joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480a38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 4]
add eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
add eax, 8
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
add eax, 0xc
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4 + 0xc]
shl eax, 0x18
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [edx + ecx*4 + 0xc]
shr edx, 8
or eax, edx
mov dword [ebp - 0x14], eax
xor eax, eax
mov al, byte [ebp - 0x14]
mov eax, dword [eax*4 + 0x503ac4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x503ac4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x503ac4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x18
and eax, 0xff
mov eax, dword [eax*4 + 0x503ac4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
shl eax, 8
mov edx, dword [ebp - 0x1c]
shr edx, 0x18
or eax, edx
xor eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
shl edx, 0x10
mov ecx, dword [ebp - 0x20]
shr ecx, 0x10
or edx, ecx
xor eax, edx
mov edx, dword [ebp - 0x24]
shl edx, 0x18
mov ecx, dword [ebp - 0x24]
shr ecx, 8
or edx, ecx
xor eax, edx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4]
mov edx, dword [ebp - 0x10]
xor eax, dword [edx*4 + 0x503648]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x10], eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4 + 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4 + 0x10]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x14], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4 + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4 + 0x14]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4 + 0xc]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4 + 0x18]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x1c], eax
add dword [ebp - 0xc], 4
cmp dword [ebp - 0xc], 0x28
jl 0x480a84
mov esp, ebp
pop ebp
ret
Function at 0x4b02c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b03f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404b8c
mov dword [ebp - 0x34], eax
fild dword [ebp - 0x34]
fdiv dword [0x4b0404]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.004299d8
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404de4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.00404b8c
mov edx, eax
sub edx, dword [ebp - 0x24]
inc edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.00404de4
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00404bd8
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004b0090
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004b01a8
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.00404f10
mov eax, dword [ebp + 8]
call fcn.00404ddc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x4b03d0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dl, byte [edx + ecx - 1]
xor al, dl
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx - 1], al
inc dword [ebp - 0x20]
dec dword [ebp - 0x30]
jne 0x4b03a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b03fa
lea eax, [ebp - 0x2c]
call fcn.004048d4
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004048f8
ret
Function at 0x4b57c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4b57c8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b59ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4b59d0
mov eax, esi
call fcn.004b33c8
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404928
lea ecx, [ebp - 0x10]
mov edx, 0x4b59e4
mov eax, esi
call fcn.004b33c8
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404928
lea ecx, [ebp - 0x14]
mov edx, 0x4b59fc
mov eax, esi
call fcn.004b33c8
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404928
lea ecx, [ebp - 0x18]
mov edx, 0x4b5a18
mov eax, esi
call fcn.004b33c8
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404928
lea ecx, [ebp - 0x1c]
mov edx, 0x4b5a34
mov eax, esi
call fcn.004b33c8
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404928
lea ecx, [ebp - 0x24]
mov edx, 0x4b5a4c
mov eax, esi
call fcn.004b33c8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00409150
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004095f0
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4b5a64
mov eax, esi
call fcn.004b33c8
mov eax, dword [ebp - 0x28]
call fcn.0045f910
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4b5a74
mov eax, esi
call fcn.004b33c8
mov eax, dword [ebp - 0x2c]
call fcn.0045f910
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4b5a8c
mov eax, esi
call fcn.004b33c8
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004095f0
inc eax
je 0x4b595d
lea ecx, [ebp - 0x34]
mov edx, 0x4b5a8c
mov eax, esi
call fcn.004b33c8
mov eax, dword [ebp - 0x34]
call fcn.004095b4
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040ae18
fstp qword [ebp - 0x3c]
wait
call fcn.0040b17c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4b5978
lea ecx, [ebp - 0x40]
mov edx, 0x4b5a8c
mov eax, esi
call fcn.004b33c8
mov eax, dword [ebp - 0x40]
call fcn.0045f910
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4b5a9c
mov eax, esi
call fcn.004b33c8
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b59c1
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004048f8
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004048f8
ret
Function at 0x4b8ac0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4b8b1a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004b8ab0
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0045e418
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0045e018
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8b21
lea eax, [ebp - 4]
call fcn.004048d4
ret
Function at 0x4de2e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, eax
xor eax, eax
mov dword [esp + 4], eax
xor esi, esi
call fcn.004ddec4
test al, al
jne 0x4de313
mov eax, dword [esp]
push eax
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
jmp 0x4de36b
test ebx, ebx
je 0x4de36b
lea eax, [ebx + 0x3c]
mov eax, dword [eax]
add eax, ebx
mov esi, dword [eax + 0x78]
add esi, ebx
mov ebp, dword [esi + 0x18]
dec ebp
test ebp, ebp
jl 0x4de367
inc ebp
xor edi, edi
mov eax, dword [esi + 0x20]
add eax, ebx
mov eax, dword [eax + edi*4]
add eax, ebx
mov edx, dword [esp]
call fcn.00409a38
test eax, eax
jne 0x4de363
mov eax, dword [esi + 0x24]
add eax, ebx
movsx eax, word [eax + edi*2]
mov edx, dword [esi + 0x1c]
add edx, ebx
mov eax, dword [edx + eax*4]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, ebx
mov dword [esp + 4], eax
inc edi
dec ebp
jne 0x4de32e
mov esi, dword [esp + 4]
mov eax, esi
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x517040
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0xda1000
lea edi, [esi - 0xc0000]
push edi
jmp 0x51705a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x517061
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x517050
mov eax, 1
add ebx, ebx
jne 0x517073
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x517084
jne 0x5170a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5170a3
dec eax
add ebx, ebx
jne 0x517090
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x517068
add ebx, ebx
jne 0x51709f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5170f5
xor ecx, ecx
sub eax, 3
jb 0x5170bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51712a
sar eax, 1
mov ebp, eax
jmp 0x5170c6
add ebx, ebx
jne 0x5170c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x517094
inc ecx
add ebx, ebx
jne 0x5170d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x517094
add ebx, ebx
jne 0x5170e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5170d6
jne 0x5170f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5170d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x517114
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x517106
jmp 0x517056
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x517114
add edi, ecx
jmp 0x517056
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x517132
cmp byte [edi], 0x11
jne 0x517132
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x517137
lea edi, [esi + 0x110000]
mov eax, dword [edi]
or eax, eax
je 0x5171af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15521c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x155398]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x517164
mov ecx, edi
jns 0x517193
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15539c]
or eax, eax
je 0x5171a9
mov dword [ebx], eax
add ebx, 4
jmp 0x517181
call dword [esi + 0x1553ac]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5171e0
cmp al, 0xef
ja 0x5171d3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5171b5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5171c2
mov ebp, dword [esi + 0x1553a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x517214
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x405464
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405722
test bl, 8
mov dword [ebp - 0xc], eax
je 0x4054a3
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42e448], eax
jmp 0x40562d
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x4054bd
test eax, eax
je 0x4055db
test bl, 2
je 0x4055db
mov esi, 0x42a848
push edi
push esi
call fcn.00405ba4
cmp dword [ebp + 8], 0
je 0x4054dc
push 0x40937c
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4054e2
push edi
call fcn.0040567b
cmp byte [edi], 0
jne 0x4054f0
cmp byte [0x42a848], 0x5c
jne 0x4054fb
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x4055d1
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.0040565f
cmp byte [eax], 0
je 0x405541
cmp byte [ebp - 0x1c], 0
je 0x405541
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405557
mov al, byte [esi + 1]
test al, al
je 0x4055b0
cmp al, 0x2e
jne 0x405557
cmp byte [esi + 2], 0
je 0x4055b0
push esi
push ebx
call fcn.00405ba4
test byte [ebp - 0x14c], 0x10
je 0x40557c
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4055b0
push dword [ebp + 0xc]
push edi
call fcn.00405464
jmp 0x4055b0
push dword [ebp - 4]
push edi
call fcn.0040541c
test eax, eax
jne 0x4055a8
cmp dword [ebp - 4], eax
je 0x4055a0
push edi
push 0xfffffffffffffff1
call fcn.00404e8f
push 0
push edi
call fcn.00405a58
jmp 0x4055b0
inc dword [0x42e448]
jmp 0x4055b0
push edi
push 0xfffffffffffffff2
call fcn.00404e8f
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40551f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x4055db
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40562d
cmp dword [ebp - 0xc], esi
jne 0x4055ef
inc dword [0x42e448]
jmp 0x40562d
push edi
call fcn.00405ea8
test eax, eax
je 0x40562d
push edi
call fcn.00405634
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.0040541c
test eax, eax
jne 0x405625
cmp dword [ebp - 4], esi
je 0x4055e7
push edi
push 0xfffffffffffffff1
call fcn.00404e8f
push esi
push edi
call fcn.00405a58
jmp 0x40562d
push edi
push 0xffffffffffffffe5
call fcn.00404e8f
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1377112
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], dh
mov dword [esp], ecx
push edx
call 0x1377112
mov ebx, 0x7ae95066
adc dword [eax], eax
add byte [eax + 0x14], ch
xchg byte [esi], dh
int1
jmp 0x137727e

Function at 0x1377279
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.013772c1
jmp 0x13772ab
cpuid
cpuid
jmp 0x13772e9
rcr ebp, 0x19
js 0x13772d3
sub bp, 0x5f5f
jmp 0x13772fa
ror ch, cl
jp 0x1377280
cpuid
cpuid
xchg bl, ah
jmp 0x13772eb
sub bp, 0x5f5f
jmp 0x13772fa
xchg bl, ah
mov esi, dword [esp + 0x2c]
mov eax, 0xdd30f73f
mov dx, word [esp]
jmp 0x1377286
lea edi, [esp]
cpuid
lea ebp, [ebx + ebp]
xchg bh, ah
setne al
jmp 0x137734c
mov dx, cx
xchg ah, bl
mov ecx, esi
mov bx, 0xabfc
sbb bh, 0xe2
jle 0x137740a
rdtsc
stc
mov edx, dword [esp]
xchg bl, bh
jmp 0x137735e
sub esp, 0xc0
mov ebp, esp
bswap ebx
mov dx, 0xaeaf
jmp 0x1377324
xchg bl, bh
not esi
setne dl
mov bl, 0xb1
jmp 0x13773d3
rdtsc
stc
mov edx, dword [esp]
jmp 0x137735c
lea edx, [edi*4]
jmp 0x137739a
lea edx, [edi*4]
sub esi, 0x5c420712
bswap edx
xchg dl, al
xchg bl, dl
jmp 0x13773ac
add esi, 0x3eeb5ab9
rol dl, cl
jmp 0x13773e2
cmc
cmp dx, 0xee1d
jmp 0x13773f0
mov ebx, esp
xchg al, dh
mov al, byte [esp]
bsr ax, sp
jno 0x1377393
jo 0x137737d
jb 0x13773ba
cmc
cmp dx, 0xee1d
jmp 0x13773f0
xor esi, 0x6a52cbf7
mov ax, word [esp]
xchg bx, dx
not ax
xchg ebx, eax
jmp 0x1377447
jmp 0x1377375
mov dx, 0x8017
rdtsc
push sp
call fcn.01377425
lea esp, [esp + 1]
jmp 0x13774ca

Function at 0x13772c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf1368614
pop word [esp + 3]
lea esp, [esp + 2]
mov dword [esp], edi
pushfd
jmp 0x1377119

Function at 0x137731b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], ebp
call 0x1377188

Function at 0x1377425
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bx, ax
mov ax, di
mov ebx, 0xd81a52ca
jmp 0x137742e
lea esp, [esp + 2]
rol esi, 0
jmp 0x137740f
add esi, dword [edi]
mov ah, 0xa7
pushal
sub esp, 0x11
je 0x137746a
lea esp, [esp + 1]
jmp 0x13774ca
jmp 0x1377454

Function at 0x137762d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
inc dx
jmp 0x1377637
jno 0x1377615
setbe ah
bsr eax, esi
jmp 0x1377645
mov ah, byte [esp]
sete dl
mov dx, word [esp]
jmp 0x1377625
Function at 0x1379615
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
mov word [esp], di
push edx
jmp 0x137964e
pop word [esp + 6]
lea esp, [esp + 2]
mov dword [esp + 0x10], ebx
pushfd
mov dword [esp + 0x10], esp
call fcn.01379638
xchg ebp, eax
pop es
xchg edi, eax
add esp, ecx
sub eax, 0xb8492eb8
jnp 0x1379687
test byte [edi], dh

Function at 0x1379696
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
mov word [esp], sp
jmp 0x1379680

Function at 0x13797fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ecx
rdtsc
add ah, 0x56
jmp 0x137987b
add ebp, 0xf116de3
bswap edx
xchg cx, ax
mov cx, di
call fcn.01379865
inc edx
rcl dword [ecx + 0x30], 0xc3
jbe 0x137983b
ja 0x137983b
mov cx, 0x8e99
ror ebp, 0
lea edx, reloc.WINMM.dll_midiStreamOut
xchg dh, dl
bsr ecx, esi
jmp 0x13798a5
jne 0x13798cc
xchg cx, ax
neg edx
jmp 0x13798b1
xchg cx, ax
Function at 0x1475457
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x14754c9
lea esp, [esp]
pop di
lea edx, [edx*4]
setg bh
bts dx, bx
cpuid
jmp 0x1475542
pop ebp
lea eax, [eax + edi]
lea esp, [esp + 6]
pop word [esp + 0x22]
mov ch, bh
popal
jmp 0x14754a6
pop di
bsr bx, si
mov edx, 0xd1047c40
not di
mov cl, ch
jmp 0x147551a
push dword [esp + 1]
pop dword [esp]
std
xchg dword [esp], edx
xchg byte [esp + 1], ch
cpuid
jmp 0x14754db
cld
mov ebp, dword [esp]
mov byte [esp], bh
mov ax, 0x7187
shr edx, cl
mov ch, byte [esp]
jmp 0x147556b
lea edx, [ebx*4]
xchg byte [esp + 1], cl
clc
lea edi, [edx*4]
xchg cx, si
add esp, 2
jmp 0x1475504
bswap ebx
rdtsc
mov dword [esp], esi
xchg byte [esp + 2], al
add esp, 0
rdtsc
jmp 0x14754f1
mov bh, 0x62
mov ebp, esi
lea ebx, [eax*4]
jmp 0x1475580
xchg byte [esp], dh
xchg bp, bx
xchg byte [esp], dh
mov ebx, dword [esp]
neg cx
mov si, word [esp]
jmp 0x1475554
lea ecx, [ebp*4]
mov di, 0xd454
lea ebp, [eax + ecx]
mov byte [esp], ah
mov bx, word [esp]
xchg dh, dl
jmp 0x14755e2
mov dx, si
dec bh
mov dh, 0x44
xchg dl, dh
lea esp, [esp]
lea esi, [edi*4]
jmp 0x14755f8
lea esi, [eax + ebx]
lea eax, [ebx + ebx]
rdtsc
lea eax, [esi*4]
mov dl, cl
mov eax, dword [esp]
jmp 0x14755ba
mov byte [esp], dl
lea edi, [ebp*4]
inc ah
not bp
jmp 0x14756a6
setle cl
add esp, 7
setp bh
lea edi, [edx + edi]
mov cx, dx
jmp 0x147565d
mov al, dh
pop ebx
bswap ebp
mov cx, word [esp + 0xb]
rcr di, cl
not bh
jmp 0x1475620
stc
mov edx, dword [esp + 3]
mov al, 0xa3
xchg ah, dl
mov dword [esp], edi
clc
jmp 0x1475689
mov esi, dword [esp + 1]
mov bp, sp
xchg dl, al
cpuid
push word [esp + 1]
xchg byte [esp + 4], ch
jmp 0x1475647
add esp, 2
lea edx, [ecx + 0x4b]
xchg ecx, edi
mov dl, byte [esp + 2]
jmp 0x1475706
xchg ch, bl
shr ah, cl
std
bsf bp, ax
pop bp
rol bp, 6
jmp 0x1475673
mov ax, 0xb163
mov si, sp
bts edi, ebx
clc
sub esp, 0xf
mov ebp, 0xdab94f80
jmp 0x1475636
rdtsc
mov ebp, edi
push si
mov byte [esp + 2], ch
rdtsc
jmp 0x14756e5
dec eax
not al
add esp, 1
xchg al, dl
bts bp, bx
xchg bp, di
jmp 0x14756be
mov ebp, 0xbdc6a9ae
rdtsc
mov dl, 0xd0
mov dword [esp], esi
call fcn.01475733
mov eax, 0x3fcca535
fild qword [edx + 0x2ed3b426]
invalid
mov di, 0x13b3
mov byte [esp], cl
bsr cx, sp
mov edi, 0x11d76e35
mov byte [esp + 1], cl
cmc
jmp 0x14756d4

Function at 0x1475c4f
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 3]
mov dword [esp + 0x1c], ebp
pushal
mov dword [esp + 0x38], esi
call 0x1475c51
push esi
rol dword [eax - reloc.WINMM.dll_midiStreamOut], 0xaa
jmp 0x1475c39
call 0x1475d00
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
mov eax, dword fs:[0x30]
jmp 0x1475cc6
jmp 0x1475c39
mov eax, dword [eax + 8]
push eax
jmp 0x1475032
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x1475ca8
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, 0x5e600d
call fcn.00403138
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40102a
xor eax, eax
jmp 0x401030
mov eax, dword [ebp - 4]
and eax, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401040
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
mov ecx, 0x5e600d
call fcn.00403138
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x24]
cmp eax, 9
je 0x401078
movzx ecx, word [ebp - 0x24]
cmp ecx, 6
je 0x401078
mov dword [ebp - 0x68], 0
jmp 0x40107f
mov dword [ebp - 0x68], 1
mov eax, dword [ebp - 0x68]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401090
Capabilities:
Create thread
Delete file
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov ecx, 0x5e600d
call fcn.00403138
mov dword [ebp - 0x20], 0x5e4870
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00401e40
add esp, 8
push 0x5e4040
call fcn.00401900
add esp, 4
push 0x5e404c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
push 0x401830
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
push 0x402140
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401148
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40111e
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10