joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465500
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4a2aa3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00495ae6
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0049b185
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0049c6a1
test eax, eax
je 0x46561c
mov ecx, dword [esp + 0x3c]
call fcn.0049b1b2
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4655e0
push edi
mov ecx, esi
call fcn.00498810
mov ecx, esi
call fcn.00465780
cmp dword [esp + 0x38], 1
jne 0x465615
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0049894b
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x468040
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x468073
push esi
call fcn.0046b150
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x46806c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4680f9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4680e2
mov eax, dword [esi + 8]
test eax, eax
je 0x468097
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4680de
cmp eax, 2
je 0x4680e2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46808a
cmp eax, 3
je 0x4680bd
cmp eax, 1
jne 0x46808a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x46808a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x46808a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00468120
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x468108
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00468120
add esp, 4
pop esi
ret

Function at 0x4750e0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x475183
test eax, eax
jbe 0x475183
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x475183
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x47512e
xor esi, esi
jmp 0x475134
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x47515f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00429790
add esi, eax
push esi
mov ebx, esi
call fcn.00429790
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x475140
pop ebp
test edi, edi
pop edi
jne 0x475183
test ebx, ebx
je 0x475183
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00484330
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4752c5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4753dd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4753dd
mov eax, dword [esi + 0x3c]
push eax
call fcn.00495f38
mov esi, eax
test esi, esi
je 0x4753dd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4753dd
mov ecx, esi
call fcn.00475230
cmp edi, eax
jge 0x4753dd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x475363
mov dword [esp + 0x34], 1
jmp 0x4753be
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4753dd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00473a90
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x478e40
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x478ea6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x478ea6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x478e87
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x479a40
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x479a89
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x479f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a3450
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00479ab0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00479b30
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00479b30
lea ecx, [esi + 0xc]
call fcn.00494499
lea ecx, [esi + 0x10]
call fcn.00494499
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0047b0c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0047b0c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0047b0c0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0049450e
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0049450e
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4968dc
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x496914
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00494969
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00494941
jmp 0x496920
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x497fcd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49800f
call fcn.0049db46
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49800f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x498006
xor eax, eax
jmp 0x498017
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049801d
pop edi
pop esi
pop ebx
ret 4

Function at 0x49e076
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49e0a4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49e0c2
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049dfdc
jmp 0x49e0c2
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49e0c2
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049dfdc
test edi, edi
mov eax, edi
jne 0x49e0ac
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x641f87
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [ebp*4]
mov dx, sp
neg dh
mov di, word [esp]
neg ebx
rcr ah, 1
jmp 0x641fb2
xchg edx, ecx
mov edi, dword [esp]
xchg edi, edx
jmp 0x641f65
Function at 0x642666
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [eax + 0x21]
xchg dh, al
and edx, ecx
mov dword [esp], ebp
jmp 0x6426e7
mov ebp, ecx
xchg bp, ax
xchg ebx, eax
pop word [esp + 0x14]
cpuid
lea edi, [ebp + 0x6f]
jmp 0x6426cf
mov byte [esp + 0x19], bh
xchg dword [esp + 0x19], ecx
mov si, 0x8f69
pop bx
pop dx
sub esp, 6
jmp 0x642785
btc edi, edi
push dword [esp + 0xb]
push dword [esp + 0x19]
xchg ch, dl
mov esi, eax
jmp 0x6426a9
mov byte [esp + 5], ah
sub esp, 0x18
cmc
setnp ah
mov word [esp + 0x10], di
xchg ebp, eax
jmp 0x642672
xchg edx, ebx
rdtsc
bswap ebx
mov ebx, 0xcd92afaa
push word [esp + 4]
not ah
jmp 0x64276b
xchg word [esp + 0x10], si
lea ebp, [eax + 0x11]
pop di
mov byte [esp + 0xf], ah
neg cx
pop ax
jmp 0x6426fd
lea eax, [esi - 0x9d]
push esp
lea esp, [esp + 3]
not ebx
xchg edx, ebx
mov ch, byte [esp]
jmp 0x64271b
rdtsc
cpuid
pop ebp
neg ebx
btr edx, esp
not bx
jmp 0x64279a
xchg esi, eax
bswap edi
pop ebx
neg bx
xchg esi, eax
xchg dword [esp + 0xb], edx
jmp 0x642749
xchg word [esp + 0xa], si
mov esi, ebp
ror esi, 0xf
pop ecx
lea esp, [esp + 0xd]
xchg byte [esp + 0x10], al
jmp 0x642735
mov si, sp
cpuid
clc
pop dx
lea ebx, [eax - 0xc1]
mov ebx, esi
jmp 0x6427e5
shr ecx, 9
push edx
mov dx, di
neg dh
pop cx
push dword [esp + 1]
jmp 0x6427cd
Function at 0x6428aa
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc bl
push edx
popal
ror dh, 7
mov ebx, dword [esp]
jmp 0x6428f7
xchg word [esp], bp
lea edx, [edi*4]
xchg cx, ax
bswap edx
mov di, dx
add esp, 4
jmp 0x64294f
lea ecx, [ecx + edi]
shr ch, 5
inc dl
btr ebx, edx
mov ebx, ebp
shr edi, 0x13
jmp 0x6429c2
btc edi, ebx
mov bp, dx
bswap edi
mov cx, di
cld
mov esi, eax
jmp 0x64292f
xchg dx, cx
pop si
setae ch
pop ecx
mov ebp, dword [esp]
mov ecx, dword [esp]
jmp 0x6429d4
xchg ecx, esi
mov dl, 0xdc
lea esp, [esp + 2]
pop word [esp + 2]
mov word [esp + 3], dx
rdtsc
jmp 0x64297b
stc
lea ecx, [esp + eax]
bsf si, ax
xchg bx, dx
mov edx, eax
sub esp, 0xa
jmp 0x64299b
lea esp, [esp]
mov dl, 0x8c
rol cx, cl
rdtsc
rcr edx, 0xd
not ah
jmp 0x642ca8
bsr cx, bp
pop esi
call fcn.00642a92
and esi, ecx
xchg word [esp + 5], bx
lea edx, [ebp*4]
bswap edx
jmp 0x642b7b
rdtsc
push word [esp + 7]
xchg byte [esp + 0xa], dl
rdtsc
lea ecx, [edi*4]
mov di, sp
jmp 0x642c56
xchg dword [esp + 4], eax
add esp, 5
xchg dword [esp], eax
bsf di, si
jmp 0x642c24
mov cx, word [esp + 2]
push dword [esp + 0xd]
push edx
lea esp, [esp + 0x10]
xchg byte [esp + 6], dl
mov bl, 0x80
jmp 0x642ba7
mov cx, word [esp + 2]
lea esi, [eax + 0xb9]
sete bh
mov dh, byte [esp + 1]
sub esp, 8
push dword [esp + 1]
jmp 0x642bbf
mov ax, 0x14f9
not dx
mov dx, bx
bsr cx, cx
call fcn.00642bfd
pop edx
lea eax, [eax + 0xa1]
bswap edi
rdtsc
lea eax, [ebp + 0xff]
lea ebx, [edi*4]
jmp 0x642c84
not esi
mov dl, 0xbc
add esp, 7
xchg dword [esp], ecx
mov esi, 0x559c3c2
mov cx, 0xddf
jmp 0x642be2
mov ax, word [esp]
xchg ebp, edi
btc edi, ebx
bsf ax, si
add esp, 1
jmp 0x642cc2
xchg ebx, ecx
btr ebx, edx
inc al
inc ebx
btc edi, ebx
mov eax, esi
jmp 0x642c6e
sub esp, 0x1a
btc ebp, ebx
lea ebp, [ecx - 0x33]
add esp, 0x13
xchg byte [esp + 6], al
xchg word [esp + 1], di
jmp 0x642b4f
mov eax, 0x4bf007b2
lea esp, [esp]
sete dh
bsr cx, cx
xchg bp, dx
mov dx, word [esp]
jmp 0x642fe7
mov bh, byte [esp]
mov cx, word [esp]
lea esp, [esp + 1]
popal
call fcn.00642d62
cmc
pushfd
outsd dx, dword [esi]
fild dword [ebx]
xchg esi, eax
add al, 0x63
sahf
aaa
xchg dword [edi + 0x2c8b66c7], eax
and al, 0xfc
xchg edi, eax
mov bp, word [esp]
cld
mov bp, 0x3ed1
lea esp, [esp]
xchg byte [esp], al
jmp 0x642cee
cpuid
bsr dx, cx
lea ebp, [eax + edi]
mov dx, word [esp + 0x19]
popal
setle bh
jmp 0x642d0c
mov ch, byte [esp]
setl dh
pushal
lea esi, [ecx - 0x3b]
xchg byte [esp + 0x16], dl
xchg word [esp + 1], si
jmp 0x642d25
mov esi, dword [esp]
rdtsc
add ecx, ebp
lea ebp, [esi - 0xed]
xchg byte [esp], al
mov edi, dword [esp]
jmp 0x642d4d
stc
cpuid
inc esi
rdtsc
mov ecx, esi
mov eax, 0xd1798ebe
jmp 0x642d8c

Function at 0x642a92
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0xf]
pop dx
pushal
pop dword [esp + 0xc]
btc ebx, ebx
pop edi
jmp 0x642a7a
xchg ebp, eax
mov si, bx
rdtsc
rol bp, cl
mov ax, dx
push word [esp + 3]
jmp 0x642a35
mov edi, dword [esp + 0x17]
mov dl, dh
not ebx
xchg word [esp + 0x19], cx
not bp
rdtsc
call fcn.00642a5f
xchg ecx, eax
mov ax, bx
setno ch
push word [esp + 1]
push dword [esp + 2]
jmp 0x642a4c
Function at 0x642ad4
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ebp
lea ecx, [esp + ebp]
sub esp, 8
jmp 0x642ae3
shr ecx, 0x1d
mov cl, ch
pop dword [esp]
push dword [esp + 6]
lea edi, [eax + edx]
mov si, word [esp + 8]
jmp 0x642b37
neg cx
inc al
rdtsc
add esp, 1
pop ecx
cpuid
jmp 0x642ba0
add esp, 5
mov dx, bx
rdtsc
lea esp, [esp + 1]
mov edx, ecx
add esp, 1
jmp 0x642b1d
inc bp
call fcn.00642b71

Function at 0x642b59
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc bl
push edx
popal
ror dh, 7
mov ebx, dword [esp]
jmp 0x6428f7
xchg word [esp], bp
lea edx, [edi*4]
xchg cx, ax
bswap edx
mov di, dx
add esp, 4
jmp 0x64294f
lea ecx, [ecx + edi]
shr ch, 5
inc dl
btr ebx, edx
mov ebx, ebp
shr edi, 0x13
jmp 0x6429c2
btc edi, ebx
mov bp, dx
bswap edi
mov cx, di
cld
mov esi, eax
jmp 0x64292f
xchg dx, cx
pop si
setae ch
pop ecx
mov ebp, dword [esp]
mov ecx, dword [esp]
jmp 0x6429d4
xchg ecx, esi
mov dl, 0xdc
lea esp, [esp + 2]
pop word [esp + 2]
mov word [esp + 3], dx
rdtsc
jmp 0x64297b
stc
lea ecx, [esp + eax]
bsf si, ax
xchg bx, dx
mov edx, eax
sub esp, 0xa
jmp 0x64299b
lea esp, [esp]
mov dl, 0x8c
rol cx, cl
rdtsc
rcr edx, 0xd
not ah
jmp 0x642ca8
bsr cx, bp
pop esi
call fcn.00642a92
and esi, ecx
xchg word [esp + 5], bx
lea edx, [ebp*4]
bswap edx
jmp 0x642b7b
rdtsc
push word [esp + 7]
xchg byte [esp + 0xa], dl
rdtsc
lea ecx, [edi*4]
mov di, sp
jmp 0x642c56
xchg dword [esp + 4], eax
add esp, 5
xchg dword [esp], eax
bsf di, si
jmp 0x642c24
mov cx, word [esp + 2]
push dword [esp + 0xd]
push edx
lea esp, [esp + 0x10]
xchg byte [esp + 6], dl
mov bl, 0x80
jmp 0x642ba7
mov cx, word [esp + 2]
lea esi, [eax + 0xb9]
sete bh
mov dh, byte [esp + 1]
sub esp, 8
push dword [esp + 1]
jmp 0x642bbf
mov ax, 0x14f9
not dx
mov dx, bx
bsr cx, cx
call fcn.00642bfd
pop edx
lea eax, [eax + 0xa1]
bswap edi
rdtsc
lea eax, [ebp + 0xff]
lea ebx, [edi*4]
jmp 0x642c84
not esi
mov dl, 0xbc
add esp, 7
xchg dword [esp], ecx
mov esi, 0x559c3c2
mov cx, 0xddf
jmp 0x642be2
mov ax, word [esp]
xchg ebp, edi
btc edi, ebx
bsf ax, si
add esp, 1
jmp 0x642cc2
xchg ebx, ecx
btr ebx, edx
inc al
inc ebx
btc edi, ebx
mov eax, esi
jmp 0x642c6e
sub esp, 0x1a
btc ebp, ebx
lea ebp, [ecx - 0x33]
add esp, 0x13
xchg byte [esp + 6], al
xchg word [esp + 1], di
jmp 0x642b4f
mov eax, 0x4bf007b2
lea esp, [esp]
sete dh
bsr cx, cx
xchg bp, dx
mov dx, word [esp]
jmp 0x642fe7
mov bh, byte [esp]
mov cx, word [esp]
lea esp, [esp + 1]
popal
call fcn.00642d62
cmc
pushfd
outsd dx, dword [esi]
fild dword [ebx]
xchg esi, eax
add al, 0x63
sahf
aaa
xchg dword [edi + 0x2c8b66c7], eax
and al, 0xfc
xchg edi, eax
mov bp, word [esp]
cld
mov bp, 0x3ed1
lea esp, [esp]
xchg byte [esp], al
jmp 0x642cee
cpuid
bsr dx, cx
lea ebp, [eax + edi]
mov dx, word [esp + 0x19]
popal
setle bh
jmp 0x642d0c
mov ch, byte [esp]
setl dh
pushal
lea esi, [ecx - 0x3b]
xchg byte [esp + 0x16], dl
xchg word [esp + 1], si
jmp 0x642d25
mov esi, dword [esp]
rdtsc
add ecx, ebp
lea ebp, [esi - 0xed]
xchg byte [esp], al
mov edi, dword [esp]
jmp 0x642d4d
stc
cpuid
inc esi
rdtsc
mov ecx, esi
mov eax, 0xd1798ebe
jmp 0x642d8c
Function at 0x642bfd
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr edx, edx
mov di, dx
jmp 0x642c09
neg ch
btc eax, edi
xchg dword [esp + 2], ebx
pop dx
bswap edi
mov dl, 0x14
jmp 0x642c37

Function at 0x64500e
Capabilities:
Access peb ldr_data
Encode data using xor
Execute anti-debugging instructions
Parse pe header

Disassembly:
call fcn.00644056
push dword [esp + 0xe]
push word [esp + 0xe]
pop word [esp + 6]
lea esp, [esp + 0x11]
lea esp, [esp + 2]
jmp 0x64521a
push eax
jmp 0x644051
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x64517f
mov dword [esp + 0x6c], edi
lea esp, [esp + 0x6c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x6451b4

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x40ee70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x479b2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046c171
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40eef2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00469b60
mov eax, dword [eax]
push 0x4af230
push eax
call fcn.0045bc74
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046c3fc
test bl, bl
je 0x40eef2
push 0x4af230
lea ecx, [esp + 0xc]
call fcn.0046c7d8
push 0x4b2dac
lea ecx, [esp + 0xc]
call fcn.0046c7d8
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40ef2e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046c3fc
jmp 0x40eff9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40efb2
lea edx, [esp + 0x7c]
push 0x4b2da8
push edx
call fcn.0045bc74
add esp, 8
test eax, eax
je 0x40efb2
lea eax, [esp + 0x7c]
push 0x4b2da4
push eax
call fcn.0045bc74
add esp, 8
test eax, eax
je 0x40efb2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40ef42
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046c3fc
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40f7f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40f852
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc