joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e3210
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4e3276
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4e3276
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4e3257
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x4e3e60
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004e3fb0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x4e3e80
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x4e3e61
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004e3fb0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x4e3e80
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x4e3eb0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4e3f07
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x4e3f1d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.004e3f40
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x4e3f40
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x4e3fd0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4e4019
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x4e4660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51d700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004e4040
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004e40c0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004e40c0
lea ecx, [esi + 0xc]
call fcn.0050c54f
lea ecx, [esi + 0x10]
call fcn.0050c54f
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004e6c40
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004e6c40
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004e6c40
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0050c5c4
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0050c5c4
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4e5488
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51d928
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x4e5498
call fcn.004e59b0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x4e557b
cmp byte [edi], 0
je 0x4e557b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x4e54bd
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.004e3e60
test eax, eax
jne 0x4e54dd
push 0x57e258
lea ecx, [esi + 0x38]
call fcn.0050c701
jmp 0x4e557b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.004e3eb0
test eax, eax
jne 0x4e550c
mov ecx, esi
call fcn.004e3fb0
push edi
add esi, 0x38
push 0x57e234
push esi
call fcn.00509c95
add esp, 0xc
jmp 0x4e557b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.004e6230
test eax, eax
je 0x4e5574
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004e5650
test eax, eax
jne 0x4e5590
push edi
lea eax, [esi + 0x38]
push 0x57e210
push eax
call fcn.00509c95
add esp, 0xc
mov ecx, esi
call fcn.004e59b0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x4e5638
mov ecx, dword [0x57e4c8]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.00509c95
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.004e3f60
test eax, eax
jne 0x4e55fa
push 0x57e1f4
lea ecx, [esi + 0x38]
call fcn.0050c701
jmp 0x4e560a
push 0xfa
mov ecx, esi
call fcn.004e6230
test eax, eax
jne 0x4e5627
mov ecx, esi
call fcn.004e59b0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0050c5c4
jmp 0x4e557b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0050c5c4
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x5021d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x51eac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004f6f74
mov eax, dword [0x55bbf8]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004f6ea6
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.00502ca0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x502277
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x50226e
cmp al, 0xff
je 0x50226e
dec al
mov byte [ecx], al
jmp 0x502277
push ecx
call fcn.0050c32e
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x5022a8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x50229f
cmp al, 0xff
je 0x50229f
dec al
mov byte [ecx], al
jmp 0x5022a8
push ecx
call fcn.0050c32e
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x50e968
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x50e9a0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0050ca1f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0050c9f7
jmp 0x50e9ac
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x510059
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x51009b
call fcn.00515e57
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x51009b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x510092
xor eax, eax
jmp 0x5100a3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005100a9
pop edi
pop esi
pop ebx
ret 4

Function at 0x516387
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5163b5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5163d3
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005162ed
jmp 0x5163d3
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5163d3
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005162ed
test edi, edi
mov eax, edi
jne 0x5163bd
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x56abbe
Capabilities:
Encrypt data using aes

Disassembly:
mov dl, dh
jmp 0x56ac42
call fcn.0056b2df
add ebx, dword [ebx + reloc.RASAPI32.dll_RasHangUpA]
imul edi, esp, 0xffffff92
cmc
add al, 0xb7
dec ecx
call 0x8a344b69
inc ebp
clc
push word [esp + 0xf]
lea esp, [esp + 2]
jmp 0x56ac04
pop word [esp + 1]
jmp 0x56ada0
lea esp, [esp + 0x24]
cmp eax, 1
push esp
push word [esp + 1]
jmp 0x56abea
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov di, word [esp]
not di
jmp 0x56acd5
movzx ebx, byte [esi + 0x11]
mov dx, 0x58d7
mov edi, ecx
jmp 0x56ac2c
mov dword [ebp - 4], ecx
not cx
xchg dx, bx
mov ecx, 0xff
jmp 0x56a8ee
lea esp, [esp + 2]
mov edi, edx
push esp
add esp, 3
lea esp, [esp + 1]
jmp 0x56acb5
xchg dx, di
mov edx, dword [esi]
sub esp, 6
pop di
push word [esp + 3]
jmp 0x56ac6c
shr edi, 0x18
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
sub esp, 0x14
mov word [esp + 0xa], di
call fcn.0056ac9d
test dword [edx + esi*4], ebx
aad 0x24
xchg edx, eax
jmp 0x3ce257df
mov edi, dword [esp]
add esi, 0x10
btc edx, ebx
setbe dh
stc
jmp 0x56ac8c
lea ecx, [eax - 1]
sete bh
xchg bx, di
lea edx, [ebp*4]
jmp 0x56ac59
lea esp, [esp + 4]
jle 0x56a947
mov cx, 0xb793
mov dl, 0xd4
mov edx, dword [esp]
jmp 0x56ad6a

Function at 0x56ac9d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x56ad3e
pushal
call fcn.0056ad44
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
cmc
inc bl
jmp 0x56ad53
popal
lea eax, [eax*4]
lea eax, reloc.RASAPI32.dll_RasHangUpA
mov edi, dword [eax]
pop eax
jmp 0x56ace4
mov dword [esp + 0x1c], edi
stc
pushal
pop dword [esp + 8]
pop dword [esp + 0xc]
lea esp, [esp + 0x18]
jmp 0x56ad01
and edi, ecx
push eax
pushal
jmp 0x56ad18
movzx ebx, byte [esi + 2]
call fcn.0056ad7f
xchg dword [edx], ebx
mov bh, ch
sbb ah, byte [ebx + ebx*8 + 0x798aef7f]
add dl, dl
dec ebp

Function at 0x56ad7f
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
sub esp, 0x18
lea esp, [esp + 2]
jmp 0x56af70
and ebx, ecx
push esp
jmp 0x56ae14
mov ebx, dword [ebp]
pop ebp
sub esp, 8
mov dword [esp + 1], ecx
push edx
jmp 0x56adb5
and edx, ecx
sub esp, 0x16
push edx
push esp
push dword [esp + 2]
jmp 0x56aecb
movzx ebx, byte [esi + 5]
sub esp, 6
mov dword [esp], ebp
stc
add esp, 1
lea esp, [esp + 1]
jmp 0x56add9
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov bl, bh
xchg bl, bh
jmp 0x56adf9
mov edx, dword [esi + 4]
mov dword [esi], edi
not edi
mov edi, 0xb232ba50
jmp 0x56ae7b
push word [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 0x40]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
shr edx, 0x13
jmp 0x56ae25
mov edi, edx
pushal
mov byte [esp + 0xb], bh
call fcn.0056aea7
push ebx
invalid
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x56ae60
push word [esp + 0x17]
lea esp, [esp + 2]
and edx, ecx
push esp
mov byte [esp + 2], bh
jmp 0x56ae47
lea esp, [esp + 2]
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
sub esp, 0x1c
mov word [esp + 8], bx
pop dword [esp + 0xa]
jmp 0x56ae95
push ebp
mov ebp, ebx
lea ebp, [ebp*4]
lea ebp, reloc.RASAPI32.dll_RasHangUpA
jmp 0x56adcb
Function at 0x56af31
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x56af07
and edi, ecx
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
and ebx, ecx
jmp 0x56aee4
mov ebx, 0xcfe0c80a
movzx ebx, byte [esi + 6]
pushal
lea esp, [esp + 0x1b]
push edx
jmp 0x56af57
mov word [esp], dx
push dword [esp]
add esp, 1
lea esp, [esp + 3]
jmp 0x56aefa

Function at 0x56b012
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
call fcn.0056af85
pushal
hlt
and edx, ecx
pushal
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x56af9c
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
movzx ebx, byte [esi + 9]
clc
jmp 0x56afb4
mov byte [esp + 2], bh
mov byte [esp + 2], ch
jmp 0x56afd1

Function at 0x56b18c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 0x44]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
bt edx, edx
jmp 0x56b198
add esp, 3
sub esp, 0x16
lea esp, [esp + 3]
jmp 0x56b171
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
lea edi, [edx + ebx]
mov di, word [esp]
jmp 0x56b1ab
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
bswap edi
inc di
jmp 0x56b5cd
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
sub esp, 4
cmc
pop word [esp]
lea esp, [esp + 2]
jmp fcn.0056b44b
mov edi, edx
push esp
shr edi, 0x18
jmp 0x56b529

Function at 0x56b2da
Capabilities:
Encrypt data using aes

Disassembly:
mov ecx, esi
lea ecx, [ecx + 0xc]
mov dword [ecx], edi
pop ecx
call 0x56b2da
pushal
push dword [esp]
jmp 0x56b2fc
mov dword [esp + 1], ebp
push ecx
jmp 0x56b2cc
mov word [esp + 2], sp
lea esp, [esp + 0x10]
jne 0x56a8ee
je 0x56a947

Function at 0x56b2f5
Capabilities:
Encrypt data using aes

Disassembly:
mov ecx, esi
lea ecx, [ecx + 0xc]
mov dword [ecx], edi
pop ecx
call 0x56b2da
pushal
push dword [esp]
jmp 0x56b2fc
mov dword [esp + 1], ebp
push ecx
jmp 0x56b2cc
mov word [esp + 2], sp
lea esp, [esp + 0x10]
jne 0x56a8ee
je 0x56a947
Function at 0x66a3d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
lea edi, [edx + ebx]
mov cx, sp
not edi
mov byte [esp + 0xd], bh
mov dh, byte [esp + 4]
jmp 0x66a2db
pop word [esp + 7]
add esp, 0xb
setno dh
lea ebx, [edx*4]
push esp
xchg bx, ax
jmp 0x66a289
pop edx
xchg byte [esp + 7], dl
push dword [esp + 0xa]
xchg edx, ebp
mov cl, ch
lea ecx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x66a2ec
xchg word [esp + 6], dx
mov bl, 0x58
xchg edx, eax
mov eax, ecx
rdtsc
add esp, 1
jmp 0x66a2bb
not eax
xchg word [esp + 0xd], di
pop word [esp + 0xb]
not bx
mov byte [esp + 5], dh
push word [esp + 0xb]
jmp 0x66a36f
push dword [esp + 8]
rdtsc
mov cl, 0x4a
push word [esp + 7]
lea edi, [edx*4]
xchg ebp, edi
jmp 0x66a2a3
lea esp, [esp + 1]
mov esi, 0xb6abe30a
lea ebp, [ebp*4]
add esp, 8
not bp
jmp 0x66a358
mov di, 0xc2a7
mov word [esp + 6], sp
pop si
pop dx
clc
mov bl, 0x48
jmp 0x66a32a
pushal
xchg word [esp + 0xc], bx
sub esp, 0x14
xchg ebx, ecx
mov bl, bh
lea edi, [esp + esi]
jmp 0x66a3af
not ax
bsf dx, si
mov word [esp + 2], di
bswap ebx
cmc
mov di, word [esp + 0xa]
jmp 0x66a346
add esp, 0x2d
xchg dword [esp], edx
cpuid
btr eax, edx
push word [esp + 7]
mov bp, 0x7e71
jmp 0x66a3c0
mov ebx, 0x7fae13c0
push edx
pop word [esp + 0x35]
popal
pushal
rdtsc
jmp 0x66a385
mov byte [esp + 5], bh
rdtsc
push edx
lea ebx, [ecx*4]
bswap eax
jmp 0x66a3ea
lea ebp, [esi + 0x45]
lea edx, [esi - 0x2d]
mov word [esp + 0xe], bx
lea ebp, [ecx + edi]
cmc
jmp 0x66a30f
xchg ah, bl
lea edi, [edx*4]
pop dword [esp + 2]
pushal
bswap ebx
jmp 0x66a606
btc esi, ebx
cpuid
stc
mov byte [esp + 3], dh
lea esp, [esp + 0x13]
lea esi, [esi*4]
jmp 0x66a40b
pop word [esp + 0x25]
mov byte [esp + 0x21], bh
mov al, ah
pushal
lea esp, [esp + 0x52]
sub esp, 0x14
jmp 0x66a42f
cpuid
xchg dh, al
inc ecx
mov dword [esp + 0x2b], esi
cpuid
push edx
jmp 0x66a4ad
mov bp, di
pop word [esp + 0x27]
pop dword [esp + 0x18]
mov ebp, 0x308e28ba
mov word [esp + 0x1e], sp
push edx
jmp 0x66a50f
push dword [esp + 0xa]
xchg dh, al
mov ax, bx
not di
mov si, sp
mov bx, 0x6db1
jmp 0x66a5de
Function at 0x66acaa
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc ebp, ebx
mov byte [esp + 6], ah
lea esp, [esp + 0x17]
pop bx
push esp
lea esp, [esp + 7]
jmp 0x66acd2
inc bl
xchg ah, bl
lea ebp, [edx + edi]
cmc
not ebp
rdtsc
jmp 0x66acac
jmp 0x66ac80
lea esi, [esi*4]
xchg word [esp + 1], cx
mov ch, byte [esp + 1]
mov cx, bx
cpuid
stc
jmp 0x66ace5
rcr ch, 5
btr ecx, esp
bswap edi
push edx
pop word [esp + 1]
xchg byte [esp], dl
jmp 0x66ac94
sub esp, 0xc
mov dword [esp + 5], ecx
not cx
xchg word [esp + 9], bp
jmp 0x66af02
rdtsc
rcr ebp, 0x11
bsr bp, cx
lea edx, [edx + ebx]
xchg byte [esp], dl
mov bp, word [esp]
jmp 0x66adbe
mov bl, 0x70
not ebp
lea esp, [esp + 0x12]
add esp, 4
cpuid
mov byte [esp], dh
jmp 0x66ad15
xchg byte [esp], cl
lea esp, [esp]
btr edx, edx
mov dl, dh
xchg ebx, eax
cld
jmp 0x66ad6a
rdtsc
mov di, sp
add esi, ebp
btc edi, edi
setbe ah
neg ah
jmp 0x66ad43
not bx
mov dx, word [esp]
setle bh
sub esp, 0xe
btr ebx, edx
add ax, 0x1a96
jmp 0x66ad9a
btr ecx, esp
lea esp, [esp]
bswap eax
bswap ecx
btc ebx, edi
sub bl, ah
jmp 0x66ad59
pushal
and cl, bh
lea esp, [esp + 0x26]
mov word [esp + 4], di
pop ax
mov dword [esp], eax
jmp 0x66ae0c
mov dx, word [esp]
mov si, word [esp]
bsf ax, si
cmc
btc ebp, edi
lea esi, [eax*4]
jmp 0x66ad89
mov bx, di
mov bl, bh
xchg bh, cl
xchg si, ax
mov ebp, 0x47ee5be8
neg esi
jmp 0x66aebc
mov bp, di
xchg bh, cl
sete ch
xchg edx, edi
bsf di, si
mov word [esp], bx
jmp 0x66add7
inc ebx
neg ch
xchg bh, cl
mov dh, byte [esp]
rdtsc
cpuid
jmp 0x66adf0
cpuid
inc ax
lea edx, [esi*4]
sub esp, 8
mov byte [esp + 0x11], bh
xchg dword [esp + 2], eax
jmp 0x66ad31
lea esp, [esp]
cpuid
mov bx, 0x5993
cpuid
sub esp, 0xe
jmp 0x66aea4
sete dh
xchg esi, ebp
lea esp, [esp + 1]
and esi, ecx
bswap edx
stc
jmp 0x66ae46
push word [esp + 0xc]
lea ebp, [ecx + edx]
add esp, 0xd
xor dl, ch
bswap ebx
lea ebp, [edi + ebp]
jmp 0x66ae5c
lea edx, reloc.RASAPI32.dll_RasHangUpA
lea esp, [esp]
mov bx, 0x5515
setnp dh
jmp 0x66aeeb
mov dword [esp + 1], eax
btr edx, edx
and ebx, ecx
bswap ecx
lea ebx, [edx + edi]
pop di
jmp 0x66ae8e
mov di, bx
push esp
stc
xchg ah, bl
mov byte [esp + 5], ch
push word [esp + 0xa]
jmp 0x66ae7a
lodsb al, byte [esi]
lea esp, [esp]
bsr di, cx
setne bh
mov si, 0x6427
xchg word [esp], bx
xchg bh, cl
jmp 0x66afdf
xchg dword [esp + 6], ecx
not esi
lea esp, [esp + 8]
mov dh, byte [esp + 1]
pop ax
jmp 0x66aece
add esp, 1
bsf cx, si
cpuid
xchg ebp, eax
xchg dword [esp + 9], eax
lea eax, [esi - 0xe5]
jmp 0x66ae2b
lea ecx, [edx + edi]
lea esp, [esp + 1]
lea esp, [esp + 8]
popal
stc
call fcn.0066afa9
ficomp dword [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
mov ebx, 0x4a2fbf38
mov ecx, 0x6901625
popal
nop
jns 0x66aecd
sbb al, 0x6f
mov eax, ebp
mov cx, 0xbf8f
push esp
sub bl, ah
btr ecx, esp
cpuid
jmp 0x66af1b
setg bh
lea ebx, [esi*4]
push edx
not cx
pop bp
btr ebx, edx
jmp 0x66af42
mov dl, dh
neg bp
rol cx, cl
cld
mov ch, byte [esp]
inc al
jmp 0x66af65

Function at 0x66f9d7
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
pop dword [esp]
push esp
push dword [esp + 6]
mov dword [esp + 0x58], edi
lea esp, [esp + 0x58]
push dword [esp]
mov dword [esp + 1], ecx
jmp 0x66f9a2
Function at 0x430840
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4962fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048a8dd
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4308c2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004886fd
mov eax, dword [eax]
push 0x4af244
push eax
call fcn.0047a8a4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0048ab68
test bl, bl
je 0x4308c2
push 0x4af244
lea ecx, [esp + 0xc]
call fcn.0048aef8
push 0x4b2dbc
lea ecx, [esp + 0xc]
call fcn.0048aef8
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4308fe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0048ab68
jmp 0x4309c9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x430982
lea edx, [esp + 0x7c]
push 0x4b2db8
push edx
call fcn.0047a8a4
add esp, 8
test eax, eax
je 0x430982
lea eax, [esp + 0x7c]
push 0x4b2db4
push eax
call fcn.0047a8a4
add esp, 8
test eax, eax
je 0x430982
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x430912
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0048ab68
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4311c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x431222
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc