joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4345c0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405caf
push edi
call esi
cmp eax, 0xffffffff
jne 0x405cf1
test ebx, ebx
je 0x405cee
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x405ce8
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
mov eax, esi
jmp 0x405cf1
call fcn.00401abd
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406306
Capabilities:
Get disk information

Disassembly:
mov eax, 0x434664
call fcn.004339e0
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.0041c900
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x4063d4
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406342
mov eax, ebx
add eax, eax
push eax
call fcn.004066d0
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x4063cd
cmp ebx, dword [ebp - 0x14]
ja 0x4063cd
lea ecx, [ebp - 0x2c]
call fcn.004028e9
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x4063b5
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4063aa
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.004066d0
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0040150c
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x406380
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00401abd
push esi
call fcn.00401abd
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x4063d6
push esi
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4066d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x4066df
pop dword [ebp - 0x14]
mov eax, 0x4066df
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3a39a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x4645
xor esi, esi
add esi, eax
mov edx, 0x44c600
add edx, dword [ebp - 0x14]
mov ebx, 0xbb1a6a7f
sub dword [ebp - 0xc], ecx
mov edi, dword [edx]
mov dword [ebp - 0x10], 0xc7b128bc
xor edi, ebx
xor dword [ebp - 8], ebx
mov dword [esi], edi
sub dword [ebp - 0x10], 0x4c6e3e5e
add esi, 0x3b9fbd5c
add esi, 0xc46042a8
add edx, 4
loop 0x406724
add eax, 0x10be7
xor ebx, ebx
add ebx, eax
add eax, 0x94c2a8c5
add eax, 0x6b3d5740
mov ecx, 0xc9e91fe0
sub ecx, 0xc9a91fe0
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x408fd0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [0x4989d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
lea edx, [ebp - 0x3f4]
push edx
push 0x20019
push 0
push str.TypeLib
push SysReAllocStringLen
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x400], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push SysReAllocStringLen
mov esi, eax
call edi
test esi, esi
je 0x409037
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459ed3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x3f4]
lea eax, [ebp - 0x3f0]
push eax
push 0x20019
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [ebp - 0x3f4]
push edx
mov esi, eax
call edi
test esi, esi
jne 0x409025
mov edx, dword [ebp - 0x3f0]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x3f8]
push eax
lea ecx, [ebp - 0x3ec]
push ecx
push esi
push edx
mov dword [ebp - 0x3f8], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
mov eax, dword [ebp - 0x3f0]
push eax
call edi
test esi, esi
jne 0x409025
mov ecx, dword [ebp - 0x400]
mov edx, dword [ebp - 0x3fc]
push ecx
push edx
lea eax, [ebp - 0x3ec]
push str._d._d
push eax
call fcn.0045c6d7
mov ecx, dword [ebp - 4]
add esp, 0x10
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.00459ed3
mov esp, ebp
pop ebp
ret
Function at 0xbbbd26
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], eax
push edx
pushal
mov word [esp], si
lea esp, [esp + 0x12]
jmp 0xbbbda2
lea esp, [esp + 3]
jmp 0xbbbd10
mov dword [esp + 0x14], ebx
call fcn.00bbbd42
lea esp, [esp + 2]
mov dword [esp + 0x18], ecx
push esi
mov word [esp], ax
mov byte [esp], ch
mov dword [esp + 0x18], edx
jmp 0xbbbd6e
Function at 0xbc34b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dl
js 0xbc34d4
jns 0xbc34dc
or dword [eax + reloc.RASAPI32.dll_RasHangUpA], edx
xchg ecx, eax
or eax, 0xa117e49d
sbb al, 0x6f
jbe 0xbc352c
mov ecx, esi
jmp 0xbc356a
mov ecx, esi
xchg cl, ah
bsr ax, sp
mov cx, dx
mov edx, 0x28ac9f1f
jmp 0xbc3523
dec dx
jle 0xbc3543
bswap edx
mov eax, esi
mov dx, word [esp]
sub esp, 2
xchg word [esp], ax
jmp 0xbc3549
mov edx, 0x28ac9f1f
mov edx, 0x4b5fe05f
inc ebp
mov cl, 0x46
jmp 0xbc3504
xlatb
mov dx, word [esp]
sub esp, 2
xchg word [esp], ax
jmp 0xbc3549
bswap edx
mov eax, esi
jmp 0xbc352d
lea ecx, [esi*4]
lea esp, [esp + 2]
neg ebp
rdtsc
rdtsc
call fcn.00bc3575
sub al, 0xb7
daa
inc edx
mov cl, 0xa
sub al, byte [ebp - 0xc]
out 0xe, eax
xchg cl, ah
bsr ax, sp
mov cx, dx
jmp 0xbc351e

Function at 0xbe2309
Capabilities:
Encrypt data using aes

Disassembly:
mov esi, ecx
jmp 0xbe2289
shl edx, 8
xor edx, esi
push esi
jmp 0xbe21ef
mov ebx, eax
add ebx, 7
movzx esi, byte [ebx]
pop ebx
jmp 0xbe2205
add edi, 8
movzx edx, byte [edi]
pop edi
sub esp, 6
bsr bp, di
jmp 0xbe2265
lea esi, reloc.RASAPI32.dll_RasHangUpA
mov dword [esp], eax
cmc
popal
jmp 0xbe222c
push edi
pushal
sub esp, 0
bsf edx, ebp
jmp 0xbe2242
xchg word [esp + 3], bx
lea esp, [esp + 2]
movzx esi, byte [eax + 9]
bsf ebp, ecx
jmp 0xbe22cc
add esi, 4
mov dword [esi], edx
pop esi
rol di, cl
xchg dx, di
jmp 0xbe225b
shl edx, 8
inc edi
jmp 0xbe22ed
cmc
movzx esi, byte [eax + 0xa]
not bh
mov bl, 0x21
inc bp
jmp 0xbe2297
shl edx, 8
pushal
xor edx, esi
sete bh
jmp 0xbe22ad
movzx esi, byte [eax + 0xb]
jmp 0xbe232a
xor edx, esi
neg esi
lea ebx, reloc.RASAPI32.dll_RasHangUpA
mov bh, byte [esp]
mov edi, esp
jmp 0xbe22d7
bswap edi
adc bx, di
push ebx
jmp 0xbe2221
mov esi, ecx
jmp 0xbe2332
shl edx, 8
xor edx, esi
push esi
jmp 0xbe2314
add esi, 8
mov dword [esi], edx
pop esi
not dh
mov bp, word [esp]
jmp 0xbe2375
movzx edx, byte [eax + 0xc]
mov bl, 0x18
bsf ebx, edx
mov bp, word [esp]
jmp 0xbe2356

Function at 0xbe2702
Capabilities:
Encrypt data using aes

Disassembly:
mov ecx, dword [ecx*4 + reloc.RASAPI32.dll_RasHangUpA]
shr edi, 0x10
sub esp, 2
lea esp, [esp + 2]
jmp 0xbe26e1
lea esp, [esp + 2]
and ecx, esi
sub esp, 3
sub esp, 0xa
lea esp, [esp + 1]
jmp 0xbe26b2
and edi, esi
sub esp, 0x1f
add esp, 0x15
lea esp, [esp + 2]
jmp 0xbe280b
push word [esp + 1]
jmp 0xbe26cf
lea esi, reloc.RASAPI32.dll_RasHangUpA
mov edi, dword [esi]
pop esi
call fcn.00be271f
shr edi, 0x18
movzx edi, byte [edi*4 + 0xbb9738]
xor ecx, edi
jmp 0xbe27d6
mov di, sp
ror edi, cl
call fcn.00be2796
lea edi, [ebx + esi]
push word [esp]
lea esp, [esp + 2]
lea esp, [esp + 0xc]
xor ecx, dword [ebx]
jmp 0xbe2830
lea edx, [ecx + ecx]
jmp 0xbe281a
push esi
mov esi, edi
lea esi, [esi*4]
jmp 0xbe2779
add ebx, 4
inc dh
clc
jmp 0xbe283a
lea edi, [eax + 0x10]
bswap edx
cmc
xor ecx, dword [eax]
jmp 0xbe27f3
mov dword [edi], ecx
mov dl, 0xa8
adc edx, ebx
lea edx, [ebx + 0x75]
jmp 0xbe2871
mov edx, dword [eax + 4]
xor edx, ecx
mov ecx, dword [esp]
bswap ecx
jmp 0xbe285b
Function at 0xbe273c
Capabilities:
Encrypt data using aes

Disassembly:
and edi, 0xff000000
jmp 0xbe275c
cmc
mov byte [esp], al
lea esp, [esp + 4]
jmp 0xbe2725
mov si, sp
mov dword [esp], edx
popal
jmp 0xbe27ac
xor ecx, edi
pushal
bswap eax
lea eax, reloc.RASAPI32.dll_RasHangUpA
jmp 0xbe2746
and edx, esi
cmc
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
cmc
jmp 0xbe2787

Function at 0xbe2bd2
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushfd
lea esp, [esp + 8]
jl 0xbaeb91
mov ax, word [esp]
pushfd
jmp 0xbe2c2b
jmp 0xbe2bae
mov eax, dword [ebp - 8]
lea esp, [esp + 4]
jmp 0xbaebba

Function at 0xbe2dc2
Capabilities:
Encrypt data using aes

Disassembly:
cmc
jmp 0xbe2de0
mov byte [esp + 2], bl
and edx, ecx
jmp 0xbe2dac
push ebx
jmp 0xbe2e4c
lea esp, [esp + 8]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
lea edx, reloc.RASAPI32.dll_RasHangUpA
neg edx
jmp 0xbe2dca
mov ebx, esi
add ebx, 4
mov edx, dword [ebx]
pop ebx
call fcn.00be2e21
lea eax, [eax*4]
lea eax, reloc.RASAPI32.dll_RasHangUpA
mov ebx, dword [eax]
pop eax
inc edi
jmp 0xbe2eb6
sub esp, 0x10
and edi, ecx
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
call fcn.00be2e83
pop ecx
invalid
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0xbe2e99

Function at 0xbe2f16
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
inc bl
jmp 0xbe2ecb

Function at 0xbe2ff1
Capabilities:
Encrypt data using aes

Disassembly:
setae bl
lea esp, [esp + 2]
movzx ebx, byte [esi + 0xa]
sub esp, 0x10
jmp 0xbe2fdb

Function at 0xbe310d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea edi, [ecx + edi]
push eax
jmp 0xbe3362
mov dword [esp + 8], edi
popal
jmp 0xbe316e
shr edi, 0x18
push ebp
pushal
jmp 0xbe313b
lea ebp, [ebp*4]
lea ebp, reloc.RASAPI32.dll_RasHangUpA
mov edi, dword [ebp]
pop ebp
call 0xbe3158
pop eax
mov edi, dword [esp]
mov edi, ebp
lea edi, [esi - 0x29]
mov edi, edx
jmp 0xbe3151
mov eax, ebx
lea eax, [eax*4]
lea eax, reloc.RASAPI32.dll_RasHangUpA
mov ebx, dword [eax]
jmp 0xbe31c7

Function at 0xbe3184
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
clc
sub esp, 0xd
lea esp, [esp + 1]
jmp 0xbe31a1
and ebx, ecx
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
setns bl
jmp 0xbe32d3
lea ebx, [eax + ecx]

Function at 0xbe31ed
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
pushfd
jmp 0xbe324f
add esp, 0
jmp 0xbe31d7
lea esp, [esp + 0x18]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0xbe3230
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
and edx, ecx
sub esp, 0x18
jmp 0xbe31f2
and edx, ecx
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
and ebx, ecx
jmp 0xbe3208
Function at 0xbe321a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
call fcn.00be3238
ficomp dword [ecx - 0x37]
test al, 0x5b
call 0x4fe6ec65
mov edx, 0x6d721b0b
jl 0xbe327f
dec dword [ebp - 4]
call fcn.00be321a

Function at 0xbe3238
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esi + 0xc], edi
jmp 0xbe32a6
lea esp, [esp + 8]
jne 0xbaebd0
je 0xbaebe6

Function at 0xbe429c
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.00be42ae
popfd
jmp 0x1b5457f9
call fcn.00be4338
bound esp, qword [ebx - 0x779ef78e]
pop ebp
daa
test ebx, ebx
cdq
cli
mov edi, 0x8b303186
pop ebp
or al, 0xeb
in eax, 0x96
or edi, dword [esi - reloc.RASAPI32.dll_RasHangUpA]
mov bh, 0xec
sub ah, byte [ebx]
mov eax, 0xf900bdf
pushfd
pushfd
mov ebx, dword [ebp + 0xc]
jmp 0xbaef68
jmp 0xbe42ba
mov edx, 0x79e4bdc5
shr ecx, 0x12
mov dh, 0x13
mov edx, 0x9292b4cf
btr edx, ebx
jmp 0xbe423c
popal
push 0x3f
mov esi, eax
btr dx, sp
jmp 0xbe41fc
sub esp, 0xd
lea esp, [esp + 1]
jmp 0xbe425a
pop edx
shr esi, 0xc
and ecx, edx
jmp 0xbe4226
jb 0xbaef4d
jae 0xbe427c
push ebp
rol byte [eax + 0x27], cl
shl byte [ebx - 0x2b], cl
push edi
invalid
and esi, edx
lea esp, [esp + 0xc]
cmp dword [ebp + 0xc], 2
jmp 0xbe4244
and edi, edx
jmp 0xbe42d3
mov edi, eax
sub esp, 0x1d
lea esp, [esp + 1]
shr edi, 6
jmp 0xbe4266
push word [esp + 2]
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0xbe421b
pushfd
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0xbe42f2
lea esp, [esp + 0x1c]
jmp 0xbaefdc
and eax, edx
mov bx, word [esp]
call fcn.00be431c
movsd dword es:[edi], dword [esi]
sub bh, byte [eax - 0x3410d521]
bound ebx, qword [ebp + 0x7d83ffec]
or al, 3
cmp dword [ebp + 0xc], 3
jne 0xbaef7e
lea ebx, [esi*4]
jmp 0xbe42dc

Function at 0xbe42ae
Capabilities:
Encrypt data using speck

Disassembly:
mov edi, dword [ebp + 0xc]
lea esp, [esp + 4]
jmp 0xbaefdc

Function at 0xca5a13
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [esp + 1]
push dword [esp + 3]
xchg word [esp], dx
jmp 0xca5a33

Function at 0xca5cf5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x11], ebx
xchg bx, dx
jmp 0xca5c19

Function at 0xca5d2f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xca5d6e
mov dx, word [esp + 1]
not bx
cmp ax, cx
btc bx, dx
xchg al, bl
bt bx, sp
jmp 0xca5d58
Function at 0xca5f9e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
mov dword [esp], ebx
rdtsc
mov ax, cx
not ah
mov dword [esp], ecx
jmp 0xca5fc3
lea esp, [esp + 0x43]
jmp 0xca5f88
adc ebx, edi
mov bl, byte [esp + 1]
neg edx
rol bx, cl
rol ebx, cl
push word [esp + 1]
jmp 0xca5fd9
pop word [esp]
lea eax, reloc.RASAPI32.dll_RasHangUpA
setns ah
std
bsf ax, cx
xchg dl, bh
jmp 0xca5fa4
pop ebx
stc
cmp ax, 0xe770
and eax, 0xe508a40d
xchg ah, dl
bsr eax, edx
jmp 0xca6b39
rdtsc
bts eax, eax
mov word [esp], dx
sub esp, 0x16
pop dx
jmp 0xca601a
pop word [esp + 0xf]
mov dx, word [esp]
mov al, 0x64
setbe bl
xchg dword [esp], edx
rdtsc
jmp 0xca5fef
xchg byte [esp + 0x1d], bh
inc ax
bsf bx, si
bswap edx
add esp, 0x20
rdtsc
jmp 0xca6065
mov ax, 0xdbc4
mov byte [esp + 0xa], al
inc dx
pop eax
lea esp, [esp + 4]
mov dl, byte [esp + 0xb]
jmp 0xca6005
neg eax
mov al, 0xac
bswap ebx
bswap edx
mov edx, esi
sub esp, 0xd
jmp 0xca60e6
sub dx, 0xa2da
inc al
mov ah, byte [esp + 4]
lea edx, [ebx + ebp]
pop word [esp]
pop bx
jmp 0xca604f
mov byte [esp + 6], bl
xchg byte [esp + 2], al
not dl
push word [esp + 1]
mov ebx, esp
xchg word [esp + 0x11], bx
jmp 0xca603a
add esp, 0x2b
mov dl, byte [esp + 1]
mov bx, cx
mov eax, edi
lea edx, [esp - 0x44]
jmp 0xca610e
bsr bx, si
mov al, byte [esp + 4]
xchg bx, ax
lea ebx, [ecx*4]
mov ebx, 0x900ac5ef
btr dx, sp
jmp 0xca609e
pushal
lea eax, [esi*4]
xchg byte [esp + 0x1b], dl
stc
pop ax
cmc
jmp 0xca60b4
btc edx, edx
mov al, ah
mov word [esp], ax
lea eax, [edi + ebp]
sbb bx, di
jmp 0xca64f5
not bl
xchg bx, ax
xchg bx, ax
or dx, 0xd201
lea ebx, reloc.RASAPI32.dll_RasHangUpA
std
jmp 0xca60f8
pop dword [esp + 0xc]
mov eax, dword [esp + 0x12]
rdtsc
xchg dx, ax
mov eax, dword [esp + 0x12]
mov ebx, 0x1206ae52
jmp 0xca6086
mov dword [esp + 0x13], ecx
dec edx
shr bl, cl
bswap ebx
mov bx, word [esp + 0xd]
mov ah, 0xd9
jmp 0xca617c
cmc
mov edx, dword [esp + 0x16]
lea edx, [ebx*4]
lea esp, [esp + 6]
mov bh, dh
add esp, 0
jmp 0xca6147
mov bh, byte [esp + 0x1a]
rol bh, 7
xchg edx, ebx
btr ebx, esp
push edx
mov dx, di
jmp 0xca634b
mov byte [esp], cl
mov al, 0xec
lea edx, [esi*4]
not ebx
pushal
xchg dword [esp + 0x13], edx
jmp 0xca6165
not dx
mov ebx, 0xc6b2d238
call fcn.00ca61e1
inc edi
je 0xca6207
inc ebx
push eax
add byte [edx], dh
sub eax, 0x66241c8a
dec ebx
mov bl, byte [esp]
dec bx
mov eax, dword [esp]
and dx, 0xad9
mov ebx, 0xb8383754
mov ah, 0x62
jmp 0xca61b5
cmc
cld
sbb edx, 0x78bbd947
btr bx, dx
xchg dx, ax
lea eax, [esi*4]
add al, 0xb5
add byte [eax], al
add byte [eax], al
jmp 0xca61cb
add esp, 0
xchg dh, al
mov bl, byte [esp]
mov ebx, dword [esp]
lea eax, reloc.RASAPI32.dll_RasHangUpA
btr ax, di
jmp 0xca61f7
std
shr dh, cl
sub esp, 0x15
mov dl, byte [esp]
lea esp, [esp + 0x35]
lea esp, [esp + 1]
jmp 0xca6232
lea ebx, [esp - 0xaf]
bsr ebx, esp
push ebp
neg dl
cmp dx, di
pop ax
jmp 0xca62b7
not ax
sbb edx, 0x14863090
mov ah, al
rdtsc
neg bl
xchg al, dh
jmp 0xca61a0
rdtsc
pushal
pop word [esp + 0x14]
mov bx, ax
shr dx, cl
mov bl, 1
jmp 0xca612c
Function at 0xca61e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
push esp
add esp, 8
lea edx, [ebx + ebp]
jmp 0xca620f
sets dh
mov dl, 0x5d
ror bh, cl
bswap eax
mov ebx, dword [esp]
xchg byte [esp], bh
jmp 0xca6268
stc
lea ebx, [esi + esi]
lea eax, [ebp*4]
lea edx, [ecx*4]
not bl
not ebx
jmp 0xca6293
mov byte [esp], ah
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov dh, 0x2b
shr bh, cl
push esp
mov ebx, 0x5604647e
jmp 0xca6249
cld
mov bh, ah
mov eax, dword [esp + 3]
mov ebx, dword [esp + 2]
push dword [esp]
jmp 0xca62e8
rdtsc
mov bl, byte [esp]
mov word [esp], si
mov al, byte [esp + 2]
rdtsc
rdtsc
jmp 0xca627d
mov bx, 0xab54
xchg edx, eax
ror bl, cl
lea esp, [esp]
neg dh
lea esp, [esp]
jmp 0xca6318
mov word [esp + 6], bx
xchg bx, dx
push dword [esp + 3]
bswap eax
lea esp, [esp + 0xb]
cmc
jmp 0xca62cd
xchg byte [esp], ah
setge dl
rdtsc
not bh
cld
bsf ebx, eax
jmp 0xca632c
lea esp, [esp + 1]
neg edx
mov al, bh
btc dx, bp
mov byte [esp], cl
not ax
jmp 0xca62fd
lea ebx, reloc.RASAPI32.dll_RasHangUpA
rcl edx, cl
mov bh, byte [esp]
neg eax
lea edx, reloc.RASAPI32.dll_RasHangUpA
bsf edx, ebp
jmp 0xca64a6
lea esp, [esp]
mov ebx, ecx
setge ah
mov byte [esp], bl
mov ah, 0xca
clc
call fcn.00ca63cd
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x79]
ror dword [edi], cl
cwde
invalid
xchg ebx, edx
sets bh
xchg bx, dx
bsf ax, di
mov bx, 0xff18
stc
jmp 0xca6362
bsr ax, dx
xchg byte [esp], dh
lea ebx, [eax + 0xad]
lea eax, [eax + ebp]
neg ax
mov edx, esi
jmp 0xca6378
not eax
rcl dx, cl
lea ebx, [edi*4]
mov ebx, esp
lea eax, [ebx*4]
sbb edx, 0x6c800d1
jmp 0xca63a0
mov bl, 0x3a
bswap edx
rol ebx, 3
mov ax, 0x5ca6
cmc
mov ax, word [esp]
jmp 0xca640b
Function at 0xca6545
Capabilities:
Execute anti-debugging instructions

Disassembly:
setne bl
mov ebx, 0x2f4e2da0
bsr bx, di
xchg dh, al
jmp 0xca63e5
jmp 0xca63b7
mov edx, dword [esp + 0x1a]
lea esp, [esp + 3]
mov eax, 0x5f6c8e60
jmp 0xca6455
mov word [esp], ax
xchg word [esp + 2], bx
lea edx, [ecx + edi]
push ax
pushal
xchg byte [esp + 0xb], bh
jmp 0xca63cf
cld
xchg word [esp + 0x19], bx
mov ah, 0x65
xchg dx, ax
inc dx
pop ebx
jmp 0xca643f
bswap eax
pop ebx
push word [esp + 0xb]
pop ebx
mov edx, 0xf54a44a4
jmp 0xca6484
pop dword [esp + 0x11]
lea esp, [esp + 0xc]
xchg dword [esp + 0xf], eax
pop word [esp + 0xf]
add esp, 8
sub esp, 0x15
jmp 0xca642b
bswap eax
std
mov bh, 0x35
xchg dword [esp + 0xe], eax
sub esp, 0x1c
rdtsc
jmp 0xca64d1
sub esp, 0x10
setl ah
mov byte [esp + 0x1a], ah
add esp, 0xf
lea ebx, [edx + esi]
mov bl, 0x46
jmp 0xca646e
xchg word [esp + 0x12], dx
lea eax, [edi - 0x6f]
mov byte [esp + 0x12], dl
call fcn.00ca64bb
inc edi
je 0xca6536
jb 0xca6557
arpl word [ecx + 0x64], ax
jb 0xca6553
jae 0xca6563
add byte [edx - 0x63], ah
in al, dx
jmp dword [esi - 9]
xchg byte [esp], bl
not al
pop ax
xchg word [esp], ax
sub esp, 0xd
jmp 0xca655b
jo 0xca6592
push 0xffffffffffffff85
shr ebx, cl
mov bx, cx
xchg dl, bl
cld
lea eax, [eax*4]
rcr ebx, 7
jmp 0xca650b
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
push ebp
outsb dx, byte [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ebx], bp
xor al, 0xeb
fadd qword [eax - 0x4cf0ed06]
jecxz 0xca6537
and al, byte [edi + 0x6c]
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
daa
dec esi
bsf ax, ax
pop word [esp + 9]
bts bx, bp
mov ah, 0x5f
call 0xca6545
bswap ebx
mov ebx, 0x8339e673
mov byte [esp + 5], ch
mov ax, word [esp + 2]
cld
rdtsc
jmp 0xca688f
or dword [esi + 0xf], esp
stosd dword es:[edi], eax
jmp 0xca651d
outsb dx, byte [esi]
insb byte es:[edi], dx
inc ecx
add cl, bl
lea esp, [esp + 0x54]
mov bh, byte [esp]
neg ax
xchg ebx, eax
rcl eax, 0x19
bsf ebx, ebx
call 0xca6543
cld

Function at 0xca668a
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
mov bh, 0xe3
xchg word [esp + 3], bx
mov dword [esp + 4], esi
mov bx, dx
jmp 0xca66a9

Function at 0xcab036
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dword [esp + 0x48], esi
push ebp
mov dword [esp + 0x48], edi
jmp 0xcab0bc
push eax
jmp 0xcaa03b
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xcab054
lea esp, [esp + 0x48]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xcab06b
Function at 0x401375
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebx]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
je 0x4013f4
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
push dword [ebp + 8]
push eax
call edi
cmp dword [ebp - 8], 1
je 0x4013ac
cmp dword [ebp - 8], 2
jne 0x4013f3
push esi
mov esi, dword [ebp + 0xc]
call fcn.00401735
mov eax, dword [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.0040197a
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebx]
call edi
test eax, eax
jne 0x4013ea
mov eax, dword [ebp - 4]
shr eax, 1
and word [esi + eax*2], 0
mov dword [ebp - 0xc], 1
mov esi, dword [ebp + 0xc]
call fcn.00401780
pop esi
pop edi
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x4022cd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4022e4
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x402319
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x402315
cmp edi, eax
jae 0x402319
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x402307
cmp edi, eax
jb 0x40231d
xor eax, eax
jmp 0x402327
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x402458
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push closesocket
xor esi, esi
push esi
push esi
mov dword [ebp - 4], 0xfffffffd
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, esi
jne 0x402481
or eax, 0xffffffff
jmp 0x4024d4
push edi
push 6
pop ecx
push 0xf01ff
push str.kxescore
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jne 0x4024b5
mov dword [ebp - 4], 0xfffffffe
jmp 0x4024cd
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4024ca
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
push edi
call esi
push ebx
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret