joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438371
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x128
xor ebx, ebx
push ebx
push esi
mov edi, ecx
call fcn.00425a60
add esp, 0xc
push 0x104
push dword [edi + 0xc]
lea eax, [esi + 0x22]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [edi + 4]
cmp eax, dword [0x44350c]
je 0x438478
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4383e1
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
jne 0x4383e8
cmp ebx, ebx
jne 0x4383e8
xor eax, eax
jmp 0x43847b
mov edi, dword [edi + 0xc]
cmp dword [edi - 0xc], ebx
jne 0x4383f5
mov byte [esi + 0x20], bl
jmp 0x438409
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete cl
dec cl
and ecx, eax
mov byte [esi + 0x20], cl
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00423955
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.00423955
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.00423955
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x438464
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x438478
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x43907d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x451944]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, 0x100
cmp esi, eax
ja 0x4390cc
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x4390cc
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4390d8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.00424061
leave
ret 8
Function at 0x439ce5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x451944]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x439d32
push dword [ebp + 8]
call fcn.0043ba32
mov esi, eax
test esi, esi
je 0x439d5a
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x439d5a
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x440ddc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.00424061
leave
ret 0xc

Function at 0x43a65e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0xc], 0x800
mov eax, dword [0x451944]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
jne 0x43a6bc
push 0x441d24
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.004254a8
add esp, 0x10
cmp eax, 0xffffffff
je 0x43a6d0
cmp eax, esi
jae 0x43a6d0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x43a6d2
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x43a687
jmp 0x43a6d3
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.00424061
leave
ret
Function at 0x43a6f3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x451944]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x43a795
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x43a897
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x43a845
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocString
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43a898
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43a83a
cmp dword [ebp - 0x24], 1
jne 0x43a83a
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x441d34
push eax
call fcn.00425607
add esp, 0xc
cmp eax, 1
jne 0x43a83a
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43a898
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x43a898
lea ecx, [ebp - 0x18]
push ecx
push 0x43a6dd
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x43a898
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x43a8be
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.0043a65e
cmp eax, ebx
pop ecx
pop ecx
jne 0x43a8c0
inc edi
cmp edi, esi
jl 0x43a8a7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00424061
leave
ret 4
Function at 0x43a8cf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x450994
je 0x43a98b
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43a973
mov esi, dword [ebx + 4]
jmp 0x43a96d
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43a95d
cmp dword [ebp - 0xc], 4
jne 0x43a95d
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x43a955
or dword [eax + 0x9c], ecx
jmp 0x43a95d
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x43a921
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x43a904
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x43ad79
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x43f04e
call fcn.0042563c
sub esp, 0x11c
mov eax, dword [0x451944]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x43ae72
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x43ae46
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00401eb0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0043ad79
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401740
test bl, bl
jne 0x43ae46
or dword [ebp - 4], 0xffffffff
jmp 0x43adb7
cmp esi, 0x103
je 0x43ae56
cmp esi, 0x3f2
jne 0x43ae66
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.00424061
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43c0a2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x43c0d7
cmp edi, dword [esi + 0xc]
jge 0x43c0d7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43c0d7
cmp edi, dword [eax + 8]
jge 0x43c0d7
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x43c0d9
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x43c1e4
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x43c218
jmp fcn.00431363
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x43c289
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x43c382
cmp eax, dword [edi + 0xc]
jge 0x43c382
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x43c2da
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x43c36b
cmp dword [ebp + 0xc], ebx
je 0x43c36b
jmp 0x43c304
push 0x10
call fcn.0043bf6e
cmp eax, ebx
je 0x43c2f0
mov ecx, eax
call fcn.0043c1db
mov esi, eax
jmp 0x43c2f2
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x43c31b
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x43c32b
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x43c33d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00431363
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.00425a60
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x43c37d
cmp ecx, dword [esi + 8]
jge 0x43c37d
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x43c383
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43c441
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43c46f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43c48d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043c3ab
jmp 0x43c48d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43c48d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0043c3ab
test edi, edi
mov eax, edi
jne 0x43c477
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x565aec]
test ecx, ecx
je 0x43c540
jmp 0x43c440
ret 8
Function at 0x1efa38f
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf ax, bx
jo 0x1efa3ac
pop ax
dec dx
lea esp, [esp + 2]
jmp 0x1efa40f

Function at 0x1efa3e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x14
jb 0x1efa3e3
pop word [esp + 6]
lea esp, [esp + 2]
jmp 0x1efa46e
jmp 0x1efa3cb
pop word [esp + 6]
lea esp, [esp + 2]
jmp 0x1efa3f2
mov dx, cx
mov edx, ebp
push eax
jmp 0x1efa42b
lea esp, [esp + 4]
sub bl, 0xa5
or eax, 0x3539eb6b
jo 0x1efa415
jno 0x1efa443
aas
mov al, 0x26
inc ecx
mov al, 7
sub eax, 0x48b663c
and al, 0x8d
adc al, 0xb5
add byte [eax], al
add byte [eax], al
mov ax, word [esp]
lea edx, [esi*4]
rdtsc
jmp 0x1efa456
setle dl
btr ax, si
jmp 0x1efa4da
mov dx, cx
mov edx, ebp
push eax
jmp 0x1efa42b

Function at 0x1efa8da
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
jmp 0x1efa860
rdtsc
lea edx, [ecx - 0x46]
jmp 0x1efa863
lea esp, [esp + 4]
inc bl
neg ah
jle 0x1efa80d
jg 0x1efa815
jmp 0x1efa890
neg ah
jo 0x1efa874
xchg edx, eax
bswap edx
jmp 0x1efa849
mov eax, dword [ebx + edi]
sete bh
mov bx, 0xa975
inc dx
jmp 0x1efa8b2
lea edx, [ecx - 0x46]
and ebx, 0x3c
bts eax, edi
jb 0x1efa83a
mov edx, 0x1c186b7a
mov dh, 0xc3
jmp 0x1efa897
xchg edx, eax
bswap edx
jmp 0x1efa849
mov dl, bh
jmp 0x1efa89c
mov edx, 0x1c186b7a
mov dh, 0xc3
sub esi, 4
jmp 0x1efa83c
mov dword [esi], eax
shr edx, 0x1e
jle 0x1efa8b8
mov edx, dword [esp]
btr eax, edx
sub esp, 2
jmp 0x1efa9b0
jo 0x1efa879
mov dl, bh
jmp 0x1efa89c
mov edx, dword [esp]
jmp 0x1efa8c1
btr eax, edx
sub esp, 2
lea esp, [esp + 2]
jmp fcn.01efa8ff
mov dh, byte [esp + 1]
mov dx, word [esp]
jmp 0x1efa82e
lea esp, [esp + 2]
jmp fcn.01efa8ff

Function at 0x1efa92d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 1], dh
mov ah, bh
cmc
jmp 0x1efa962
jnp 0x1efa97c
and ah, 0x7f
sub esp, 0x14
call 0x1efa9dc
add dword [edx], reloc.KERNEL32.dll_RtlUnwind
test dword [edx], reloc.KERNEL32.dll_RtlUnwind
xor al, cl
jle 0x1efa976
and ah, 0x7f
sub esp, 0x14
neg edx
jmp 0x1efaa5c
sub bl, cl
sub esp, 1
jnp 0x1efaa3c
rdtsc
jmp 0x1efaa26
rdtsc
mov al, byte [esp]
lea esp, [esp + 1]
xchg word [esp + 4], ax
mov byte [esp + 0x11], ah
mov edx, esp
jmp 0x1efa99a

Function at 0x1efb16a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, byte [esp + 3]
lea eax, reloc.KERNEL32.dll_RtlUnwind
Function at 0x1f03237
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0x5b
mov edx, dword [esp + 8]
mov bl, al
mov bl, cl
not bx
xchg bh, bl
jmp 0x1f03285
mov ebp, dword [esp + 4]
mov dx, word [esp]
not edx
mov bx, word [esp]
not bx
jmp 0x1f03221
mov bh, 0x38
mov ebx, dword [esp + 0xe]
lea esp, [esp + 0x14]
jmp 0x1ee955e

Function at 0x1f065ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub ebx, edx
mov esp, ebx
pushfd
jmp 0x1f065b1
push ecx
mov esi, eax
mov edi, ebx
jmp 0x1f065b9
and bl, 0xfc
pushal
jmp 0x1f0658a
lea edi, [edx + ebx - 0x40]
push esi
push edi
jmp 0x1f06591
pushal
not bx
cmc
jae 0x1f065ee
jb 0x1f065f7
in eax, dx
hlt
sub esp, 0xe
jmp 0x1f0663b
sub esp, 0xe
mov cl, 0x16
lea esp, [esp + 2]
mov dword [esp + 0x24], edx
lea esp, [esp + 0xc]
jmp fcn.01f06626
mov cl, 0x16
lea esp, [esp + 2]
mov dword [esp + 0x24], edx
jmp fcn.01f06622

Function at 0x1f07eff
Capabilities:
Encode data using xor

Disassembly:
add ebx, 0xdcca85a8
jmp 0x1f07f34
call 0x1f07c79
push dword [esp + 3]
xchg word [esp + 2], bx
mov bx, ax
push ax
mov word [esp], ax
mov ah, byte [esp]
stc
jmp 0x1f07d70
xchg byte [esp], bh
lea eax, [esp + edx]
push ebp
lea esp, [esp + 2]
jmp 0x1f07d9e
ja 0x1f07d54
xchg byte [esp], bh
lea eax, [esp + edx]
jmp 0x1f07d93
push ebp
lea esp, [esp + 2]
jmp 0x1f07d9e
rol cl, 0
sub esp, 0xa
jae 0x1f07dd5
bsf ax, cx
mov byte [esp + 5], bl
bt ax, ax
jmp 0x1f0831a
mov byte [esp + 5], bl
bt ax, ax
mov al, 0x7d
lea esp, [esp + 2]
jmp 0x1f081fc
bsf ax, cx
jmp 0x1f07dbf
mov ebx, 0x470571f1
lea eax, [eax + ebp]
mov eax, dword [esp]
mov bx, bp
lea ebx, [ebx*4]
jmp 0x1f07e28
lea ebx, [edx + edi]
ror cl, 0
lea ebx, [eax + edx]
mov ah, 0x3b
jmp 0x1f07dfd
xor cl, 0x76
adc bx, 0x395
jns 0x1f0815a
pushal
xchg byte [esp + 0x12], al
jmp 0x1f07edf
jmp 0x1f07e1b
xchg byte [esp + 0x12], al
call fcn.01f07e76
mov ebx, dword [ebx + reloc.KERNEL32.dll_RtlUnwind]
mov eax, edx
jmp 0x1f07f15
call 0x1f07ee4
mov ah, bl
lea eax, [esi*4]
bsr ax, bx
jmp 0x1f07f4f
setle ah
lea eax, [eax + edx]
call 0x1f07eff
sub byte [eax + 0x62a05136], ah
push esi
fisttp qword [ebp + 0x14]
out 0x50, eax
mov al, byte [0x36dbbc2e]
mov edi, 0xc37cf886
clc
jl 0x1f07efa
jge 0x1f07efa
lea eax, reloc.KERNEL32.dll_RtlUnwind
pushfd
jmp 0x1f08054
cmp al, 0xb1
and dword [eax - 0x4d], eax
push es
xor byte [ebx], dh
sub al, byte [ebp - 0x48]
mov al, 0x5d
mov edx, dword [edi + eax*4]
add al, 0x24
mov eax, 0x148b5db0
xchg dword [esp], eax
stc
stc
call 0x1f07f39
cli
jbe 0x1f07f45
cmp dword [esi - 0x38], reloc.KERNEL32.dll_RtlUnwind
push cs
mov al, 0xbd
jmp 0x1f06d93
xchg dword [esp + 8], eax
bt eax, edx
sbb eax, esp
lea eax, [eax + ecx]
push dword [esp + 8]
ret 0xc
pushal
jmp 0x1f07edb
lea esp, [esp + 0xc]
not cl
xchg ebx, eax
dec eax
jnp 0x1f07e48
lea ebx, [edx + edi]
jmp 0x1f07e1e
mov al, 0x7d
lea esp, [esp + 2]
jmp 0x1f081fc
Function at 0x746d7c8a
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 8]
mov ebx, ecx
call fcn.746d9762
mov edi, eax
test edi, edi
