joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6eda
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x18], 0
je 0x4c6f0f
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [ebp + 0x18], 0
jne 0x4c6f26
mov dword [ebp - 0x14], 0xc000000d
jmp 0x4c7073
mov ecx, dword [ebp + 8]
and ecx, 0xfffffffe
je 0x4c6f3f
mov dword [ebp - 0x14], 0xc000000d
jmp 0x4c7073
cmp dword [ebp + 0xc], 0
je 0x4c6f4b
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4c6f5c
mov dword [ebp - 0x14], 0xc000000d
jmp 0x4c7073
mov edx, dword [ebp + 8]
and edx, 1
sete al
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x4c6f8f
cmp dword [ebp + 0x14], 0
ja 0x4c6f8f
jb 0x4c6f7e
cmp dword [ebp + 0x10], 0x40
jae 0x4c6f8f
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4c7073
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x4c6fad
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4c7073
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4c700c
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0x14]
ja 0x4c7001
jb 0x4c6fdb
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + 0x10]
jae 0x4c7001
cmp dword [ebp - 0x10], 0xffffffe7
jae 0x4c7001
mov edx, dword [ebp - 0x10]
add edx, 0x18
xor eax, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp + 0x14]
jb 0x4c700c
ja 0x4c7001
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp + 0x10]
jb 0x4c700c
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4c7073
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [0x13050]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx]
jae 0x4c7056
mov eax, dword [0x13050]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax]
jb 0x4c7039
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4c7073
mov edx, dword [ebp - 8]
add edx, 0xf8
mov eax, dword [0x13050]
cmp edx, dword [eax]
jb 0x4c7056
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4c7073
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x4c706c
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4c7073
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jl 0x4c7081
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x56adf5
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x578883
mov byte [esp], ah
pushal
mov word [esp + 0x18], di
mov dword [esp + 0x1f], edx
lea edx, [ebx + edi]
mov dh, ch
jmp 0x56ae31
lea esp, [esp + 3]
push dword [esp]
pop word [esp + 5]
pop dword [esp]
mov byte [esp + 1], ah
jmp 0x56adb3
pop dword [esp]
mov dword [esp + 0xc], eax
mov edx, eax
bswap edx
mov ax, 0xffb1
jmp 0x56af51
not dx
lea edx, [eax + ebx]
mov edx, dword [esp]
mov dx, 0x3ec3
lea edx, [eax + 0x11]
pushal
jmp 0x56ae1a
mov ax, cx
xchg ah, dh
rdtsc
not edx
setae dh
xchg dh, dl
jmp 0x56aedc
mov eax, ecx
mov word [esp], dx
push word [esp + 3]
lea edx, [ebp - 0x51b31ba1]
lea esp, [esp + 2]
mov ebp, dword [esp + 4]
jmp 0x56ae44
rdtsc
mov edx, 0x2662941c
lea ebp, [esi + 0x75]
mov dh, byte [esp]
push edx
not bp
jmp 0x56ae65
mov dx, 0x9689
mov dx, 0x6bf1
mov edx, 0x40a1e7fa
jmp 0x56af07
xchg word [esp + 1], ax
mov eax, dword [esp + 0x14]
lea edx, [edx + ebp]
lea edx, [edi*4]
mov dx, word [esp]
mov dx, 0x4535
jmp 0x56ae9e
bswap eax
lea edx, [ebx + esi]
push edx
not dh
mov byte [esp + 1], dh
not eax
jmp 0x56aeb4
mov dx, 0xae93
mov dx, word [esp]
bswap edx
mov edx, dword [esp + 0x43]
lea esp, [esp + 0x48]
jmp 0x55364b
lea eax, [eax + edx]
mov eax, dword [esp]
mov edx, ebx
mov dword [esp], ebp
rdtsc
lea ebp, [edx*4]
jmp 0x56ae8b
mov edx, 0xc4f3eb74
mov edx, 0xc83ccb16
mov dl, 0x4c
xchg edx, eax
lea eax, [edx + edi]
rdtsc
jmp 0x56af33

Function at 0x56ba0c
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0xb], esi
mov esi, dword [esp]
lea esi, [eax - 0x59]
mov si, 0x9ec1
call fcn.0056ba23
mov eax, 0xfcedf29b
iretd
pop word [esp + 0x17]
mov word [esp + 0xe], sp
mov word [esp], bx
mov byte [esp + 0x1d], ch
push dword [esp + 0x12]
lea esp, [esp + 2]
jmp 0x56b9c1
push edx
push esp
push dword [esp + 2]
lea esi, [eax + edi]
jmp 0x56ba46
rol dword [eax - 0x412a05bd], 0xee
add eax, dword [ebx + 0x51e3eb6a]
invalid
into
jl 0x56b9fb
jnp 0x56ba07
invalid
and al, 0x34
push edx
push dword [esp]
lea esp, [esp + 8]
call fcn.0056bb2c
repne insb byte es:[edi], dx
loop 0x56ba17
je 0x56ba54
stc
fdivr dword [ebx]
adc cl, byte [ecx + 0x6488242c]
mov dword [esp], ebp
mov byte [esp + 2], ah
mov word [esp], bx
pushal
jmp 0x56b9da

Function at 0x58170b
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 1]
add esp, 3
jmp 0x581737
clc
lea esp, [esp + 3]
lea esp, [esp + 0x2c]
xor edi, dword [ebx*4 + 0x55f158]
mov bx, word [esp]
jmp 0x581780
movzx ebx, byte [esi + 0xa]
stc
mov ebx, dword [ebx*4 + 0x55e558]
pushal
jmp 0x581bc8
mov bl, bh
mov bl, 0xb2
jmp 0x581765
mov edi, edx
lea edi, [edi*4]
lea edi, [edi + 0x55e558]
mov edx, dword [edi]
pop edi
call fcn.005817b6
sub esp, 0x12
lea esp, [esp + 9]
add esp, 8
lea esp, [esp + 1]
popal
call fcn.00581882
xchg ecx, eax
adc byte [ebx + 0x260a50a], dl
lds esi, [ecx + 0x24148902]
stc
jmp 0x581801
cmc
push dword [esp + 2]
sub esp, 4
push edi
jmp 0x5817ea
dec ebx
movzx ebx, byte [esi + 0xd]
and edx, ecx
sub esp, 4
jmp 0x5818b5
and ebx, ecx
pushal
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + 0x55ed58]
jmp 0x5819f8
Function at 0x5817b6
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 1
clc
sub esp, 0x1a
lea esp, [esp + 1]
jmp 0x5817d3
jmp 0x58179d
lea esp, [esp + 0x48]
xor edi, dword [edx*4 + 0x55f558]
jmp 0x581860
and edx, ecx
pushal
jmp 0x5817b8
pushal
add al, ch
mov cl, 2
mov dword [esp], edx
lea edi, [edi*4]
mov di, 0xc0b9
neg edi
mov ebx, dword [ebx*4 + 0x55e558]
not edi
jmp 0x58181a
mov edx, dword [esi + 0xc]
clc
pushal
mov dword [esi + 8], edi
jmp 0x581839

Function at 0x58189e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + 0x55e558]
jmp 0x5819dd
mov dword [esp], esi
add esp, 1
lea esp, [esp + 3]
jmp 0x581888
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + 0x55f158]
mov bl, 8
mov ebx, dword [esp]
jmp 0x581906
and ebx, ecx
sub esp, 0xa
add esp, 9
lea esp, [esp + 1]
jmp 0x5818c3
mov ebx, dword [ebx*4 + 0x55e558]
pushal
jmp 0x581991
movzx ebx, byte [esi + 0xe]
clc
pushal
push esp
mov byte [esp + 9], ah
jmp 0x5818eb
lea esp, [esp + 1]
mov edi, dword [edi*4 + 0x55e958]
push edx
add esp, 1
lea esp, [esp + 3]
jmp 0x5818dd
lea esp, [esp + 0x44]
xor edi, dword [ebx*4 + 0x55ed58]
call fcn.0058195f
ror byte [esi - 0x24], 0xbb
push esi
xchg esp, eax
pop edi
cmpsb byte [esi], byte es:[edi]
rcl dword [eax + 0x21]
retf 0x148b
and edx, ecx
mov edx, dword [edx*4 + 0x55e558]
and ebx, ecx
jmp 0x581977
and edi, ecx
cmc
sub esp, 0x10
pop word [esp + 1]
add esp, 9
jmp 0x58191f

Function at 0x581ad3
Capabilities:
Encrypt data using aes

Disassembly:
jne 0x5542bd
je 0x5542e8
lea esp, [esp + 4]
ret
pop word [esp]
mov byte [esp], dh
lea esp, [esp + 2]
lea esp, [esp + 0x20]
jmp 0x581a26

Function at 0x671e01
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00671e6d
mov byte [esp + 1], ch
push esp
call fcn.00671e43
invalid

Function at 0x671e6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], bx
lea esp, [esp + 5]
mov byte [esp + 1], bh
jmp 0x671e06
Function at 0x678ee4
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bl, bh
setle bl
bswap ebx
mov bl, 0x12
mov dword [esp + 1], edx
mov dx, 0x458b
jmp 0x678eaf
lea esp, [esp + 0x14]
mov byte [esp + 1], ah
lea esp, [esp + 3]
mov dword [esp + 7], ebx
mov ebx, dword [esp]
not bh
jmp 0x678daf
push esp
mov dword [esp], ecx
lea esp, [esp + 3]
pushal
push word [esp + 0xd]
push dword [esp + 0x16]
jmp 0x678dc7
jmp 0x6799a7
mov word [esp + 2], bx
lea esp, [esp + 7]
lea esp, [esp + 1]
push 0
pushfd
jmp 0x678de3
xchg edx, eax
not ax
mov ax, word [esp + 2]
mov bh, byte [esp + 1]
mov edx, 0xd26ae7bc
jmp 0x678e98
xchg bh, dh
xchg ebx, eax
push esp
setp ah
push word [esp + 1]
xchg dword [esp], eax
jmp 0x678e3e
xchg dx, ax
rdtsc
lea ebx, [ebx + edi]
lea edx, [ebx + esi]
mov edx, dword [esp]
rdtsc
jmp 0x678e58
mov edx, dword [esp]
mov dl, dh
xchg dh, bl
lea edx, [ebp - 0x7f]
xchg bx, dx
xchg dx, bx
jmp 0x678ec3
mov word [esp + 2], dx
lea esp, [esp + 2]
mov eax, dword [esp + 0x1e]
mov ebx, dword [esp]
jmp 0x678e81
lea edx, [edi + edi]
pushal
xchg byte [esp + 5], dh
mov byte [esp + 0x1c], dh
mov edx, ecx
mov dword [esp + 0x1a], eax
jmp 0x678e70
xchg bl, bh
xchg dh, bl
lea ebx, [esi + 0x75]
mov dx, 0xa55d
mov ebx, eax
mov dh, byte [esp]
jmp 0x678f0d
push edx
push dword [esp + 2]
jmp 0x678e29
mov bl, 0x2c
lea ebx, [ecx*4]
lea ebx, [eax + edi]
lea esp, [esp + 1]
jmp 0x678f82
mov bl, bh
mov edx, dword [esp + 0x25]
bswap ebx
lea ebx, [ebx*4]
call fcn.00678eee
lea ebx, [edx + edx]
mov byte [esp], dh
lea ebx, [eax - 0xa9]
not bx
mov ebx, dword [esp]
setge bl
jmp 0x678ef7
call 0x678f60
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
dec esp
xchg dword [eax], edx
xchg cl, ah
adc byte [ecx + 0x60ef9c0d], bh
pushal
jmp 0x678f50
mov ebx, dword [esp + 0x2b]
lea esp, [esp + 0x34]
cmp dword [esp + 4], 0
jne 0x678e01
je 0x678f6b
push eax
call fcn.00559395
jmp 0x678fb5
push eax
jmp 0x679d65
call fcn.00679d79
add byte [eax], al
add byte [eax], al
Function at 0x67de77
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, 0x8508c3b0
xchg dword [esp + 8], eax
ror dx, cl
xchg byte [esp + 7], cl
jmp 0x67de60
not ecx
xchg ecx, eax
push word [esp + 0xd]
lea eax, [esi + edi]
pop cx
jmp 0x67de03
clc
push edx
pop edx
cld
xchg dword [esp + 0x14], edx
mov al, 0xe6
jmp 0x67de1b
mov ch, byte [esp + 9]
mov ecx, 0x310335e2
push esp
xchg byte [esp], al
pop dword [esp + 0xc]
pop cx
jmp 0x67dead
pop dword [esp + 0xe]
lea esp, [esp + 7]
bswap eax
clc
rol cl, 3
lea edx, [eax - 0x21]
jmp 0x67de40
sub esp, 0x16
not ch
pop cx
xchg dword [esp + 0x14], ecx
clc
jmp 0x67de34
xchg byte [esp], ch
pop dword [esp]
setae dh
neg ecx
xchg ch, dl
pop word [esp]
jmp 0x67dedd
rdtsc
mov dl, 0x44
mov ax, 0x1f1f
sub esp, 0x10
mov eax, 0xeea2ae0a
add esp, 0x14
jmp 0x67de85
btc ecx, edi
lea edx, [edx*4]
mov eax, 0xbe30aa8
mov ch, byte [esp + 5]
jmp 0x67def5
push dword [esp + 4]
mov word [esp + 6], di
xchg dword [esp + 4], ecx
xchg byte [esp + 2], ch
setae ch
mov edx, eax
jmp 0x67dec2
mov eax, 0xa3b76dc6
pop word [esp]
xchg dword [esp], eax
lea edx, [edx + esi]
rdtsc
jmp 0x67df68
mov ch, byte [esp]
lea edx, [edx + edi]
btc edx, esp
mov dx, 0x321d
xchg dh, al
lea edx, [edx*4]
jmp 0x67dfd1
neg cl
sets cl
mov byte [esp + 3], ch
add esp, 3
mov ecx, dword [esp]
setno ah
jmp 0x67df28
xchg dx, cx
mov cx, 0x2325
mov ecx, 0x58f34592
inc eax
xchg edx, eax
add esp, 1
jmp 0x67df4e
xchg cx, dx
lea esp, [esp]
rcl cx, cl
mov eax, 0x9f8ec78a
mov edx, eax
bswap eax
jmp 0x67e463
clc
xchg byte [esp], cl
pop cx
mov byte [esp], ch
mov ecx, 0x74eee4b6
mov cx, word [esp]
jmp 0x67df7c
cmc
mov ah, byte [esp + 1]
bt ecx, edi
mov edx, 0x168f9c32
mov word [esp], sp
mov al, ah
jmp 0x67df95
lea eax, [ebx + edi]
xchg cx, ax
xchg byte [esp], cl
btc ecx, ebx
lea edx, [edx*4]
setle cl
jmp 0x67dfae
setle cl
inc eax
lea esp, [esp + 0xd]
xchg dword [esp], ecx
add esp, 4
dec edx
jmp 0x67e057
not dx
mov ecx, eax
setp ah
lea esp, [esp + 0x13]
mov dx, 0x4f0f
btr ecx, edi
jmp 0x67e006
bsf cx, si
neg eax
xchg dx, ax
lea edx, [esi - 0x3d]
call fcn.0067e040
dec edi
retf
add esp, 0
xchg edx, eax
bswap eax
mov cx, 0x9af9
bsf dx, si
pop dx
jmp 0x67e02b
mov dx, di
sub ch, ah
push dword [esp + 8]
mov eax, 0x863d356c
rcl eax, 0x13
mov ax, bx
jmp 0x67e078
xchg word [esp + 2], dx
push word [esp + 0x13]
mov ch, bh
bswap ecx
mov ch, bh
xchg ch, dl
jmp 0x67e0a3
xchg dh, al
mov ax, 0x8ef5
sub esp, 0xc
mov al, 6
mov word [esp + 1], dx
sub esp, 0x14
jmp 0x67e289

Function at 0x67e2f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, edx
xchg byte [esp], al
setl cl
xchg dh, al
mov word [esp + 7], dx
jmp 0x67e325

Function at 0x67e52b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop cx
pop dx
setle ch
mov eax, dword [esp]
mov dl, 0x24
bsf dx, ax
jmp 0x67e4f4
rdtsc
xchg cx, dx
jmp 0x67e50d
Function at 0x67e8d2
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 3
rcr edx, 0x1b
xchg word [esp], ax
btr eax, ebx
add esp, 4
jmp 0x67e8fc
rdtsc
mov cl, 0x92
xchg dword [esp + 5], edx
neg ax
pop cx
mov al, 6
jmp 0x67e8a0
lea eax, [esi - 0x3d]
jmp 0x67e8b6
pop ecx
add al, dh
pop eax
mov ax, word [esp + 3]
lea eax, [esp + eax]
stc
jmp 0x67e972
mov ah, byte [esp]
mov ecx, eax
lea esp, [esp]
lea eax, [edi*4]
pushal
mov ecx, 0x4771a228
jmp 0x67e8d7
lea eax, [ebp*4]
inc al
pop cx
add esp, 0x1a
xchg dx, cx
jmp 0x67e95b
pop eax
not ch
push word [esp + 0x16]
mov cl, ch
mov al, 0x96
xchg edx, eax
jmp 0x67e934
bsf cx, si
pushal
sub esp, 0xe
mov dx, cx
mov dx, cx
sub esp, 4
jmp 0x67e99e
setne ch
push esp
mov al, 0x76
pop word [esp + 1]
push esp
neg ax
jmp 0x67e94b
mov dword [esp + 0xe], ecx
xchg dx, cx
xchg cx, ax
mov ch, bh
lea ecx, [ebp + 0xdf]
xchg byte [esp + 0x2c], ch
jmp 0x67edb3
rcl dx, cl
mov dl, dh
mov dword [esp + 6], ebp
mov word [esp + 0x2d], dx
push esp
not ah
jmp 0x67e983
sub esp, 0x16
inc dl
mov al, 0xc6
setbe cl
xchg dh, al
mov edx, dword [esp + 0x15]
jmp 0x67eb10
mov ecx, 0x97f05288
lea edx, [eax*4]
mov cx, dx
mov cl, ch
jmp 0x67e9d0
mov dx, 0x3e8b
pop dword [esp + 0xe]
not ah
mov dword [esp + 1], ecx
bsr ax, bp
inc dl
jmp 0x67e9e9
lea edx, [eax + edi]
rdtsc
mov word [esp + 6], dx
xchg word [esp + 6], ax
mov dl, 0x64
pop word [esp + 5]
jmp 0x67ea01
mov ecx, 0xa747f136
bswap ecx
cmc
clc
mov byte [esp + 0x16], ah
call fcn.0067ea33
aad 0x5f
iretd
mov edx, 0x632d0ba
pop dword [esp + 0xc]
lea eax, [edx + esi]
mov ch, byte [esp + 0x11]
jmp 0x67ea4a
xchg byte [esp + 0x22], cl
dec dx
mov dword [esp + 0x17], esi
pop word [esp + 0xf]
bsr cx, cx
bsr dx, bp
jmp 0x67ea68
mov cx, 0x64c3
xchg edx, ecx
bsr cx, bp
mov dword [esp + 0x1d], ecx
pop ecx
neg cx
jmp 0x67ea81
pushal
lea esp, [esp + 0x55]
lea eax, [eax*4]
sub esp, 0x1a
push esp
mov word [esp + 0xc], bx
jmp 0x67ea1b
pop cx
bswap ecx
mov ecx, eax
pop dword [esp + 0x17]
push dword [esp + 0x2b]
xchg dh, al
jmp 0x67eb75

Function at 0x67e91f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ebp*4]
add esp, 5
xor edx, esi
xchg edx, eax
mov eax, edi
jmp 0x67e88c
seto cl
call fcn.0067e782
mov dx, 0x76cf
mov al, 0xde
xchg dword [esp + 0xd], edx
push word [esp + 1]
xchg byte [esp + 2], ch
push esp
jmp 0x67e82b
rdtsc
mov cx, di
mov ch, byte [esp + 0x15]
btc eax, ebx
lea esp, [esp + 0x15]
mov cx, word [esp + 1]
jmp 0x67e7a3
xchg dx, ax
mov ecx, edi
bswap ecx
cld
mov ecx, dword [esp + 0x18]
call 0x67e815
ljmp 0x4eeb
sub ecx, eax
mov ch, bh
xchg dword [esp + 0x11], ecx
xchg edx, eax
pushal
setns ch
jmp 0x67e804
xchg dx, ax
setnp ch
lea edx, [ebp + 0x9f]
push word [esp + 9]
xchg byte [esp + 0xf], cl
lea eax, [ebx + esi]
jmp 0x67e7ed
mov dh, byte [esp + 0x15]
mov byte [esp + 4], bh
pop ecx
mov edx, ebp
mov eax, 0x2089b470
rdtsc
jmp 0x67e84f
mov dword [esp + 2], ebp
sub esp, 8
cmc
mov ax, word [esp + 0x1e]
xchg dword [esp], edx
jmp 0x67e6fe
Function at 0x67ea33
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, byte [esp + 0x27]
jmp 0x67eae0
bt eax, edi
bswap ecx
mov ax, di
bswap edx
lea ecx, [ecx + 0x739d2523]
mov dl, dh
jmp 0x67eb3d
rdtsc
bts eax, ebx
btc ecx, edi
sub ch, ah
lea esp, [esp + 1]
mov ecx, eax
jmp 0x67ea9a
lea edx, [eax*4]
rdtsc
lea esp, [esp + 0x23]
add esp, 3
neg ax
lea eax, [ebx*4]
jmp 0x67eaba
lea ecx, [ecx - 0x2b087295]
bsr cx, cx
rcl cl, 3
bswap ecx
jmp 0x67eb56
ror ax, cl
bsf ax, ax
mov eax, dword [esp]
xchg ecx, eax
mov eax, 0xdfadf9d6
lea eax, [esi - 0x734121ab]
jmp 0x67eb27
mov cl, byte [esp]
mov cx, si
inc ecx
mov ax, word [esp]
xor dl, ch
xchg ah, ch
jmp 0x67ebfb
mov ch, bh
cmp edx, ecx
mov byte [esp], bh
inc ecx
mov ch, 0x50
lea eax, [edi*4]
jmp 0x67ed0f
sub ecx, eax
mov cl, byte [esp + 1]
clc
btr ecx, esp
add esp, 1
xor ax, 0x98ac
jmp 0x67eb8f
bsr dx, cx
xchg word [esp], cx
xchg byte [esp], ch
lea esp, [esp + 1]
mov ch, 0x80
bsf dx, si
jmp 0x67ebb8
push esp
mov dx, 0x8b53
mov cx, 0x58fb
pop dx
bsf ax, ax
mov ecx, 0x555718be
jmp 0x67ebd1
mov ch, 0x38
pop word [esp + 4]
mov byte [esp + 0xb], ch
mov al, ah
bswap eax
call fcn.0067ec62
mov dl, 0xac
pop word [esp + 0x15]
cld
mov word [esp + 4], di
setns dh
jmp 0x67ecf6
xchg cx, dx
lea eax, [edi*4]
sub esp, 0x14
xchg dh, al
call fcn.0067ecdc
enter 0xffffffffffff826b, 0x3d
or al, 0xba
cmp ecx, edi
sbb ecx, dword [ebp + 0xb514]
add byte [eax], al
mov edx, 0x1bf9392e
lea edx, [esi*4]
lea eax, [ecx + 0x76a769cb]
add esp, 0
neg cl
sub esp, 0xe
jmp 0x67eca1
Function at 0x67ecdc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, 0x8acd
lea eax, [ebp*4]
jmp 0x67ed46
xchg dword [esp + 0x2d], eax
lea edx, [ebx + edi]
rdtsc
mov ecx, dword [esp + 2]
lea eax, [ebx + edi]
not cl
jmp 0x67ed90
pop ax
mov cl, byte [esp + 0xd]
btc eax, edi
mov word [esp + 4], bx
btc edx, edi
lea ecx, [edi*4]
jmp 0x67ed2e
pop word [esp + 0x1e]
xchg dword [esp + 0x23], ecx
mov cl, 0xf2
push word [esp + 0x11]
jmp 0x67edc8
xchg word [esp + 0x2a], ax
lea ecx, [ebp*4]
inc al
pop ax
push edx
jmp 0x67ed60
xchg dword [esp + 5], edx
pop dx
mov eax, dword [esp + 0x17]
lea eax, [edx + edi]
cmc
lea ecx, [edx + ebx]
jmp 0x67ed79
mov ah, byte [esp + 0x28]
bswap eax
xchg byte [esp + 0x28], dl
lea ecx, [ecx - 0x93]
push dword [esp + 0xa]
jmp 0x67efbe
shr edx, 0xd
mov edx, ecx
pushal
sete ch
xchg byte [esp + 0x30], al
xchg ecx, eax
jmp 0x67ee5a
lea edx, [esi - 0x157a3fdb]
mov eax, 0x30aa199c
not dh
lea ecx, [edx + ebx]
mov cx, 0xe9b1
sub esp, 0x18
jmp 0x67edea
sub esp, 0x12
lea esp, [esp + 0x45]
mov cl, ch
mov ax, word [esp]
mov edx, dword [esp]
lea ecx, [ebp - 0x9f]
jmp 0x67ee02
dec ecx
lea ecx, [ecx - 0x43]
mov edx, dword [esp + 0x1b]
xchg dh, al
cld
mov word [esp + 4], di
jmp 0x67ee86
mov dl, dh
pop edx
rol dx, cl
sub esp, 6
push edx
mov cx, 0x5505
jmp 0x67ee37
pop cx
rdtsc
mov cx, word [esp + 0x16]
neg cl
sbb ecx, ebp
mov dx, 0x64cd
jmp 0x67ee9b
pop dword [esp + 0x26]
pop ecx
xchg byte [esp + 0xb], al
cmc
mov ecx, 0x5a9bdd32
pop dword [esp + 0x2a]
jmp 0x67ee6a
setp ah
mov ax, word [esp + 0x18]
push word [esp + 0x13]
not edx
bswap edx
setp cl
jmp 0x67ef1a
bsf ax, ax
push word [esp + 0x10]
neg eax
mov edx, 0xfbe5bec6
mov cx, di
add ecx, ebp
jmp 0x67ee1f
pushal
push word [esp + 3]
setns ah
call fcn.0067eed3
mov edi, 0x37c4bd2d
xchg edx, eax
scasd eax, dword es:[edi]
lodsb al, byte ds:[esi]
retf
pop cx
mov al, 0x5e
mov al, ah
mov ax, word [esp + 0xa]
sub esp, 0x18
lea esp, [esp + 0x48]
jmp 0x67eefb
mov ch, byte [esp + 0x29]
rdtsc
ror ax, cl
mov cl, ch
dec edx
pop word [esp + 0x10]
jmp 0x67eeb9
rcr cx, cl
mov word [esp + 0xb], dx
lea ecx, [ecx*4]
pop edx
mov ax, 0x4b31
shr dx, cl
jmp 0x67ef47
Function at 0x40176e
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0040191e
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x40186c
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x40180f
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x401852
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x401826
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x401841
test al, 0x40
je 0x401838
mov ecx, dword [edi + 0x20]
jmp 0x40183f
test al, 0x80
je 0x401852
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x401852
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4017de
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x40f300
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47b9cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046dfa3
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40f382
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046b9ca
mov eax, dword [eax]
push 0x5b5230
push eax
call fcn.0045db64
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046e22e
test bl, bl
je 0x40f382
push 0x5b5230
lea ecx, [esp + 0xc]
call fcn.0046e60a
push 0x5b8da0
lea ecx, [esp + 0xc]
call fcn.0046e60a
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40f3be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046e22e
jmp 0x40f489
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40f442
lea edx, [esp + 0x7c]
push 0x5b8d9c
push edx
call fcn.0045db64
add esp, 8
test eax, eax
je 0x40f442
lea eax, [esp + 0x7c]
push 0x5b8d98
push eax
call fcn.0045db64
add esp, 8
test eax, eax
je 0x40f442
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40f3d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046e22e
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40fca0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40fd02
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc