joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430cb6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
jne 0x430cd6
xor eax, eax
jmp 0x430e3c
mov eax, dword [ebp + 8]
sar eax, 5
lea ebx, [eax*4 + 0x45a6ee]
mov eax, dword [ebp + 8]
and eax, 0x1f
lea esi, [eax + eax*8]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x430d06
push 2
push edi
push dword [ebp + 8]
call fcn.0042e522
add esp, 0xc
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x430dd5
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], eax
mov dword [ebp + 8], edi
jbe 0x430e10
lea eax, [ebp - 0x414]
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp + 0x10]
jae 0x430d60
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
mov cl, byte [ecx]
cmp cl, 0xa
jne 0x430d4b
inc dword [ebp - 0x10]
mov byte [eax], 0xd
inc eax
mov byte [eax], cl
inc eax
mov ecx, eax
lea edx, [ebp - 0x414]
sub ecx, edx
cmp ecx, 0x400
jl 0x430d2c
mov edi, eax
lea eax, [ebp - 0x414]
sub edi, eax
lea eax, [ebp - 0xc]
push 0
push eax
lea eax, [ebp - 0x414]
push edi
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x430dca
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], eax
cmp eax, edi
jl 0x430d9c
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jb 0x430d26
xor edi, edi
mov eax, dword [ebp - 8]
cmp eax, edi
jne 0x430e39
cmp dword [ebp + 8], edi
je 0x430e10
push 5
pop esi
cmp dword [ebp + 8], esi
jne 0x430e02
call fcn.0042e1be
mov dword [eax], 9
call fcn.0042e1c7
mov dword [eax], esi
jmp 0x430e0b
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x430d9c
lea ecx, [ebp - 0xc]
push edi
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x430df7
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], edi
mov dword [ebp - 8], eax
jmp 0x430d9e
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x430d9e
push dword [ebp + 8]
call fcn.0042e14b
pop ecx
or eax, 0xffffffff
jmp 0x430e3c
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x430e25
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
je 0x430ccf
call fcn.0042e1be
mov dword [eax], 0x1c
call fcn.0042e1c7
mov dword [eax], edi
jmp 0x430e0b
sub eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4328c8
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x43292c
push 0x3d
push dword [ebp + 8]
call fcn.00432e84
mov esi, eax
pop ecx
cmp esi, edi
pop ecx
mov dword [ebp - 8], esi
je 0x43292c
cmp dword [ebp + 8], esi
je 0x43292c
mov eax, dword [0x459202]
xor ebx, ebx
cmp byte [esi + 1], bl
sete bl
cmp eax, dword [0x459206]
jne 0x432912
push eax
call fcn.00432aa7
pop ecx
mov dword [0x459202], eax
cmp eax, edi
jne 0x43296a
cmp dword [ebp + 0xc], edi
je 0x432934
cmp dword [0x45920a], edi
je 0x432934
call fcn.00432395
test eax, eax
je 0x43296a
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp ebx, edi
jne 0x432a48
push 4
call fcn.0042d3fb
cmp eax, edi
pop ecx
mov dword [0x459202], eax
je 0x43292c
mov dword [eax], edi
cmp dword [0x45920a], edi
jne 0x43296a
push 4
call fcn.0042d3fb
cmp eax, edi
pop ecx
mov dword [0x45920a], eax
je 0x43292c
mov dword [eax], edi
sub esi, dword [ebp + 8]
mov edi, dword [0x459202]
mov dword [ebp - 4], edi
push esi
push dword [ebp + 8]
call fcn.00432a4f
mov esi, eax
pop ecx
test esi, esi
pop ecx
jl 0x4329ca
cmp dword [edi], 0
je 0x4329ca
test ebx, ebx
je 0x4329c2
push dword [edi + esi*4]
lea edi, [edi + esi*4]
call fcn.0042d76d
pop ecx
cmp dword [edi], 0
je 0x4329ac
mov eax, dword [edi + 4]
inc esi
mov dword [edi], eax
add edi, 4
jmp 0x43299c
mov eax, esi
shl eax, 2
push eax
push dword [ebp - 4]
call fcn.00432b55
pop ecx
test eax, eax
pop ecx
je 0x4329fc
jmp 0x4329f7
mov eax, dword [ebp + 8]
mov dword [edi + esi*4], eax
jmp 0x4329fc
test ebx, ebx
jne 0x432a48
test esi, esi
jge 0x4329d4
neg esi
lea eax, [esi*4 + 8]
push eax
push edi
call fcn.00432b55
pop ecx
test eax, eax
pop ecx
je 0x43292c
mov ecx, dword [ebp + 8]
mov dword [eax + esi*4], ecx
and dword [eax + esi*4 + 4], 0
mov dword [0x459202], eax
cmp dword [ebp + 0xc], 0
je 0x432a48
push dword [ebp + 8]
call fcn.0042e81f
inc eax
inc eax
push eax
call fcn.0042d3fb
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x432a48
push dword [ebp + 8]
push esi
call fcn.00430a64
mov eax, esi
pop ecx
sub eax, dword [ebp + 8]
pop ecx
add eax, dword [ebp - 8]
and byte [eax], 0
inc eax
neg ebx
sbb ebx, ebx
not ebx
and ebx, eax
push ebx
push esi
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
push esi
call fcn.0042d76d
pop ecx
xor eax, eax
jmp 0x43292f
Function at 0x435648
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
xor eax, eax
pushal
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x43573d
mov dword [ebp - 0x174], eax
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebp - 0x170], eax
push 0x80000
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebp - 0x164], eax
push 0x6277
push esp
push dword [ebp + 0xc]
call fcn.00437cea
add esp, 8
add esp, 4
test eax, eax
je 0x435731
mov dword [ebp - 0x16c], eax
xor ebx, ebx
cmp ebx, dword [ebp - 0x170]
jae 0x43571b
lea eax, [ebp - 0x168]
mov ecx, dword [ebp - 0x170]
sub ecx, ebx
cmp ecx, 0x80000
jbe 0x4356e3
mov ecx, 0x80000
push 0
push eax
push ecx
push dword [ebp - 0x164]
push dword [ebp - 0x174]
call dword [sym.imp.kernel32.dll_ReadFile]
push dword [ebp - 0x168]
push dword [ebp - 0x164]
push dword [ebp - 0x16c]
call fcn.00438395
add esp, 0xc
add ebx, dword [ebp - 0x168]
jmp 0x4356c0
push dword [ebp - 0x16c]
call fcn.00438481
add esp, 4
mov dword [esp + 0x1c], 1
push dword [ebp - 0x174]
call dword [sym.imp.kernel32.dll_CloseHandle]
popal
leave
ret 8
Function at 0x438395
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
test ebx, ebx
je 0x4383b1
cmp byte [ebx + 0x5c], 0x77
je 0x4383bd
mov eax, 0xfffffffe
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [ebx], edi
test esi, esi
mov dword [ebx + 4], esi
je 0x438456
lea esi, [esi]
lea edi, [edi]
mov edx, dword [ebx + 0x10]
test edx, edx
jne 0x438408
mov ecx, dword [ebx + 0x48]
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0xc], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4000
mov dword [esp + 4], 1
mov dword [esp], ecx
call sub.msvcrt.dll_fwrite
cmp eax, 0x4000
jne 0x438478
mov dword [ebx + 0x10], 0x4000
mov edx, dword [ebx + 4]
xor ecx, ecx
add dword [ebx + 0x68], edx
mov edx, dword [ebx + 0x10]
adc dword [ebx + 0x6c], ecx
xor ecx, ecx
add dword [ebx + 0x70], edx
adc dword [ebx + 0x74], ecx
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.00438fdc
mov dword [ebx + 0x38], eax
mov edx, dword [ebx + 4]
xor ecx, ecx
sub dword [ebx + 0x68], edx
mov edx, dword [ebx + 0x10]
sbb dword [ebx + 0x6c], ecx
xor ecx, ecx
sub dword [ebx + 0x70], edx
sbb dword [ebx + 0x74], ecx
test eax, eax
jne 0x438456
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4383ce
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov edi, dword [ebx + 0x4c]
mov dword [esp], edi
call fcn.00437a35
mov dword [ebx + 0x4c], eax
mov eax, esi
mov esi, dword [ebx + 4]
sub eax, esi
jmp 0x4383b6
mov dword [ebx + 0x38], 0xffffffff
jmp 0x438456
Function at 0x438924
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
test ebx, ebx
je 0x43893f
cmp byte [ebx + 0x5c], 0x77
je 0x43894c
mov eax, 0xfffffffe
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx + 4], 0
mov edx, dword [ebx + 0x10]
lea esi, [esi]
lea edi, [edi]
mov ecx, 0x4000
mov esi, ecx
sub esi, edx
jne 0x4389d2
test edi, edi
jne 0x4389cd
mov edi, dword [ebx + 0x10]
xor ecx, ecx
add dword [ebx + 0x70], edi
adc dword [ebx + 0x74], ecx
xor edi, edi
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.00438fdc
mov dword [ebx + 0x38], eax
mov edx, dword [ebx + 0x10]
sub dword [ebx + 0x70], edx
sbb dword [ebx + 0x74], edi
test esi, esi
jne 0x438997
cmp eax, 0xfffffffb
je 0x4389c4
mov esi, dword [ebx + 0x10]
xor edi, edi
test esi, esi
mov edx, esi
jne 0x4389bf
mov eax, dword [ebx + 0x38]
cmp eax, 1
je 0x4389b8
cmp eax, 1
jbe 0x43895a
cmp eax, 1
jne 0x438944
xor eax, eax
jmp 0x438944
mov edi, 1
jmp 0x4389aa
mov eax, dword [ebx + 0x38]
jmp 0x4389b8
mov dword [ebx + 0x38], 0
jmp 0x438997
mov eax, dword [ebx + 0x38]
jmp 0x4389af
mov ecx, dword [ebx + 0x40]
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp + 0xc], ecx
mov edx, dword [ebx + 0x48]
mov dword [esp], edx
call sub.msvcrt.dll_fwrite
cmp eax, esi
jne 0x438a06
mov dword [ebx + 0x10], 0x4000
mov edx, dword [ebx + 0x48]
mov dword [ebx + 0xc], edx
jmp 0x438965
mov dword [ebx + 0x38], 0xffffffff
mov eax, 0xffffffff
jmp 0x438944
Function at 0x443cf0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [esi]
mov ecx, edx
xor ecx, eax
and ecx, 0xff
mov ecx, dword [edi + ecx*4]
shr edx, 8
xor ecx, edx
mov edx, dword [esi + 4]
mov dword [esi], ecx
and ecx, 0xff
add ecx, edx
mov edx, dword [esi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 4], ecx
shr ecx, 0x18
xor ecx, edx
push ebx
and ecx, 0xff
mov ebx, dword [edi + ecx*4]
shr edx, 8
xor edx, ebx
mov dword [esi + 8], edx
pop ebx
ret

Function at 0x443d40
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, eax
xor eax, eax
mov dword [edx], 0x12345678
mov dword [edx + 4], 0x23456789
mov dword [edx + 8], 0x34567890
mov al, byte [esi]
test al, al
je 0x443da7
push ebx
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov eax, dword [edi + eax*4]
shr ecx, 8
xor eax, ecx
mov ecx, dword [edx + 4]
mov dword [edx], eax
and eax, 0xff
add eax, ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
mov ebx, dword [edi + eax*4]
shr ecx, 8
xor ecx, ebx
inc esi
mov dword [edx + 8], ecx
mov al, byte [esi]
test al, al
jne 0x443d60
pop ebx
pop esi
ret
Function at 0x854d5e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, ch
bsr ax, sp
jge 0x854d69
sub esp, 0x10
jmp 0x854d77
lea esp, [esp + 4]
add cl, 0xa9
bswap eax
jmp 0x854d45
sub esp, 0x10
mov dx, 0xff06
jmp 0x854dd2
mov dx, 0xff06
bswap edx
push word [esp + 5]
mov al, byte [esp + 0xb]
jmp 0x854db0
bswap edx
push word [esp + 5]
mov al, byte [esp + 0xb]
jmp 0x854db0

Function at 0x8560e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esp, eax
jmp 0x8560c1
jmp 0x856093
push edi
call fcn.008560ff
mov al, 0x3f
scasd eax, dword es:[edi]
retf 0xf739
pushfd
lea esi, [eax + ecx - 0x40]
push esi
jmp 0x8560ab
add esp, 0xb
je 0x8560a9
jne 0x856093

Function at 0x8560e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], ah
xchg dword [esp + 4], ebx
sub esp, 1
sub esp, 0x14
jmp 0x85613c
lea esp, [esp + 1]
lea ebx, [ebx + 0x18]
call fcn.00856123
rep movsb byte es:[edi], byte [esi]
jmp 0x85617b
popfd
jmp fcn.008557f3
pop ecx
pop edi
pop esi
jmp 0x856165
Function at 0x8a9696
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
call fcn.008a8594
adc al, 0x40
rol byte [eax + 0x27], cl
shl byte [ecx - 0x3e], cl
push edi
invalid
pop esi
mov bl, dl
xchg bh, bl
jmp 0x8a879b
inc ebx
clc
cmp ebx, esi
jmp 0x8a9590
add eax, dword [eax + 4]
push si
lea esp, [esp + 2]
jmp 0x8a884c
mov cx, word [eax + ebx*2 + 8]
jmp 0x8a84c2
btr edx, esi
mov dx, cx
jmp 0x8a839a
mov dh, byte [esp]
jmp 0x8a83b7
mov edx, dword [eax + 4]
sub esp, 0x18
lea esp, [esp + 0x18]
test edx, edx
call 0x8a83c9
insd dword es:[edi], dx
jmp 0x8a8415
pop word [esp + 0xb]
lea esp, [esp + 2]
jmp 0x8a845e
lea esp, [esp + 4]
je 0x8a81d7
cmp edx, 8
call fcn.008a83e9
lea esp, [esp + 8]
jb 0x8a81d7
pushal
mov dword [esp + 0x19], esi
jmp 0x8a83fb
lea esp, [esp + 0x40]
jb 0x8a81d7
jae 0x8a8469
sub eax, 0xaf5c35a5
push ds
push esp
invalid
lea esp, [esp + 0x1c]
cmp dword [ebp + 8], edx
pushal
pushal
jmp 0x8a8448
lea esi, [edx - 8]
jmp 0x8a8553
mov edx, 0x3000
sub esp, 0x1d
sub esp, 0x11
lea esp, [esp + 2]
jmp 0x8a84e9
mov edx, dword [esp]
sub esp, 0x12
mov dx, si
adc dx, ax
lea esp, [esp + 2]
jmp 0x8a8492
mov edx, 0xf000
sub esp, 0xf
lea esp, [esp + 3]
and cx, dx
jmp 0x8a84a8
movzx ecx, word [eax + ebx*2 + 8]
mov edx, ecx
setb dl
sub esp, 0xa
jmp 0x8a84fc
cmp cx, dx
lea esp, [esp + 0x48]
jne 0x8a8205
mov dx, word [esp]
jmp 0x8a84d3
lea esp, [esp + 2]
jmp 0x8a8536
pop ebx
je 0x8a822e
jne 0x8a8244
add ecx, dword [eax]
jmp 0x8a855f
lea esp, [esp + 8]
and ecx, 0xfff
jmp 0x8a8520
shr esi, 1
push 0
bswap ebx
mov bx, 0x1982
jmp 0x8a8513
lea edx, [ecx + edi]
setp ch
mov ecx, dword [ebp - 4]
jmp 0x8a97c7
mov ebx, dword [esp]
lea esp, [esp + 4]
jmp 0x8a81bb
jne 0x8a827c
je 0x8a81d7
mov dword [edi], edx
pop edi
pushfd
call fcn.008a8939
xchg ecx, eax
mov dword [ecx - reloc.MSVCRT.dll_strncpy], 0xdef7728f
sub dword [eax + 0x57], ecx
mov edi, ebp
add edi, 0xffffffec
jmp 0x8a8858
jb 0x8a8244
jae 0x8a822e
sub esp, 0xc
ja 0x8a95d6
add esp, 5
mov word [esp], bp
lea esp, [esp + 3]
lea esp, [esp + 4]
popal
jmp 0x8a95df
lea esp, [esp + 3]
lea esp, [esp + 4]
popal
jmp 0x8a95df
add esp, 5
mov word [esp], bp
jmp 0x8a95c0
mov edx, dword [ecx]
mov ch, 0xac
sub esp, 0xf
jl 0x8a9627
mov cx, 0x753a
pop dword [esp]
lea esp, [esp + 3]
jmp 0x8a9643
pop dword [esp]
lea esp, [esp + 3]
jmp 0x8a9643
mov cx, 0x753a
jmp 0x8a9611
jmp 0x8a9681
mov eax, dword [ebp + 4]
lea ecx, [ecx + 0x52]
rcr cx, cl
jl 0x8a962d
jge 0x8a962d
pop ss
iretd
lea ecx, [edx + ebx]
not ch
jmp 0x8a968e
sub ebp, 4
sub esp, 0x18
jns 0x8a966b
lea ecx, [edx + ebx]
jmp 0x8a96ba
imul edx
call 0x8a9696
ret 0x930f
not ch
jmp 0x8a968e
add dword [edx], ecx
jmp 0x8a8205
Function at 0x9ed3f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 0x25], bp
mov cx, 0x7f27
stc
jmp 0x9ed48d
bt edx, esp
add edx, edi
add esp, 0xb
mov cx, 0x1cf3
pop word [esp]
jmp 0x9ed471
rol ch, cl
mov edi, 0x7f53e3e
and eax, 0xb5a8a03c
dec dh
dec ebp
mov byte [esp + 4], dl
jmp 0x9ed426
pop bp
xchg dword [esp + 1], edi
inc eax
xchg dword [esp], eax
xchg al, cl
not esi
jmp 0x9ed43c
bsr di, bp
pop word [esp]
dec ebp
mov edx, esp
bsr eax, eax
pushfd
jmp 0x9ed4b7
bsf ebx, eax
mov bl, byte [esp + 0x22]
lea esp, [esp + 0x1b]
rol ch, cl
xchg ch, cl
cpuid
jmp 0x9ed461
neg eax
mov bp, 0xf6ac
pop ebp
mov edx, dword [esp]
rdtsc
bsr di, di
jmp 0x9ed4c7
cmc
mov di, ax
not bl
mov esi, edi
xchg al, cl
mov edi, dword [esp + 2]
jmp 0x9ed4a0
cpuid
xchg bx, ax
std
mov di, 0xa4ea
mov ecx, 0x89e86a6f
rdtsc
jmp 0x9ed954
cpuid
mov al, byte [esp]
ror al, cl
lea eax, reloc.MSVCRT.dll_strncpy
lea edi, reloc.MSVCRT.dll_strncpy
mov al, byte [esp]
jmp 0x9ed4fc
bswap eax
xchg bx, di
not bx
dec edi
clc
mov dx, 0x8e1a
jmp 0x9ed512
xchg bp, si
mov bl, byte [esp]
mov dl, al
lea ebp, reloc.MSVCRT.dll_strncpy
mov ebp, eax
pop bp
jmp 0x9ed578

Function at 0x9ed540
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg al, ch
xchg dl, ch
dec eax
and si, bp
sub esp, 0xf
jmp 0x9ed52a
Function at 0x9ed705
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
neg ax
btc edx, ebp
mov ebp, 0xee20b509
btc edi, esi
jmp 0x9ed767
dec dx
xchg dword [esp + 0xd], esi
push dword [esp + 0xe]
jmp 0x9ed6ef
mov byte [esp + 0xb], ah
pop di
mov al, ch
mov bx, word [esp + 0xf]
setnp cl
jmp 0x9ed797
neg ax
xchg byte [esp + 0xb], bl
xchg bh, al
push edx
dec edx
mov ebp, dword [esp + 3]
jmp 0x9ed738
push dword [esp + 7]
lea esp, [esp + 0xc]
mov bx, word [esp + 8]
mov esi, ebp
mov word [esp + 0xa], si
mov bx, 0x9384
jmp 0x9ed74e
xchg cx, bp
mov byte [esp + 7], al
mov eax, edi
mov bh, ch
push dword [esp + 3]
jmp 0x9ed7da
xchg byte [esp + 0xd], dh
lea esi, [esp + ecx]
pop word [esp + 0xa]
mov ebp, dword [esp + 7]
mov edx, ebx
mov esi, dword [esp + 8]
jmp 0x9ed781
mov bl, cl
pushal
add esp, 5
lea edx, [edx + ebp]
neg ah
call 0x9ed7c0
outsb dx, byte [esi]
cpuid
jmp 0x9ed810
inc ax
mov cl, byte [esp + 1]
xchg word [esp], cx
xchg si, ax
std
jmp 0x9ed7f2
add esp, 0xd
mov ch, byte [esp + 4]
neg ch
lea edi, reloc.MSVCRT.dll_strncpy
rdtsc
mov word [esp + 2], dx
jmp 0x9ed7af
mov byte [esp], dl
neg ecx
mov ebp, 0xf5f09048
shl ax, cl
lea eax, reloc.MSVCRT.dll_strncpy
mov word [esp], bx
jmp 0x9ed826
xchg word [esp + 0x18], bp
bsf eax, eax
pop ebx
push word [esp + 0x1c]
add esp, 0x20
mov ch, byte [esp]
jmp 0x9ed7c4
dec bx
xchg edi, eax
xchg dh, bl
mov word [esp], ax
pushal
xchg byte [esp + 9], bl
jmp 0x9ed87a
mov byte [esp + 7], bh
lea esp, [esp + 6]
neg dx
add esp, 1
jmp 0x9ed8a3
mov si, bx
xchg dword [esp + 0xa], ecx
pushfd
mov dword [esp + 0xa], ebx
stc
lea esp, [esp + 0x19]
jmp 0x9ed864
mov cx, word [esp + 2]
xchg byte [esp + 7], bl
rdtsc
pop word [esp + 8]
jmp 0x9ed8b5
mov dword [esp], edx
pop cx
neg ax
xchg ebx, ebp
sub esp, 0xb
mov ax, bx
jmp 0x9ed88d
lea esp, [esp + 4]
xchg dword [esp], edi
lea esp, [esp]
btr dx, si
jmp 0x9ed904
pop edx
mov byte [esp + 4], ch
bsf di, cx
xchg byte [esp + 4], ah
rdtsc
rcr dx, 4
jmp 0x9ed930
mov ax, word [esp + 6]
bt ax, ax
mov bp, sp
push word [esp]
xchg bh, cl
neg ah
jmp 0x9ed8e5
push word [esp + 6]
cpuid
mov eax, dword [esp + 3]
sub esp, 4
jmp 0x9ed9bb
xchg bp, cx
lea edi, [ecx*4]
mov word [esp + 2], si
shl dl, 3
rdtsc
mov bp, dx
jmp 0x9ed91a
xchg byte [esp + 0xb], ah
pop word [esp + 4]
push word [esp + 3]
mov edx, ebx
call fcn.009ed984
bsf edx, esp
xchg byte [esp], bh
pop bx
cld
lea eax, [esi*4]
lea ebp, [ecx + edi]
jmp 0x9ed9ff
mov word [esp + 6], sp
cmc
mov bx, 0xadd9
lea ebp, [eax + edi]
push word [esp + 1]
xchg dword [esp + 1], esi
jmp 0x9edc91
mov bp, 0x3aa7
pop dword [esp + 3]
not ch
call fcn.009eda9e
Function at 0x9ed7c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
neg ax
btc edx, ebp
mov ebp, 0xee20b509
btc edi, esi
jmp 0x9ed767
dec dx
xchg dword [esp + 0xd], esi
push dword [esp + 0xe]
jmp 0x9ed6ef
mov byte [esp + 0xb], ah
pop di
mov al, ch
mov bx, word [esp + 0xf]
setnp cl
jmp 0x9ed797
neg ax
xchg byte [esp + 0xb], bl
xchg bh, al
push edx
dec edx
mov ebp, dword [esp + 3]
jmp 0x9ed738
push dword [esp + 7]
lea esp, [esp + 0xc]
mov bx, word [esp + 8]
mov esi, ebp
mov word [esp + 0xa], si
mov bx, 0x9384
jmp 0x9ed74e
xchg cx, bp
mov byte [esp + 7], al
mov eax, edi
mov bh, ch
push dword [esp + 3]
jmp 0x9ed7da
xchg byte [esp + 0xd], dh
lea esi, [esp + ecx]
pop word [esp + 0xa]
mov ebp, dword [esp + 7]
mov edx, ebx
mov esi, dword [esp + 8]
jmp 0x9ed781
mov bl, cl
pushal
add esp, 5
lea edx, [edx + ebp]
neg ah
call 0x9ed7c0
outsb dx, byte [esi]
cpuid
jmp 0x9ed810
inc ax
mov cl, byte [esp + 1]
xchg word [esp], cx
xchg si, ax
std
jmp 0x9ed7f2
add esp, 0xd
mov ch, byte [esp + 4]
neg ch
lea edi, reloc.MSVCRT.dll_strncpy
rdtsc
mov word [esp + 2], dx
jmp 0x9ed7af
mov byte [esp], dl
neg ecx
mov ebp, 0xf5f09048
shl ax, cl
lea eax, reloc.MSVCRT.dll_strncpy
mov word [esp], bx
jmp 0x9ed826
xchg word [esp + 0x18], bp
bsf eax, eax
pop ebx
push word [esp + 0x1c]
add esp, 0x20
mov ch, byte [esp]
jmp 0x9ed7c4
dec bx
xchg edi, eax
xchg dh, bl
mov word [esp], ax
pushal
xchg byte [esp + 9], bl
jmp 0x9ed87a
mov byte [esp + 7], bh
lea esp, [esp + 6]
neg dx
add esp, 1
jmp 0x9ed8a3
mov si, bx
xchg dword [esp + 0xa], ecx
pushfd
mov dword [esp + 0xa], ebx
stc
lea esp, [esp + 0x19]
jmp 0x9ed864
mov cx, word [esp + 2]
xchg byte [esp + 7], bl
rdtsc
pop word [esp + 8]
jmp 0x9ed8b5
mov dword [esp], edx
pop cx
neg ax
xchg ebx, ebp
sub esp, 0xb
mov ax, bx
jmp 0x9ed88d
lea esp, [esp + 4]
xchg dword [esp], edi
lea esp, [esp]
btr dx, si
jmp 0x9ed904
pop edx
mov byte [esp + 4], ch
bsf di, cx
xchg byte [esp + 4], ah
rdtsc
rcr dx, 4
jmp 0x9ed930
mov ax, word [esp + 6]
bt ax, ax
mov bp, sp
push word [esp]
xchg bh, cl
neg ah
jmp 0x9ed8e5
push word [esp + 6]
cpuid
mov eax, dword [esp + 3]
sub esp, 4
jmp 0x9ed9bb
xchg bp, cx
lea edi, [ecx*4]
mov word [esp + 2], si
shl dl, 3
rdtsc
mov bp, dx
jmp 0x9ed91a
xchg byte [esp + 0xb], ah
pop word [esp + 4]
push word [esp + 3]
mov edx, ebx
call fcn.009ed984
bsf edx, esp
xchg byte [esp], bh
pop bx
cld
lea eax, [esi*4]
lea ebp, [ecx + edi]
jmp 0x9ed9ff
mov word [esp + 6], sp
cmc
mov bx, 0xadd9
lea ebp, [eax + edi]
push word [esp + 1]
xchg dword [esp + 1], esi
jmp 0x9edc91
mov bp, 0x3aa7
pop dword [esp + 3]
not ch
call fcn.009eda9e

Function at 0x9ef66b
Capabilities:
Check for peb beingdebugged flag

Disassembly:
jmp 0x9ef6db
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x9ef696
mov word [esp + 5], cx
pop dword [esp + 2]
mov dword [esp + 0x60], edi
lea esp, [esp + 0x60]
mov eax, dword fs:[0x30]
jmp 0x9ef6ac
Function at 0x401390
Capabilities:
Copy file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x44c250]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push edi
mov edi, dword [esp + 0x218]
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00422000
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [esp + 8]
test eax, eax
jle 0x4013f2
push edi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4386d4
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x401400
lea ecx, [esi + 0x834]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x104
lea edi, [esi + 0x62c]
push edi
lea eax, [esp + 0x10]
push eax
push 0x454590
call fcn.00412620
add esp, 0x10
test eax, eax
je 0x401438
push 0
push edi
add esi, 0x21c
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
call fcn.00421fea
add esp, 0x20c
ret 4

Function at 0x401560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401579
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4015b4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4015b0
lea ebx, [ebx]
cmp esi, eax
jae 0x4015b4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4015a0
cmp esi, eax
jb 0x4015ba
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret