joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409470
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00409424
test al, al
jne 0x409491
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4094dd
xor eax, eax
push ebp
push 0x4094cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4094d4
lea eax, [ebp - 0xc]
call fcn.00409460
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4099b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409a0a
inc esi
xor edi, edi
cmp edi, 1
jne 0x4099d6
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4099e4
cmp edi, 1
jle 0x4099e4
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00409470
test eax, eax
jne 0x409a0a
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409a0a
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409a0a
inc edi
dec esi
jne 0x4099c6
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x409a14
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x409a61
xor ebx, ebx
jmp 0x409a56
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.004050c8
test eax, eax
jne 0x409a55
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x409b11
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409a37
mov al, byte [ebp - 1]
sub al, 1
jb 0x409a6c
je 0x409a75
jmp 0x409a7e
call fcn.004074d8
mov edi, eax
jmp 0x409a80
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x409a80
xor edi, edi
test di, di
je 0x409b11
xor ebx, ebx
jmp 0x409abc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x409abb
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409ab0
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x409abb
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409b11
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409a8d
xor ebx, ebx
jmp 0x409b06
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x409b05
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409afa
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x409b05
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409b11
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409acb
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x508b46
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x4ef2bf
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x4ef2d9
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x4ef2c8
pop esi
jmp 0x4ef2e4
ret 4
jmp 0x4ef2b2
Function at 0x51fa43
Capabilities:
Encrypt data using aes

Disassembly:
stc
mov dword [esp + 4], edx
lea esp, [esp + 4]
popal
jmp 0x51fa8a
pushal
mov dword [esp + 0x1c], edi
clc
popal
jmp 0x51fabf
and edi, esi
mov ebp, 0x6119da68
clc
push eax
jmp 0x51fa71
lea ebp, [edi*4]
mov bp, 0xb2b9
bsr ebp, ebx
mov ebp, 0x94ecdbba
jmp 0x51fad8
lea eax, [eax*4]
lea eax, reloc.USER32.dll_GetParent
mov edi, dword [eax]
pop eax
lea ebp, [edi*4]
jmp 0x51fa95
add ebp, 0x6b142346
and edi, ebp
jmp 0x51fb18
lea esp, [esp + 0x10]
xor eax, dword [ecx]
mov di, 0xf89b
jmp 0x51fb5b
xor eax, edi
bswap edi
jmp 0x51fb02
mov dword [edi], eax
setno al
jmp 0x51fb81
lea edi, [ecx + 0x10]
pushfd
xor ebx, eax
jmp 0x51fb45
mov eax, dword [ecx + 8]
xor eax, ebx
call fcn.0051fb63
mov dword [esp + 0x30], edi
lea esp, [esp + 0x14]
popal
jmp 0x51fbc6
mov di, cx
jmp 0x51fbf5
mov edx, dword [eax + 0xc]
mov ch, 0x3d
xchg di, cx
mov ecx, edx
jmp 0x51fbaf
shr ecx, 8
call fcn.0051fbd2
shr edi, 0x10
stc
push ecx
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x51fc55
lea edx, [edx*4]
lea edx, reloc.USER32.dll_GetParent
mov edi, dword [edx]
pop edx
jmp 0x51fc99
and edi, esi
push edx
mov edx, edi
jmp 0x51fc3f
and edx, esi
jmp 0x51fc83
xor ecx, edi
mov edi, edx
sub esp, 0xc
mov dword [esp + 7], esp
push dword [esp + 3]
jmp 0x51fc5c
mov edx, dword [edx*4 + reloc.USER32.dll_GetParent]
call fcn.0051fcab
xchg dword [edi], ecx
lahf
cli
or edx, edx
and bl, byte [ebp - 0x54]
mov edi, 0x2024648d
lea esp, [esp + 0x20]
and ecx, 0xff0000
and edi, 0xff000000
jmp 0x51fc72

Function at 0x51fcab
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov byte [esp + 2], al
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x51fd75
bsf di, si
xor ecx, edx
cmp dx, sp
jmp 0x51fd33
xor ecx, edi
clc
and edx, ebp
mov edi, dword [esp]
jmp 0x51fce3
lea edi, [eax + 0x10]
lea edx, reloc.USER32.dll_GetParent
xor ecx, dword [eax]
neg dh
lea edx, [edx + 0xeb]
jmp 0x51fd55
mov dword [edi], ecx
mov dx, 0x3806
jmp 0x51fd3f
lea esp, [esp + 0x14]
xor ecx, dword [ebx]
stc
mov edx, dword [esp]
jmp 0x51fd07
mov edx, dword [eax + 4]
pushal
jmp 0x51fda7
add ebx, 4
mov dl, 0x4f
bsr edx, ebx
pushal
jmp 0x51fd1c
shr edi, 0x18
sub esp, 5
mov word [esp + 2], ax
lea esp, [esp + 1]
movzx edi, byte [edi*4 + 0x4f8318]
jmp 0x51fcfd
lea ebx, [ebx + 0x14]
mov dword [ebx], edx
pop ebx
jmp 0x51fdc4
xor edx, ecx
push ebx
mov ebx, eax
jmp 0x51fd91
mov ecx, dword [ebp]
pop ebp
jmp 0x51fdcc
push ebp
mov ebp, eax
lea ebp, [ebp + 8]
jmp 0x51fdae
xor ecx, edx
push edx
pushal
jmp 0x51fdd6
mov ebx, 0x7435e3
mov cx, word [esp]
mov dword [esp + 0x14], eax
popal
jmp 0x51fe52
xor edx, ecx
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x40]
jmp 0x51fe06
lea edx, [edx + 0x18]
mov dword [edx], ecx
pop edx
mov edx, dword [eax + 0xc]
jmp 0x51fe22
Function at 0x5204e1
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.USER32.dll_GetParent]
mov dh, ch
jmp 0x5204ff
lea esp, [esp + 2]
and edx, ecx
jmp 0x5204cb
push eax
jmp 0x52062d
mov edx, dword [esi + 0xc]
pushal
mov dword [esp + 0x1b], edi
jmp 0x5204e9
shr edi, 0x18
mov edi, dword [edi*4 + reloc.USER32.dll_GetParent]
call fcn.0052052c
mov byte [0x3ccdaa34], al
mov dh, byte [ecx - 0x60dc2f4f]
loopne 0x520582
pop edx
mov ch, 0x8b
sbb al, 0x9d
sbb byte [ebx + 0x3c8b004f], al
and al, 0xf7
xlatb
mov ebx, dword [ebx*4 + reloc.USER32.dll_GetParent]
mov edi, dword [esp]
not edi
mov edi, edx
jmp 0x520542
mov ah, 0xd3
popfd
rcr byte [ebx - 0x35], 0xae
pop ebp
cdq
mov esp, 0x7bc43552
or dword [ebp + reloc.USER32.dll_GetParent], ecx
cmp al, 0x9d
sbb byte [edi - 0x49f0ffb1], cl
pop esi
push cs
call fcn.00520571
mov esi, 0xc90eba6f
mov si, 0x3383
mov dword [esp], edx
popal
lea edi, [edi*4]
jmp 0x5205df
lea edi, reloc.USER32.dll_GetParent
mov edx, dword [edi]
pop edi
call fcn.00520608
in al, 0x83
adc esi, dword [esi - 0x7b]
inc ecx
fiadd dword [edx + ebx*8 - 0x43]
dec esp
invalid
mov eax, esi
add eax, 8
mov dword [eax], edi
pop eax
jmp 0x520561

Function at 0x52066c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push dword [esp + 0x13]
push dword [esp + 0x27]
jmp 0x5206e0
mov dword [ebp], edi
pop ebp
lea esp, [esp + 0x2c]
jne 0x4ed771
je 0x4ed787
cmp dword [ebp + reloc.USER32.dll_GetParent], edi
or dword [esi + reloc.USER32.dll_GetParent], ecx
lahf
out 0x11, al
nop
push ebp
mov ebp, esi
lea ebp, [ebp + 0xc]
jmp 0x5206bc

Function at 0x521954
Capabilities:
Encrypt data using speck

Disassembly:
cmp edi, 0x34
jmp 0x521956
call 0x52199e
lea esp, [esp + 4]
jae 0x4edc80
jb 0x52196c
ror byte [edx + eax*8 - 0x5b], 0x54
in al, 0x59
mov eax, 0xe8ebf29b
jmp 0x52193e
jmp 0x52193e
jae 0x4edc96
mov ecx, 0x58f5b139
setle ch
jmp 0x521996
lea ecx, [edi + 0x41]
jmp 0x4edc6a

Function at 0x521a07
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
call fcn.00521aa6
loope 0x5214bc
adc bl, ah
push edx
cmpsd dword [esi], dword es:[edi]
and dh, byte [eax - 0x1c1edd29]
sbb dh, byte [ebp + 0x64]
xchg edi, eax
cmp ebx, eax
pushfd
jmp 0x521a6d
lea esp, [esp + 4]
jmp 0x521a25
jae 0x521459
lea ecx, [ebx + 0x47]
jmp 0x5214f8
lea ecx, [ebx - 4]
jmp 0x5214f8
lea esp, [esp + 4]
jae 0x521443
jb 0x521a57
push 0xff0c65f5
cmp al, 0x7a
out 0x74, al
adc ebp, esi
sub al, 0x97
dec cl

Function at 0x5d0c7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, 0x84
push word [esp + 6]
jmp 0x5d148b
bswap edx
add esp, 4
xchg byte [esp + 1], ah
mov edx, dword [esp]
add esp, 2
mov cl, byte [esp]
jmp 0x5d0dad
mov dword [esp], ebp
setl bh
bswap edi
rdtsc
mov bx, word [esp]
rcr dx, 7
jmp 0x5d0e9e
rdtsc
lea edx, [ecx*4]
bsr cx, sp
std
pop bp
xchg byte [esp], cl
jmp 0x5d100d

Function at 0x5d0d7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc cl
xchg dl, al
std
lea ecx, [ebp*4]
jmp 0x5d0e10
add esp, 0
sbb bp, 0xa2d1
rdtsc
xchg word [esp + 3], cx
xchg byte [esp + 5], cl
mov dword [esp + 2], ebp
sub esp, 0xb
mov byte [esp + 5], cl
setle bl
cmc
jmp 0x5d0de3
Function at 0x5d10eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [edx + ebx]
xchg word [esp + 0xa], si
mov edi, eax
bt si, cx
pop word [esp + 8]
jmp 0x5d10cd

Function at 0x5d129d
Capabilities:
Execute anti-debugging instructions

Disassembly:
not di
mov byte [esp + 9], cl
xchg dword [esp + 9], eax
push word [esp + 0x10]
pop eax
jmp 0x5d1271

Function at 0x5d15fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop cx
jmp 0x5d1602
std
xchg ebx, ecx
cpuid
cmc
sub esp, 0x1b
lea esp, [esp + 0x52]
jmp 0x5d1635
lea esi, [ebx*4]
pop ebp
cmp di, 0xdb06
xchg dx, si
jmp 0x5d1645
pushal
rdtsc
mov bh, dl
xchg word [esp + 0x1d], dx
bswap eax
xchg edi, ebx
jmp 0x5d161f
bsr cx, bp
pop bx
mov byte [esp], ch
std
push word [esp + 2]
pop ebx
jmp 0x5d168b
push edx
xchg byte [esp + 1], al
xchg bp, dx
mov esi, dword [esp + 0xa]
bswap ecx
mov ch, bl
jmp 0x5d16bb
mov ebp, 0x71c8731b
neg al
lea esi, [ebx + ebp]
xchg bl, ch
rdtsc
pop di
jmp 0x5d1674
mov ax, 0xfddc
bt eax, esp
add cl, cl
mov edx, dword [esp]
mov al, 0x57
rdtsc
jmp 0x5d16ed
setns bl
dec ax
add esp, 0x19
mov cx, 0x3bd0
mov ah, 0xa1
not bl
jmp 0x5d169d
bswap eax
btc dx, sp
xchg esi, eax
mov edx, ebp
dec ch
mov al, 0xaf
jmp 0x5d16fd
mov dh, byte [esp]
cpuid
bsf ax, ax
dec di
ror dh, cl
cld
jmp 0x5d16cd
mov dx, word [esp]
shr cx, 2
mov bl, byte [esp]
lea ebx, reloc.USER32.dll_GetParent
mov edi, dword [esp]
jmp 0x5d1b03
lea esp, [esp + 1]
lea esp, [esp + 0xc]
popfd
jmp 0x5d17ad
sub esp, 5
push word [esp + 2]
push dword [esp + 3]
pop word [esp + 5]
push dword [esp + 7]
stc
jmp 0x5d1732
push 0x46e2d5db
add dword [esp], reloc.USER32.dll_GetParent
call fcn.005d177c
pushal
lea esp, [esp + 0xd]
call 0x5d183d
inc edi
je 0x5d1810
insb byte es:[edi], dx
dec ecx
je 0x5d1836
insd dword es:[edi], dx
add byte [esi], dl
mov byte [esp + 3], bh
lea esp, [esp]
push dword [esp + 4]
lea esp, [esp]
mov word [esp + 2], ax
pop dword [esp]
jmp 0x5d17be
add byte [eax], al
inc edi
je 0x5d1863
jae 0x5d188c
popal
push esp
imul ebp, dword [ebp + 0x65], 0xffba0300
je 0x5d184a
push dword [esp + 0xd]
call 0x5d180d
inc edi
je 0x5d187d
or eax, 0xffffe1e8
inc dword [edi + 0x65]
je 0x5d187d
jae 0x5d18a6
popal
push eax
push eax
outsd dx, dword [esi]
jae 0x5d183a
xchg ebp, eax
add al, 0xb7
pushal
mov dword [esp + 0x1b], esi
lea esp, [esp + 0x10]
pop word [esp + 7]
pop es
jmp 0x5d1823
and al, 3
push word [esp + 8]
call fcn.005d1924
dec ecx
jae 0x5d18c9
imul ebp, dword [esi + 0x64], reloc.USER32.dll_GetParent
and al, 0x1f
push word [esp + 9]
push dword [esp + 9]
pop word [esp + 0xe]
mov byte [esp + 0x11], dh
call fcn.005d184d
pushfd
pushal
jmp 0x5d18ca
invalid
and al, 2
lea esp, [esp + 8]
push 0
call 0x5d188f
pop dword [esp + 3]
push di
push eax
mov dword [esp + 0xc], eax
mov dword [esp], edi
jmp 0x5d18d3
push ebx
push dword [esp + 0x20]
call 0x5d18b4
lea esp, [esp + 0x29]
pop word [esp + 3]
mov byte [esp + 4], cl
pop word [esp + 1]
call fcn.005d1906
retf 0x5465
mov byte [esp], al
xchg bx, si
mov ebx, esi
xchg byte [esp], ch
lea esp, [esp + 1]
popal
jmp 0x5d174e
Function at 0x5d45a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], dx
mov ax, word [esp]
mov ah, byte [esp + 2]
setnp ch
jmp 0x5d4638
cpuid
bswap edi
mov bp, sp
sbb bp, 0x689c
cmc
cld
jmp 0x5d4648
cpuid
setbe ch
cpuid
bswap edi
sub esp, 0x13
mov edi, dword [esp + 8]
jmp 0x5d4604
xchg edx, ebx
mov dh, 0xfb
mov bx, 0x2d5c
inc bl
pushfd
add esp, 7
jmp 0x5d461a
bsr edi, eax
lea esp, [esp + 0xe]
xchg edi, eax
mov ecx, dword [esp + 4]
not bl
mov dl, dh
jmp 0x5d4699
xchg word [esp + 1], si
push dword [esp]
stc
lea ecx, [esi + edi]
pop esi
xchg edi, eax
jmp 0x5d46c2
pop cx
neg si
xchg word [esp + 1], si
std
sub esp, 3
mov bx, ax
jmp 0x5d4683
xchg dword [esp], edx
rdtsc
lea edi, [edx + esi]
mov cl, 0xe
xchg dl, ah
mov byte [esp + 5], bl
jmp 0x5d46fc
std
mov edx, 0xcb770407
std
bswap ebp
lea eax, [ebp - 0xdb]
lea edi, [esp + edx]
jmp 0x5d46ac
mov byte [esp + 1], cl
pop cx
lea ebx, [ebx*4]
bsr bx, ax
push edi
mov bp, 0xdad7
jmp 0x5d49fe
mov ax, dx
mov word [esp + 2], di
not bx
add esp, 2
mov di, 0x740d
mov bx, word [esp + 1]
jmp 0x5d46d6
xchg si, di
push sp
call fcn.005d4747
btr si, si
xchg byte [esp + 0xb], cl
pop di
rdtsc
xchg word [esp + 5], cx
add esp, 9
jmp 0x5d4994
xchg bh, ah
not ebx
lea eax, [ebx*4]
mov ah, bh
mov ax, word [esp + 4]
xchg bh, dl
jmp 0x5d475d
bsf bx, dx
rdtsc
mov dx, word [esp + 2]
pop edx
cpuid
dec bl
jmp 0x5d47c8
not ax
cpuid
bsf ebp, edi
dec ah
mov di, cx
mov ax, word [esp + 3]
jmp 0x5d479e
cpuid
lea edx, [ecx + edi]
mov di, 0x82de
mov eax, 0xa80f2ea8
mov si, bx
jmp 0x5d48b5
mov byte [esp + 2], ch
mov ecx, esp
bsr si, si
pop dx
std
bswap eax
jmp 0x5d47b4
mov dh, byte [esp]
mov ah, byte [esp]
call fcn.005d47f2
cld
cld
xchg bl, dl
pop dword [esp + 7]
cmc
mov bl, al
jmp 0x5d4887
bt bx, dx
mov byte [esp + 0xf], ah
mov esi, ebp
mov ah, byte [esp + 7]
xchg ebx, esi
jmp 0x5d489a
xchg ecx, ebx
setge bl
std
pop word [esp + 3]
lea esp, [esp + 1]
cpuid
jmp 0x5d4871
lea edx, [ebx*4]
mov dx, cx
pushfd
push dword [esp + 0xc]
xchg dl, ah
mov ah, bh
jmp 0x5d4955
bts ax, dx
mov dx, word [esp]
bswap ebp
mov ch, bh
not dh
cmc
jmp 0x5d4812
btr dx, ax
lea edx, [ecx + edx]
lea esi, [edx*4]
jmp 0x5d48f9
lea ecx, [ecx*4]
mov ch, 0xd3
push dword [esp + 8]
cmc
mov word [esp + 0xf], bx
pop word [esp + 1]
jmp 0x5d48c9
pop dword [esp + 0xa]
bsf esi, eax
mov cx, si
mov esi, ebx
mov word [esp + 2], dx
add esp, 7
jmp 0x5d493a
push eax
setl ch
not si
push si
inc bh
lea esp, [esp + 0x26]
jmp 0x5d48df
cmc
shr al, cl
call fcn.005d4968
and dword [edx + reloc.USER32.dll_GetParent], esi
and dword [edi + reloc.USER32.dll_GetParent], esi
sub al, byte [ebp + 0x66]
mov eax, 0x25be15ed
xchg ecx, eax
invalid
mov ax, 0x15ed
mov esi, 0xe5f09125
not edx
xchg byte [esp + 4], cl
xchg dword [esp + 1], ebx
clc
jmp 0x5d4924
mov dl, 0x12
sub esp, 0x14
mov ax, bp
mov edi, ecx
xchg cl, ch
mov word [esp + 8], sp
jmp 0x5d4913
lea ebx, [ebx + ebp]
bts ebp, esp
dec ax
mov dword [esp], esp
btr ebx, ebp
mov ebp, dword [esp + 4]
jmp 0x5d47e1
xchg bh, ch
cld
xchg edi, ebx
not bp
rdtsc
mov bh, byte [esp + 1]
jmp 0x5d4788
Function at 0x5d4747
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ebx*4]
push dword [esp + 6]
xchg cl, al
jmp 0x5d4767

Function at 0x5d4a4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cx, ax
pop word [esp + 1]
dec al
jmp 0x5d4a90
cpuid
std
mov word [esp + 1], si
mov ax, word [esp]
clc
pop dx
jmp 0x5d4ac9
xchg edx, eax
pushfd
mov byte [esp + 1], bl
mov word [esp], sp
xchg dword [esp + 1], eax
mov eax, ecx
jmp 0x5d4a7a
stc
mov bh, ah
mov eax, 0xcd50ce6b
mov ebp, 0x73d24091
pop dx
not edx
jmp 0x5d4b34
bswap ebp
clc
mov dword [esp], esi
mov dx, word [esp + 5]
xchg dh, ah
bsr ecx, edi
jmp 0x5d4b5e
sub si, sp
mov dword [esp], ebp
cpuid
mov al, bh
bts ax, di
mov bh, 0x3b
jmp 0x5d4b05
push dx
not edi
lea ebx, [ebx + esi]
bsf esi, eax
xchg dword [esp], ebx
mov cx, word [esp + 2]
jmp 0x5d4b1b
std
bswap edi
pop dx
rdtsc
mov cx, 0x7702
xchg edi, ecx
jmp 0x5d4b88
lea esp, [esp + 4]
mov byte [esp], al
bts cx, di
inc edx
sbb cl, 0x37
xchg byte [esp], ah
jmp 0x5d4b48
mov edx, dword [esp]
mov ebp, dword [esp]
xchg edx, ecx
bswap edi
mov ax, bp
sub esp, 9
jmp 0x5d4d5b
mov ebx, dword [esp]
cmc
ror dh, cl
bswap edx
mov bh, byte [esp]
lea edi, [ecx*4]
jmp 0x5d4b72
rcr bh, 2
mov bl, 0x86
inc bp
pop eax
push word [esp + 2]
rcl edi, 0x15
jmp 0x5d4cfa
xchg dword [esp + 4], ebp
pop word [esp + 3]
mov al, byte [esp + 1]
mov esi, 0xc7e04a0b
xchg byte [esp + 3], dh
xchg dx, bp
jmp 0x5d4bb5
mov si, 0x5654
cpuid
mov ax, 0xa09f
mov si, 0x19ed
pop word [esp + 1]
rdtsc
jmp 0x5d4c1e
lea eax, [ecx + esi]
std
add esp, 4
lea ebp, reloc.USER32.dll_GetParent
lea esp, [esp]
sub esp, 0xa
jmp 0x5d4c58
lea edx, reloc.USER32.dll_GetParent
xchg dword [esp + 3], esi
not dx
push dword [esp + 5]
pop dword [esp + 4]
btc edi, esi
jmp 0x5d4bdb
Function at 0x5d4eb2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0xa]
pop esi
mov dl, 0x39
lea esp, [esp + 8]
sub esp, 0x1e
jmp 0x5d4eb4
jmp 0x5d4e9c
mov eax, dword [esp + 2]
xchg bl, bh
xchg edi, eax
popal
bswap ecx
setno dh
jmp 0x5d4ed9
mov dl, byte [esp]
mov ch, 0xe6
mov si, word [esp + 1]
cpuid
xchg bp, ax
rdtsc
jmp 0x5d4f55
stc
not ebx
bswap ebp
std
not ebp
add esp, 0
jmp 0x5d4f2b
inc edi
cmp bp, 0xa6f0
cmc
mov ch, 0x85
bswap ebp
rdtsc
jmp 0x5d4f15
lea ecx, [ebx + edi]
add esp, 1
mov ebp, 0xb6cda993
xchg esi, ebp
xchg bl, dl
mov ebx, 0x802301d3
jmp 0x5d4eec

Function at 0x5d50d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 3
mov dword [esp + 3], edi
bsf bp, bx
mov bl, 0x7e
pop esi
jmp 0x5d5349
pop word [esp + 8]
setg cl
cld
push word [esp + 2]
rdtsc
xchg word [esp + 0x18], dx
jmp 0x5d50fd
mov esi, eax
push dword [esp + 0x1f]
xchg ebp, eax
mov ecx, dword [esp]
inc di
bswap esi
jmp 0x5d5113
xor eax, 0x39b08a9a
xchg word [esp + 2], dx
pushal
xchg ch, bl
not dl
mov dword [esp + 5], esi
jmp 0x5d514c
pushfd
mov dword [esp], esi
xchg byte [esp], ah
cld
btc edx, esp
std
jmp 0x5d51b2
lea esp, [esp + 2]
dec ecx
lea esp, [esp]
mov ecx, dword [esp]
mov word [esp], ax
xchg cl, bl
jmp 0x5d5283
and bl, ch
lea esp, [esp + 2]
cld
mov ah, byte [esp + 2]
rdtsc
mov dword [esp], edx
jmp 0x5d5318

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x402000
Capabilities:
Access peb ldr_data

Disassembly:
push 0
push 2
push 0x403068
push 0x403053
call dword [sym.imp.Winmm.dll_mciSendStringA]
cmp eax, 0x107
je 0x40201c
ret
mov edi, edi
mov esi, 0x4020c7
mov edi, esi
push 1
push 0x403086
push 1
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreA]
mov edx, eax
pop ebx
mov ecx, 0x3ab
mov al, byte [esi]
sub al, bl
stosb byte es:[edi], al
inc esi
loop 0x402040
push dword fs:[0x30]
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
cmp word [eax], 0x5a4d
je 0x402066
xor eax, eax
mov dword [0x403099], eax
add esp, 4
ret
Function at 0x409fd0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47ec7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00473c4b
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40a052
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00471b9a
mov eax, dword [eax]
push 0x69e1f0
push eax
call fcn.00464654
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00473ed6
test bl, bl
je 0x40a052
push 0x69e1f0
lea ecx, [esp + 0xc]
call fcn.00474266
push 0x6a1d38
lea ecx, [esp + 0xc]
call fcn.00474266
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40a08e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00473ed6
jmp 0x40a159
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40a112
lea edx, [esp + 0x7c]
push 0x6a1d34
push edx
call fcn.00464654
add esp, 8
test eax, eax
je 0x40a112
lea eax, [esp + 0x7c]
push 0x6a1d30
push eax
call fcn.00464654
add esp, 8
test eax, eax
je 0x40a112
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a0a2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00473ed6
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40a950
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40a9b2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc