joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6be3e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x6be446
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x6be446
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x6be427
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x6c1340
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x119ef1c]
xor edx, edx
cmp eax, edx
jne 0x6c1366
xor eax, eax
mov byte [eax + 0x119ee1c], al
inc eax
cmp eax, 0x100
jl 0x6c134e
mov dword [0x119ef1c], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x119ee1c
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x6c13f7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x6c13ca
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x6c1398
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x6c1470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x6c14c3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x6c14aa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6c7e40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x704e9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.006c8760
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x1112f6c
call fcn.006f00ff
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x6c7ed3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.006f00ff
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x6c7ecc
push 0
mov ecx, eax
call fcn.006bef70
mov dword [esi + 0xc], eax
jmp 0x6c7ed5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x6c7ed5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x6f1204
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.006fb5cd
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x6f1235
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.006f1248
pop edi
pop esi
pop ebx
ret 8

Function at 0x6f281c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x6f2854
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.006f0865
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.006f083d
jmp 0x6f2860
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x6f410d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x6f414f
call fcn.006fb5cd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x6f414f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x6f4146
xor eax, eax
jmp 0x6f4157
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.006f415d
pop edi
pop esi
pop ebx
ret 4
Function at 0x6fbafd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x6fbb2b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x6fbb49
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.006fba63
jmp 0x6fbb49
mov eax, dword [esi + 0x14]
test eax, eax
je 0x6fbb49
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.006fba63
test edi, edi
mov eax, edi
jne 0x6fbb33
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1382ef2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
bswap esi
xor edi, esi
lea ebp, [esp + 0x34]
pop ebx
xadd bx, dx
add esp, 0x30
jae 0x1382f34
sub esp, 0xc0
cmp di, 0xb483
mov edi, esp
bsf ebx, ecx
mov ebx, esi
btc dx, 6
dec dl
add esi, dword [ebp]
btr bp, ax
pushfd
jmp 0x1383ed3
mov dword [esp + 0x40], ecx
lea esi, [edi*2 - 0x5bd70906]
btc si, cx
push dword [0x1382e5e]
pop dword [esp + 0x3c]
cmc
rol di, cl
mov dword [esp + 0x38], 0
clc
pop ebx
not bh
mov esi, dword [esp + 0x64]
ror di, 1
rol di, cl
rol esi, 0x1c
not di
rol bp, 4
add esi, 0x9b6091ca
add ebp, 0x21b482dd
jmp 0x1382c1b
Function at 0x1390c5e
Capabilities:
Hash data with md5

Disassembly:
inc byte [ecx]
jns 0x1390c3b
test byte [eax], bl
xchg ecx, eax
rol dword [esi + 0xbc8c1eb], cl
jae 0x1390c7a
jb 0x1390c7a
popal
nop
lodsb al, byte [esi]
mov ch, 0x25
dec esp
mov edi, 0xe981eee
imul ebx, dword [eax - 0x1b890ee1], 0x79f97e83
stc
imul esp, dword [eax + 0x70], 0xb217eb19
aad 0x24
dec edi
inc eax
rcl byte [esi + 0x31], 0xc0
cld
xchg edx, eax
adc dword [ecx - 0x58bdec20], eax
daa
mov bh, 0xd2
pushal
jo 0x1390c96
jmp 0x1390c96
and dword [eax + 0x7dc2c764], ebp
cmp al, 0xef
aaa
mov edx, 0x37ef3c7d
jle 0x1390cb2
jg 0x1390cb2
stosd dword es:[edi], eax
lodsb al, byte [esi]
sub eax, 0x5e37c4bd
push ecx
xlatb
inc edi
and dl, cl
jecxz 0x1390c2f
add byte [esi + 0xf6000f1], dl
mov edx, gs
fadd qword [esi]
add byte [edi], cl
invalid
pushal
jl 0x13fe9a3
jge 0x13fe9a3
call 0x6bd9052e
cmp esi, dword [esi*4 - 0x2940b3db]
xchg edi, eax
adc eax, 0x211fec85
jle 0xc6cf87f3
pop dword [ebx - 0x5c]
jnp 0x1390c93
scasb al, byte es:[edi]
call fcn.01390c5e
mov bh, byte [esp + 8]
Function at 0x1390f15
Capabilities:
Check for software breakpoints

Disassembly:
js 0x14001ce
jns 0x14001ce
outsb dx, byte [esi]
xor dh, byte [eax - 0x1e4fbeda]
div dword [edx + ebp*8 - 0x73]
jl 0x1390f45
cmp al, 0xbc
push edx
call fcn.0139df6d
int3
invalid
movzx eax, byte [eax]
movzx ecx, byte [ecx]
sub esp, 8
add esp, 3
push word [esp + 4]
push esi
stc
pop dword [esp]
push word [esp + 4]
mov word [esp + 3], bp
lea esp, [esp + 1]
sub eax, ecx
pushal
lea esp, [esp + 9]
push dword [esp + 0x13]
push word [esp + 3]
pushfd
push dword [esp + 4]
pushal
lea esp, [esp + 0x18]
lea esp, [esp + 1]
lea esp, [esp + 0x34]
leave
ret
pushal
mov bl, byte [esp]
bswap bp
popal
pushfd
pop word [esp]
push word [esp]
lea esp, [esp + 2]
pushal
pop dword [esp + 0x15]
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
lea esp, [esp + 4]
pushal
mov cx, word [esp]
mov cx, 0x34f
jg 0x1400276
jle 0x1400276
and ah, byte [ecx - 0xd5cafcf]
and ebp, dword [ebx + 0x2cad5e3b]
push esi
xlatb
inc edi
and dl, cl
pop eax
int3
pushal
mov ecx, 0x1c2a1cb8
je 0x1400319
jne 0x1400319
add byte [eax], al
add byte [ebx + edi*8 + 0x6b], dh
push cs
std
je 0x1400250
imul ecx, dword [esi], 0xfffffffd
test al, 0x1f
or dword [edi], edx
cmp al, 0xcc
dec dword [ebp - 4]
mov edx, dword [ebp - 4]
jne 0x1400407
jmp 0x140017f
popal
pushal
push word [esp + 0x11]
lea esp, [esp + 0x1f]
mov word [esp], ax
lea esp, [esp + 1]
je 0x14002b9
jne 0x14002b9
cmpsd dword es:[esi], dword es:[edi]
aaa
push edx
mov eax, dword [0x67f77328]
add dh, cl
scasb al, byte es:[edi]
mov ecx, dword [eax]
sahf
stc
or byte [ebx - 0x60], ah
ljmp 0x8802
mov al, byte [edx]
mov byte [ecx], al
inc ecx
inc edx
jmp 0x14002d9
mov byte [esp], bl
mov word [esp], dx
jmp 0x1400371
mov eax, dword [esp + 8]
dec dword [esp + 8]
test eax, eax
jne 0x14002a4
mov eax, esi
pop esi
ret
mov cx, 0x6a87
popal
pushfd
mov dword [esp], esp
lea esp, [esp]
pushal
lea esp, [esp + 8]
push word [esp + 5]
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
push esi
mov esi, ecx
jmp 0x14002d9
mov word [esp], bp
pushal
mov dword [esp + 0x11], ecx
pop word [esp + 0x10]
lea esp, [esp + 0x20]
jmp 0x1400240
mov dl, byte [eax]
stc
pushal
push word [esp + 4]
lea esp, [esp + 5]
sub esp, 0x1e
mov word [esp + 0x2b], cx
cmc
mov dword [esp + 0x2c], esp
push dword [esp + 0x20]
lea esp, [esp + 3]
lea esp, [esp + 0x3c]
cmp dl, byte [ecx]
jne 0x140017f
inc eax
inc ecx
jmp 0x140025e
Function at 0x13f0998
Capabilities:
Hash data with md5

Disassembly:
pushal
pushfd
setne bl
mov byte [esp + 2], bl
lea esp, [esp + 4]
popal
pushfd
mov byte [esp], dh
push word [esp + 3]
push word [esp + 2]
jl 0x13f0a24
jmp 0x13f0a24
mov dword [esp + 3], esi
push word [esp + 5]
jmp 0x13f0cf4
mov word [esp + 6], sp
pushal
mov dword [esp + 0x16], ebp
mov dword [esp + 0xb], ebx
pop dword [esp + 0x16]
lea esp, [esp + 2]
lea esp, [esp + 0x24]
pushal
not ecx
mov dx, 0x7c40
mov dx, cx
popal
push ebp
push bp
mov byte [esp + 1], cl
mov byte [esp], cl
pop word [esp + 1]
mov dword [esp], eax
lea esp, [esp + 4]
jmp fcn.01390c59
Function at 0x13f36d9
Capabilities:
Hash data with md5

Disassembly:
pushal
xchg di, bp
mov bh, 0xe0
pushal
lea esp, [esp + 0x20]
popal
pushal
jne 0x13f3753
je 0x13f3753
aad 0x54
retf 0x5cad
push dword [esp]
pop word [esp + 0xa]
push word [esp + 4]
lea esp, [esp + 7]
push word [esp + 0x17]
js 0x13f3883
jns 0x13f3883
lahf
and esi, dword [ebx + 0x347225d6]
mov ch, 0x25
dec esp
mov edi, 0x605711d6
pushal
push word [esp + 5]
pop dword [esp + 2]
mov word [esp + 0x16], cx
push dword [esp + 3]
push dword [esp + 0x10]
push dword [esp + 0x21]
mov word [esp + 2], bp
lea esp, [esp + 0x1a]
lea esp, [esp + 3]
lea esp, [esp + 0xc]
pushal
mov bh, dl
mov dh, 0x77
mov edx, dword [esp]
popal
pushal
push word [esp + 0x12]
push dword [esp]
mov word [esp + 0x1d], ax
mov word [esp + 0x12], si
mov dword [esp + 0x11], ebp
pushal
pop word [esp + 1]
mov byte [esp + 0x23], cl
lea esp, [esp + 0x44]
jmp fcn.01390c59

Function at 0x13f37f5
Capabilities:
Check for software breakpoints
Hash data with md5

Disassembly:
pushal
mov ecx, 0x26d352d9
popal
pushal
push esi
push dword [esp + 0x13]
push word [esp + 5]
mov word [esp + 0xf], dx
push dword [esp + 0x17]
mov byte [esp + 8], ch
jns 0x13f3833
jmp 0x13f3833
pushfd
push bx
push ebx
pop word [esp + 0xc]
lea esp, [esp + 0xf]
lea esp, [esp + 0x20]
lea esp, [esp + 3]
lea esp, [esp + 4]
pushal
xchg edi, ecx
popal
push eax
push dword [esp]
mov byte [esp], cl
lea esp, [esp + 4]
push dword [esp + 3]
push word [esp + 1]
pop dword [esp]
pushfd
jo 0x13f38e2
jno 0x13f38e2
jl 0x13f386c
insb byte es:[edi], dx
or eax, dword [esi]
push edi
mov al, byte [0x23d0b121]
dec edx
push esi
salc
inc esp
and ebx, esi
loop 0x13f38c6
sti
sub ebp, ebp
daa
lea esp, [esp + 2]
lea esp, [esp + 8]
jmp 0x1390f10

Function at 0x13f3904
Capabilities:
Encode data using xor

Disassembly:
call fcn.013915bb
jmp 0x1391640

Function at 0x13f3c48
Capabilities:
Check for software breakpoints

Disassembly:
pushal
not dl
xchg bx, dx
jb 0x13f3cc6
jae 0x13f3cc6
aaa
mov al, 0x26
inc ecx
mov al, 0x37
inc edi
retf
pop word [esp + 0xd]
lea esp, [esp + 0x1c]
pushal
mov bl, 0xaa
mov al, byte [esp]
mov cx, 0x1f69
setl bh
push edi
mov dh, 3
xchg dword [esp], edi
lea esp, [esp + 4]
popal
pushfd
mov dword [esp], ebp
push dx
pop word [esp]
pop word [esp]
mov byte [esp], al
push word [esp + 1]
lea esp, [esp + 4]
jmp fcn.01390d25
xchg bp, dx
jl 0x13f5bd1
jge 0x13f5bd1
xor al, 0xb6
and al, 0x43
mov esi, 0x950584ef
cld
pcmpgtd mm7, mm0
sbb eax, 0x448f6654
and al, 5
pop dword [esp]
mov word [esp + 0xb], bp
mov word [esp + 0x1a], bp
jge 0x13f3c67
jl 0x13f3c67
cmpsb byte es:[esi], byte es:[edi]
xor al, 0x53
scasb al, byte es:[edi]
xchg edx, eax
fstp qword [edx + esi*8 - 0x6b]
aaa
mov al, 0xec
Function at 0x13fcb09
Capabilities:
Encrypt data using aes

Disassembly:
pushal
mov ch, 0xe
lea ebp, [0x330934bf]
mov edx, esi
mov ah, byte [esp]
jae 0x13fcb70
jmp 0x13fcb70
lea esp, [esp + 0x15]
je 0x13fd20c
jne 0x13fd20c
pop ecx
fimul dword [eax + 0x2f]
fidiv dword [ecx + 0x443dad2f]
mov bh, 0x89
xor al, 0x7c
popal
pushal
pop word [esp]
mov word [esp + 0xd], bx
push dword [esp + 0x11]
jp 0x13fcb52
jnp 0x13fcb52
mov ch, 0x34
stosb byte es:[edi], al
int 0x3c
outsd dx, dword [esi]
inc ecx
lds edx, [ebp + 0x3c]
iretd
lea esp, [esp + 2]
lea esp, [esp + 0x24]
movzx esi, byte [eax + 7]
pushal
mov ax, 0x54a5
setb bl
push dx
not ebp
lea esp, [esp + 2]
popal
pushal
pop word [esp + 0xc]
push word [esp + 0x1b]
pushal
mov word [esp + 0x29], dx
push dword [esp + 0x34]
lea esp, [esp + 0x11]
lea esp, [esp + 3]
lea esp, [esp + 0x30]
push ebx
push ebp
push esi
push edi
movzx edx, byte [eax]
pushfd
pop word [esp]
push word [esp]
push dword [esp + 1]
mov byte [esp + 3], dh
pop dword [esp]
push dword [esp + 2]
shl edx, 8
push bx
mov byte [esp], bl
lea esp, [esp]
push word [esp + 1]
lea esp, [esp + 0xc]
movzx esi, byte [eax + 1]
xor edx, esi
movzx esi, byte [eax + 2]
push di
push word [esp]
shl edx, 8
lea esp, [esp + 4]
xor edx, esi
movzx esi, byte [eax + 3]
pushal
shl edx, 8
lea esp, [esp + 0x20]
xor edx, esi
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
push ebp
pushal
xor edx, esi
push bx
lea esp, [esp]
jge 0x13fcced
jl 0x13fcced
pop eax
fmul dword [esi + 0x29]
fsub st(4)
jecxz 0x13fd268
invalid
mov word [esp + 6], sp
lea esp, [esp + 1]
lea esp, [esp + 0xc]
lea esp, [esp + 4]
pushal
lea ecx, [ebx - 0x23c5]
mov edi, dword [esp]
mov dx, 0x2a17
mov bx, word [esp]
popal
push si
push word [esp + 1]
pop word [esp]
mov word [esp], cx
push ebx
lea esp, [esp + 3]
mov word [esp], si
lea esp, [esp + 3]
jmp 0x13fd146
retf 0x148b
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4a323d7c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6c046f70
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x650458
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esp, ecx
jmp 0x650430
jmp 0x650418
pushfd
lea edi, [ecx + ebx - 0x40]
push esi
jmp 0x65043c
push edi
push ecx
mov esi, edx
jmp 0x65049a
rdtsc
jmp 0x65047a
mov word [esp + 1], si
push dword [esp]
jg 0x65042e
jle 0x650418
cld
jmp 0x6504f9
mov dword [esp], ecx
popal
mov ecx, ebx
call fcn.0065051d
mov bl, 0x2c
mov byte [0xa78a34c5], al
cmp dword [ecx - reloc.kernel32.dll_DeleteCriticalSection], ebp
sbb cl, byte [eax - 0x456e511]
ror byte [ebp + 0x60], cl
pushal
cmp ax, ax
jb 0x650442
rdtsc
mov dword [esp], ecx
popal
jmp 0x65047e
rep movsb byte es:[edi], byte [esi]
pop ecx
pop edi
jmp 0x650503
pop esi
popfd
jmp 0x650547
lea ebx, [ebp*4]
xchg ch, cl
mov cx, 0xea8b
mov cl, 0xc7
call fcn.0065054c
movzx edx, byte [esi]
movzx edx, byte [esi]
jmp 0x650531

Function at 0x6567c8
Capabilities:
Encode data using xor

Disassembly:
sbb dh, byte [ebp + edx*4 + 0x2a]
inc ebp
hlt
call fcn.00656809
jns 0x6567e7
shr dword [edi - 0x5f], 1
and al, 0x20
jle 0x65675a
imul ecx, dword [ebp + 0x4f], 0x79
jg 0x656822
int1
invalid
lea esp, [esp + 5]
lea esp, [esp + 1]
lea esp, [esp + 2]
push ecx
mov ecx, 0x2f6828bd
jmp 0x656836
mov edi, ecx
mov edi, 0xbc0f7d61
mov dword [esp + 2], eax
push ecx
jmp 0x6568a2
setp cl
mov ecx, dword [esp]
mov cl, byte [esp]
mov cx, sp
pop ecx
jmp fcn.0063ca11
push word [esp]
pop word [esp + 1]
pop edi
mov di, word [esp]
xchg esi, eax
jmp 0x6568ec
xchg byte [esp + 1], al
mov di, cx
pop edi
push esi
bswap esi
pushfd
jmp 0x65688a
mov di, 0xc8b4
lea edi, [ebx*4]
push ecx
mov edi, dword [esp + 0x18]
jmp 0x656913
mov dword [esp + 6], esp
mov ah, byte [esp + 8]
mov eax, dword [esp + 0xe]
bswap edi
not di
bswap edi
jmp 0x6568b0
mov al, byte [esp]
pop esi
pushfd
push dword [esp + 1]
bswap eax
push dword [esp + 4]
jmp 0x6568c6
lea esp, [esp + 0x2c]
jmp fcn.0063ceae

Function at 0x6b368d
Capabilities:
Execute anti-debugging instructions

Disassembly:
popal
jmp 0x6b3ec0
lea esp, [esp + 4]
jmp 0x6b3677
bsf dx, si
dec bx
jmp 0x64b714
mov dword [edx], ebx
bsf dx, si
dec bx
jmp 0x64b714
add edx, 4
jae 0x6b36d9
mov dword [edx], ebx
jmp 0x6b36bc

Function at 0x73274e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + 0xe]
mov esi, dword [esp + 0xe]
push dword [esp + 8]
jmp 0x732771
pop edx
mov dword [esp + 5], ecx
mov dword [esp + 4], ecx
xchg si, dx
rol dh, 5
jmp 0x732721
mov dh, byte [esp + 0xc]
cmc
push bp
bts dx, bp
jmp 0x732737
pop dword [esp + 0xa]
mov edx, 0x787d28b6
xchg dword [esp + 2], edx
jmp 0x7327a0
pop word [esp + 6]
mov al, 0xc1
sub esp, 1
mov eax, 0xcd216f6a
mov byte [esp + 0x10], ah
mov esi, dword [esp + 1]
jmp 0x73275b
Function at 0x732b7c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x732bc0
mov word [esp + 0x1a], dx
mov byte [esp + 0xe], dl
mov al, byte [esp + 0x14]
mov dh, 0x87
mov dh, 0x43
pop eax
jmp 0x732caa
mov esi, 0xfc5b1fdf
add esp, 0xf
xchg al, ah
stc
pop eax
cmc
jmp 0x732c29
lea edx, [eax + ecx]
xchg edx, eax
rol dh, cl
mov ah, byte [esp + 0x18]
rdtsc
push dword [esp + 7]
jmp 0x732c01
pop dword [esp + 1]
xchg dword [esp + 6], edx
rdtsc
mov word [esp + 4], bp
push dword [esp + 1]
mov eax, dword [esp + 0xe]
jmp 0x732c74
mov esi, 0xad23ef4e
mov dx, si
xchg dl, al
dec dl
mov dh, ah
rdtsc
jmp 0x732c17
pop ax
xchg dword [esp + 0xa], esi
inc edx
pop eax
rdtsc
mov dh, 0x54
jmp 0x732c88
mov dword [esp], edi
rdtsc
rcl si, 1
push word [esp]
shr eax, cl
btc si, si
jmp 0x732c5e
clc
lea esp, [esp + 3]
bsf si, ax
sbb eax, 0x4a57ad32
sub esp, 0x14
cmc
jmp 0x732cd1
pop eax
pop esi
setnp dl
xchg si, ax
xchg dword [esp + 5], edx
mov ax, bp
jmp 0x732c4c
mov dh, bl
btc dx, di
rdtsc
xchg esi, edx
bswap esi
mov ah, byte [esp + 0x1a]
jmp 0x732ce7
mov dh, 0x4e
bswap eax
mov word [esp + 7], bp
lea eax, [ecx - 0x52]
cld
lea esi, [eax*4]
jmp 0x732cba
stc
mov al, byte [esp + 8]
lea esi, reloc.kernel32.dll_DeleteCriticalSection
mov word [esp], dx
pop dword [esp + 8]
sub esp, 3
jmp 0x732d1c
mov dword [esp + 8], esp
pop dword [esp + 0x10]
neg ah
bts eax, esp
cld
call int.00732e52
fdivr dword [ebx]
adc cl, byte [ebp + 0x11666f1c]
enter 0x248a, 0x24

Function at 0x733226
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc eax, 0xf56e1d71
mov dl, 6
push bp
inc al
stc
btr edx, edx
jmp 0x7331f6
mov dl, al
mov al, byte [esp]
xor edx, ebx
rdtsc
mov si, bp
bsr eax, ebx
jmp 0x7331a5
xchg word [esp], ax
xchg esi, eax
mov ax, 0xfa07
rdtsc
add esp, 1
mov dh, ch
jmp 0x733206
mov si, bp
rdtsc
neg eax
rcl si, 0xf
mov dword [esp], eax
add esp, 2
jmp 0x733263
std
bsr esi, esi
lea eax, [ecx + 0x2f]
xchg edx, esi
not esi
btc eax, edx
jmp 0x7331cc
sets ah
bsf edx, ebp
neg al
mov dh, byte [esp]
push esi
bswap eax
jmp 0x7331df
rdtsc
xchg byte [esp + 0x1b], ah
sub esp, 0x1c
lea esp, [esp + 0x52]
jmp 0x7331bb
rdtsc
call fcn.0073328d
push 0x4f592fc
mov al, 0x5e
leave
pop ecx
cmp bl, cl
pushal
call 0xc4f6d458
add cl, byte [eax + 0xffc243c]
mov ebp, 0x3b348dc1
add esp, 2
mov byte [esp], bh
cld
bsr eax, ecx
lea esi, [ebx + edi]
xchg byte [esp], dl
jmp 0x733235
setge dl
mov esi, dword [esp]
mov dx, word [esp + 1]
xchg si, ax
cld
mov word [esp], di
jmp 0x73324b

Function at 0x733c35
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.007322c2
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x7322bd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x7337d8
lea esp, [esp + 2]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x733af4