joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x464ea8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x481670]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
push 0x4740fc
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], edi
call fcn.004036e0
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
lea ecx, [esp + 0x40]
push ecx
mov ecx, esi
mov dword [esp + 0x30], edi
call fcn.00450150
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x1c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x450487
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x30]
push 0x4740fc
push ecx
call fcn.00407230
add esp, 8
test al, al
je 0x4504ea
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
push 0x4740f4
push esi
call fcn.0043841a
mov edi, dword [esp + 0x1c]
lea eax, [esi - 0x10]
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4504d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45050a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10

Function at 0x451420
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
xor ebx, ebx
cmp eax, ebx
push edi
je 0x451444
push eax
call fcn.004351e8
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov edi, dword [esp + 0x14]
cmp edi, ebx
jne 0x451455
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 4
lea eax, [esp + 0xc]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
mov dword [esi + 8], eax
jbe 0x451495
push eax
call fcn.004352c5
mov ecx, dword [esi + 8]
add esp, 4
push eax
push ecx
push ebx
push edi
mov dword [esi + 4], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x451495
mov edx, dword [esi + 4]
push edx
call fcn.004351e8
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
xor eax, eax
cmp dword [esi + 4], ebx
pop edi
pop esi
setne al
pop ebx
pop ecx
ret 4
Function at 0x451b30
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x451b58
mov eax, dword [eax + 0x2c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
sete al
test al, al
je 0x451b58
xor al, al
pop esi
ret 0xc
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x451b68
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
push ebx
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
push ecx
mov edx, ebx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x14]
or edx, 4
push edx
push eax
push 0
push esi
push 0x451a20
mov byte [esi + 0xc], 0
call fcn.004209f3
test eax, eax
mov dword [esi + 8], eax
je 0x451bbe
test bl, 4
mov dword [eax + 0x28], 0
jne 0x451bbe
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
cmp dword [esi + 8], eax
pop ebx
setne al
pop esi
ret 0xc
Function at 0x4628d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x465fa8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x481670]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004532e0
mov dword [esi], vtable.boost::regex_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
test ecx, ecx
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
je 0x462935
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x426ccc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x426cdb
pop dword [ebp - 0x28]
mov eax, 0x8906a321
add eax, 0x773bc9ba
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x4e4a4
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x7f69bcde
sub ecx, 0x7f697c19
xor edx, edx
add edx, eax
mov esi, 0xb9591dcf
sub esi, 0xb9109fcf
add esi, dword [ebp - 0x28]
mov ebx, 0x2889ecd2
xor dword [ebp - 0x1c], esi
mov edi, dword [esi]
add edi, ebx
sub dword [ebp - 0x10], 0x9f24d659
mov dword [edx], edi
add dword [ebp - 8], 0x2272889f
add edx, 4
add esi, 0x4d088456
add esi, 0xb2f77bae
loop 0x426d31
add eax, 0x3ee3f21e
sub eax, 0x3ee2fc37
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x96a0b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [esp + 2]
bsf ax, di
jge 0x96a0d3
jl 0x96a0d3
xor byte [eax + 0x2b04126], dh
sub eax, 0xe8eb0f3c
jmp 0x96a09b
mov ax, 0xbb3f
not dx
jmp 0x96a101
jmp 0x96a09b
jmp 0x96a0d8
call 0x96a0b3
push ebp
mov ax, 0xc559
lea ecx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x96a0e9
lea esp, [esp + 0x10]
xor edi, 0x2c3cb4b4
sets ah
mov edx, ecx
neg edx
jmp 0x96a132
rol edi, 0
mov cl, 0x63
rdtsc
not ah
bsf edx, edx
ja 0x96a0bc
push ebp
mov ax, 0xc559
lea ecx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x96a0e9
jle 0x96a15f
xchg cx, ax
jmp 0x96a161

Function at 0x96a0b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [esp + 2]
bsf ax, di
jge 0x96a0d3
jl 0x96a0d3
xor byte [eax + 0x2b04126], dh
sub eax, 0xe8eb0f3c
jmp 0x96a09b
mov ax, 0xbb3f
not dx
jmp 0x96a101
jmp 0x96a09b
jmp 0x96a0d8
call 0x96a0b3
push ebp
mov ax, 0xc559
lea ecx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x96a0e9
lea esp, [esp + 0x10]
xor edi, 0x2c3cb4b4
sets ah
mov edx, ecx
neg edx
jmp 0x96a132
rol edi, 0
mov cl, 0x63
rdtsc
not ah
bsf edx, edx
ja 0x96a0bc
push ebp
mov ax, 0xc559
lea ecx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x96a0e9
jle 0x96a15f
xchg cx, ax
jmp 0x96a161

Function at 0xac9076
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, 6
lea ecx, [esi - 0x43]
mov dword [esp], eax
mov bx, word [esp + 4]
jmp 0xac909e
mov word [esp + 2], bx
mov ax, bp
rdtsc
bswap esi
jmp 0xac90d5
xchg word [esp + 2], ax
xchg ch, dh
mov ebx, dword [esp + 2]
mov dx, word [esp + 2]
mov dx, 0x195b
mov eax, 0x1bcb98b0
jmp 0xac90bf

Function at 0xac94eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edi
xchg cx, dx
push dx
xchg si, ax
jmp 0xac955a
mov bh, 0x8d
sub esp, 0x1e
mov bh, byte [esp + 0x11]
add esp, 0x14
mov bx, 0x3e07
mov bh, dl
jmp 0xac951b
rdtsc
rdtsc
mov byte [esp + 2], al
mov cl, bl
mov byte [esp + 4], dl
xchg ecx, eax
jmp 0xac9531

Function at 0xac96f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, byte [esp]
sbb cl, bh
cld
bsf si, cx
xchg ch, dl
not ecx
jmp 0xac9718
push word [esp + 4]
add esp, 6
not bx
mov dh, 0x36
jmp 0xac96dd
rdtsc
cld
mov ecx, ebp
lea eax, [eax + ebp]
lea ebx, [ebx + ebp]
lea eax, [eax + ecx]
jmp 0xac9728
mov ecx, dword [esp]
xchg cl, bl
mov al, 0x97
rdtsc
bts eax, eax
neg bh
jmp 0xac9702
not ax
cpuid
lea esp, [esp]
lea esp, [esp]
mov dl, bl
cmp bx, 0xee84
jmp 0xac978f
cld
stc
mov cx, 0x9eeb
rdtsc
mov bl, 0x35
pushal
jmp 0xac974d
lea ebx, reloc.RASAPI32.dll_RasHangUpA
dec bp
ror si, cl
mov ch, dh
lea edi, [ebp*4]
mov ebp, dword [esp]
jmp 0xac9763

Function at 0xac9a01
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bl, al
std
not edi
lea eax, [eax + edx]
xchg al, ah
sub esp, 0x13
jmp 0xac9a25
pop word [esp + 0xe]
sub esp, 0xc
bsr cx, bx
jmp 0xac99eb
lea esp, [esp + 0x42]
mov esi, 0x730aa5e5
mov cl, byte [esp]

Function at 0xac9cd6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, dh
xchg bp, bx
xchg dword [esp + 9], eax
popal
jmp 0xac9d2b
add esp, 1
inc bp
xchg ebx, eax
mov ax, 0x91f2
inc bx
ror edx, cl
jmp 0xac9d00
Function at 0xacd2d3
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0xacd2d3
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
pushfd
clc
pushal
lea esp, [esp + 3]
jmp 0xacd2e6
stc
pop dword [esp + 0x14]
push eax
sub esp, 0xa
lea esp, [esp + 3]
lea esp, [esp + 0x24]
jmp 0xacd334
not cx
pushal
mov word [esp + 0x1a], si
and ebx, ebx
setle al
jmp 0xacd5bd
pushal
mov dh, byte [esp]
bswap ebx
rdtsc
dec dx
xchg di, dx
jmp 0xacd31e
pop dword [esp + 0x11]
call 0xacd3a5
aam 0x47
xlatb
mov dl, 0x41
out 0x62, al
clc
outsb dx, byte [esi]
or eax, edi
dec edi
push ebp
pop word [esp]
pop esi
cpuid
pop word [esp + 0xc]
lea eax, [edx + 0x2c]
neg di
jmp 0xacd35d
rdtsc
mov si, 0x83c1
pop dword [esp + 0x19]
bts cx, sp
mov al, 0x9c
lea edx, [edx + edx]
jmp 0xacd373
dec si
xchg byte [esp + 0xb], dh
mov bh, 0xe5
mov bh, byte [esp + 0x10]
setg bh
mov dword [esp + 0x19], esp
jmp 0xacd390
mov si, word [esp + 4]
bt esi, ebx
xchg esi, ebx
adc bp, si
sub esp, 9
mov eax, 0x3723751
jmp 0xacd3d1
Function at 0xacd60b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, 0x3a5f
push dword [esp + 6]
mov byte [esp + 9], cl
mov ah, bl
jmp 0xacd737
neg ch
rol cl, cl
setnp cl
mov word [esp], ax
mov dword [esp], ebp
push dword [esp + 2]
jmp 0xacd5d7
jmp 0xacd5ed
std
cpuid
push word [esp + 1]
mov word [esp + 1], si
add esp, 0
jmp 0xacd63c
lea ebp, [ebx*4]
lea ecx, [esi + ebp]
cpuid
mov edi, 0x2df052ca
ror ebp, cl
lea esp, [esp + 6]
jmp 0xacd60d
xchg di, cx
mov di, 0x6308
setnp bh
inc ebx
mov bl, byte [esp + 2]
pop bx
jmp 0xacd681
xchg byte [esp], al
mov word [esp], si
mov edx, dword [esp]
xchg cl, dl
shl ax, 2
cmp edx, ebp
jmp 0xacd6f9
mov byte [esp + 2], cl
pop word [esp + 3]
sub esp, 1
mov di, ax
and ecx, 0x1981a9ed
mov esi, dword [esp]
jmp 0xacd623
sets bl
mov ah, 0x8f
lea edi, [esi + 0xc4]
mov word [esp], dx
mov eax, esi
sbb cx, ax
jmp 0xacd64f
pop cx
mov dword [esp], ebx
mov dh, 0xc4
lea eax, [ebp*4]
push word [esp + 4]
clc
jmp 0xacd667
stc
mov dh, ah
mov bx, word [esp + 1]
lea esp, [esp]
neg cx
jmp 0xacd70e
lea edx, [ecx*4]
cld
not esi
not edx
push ax
lea ebp, [eax + ecx]
jmp 0xacd6bf
mov byte [esp], dh
mov word [esp], bx
xchg dx, si
mov bp, 0xa7da
setge al
pop bx
jmp 0xacd6d5
lea ecx, [ebx + ebx]
xor edi, edx
inc ax
dec ebx
bsf ax, si
mov di, word [esp + 1]
jmp 0xacd77c
add esp, 0
setle al
xchg di, ax
lea edx, [esi*4]
jmp 0xacd765
add esp, 3
pop cx
cld
pop word [esp]
mov word [esp + 2], bx
push dword [esp + 2]
jmp 0xacd6a9
mov byte [esp + 2], dl
cpuid
add esp, 2
mov ecx, 0x35b1e625
and ah, bl
jmp 0xacd7ee
btr ebx, edx
xchg byte [esp], ah
xchg edx, ebp
inc cx
rdtsc
push esp
jmp 0xacd74f
cpuid
xchg byte [esp], ch
mov cx, bp
bswap edi
mov byte [esp], ah
add esp, 1
jmp 0xacd721
neg cl
push di
lea esp, [esp]
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov word [esp], si
not bp
jmp 0xacd7c4
mov byte [esp], ch
mov ah, bh
mov al, bh
mov esi, 0x59eaf50f
mov ebp, 0x7a447bc4
std
jmp 0xacd78e
sub esp, 8
xchg dword [esp + 6], ebp
mov cl, byte [esp + 8]
pop ebp
mov dword [esp], edi
lea ecx, [edi*4]
jmp 0xacd803
add esp, 2
neg dh
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov cx, 0x78e9
mov dh, byte [esp]
clc
jmp 0xacd7b0
rcl ebp, 8
seto dh
mov dword [esp], esp
mov ch, 0xde
add esp, 6
bswap ebx
jmp 0xacd9e0
mov edx, 0x74c402c1
mov eax, 0x47b8fc15
cmc
mov bx, sp
push word [esp + 0xc]
setnp al
jmp 0xacd8af
pop edi
rdtsc
neg eax
xchg dword [esp + 0xf], ebp
mov dword [esp + 0xb], edi
mov word [esp + 0xa], di
jmp 0xacd82b
xchg dword [esp + 1], ecx
clc
mov dword [esp + 4], edi
call fcn.00acd88c
inc eax
aam 0x4a
sub eax, 0x41d66fdc
sal dword [eax - reloc.RASAPI32.dll_RasHangUpA], 1
std
bsr di, di
xchg edi, ebp
mov byte [esp], ah
mov bl, byte [esp + 0x13]
mov ebp, dword [esp + 1]
jmp 0xacd85d
xchg dword [esp + 5], ebp
pop esi
pop si
xchg esi, eax
neg dx
push sp
jmp 0xacd878
pop eax
mov bl, byte [esp]
sub esp, 0x13
mov dx, 0x33e0
bswap edi
sub esp, 6
jmp 0xacd849
lea ebp, [ebx + ebp]
xchg si, bx
mov ch, cl
std
push esp
xchg edi, edx
jmp 0xacd96f
Function at 0xacd952
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x43]
mov ebp, esi
mov eax, dword [esp]
jmp 0xacd99a
or si, sp
btc esi, ecx
rdtsc
adc bl, al
bswap eax
jmp 0xacd9c0
mov dl, byte [esp]
rdtsc
mov dh, dl
mov al, ch
xchg ah, dl
mov al, byte [esp]
jmp 0xacd984
shl ah, cl
btc bx, si
mov dl, 0xec
rcl bx, 1
xor cl, 0x87
jmp 0xacdadb
mov ax, 0xcd1d
lea ebx, [ecx + ebp]
sub esp, 1
bswap edx
xchg dx, cx
ror bh, cl
jmp 0xacd9aa
mov word [esp], ax
xchg byte [esp], bl
rdtsc
mov edi, edx
add esp, 0
jmp 0xacda14
mov dl, byte [esp]
btc ecx, eax
mov bl, dl
mov dh, 0xf2
bt esi, esi
inc edx
jmp 0xacd9ee
mov word [esp + 1], dx
xchg bx, ax
mov dword [esp], esi
mov cx, word [esp + 1]
jmp 0xacda6e
mov ecx, 0x294d3314
rdtsc
xchg byte [esp], ah
mov di, word [esp]
push esp
xchg word [esp + 1], dx
jmp 0xacda04
xchg esi, ebx
rol bx, 2
xchg di, bp
setl dh
not ch
xchg esi, ebp
jmp 0xacdaa9
sub esp, 2
cmc
mov bx, word [esp + 1]
mov al, ch
mov byte [esp + 2], ah
pop eax
jmp 0xacda41
not al
lea esp, [esp + 1]
mov al, 0x8d
mov word [esp], ax
xchg word [esp], bx
mov bx, word [esp + 1]
jmp 0xacda57
bswap ebx
stc
rol dx, 0
cpuid
cpuid
std
jmp 0xacdabf
neg ecx
cpuid
xchg bx, bp
mov ch, 0x1b
sbb edi, ebx
setbe bl
jmp 0xacdcc9
mov word [esp], sp
mov word [esp], sp
xchg word [esp], dx
rdtsc
mov bh, dh
mov cl, byte [esp + 1]
jmp 0xacda85
xchg word [esp], dx
bswap edi
mov ebx, 0x8756d8d8
sub ah, dl
add esp, 1
add esp, 0
jmp 0xacda93
mov ah, byte [esp]
add esp, 0
not ah
xchg ecx, eax
mov edi, 0x96b39bc0
sub al, 0xc9
jmp 0xacda2b
adc ax, 0x2205
mov dx, 0x13e7
pop word [esp + 0x10]
jmp 0xacdb4c
mov bp, word [esp + 0x27]
bts ecx, eax
inc bx
btr eax, esi
xchg dword [esp + 0x13], esi
xchg edi, esi
jmp 0xacdaf0
mov ah, al
push dword [esp + 0x1c]
xchg byte [esp + 2], bh
pushfd
xchg word [esp + 0xd], di
push word [esp + 9]
jmp 0xacdb06
pop word [esp + 1]
mov word [esp + 4], bx
lea esp, [esp + 7]
bswap edi
call fcn.00acdbbb
push ds
xchg word [esp + 7], si
xchg byte [esp + 0xd], dl
cpuid
popal
xchg ch, dh
sub esp, 3
jmp 0xacdb36
lea ecx, reloc.RASAPI32.dll_RasHangUpA
xchg dword [esp + 9], edi
push dword [esp + 0x18]
mov cx, word [esp + 0xb]
xchg dword [esp + 0xc], esi
mov ebp, 0x9c65394a
jmp 0xacdb1f
pop word [esp + 0xd]
rdtsc
push word [esp + 0x15]
mov dword [esp + 2], edx
lea edi, reloc.RASAPI32.dll_RasHangUpA
xchg word [esp + 0x13], bp
jmp 0xacdb67
xchg ch, ah
xchg ch, al
mov si, 0xe2d4
xchg di, cx
sub esp, 0x1a
xchg word [esp + 0x17], bp
jmp 0xacdc0d

Function at 0xace277
Capabilities:
Packed with generic packer

Disassembly:
push ax
call fcn.00ace261
pushal
lea esp, [esp + 2]
mov dword [esp + 0x3c], ebx
pushfd
pop word [esp]
lea esp, [esp + 2]
jmp 0xace33b
mov dword [esp + 0x38], esp
call fcn.00ace2fe

Function at 0xace2bb
Capabilities:
Packed with generic packer

Disassembly:
call fcn.00acd239
jmp 0xace2e7
mov dword [esp + 0x58], esi
pushfd
mov dword [esp + 0x58], edi
lea esp, [esp + 0x58]
jmp 0xace319
mov eax, dword [eax]
jmp 0xace35a
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xace303
mov eax, dword [eax + 8]
push eax
jmp 0xacd234
Function at 0xace2d1
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
mov dword [esp + 0x3c], ebp
pushal
push dword [esp + 0x10]
pop dword [esp + 0x13]
pop dword [esp + 0xf]
call fcn.00ace2bb
Function at 0x401998
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4019d7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4019d7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4019d7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4019d7
cmp dword [ecx + 0x74], 0xe
jbe 0x4019d7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401000
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x47c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x48c]
lea ebp, [esp + 0x14]
push edi
mov eax, esi
sub ebp, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + ebp], cl
inc eax
test cl, cl
jne 0x401020
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401031
sub eax, edx
cmp byte [esp + eax + 0x17], 0x5c
je 0x401057
lea edi, [esp + 0x18]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401046
mov ax, word [0x40210c]
mov word [edi], ax
lea edi, [esp + 0x18]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401060
mov ebx, dword [esp + 0x494]
mov ecx, dword [0x402110]
push ebx
push esi
lea edx, [esp + 0x360]
push str._s_s
push edx
mov dword [edi], ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x358]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4010d1
mov edx, 0x403130
mov eax, esi
sub edx, esi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4010b0
mov dword [0x403324], 1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x47c
ret
lea ecx, [esp + 0x218]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, 0xffffffff
jmp 0x4011d2
inc dword [0x403328]
cmp dword [esp + 0x218], 0x10
jne 0x4011c1
cmp byte [esp + 0x244], 0x2e
je 0x4011c1
lea eax, [esp + 0x244]
push eax
push str.Windows
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x4011c1
mov eax, esi
mov cl, byte [eax]
mov byte [eax + ebp], cl
inc eax
test cl, cl
jne 0x401134
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401145
sub eax, edx
cmp byte [esp + eax + 0x17], 0x5c
je 0x401172
lea edi, [esp + 0x18]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401160
mov cx, word [0x40210c]
mov word [edi], cx
lea eax, [esp + 0x244]
mov edx, eax
jmp 0x401180
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401180
lea edi, [esp + 0x18]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401190
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x18]
and ecx, 3
push ebx
push edx
rep movsb byte es:[edi], byte [esi]
call section..text
mov esi, dword [esp + 0x498]
mov edi, dword [esp + 0x1c]
add esp, 8
lea eax, [esp + 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4010f2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x47c
ret
Function at 0x4011f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x200
push ebx
push esi
push 0x1ff
lea eax, [esp + 0xd]
push 0
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
add esp, 0xc
xor ebx, ebx
lea ebx, [ebx]
mov cl, bl
lea edx, [esp + 8]
add cl, 0x42
push edx
mov byte [esp + 0xc], cl
mov byte [esp + 0xd], 0x3a
mov byte [esp + 0xe], 0x5c
mov dword [0x403324], 0
call esi
cmp eax, 1
je 0x401264
lea eax, [esp + 8]
push str.TLBBDownload.exe
push eax
call section..text
add esp, 8
cmp dword [0x403324], 1
je 0x401272
inc ebx
cmp ebx, 0x1a
jl 0x401220
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401280
Capabilities:
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
push 0xc8
lea eax, [esp + 0x1c]
push 0
mov ecx, 0xf
mov esi, str.CE_9YC.DLL
lea edi, [esp + 0xe8]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.MSVCRT.dll_memset
add esp, 0xc
push section..data
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
sub eax, 0xa
push eax
lea ecx, [esp + 0x1c]
push section..data
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push str.fmod.dll
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push 4
push 0x1000
mov ebp, eax
push ebp
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
mov ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push esi
mov dword [ebx + 3], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea edx, [esp + 0x18]
push edx
call esi
test eax, eax
jne 0x401367
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x1f4
call edi
lea eax, [esp + 0x18]
push eax
call esi
test eax, eax
je 0x401355
push 0
push 0x80
push 1
push 0
push 1
lea edi, [ebx + 0x252bc]
mov ecx, 0xf
lea esi, [esp + 0xf4]
rep movsd dword es:[edi], dword [esi]
push 0x40000000
lea ecx, [esp + 0x30]
push ecx
mov dword [ebx + 0x118], 0x92eca
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
push 0
lea edx, [esp + 0x14]
push edx
push ebp
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret