joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403350
Capabilities:
Terminate process

Disassembly:
call fcn.00402110
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jb 0x403378
push str.PsShutdown_requires_Windows_NT_2000_XP._n_n
push 0x40e858
call fcn.004034a4
add esp, 8
or eax, 0xffffffff
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call fcn.00402cb0
add esp, 8
test al, al
jne 0x403395
push 0xffffffffffffffff
call fcn.00404275
mov al, byte [0x40fff8]
test al, al
je 0x4033ee
mov al, byte [0x410100]
test al, al
jne 0x4033ee
push esi
push str.Password:
call fcn.00403e8d
push 0x40e838
call fcn.00403d27
add esp, 8
xor esi, esi
call fcn.00403b7a
cmp al, 0xd
je 0x4033d9
mov byte [esi + 0x410480], al
inc esi
cmp esi, 0x103
jb 0x4033c1
push 0x40d2d0
mov byte [esi + 0x410480], 0
call fcn.00403e8d
add esp, 4
pop esi
push 0x402970
push 0x40f7f8
push 1
call fcn.00401f90
add esp, 0xc
ret

Function at 0x408d86
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40f528
cmp edx, dword [eax]
je 0x408da8
add eax, 8
inc ecx
cmp eax, 0x40f5b8
jl 0x408d99
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40f528]
jne 0x408ed6
mov eax, dword [0x41016c]
cmp eax, 1
je 0x408eb0
test eax, eax
jne 0x408dd9
cmp dword [0x40edf4], 1
je 0x408eb0
cmp edx, 0xfc
je 0x408ed6
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x408e10
lea eax, [ebp - 0x1a4]
push 0x40b54c
push eax
call fcn.0040a300
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00406cb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x408e53
lea eax, [ebp - 0x1a4]
push eax
call fcn.00406cb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b548
push edi
call fcn.00404450
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x40b52c
push eax
call fcn.0040a300
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040a310
lea eax, [ebp - 0xa0]
push 0x40d3a0
push eax
call fcn.0040a310
push dword [esi + 0x40f52c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040a310
push 0x12010
lea eax, [ebp - 0xa0]
push 0x40b504
push eax
call fcn.0040a3f0
add esp, 0x2c
pop edi
jmp 0x408ed6
lea eax, [ebp + 8]
lea esi, [esi + 0x40f52c]
push 0
push eax
push dword [esi]
call fcn.00406cb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4053da
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x405400
jmp 0x405516
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffff
jne 0x405420
jmp 0x405516
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov al, byte [ebp - 4]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0040a33d
add esp, 4
mov dword [0x40e0a0], 0
mov dword [ebp - 0x420], 0x646c6f47
mov dword [ebp - 0x41c], 0x6f736e65
mov byte [ebp - 0x418], 0x66
mov dword [ebp - 0x20], 0
jmp 0x40546d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0x40548d
mov eax, dword [ebp - 0x20]
movsx eax, byte [eax + ebp - 0x420]
xor al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ecx + ebp - 0x420], al
jmp 0x40546a
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x417], al
push 0xa
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
push 0x400
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4054f5
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00409ee0
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
jmp 0x4054a9
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40577c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
je 0x4057c5
mov eax, dword [ebp - 0xc]
add dword [eax + 8], 0xa
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jne 0x405868
mov dword [ebp - 0x18], 0
jmp 0x4057f3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x405868
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0x40e0a4], ecx
jne 0x405866
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx*4 + 0x40e1b2]
cmp dword [eax*4 + 0x40e13a], ecx
jb 0x405855
mov eax, dword [ebp - 0x10]
cmp dword [0x40e0a0], eax
je 0x405843
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x40e11c]
push eax
call fcn.0040a33d
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [0x40e0a0], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00409e94
add esp, 8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add dword [ecx*4 + 0x40e13a], eax
jmp 0x405868
jmp 0x4057f0
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0x405879
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
jmp 0x4058c7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x405929
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp dword [eax*4 + 0x40e0a4], ecx
jne 0x405927
mov eax, dword [ebp - 0xc]
cmp dword [0x40e0a0], eax
je 0x405901
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x40e11c]
push eax
call fcn.0040a33d
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x40e0a0], eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00409ee0
add esp, 8
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x405925
mov eax, dword [ebp - 8]
add dword [eax + 8], 0xa
jmp 0x405929
jmp 0x4058c4
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x405957
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00409e94
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0x409f74
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 8], 0xffffffff
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], eax
push 0
push 0
push 0x1e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], 0
jmp 0x409fb3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jge 0x40a089
push 0
lea eax, [ebp - 0x14]
push eax
push 0xa
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
mov al, byte [ebp - 0x20]
cmp eax, 0x54
jne 0x40a084
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x44
je 0x40a003
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x64
je 0x40a003
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x53
jne 0x40a084
mov al, byte [ebp - 0x17]
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
push eax
call fcn.0040a33d
add esp, 4
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x64
jne 0x40a056
mov dword [0x40e2ce], 1
mov dword [ebp - 0x10], 0
jmp 0x40a039
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
jge 0x40a054
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax + ebp - 0x1e]
xor cl, byte [ebp - 0x17]
mov eax, dword [ebp - 0x10]
mov byte [eax + ebp - 0x1e], cl
jmp 0x40a036
jmp 0x40a060
mov dword [0x40e2ce], 0
mov eax, dword [ebp - 0x1e]
xor eax, 0x19611225
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1a]
xor eax, 0x198931
and eax, 0xffffff
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx]
mov dword [ebp - 8], eax
jmp 0x40a089
jmp 0x409fb0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 8]
jmp 0x40a0a0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a1ca
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0xffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 0xa
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], 0
jmp 0x40a1fc
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
jge 0x40a217
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + ebp - 0x18]
xor cl, byte [ebp - 0xf]
mov eax, dword [ebp - 8]
mov byte [eax + ebp - 0x18], cl
jmp 0x40a1f9
cmp dword [ebp - 0x18], 0x646c6f47
jne 0x40a261
cmp dword [ebp - 0x14], 0x6f736e65
jne 0x40a261
xor eax, eax
mov al, byte [ebp - 0x10]
cmp eax, 0x66
jne 0x40a261
mov al, byte [ebp - 0xf]
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
push eax
call fcn.0040a33d
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x40a258
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [ebp - 4], 0xa
jmp 0x40a271
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 4]
jmp 0x40a276
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a5cc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call fcn.00409c95
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.00409d1d
add esp, 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0040a7fe
add esp, 8
cmp eax, 0xffffffff
je 0x40a631
mov dword [ebp - 0x14], 1
jmp 0x40a638
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 2
jne 0x40a668
cmp dword [ebp - 8], 0
je 0x40a668
cmp dword [ebp - 0x14], 0
je 0x40a668
push 0x40e6e0
mov eax, dword [ebp - 4]
push eax
call fcn.0040a679
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x40a84c
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], eax
push 2
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x40a921
cmp dword [ebp - 8], 0
jne 0x40a921
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov al, byte [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
push eax
call fcn.0040a33d
add esp, 4
mov dword [ebp - 0x41c], 0x646c6f47
mov dword [ebp - 0x418], 0x6f736e65
mov byte [ebp - 0x414], 0x66
mov dword [ebp - 0x1c], 0
jmp 0x40a8d9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 9
jge 0x40a8fb
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax + ebp - 0x41c]
mov ecx, dword [ebp + 0xc]
xor al, byte [ecx]
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + ebp - 0x41c], al
jmp 0x40a8d6
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [ebp - 0x413], al
push 0
lea eax, [ebp - 0x1c]
push eax
push 0xa
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40a933
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ad1c
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x40d3d6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push esi
push edi
push 7
mov esi, 0x40ef9c
pop ecx
lea edi, [ebp - 0xe0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x2a
xor eax, eax
pop ecx
lea edi, [ebp - 0xc1]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor esi, esi
push 0xa
lea eax, [ebp - 0x18]
push esi
push eax
mov dword [ebp - 0xc], 4
call fcn.0040d491
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push 0x40ecd4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x18]
push 0x1e
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d4c0
add esp, 0x24
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0xe0]
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40d45f
xor eax, eax
jmp 0x40d48d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x40efbb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x40d937
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov ecx, 0x40eca8
push 0x20
sub ecx, eax
pop esi
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x40d946
pop esi
ret

Function at 0x40d951
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov ecx, 0x40eca8
push 0x20
sub ecx, eax
pop esi
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x40d960
pop esi
ret
Function at 0x868890
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1d7000]
push edi
or ebp, 0xffffffff
jmp 0x8688b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8688b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8688a8
mov eax, 1
add ebx, ebx
jne 0x8688cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8688dc
jne 0x8688fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8688fb
dec eax
add ebx, ebx
jne 0x8688e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8688c0
add ebx, ebx
jne 0x8688f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x86894d
xor ecx, ecx
sub eax, 3
jb 0x868913
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x868982
sar eax, 1
mov ebp, eax
jmp 0x86891e
add ebx, ebx
jne 0x86891e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8688ec
inc ecx
add ebx, ebx
jne 0x86892c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8688ec
add ebx, ebx
jne 0x868939
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x86892e
jne 0x86894a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x86892e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x86896c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x86895e
jmp 0x8688ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x86896c
add edi, ecx
jmp 0x8688ae
pop esi
mov edi, esi
mov ecx, 0x69f7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x86898a
cmp byte [edi], 0xe
jne 0x86898a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x86898f
lea edi, [esi + 0x45f000]
mov eax, dword [edi]
or eax, eax
je 0x868a07
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x46cb94]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x46ccd4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8689bc
mov ecx, edi
jns 0x8689eb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x46ccd8]
or eax, eax
je 0x868a01
mov dword [ebx], eax
add ebx, 4
jmp 0x8689d9
call dword [esi + 0x46cce8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x868a38
cmp al, 0xef
ja 0x868a2b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x868a0d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x868a1a
mov ebp, dword [esi + 0x46ccdc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x868a6c
sub esp, 0xffffff80
jmp 0x4af4e0
Function at 0x79011573
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0x7913d083
jmp fcn.790de151
mov eax, dword [ebp - 0x58]
pushfd
pushfd
pushal
mov dword [esp + 0x24], eax
jmp 0x7916b6a5
not ch
seta cl
movzx ecx, al
mov ch, 0xf9
mov ecx, 0x7906f4d4
pushal
push ebp
lea esp, [esp + 0x24]
call fcn.79012ba0
cmc
movzx eax, al
clc
stc
cmp bp, 0xe7eb
push eax
test eax, eax
pushfd
lea esp, [esp + 8]
jne 0x7917e0f5
movsx ax, al
lea eax, [edi*8 + 0x116c14fc]
not ax
jmp 0x7913cbb7
pushfd
lea esp, [esp + 0x28]
call fcn.79015d43
bt si, bx
add esp, 4
cmc
mov dword [ebp - 0x64], eax
btc ax, ax
bswap eax
mov eax, dword [ebp - 0x58]
clc
cmc
jmp fcn.7915caed
Function at 0x79022640
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x79068330]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
movzx eax, byte [0x790703cd]
test eax, eax
je 0x7902266b
mov eax, 1
jmp 0x79022811
mov eax, dword [0x7906f1b8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.790375d0
add esp, 4
mov dword [ebp - 0xc], eax
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [0x7906f1b0], eax
cmp dword [ebp - 0x10], 0
je 0x7902280f
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.79038d00
add esp, 0xc
mov dword [ebp - 0x14], fcn.7903c9bb
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax]
cmp ecx, 0xe9
jne 0x790226e5
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 1]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 5]
mov dword [ebp - 0x14], eax
jmp 0x79022704
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax]
cmp ecx, 0xeb
jne 0x79022704
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax + 1]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0x40
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
mov dword [edx + ecx], 0x1b8
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + eax], 0x12c200
lea eax, [ebp - 0x18]
push eax
push 0x40
push 0x50
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x7902280f
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
mov edx, 0x7902277d
mov dword [ebp - 0x70], edx
mov eax, 0x790227bf
sub eax, edx
mov dword [ebp - 0x6c], eax
jmp 0x790227bf
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
lea edx, [ebp - 0x68]
push edx
call fcn.79038d00
add esp, 0xc
push 0x50
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x68]
call eax
push 0x8000
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov byte [0x790703cd], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.79039ab6
mov esp, ebp
pop ebp
ret
Function at 0x7902f6bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0x791844e0
inc al
neg ecx
ror cl, 6
mov eax, dword [ebp - 0x2f4]
sar cl, 6
ror dx, cl
test dl, bl
stc
sub eax, dword [ebp - 0x14]
pushfd
bsr edx, edi
mov dword [ebp - 0x2f4], eax
rcr ax, cl
xchg ch, dh
sal cx, cl
mov eax, dword [ebp - 0x2f4]
pop edx
add eax, 6
movzx cx, al
pushal
jmp fcn.79100d68
mov word [ebp - 0x33a], ax
sub edx, 0x32d47e53
or dx, ax
push 0x6cc6cea6
xor eax, eax
pushal
shl cx, cl
mov word [ebp - 0x338], ax
das
mov dword [esp + 0x28], 0
clc
bts ax, 0xd
mov dword [esp + 0x24], 0
xor cl, bh
call fcn.790b59f1
lea edx, [esi + 0x7c4b5f8a]
push 0
not ch
pushal
jmp 0x7903105d
setno al
bsf ax, di
sbb cx, 0x732
stc
mov eax, 0x61
pushfd
adc dl, 0xb0
pushfd
add dh, 0x92
mov word [ebp - 0x33c], ax
clc
mov eax, 0x32
shl cl, cl
not dl
not dx
jmp 0x7908d5a9
rcr al, 3
bts eax, edi
bts ax, cx
bswap ax
mov eax, 0x68
sar dx, 1
inc cx
mov word [ebp - 0x334], ax
btr ax, 3
or cx, si
bsr ax, dx
mov eax, 0x6d
pushal
bsr cx, si
sal dl, cl
mov word [ebp - 0x332], ax
rcl dl, cl
sbb dl, ah
cmc
bsr cx, di
mov eax, 0x61
movzx dx, dl
clc
bsf cx, bx
mov word [ebp - 0x330], ax
add ax, 0xfbb6
or ah, dh
stc
inc cx
mov eax, 0x31
movzx cx, bl
mov word [ebp - 0x32e], ax
inc cl
xor eax, eax
lea edx, [ecx*4 + 0x63b62cc9]
setge ch
or ch, cl
mov word [ebp - 0x32c], ax
bsf edx, edx
bt bp, 0xe
mov eax, 0x68
add esp, 0x20
sal dx, 0xb
mov word [ebp - 0x340], ax
pushfd
rol al, cl
cwde
bswap eax
mov eax, 0x6d
neg dl
neg dl
cmc
shr cl, cl
mov word [ebp - 0x33e], ax
add esp, 4
jne 0x7913e455
sal al, 3
bts ecx, edi
cwde
mov eax, 0x61
bts cx, 4
clc
bts dx, 0xf
pushfd
mov word [ebp - 0x33c], ax
shrd cx, si, 2
mov eax, 0x32
bswap edx
movzx edx, dl
mov word [ebp - 0x33a], ax
xadd cx, dx
xor cx, 0x9705
sub eax, eax
lea ecx, [ecx + 0x36d19593]
shr dh, 2
xor ch, cl
sar ch, 4
mov word [ebp - 0x338], ax
rcl ah, 5
neg cl
mov dword [esp], 0
sbb ah, 0xc0
mov cl, dh
push 0
aaa
das
mov eax, dword [ebp - 0x14]
mov edx, esi
add eax, 2
and dx, 0x8878
push eax
sbb dl, 0x6e
mov ch, 6
bts dx, si
mov ecx, dword [0x7906f2d4]
bt si, 0xe
movzx dx, al
inc dl
add dl, 0xfb
add ecx, 0xec
setp dh
mov dx, 0xfd9c
push ecx
jns 0x79118bb3
call fcn.79084efb