joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b6cb
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x48b739
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x4e10ec
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x48b730
cmp dword [ebp - 0xc], 4
jne 0x48b730
cmp dword [ebp - 0x10], edi
je 0x48b730
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5cfd78], edi
xor eax, eax
jmp 0x48b778
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x5cfd78], edi
jge 0x48b773
lea eax, [ebp - 0x34]
push eax
mov dword [0x5cfd78], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x48b773
cmp word [ebp - 0x14], 5
jb 0x48b773
call fcn.0048b6a6
test eax, eax
je 0x48b773
emms
mov dword [0x5cfd78], 1
mov eax, dword [0x5cfd78]
pop edi
leave
ret

Function at 0x4ba1ee
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4ba226
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b823e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b8216
jmp 0x4ba232
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4bb8e8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4bb92a
call fcn.004c1928
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4bb92a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4bb921
xor eax, eax
jmp 0x4bb932
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004bb938
pop edi
pop esi
pop ebx
ret 4

Function at 0x4c1e58
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4c1e86
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4c1ea4
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004c1dbe
jmp 0x4c1ea4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4c1ea4
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004c1dbe
test edi, edi
mov eax, edi
jne 0x4c1e8e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x11255318
Capabilities:
Authenticate hmac

Disassembly:
mov ch, 0x78
mov ecx, 0x99a7ea16
push dword [esp]
mov cx, word [esp + 6]
jmp 0x11255350
xchg byte [esp + 1], ch
mov cl, 0xd2
mov ecx, dword [esp + 3]
lea ecx, [ecx*4]
clc
jno 0x11255339
jo 0x11255399
mov ebx, 0x3cbd4e2b
push ds
pushfd
xor dl, byte [ebp - 0x5c]
invalid

Function at 0x1125cab5
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + 0x38], ecx
call 0x1125ca7a
mov dword [ecx], ecx
cdq
clc
or ebp, dword [edx + 0x29]
stosb byte es:[edi], al
cmp byte [edi - 0x56], bl
xchg ebp, eax
dec ebx
loop 0x1125cac8
insb byte es:[edi], dx
push dword [esp + 4]
call fcn.1125ca93
mov byte [esp + 3], bh
push edx
lea esp, [esp + 0x34]
popal
jmp 0x1125cac5
lea ebx, reloc.mscoree.dll__CorExeMain
aas
add dword [eax], edx
mov dword [ebx], eax
pop ebx
jmp 0x1125cb47
movzx ebx, byte [eax]
add ebx, 0xf3132125
jmp 0x1125cb89
cmp ebx, 0xf31321f1

Function at 0x1126dc1b
Capabilities:
Encrypt data using aes

Disassembly:
pushal
push word [esp + 0x13]
mov dword [esp + 1], eax
pop word [esp + 0xd]
jmp 0x1126dc44
stc
lea esp, [esp + 0x14]
add dword [ebp - 4], 4
jmp 0x1126dbf8
mov eax, dword [edx - 4]
mov dword [edx - 8], edi
mov edi, dword [ecx - 4]
jmp 0x1126dc4e
mov dword [ecx - 8], eax
btr eax, edi
pushal
stc
jmp 0x1126dc26
mov dword [ecx - 4], eax
mov eax, dword [edx]
mov dword [edx - 4], edi
jmp 0x1126dc5c
push esi
mov esi, ecx
mov edi, dword [esi]
pop esi
jmp 0x1126dd81
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [edx], edi
jmp 0x1126dd54

Function at 0x1126dc5c
Capabilities:
Encrypt data using aes

Disassembly:
pushal
push word [esp + 0x13]
mov dword [esp + 1], eax
pop word [esp + 0xd]
jmp 0x1126dc44
stc
lea esp, [esp + 0x14]
add dword [ebp - 4], 4
jmp 0x1126dbf8
mov eax, dword [edx - 4]
mov dword [edx - 8], edi
mov edi, dword [ecx - 4]
jmp 0x1126dc4e
mov dword [ecx - 8], eax
btr eax, edi
pushal
stc
jmp 0x1126dc26
mov dword [ecx - 4], eax
mov eax, dword [edx]
mov dword [edx - 4], edi
jmp 0x1126dc5c
push esi
mov esi, ecx
mov edi, dword [esi]
pop esi
jmp 0x1126dd81
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [edx], edi
jmp 0x1126dd54

Function at 0x1126dc97
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 3
sub esp, 2
lea esp, [esp + 3]
jmp 0x1126dc80
Function at 0x1126e009
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
stc
clc
stc
push edx
jmp 0x1126dfa3
and edx, ecx
call fcn.1126e009
sbb eax, 0x9e630496
sbb dword [edi + 0xdfe9b0b], eax
push 0x4522ac2f
mov ah, 0x8b
cmp dword [ecx], esp
retf 0xec83
and edx, ecx
sub esp, 0x1c
cmc
mov dword [esp + 0x15], ecx
jmp 0x1126df92
not ebx
movzx ebx, byte [esi + 5]
push edx
mov word [esp], di
jmp 0x1126dfbd
shl dh, 1
bswap edx
setge dh
mov edx, dword [esi + 4]
pushal
jmp 0x1126e052
mov byte [esp + 1], ch
lea esp, [esp + 0x28]
xor edi, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
jmp 0x1126dfe8
mov ebx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
call fcn.1126e065
in eax, 0x6e
pushfd
and eax, 0x1ee81125
add byte [eax], al
add ch, ah
outsb dx, byte [esi]
cld
wait
jbe 0x1126e03e
inc esi
jno 0x1126e0c1
jae 0x1126dfdb
mov byte [esp + 7], bh
jl 0x1126e079
pop es
pop word [esp + 5]
lea esp, [esp + 2]
mov dword [esi], edi
rcl edi, 1
jmp 0x1126e03b
sbb eax, ebp
mov eax, dword [ebp + eax + reloc.mscoree.dll__CorExeMain]
xor al, 0x27
lodsd eax, dword [esi]
add byte [eax], al
add byte [eax], al

Function at 0x1126e28f
Capabilities:
Encrypt data using aes

Disassembly:
and eax, 0xbbb4bb11
popal
xlatb
call 0x1126e28f
and al, 0
add byte [eax], al
jo 0x1126e267
push 0x52e2fa0f
fisttp word [edi + 0x2a]
fldenv [eax - 0x4e]
lodsd eax, dword [esi]
mov esp, 0x6b81168f
popal
inc edx
mov byte [0xe1b0e3f9], al
xchg ecx, eax
mov eax, 0xe11d03a2
in eax, dx
jl 0x1126e241
sbb al, 0x83
les eax, [ebx]
lea esp, [esp + 1]
mov edx, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
call fcn.1126e2b4
inc eax
ret 0x3750

Function at 0x1126f1c7
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 5], dh
lea esp, [esp + 2]
jmp 0x1126f202
lea esp, [esp + 0x10]

Function at 0x1126f1de
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 3]
call fcn.1126f1c7
outsd dx, dword [esi]
out dx, eax
jg 0x1126f206
jmp 0xa72779c4
jne 0x1126d9a5
je 0x1126d9c0
or cl, byte [esi - 0x96984e4]
cwde
and esi, dword [ebx - reloc.mscoree.dll__CorExeMain]
cli
popfd
insb byte es:[edi], dx
je 0x1126f236
nop
adc eax, dword [ebx - reloc.mscoree.dll__CorExeMain]
and al, 0x8d
and al, 2

Function at 0x11271326
Capabilities:
Encode data using xor

Disassembly:
mov dh, bh
xchg word [esp + 1], dx
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x11271344
Function at 0x113322a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, di
pushal
bsf bx, si
xchg dword [esp + 6], eax
rdtsc
xchg di, dx
jmp 0x113322e7
bsf bx, ax
mov bx, dx
add esp, 6
lea esp, [esp + 6]
xchg ch, dl
mov al, ah
jmp 0x11332255
push dword [esp]
bsf si, si
jmp 0x1133227d
mov bp, 0x24a3
lea esi, [edx + edi]
mov bl, 0xf0
xor bp, 0x89b4
sub esp, 0x18
lea edi, [eax + edi]
jmp 0x1133231f
rdtsc
inc dl
pop word [esp + 0x16]
add esp, 0x2e
neg ch
mov bp, word [esp + 0xd]
jmp 0x113322af
sub esp, 0x1e
cmc
lea ebx, [eax*4]
rcr ecx, 0xf
mov bh, byte [esp + 0x2f]
stc
jmp 0x113322cb
not ebx
mov byte [esp + 7], bh
bswap edi
lea edi, [eax*4]
ror ch, 5
call fcn.11332390
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi + 0x524448f], bl
pop dword [esp + 5]
add al, dh
neg ebx
setbe bh
not dh
mov dword [esp + 0xf], eax
jmp 0x113322fc
Function at 0x113326e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov word [esp + 2], sp
rcl di, cl
setae ah
not esi
lea eax, [ecx + ebx]
jmp 0x113326f1
rdtsc
xchg byte [esp + 4], dl
jmp 0x113326d1
sub esp, 0x1a
xchg edi, edx
lea edi, [ebx*4]
pop dword [esp + 4]
xchg ebx, ebp
jmp 0x11332810
xchg bp, ax
push dword [esp + 0x16]
add esp, 0xf
pop eax
lea esp, [esp + 7]
add bx, 0xffb6
jmp 0x1133277d
mov bp, word [esp + 0xa]
xchg ch, dl
mov cx, 0x912d
xchg word [esp + 0x19], dx
xchg byte [esp + 0x10], bl
xchg ch, dl
jmp 0x1133273e
btc esi, edi
add esp, 1
bswap esi
push dword [esp + 6]
xchg ebx, ecx
add bp, 0x7d6
jmp 0x113327f4
lea eax, [edx*4]
call fcn.113327db
leave
push ebx
ret
not di
mov byte [esp + 0x13], bh
push word [esp + 0x13]
xchg byte [esp + 0x17], cl
mov eax, 0xc53f0dfe
mov edx, ecx
jmp 0x11332765
btc ebx, edi
mov dword [esp], esi
mov byte [esp + 5], ch
bsf dx, ax
neg ch
mov eax, 0x78cddff6
jmp 0x11332792
bsr di, cx
xchg si, ax
lea ebx, [esi*4]
xchg word [esp + 0x19], bx
xchg byte [esp + 4], dl
btr esi, edx
jmp 0x113327a9

Function at 0x11332900
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ebx, ebp
mov ax, bx
add esp, 1
mov bh, byte [esp + 1]
mov bx, word [esp]
shr bh, 3
jmp 0x113328b0
sub esp, 4
xchg bx, ax
pop di
bswap edx
stc
xchg bh, cl
jmp 0x11332866
and di, 0xdf22
mov dl, 0xf4
xchg edx, esi
popal
shl ax, cl
pop bp
jmp 0x11332885
mov ebx, ebp
push word [esp + 1]
lea esp, [esp + 3]
mov al, ah
xchg si, dx
stc
jmp 0x113328e7
pop dword [esp + 0x15]
neg cx
bswap ebx
rdtsc
mov ax, 0xf475
mov esi, 0x84beaefe
jmp 0x1133289f
mov edx, 0xa07e3958
mov ah, byte [esp]
mov dh, byte [esp]
bswap ebp
xchg byte [esp], cl
mov eax, dword [esp]
jmp 0x11332ad2
bsf cx, ax
pushal
mov edi, 0xae206f8c
xchg byte [esp + 0x1c], al
jmp 0x113328d1
mov dh, byte [esp + 0xd]
not bp
lea ecx, reloc.mscoree.dll__CorExeMain
mov bl, bh
mov dword [esp + 0xa], esi
call int.113329b0
aas
mov eax, 0xc5b8492e
adc edx, dword [ebp + reloc.mscoree.dll__CorExeMain]
test byte [edi], dh
push ds
imul ecx, dword [eax + reloc.mscoree.dll__CorExeMain], 0x86c18766
iretd
ror ch, 5
inc ebx
xchg cx, ax
xchg bh, cl
mov al, ah
xchg word [esp + 0xc], di
jmp 0x113329cf
xchg byte [esp], cl
sub esp, 0x10
mov edi, dword [esp + 3]
mov si, di
add esp, 2
mov ebp, eax
jmp 0x113329f8
rdtsc
add esp, 0
xchg cx, bp
neg ah
bswap edx
shr ah, 1
jmp 0x11332a60

Function at 0x1133294a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, 0x1e
push dword [esp + 3]
push word [esp + 2]
call 0x1133294a
xor dword [eax + reloc.mscoree.dll__CorExeMain], ecx
xchg dword [esp + 7], ebx
lea esp, [esp + 2]
jmp 0x11332966
jmp 0x11332939
xchg dx, cx
xchg ah, bl
push word [esp + 2]
xchg cx, bp
rol bx, cl
jmp 0x11332995

Function at 0x11332e9d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [eax*4]
lea ebp, [eax*4]
xchg word [esp + 3], cx
jmp 0x11332e6a
lea eax, [eax + edi]
lea esp, [esp + 1]
jmp 0x11332e84
Function at 0x11333bb5
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
call 0x11333bb5
lea esp, [esp + 1]
pushal
push esp
push word [esp + 1]
xchg byte [esp + 1], bl
rdtsc
jmp 0x11333b9c
call 0x11333b5c
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x6f725020
je 0x11333bb3
arpl word [edi + ebp*2 + 0x72], si
and byte [esi + 0x32], dh
xor dword cs:[esi], ebp
cmp dword [esi], ebp
xor byte [eax], al
pushfd
jmp 0x11333b10
sub bx, 0xcf80
mov ecx, 0x3cfebe48
mov bl, 0x10
bsf di, si
jmp 0x11333bca
xchg byte [esp + 2], dl
push word [esp + 5]
mov bx, 0xed9b
mov byte [esp + 1], ch
jmp 0x11333b84
dec edx
in eax, 0x66
mov dword [esp], ebx
pop word [esp]
clc
lea esp, [esp + 1]
add esp, 0
jmp 0x11333b16
mov ebx, dword [esp + 1]
inc di
mov edi, dword [esp + 1]
pushal
pop dword [esp + 0xc]
xchg dh, al
jmp 0x11333c61
cld
push esp
lea ecx, [esi*4]
rdtsc
xchg dx, si
bswap esi
jmp 0x11333cc9
xchg byte [esp + 5], al
mov al, 0x3e
mov ebx, ebp
setno ah
cpuid
lea ecx, [ebp + 0x27]
jmp 0x11333cb3
mov ch, byte [esp + 0x1d]
mov cl, ch
push word [esp + 0x25]
mov dh, byte [esp + 0x25]
jmp 0x11333e82
mov bp, word [esp + 4]
xchg ch, dl
xchg byte [esp + 0x18], cl
xchg edx, ebp
not ecx
xchg word [esp + 0x17], cx
jmp 0x11333c9d
shl ax, cl
lea ecx, [edx + ebx]
lea esp, [esp + 0xd]
call fcn.11333d94
mov bx, word [esp + 0x14]
pop ebp
bswap esi
lea edx, [ebp - 0x87]
pop ebx
not edx
jmp 0x11333eff
cld
btr esi, esp
call fcn.11333ec6
fistp word [ebp - 0x33]
xchg esp, eax
and ch, byte [bx]
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 0xeb
aas
push es
mov cl, 0xb0
mov bl, 0x89
insb byte es:[edi], dx
and al, 1
mov dword [esp + 1], ebp
mov al, 0x3e
popal
xchg dh, al
pop word [esp + 3]
add esp, 0xd
jmp 0x11333ee5
Function at 0x11333ec6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, byte [esp + 2]
cpuid
mov dword [esp + 3], ebp
mov bp, di
jmp 0x11333f39
mov eax, 0x97808b8e
push word [esp + 6]
xchg dh, al
xchg byte [esp + 2], bl
push dword [esp + 7]
xchg word [esp + 1], cx
jmp 0x11333fdb
pop ebp
xchg ch, dl
mov bx, di
not dh
push edx
neg edi
jmp 0x11333f12
push word [esp + 0x10]
lea edi, [ebp*4]
setle dh
not eax
mov si, sp
add esp, 2
jmp 0x113359eb
ror ch, 5
sub esp, 0x1c
xor dl, ch
setle ah
mov esi, dword [esp + 0xb]
mov ax, bx
jmp 0x11333f56
mov dh, byte [esp + 7]
mov word [esp + 8], sp
mov byte [esp + 1], bh
xchg dword [esp + 4], edi
pop dword [esp + 1]
jmp 0x11333f7b
mov esi, dword [esp]
push word [esp + 0xa]
mov edx, 0x40a477b4
lea edi, [eax*4]
mov dword [esp + 1], ecx
jmp 0x11333f9f
cpuid
rdtsc
pop ax
xchg dword [esp + 6], edx
rdtsc
lea esp, [esp + 2]
jmp 0x11333fbb
bswap ebx
clc
pop word [esp + 9]
call fcn.113341b9
pop cx
pop dword [esp + 0xb]
lea edx, [ecx*4]
xchg ebp, ecx
call fcn.1133444a
mov edx, 0x45b6d343
xchg byte ds:[ecx], dh
xor byte [ebx], dh
sub al, byte [ebp - 0x76]
and al, 0x17
sub bl, ah
lea esp, [esp]
lea esp, [esp + 2]
not dh
bswap ecx
jmp 0x11334417
lea eax, [esi - 0xed]
xchg dword [esp + 0x10], ebx
stc
push esp
mov ecx, eax
cmc
jmp 0x1133440a
rol ax, cl
mov bp, word [esp + 0x15]
mov dword [esp + 0xf], ecx
cld
popal
pop di
jmp 0x11334729
mov dx, 0x142b
bsf dx, si
lea ebx, [esi + edi]
sub esp, 0x16
mov bx, dx
xchg dword [esp + 0x19], ebp
jmp 0x1133489c

Function at 0x113346a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 0xf]
neg dh
lea edi, [ebp + 0x17]
not bh
mov eax, 0xfe25fe2c
pop ecx
jmp 0x113346c9
cmc
jmp 0x11334683
mov dx, word [esp + 2]
pop word [esp + 3]
lea esp, [esp + 7]
neg eax
sub esp, 0x16
push edx
jmp 0x11334710
xchg byte [esp + 1], bl
xchg byte [esp + 7], bl
mov ah, byte [esp + 1]
mov cl, 0xba
pop word [esp + 5]
xchg bp, ax
jmp 0x113346a9
xchg byte [esp + 4], cl
xchg dword [esp + 0x17], eax
mov bh, byte [esp + 0x16]
mov ebp, 0x2ac48ab4
jmp 0x113346fa
Function at 0x113349be
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x10
mov dword [esp + 9], ebp
cpuid
sub esp, 0x16
sub esp, 0
xchg ecx, ebx
jmp 0x11334958
lea esi, [esi - 0x45]
lea edi, [esp + edi]
mov esi, ebp
pop bp
lea ebx, [eax + edi]
sub esp, 6
jmp 0x113348b1
bswap ecx
xchg si, dx
lea esi, [edx + ebx]
xchg word [esp + 8], si
lea esp, [esp + 0xf]
xchg byte [esp + 2], al
jmp 0x113348cf
mov al, ah
push esp
sub esp, 2
sub esp, 0xc
pop dword [esp + 7]
push dword [esp + 5]
jmp 0x113348f3
mov bp, word [esp + 0xc]
mov di, word [esp]
mov esi, dword [esp + 0xf]
rdtsc
mov esi, dword [esp + 0xd]
mov di, word [esp + 2]
jmp 0x1133496a
popal
push dword [esp + 8]
btr ecx, edx
neg dh
mov di, dx
xchg bp, dx
jmp 0x1133492d
mov word [esp + 0xe], sp
bswap esi
sub esp, 0x1a
xchg ch, dl
mov word [esp + 0x18], bx
mov bp, word [esp + 2]
jmp 0x1133499f
pop edi
btc ecx, ebx
lea ebp, [esi - 5]
xchg byte [esp + 0x24], al
mov ebx, 0x23fa11f2
add esp, 0x27
jmp 0x1133491a
mov dl, dh
pop di
pop word [esp + 0xf]
xchg byte [esp + 0x14], al
lea eax, [esi - 0x95]
popal
jmp 0x113349cd
pop dword [esp + 8]
cld
pop ebp
neg bp
mov byte [esp + 0x1f], ch
jmp 0x11334987
xchg word [esp + 1], di
mov al, ah
mov byte [esp + 4], dh
xchg cx, dx
rdtsc
call fcn.11334ada
dec esp
fbld tbyte [esi]
push ecx
shl byte [esi - 0x79], 1
dec esp
and al, 0x1f

Function at 0x11334ada
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap esi
cld
cmc
xchg bh, cl
xchg byte [esp + 0xa], dl
rol bx, cl
jmp 0x113349f1
pop word [esp + 7]
xchg ah, bl
xchg si, cx
mov cl, 0xa
mov word [esp + 0xa], sp
inc bl
jmp 0x11334a0a
push dword [esp + 8]
bsf bp, ax
mov dword [esp + 9], ebp
mov esi, ecx
pop dword [esp + 8]
mov dword [esp + 5], ebp
jmp 0x11334a3f
push edx
jmp 0x11334a88

Function at 0x11334d18
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x21]
mov dx, 0x2dbd
rdtsc
pop word [esp + 0x20]
popal
inc dl
jmp 0x11334d1a
jmp 0x11334cf7
mov dword [esp], eax
btc ecx, ebx
lea ebx, [ecx + 0x8b]
mov dh, byte [esp + 2]
mov byte [esp + 3], ah
xchg byte [esp], cl
jmp 0x11334d68
mov al, 0xe
bswap edx
xchg byte [esp], al
mov dx, di
cpuid
setnp dh
jmp 0x11334d52

Function at 0x1133505c
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.11333ffe
call 0x11335014
pop edx
jmp 0x113350a3
mov eax, dword [eax + 8]
push eax
jmp 0x11333ff9
Function at 0x113350f4
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x1133200d
call fcn.11332012
movzx ebx, word [eax + 0x3c]
jmp 0x113350fb
lea esp, [esp + 0x20]
cmp word [eax], 0x5a4d
jmp 0x11335654
pushal
pop dword [esp + 0xe]
jmp 0x113350dd
add ebx, eax
cmp word [ebx], 0x4550
jmp 0x11335211
lds esi, [edx + edi*2]
mov ecx, 0x4dd2fb98
fmul qword [edi]
test byte [esi - 0x35], al
invalid
je 0x11331d5d
jne 0x1133565a
sub dh, byte [ebx - 0x314ab9dd]
xor byte [edx + ebp + 0x263bbc4d], dh
mov eax, dword [reloc.mscoree.dll__CorExeMain]
pushal
loop 0x113352a2
pop ss
loop 0x11335208
mov byte [0x21d2b727], al
or eax, ebx
pop eax
into
test eax, 0xb5361f58
and eax, 0x20e0bf4c
cmpsb byte [esi], byte es:[edi]
xor al, 0x53
scasb al, byte es:[edi]
loopne 0x113352a0
fisttp dword [ebx + 0x2e]
frstor dword [esi - reloc.mscoree.dll__CorExeMain]
inc esp
ret
das
push es
test dword [reloc.mscoree.dll__CorExeMain], edx
movsb byte es:[edi], byte ss:[esi]
ret
je 0x1133407a
sub eax, 0x10000
jmp 0x113350e1
Function at 0x4014f3
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004016a3
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x4015f1
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x401594
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x4015d7
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4015ab
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4015c6
test al, 0x40
je 0x4015bd
mov ecx, dword [edi + 0x20]
jmp 0x4015c4
test al, 0x80
je 0x4015d7
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x4015d7
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x401563
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x40d1f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47600b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046a56d
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40d272
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00467ec0
mov eax, dword [eax]
push 0x609200
push eax
call fcn.0045a174
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046a7f8
test bl, bl
je 0x40d272
push 0x609200
lea ecx, [esp + 0xc]
call fcn.0046ab88
push 0x60cd90
lea ecx, [esp + 0xc]
call fcn.0046ab88
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40d2ae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046a7f8
jmp 0x40d379
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40d332
lea edx, [esp + 0x7c]
push 0x60cd8c
push edx
call fcn.0045a174
add esp, 8
test eax, eax
je 0x40d332
lea eax, [esp + 0x7c]
push 0x60cd88
push eax
call fcn.0045a174
add esp, 8
test eax, eax
je 0x40d332
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40d2c2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046a7f8
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40db70
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40dbd2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc