joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58ef43
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x100a9203
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.005b3234
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x100c2410
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x100bd8c8
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x100aa0cc]
push eax
mov ecx, edi
call fcn.005b88e6
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.005b9e02
test eax, eax
je 0x58f05f
mov ecx, dword [esp + 0x3c]
call fcn.005b8913
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x100aa540]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x58f023
push edi
mov ecx, esi
call fcn.005b5f61
mov ecx, esi
call fcn.0058f1c3
cmp dword [esp + 0x38], 1
jne 0x58f058
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.005b609c
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x591a73
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x591aa6
push esi
call fcn.00594b73
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x591a9f
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x591b2c
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x591b15
mov eax, dword [esi + 8]
test eax, eax
je 0x591aca
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x591b11
cmp eax, 2
je 0x591b15
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x591abd
cmp eax, 3
je 0x591af0
cmp eax, 1
jne 0x591abd
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x591abd
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x591abd
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00591b53
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x591b3b
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00591b53
add esp, 4
pop esi
ret
Function at 0x62a17e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x62a1ac
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x62a1b3
cmp ebx, dword [eax + 4]
jae 0x62a1b3
xor eax, eax
jmp 0x62a3a3
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x62a1c4
xor eax, eax
inc eax
jmp 0x62a3a2
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x62a1da
cmp ecx, edx
jae 0x62a31f
cmp dword [eax + 4], 0
je 0x62a1e3
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x62a1cb
cmp dword [ebp + 8], 0
je 0x62a205
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x62a31f
cmp eax, esi
jae 0x62a31f
mov eax, dword [0x10042560]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x62a22a
cmp dword [esi*4 + 0x10042568], edi
je 0x62a323
inc esi
cmp esi, eax
jl 0x62a218
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x100300e8]
test eax, eax
je 0x62a39f
cmp dword [ebp - 8], 0x1000000
jne 0x62a39f
test byte [ebp - 0xc], 0xcc
je 0x62a2a8
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x62a39f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x62a39f
cmp word [eax + 0x18], 0x10b
jne 0x62a39f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x62a39f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x62a2a8
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x62a2a8
test byte [ecx + 0x27], 0x80
jne 0x62a31f
push 1
push 0x100425a8
call dword [0x100302e8]
test eax, eax
jne 0x62a1bc
mov ecx, dword [0x10042560]
test ecx, ecx
mov edx, ecx
jle 0x62a2dc
lea eax, [ecx*4 + 0x10042564]
cmp dword [eax], edi
je 0x62a2dc
dec edx
sub eax, 4
test edx, edx
jg 0x62a2d0
test edx, edx
jne 0x62a30d
push 0xf
pop ebx
cmp ecx, ebx
jg 0x62a2e9
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x62a301
lea eax, [edx*4 + 0x10042568]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x62a2ef
cmp ecx, 0x10
jge 0x62a30d
inc ecx
mov dword [0x10042560], ecx
push 0
push 0x100425a8
call dword [0x100302e8]
jmp 0x62a1bc
xor eax, eax
jmp 0x62a3a2
test esi, esi
jle 0x62a1bc
mov ebx, dword [0x100302e8]
push 1
push 0x100425a8
call ebx
test eax, eax
jne 0x62a1bc
cmp dword [esi*4 + 0x10042568], edi
je 0x62a379
mov eax, dword [0x10042560]
lea esi, [eax - 1]
test esi, esi
jl 0x62a367
cmp dword [esi*4 + 0x10042568], edi
je 0x62a363
dec esi
jns 0x62a357
test esi, esi
jge 0x62a377
cmp eax, 0x10
jge 0x62a372
inc eax
mov dword [0x10042560], eax
lea esi, [eax - 1]
jmp 0x62a379
je 0x62a391
xor ecx, ecx
test esi, esi
jl 0x62a391
lea eax, [ecx*4 + 0x10042568]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x62a37f
push 0
push 0x100425a8
call ebx
jmp 0x62a1bc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x62d5bc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035870
push 0x10011a4c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, edx
push 0x1c
lea eax, [ebp - 0x3c]
push eax
push ecx
call dword [0x100300e8]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x62d653
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x62d653
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
cmp esi, edi
jb 0x62d653
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x62d653
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x62d9ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035880
push 0x10011a4c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [0x100300e8]
test eax, eax
je 0x62da73
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x5a4d
jne 0x62da6c
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ecx], 0x4550
jne 0x62da6c
cmp word [ecx + 0x14], 0
je 0x62da6c
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x74b52b
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x24]
movzx esi, byte [eax + 9]
lea edi, [edx + esi]
sub esp, 4
mov word [esp], bx
jmp 0x74b428
xor edx, esi
pushal
sub esp, 0
xchg bh, bl
mov bl, bh
jmp 0x74b3d2
lea esp, [esp + 4]
movzx edx, byte [eax + 8]
bsr bp, cx
mov bl, bh
jmp 0x74b4c3
mov dword [ecx + 4], edx
jmp 0x74b405
mov di, 0x4523
xchg di, bx
mov di, dx
jmp 0x74b3f9
xor edx, esi
movzx esi, byte [eax + 0xb]
neg bh
lea ebp, [esp + ebx]
jmp 0x74b4ab
movzx esi, byte [eax + 0xa]
lea edi, [edi*4]
shl edx, 8
bsf di, ax
jmp 0x74b44b
shl edx, 8
mov bl, 0x96
xor edx, esi
mov ebp, ecx
jmp 0x74b490
mov bl, 0xcc
xchg bl, bh
movzx esi, byte [eax + 0xd]
lea ebx, [eax + ebx]
not ebx
jmp 0x74b4fb
ror ebp, 3
btc edi, edi
jmp 0x74b481
shl edx, 8
inc bl
mov bl, 0x60
xor edx, esi
jmp 0x74b46d
shl edx, 8
mov bl, byte [esp]
lea edi, [eax*4]
setl bl
jmp 0x74b652
movzx edx, byte [eax + 0xc]
pushal
clc
jmp 0x74b4ce
mov dword [ecx + 8], edx
jmp 0x74b4e4
shl edx, 8
call 0x74b52b
cmc
bsr si, bp
lea edi, [edx + edx]
jmp 0x74b57f
not bh
mov ebp, eax
sub esp, 0xa
lea esp, [esp + 2]
xor edx, esi
jmp 0x74b522
mov eax, edx
cmc
stc
pushal
jmp 0x74b58a
mov dword [ecx + 0xc], edx
mov bl, bh
pushal
btr esi, esp
xchg byte [esp + 0xd], bl
jmp 0x74b552
xor edx, eax
btc ebp, edi
xchg si, bp
push esp
jmp 0x74b568
shr eax, 0x10
lea esp, [esp + 0x50]
mov esi, 0xff
pushal
jmp 0x74b5fa
mov edi, 0x6f675a24
bsr di, bp
xor di, 0x61b4
shl edx, 8
lea ebp, [ecx*4]
jmp 0x74b543
lea esp, [esp + 0x20]
xor eax, 0x1000000
mov edi, dword [esp]
sub di, 0x8208
jmp 0x74b629
and eax, esi
mov eax, dword [eax*4 + 0x7282d0]
rcr edi, 5
jmp 0x74b5ca
xchg word [esp + 0x11], di
mov di, cx
jmp 0x74b5e2
bswap edi
lea edi, [ebp*4]
lea ebp, [esi + 0x65]
movzx eax, byte [eax + 0xf]
mov bl, 0x60
jmp 0x74b5ad
bswap edi
mov edi, edx
btc ebx, edx
neg bp
mov ebp, esi
jmp 0x74b63b
sete bl
jmp 0x74b6b2
mov edi, ebx
xor edx, esi
lea esp, [esp + 0x20]
movzx esi, byte [eax + 0xe]
jmp 0x74b615
bswap ebp
mov bp, di
mov ebx, dword [ecx + 4]
lea ebp, [ecx*4]
btc ebp, edx
jmp 0x74b696
and edi, esi
mov edi, dword [edi*4 + 0x7282d0]
and edi, 0xff0000
jmp 0x74b660
and eax, 0xff000000
shl bp, cl
lea ebp, [eax + ebx]
mov ebp, 0x82a9cf62
jmp 0x74b714
shr edi, 8
neg bp
sub esp, 0
mov bl, 0x44
setb bl
jmp 0x74b685
sub esp, 2
add esp, 1
sub esp, 4
lea esp, [esp + 2]
lea esp, [esp + 3]
lea esp, [esp + 0xc]
jmp 0x74b6f5
inc cl
clc
sub esp, 0x12
pop dword [esp + 8]
lea esp, [esp + 2]
mov dword [esp + 0xc], edx
jmp 0x74b6c2
popal
dec ebp
call 0x74b6fd
fiadd dword [ebx + 0x35eb0cec]
cmp dword [ebp + 0xfbf4c25], esi
sub dword [esi + 0x1dae5334], esp
push edi
mov esi, 0xe24b2889
xor eax, edi
mov edi, ecx
mov edi, 0xb2551cd6
pushal
jmp 0x74b6e1
Function at 0x74b897
Capabilities:
Encrypt data using aes

Disassembly:
call 0x71d926
jmp 0x74b835
jmp 0x71d949
mov eax, edi
add di, 0xe0c6
lea edx, [ecx + edx]
jmp 0x74b86d
mov edx, dword [eax + 0xc]
mov cl, 0x82
mov ecx, edx
bswap edi
call 0x74b87c
adc ch, al
pop edx
add dword [eax], eax
add byte [ebp + 0xf5be], cl
add cl, ch
or al, 1
add byte [eax], al
xchg esi, eax
or eax, 0xd617e49d
sbb al, 0x6f
jbe 0x74b8f7
mov al, byte [0xffff31e9]
inc ecx
out dx, eax
adc al, ch
imul eax, dword [eax], 0
add bh, bh
not dword [bp + si - 0x519f]
pop es
cwde
push cs
imul ebx, dword [eax - 0x749b8aa3], 0x82d08d0c
jb 0x74b8b9
shr edi, 0x10
call 0x74b90f
jmp dword [edi - 9]
stc
jmp 0x74b89c
invalid

Function at 0x849e4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bx, si
push esp
inc si
bswap edx
mov dword [esp], esi
btc ebx, ebx
jmp 0x849fb5
mov cx, dx
mov bl, bh
rdtsc
mov dx, 0xf3b5
pop word [esp]
mov ecx, 0xc9d79ba8
jmp 0x849e0f
xchg ch, dl
xor dl, ch
mov bx, dx
mov dx, 0x72fd
pop ax
jmp 0x849e29
mov ch, byte [esp]
setne ch
cmc
cmc
cmc
sub esp, 0x1a
jmp 0x849f2c
xchg edi, ecx
inc esi
ror ah, 1
lea esp, [esp + 1]
cpuid
mov ebp, eax
jmp 0x849e5c
mov ecx, dword [esp]
xchg ch, dl
neg esi
rdtsc
cld
cpuid
jmp 0x849e7a
rdtsc
mov ch, byte [esp + 1]
mov word [esp], di
mov dword [esp], ebp
mov ecx, 0x8378ced0
pop edi
jmp 0x849e96
mov word [esp], di
mov word [esp + 0xc], di
mov byte [esp + 0xb], ah
mov cl, ch
xchg word [esp + 0x14], cx
call fcn.00849ec3
pop bp
inc bl
xchg byte [esp + 0x14], cl
lea ebx, [eax - 0x99]
not ch
lea eax, [eax + 0x2077601]
jmp 0x849ee7
inc edx
mov bx, word [esp + 8]
pop dword [esp]
mov ah, byte [esp + 1]
lea esi, [edx + edi]
cmc
jmp 0x849eae
mov cl, ch
mov dword [esp], eax
push dword [esp]
cmc
mov eax, 0xe01ff19c
mov dx, 0x2563
jmp 0x849f94

Function at 0x84a0a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
btc edi, ebx
bswap eax
mov dx, sp
mov edi, eax
btc edx, edi
jmp 0x84a080
lea eax, [esp + eax]
mov bh, byte [esp + 4]
setae ah
pop word [esp]
push esp
jmp 0x84a0e7
add esp, 0
lea edi, [esi + 0xad]
xchg bx, cx
xchg ch, dl
lea esp, [esp]
bsr si, cx
jmp 0x849ffd
pushal
mov word [esp + 0x1a], dx
add esp, 0x17
lea esp, [esp + 9]
mov dl, dh
lea esp, [esp + 1]
jmp 0x84a025
clc
add esp, 3
xchg word [esp], ax
xchg bh, cl
add esp, 1
mov ah, byte [esp + 1]
jmp 0x84a044
xchg bx, di
xchg dh, al
sub esi, eax
sub esp, 4
mov ecx, 0xa7e7d1de
mov bh, byte [esp + 4]
jmp 0x84a00e
jmp 0x84a06d
bsf di, ax
mov cx, 0xb439
pop bp
inc cx
push dword [esp + 0xb]
xchg ch, dl
jmp 0x84a114
bswap eax
mov cl, ch
mov dl, dh
push edx
xchg byte [esp + 4], cl
rdtsc
jmp 0x84a0a6
lea eax, [edi*4]
xchg word [esp], ax
xchg ch, dl
pop ecx
cpuid
pushal
jmp 0x84a0c5
mov edx, ecx
ror bh, 3
xor edi, esi
inc bl
mov ax, sp
pop word [esp + 2]
jmp 0x84a20c
pop ebp
pop dword [esp + 0xc]
pop dword [esp + 0x15]
pop dword [esp + 9]
pop bp
rcr eax, 0xf
jmp 0x84a0fa
pop di
lea eax, [ebp + 0xb7]
setns ch
pop word [esp + 0xa]
cld
mov di, 0xb265
jmp 0x84a14d
neg di
rcr edx, 9
inc ebx
inc dl
btr ecx, edx
mov dh, byte [esp + 5]
jmp 0x84a173
Function at 0x84a546
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ebp
mov dl, 0xbc
mov si, 0x2281
sub esp, 0x1a
jmp 0x84a5a2
push dword [esp + 2]
mov word [esp + 2], dx
setl dh
mov bl, bh
mov byte [esp + 0x1e], ch
mov edi, eax
jmp 0x84a569
xchg ebp, eax
ror esi, 0x1f
xchg si, ax
xchg word [esp + 0xd], bx
mov dh, byte [esp + 7]
pop dword [esp + 0x14]
jmp 0x84a586

Function at 0x84a96f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, 0x3a0d
xchg word [esp + 0x1a], si
call 0x84a96f
jle 0x84a9d6
mov ebx, 0x310f040b
popal
cmc
jmp 0x84a9a5
mov ax, word [esp + 0xa]
push dword [esp + 0x15]
shl bx, cl
mov bp, di
xchg dword [esp + 0xd], ebx
mov byte [esp + 0x1b], ah
jmp 0x84a960
rdtsc
mov cl, ch
mov dh, byte [esp + 4]
mov bl, 8
mov eax, dword [esp + 4]
setnp dh
jmp 0x84a9f6
clc
xchg ah, bl
xchg dh, al
bsr di, cx
mov dh, byte [esp + 0x11]
clc
jmp 0x84a98c
mov ch, 0x33
fiadd word [ebx + 0x6c8814ec]
and al, 9
xor ebx, esi
sub esp, 0x14
mov byte [esp + 9], ch
add esp, 0xd
push word [esp + 7]
mov ch, byte [esp + 1]
jmp 0x84aa3c
xchg dword [esp], edi
lea edx, [edx + edi]
neg bx
pop cx
mov bp, word [esp]
mov edx, dword [esp]
jmp 0x84a9d7
xchg bx, di
ror esi, 0xb
sub esp, 0xa
xchg ebx, esi
xchg dword [esp + 4], esi
clc
jmp 0x84aa56
rcr ecx, 1
mov esi, 0xd9473d68
shr ah, 1
mov byte [esp + 0xe], ch
sub bl, ah
bswap edx
jmp 0x84aa0a
mov bx, word [esp + 2]
push dword [esp + 0xa]
xchg ecx, ebp
mov dx, 0x3147
mov bp, word [esp + 8]
mov ch, byte [esp + 0xd]
jmp 0x84aa20
mov dword [esp + 0x15], esi
xchg byte [esp + 0xb], cl
xchg bx, bp
pop dword [esp + 8]
xchg word [esp + 9], di
mov bl, bh
jmp 0x84aeb4
jmp 0x84a9c7
btr edi, esp
inc di
mov bx, word [esp + 6]
call fcn.0084aa87
lea ebx, [esi - 0x7cdefce3]
xchg bp, bx
mov byte [esp + 8], ah
mov cl, ch
pushal
lea edi, [ecx + 0x43]
jmp 0x84acd5
pop edx
pop esi
push word [esp + 0x1d]
pop edi
xchg dword [esp + 6], edx
stc
jmp 0x84aa9d
popal
mov byte [esp + 2], ah
call 0x84aca4
lea edx, [eax + edx]
mov eax, 0x3c28adf0
mov bx, 0xf1a7
mov ax, dx
jmp 0x84ad8d
mov dx, di
mov bp, 0x4ad3
push edx
mov word [esp + 4], di
sub esp, 0x16
mov byte [esp + 0xb], ah
jmp 0x84ad76
clc
sub bl, ah
mov al, ah
rdtsc
xchg ch, dl
bswap edi
jmp 0x84ad0b
lea ebp, [eax + 0xf9]
sub esp, 0
push esp
add esp, 9
pop word [esp + 2]
lea esp, [esp + 2]
jmp 0x84ad26
inc bx
neg si
setne bh
add esp, 3
add esp, 0
mov ecx, dword [esp]
jmp 0x84adf8
xchg byte [esp + 0x14], cl
lea esp, [esp + 0x19]
clc
setns bh
mov di, 0xcc27
jmp 0x84ad5d
pop word [esp + 9]
pop word [esp + 5]
bsf cx, ax
bsf cx, si
not di
lea ebp, [esi + edi]
jmp 0x84ad45
btc eax, ebx
inc bl
xchg bh, cl
xchg byte [esp], dl
call fcn.0084ae21
invalid
mov cl, ch
mov bh, byte [esp]
inc cx
cmc
bswap ecx
xchg bh, cl
jmp 0x84add5
push word [esp + 9]
xchg byte [esp + 4], bl
bswap ecx
mov ax, dx
mov cl, ch
mov dword [esp + 0x11], ebp
jmp 0x84aae7
sub esp, 0x14
mov bl, 0x38
inc ebx
lea esi, [esp + edi]
rdtsc
bsr bx, cx
jmp 0x84ae3b
Function at 0x84acb4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [eax - 0x16e475b7]
cmc
jmp 0x84adb9
inc al
rdtsc
pop dword [esp + 0xc]
ror ah, 1
xchg cx, bx
pop dword [esp + 0xa]
jmp 0x84acdf
mov eax, 0x472a27aa
mov word [esp + 0xe], bx
rcr bh, 3
mov dl, dh
mov esi, 0x6490a108
not cx
jmp 0x84acf8

Function at 0x84d244
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x84d28a
mov eax, dword fs:[0x30]
jmp 0x84d20f
lea esp, [esp + 1]
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0x84d22c
Function at 0x40a2c0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46dfcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00462668
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40a342
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004602f0
mov eax, dword [eax]
push 0x4ac200
push eax
call fcn.004525a4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004628f3
test bl, bl
je 0x40a342
push 0x4ac200
lea ecx, [esp + 0xc]
call fcn.00462c83
push 0x4afd6c
lea ecx, [esp + 0xc]
call fcn.00462c83
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40a37e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004628f3
jmp 0x40a449
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40a402
lea edx, [esp + 0x7c]
push 0x4afd68
push edx
call fcn.004525a4
add esp, 8
test eax, eax
je 0x40a402
lea eax, [esp + 0x7c]
push 0x4afd64
push eax
call fcn.004525a4
add esp, 8
test eax, eax
je 0x40a402
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a392
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004628f3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40b6a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40b702
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40b710
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46e12b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4b6540]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40b848
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40b776
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004628f3
xor eax, eax
jmp 0x40b8bf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00462a30
push esi
lea ecx, [esp + 0xc]
call fcn.00462cbf
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40b89d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push 0x80000000
call fcn.0040b6a0
test eax, eax
jne 0x40b89d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x80000000
mov ecx, edi
call fcn.0040b6a0
test eax, eax
jne 0x40b89d
lea eax, [esp + 0x14]
push str.__1_
push eax
call fcn.004535e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b87c
lea ecx, [esp + 0x14]
push 0x4afd7c
push ecx
call fcn.00453560
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b87c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40b87f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004629e0
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40b78e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004628f3
xor eax, eax
jmp 0x40b8bf
mov byte [esi], 0
push 0x4afd78
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004628f3
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4