
xchg word [esp + 4], dx
xchg bp, di
mov word [esp], bx
rdtsc
mov word [esp + 3], di
jmp 0x61dbe4
pop word [esp + 0x10]
add esp, 0xa
push dword [esp + 8]
lea ecx, [edx + edi]
mov ebx, 0xc967b4bc
xchg cx, bx
jmp 0x61dab6
xchg ebp, esi
lea esp, [esp + 6]
mov dword [esp + 0xe], ebp
mov word [esp + 0x13], dx
pop cx
mov ebx, 0x5ef83f7e
jmp 0x61dad4
mov word [esp + 2], di
stc
call 0x61db1c
stosb byte es:[edi], al
mov ecx, esi
lea ebx, [esi + 0x2d]
and cl, bh
xchg ebx, edi
jmp 0x61db68
cpuid
mov ecx, dword [esp + 3]
mov bh, byte [esp + 4]
push dword [esp + 5]
xchg dh, al
pop word [esp]
jmp 0x61db10
lea esi, [esi - 0x30c9db4b]
mov dx, word [esp + 9]
xchg word [esp + 0xa], bp
sub bl, ah
mov si, word [esp]
jmp 0x61dbcb
add esp, 0xa
push edx
pop dword [esp + 1]
push esp
mov di, 0x31a1
jmp 0x61db4a
mov ecx, dword [esp + 0xf]
mov dword [esp + 7], ecx
inc bx
bswap edx
cmc
mov dword [esp + 7], eax
jmp 0x61db34
push dword [esp + 7]
mov cl, 0xb2
lea ecx, [ebx*4]
setnp ch
add esp, 3
bsr bp, cx
jmp 0x61dd6c
pop si
xchg bx, bp
pop ax
clc
push dword [esp + 8]
inc edi
jmp 0x61db92
mov word [esp + 0xe], bx
pop eax
sub esp, 6
pop dword [esp]
mov byte [esp + 5], bh
add edx, ebp
jmp 0x61dbb1
lea ecx, [eax + 0x40abefb9]
bsr cx, bp
mov ah, byte [esp + 6]
xchg bh, cl
mov edi, dword [esp + 9]
lea edx, [ecx + 0xf3]
jmp 0x61db7f
mov ebx, eax
lea edx, [ebx*4]
mov di, word [esp]
inc eax
mov dl, 0x5c
mov al, ah
jmp 0x61dc55
xchg ch, dl
mov eax, 0xcd16def4
lea ebp, [edi + ebp]
bswap esi
rol bp, cl
mov edi, 0x384fca84
jmp 0x61dc03
push edx
xchg cx, bp
and cx, 0x58a
clc
lea esi, [ecx - 0xbb]
pop ecx
call fcn.0061dca5
xchg esp, eax
xchg bh, cl
rdtsc
mov byte [esp], bh
mov byte [esp], ch
inc di
rcr ch, 5
jmp 0x61dc3d
cpuid
not ch
xchg byte [esp], dl
lea esp, [esp]
mov ecx, dword [esp]
cpuid
jmp 0x61dc27
xchg byte [esp + 0x12], bl
neg bh
xchg dword [esp + 0xa], ebp
mov byte [esp + 0xf], ch
lea esp, [esp + 0x15]
xchg byte [esp], bl
jmp 0x61dc73
push dword [esp + 0x10]
mov bx, dx
mov ah, byte [esp + 1]
mov cl, 0xea
cld
pop word [esp + 5]
jmp 0x61dcc6
cld
mov eax, dword [esp + 0xd]
pop si
push dword [esp + 0xc]
xchg word [esp + 0xb], dx
xchg dword [esp + 0xa], ebx
jmp 0x61dcef
Function at 0x61dca5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edi, esi
mov si, di
cpuid
sub esp, 0x14
sub esp, 0xe
sub esp, 0x18
jmp 0x61dca7
jmp 0x61dc84
pushal
lea esp, [esp + 0x5f]
btc ecx, ebx
mov ecx, dword [esp]
mov dl, byte [esp]
mov si, 0xcf51
jmp 0x61dd30
pop word [esp]
sub esp, 0x12
sub esp, 0
xchg word [esp + 7], cx
cpuid
btc ebx, ebx
jmp 0x61dd43
mov ch, byte [esp + 0x15]
bswap eax
xchg byte [esp + 0x17], bl
pop dword [esp + 4]
stc
jmp 0x61df38
rdtsc
xchg dh, al
mov bl, bh
push esp
lea ebx, [ecx*4]
setne bh
jmp 0x61dd04
lea eax, [ebp*4]
sub esp, 0xa
mov ax, di
push word [esp + 0xb]
xchg byte [esp + 0x1c], al
rdtsc
jmp 0x61dd1a
inc di
shr ecx, 0xb
mov ch, byte [esp + 7]
cpuid
xchg word [esp + 0xd], bx
jmp 0x61ddfc
pop dword [esp + 0x1c]
setbe ch
mov cl, ch
mov ecx, 0x5b8f626e
bsr dx, cx
lea ebp, [ecx*4]
jmp 0x61dd85
stc
setno ch
xchg esi, edx
lea edi, [edx*4]
mov cx, word [esp + 0xc]
mov esi, dword [esp + 0xb]
jmp 0x61dd9e
push edx
mov al, ah
mov bx, 0x557
mov di, dx
mov edi, dword [esp + 4]
cmc
jmp 0x61de97
lea esp, [esp + 0x15]
mov dl, 4
mov edi, esi
pop bx
mov edx, 0x195a7dd0
bsf cx, si
jmp 0x61dde4
cld
setne dh
pop si
inc esi
mov al, ah
mov ax, di
call fcn.0061de2a
lea esp, [esp]
rcr ebx, 0x1f
mov di, word [esp]
push edx
not ecx
rdtsc
jmp 0x61de43
rdtsc
lea esp, [esp + 0xe]
xchg bh, cl
bsr ax, bp
cpuid
sete bh
jmp 0x61de71
pop bx
mov dh, byte [esp + 0x29]
pop eax
xchg byte [esp + 0x10], al
mov cl, 0x5a
mov word [esp + 0x16], sp
jmp 0x61ddcc
mov byte [esp + 0xb], ah
mov dh, byte [esp + 0xf]
bsf cx, si
not ah
push dword [esp + 0x12]
sub esp, 0xc
jmp 0x61df03

Function at 0x61dfd0
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
btc edx, ebx
mov dl, 0xf4
mov cx, dx
rdtsc
bsr bp, bp
jmp 0x61dfaa
pop ebp
bswap eax
not ebx
mov bp, word [esp]
mov bl, bh
mov edx, 0x4a28861c
jmp 0x61df4f
mov ebx, 0x1d12437c
push esp
xchg ecx, edx
xchg byte [esp + 0x12], al
lea ecx, [esi + 0x25]
jmp 0x61dff2
mov bx, 0x4923
mov eax, ecx
not bp
lea ebp, [esp + esi]
xchg word [esp], cx
pushal
jmp 0x61df7a
mov bx, di
sub esp, 2
bsr ax, cx
mov dh, byte [esp + 1]
neg di
lea esi, [ebp + 0xaf]
jmp 0x61df91
mov dword [esp], esi
bsf bp, si
jmp 0x61df68
xchg esi, ebx
neg dh
bsf bp, ax
lea esp, [esp + 3]
bsr bp, bp
neg bh
jmp 0x61e080
mov ebx, dword [esp + 0x1c]
mov al, ah
lea esp, [esp + 0x21]
xchg dword [esp], eax
mov ch, byte [esp + 3]
jmp 0x61dfd9
lea edi, [ebx + edi]
mov dx, 0x5591
cpuid
setp dh
mov esi, dword [esp + 0xb]
ror dh, 7
jmp 0x61e019
shr ch, 5
push dword [esp + 0x17]
mov dword [esp + 0x18], ecx
mov dl, dh
mov bl, 0x80
lea ebp, [ebp*4]
jmp 0x61e03a
btc ebx, ebx
mov dl, dh
sub esp, 0x16
stc
xchg word [esp + 9], di
lea ecx, [ecx + ebx]
jmp 0x61e05b

Function at 0x620286
Capabilities:
Parse pe header

Disassembly:
mov dword [esp], esi
pushal
call fcn.00620292
lodsb al, byte [esi]
cmp eax, 0xac47b4ad
sahf
push cs
pushfd
sti
push ss
mov cl, 0x1f
xchg cx, ax
adc byte [eax - 0x7699dbd4], cl
mov byte [esp], ch
mov word [esp], di
mov byte [esp], ch
mov word [esp], di
mov byte [esp], dh
jmp 0x62026d
Function at 0x620292
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x64], esi
call 0x62029c
xchg ebx, eax
push dword [esp + 2]
mov word [esp + 2], dx
pop dword [esp]
jmp 0x6202ec
pop word [esp]
lea esp, [esp + 1]
call fcn.006202d1
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x620382
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x61f015

Function at 0x62029c
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x64], esi
call 0x62029c
xchg ebx, eax
push dword [esp + 2]
mov word [esp + 2], dx
pop dword [esp]
jmp 0x6202ec
pop word [esp]
lea esp, [esp + 1]
call fcn.006202d1
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x620382
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x61f015

Function at 0x6202d1
Capabilities:
Parse pe header

Disassembly:
mov eax, dword fs:[0x30]
jmp 0x6202f9
lea esp, [esp + 4]
lea esp, [esp + 1]
mov dword [esp + 0x60], edi
lea esp, [esp + 0x60]
jmp 0x6202bb
Function at 0x411590
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47f79b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00472081
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x411612
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046f9fd
mov eax, dword [eax]
push 0x4b41f0
push eax
call fcn.00461d84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047230c
test bl, bl
je 0x411612
push 0x4b41f0
lea ecx, [esp + 0xc]
call fcn.004726e8
push 0x4b7d5c
lea ecx, [esp + 0xc]
call fcn.004726e8
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41164e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047230c
jmp 0x411719
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4116d2
lea edx, [esp + 0x7c]
push 0x4b7d58
push edx
call fcn.00461d84
add esp, 8
test eax, eax
je 0x4116d2
lea eax, [esp + 0x7c]
push 0x4b7d54
push eax
call fcn.00461d84
add esp, 8
test eax, eax
je 0x4116d2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x411662
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047230c
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x411f10
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x411f72
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x411f80
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47f81b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4c0d18]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4120b8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x411fe6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047230c
xor eax, eax
jmp 0x41212f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00472495
push esi
lea ecx, [esp + 0xc]
call fcn.00472724
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41210d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocStringLen
call fcn.00411f10
test eax, eax
jne 0x41210d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocStringLen
mov ecx, edi
call fcn.00411f10
test eax, eax
jne 0x41210d
lea eax, [esp + 0x14]
push 0x4b7d70
push eax
call fcn.00462f30
mov esi, eax
add esp, 8
test esi, esi
jne 0x4120ec
lea ecx, [esp + 0x14]
push 0x4b7d6c
push ecx
call fcn.00462eb0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4120ec
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4120ef
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00472445
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x411ffe
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047230c
xor eax, eax
jmp 0x41212f
mov byte [esi], 0
push 0x4b7d68
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0047230c
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4