jne 0x746d7cab
mov eax, 0x80004005
jmp 0x746d7d57
push esi
mov esi, dword [ebp + 0xc]
cmp word [esi], 0x30
jne 0x746d7d51
cmp word [esi + 0x10], 0x17
ja 0x746d7d51
cmp word [esi + 0x12], 0x3b
ja 0x746d7d51
xor eax, eax
mov ax, word [esi + 4]
push eax
xor eax, eax
mov ax, word [esi + 8]
push eax
xor eax, eax
mov ax, word [esi + 6]
push eax
call fcn.746f1383
test eax, eax
je 0x746d7d51
test byte [esi + 0x1c], 1
je 0x746d7d11
xor eax, eax
mov ax, word [esi + 0xa]
push eax
xor eax, eax
mov ax, word [esi + 0xe]
push eax
xor eax, eax
mov ax, word [esi + 0xc]
push eax
call fcn.746f1383
test eax, eax
je 0x746d7d51
mov eax, dword [esi + 0x14]
test eax, eax
ja 0x746d7d1e
cmp dword [esi + 0x18], 0
jbe 0x746d7d23
cmp dword [esi + 0x18], eax
jae 0x746d7d51
mov eax, dword [esi + 0x20]
test eax, eax
je 0x746d7deb
cmp eax, 1
je 0x746d7dda
cmp eax, 2
je 0x746d7db4
cmp eax, 3
je 0x746d7da2
cmp eax, 4
je 0x746d7d5d
jle 0x746d7d51
cmp eax, 7
jle 0x746d7deb
mov eax, 0x80070057
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ax, word [esi + 0x24]
cmp ax, 1
jb 0x746d7d51
cmp ax, 5
ja 0x746d7d51
mov cx, word [esi + 0x26]
test cx, cx
je 0x746d7d51
cmp cx, 0x7f
ja 0x746d7d51
mov cx, word [esi + 0x28]
test cx, cx
je 0x746d7d51
cmp cx, 0xfff
ja 0x746d7d51
mov word [edi + 0x24], ax
mov ax, word [esi + 0x26]
mov word [edi + 0x26], ax
mov ax, word [esi + 0x28]
mov word [edi + 0x28], ax
jmp 0x746d7deb
push esi
call 0x746d6a5e
test eax, eax
je 0x746d7d51
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
jmp 0x746d7d98
mov ax, word [esi + 0x24]
test ax, ax
je 0x746d7d51
mov cx, word [esi + 0x26]
test cx, cx
je 0x746d7d51
cmp cx, 0x7f
ja 0x746d7d51
mov word [edi + 0x24], ax
mov ax, word [esi + 0x26]
mov word [edi + 0x26], ax
jmp 0x746d7deb
mov ax, word [esi + 0x24]
test ax, ax
je 0x746d7d51
mov word [edi + 0x24], ax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov ax, word [esi]
mov word [edi], ax
mov ax, word [esi + 4]
mov word [edi + 4], ax
mov ax, word [esi + 6]
mov word [edi + 6], ax
mov ax, word [esi + 8]
mov word [edi + 8], ax
mov ax, word [esi + 0xa]
mov word [edi + 0xa], ax
mov ax, word [esi + 0xc]
mov word [edi + 0xc], ax
mov ax, word [esi + 0xe]
mov word [edi + 0xe], ax
mov ax, word [esi + 0x10]
mov word [edi + 0x10], ax
mov ax, word [esi + 0x12]
mov word [edi + 0x12], ax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
and word [edi + 0x1c], 0x8000
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
and eax, 0x7fff
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x44]
and eax, 0xdfbfffff
or eax, 0x90000000
push 0
mov ecx, ebx
mov dword [ebx + 0x44], eax
call 0x746d66db
xor eax, eax
jmp 0x746d7d56