joyce8/EMBER2024-capa huggingface dataset:
Function at 0x596650
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5e5406
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x30]
xor ebx, ebx
cmp ebp, ebx
jne 0x59668c
pop ebp
mov eax, 0xc0004001
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
push esi
mov esi, dword [esp + 0x38]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov cl, byte [esi]
mov dword [esp + 0x18], ebx
cmp cl, bl
lea eax, [esi + 1]
je 0x5966ad
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5966a6
sub eax, esi
push edi
dec eax
lea ecx, [esp + 0x1c]
mov edi, eax
lea edx, [edi + 0x20]
push edx
call fcn.0041b410
mov cl, byte [esi]
mov eax, dword [esp + 0x1c]
cmp cl, bl
je 0x5966d5
mov byte [eax], cl
mov cl, byte [esi + 1]
inc eax
inc esi
cmp cl, bl
jne 0x5966ca
mov byte [eax], bl
mov dword [esp + 0x24], edi
mov esi, dword [esp + 0x40]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov cl, byte [esi]
mov dword [esp + 0x10], ebx
cmp cl, bl
lea eax, [esi + 1]
je 0x5966ff
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5966f8
sub eax, esi
lea ecx, [esp + 0x10]
dec eax
mov edi, eax
lea edx, [edi + 0x20]
push edx
call fcn.0041b410
mov cl, byte [esi]
mov eax, dword [esp + 0x10]
cmp cl, bl
je 0x596726
mov byte [eax], cl
mov cl, byte [esi + 1]
inc eax
inc esi
cmp cl, bl
jne 0x59671b
mov byte [eax], bl
mov dword [esp + 0x18], edi
mov eax, dword [ebp + 0x20]
mov byte [esp + 0x30], 1
cmp eax, ebx
pop edi
jne 0x596790
push 0x18
call fcn.005b449a
mov esi, eax
add esp, 4
mov dword [esp + 0x34], esi
cmp esi, ebx
mov byte [esp + 0x2c], 2
je 0x596786
lea ecx, [esi + 0xc]
call fcn.00419f90
push 0x2c
mov byte [esp + 0x30], 3
call fcn.005b449a
mov dword [esi], eax
add esp, 4
mov dword [esi + 4], 0xb
mov dword [esi + 8], ebx
mov eax, 0x2c
mov ecx, dword [esi]
sub eax, 4
mov dword [ecx + eax], ebx
jne 0x59677a
jmp 0x596788
xor esi, esi
mov byte [esp + 0x2c], 1
mov dword [ebp + 0x20], esi
mov ecx, dword [ebp + 0x20]
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
push edx
push eax
call fcn.0041ed60
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x2c], bl
push ecx
call fcn.005b44c3
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
push edx
call fcn.005b44c3
mov ecx, dword [esp + 0x2c]
add esp, 8
mov eax, 0x4000
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc

Function at 0x5aff2b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x5aff4d
cmp dword [edi + 0x3c], 0
jne 0x5aff4d
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.005cb95c
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.005aff7a
pop edi
pop esi
pop ebx
ret 8
Function at 0x5b15c8
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5b1600
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005b4c1f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005b4bf6
jmp 0x5b160c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5b1610
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x8877e8
mov ecx, edi
call fcn.005b48f8
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x5b1663
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x5b1676
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.005b4c1f
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.005b4bf6
jmp 0x5b1676
mov ecx, esi
call fcn.005b3ba7
test eax, eax
je 0x5b1676
push edi
mov ecx, eax
call fcn.005b15c8
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x5b32de
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5b3320
call fcn.005cb95c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x5b3320
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5b3317
xor eax, eax
jmp 0x5b3328
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005b332e
pop edi
pop esi
pop ebx
ret 4
Function at 0x5b3100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push ebx
xor eax, 0xb2a90595
mov dword [ebp - 0x1c], 0xaa7575b3
mov dword [ebp - 0x18], 0xf0a59521
mov dword [ebp - 0x14], 0x315b1289
mov dword [ebp - 0x10], 0x5985ddca
push esi
push edi
cmp eax, 0xb2a90594
jne 0x5b331f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
mov eax, dword [eax + edx + 0xc0]
mov ecx, eax
xor ecx, 0xde1a4afa
lea esi, [eax + edx]
xor eax, eax
cmp ecx, 0xde1a4afa
cmove esi, eax
mov eax, esi
xor eax, 0xabc7da58
cmp eax, 0xabc7da58
je 0x5b331f
mov ebx, dword [esi + 0xc]
lea eax, [ebp - 0x1c]
push 0
push 0xf67b7b8d
push eax
lea edx, [esi + 0x340]
mov dword [ebp - 0xc], ebx
lea ecx, [esi + 0xd8]
call section..gcode
mov eax, dword [ebx + 4]
add esp, 0xc
xor eax, 0x96f3b235
cmp eax, 0x96f3b235
je 0x5b331f
mov eax, dword fs:[0x18]
xor edx, edx
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 8]
mov eax, dword fs:[0x18]
lea edi, [ebx + 0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
movzx eax, word [ecx + ebx + 0x14]
add eax, ecx
add edi, eax
movzx eax, word [ecx + ebx + 6]
xor ecx, ecx
mov dword [ebp - 8], edi
mov dword [ebp + 0xc], eax
cmp cx, ax
jae 0x5b331f
nop dword [eax]
movzx eax, dx
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0xc]
lea edi, [edi + eax*8]
lea eax, [ecx + ebx]
cmp eax, entry1
ja 0x5b3215
mov eax, dword [edi + 0x10]
add eax, ecx
add eax, ebx
cmp eax, entry1
ja 0x5b3225
inc edx
cmp dx, word [ebp + 0xc]
jae 0x5b331f
mov edi, dword [ebp - 8]
jmp 0x5b31f0
mov eax, edi
xor eax, 0x9a961e35
cmp eax, 0x9a961e35
je 0x5b331f
mov eax, dword fs:[0x18]
mov ecx, dword [edi + 0xc]
mov edi, dword [edi + 0x10]
add edi, ecx
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
add edi, edx
lea eax, [ecx + edx]
cmp eax, edi
jae 0x5b331f
mov ebx, dword [esi + 0x318]
nop
mov edx, dword [eax + 4]
mov ecx, ebx
xor ecx, dword [eax]
xor edx, dword [esi + 0x31c]
xor ecx, 0x45ecc763
xor edx, 0
cmp ecx, 0x45ecc763
jne 0x5b32f7
test edx, edx
jne 0x5b32f7
mov ecx, dword [esi + 0x320]
xor ecx, dword [eax + 8]
mov edx, dword [esi + 0x324]
xor ecx, 0xc3464624
xor edx, dword [eax + 0xc]
xor edx, 0
cmp ecx, 0xc3464624
jne 0x5b32f7
test edx, edx
jne 0x5b32f7
mov ecx, dword [esi + 0x328]
xor ecx, dword [eax + 0x10]
mov edx, dword [esi + 0x32c]
xor ecx, 0x5ce40551
xor edx, dword [eax + 0x14]
xor edx, 0
cmp ecx, 0x5ce40551
jne 0x5b32f7
test edx, edx
jne 0x5b32f7
mov ecx, dword [esi + 0x330]
xor ecx, dword [eax + 0x18]
mov edx, dword [esi + 0x334]
xor ecx, 0x15070819
xor edx, dword [eax + 0x1c]
xor edx, 0
cmp ecx, 0x15070819
jne 0x5b32f7
test edx, edx
je 0x5b3309
inc eax
cmp eax, edi
jb 0x5b3260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
xor ecx, 0x21c53235
cmp ecx, 0x21c53235
je 0x5b331f
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5dbe1b1e
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x50013b75
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x5c7c8d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ecx, eax
call 0x5c7b8a
sub esp, 0xc0
jmp 0x5c7bca
mov ebp, esp
bsf edx, esp
jno 0x5c7c12
xchg cx, dx
call fcn.005c7c3c
push es
wait
or ebp, dword [esi - 0x63]
sub ch, byte [esp + edi*8 - 0x6e]
cmc
add al, 0xb1
dec ecx
call 0xbb6c1df6
lds esi, [ebx]
lds eax, [eax + 0x66]
bsf edx, esp
btc ebp, eax
xor eax, ebp
inc eax
bsf dx, sp
lea ebx, [ebx - 0xd8]
clc
jmp 0x5c7ba6
mov ebx, esi
mov edx, 0x233b1078
lea ecx, [esi*4]
jmp 0x5c7cb9
xchg cx, dx
jmp 0x5c7bfc
lea ecx, [esp + ecx]
lea edx, [esi + edi]
xchg ch, al
lea ebp, reloc.RASAPI32.dll_RasHangUpA
xchg dword [esp], ebx
jmp 0x5c7be9
mov cx, 0x719f
rdtsc
jmp 0x5c7cc9
adc dl, bh
jp 0x5c7ca3
mov cx, 0x719f
rdtsc
jmp 0x5c7d65
not ecx
dec edx
rdtsc
jmp 0x5c7d12
lea edx, [eax*4]
lea eax, reloc.RASAPI32.dll_RasHangUpA
jmp 0x5c7cfc
sub esp, 4
cmc
push dword [esp + 3]
jmp 0x5c7d48
ror esi, 0
jge 0x5c7cd0
lea edx, [eax*4]
lea eax, reloc.RASAPI32.dll_RasHangUpA
sub esp, 4
cmc
push dword [esp + 3]
jmp 0x5c7d48
lea esp, [esp + 8]
add esi, 0x5115e39e
mov eax, 0xdaa30dd6
xchg al, cl
mov dh, bl
call fcn.005c7d85
push ecx
sal byte [ebp - 0x72ac990a], 1
and al, 2
mov ch, 0xf6
push bx
lea esp, [esp + 2]
jmp 0x5c7d2e
not ecx
dec edx
rdtsc
jmp 0x5c7cce

Function at 0x5ccfba
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol dx, 5
jne 0x5ccfd5
je 0x5ccfdf
fadd qword [edi - 0x29]
mov dl, 0x41
lea ebx, [edx - 8]
outsb dx, byte [esi]
or eax, edi
jg 0x5cd024
invalid
lea esp, [esp + 3]
jmp fcn.005cd0a0

Function at 0x5cd54c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, edx
lea esp, [esp + 2]
jmp 0x5cd566
pop ax
jmp 0x5cd536
xchg byte [esp + 5], ah
jmp 0x5cd5c7
add bl, dl
sub esp, 0x1a
jno 0x5cd550
xchg byte [esp + 5], ah
push dword [esp + 0x16]
lea esp, [esp + 2]
jmp 0x5cd5cf
lea edx, [ebx + edi]
lea eax, reloc.RASAPI32.dll_RasHangUpA
mov dx, si
mov al, 0x7d
setnp dh
mov ax, 0xc219
jmp 0x5cd593
push dword [esp + 0x16]
lea esp, [esp + 2]
dec esi
jmp 0x5cd5a9

Function at 0x5f0e90
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, ch
shl eax, 0x1f
mov eax, dword [esp]
mov ah, dh
xchg dword [esp], edi
jmp 0x5f0ef6
setl ah
lea edx, reloc.RASAPI32.dll_RasHangUpA
lea edx, reloc.RASAPI32.dll_RasHangUpA
xchg dl, dh
setge dl
lea edi, [edi + 0x32]
call fcn.005f0edb

Function at 0x5f4ebd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xchg ecx, ebp
jmp 0x5f4f05
mov ebx, dword [ebp + 0xc]
jmp 0x5f4eef
lea esp, [esp + 4]
mov ebp, esp
sub esp, 0x14
push ebx
jmp 0x5f4ec1
Function at 0x5f4fb5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx ecx, bx
jmp 0x5f4fed
push edx
jmp 0x5f5044
inc edx
jmp 0x5f4ea7
jmp 0x5f5554
stc
jmp 0x5f5449
sub edi, dword [ebp + 0xc]
sub esp, 0
call fcn.005f54d4
inc ecx
rol byte [esi + 0x21], 1
rcl byte [esi]
int 0x5c
scasd eax, dword es:[edi]
mov dh, 0xa1
push esi
mov ecx, ebp
neg ecx
not cl
jmp 0x5f4f11
push edi
clc
mov edi, dword [eax]
mov cx, 0xc3ac
jmp 0x5f4f20
mov ch, byte [esp]
pushal
mov ecx, eax
jmp 0x5f4f51
mov eax, dword [eax + 4]
pushfd
mov cl, dl
setb ch
bsf ecx, edx
jmp 0x5f4f9f
sub esp, 0x16
mov dword [esp + 7], esi
lea esp, [esp + 2]
mov dword [ebp - 0x10], eax
pushfd
jmp 0x5f4fac
shr ebx, 0x10
mov ecx, 0xffff
mov dword [ebp - 0xc], ebx
jmp 0x5f4f7d
cmp bx, cx
call 0x5f4fb5
salc
lea esp, [esp + 0x40]
jne 0x5b7a38
je 0x5f4fe2
pop edi
rcl dword [ecx + 0x30], 0xc3
jae 0x5f4f8b
jp 0x5f501f
les esi, [edi - 0x64]
pushfd
jmp 0x5f52fb
shr eax, 0x10
mov dword [ebp - 4], eax
jmp 0x5b7a7a
mov dl, 0x5b
inc ecx
not dl
not dx
sub esp, 0
jmp 0x5f502c
or byte [esi + 0x21c908f9], bl
movsd dword es:[edi], dword [esi]
xor eax, 0x546baf5c
invalid
xor edx, edx
div ecx
movzx eax, ax
call fcn.005f5016
mov dword [ebp - 4], eax
lea esp, [esp + 4]
jmp 0x5b7a7a
mov edx, ebp
jmp 0x5f5ddf
imul ecx, eax
call 0x5f50c6
lea esp, [esp + 0xc]
lea ecx, [ebx + 1]
jmp 0x5f52ae
div ecx
push esi
lea edx, [ecx*4]
lea esp, [esp + 4]
jmp 0x5f52c2
movzx edx, ax
jmp 0x5f4fcc
lea esp, [esp + 8]
imul eax, ebx
call fcn.005f530a
pop edi
invalid
lea esp, [esp + 4]
movzx eax, dx
imul esi, eax
sub esp, 8
jmp 0x5f52e5
test ecx, ecx
jmp 0x5f54c2
mov word [esp], di
jmp 0x5f54a4
stc
lea esp, [esp + 3]
lea esp, [esp + 4]
cmp edi, dword [ebp + 0xc]
pushfd
jmp 0x5f547f
lea esp, [esp + 4]
jb 0x5f4e7b
jae 0x5f4ed9
xor dh, byte [eax + 0x76b04126]
sub al, 0xad
cmp eax, 0x3c0bb744
invalid
ja 0x5f4ed9
jne 0x5f4e7b
sub esp, 3
pushfd
jmp 0x5f5495
movzx eax, word [ebp - 4]
rol di, 0xc
jmp 0x5f5574
movzx ecx, dx
xchg edi, esi
sub esp, 0x13
lea esp, [esp + 3]
jmp 0x5f55a7
lea esp, [esp + 4]
movzx ebx, bx
mov cl, 0x19
inc ecx
mov ecx, esi
jmp 0x5f5285
movzx eax, ax
xchg ch, cl
setge cl
push esp
jmp 0x5f55ce
lea edx, [edx + 0xc]
movzx esi, word [edx]
pop edx
lea ecx, [esi*4]
mov cx, 0xb2ea
jmp 0x5f5ac9
Function at 0x6a22ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6a22fb
push dword [esp + 0x1d]
lea edx, [esp + ebx]
push word [esp + 2]
mov dx, 0x8b56
not ah
pop dword [esp + 0x21]
jmp 0x6a394b
mov edx, 0x5b6f5868
pop word [esp + 0x17]
sub esp, 0x11
setg dl
mov di, 0xb26a
mov eax, dword [esp + 0x21]
jmp 0x6a22cc
dec ah
mov dword [esp + 0x23], ebp
rcr eax, cl
add esp, 0x20
pop dword [esp + 8]
neg eax
jmp 0x6a3071
xchg word [esp + 0x1e], di
mov di, sp
mov di, si
mov ax, 0x8d38
xchg word [esp + 0x24], di
xchg word [esp + 5], di
jmp 0x6a2323
inc ax
rdtsc
mov al, 0xe8
pop word [esp + 7]
lea esp, [esp + 6]
xchg byte [esp + 0xb], al
jmp 0x6a2341
rol edi, cl
xchg dword [esp + 6], edi
setno ah
mov eax, dword [esp + 4]
pop edx
jmp 0x6a23b2
pop word [esp + 9]
mov dword [esp + 1], edx
xchg dword [esp + 7], edi
pop word [esp + 6]
rdtsc
mov dh, byte [esp + 6]
jmp 0x6a2382
xchg di, dx
pop word [esp + 2]
xchg dword [esp], eax
mov dx, sp
pop dx
pop edx
jmp 0x6a2407
ror eax, 3
rdtsc
mov dx, 0xa2e6
xchg dword [esp + 7], eax
mov dx, 0x2a61
mov edx, 0xfee31af9
jmp 0x6a2398
add esp, 9
xchg di, ax
rdtsc
inc ah
clc
xchg edi, eax
jmp 0x6a241d
xchg dl, ah
sub esp, 0x15
ror dx, 0xe
pop di
lea eax, [ebp - 0xd3]
btr eax, esi
jmp 0x6a23f1
mov word [esp + 3], dx
push dword [esp + 1]
xchg ah, al
add esp, 6
push word [esp + 6]
lea eax, [eax + ebp]
jmp 0x6a2465
pop dword [esp + 0xb]
rdtsc
bswap eax
xchg word [esp + 0xc], di
add esp, 1
neg eax
jmp 0x6a23d9
neg ax
xor di, 0x5613
xchg edx, edi
mov byte [esp], bl
call fcn.006a244f
bnd jnp 0x6a2465
invalid
push dword [esp + 7]
lea edi, [ecx + ebp]
bsr edx, ecx
push dword [esp + 0xa]
mov dl, byte [esp + 5]
mov dx, 0x39cc
jmp 0x6a243b
btc eax, ebx
mov eax, dword [esp + 0xa]
mov eax, ebp
inc ax
std
neg edx
jmp 0x6a248b
cmc
rdtsc
lea esp, [esp + 1]
lea esp, [esp + 1]
sub esp, 0xc
bswap eax
jmp 0x6a250d
push dword [esp + 6]
xchg byte [esp + 0x10], ah
add esp, 0x11
neg ah
xchg edx, eax
lea edx, [ebp - 9]
jmp 0x6a26b2
neg ah
push dword [esp + 0x19]
adc dl, 0xe6
rdtsc
mov dx, word [esp + 0x33]
xchg dx, ax
jmp 0x6a236d
Function at 0x6a244f
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov di, dx
jmp 0x6a24b9
pushal
cld
push dword [esp + 0x1c]
rcr di, cl
xchg dl, dh
pop word [esp + 0x18]
jmp 0x6a24e2
push word [esp + 3]
xchg ah, dl
mov edx, eax
lea esp, [esp + 0xb]
add esp, 4
cld
jmp 0x6a24a3
push word [esp + 0xe]
pop dx
cmc
or dh, cl
bsf edi, ebp
jmp 0x6a24f6
bsf edi, ebx
dec di
xchg edi, edx
mov dx, si
mov eax, 0x4ec4235b
setae dl
jmp 0x6a24cc
mov edx, 0xdd98d37c
bswap edi
mov ax, 0x25f6
mov dl, bl
xchg dx, di
jmp 0x6a2639
lea eax, [eax*4]
cld
mov edx, 0xbe4b58fb
xchg di, ax
jmp 0x6a256a
pop di
bsr eax, eax
stc
add dh, bl
bswap edi
mov al, 0x40
jmp 0x6a2520
setb ah
lea edi, reloc.RASAPI32.dll_RasHangUpA
pop word [esp + 1]
pop word [esp]
pop ax
xchg dx, di
jmp 0x6a257d
rdtsc
setb dl
xchg ah, dl
mov edx, 0xa67da0cb
ror al, cl
sub esp, 7
jmp 0x6a2544
mov dx, bp
push ecx
xchg di, ax
mov byte [esp + 1], al
sub esp, 6
bsf edx, edx
jmp 0x6a25c4
mov dx, sp
add esp, 0x1f
neg dh
adc ax, di
lea eax, [edi + ebp]
mov dl, 0x8f
jmp 0x6a2536
ror di, cl
not dh
shr dh, cl
call fcn.006a25fd
out dx, eax
not dword [bp + si - reloc.RASAPI32.dll_RasHangUpA]
sbb dh, byte [ebp + 0x64]
xchg edi, eax
bsr edx, esi
mov al, 0x49
rdtsc
sub esp, 0x17
xchg di, ax
xchg edi, edx
jmp 0x6a25ae
mov eax, dword [esp + 0x1d]
btc edi, edi
bswap eax
mov al, byte [esp + 0xa]
pop word [esp + 0x1e]
mov edx, dword [esp + 1]
jmp 0x6a259c
Function at 0x6a25fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, esi
ror dl, 4
push word [esp + 0x1b]
stc
lea edi, [ebp*4]
mov eax, 0x9861ce28
jmp 0x6a260d
push dword [esp + 0x22]
mov word [esp + 0x26], bx
mov edx, 0x840fe0e0
jmp 0x6a25d5
xchg al, dh
mov dx, word [esp + 0x20]
mov byte [esp + 0x25], cl
mov dx, 0xb90a
mov eax, edi
btc ax, dx
jmp 0x6a266f
xchg al, ah
mov dword [esp + 0xd], esp
not di
mov word [esp + 8], bp
xchg word [esp + 0x1c], dx
jmp 0x6a2698
bswap edx
mov di, bx
mov dx, word [esp + 0x13]
sete ah
neg dl
rdtsc
jmp 0x6a2654
bswap eax
mov ax, word [esp + 0x16]
rcl di, cl
inc al
mov eax, dword [esp + 0xe]
jmp 0x6a2cd6
mov dword [esp + 6], edx
pop dword [esp + 0x10]
add esp, 0xe
rdtsc
mov dl, al
bts edi, ecx
jmp 0x6a2682
xor edi, 0x88c1d39b
std
rdtsc
mov word [esp + 0x2b], si
mov dword [esp + 0x1e], edx
push dword [esp + 0x1a]
call fcn.006a2788
lea edi, reloc.RASAPI32.dll_RasHangUpA
neg eax
lea edx, reloc.RASAPI32.dll_RasHangUpA
bswap edx
jmp 0x6a29a1
rdtsc
mov word [esp + 9], di
pop dx
mov ax, 0x33b5
bt dx, sp
pop ax
jmp 0x6a27c4
pushal
lea esp, [esp + 0x4f]
mov di, si
dec ax
call fcn.006a2959
pop edx
xchg ah, dl
mov dh, 0x63
neg dx
sub esp, 0x1c
lea esp, [esp + 0x26]
jmp 0x6a2a18
btr dx, bx
pop dword [esp]
call fcn.006a29fc
mov al, 0x8f
push word [esp + 3]
btr edx, ebp
add esp, 5
pop dx
xchg di, ax
jmp 0x6a2aa1
neg di
mov di, cx
xchg dword [esp + 3], edx
lea eax, [ebx + esi]
rcr edi, 4
jmp 0x6a2afa
mov ax, dx
push dword [esp + 2]
xchg al, dl
add esp, 1
bts edi, esi
lea eax, [edi*4]
jmp 0x6a2a66
mov edi, 0x9bb110a0
pushfd
xchg al, dl
neg edx
rdtsc
sub esp, 1
jmp 0x6a2a7c
bswap edi
inc al
mov edx, 0xeacce096
mov dl, bl
bsr dx, di
jmp 0x6a2ada
rcl eax, cl
lea eax, [ebx + edi]
xchg edi, edx
bsf eax, esp
push word [esp + 6]
pop edi
jmp 0x6a2ab2
xchg word [esp], ax
cmc
btr dx, si
mov ax, si
btc ax, dx
bswap edi
jmp 0x6a2b21
btc edi, ecx
mov eax, 0xfb12435c
shr al, cl
pop edi
mov dword [esp], ebx
pushfd
jmp 0x6a2ac8
sub esp, 0x14
mov dl, ch
pop word [esp + 7]
inc di
mov ax, word [esp + 0x17]
mov edi, dword [esp + 8]
call fcn.006a2b0b
mov ecx, 0x37c4bd2d
sub byte [ecx + 0x46cbac3e], 0xef
cdq
adc eax, dword [ebx + reloc.RASAPI32.dll_RasHangUpA]
and dword [esi + 0xf], 0x5f66faa3
bt dx, di
pop di
mov dh, 0xc
mov al, byte [esp + 0x2b]
push dword [esp + 0x22]
xchg byte [esp + 0x31], al
jmp 0x6a280c
xchg edi, eax
pop edx
push word [esp + 9]
mov eax, dword [esp + 0x27]
neg dx
rdtsc
jmp 0x6a2b4f
sub esp, 0x1e
not ax
neg ah
xchg byte [esp + 0x2d], al
lea eax, [eax + edi]
bsf eax, ebp
jmp 0x6a2c11
Function at 0x6a26dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 0xe], ax
mov byte [esp + 0x2c], bl
xchg edi, edx
mov dword [esp + 5], edx
jmp 0x6a26fc
mov edi, dword [esp + 0x34]
not ah
pop edx
jmp 0x6a26c7
xchg byte [esp + 0x1e], dl
xchg di, ax
mov di, cx
jmp 0x6a274c
pop word [esp + 0x2f]
push dword [esp + 0x11]
mov ah, byte [esp + 0x29]
mov edi, dword [esp + 0x11]
not dh
mov word [esp + 3], si
jmp 0x6a26e6
mov eax, 0x882423cb
mov word [esp + 0x2e], sp
mov di, word [esp + 3]
jmp 0x6a2766
lea eax, [esi*4]
rdtsc
mov dx, 0xfd01
dec dx
add esp, 0xb
lea edx, [eax - 0xd9]
jmp 0x6a2736
not dx
lea edi, [eax + 0x33]
lea eax, [ecx + ebx]
ror edx, 0xf
push word [esp + 0x24]
cmc
jmp 0x6a27a0
mov dh, byte [esp + 5]
bswap edx
lea edi, reloc.RASAPI32.dll_RasHangUpA
mov dl, 0xf
rdtsc
jmp 0x6a27f5
mov dl, byte [esp + 0x1a]
mov byte [esp + 0x10], dl
rdtsc
pop di
lea edi, [edx*4]
lea edx, [ecx*4]
jmp 0x6a278a
mov edx, 0xbe8e7014
mov dword [esp + 8], edx
pop dword [esp + 0xa]
jmp 0x6a27df
Function at 0x6a2f16
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg al, dl
xchg word [esp + 0x23], ax
pop di
mov edx, 0xdb1bbbd7
mov word [esp + 0x11], bp
sub esp, 0xe
jmp 0x6a2e9f
mov di, word [esp + 1]
sub esp, 0x1e
mov di, dx
mov eax, dword [esp + 0x10]
neg eax
sub di, dx
jmp 0x6a2eb5
neg di
rdtsc
jmp 0x6a2eda
Function at 0x410b50
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x55f41b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047f6e7
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x410bd2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047d600
mov eax, dword [eax]
push 0x622bb4
push eax
call fcn.00545974
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047f972
test bl, bl
je 0x410bd2
push 0x622bb4
lea ecx, [esp + 0xc]
call fcn.0047fd02
push 0x622bc0
lea ecx, [esp + 0xc]
call fcn.0047fd02
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x410c0e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047f972
jmp 0x410cd9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x410c92
lea edx, [esp + 0x7c]
push 0x622bbc
push edx
call fcn.00545974
add esp, 8
test eax, eax
je 0x410c92
lea eax, [esp + 0x7c]
push 0x622bb8
push eax
call fcn.00545974
add esp, 8
test eax, eax
je 0x410c92
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410c22
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047f972
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4114d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x411532
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc