joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bc00
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44bc33
push esi
call fcn.0044ecf0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44bc2c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44bcb9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44bca2
mov eax, dword [esi + 8]
test eax, eax
je 0x44bc57
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44bc9e
cmp eax, 2
je 0x44bca2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44bc4a
cmp eax, 3
je 0x44bc7d
cmp eax, 1
jne 0x44bc4a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44bc4a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44bc4a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044bce0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44bcc8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044bce0
add esp, 4
pop esi
ret

Function at 0x45cb60
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x45cc03
test eax, eax
jbe 0x45cc03
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x45cc03
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45cbae
xor esi, esi
jmp 0x45cbb4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x45cbdf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0040b930
add esi, eax
push esi
mov ebx, esi
call fcn.0040b930
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x45cbc0
pop ebp
test edi, edi
pop edi
jne 0x45cc03
test ebx, ebx
je 0x45cc03
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004715c0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x45cd45
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45ce5d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45ce5d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0048375f
mov esi, eax
test esi, esi
je 0x45ce5d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x45ce5d
mov ecx, esi
call fcn.0045ccb0
cmp edi, eax
jge 0x45ce5d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x45cde3
mov dword [esp + 0x34], 1
jmp 0x45ce3e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x45ce5d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0045b530
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x45efd0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x45f019
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x45f490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x493360
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0045f040
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0045f0c0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0045f0c0
lea ecx, [esi + 0xc]
call fcn.00481c50
lea ecx, [esi + 0x10]
call fcn.00481c50
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00460650
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00460650
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00460650
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00481cc5
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00481cc5
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x460840
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4608a6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4608a6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x460887
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x484102
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48413a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048216c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00482144
jmp 0x484146
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4857f3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x485835
call fcn.0048b5e1
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x485835
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48582c
xor eax, eax
jmp 0x48583d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00485843
pop edi
pop esi
pop ebx
ret 4

Function at 0x48bb10
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48bb3e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48bb5c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048ba76
jmp 0x48bb5c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48bb5c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048ba76
test edi, edi
mov eax, edi
jne 0x48bb46
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4613700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0461378f
jae 0x461370e
xor ecx, ecx
call fcn.0461378f
jae 0x461373d
xor eax, eax
call fcn.0461378f
jae 0x461374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0461378f
adc al, al
jae 0x461372f
jne 0x4613779
stosb byte es:[edi], al
jmp 0x4613711
call fcn.0461379b
sub ecx, ebx
jne 0x4613756
call fcn.04613799
jmp 0x4613775
lodsb al, byte [esi]
shr eax, 1
je 0x4613783
adc ecx, ecx
jmp 0x4613772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.04613799
cmp eax, 0x7d00
jae 0x4613772
cmp ah, 5
jae 0x4613773
cmp eax, 0x7f
ja 0x4613774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4613711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x44fc30
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dl, bh
pushal
dec edx
push dword [esp + 0x44]
ret 0x48
rol cl, 0
call fcn.0044efca
add edx, 0x74c3f143
jmp 0x44f0bf
mov bx, 0x94f1
mov dh, ch
neg ebx
jo 0x44ef3e
jno 0x44ef3e
neg dl
jl 0x44f078
jge 0x44ef70
loopne 0x44ef91
pop edx
mov ch, 0xf9
stc
pushfd
add esp, 2
jmp 0x44f049
add edx, 0x6febda8d
jmp 0x44f127
cwde
lea ebx, [edi*4]
xchg dword [esp + 4], eax
pushal
jmp 0x44ef33
jmp 0x44f051
lea esp, [esp + 2]
not cl
xchg edx, ebx
bsr bx, bx
jp 0x44f008
lea ebx, [eax + esi]
jmp 0x44f054
bt bx, dx
ja 0x44f05c
jbe 0x44f05c
push 0xf043e440
jmp 0x44fc01
bts edx, ecx
mov ebx, dword [esp]
jmp 0x44f083
lea ebx, [eax + esi]
mov edx, ecx
mov bl, byte [esp]
push edi
jmp 0x44f031
shl edx, 2
call fcn.0044f0a6
add edx, 0x7a0565c6
jmp 0x45043c
insd dword es:[edi], dx
stc
pushfd
add esp, 2
bts edx, ecx
mov ebx, dword [esp]
xchg bh, dh
mov edx, ebx
mov byte [esp], dh
jmp 0x44f01e
jmp 0x44f0b5
mov bx, word [esp + 1]
jmp 0x44ef46
add edx, 0x8a5906c0
jmp 0x450488
neg bx
jb 0x44f08c
jae 0x44f08e
pop esp
rcl dword [ecx + 0x30], 0xc3
jno 0x44f077
jp 0x44f11c
mov bx, word [esp + 1]
mov ebx, dword [esp + 1]
jmp 0x44ef46
mov bx, word [esp]
mov bx, dx
mov ebx, dword [esp]
mov bx, 0xc8bc
jmp 0x44f0ee
mov edx, dword [edx - reloc.KERNEL32.dll_ExitProcess]
bswap ebx
sub esp, 1
jp 0x44f171
jnp 0x44f13d
je 0x44f0ee
jg 0x44f11b
jmp 0x9645934f
add cl, byte [ebp - 0x1f7db9c]
leave
lea esp, [esp + 8]
dec cl
jmp 0x44ef56
mov ebx, dword [esp]
jmp 0x44f14c
bsr ebx, ebx
mov byte [esp], ch
lea esp, [esp + 1]
jmp 0x44ef7a
seto bl
mov ebx, 0xbde2f68a
btr ebx, ebx
jl 0x44f1b7
jge 0x44f1b7
bsr ebx, ebx
mov byte [esp], ch
lea esp, [esp + 1]
jmp 0x44ef7a
cpuid
lea esi, [esp - 0xe1]
mov si, 0x2939
xchg ecx, edx
jmp 0x44fc26
mov ebp, dword [esp + 0x2c]
call 0x44fc30
mov al, byte [0x89c18166]
push 0x78
daa
pop eax
jmp 0x44fc65
jmp 0x44fc85
lea edi, [esp]
rdtsc
xchg bl, al
clc
jbe 0x44fc3a
rol bh, 3
jmp 0x44fc88
rol bh, 3
sub esp, 0xc0
mov esi, esp
jmp 0x44fce9
sets ch
not ecx
mov edx, ebp
call fcn.0044fcc3
stosb byte es:[edi], al
inc ebx
sal dword [esi + reloc.KERNEL32.dll_ExitProcess], cl
xor byte [ebx], dh
lea ecx, [ecx*4]
rdtsc
mov bh, byte [esp]
mov eax, ebp
lea ecx, reloc.KERNEL32.dll_ExitProcess
bswap edx
jmp 0x44fc92
mov ch, byte [esp]
xchg cl, ch
mov ecx, dword [esp]
jmp 0x45049e
mov ecx, dword [esp]
jmp 0x4504d0
mov edx, dword [edx - reloc.KERNEL32.dll_ExitProcess]
mov cl, ch
mov ecx, 0xaae6f9b8
xchg cl, ch
jmp 0x44f098
mov ecx, dword [esp]
mov cx, word [esp]
mov esp, esi
bswap ecx
sub esp, 0x1a
jmp 0x450516
jg 0x450535
lea esp, [esp + 2]
jmp 0x450539
lea esp, [esp + 2]
push edx
ret
Function at 0x452461
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf043e440
jmp 0x4524f1
pushfd
jmp 0x450fb7
lea esp, [esp + 1]
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x45244a
xchg ebp, eax
jmp 0x4524b6
mov ebp, esp
setl cl
not ax
lea edx, [edx*4]
mov edx, esi
jmp 0x45249b
lea edi, [eax + edx]
stc
jo 0x45246f
xchg ebp, eax
jmp 0x452471
pushal
push word [esp + 4]
je 0x4524c6
bswap ebx
jmp 0x4524d1
lea edi, [esp]
pushal
rdtsc
rdtsc
sub esp, 0xa0
jmp 0x452473
bswap ebx
lea ebx, [eax + edi]
jmp 0x45255b
lea ebx, [eax + edi]
lea esp, [esp + 2]
mov ecx, dword [esp]
jmp 0x452562
mov esi, 0x52094e3b
mov ax, 0x97a3
rdtsc
mov esi, dword [esp + 0x2c]
jmp 0x452491
lea esp, [esp + 2]
mov ecx, dword [esp]
call 0x45252c

Function at 0x45cc17
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x45dcf2
push eax
mov eax, ebp
add eax, 0xc
jmp 0x43eb27
xor ch, al
movzx eax, word [ebp + 8]
xchg ecx, edx
sub esp, 0xc
pop dword [esp + 2]
jmp 0x43eae2
lea esp, [esp + 2]
lea esp, [esp + 8]
push ebx
jmp 0x43eb65
movzx ecx, word [eax]
pop eax
mov edx, 0x6bd3b13a
mov dh, 0xbf
push di
lea edx, reloc.KERNEL32.dll_ExitProcess
jmp 0x43eb0d
push ebp
mov ax, word [esp]
mov ebp, esp
neg dl
jmp 0x43eafc
mov ebx, dword [eax]
pop eax
mov dl, 0x4d
jmp 0x43eb87
push eax
mov eax, ebp
add eax, 0xc
jmp 0x43eb4b
mov ecx, ebp
add ecx, 8
mov esi, dword [ecx]
pop ecx
jmp 0x470b90
push esi
neg dx
sete dh
push ecx
jmp 0x43eb6d
jmp 0x43eacc
jmp 0x43eba8
jmp 0x45cc01
jmp 0x43eb40
shr esi, 0x10
mov edx, dword [esp]
jmp 0x470bb8
shr ebx, 0x10
mov dx, word [esp]
movzx esi, si
inc dl
jmp 0x470c0f
push dx
sub esp, 0x1d
push esi
lea esp, [esp + 3]
jmp 0x470bf2
lea esp, [esp + 0x20]
imul ecx, esi
mov dword [ebp + 0xc], esi
mov si, 0x8e71
jmp 0x470c6c
mov edx, eax
movzx ebx, bx
imul edx, ecx
jmp 0x470bc6
lea esi, [edx + edi]
bsr si, ax

Function at 0x45cf2d
Capabilities:
Encode data using xor

Disassembly:
push bp
lea esp, [esp + 2]
jmp 0x441766

Function at 0x48f66c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esi + 0xc]
mov eax, edx
sub eax, ebx
call fcn.0048f602
jae 0x48e1ae
bsr eax, esp
rdtsc
mov dh, byte [esp]
add edx, 0x465c06c7
jmp 0x48f618
lea esp, [esp + 0x28]
cmp dword [ebp + 8], edi
jmp 0x48f63a

Function at 0x4f73d2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, esi
mov dx, 0xf69d
jmp 0x4f7591
pop dword [esp + 2]
Function at 0x4f8df8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x2e], si
mov byte [esp + 0x34], dl
push dword [esp + 0x20]
jmp 0x4f8d59
lea esp, [esp + 2]
lea esp, [esp + 0x3c]
pushal
not bl
mov bl, cl
btr ecx, ecx
jmp 0x4f8d8a
bswap ecx
cpuid
bsr esi, edi
mov cl, 0x9f
setge dl
cpuid
jmp 0x4f8dbb
mov edi, 0x5a60da75
mov si, word [esp]
rdtsc
bts ebp, edi
mov cx, word [esp]
bswap esi
jmp 0x4f8e1c
call 0x4f8df8
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
pushfd
pushal
push dword [esp + 0xa]
sub esp, 0x16
jmp 0x4f8d3d
sub esp, 8
rdtsc
bsf ebp, eax
cmc
neg dh
lea ebx, [esp + esi]
jmp 0x4f8eae
mov al, byte [esp]
lea edi, [esp + ebp]
bswap ebp
cpuid
xchg edi, eax
setg bh
jmp 0x4f8e06
xchg edx, ebx
add esp, 5
lea ebx, reloc.KERNEL32.dll_ExitProcess
lea esp, [esp]
lea esi, [edi*4]
push esp
jmp 0x4f8e88
mov ecx, ebp
push dword [esp]
sete bh
add esp, 8
stc
push word [esp + 3]
jmp 0x4f8e57
mov si, 0x2f
adc di, 0x3717
lea esp, [esp + 3]
xchg dl, cl
mov eax, ebx
lea eax, [ecx + ebp]
jmp 0x4f8ed2
pop ecx
dec ecx
push dword [esp]
mov dl, 0xe6
bswap eax
xchg dx, ax
jmp 0x4f8e75
mov ch, byte [esp + 0x14]
neg dx
pop eax
mov byte [esp + 0xc], dl
mov dl, byte [esp + 5]
jmp 0x4f8ef9
xchg edi, eax
mov word [esp], bx
pushal
std
mov bl, byte [esp + 0xf]
lea esp, [esp + 4]
jmp 0x4f8ebc
add esp, 9
and cl, 0xc0
pop dword [esp]
mov si, 0x4a12
not bp
jmp 0x4f8f23
pop word [esp + 5]
rdtsc
dec cl
neg di
pop edi
xchg word [esp + 0xe], bp
jmp 0x4f8ee3
setg bl
pop edx
push dword [esp + 5]
call fcn.004f8f8e
mov dl, 0x3e
lodsb al, byte [esi]
retf
btr eax, esp
mov bx, word [esp + 4]
bswap ecx
not bx
mov ebp, 0x74c15d8b
sub esp, 0xd
jmp 0x4f8f0d
Function at 0x4f982c
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr ax, cx
cpuid
push dword [esp + 3]
pop edx
mov bh, byte [esp + 1]
dec eax
jmp 0x4f902e
mov dword [esp], esi
pushfd
cmc
mov dx, 0xf900
lea esi, [ebp + 0x79]
mov byte [esp + 1], bl
jmp 0x4f90a6
pop word [esp + 8]
popal
not ecx
lea ecx, [edx + edx]
push ax
push word [esp + 1]
jmp 0x4f8ff1
mov dword [esp], eax
stc
cld
push word [esp + 2]
or esi, 0xbd9ac3b
mov word [esp], bx
jmp 0x4f9003
push cx
xchg word [esp + 0x17], si
stc
cpuid
lea esp, [esp + 0xb]
xchg byte [esp + 0x16], dl
jmp 0x4f901a
add esp, 0
not ebp
mov byte [esp + 0xa], cl
lea ebp, [ecx*4]
jmp 0x4f908e
mov ah, byte [esp + 0x15]
lea esp, [esp + 0x1c]
lea eax, reloc.KERNEL32.dll_ExitProcess
rdtsc
ror esi, cl
mov word [esp + 9], bp
jmp 0x4f905f
xchg word [esp + 6], dx
btc bx, sp
lea esp, [esp + 1]
bts ebx, eax
jmp 0x4f9127
inc si
not eax
std
neg ebx
pushal
setp cl
jmp 0x4f9075
xchg dword [esp + 3], ebp
xchg word [esp + 0x15], bx
xchg dword [esp + 0xa], eax
mov dh, cl
jmp 0x4f90f9
push dword [esp + 0xc]
pop edi
pop word [esp]
setae al
sub esp, 0x18
cmc
jmp 0x4f90b3
xchg word [esp + 0x21], si
setge dl
push word [esp + 0x16]
mov al, 0x57
push word [esp + 0xd]
cpuid
jmp 0x4f9142
mov bh, byte [esp + 0x1d]
xchg word [esp + 0x19], cx
mov di, word [esp + 0x1e]
mov al, 0x92
push word [esp + 0x17]
setne bh
jmp 0x4f90db
xchg word [esp + 7], ax
lea ecx, [ebx*4]
xchg byte [esp + 6], dl
bts ebp, edi
sub esp, 4
neg cx
jmp 0x4f90c9
mov bp, word [esp]
xchg ecx, eax
popal
rol ah, cl
bsf edx, esp
lea esp, [esp + 9]
jmp 0x4f929e
mov dx, word [esp + 0x13]
mov cx, word [esp + 0xe]
bsf ebx, ecx
bswap eax
pop cx
lea eax, reloc.KERNEL32.dll_ExitProcess
jmp 0x4f904b
xchg dx, bp
rdtsc
call fcn.004f9178
xchg ebp, esi
neg ebx
rdtsc
mov edi, 0x87c25e41
push dx
neg ecx
jmp 0x4f918e
lea ebx, [eax + ebp]
push word [esp + 1]
xchg dx, bp
mov ch, byte [esp + 2]
pop esi
setb bl
jmp 0x4f9203
pop word [esp]
xchg dx, si
lea eax, [esi + edi]
cpuid
lea eax, [ebp - 0x68]
shr al, cl
jmp 0x4f9264
bts di, si
mov byte [esp + 0x2a], cl
neg bh
add esp, 0
lea ebx, [esi*4]
mov word [esp + 0xc], dx
jmp 0x4f915c
mov esi, ebx
bsf ax, di
lea ebp, [eax*4]
push word [esp + 0x23]
rcr eax, cl
pop dword [esp + 0x23]
jmp 0x4f932c
pop esi
pushal
jmp 0x4f93d0
Function at 0x402cf1
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00402ea1
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x402def
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x402d92
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x402dd5
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x402da9
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x402dc4
test al, 0x40
je 0x402dbb
mov ecx, dword [edi + 0x20]
jmp 0x402dc2
test al, 0x80
je 0x402dd5
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x402dd5
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x402d61
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x4035be
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
ret
Function at 0x409ac0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
fild dword [ebp + 0x10]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x526d03]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
call fcn.00401187
mov dword [ebp + 0x10], eax
push 0x33
call 0x409aed
add dword [esp], 5
retf
Function at 0x42f430
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c30fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004b8183
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x42f4b2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004b6069
mov eax, dword [eax]
push 0x647ce8
push eax
call fcn.004a8794
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004b840e
test bl, bl
je 0x42f4b2
push 0x647ce8
lea ecx, [esp + 0xc]
call fcn.004b879e
push 0x647cf4
lea ecx, [esp + 0xc]
call fcn.004b879e
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42f4ee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004b840e
jmp 0x42f5b9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x42f572
lea edx, [esp + 0x7c]
push 0x647cf0
push edx
call fcn.004a8794
add esp, 8
test eax, eax
je 0x42f572
lea eax, [esp + 0x7c]
push 0x647cec
push eax
call fcn.004a8794
add esp, 8
test eax, eax
je 0x42f572
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42f502
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004b840e
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x42fdc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42fe22
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc