joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e8880
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0xa
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CFontInstaller.0
call fcn.004dc130
push 0xa
lea ecx, [esi + 0x30]
call fcn.004dc130
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.gdi32.dll
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x5e88e5
push str.AddFontMemResourceEx
push edi
call ebx
push str.AddFontResourceExA
push edi
mov dword [esi + 4], eax
call ebx
push str.RemoveFontMemResourceEx
push edi
mov dword [esi + 0xc], eax
call ebx
push str.RemoveFontResourceExA
push edi
mov dword [esi + 8], eax
call ebx
mov dword [esi + 0x10], eax
push str.kernel32.dll
call ebp
test eax, eax
je 0x5e88fb
push str.MoveFileExA
push eax
call ebx
mov dword [esi + 0x14], eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x5e8910
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x60fc88
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 8], 0
je 0x5e896f
mov esi, dword [ebx + 0x18]
test esi, esi
lea edi, [ebx + 0x18]
je 0x5e8968
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x5e8a28
mov ecx, dword [ebx + 8]
mov eax, esi
mov eax, dword [eax + 8]
mov esi, dword [esi]
push eax
call ecx
test esi, esi
jne 0x5e8948
mov ecx, edi
call fcn.004cd340
cmp dword [ebx + 0x10], 0
je 0x5e8a15
mov edi, dword [ebx + 0x30]
test edi, edi
lea ecx, [ebx + 0x30]
mov dword [esp + 0x10], ecx
je 0x5e8a10
jmp 0x5e8990
xor eax, eax
test edi, edi
setne al
test eax, eax
je 0x5e8a28
mov eax, edi
mov eax, dword [eax + 8]
mov edi, dword [edi]
sub eax, 0x10
push eax
call fcn.00403f80
lea esi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x14], esi
mov edx, dword [ebx + 0x10]
push 0
push 0x10
push esi
mov dword [esp + 0x2c], 0
call edx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x5e89e4
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x5e89e4
push 4
push 0
push esi
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5e8a08
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
jne 0x5e8990
mov ecx, dword [esp + 0x10]
call fcn.00403ef0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push 0x80004005
call fcn.00401480
int3

Function at 0x5e8aa0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x60fcc6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CFontInstaller.0
mov dword [esp + 0x14], 1
call fcn.005e8910
lea ecx, [esi + 0x30]
call fcn.00404010
lea ecx, [esi + 0x18]
call fcn.00560500
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5e8b20
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x60fd06
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x6f1550]
xor eax, esp
mov dword [esp + 0x21c], eax
push esi
push edi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0x22c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x23c]
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x5e8c63
lea ecx, [esp + 0x10]
call fcn.005a9b22
lea eax, [esp + 0x124]
push eax
push 0x104
mov dword [esp + 0x23c], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x5e8c4f
lea ecx, [esp + 0x20]
push ecx
push 0
push str.g_font
lea edx, [esp + 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x5e8c4f
push 0
push 1
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
call fcn.005a9f9c
test eax, eax
je 0x5e8c44
mov ecx, dword [esp + 0x240]
push ecx
push edi
lea ecx, [esp + 0x18]
call fcn.005a9870
lea ecx, [esp + 0x10]
call fcn.005a9ac0
mov eax, dword [esi + 0xc]
push 0
push 0x10
lea edx, [esp + 0x28]
push edx
call eax
test eax, eax
jle 0x5e8c44
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401f00
lea edx, [esp + 0xc]
push edx
lea ecx, [esi + 0x30]
mov byte [esp + 0x238], 1
call fcn.004048b0
lea ecx, [esp + 0xc]
call fcn.00401aa0
lea ecx, [esp + 0x10]
mov dword [esp + 0x234], 0xffffffff
call fcn.005a9c2f
mov al, 1
jmp 0x5e8c65
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x234], 0xffffffff
call fcn.005a9c2f
xor al, al
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.005bf6a4
add esp, 0x22c
ret 8
Function at 0x100452a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x321e0
jmp 0x100452f1
call 0x100452a1
mov dword [esp + 0x28], eax
call 0x10045227
push 0x2247488
mov byte [esp + 2], cl
jmp 0x10045266
mov byte [esp], bh
call 0x10045250
pushfd
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esp
pushal
push word [esp + 2]
jmp 0x100452cf
lea esp, [esp + 2]
mov dword [esp + 0x3c], ebp
call 0x100452a6
pop es
mov word [edx], es
xchg esp, eax
and ebx, dword [ecx + reloc.KERNEL32.dll_FlushFileBuffers]
call 0x1004521d
mov dword [esp + 0x3c], esi
jmp 0x100452b0
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
pushfd
jmp 0x10044d5b
jae 0x10045289
lea esp, [esp + 2]
mov dword [esp + 0x3c], ebp
jmp 0x10045291
lea eax, reloc.KERNEL32.dll_FlushFileBuffers
jmp 0x1004530e
or cl, cl
sub eax, dword [edx + 0xf]
popfd
mov byte [esi - 0x171c1402], 0xcd
add eax, dword [eax]
add bl, dh
jge 0x100452ed
setge dh
xchg dh, bh
jmp 0x100452db
call 0x100456ca
jge 0x100452ed
je 0x10045289
cmp eax, ebx
dec esi
fdivr qword [ebx - 0x59a01aaa]
rcl dword [eax - 0x2d]
mov edi, dword [esp + 0x2c]
setnp dh
mov ax, di
cmc
jb 0x100452f8
not dx
jmp 0x10045328
lea esi, [esp]
lea ecx, [esp + 0x17]
rol dh, cl
jmp 0x1004535a
sub esp, 0xbc
jmp 0x10045365
jno 0x10045382
sub esp, 6
lea esp, [esp + 2]
jmp 0x10045389
mov ebp, esp
bts bx, sp
ja 0x100453a1
mov ch, cl
jmp 0x1004538b
sub esp, 6
lea esp, [esp + 2]
jmp 0x10045344
mov ecx, edi
mov ax, 0xf397
sub esp, 0x11
jle 0x100453bb
pop word [esp]
jmp 0x100453d7
mov ch, cl
jmp 0x1004538b
xchg byte [esp + 8], dh
lea esp, [esp + 3]
mov bx, ax
mov ah, byte [esp]
push di
jmp 0x100454f3
pop word [esp]
jmp 0x100453a5
mov ah, byte [esp]
jmp 0x100453b3
xchg byte [esp + 8], dh
lea esp, [esp + 3]
mov bx, ax
jmp 0x100453c1
lea edx, [ebx + ebx]
lea ebx, [ebp + ebp]
call fcn.10045418
push esi
rol dword [ebx + 0x26], cl
aad 0x63
salc
inc ecx
ret
lea esp, [esp + 1]
jmp 0x10045484
lea edx, [ebx + ebx]
lea ebx, [ebp + ebp]
jmp 0x10045403
mov byte [esp], dh
lea esp, [esp + 1]
sub edi, 0x6a0e2f01
sub esp, 0x1b
jb 0x100453fc
jae 0x10045444
lea esp, [esp + 1]
neg bx
jle 0x1004547d
mov byte [esp], dh
jmp 0x10045412
Function at 0x100452a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x321e0
jmp 0x100452f1
call 0x100452a1
mov dword [esp + 0x28], eax
call 0x10045227
push 0x2247488
mov byte [esp + 2], cl
jmp 0x10045266
mov byte [esp], bh
call 0x10045250
pushfd
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esp
pushal
push word [esp + 2]
jmp 0x100452cf
lea esp, [esp + 2]
mov dword [esp + 0x3c], ebp
call 0x100452a6
pop es
mov word [edx], es
xchg esp, eax
and ebx, dword [ecx + reloc.KERNEL32.dll_FlushFileBuffers]
call 0x1004521d
mov dword [esp + 0x3c], esi
jmp 0x100452b0
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
pushfd
jmp 0x10044d5b
jae 0x10045289
lea esp, [esp + 2]
mov dword [esp + 0x3c], ebp
jmp 0x10045291
lea eax, reloc.KERNEL32.dll_FlushFileBuffers
jmp 0x1004530e
or cl, cl
sub eax, dword [edx + 0xf]
popfd
mov byte [esi - 0x171c1402], 0xcd
add eax, dword [eax]
add bl, dh
jge 0x100452ed
setge dh
xchg dh, bh
jmp 0x100452db
call 0x100456ca
jge 0x100452ed
je 0x10045289
cmp eax, ebx
dec esi
fdivr qword [ebx - 0x59a01aaa]
rcl dword [eax - 0x2d]
mov edi, dword [esp + 0x2c]
setnp dh
mov ax, di
cmc
jb 0x100452f8
not dx
jmp 0x10045328
lea esi, [esp]
lea ecx, [esp + 0x17]
rol dh, cl
jmp 0x1004535a
sub esp, 0xbc
jmp 0x10045365
jno 0x10045382
sub esp, 6
lea esp, [esp + 2]
jmp 0x10045389
mov ebp, esp
bts bx, sp
ja 0x100453a1
mov ch, cl
jmp 0x1004538b
sub esp, 6
lea esp, [esp + 2]
jmp 0x10045344
mov ecx, edi
mov ax, 0xf397
sub esp, 0x11
jle 0x100453bb
pop word [esp]
jmp 0x100453d7
mov ch, cl
jmp 0x1004538b
xchg byte [esp + 8], dh
lea esp, [esp + 3]
mov bx, ax
mov ah, byte [esp]
push di
jmp 0x100454f3
pop word [esp]
jmp 0x100453a5
mov ah, byte [esp]
jmp 0x100453b3
xchg byte [esp + 8], dh
lea esp, [esp + 3]
mov bx, ax
jmp 0x100453c1
lea edx, [ebx + ebx]
lea ebx, [ebp + ebp]
call fcn.10045418
push esi
rol dword [ebx + 0x26], cl
aad 0x63
salc
inc ecx
ret
lea esp, [esp + 1]
jmp 0x10045484
lea edx, [ebx + ebx]
lea ebx, [ebp + ebp]
jmp 0x10045403
mov byte [esp], dh
lea esp, [esp + 1]
sub edi, 0x6a0e2f01
sub esp, 0x1b
jb 0x100453fc
jae 0x10045444
lea esp, [esp + 1]
neg bx
jle 0x1004547d
mov byte [esp], dh
jmp 0x10045412

Function at 0x10045418
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x1004542e
dec edi
aad 0x45
sub al, 0xdf
push 0xb3d446df
dec esi
cld
ja 0x10045489
test eax, 0x648d6bc8
and al, 3
jmp 0x10045463
inc ax
mov bh, dl
mov dh, 0xe3
mov edx, 0x2caf5d07
jmp 0x100454d2
lea esp, [esp + 0x20]
sub edi, 0x328fae78
shr ebx, 0x1b
jbe 0x1004544d
ja 0x100454b4
dec ebx
salc
inc esp
and ebx, esi
outsd dx, dword [esi]
invalid
push 0xffffffffffffff83
in al, dx
sbb ecx, dword [edi]
sub byte [ecx - 1], 0xff
push dword [ebx - 0x51]
inc ax
mov bh, dl
mov dh, 0xe3
jmp fcn.10045495
mov edx, 0xb46f4cf2
Function at 0x1004542e
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x1004542e
dec edi
aad 0x45
sub al, 0xdf
push 0xb3d446df
dec esi
cld
ja 0x10045489
test eax, 0x648d6bc8
and al, 3
jmp 0x10045463
inc ax
mov bh, dl
mov dh, 0xe3
mov edx, 0x2caf5d07
jmp 0x100454d2
lea esp, [esp + 0x20]
sub edi, 0x328fae78
shr ebx, 0x1b
jbe 0x1004544d
ja 0x100454b4
dec ebx
salc
inc esp
and ebx, esi
outsd dx, dword [esi]
invalid
push 0xffffffffffffff83
in al, dx
sbb ecx, dword [edi]
sub byte [ecx - 1], 0xff
push dword [ebx - 0x51]
inc ax
mov bh, dl
mov dh, 0xe3
jmp fcn.10045495
mov edx, 0xb46f4cf2

Function at 0x10047638
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x100476a0
jmp 0x10047689
sub esp, 0xbc
mov esi, esp
xchg ebx, eax
push edi
jmp 0x10047673
mov byte [esp + 1], cl
rdtsc
jmp 0x1004763c
mov ebp, esp
lea ebp, [esp + 4]
mov dx, cx
neg ax
jne 0x1004763a
rdtsc
jmp 0x1004763c

Function at 0x1010d12c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, cx
bsf ax, bx
xchg byte [esp + 3], bh
mov ebp, dword [esp + 3]
jmp 0x1010d12e
jmp 0x1010d116
xchg word [esp + 2], cx
mov dword [esp], esi
mov ebp, esi
mov edx, 0xab07a06
xchg ah, al
push cx
jmp 0x1010d165

Function at 0x1010d28e
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg si, ax
add esp, 0
jmp 0x1010ecee
lea esp, [esp + 2]
bswap ecx
xchg byte [esp], bh
bswap edx
bswap ebp
mov bl, byte [esp]
jmp 0x1010d386
xchg dh, dl
pop cx
std
mov edi, dword [esp + 1]
xchg byte [esp + 2], dh
lea esp, [esp + 2]
jmp 0x1010d341
bswap esi
xchg ebp, edx
mov edx, 0x99e77e6f
xchg bl, ch
mov esi, dword [esp]
std
jmp 0x1010d43c
add esp, 0
mov dx, 0x1beb
mov byte [esp], bh
mov cl, byte [esp]
mov di, bx
lea esp, [esp]
jmp 0x1010d370
cpuid
cmp bh, al
std
mov edx, dword [esp]
not si
bswap ecx
jmp 0x1010d3ae
xchg dx, bp
mov byte [esp], cl
bswap edi
mov cx, 0xd4f7
call 0x1010d3ef
lea ebx, [edi + ebp*2]
jbe 0x1010d425
inc ebp
mov ch, bl
std
lea ebx, [edi*4]
xchg byte [esp], dh
mov ebp, 0x54e5a46e
jmp 0x1010d39b
add byte [eax], al
add byte [esi - 0x77], ah
cmp al, 0x24
bts edi, ecx
clc
rdtsc
jmp 0x1010d548
setns dl
btr si, si
mov dl, byte [esp]
rol ah, cl
std
mov ax, 0x1010
jmp 0x1010d3c4
mov edx, edi
call fcn.1010d499
mov ecx, 0x36dbbc2e
lahf
test eax, 0x45b6d343
lock xchg byte [ecx], dh
xor byte [ebp + 0x9d0c], cl
add byte [eax], al
lea ecx, [ebx*4]
rdtsc
lea ecx, [edi*4]
mov si, 0x21d
xchg ah, bl
setg bh
jmp 0x1010d452
mov byte [esp], bh
lea ebp, [ebx + esi]
add esp, 1
clc
rcr ebx, 1
cpuid
jmp 0x1010d468
shr bp, 1
mov bx, 0x2844
mov byte [esp], bl
xchg byte [esp], cl
cpuid
mov di, word [esp]
jmp 0x1010d4bd
push word [esp + 1]
lea esp, [esp + 3]
btc ax, si
xchg byte [esp], bl
dec si
cmc
jmp 0x1010d4ec
bswap esi
rdtsc
mov cx, 0x17e0
push word [esp + 1]
lea ebx, [ecx + edi]
neg ebp
jmp 0x1010d35d
mov eax, esi
mov dx, bp
rdtsc
bswap eax
mov dl, 0xd7
mov edi, 0x40ff1068
jmp 0x1010d5b8
cld
bswap ecx
mov ecx, dword [esp + 8]
mov bh, byte [esp + 2]
add esp, 7
lea ebx, [esp + 0xf1]
jmp 0x1010d91d
Function at 0x1010d76e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, ebp
pop dword [esp + 0xb]
mov dword [esp + 0x11], ecx
rdtsc
mov ah, byte [esp]
jmp 0x1010d752
stc
setns ah
clc
xchg cx, ax
xchg byte [esp + 1], ch
btc bx, di
jmp 0x1010d715
mov bh, 0xec
mov dword [esp + 0xf], esp
xchg dword [esp + 0x18], ebp
bsf ebp, eax
setle dl
jmp 0x1010d7e4
push dword [esp + 4]
mov di, bx
setg bl
xchg byte [esp + 0xd], bh
push si
mov ebp, dword [esp + 9]
jmp 0x1010d73c
bswap ecx
cmp ebx, 0xcafdfd3c
setae dh
jmp 0x1010d72b
pop word [esp + 0x12]
xchg dword [esp + 8], ebp
mov bp, word [esp + 0x12]
jmp 0x1010d7b9
rdtsc
popal
clc
pop bp
mov word [esp + 0xa], si
mov edx, 0x8efeedec
jmp 0x1010d77b
cpuid
not eax
xchg dl, al
mov ah, byte [esp + 0xe]
mov byte [esp + 0xa], bh
jmp 0x1010d80b
mov ebx, dword [esp + 0xa]
pop word [esp + 8]
lea eax, [ecx*4]
mov bp, word [esp + 0x10]
inc edx
bswap ebx
jmp 0x1010d7a3
dec ch
rcr dl, 2
sub esp, 0x16
mov cx, 0x8913
cld
cpuid
jmp 0x1010d791
mov cx, word [esp + 4]
lea esp, [esp + 1]
mov ebx, edx
mov di, dx
jmp 0x1010d81e
lea esi, [ebx + edi]
rdtsc
mov si, bx
lea esp, [esp + 0xe]
cpuid
mov ecx, dword [esp]
jmp 0x1010d7f5
sub esp, 0x14
inc cx
mov dh, 0x97
lea ebx, [esi*4]
push esi
mov word [esp + 3], bp
jmp 0x1010d872
push dword [esp + 0xa]
rdtsc
push dword [esp + 0x14]
xchg dword [esp + 0x13], esi
bswap ecx
popal
jmp 0x1010d844
xchg dx, ax
mov si, word [esp + 3]
xchg word [esp + 0x15], ax
xchg cx, di
bsr ebx, eax
mov dx, 0x52cd
jmp 0x1010d85a

Function at 0x1010da58
Capabilities:
Execute anti-debugging instructions

Disassembly:
std
xchg byte [esp], bh
jmp 0x1010da62
add esp, 4
xchg dh, dl
xchg dx, ax
xchg word [esp + 1], dx
lea edi, [ebx*4]
or ecx, 0x81254208
jmp 0x1010db1f
inc dx
mov dx, 0x19a4
btc di, sp
bt bx, cx
mov esi, eax
push word [esp]
jmp 0x1010dae7
bsf di, sp
mov byte [esp], ah
inc bp
mov word [esp], bx
bsr edi, ebp
lea esp, [esp + 1]
jmp 0x1010da94
add esp, 0
ror ebp, 7
add esp, 2
bsr edx, edx
dec si
mov edx, dword [esp]
jmp 0x1010dafc
mov dword [esp], ecx
mov word [esp + 1], dx
lea esp, [esp + 1]
mov bh, al
push si
xchg byte [esp], al
jmp 0x1010dad0
mov dh, byte [esp + 2]
mov ch, byte [esp + 1]
setp bl
not bl
lea ecx, [ecx*4]
xchg word [esp], bx
jmp 0x1010db57
lea edi, [ecx*4]
lea edx, [esi*4]
pop word [esp]
xchg di, dx
mov edi, dword [esp + 4]
lea esp, [esp + 2]
jmp 0x1010daba
mov dword [esp + 6], esp
btc ax, ax
cmp ebp, 0xf0898cf2
jmp 0x1010ea1d
xchg ebp, eax
rdtsc
inc cl
sub esp, 0x1c
mov dword [esp + 5], esi
lea eax, [esi*4]
jmp 0x1010db41
mov ebp, 0x8d35a23c
call fcn.1010dba8
clc
rdtsc
mov dh, 0x84
shl dx, 4
rdtsc
lea esp, [esp]
call 0x1010dc0d
sub ebx, ebp
cmp al, 0x53
retf 0x3f58
mov al, byte [esp + 1]
xchg ebx, eax
setge dh
stc
lea ebp, [eax*4]
not cl
jmp 0x1010dbef
lea ebp, [esi + ebp]
cld
bswap ebx
rdtsc
sub esp, 1
add esp, 0
jmp 0x1010dc6d
rcr dh, 0
mov ebp, 0x75df6346
lea ebp, [ebx - 0x5a]
not bl
neg dx
rcl ebp, 0x19
jmp 0x1010dca6
bswap edx
setne bl
xchg esi, edi
mov cl, 0xf1
mov esi, 0xdd3441f4
bsf ebp, esi
jmp 0x1010ddbc
mov word [esp + 0x10], dx
mov esi, edi
add esp, 0x1d
add esp, 1
mov si, word [esp]
cld
jmp 0x1010df0d
Function at 0x1010dcf7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx*4]
lea ebx, [eax + ecx]
inc dl
xchg byte [esp + 1], dh
std
mov di, sp
jmp 0x1010dd1a
neg bp
mov bp, word [esp + 0x21]
add esp, 0x21
jmp 0x1010dcd6
mov al, bh
sete al
mov ebx, 0xee4c4024
mov al, byte [esp]
jmp 0x1010dd30
btc ebp, ebx
xor edi, esi
xchg word [esp], bx
xchg word [esp], bx
lea esp, [esp + 2]
rcr cx, cl
jmp 0x1010dd04
lea eax, reloc.KERNEL32.dll_FlushFileBuffers
xchg dx, di
mov ebx, eax
mov ah, byte [esp]
bswap esi
mov cx, si
jmp 0x1010dd82
rdtsc
mov cx, word [esp]
mov byte [esp], dl
std
std
lea ebp, reloc.KERNEL32.dll_FlushFileBuffers
jmp 0x1010dd98
xchg bx, ax
lea ecx, [edi*4]
rdtsc
btr bx, dx
rdtsc
mov byte [esp], al
jmp 0x1010dd5a
xchg bh, cl
sub esp, 0x10
pop ax
lea eax, [esi + 0x82]
xchg dl, bh
xchg byte [esp + 0xc], al
jmp 0x1010decb
mov al, dl
push dword [esp + 2]
mov di, word [esp + 5]
mov ecx, edx
lea ebx, [eax + edi]
mov word [esp + 6], ax
jmp 0x1010de10
rdtsc
pop eax
lea eax, reloc.KERNEL32.dll_FlushFileBuffers
mov di, bx
cmc
mov cl, byte [esp + 1]
jmp 0x1010ddd4
xchg byte [esp + 4], dh
mov dh, byte [esp + 1]
rdtsc
cpuid
pop ecx
mov byte [esp + 1], ch
jmp 0x1010de3e
rdtsc
btr ecx, esi
mov word [esp + 3], si
lea edi, [ecx + ebp]
lea esp, [esp + 2]
mov cl, 8
jmp 0x1010ddfd
xchg byte [esp + 2], bh
cmc
btc edx, esi
xchg word [esp + 1], bx
pushal
mov ch, byte [esp + 7]
jmp 0x1010de8a
mov dword [esp + 2], edx
bsr bx, bx
btc ebp, edx
lea eax, [esi + ebp]
inc cl
lea ebp, [ecx*4]
jmp 0x1010de29
bswap ebx
xchg word [esp + 0x19], di
neg ah
bsr si, cx
not bx
jmp 0x1010dea7
neg cl
mov ebp, dword [esp + 0x20]
pop dword [esp + 9]
cmp ecx, 0xda909e6b
lea edx, [ebp*4]
mov dword [esp + 5], ebp
jmp 0x1010de72
bsr eax, eax
xchg dh, bh
add esp, 0x1d
not dl
mov bp, word [esp + 3]
sub esp, 5
jmp 0x1010dee2
pop edi
lea ebx, [eax - 0xae]
mov si, 0x28a3
bswap ebx
mov esi, eax
bsr edx, ecx
jmp 0x1010de59
not ax
lea esp, [esp]
lea ebx, reloc.KERNEL32.dll_FlushFileBuffers
not eax
xchg word [esp + 5], ax
pop word [esp]
jmp 0x1010e013
rdtsc
lea esp, [esp + 3]
lea esp, [esp + 0x28]
popal
call fcn.1010df5a
jmp 0x1010dfdf
lea esp, [esp + 6]
pushal
push word [esp + 5]
push dword [esp + 1]
jmp 0x1010dff5
pushal
push dx
pop dword [esp + 1]
push dword [esp + 0x18]
mov word [esp + 0x1e], sp
mov byte [esp + 0xf], dl
jmp 0x1010dfc9
lea esp, [esp + 0x42]
call fcn.1010e382
aad 0x54
retf 0x5cad
bsf eax, edx
sete bl
mov cx, 0x296e
inc bx
pushal
push dword [esp + 0xd]
jmp 0x1010df92
Function at 0x101108f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, reloc.KERNEL32.dll_FlushFileBuffers
xchg edx, ebx
lea ecx, reloc.KERNEL32.dll_FlushFileBuffers
jmp 0x1011098f
mov bp, 0x954c
mov ebp, 0xe4dec3c7
jmp 0x101108dd
xchg byte [esp], al
mov bh, 0x45
add esp, 0
mov eax, 0x5851985b
xchg ebp, ebx
jmp 0x1011093e
cpuid
setg dh
pop word [esp]
lea esp, [esp]
rcr ecx, cl
mov di, word [esp]
jmp 0x101108fe
xchg word [esp], cx
xchg byte [esp], dh
sub esp, 0x16
pop word [esp + 8]
jmp 0x1011096a
lea edi, [ebx*4]
lea esp, [esp]
mov byte [esp], ah
rdtsc
mov byte [esp], dl
rcr bh, cl
jmp 0x10110928
mov word [esp + 1], bp
mov bl, byte [esp + 3]
xchg esi, ebp
push bp
lea ecx, [esi + edi]
jmp 0x101109ae
xchg bp, si
dec dx
mov dword [esp + 3], ecx
lea edx, [esi - 0x9d]
xchg cl, ch
pushfd
jmp 0x10110954
mov cx, 0xdbf1
mov esi, 0x172ffe04
xchg word [esp], cx
mov bp, 0x8f67
lea esi, [ecx*4]
not al
jmp 0x10110914
xchg word [esp + 6], di
xchg word [esp + 0x11], cx
mov eax, dword [esp + 0x1a]
mov eax, dword [esp + 0xf]
jmp 0x101109ed
xchg si, bp
pop ecx
Function at 0x1011309c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 2]
lea esi, [edx*4]
mov ch, byte [esp + 3]
jmp 0x101130b4
jmp 0x10113086
rdtsc
not dx
lea esp, [esp]
mov ebp, 0x5c943cda
jmp 0x101134db
neg dl
xchg dword [esp + 3], edx
ror dx, 0xd
bswap eax
mov dword [esp + 3], ecx
stc
jmp 0x1011309e
push word [esp + 1]
mov byte [esp], bl
std
bsr eax, eax
xchg si, bp
lea ebx, [ecx*4]
jmp 0x101130e3
xchg byte [esp + 1], cl
inc bl
push word [esp + 1]
lea esp, [esp + 4]
xchg ecx, esi
xchg word [esp], bp
jmp 0x101130fb
mov dword [esp], ecx
lea ebp, reloc.KERNEL32.dll_FlushFileBuffers
std
mov edx, esi
lea eax, [edx + esi]
mov edi, 0x19a329f9
jmp 0x10113128
ror eax, cl
mov dx, cx
pop eax
cpuid
sbb cx, di
lea ecx, [edx*4]
jmp 0x10113260
mov word [esp + 1], sp
mov ebx, dword [esp + 2]
xchg edx, ecx
rdtsc
not edx
not bl
jmp 0x101133f9

Function at 0x101132fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0x13]
pushfd
add esp, 0x23
lea eax, [esp + edx]
pushfd
mov dh, al
jmp 0x10113309
std
mov si, sp
lea ecx, reloc.KERNEL32.dll_FlushFileBuffers
jmp 0x101132e6
lea esp, [esp + 2]
pop bx
xchg dword [esp + 0x12], edi
setge dh
xchg word [esp + 0x10], di
add esp, 0xb
jmp 0x10113337
Function at 0x10113b6d
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [esp], ebx
pop word [esp]
mov byte [esp], dh
jmp 0x10113b57

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40122c
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 8
mov eax, 0x40f33d
call fcn.0040e153
mov dword [ebp - 4], 1
xor ebx, ebx
lea esi, [ebp + 8]
mov dword [ebp - 0x10], ebx
call fcn.00402e50
push ebx
push 0x80
push 2
push ebx
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40128b
xor edi, edi
lea esi, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.00402470
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 0x2c]
call fcn.00402470
mov eax, edi
call fcn.0040e1f2
ret
lea esi, [ebp + 0x2c]
call fcn.00402e50
push eax
movzx eax, word [ebp + 0x28]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
inc edi
jmp 0x40126c