joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e8d5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44e9ed
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44e9ed
mov eax, dword [esi + 0x3c]
push eax
call fcn.00465982
mov esi, eax
test esi, esi
je 0x44e9ed
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44e9ed
mov ecx, esi
call fcn.0044e840
cmp edi, eax
jge 0x44e9ed
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44e973
mov dword [esp + 0x34], 1
jmp 0x44e9ce
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44e9ed
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044de40
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x466326
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46635e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004643da
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004643b2
jmp 0x46636a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x467a18
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x467a5a
call fcn.0046d510
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x467a5a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x467a51
xor eax, eax
jmp 0x467a62
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00467a68
pop edi
pop esi
pop ebx
ret 4
Function at 0x46da40
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46da6e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46da8c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046d9a6
jmp 0x46da8c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46da8c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046d9a6
test edi, edi
mov eax, edi
jne 0x46da76
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x454331
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
mov edi, 0xc519e8d0
lea esp, [esp + 1]
jmp 0x454359
movzx eax, byte [eax + 0xf]
mov bl, 0x60
shl edx, 8
lea edi, [edi + edi]
jmp 0x45439d
not si
shl edx, 8
pushal
btr ebp, esp
pop word [esp + 0x1b]
jmp 0x454479
mov bx, word [esp]
xor edx, esi
xchg bp, bx
btc ebp, edi
ror bh, 3
jmp 0x454382
lea esp, [esp + 0x34]
mov esi, 0xff
not edi
ror ebp, 0x1b
jmp 0x45445d
shr eax, 0x10
lea esi, [edx*4]
not esi
xchg bh, bl
lea esi, [ebp - 0xd7]
jmp 0x4543e9
mov dword [ecx + 0xc], edx
mov eax, edx
sub esp, 0x1a
mov bp, word [esp + 0x18]
lea esp, [esp + 2]
jmp 0x454404
stc
xor eax, 0x1000000
push edx
mov bl, bh
jmp 0x4544e3
and eax, esi
mov di, word [esp]
mov eax, dword [eax*4 + reloc.USER32.dll_MessageBoxA]
mov bl, bh
jmp 0x45443f
lea esp, [esp + 2]
xor edx, eax
mov si, word [esp]
setle al
jmp 0x45442c
and edi, esi
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
lea esp, [esp + 0x18]
and edi, 0xff0000
jmp 0x4544c1
shr edi, 8
lea ebx, [edx*4]
mov bl, bh
mov bl, 0xdc
jmp 0x454488
mov ebp, dword [esp]
xchg bl, bh
mov ebx, dword [ecx + 4]
bswap ebp
mov bp, word [esp]
jmp 0x454532
mov edi, edx
sub esp, 0x16
mov dword [esp + 0x11], eax
lea esp, [esp + 2]
jmp 0x4544b1
bswap ebp
xor eax, edi
mov edi, dword [esp]
mov bp, 0xb939
bsr bp, bp
jmp 0x4545b1
btr ebp, edi
and eax, 0xff000000
bswap ebp
lea ebp, [edx + edx]
lea ebp, [ecx + 0xdb]
jmp 0x454517
shr edi, 0x18
bswap ebp
call fcn.00454586
fcomp dword [ebx - 0x35]
scasb al, byte es:[edi]
pop ebp
lahf
mov esp, 0x75c43552
or dword [eax - reloc.USER32.dll_MessageBoxA], ebp
cmp dh, bh
aad 0xeb
fidiv word [ebx - 0x20]
jbe 0x45457e
popal
mov bp, 0x3a67
not ebp
jmp 0x454547
loopne 0x4545c4
invalid
pushal
mov dword [esp + 0x20], edx
clc
cmc
push esp
lea esp, [esp + 0x24]
jmp 0x454560
mov di, sp
pushal
mov ax, dx
xchg ch, al
xchg esi, edi
jmp 0x454578
mov edi, dword [ecx]
pop ecx
jmp 0x454603
lea esp, [esp + 4]
mov ebp, 0xff00
pushal
pop dword [esp + 0x12]
clc
jmp 0x454962
lea edi, [ecx + 0x10]
call fcn.0045467f
push edx
mov edx, ecx
lea edx, [edx + 0x18]
jmp 0x454904
lea esp, [esp + 0x3c]
xor eax, dword [ecx]
mov di, 0xc6b3
mov di, 0x19ad
jmp 0x4546c4
mov dword [edx], eax
pop edx
call fcn.004548a1
mov dword [edi], ecx
mov dl, 0x1c
push esp
jmp 0x45494b
mov edx, dword [eax + 4]
pushal
jmp 0x4549af
and edi, ebp
pushal
mov dword [esp + 9], ebp
xor eax, edi
jmp 0x4546e6
pushal
xor ecx, edx
mov dword [eax + 0x18], ecx
jmp 0x454b23
bsf cx, si
rcr ecx, 0x1d
mov ecx, dword [eax + 8]
push edx
cmc
jmp 0x454970
xor edx, ecx
mov dword [eax + 0x14], edx
mov cl, 0x52
lea ecx, [esi*4]
jmp 0x45498c
mov edx, dword [eax + 0xc]
xor edx, ecx
push ebp
jmp fcn.00454add
Function at 0x455264
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
jmp 0x45524d
pushal
push word [esp + 0x1f]
mov dword [esp + 7], esi
cmc
lea esp, [esp + 2]
jmp 0x45520f
and ebx, ecx
jmp 0x45528e
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
pushal
jmp 0x455237
push word [esp + 3]
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
jmp 0x455226
movzx ebx, byte [esi + 0xa]
jmp 0x4552a5
lea esp, [esp + 0x54]
xor edi, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
lea ebx, [edx + ebx]
mov bx, word [esp]
mov bl, byte [esp]
jmp 0x455276
mov ebx, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
and ebx, ecx
sub esp, 0x10
mov word [esp + 6], di
jmp 0x455648
and edx, ecx
pushal
mov edx, dword [edx*4 + reloc.USER32.dll_MessageBoxA]
jmp 0x4552f8
clc
bts ebx, edx
movzx ebx, byte [esi + 0xd]
pushal
push edx
jmp 0x455312
pop word [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
bswap ebx
jmp 0x455339

Function at 0x4554a5
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 5]
lea esp, [esp + 3]
and edx, ecx
mov edx, dword [edx*4 + reloc.USER32.dll_MessageBoxA]
jmp 0x455489
mov byte [esp + 2], ah
jmp 0x45540f
lea esp, [esp + 1]
jmp 0x45549d
lea esp, [esp + 0x34]
xor edi, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
sub esp, 0xa
lea esp, [esp + 5]
push dword [esp]
jmp 0x455438
and ebx, ecx
sub esp, 0xe
push dword [esp + 0xa]
pop word [esp + 0xd]
jmp 0x45544e
sub esp, 0x12
push dword [esp + 0xe]
sub esp, 0x10
mov byte [esp + 0x1d], ah
lea esp, [esp + 2]
jmp 0x455470
and edx, ecx
call 0x4554a5
xchg ebp, eax
lea esp, [esp + 1]
mov byte [esp + 1], dh
mov word [esp], dx
lea esp, [esp + 3]
jmp 0x455515
dec dword [ebp - 4]
push edx
push esp
mov dword [esi + 0xc], edi
call fcn.004554db
dec eax
rol dword [ecx + 0x20], 1
shl dword [ebx - 0x36], cl
push edx
shl byte [edi - 0x35ac6cae], 0x65
xchg esp, eax
pop es
lea esp, [esp + 8]
xor edi, dword [edx*4 + reloc.USER32.dll_MessageBoxA]
push esp
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x4554f7
Function at 0x4554db
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
call fcn.0045556d
movsd dword es:[edi], dword [esi]
jmp 0x4816a6
sub esp, 0x14
lea edi, [edx*4]
mov di, word [esp + 4]
jmp 0x454da5
lea esp, [esp + 0x14]
movzx ebx, byte [esi + 0x11]
mov edi, dword [esp]
jmp 0x454e0d
add esi, 0x10
sub esp, 0xa
mov di, 0x9fbb
bswap edi
lea esp, [esp + 2]
jmp 0x454e1d
mov ebx, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
stc
bt edi, ebx
setb dh
jmp 0x454de6
mov edx, dword [esi]
dec di
sbb di, 0x7216
bsf di, si
jmp 0x454ee4
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
call fcn.00454eae
dec eax
int 0x5d
and al, 0xd7
adc dl, bl
pop esi
int3
pushal
add esp, 0x17
lea esp, [esp + 1]
jmp 0x454e49
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
cmc
pushal
and edi, ecx
jmp 0x454e69
mov edi, edx
shr edi, 0x18
push edx
mov word [esp], di
jmp 0x454e80
call fcn.004555a0
mov dword [esp + 1], ecx
push edx
jmp 0x455588
lea esp, [esp + 0x14]
jne 0x427c38
je 0x427bf7
dec ebx
iretd
push 0x8666f7db
call fcn.00435033
call fcn.0048174c
push 0x8666fc4c
call fcn.00435033
push ebp
enter 0x395e, 0xffffffffffffffc8
or ebp, eax
cmc
pushfd
outsd dx, dword [esi]
ljmp 0x7b18

Function at 0x505497
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, 0x72
mov word [esp], di
neg esi
pop si
lea esp, [esp + 2]
push eax
jmp 0x5054c1
mov al, byte [esp]
add ax, 0x879e
bswap esi
mov edx, 0x8e5beed0
cmc
push esp
jmp 0x505499
jmp 0x505470
push dword [esp]
sub esp, 0x1e
bsr ax, bp
mov byte [esp + 0x21], bh
neg edx
xchg edx, esi
jmp 0x505514
mov dx, word [esp]
bsf si, ax
xchg esi, edx
dec dx
xchg ah, dh
mov dh, ch
jmp 0x505481
rdtsc
mov dh, byte [esp + 0x12]
pop dword [esp + 0xa]
cmc
pop dword [esp + 1]
pop dword [esp + 1]
jmp 0x505585
xchg dx, ax
pop word [esp + 0x1b]
push word [esp + 0x13]
lea esp, [esp + 0x11]
rol ax, cl
mov ax, cx
jmp 0x5054f8
lea esi, [eax + edi]
lea eax, [ebp + 0x27]
xor dl, ch
cmc
rdtsc
xchg byte [esp], dh
jmp 0x505564
pop eax
rdtsc
inc esi
pop si
lea edx, [eax + 0xa1]
mov al, ah
jmp 0x50552c
btc esi, ebx
sub esp, 0x18
xchg byte [esp + 0xc], dh
stc
rdtsc
call fcn.0050553c
mov ebx, 0x34c5a22c
popfd
scasd eax, dword es:[edi]
cmp dword [ecx - reloc.USER32.dll_MessageBoxA], ebp
sti
ror byte [edi], cl
xor dword [ecx + reloc.USER32.dll_MessageBoxA], ecx
xor dword [esi + reloc.USER32.dll_MessageBoxA], eax
mov dword [reloc.USER32.dll_MessageBoxA], eax
and al, 1
rdtsc
mov dword [esp + 3], eax
rdtsc
xchg byte [esp + 2], dh
bt esi, esp
xchg word [esp + 1], si
jmp 0x505554
Function at 0x505b71
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ah, dh
lea esi, [ecx*4]
push dword [esp + 0xa]
setno dh
xchg byte [esp + 0x1c], al
jmp 0x505c7d
rcl dx, cl
lea eax, reloc.USER32.dll_MessageBoxA
add esp, 0x1b
jmp 0x505c16
mov edx, eax
bsf si, ax
xor esi, esi
mov dx, cx
mov dl, 0xc
pop eax
jmp 0x505b98
mov byte [esp + 0x26], dh
mov si, word [esp + 0x26]
push word [esp + 9]
xchg dword [esp + 0x14], esi
inc eax
pop si
jmp 0x505baf
push dword [esp + 6]
mov si, ax
pop si
shr esi, 0xb
pop eax
xchg dword [esp + 4], eax
jmp 0x505bc6
dec eax
xchg byte [esp + 4], dh
mov dh, 0xd2
push word [esp + 6]
xchg dword [esp + 1], esi
bswap eax
jmp 0x505c58
lea edx, [edi*4]
xchg byte [esp + 8], dh
xchg byte [esp], dh
inc al
pop dx
mov dh, byte [esp + 6]
jmp 0x505bf4
mov dh, ch
lea esi, [edi*4]
and dh, bh
setg dh
mov eax, dword [esp + 4]
stc
jmp 0x505d62
mov al, 0xbe
cmc
pop word [esp + 1]
lea esi, [ebx*4]
bswap edx
mov ax, 0x9cf
jmp 0x505c2e
mov edx, 0x283eee12
cmc
mov ax, 0x6dc9
mov byte [esp + 0x22], ch
mov word [esp + 8], bx
mov dx, ax
jmp 0x505be1
lea esi, [ecx + 0xdb]
mov edx, ecx
mov esi, dword [esp + 5]
mov esi, 0xf45a5acc
xchg esi, eax
mov dword [esp], esi
jmp 0x505cb6
pop ax
add esp, 3
lea esi, [ebp*4]
neg dh
jmp 0x505ce2

Function at 0x505e2f
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 8
neg ax
xchg si, ax
xchg dh, dl
xchg byte [esp + 0x10], al
dec edx
jmp 0x505e53
lea esi, [edx + ebx]
mov si, bx
dec ax
mov edx, dword [esp + 5]
mov byte [esp + 0x10], ch
jmp 0x505e33
push dword [esp + 6]
lea eax, [ebx*4]
mov dh, bh
mov byte [esp + 0xc], ch
mov eax, edx
mov esi, 0x4d2a14c4
jmp 0x505dd6
bswap esi
jmp 0x505e01
mov esi, dword [esp + 9]
mov ah, byte [esp + 1]
mov edx, dword [esp + 7]
stc
xchg dh, al
mov dx, 0xb543
jmp 0x505e80
mov word [esp + 0xc], dx
bsr si, cx
xchg byte [esp + 0xd], al
bswap eax
neg ah
bswap edx
jmp 0x505de8
mov si, 0xb061
xchg word [esp + 3], ax
pop word [esp]
not esi
stc
rdtsc
jmp 0x505fc7
mov si, 0x76bd
pop word [esp + 0xf]
bsr dx, cx
lea esp, [esp + 0xf]
jmp 0x505e68
sub esp, 0x14
mov si, 0xa46d
mov byte [esp + 1], ch
xchg si, ax
bswap eax
push word [esp + 1]
jmp 0x505ef0
lea esp, [esp]
add esp, 2
pop si
xchg edx, esi
btc edx, ebx
neg eax
jmp 0x505f0d
mov esi, dword [esp + 1]
push dword [esp + 2]
xchg dx, ax
xchg word [esp + 4], si
bsr ax, bp
pop word [esp + 1]
jmp 0x505f5c
Function at 0x506370
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol si, cl
mov dh, 0x92
mov dh, 0x9a
mov edx, dword [esp + 0x16]
mov dx, 0xabdd
not dx
jmp 0x5061e7
mov al, 0xae
mov edx, 0x61359ad2
pop ax
mov ax, bp
lea esp, [esp]
mov eax, dword [esp]
jmp 0x5061c1
lea esp, [esp + 0xa]
mov esi, ecx
cmc
setae dh
lea eax, [eax*4]
lea edx, reloc.USER32.dll_MessageBoxA
jmp 0x50615c
mov esi, ebp
mov ax, sp
mov ax, word [esp]
call fcn.0050621a
inc esi
jb 0x506217
dec esp
imul esp, dword [edx + 0x72], 0x797261
push 0xffffffffffffff85
xor al, 0x27
dec esi
fld dword [esi + 0x24882404]
and al, 0xf
xor dword [ebx - reloc.USER32.dll_MessageBoxA], ecx
xchg byte [esp], al
mov byte [esp], ah
rdtsc
mov eax, dword [esp]
mov esi, ebp
ror si, cl
jmp 0x5061a1
rol dh, 3
not dx
cld
xchg word [esp + 0x1c], ax
rdtsc
add esp, 0x1c
jmp 0x506170
push dword [esp + 0x1e]
ror dh, 5
xchg dword [esp + 0xa], eax
mov dh, 0xa8
push dword [esp + 0x16]
mov dword [esp + 0x23], ebp
jmp 0x506188
rcl ax, cl
rdtsc
neg esi
pop dx
pop dword [esp + 0x1b]
xchg word [esp + 0x19], si
jmp 0x50623e
shr si, cl
mov dl, 0xac
xchg dword [esp + 3], esi
shr dh, 5
mov word [esp + 0x19], bx
jmp 0x5062cd
Function at 0x5063c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dh
sub esp, 0x14
inc al
jmp 0x5064f7
add esp, 1
neg ax
setp dh
cmc
rdtsc
mov si, di
jmp 0x506466
mov byte [esp + 5], dh
rdtsc
pop dword [esp]
pop esi
ror dx, cl
mov eax, dword [esp]
jmp 0x506424
mov word [esp + 4], di
lea esp, [esp + 0x1b]
xchg dx, si
push esp
neg dx
neg ax
jmp 0x50643a
mov si, 0x30cf
and dh, bh
mov byte [esp], dh
cmc
btc edx, edi
mov al, ah
jmp 0x5064ab
btr eax, edx
mov esi, 0x18e935c4
push word [esp + 0x1e]
xchg word [esp + 1], si
pop ax
dec edx
jmp 0x506451
mov dl, dh
lea esi, reloc.USER32.dll_MessageBoxA
rdtsc
xchg byte [esp + 2], dl
jmp 0x5064e0
mov byte [esp], bh
bsr ax, cx
lea edx, [ecx*4]
push edx
not esi
lea eax, [edx*4]
jmp 0x506495
push dword [esp + 3]
xchg esi, eax
xchg dword [esp + 0xd], eax
inc esi
xchg word [esp + 0x19], ax
xchg byte [esp + 0xe], dl
jmp 0x50647e
lea eax, reloc.USER32.dll_MessageBoxA
btc esi, edi
lea esp, [esp + 4]
pushal
rdtsc
jmp 0x506640
lea esi, [esi - 0x2d]
bswap eax
mov dword [esp + 0xf], esi
lea edx, [ebx*4]
xchg word [esp + 0x17], si
neg si
jmp 0x5064ca
mov esi, dword [esp + 0x12]
push dword [esp + 3]
setne dh
lea edx, [eax + edx]
add esp, 0
call fcn.005065ec
clc
lea eax, [ebx*4]
mov dh, byte [esp]
stc
mov dh, bh
mov dl, 0xac
jmp 0x5066ae
mov byte [esp], bh
neg dh
sub esp, 4
mov esi, eax
pop si
rdtsc
jmp 0x506696
bsf si, si
add al, dh
mov ax, 0xb625
mov eax, ecx
ror dh, 7
and dh, bh
jmp 0x5066e5
lea esp, [esp]
neg ah
mov edx, 0x8861ddc0
bsf ax, si
neg ax
mov byte [esp], ah
jmp 0x506668
inc dx
mov ax, word [esp + 2]
mov word [esp], sp
mov esi, ecx
sub esp, 0x1c
jmp 0x506950
btr eax, esp
mov eax, dword [esp + 4]
neg dh
mov esi, 0x42a051fe
bswap edx
call fcn.00506713
jg 0x506788
int1
ljmp 0xf7f4
lea eax, [edx + esi]
xchg ah, dh
not eax
setg ah
setbe dh
lea esi, [edi*4]
jmp 0x50672b
sub esp, 0x1a
lea esi, [edx + ebp]
pop dword [esp + 6]
push dword [esp + 0x34]
mov esi, dword [esp + 0x4c]
jmp 0x506846
mov word [esp], bx
jmp 0x50675c
push 0xbd70225
add dword [esp], reloc.USER32.dll_MessageBoxA
call fcn.005067ce
mov eax, 0xfcedf29b
iretd
lea esp, [esp + 0x50]
popfd
jmp 0x5067a7
mov al, ah
mov byte [esp + 3], ch
ror dh, 7
lea esp, [esp + 1]
rdtsc
bsf ax, si
jmp 0x506746
push dword [esp + 6]
rcr dh, 5
add esp, 0xb
add esp, 0xf
pop eax
xchg word [esp + 2], dx
jmp 0x5068b5

Function at 0x506544
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, byte [esp + 1]
pop si
jmp 0x506579
mov dh, byte [esp]
lea esi, [esi + 0x5d]
rdtsc
mov word [esp], sp
not edx
lea esi, [eax - 1]
jmp 0x5065cb
mov word [esp], di
xchg word [esp], dx
dec dx
bsr si, cx
ror eax, 9
mov eax, ebp
jmp 0x50660a
rcl dh, 3
xchg byte [esp], dh
mov edx, 0xf3bde7c4
lea esi, [ebp*4]
xchg esi, eax
lea eax, [edx*4]
jmp 0x5065f3

Function at 0x508a0d
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 0x13]
mov byte [esp + 9], dh
mov dword [esp + 3], ecx
lea esp, [esp + 0x18]
jmp 0x5089e1
Function at 0x41a8e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48b62b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047bc41
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41a962
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004793da
mov eax, dword [eax]
push 0x4d8d34
push eax
call fcn.0046bdc4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047becc
test bl, bl
je 0x41a962
push 0x4d8d34
lea ecx, [esp + 0xc]
call fcn.0047c2a8
push 0x4d8d40
lea ecx, [esp + 0xc]
call fcn.0047c2a8
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41a99e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047becc
jmp 0x41aa69
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41aa22
lea edx, [esp + 0x7c]
push 0x4d8d3c
push edx
call fcn.0046bdc4
add esp, 8
test eax, eax
je 0x41aa22
lea eax, [esp + 0x7c]
push 0x4d8d38
push eax
call fcn.0046bdc4
add esp, 8
test eax, eax
je 0x41aa22
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41a9b2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047becc
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41b270
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41b2d2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x41b2e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48b6ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4df790]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x41b418
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x41b346
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047becc
xor eax, eax
jmp 0x41b48f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0047c055
push esi
lea ecx, [esp + 0xc]
call fcn.0047c2e4
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41b46d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.0041b270
test eax, eax
jne 0x41b46d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.0041b270
test eax, eax
jne 0x41b46d
lea eax, [esp + 0x14]
push 0x4d8d50
push eax
call fcn.0046cf70
mov esi, eax
add esp, 8
test esi, esi
jne 0x41b44c
lea ecx, [esp + 0x14]
push 0x4d8d4c
push ecx
call fcn.0046cef0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41b44c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41b44f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0047c005
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41b35e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047becc
xor eax, eax
jmp 0x41b48f
mov byte [esi], 0
push 0x4d8d48
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0047becc
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4