joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c4f64
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x5c4f92
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x5c4f99
cmp ebx, dword [eax + 4]
jae 0x5c4f99
xor eax, eax
jmp 0x5c5189
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x5c4faa
xor eax, eax
inc eax
jmp 0x5c5188
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x5c4fc0
cmp ecx, edx
jae 0x5c5105
cmp dword [eax + 4], 0
je 0x5c4fc9
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x5c4fb1
cmp dword [ebp + 8], 0
je 0x5c4feb
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x5c5105
cmp eax, esi
jae 0x5c5105
mov eax, dword [0x10042560]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x5c5010
cmp dword [esi*4 + 0x10042568], edi
je 0x5c5109
inc esi
cmp esi, eax
jl 0x5c4ffe
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x100300e8]
test eax, eax
je 0x5c5185
cmp dword [ebp - 8], 0x1000000
jne 0x5c5185
test byte [ebp - 0xc], 0xcc
je 0x5c508e
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x5c5185
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x5c5185
cmp word [eax + 0x18], 0x10b
jne 0x5c5185
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x5c5185
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x5c508e
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x5c508e
test byte [ecx + 0x27], 0x80
jne 0x5c5105
push 1
push 0x100425a8
call dword [0x100302e8]
test eax, eax
jne 0x5c4fa2
mov ecx, dword [0x10042560]
test ecx, ecx
mov edx, ecx
jle 0x5c50c2
lea eax, [ecx*4 + 0x10042564]
cmp dword [eax], edi
je 0x5c50c2
dec edx
sub eax, 4
test edx, edx
jg 0x5c50b6
test edx, edx
jne 0x5c50f3
push 0xf
pop ebx
cmp ecx, ebx
jg 0x5c50cf
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x5c50e7
lea eax, [edx*4 + 0x10042568]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x5c50d5
cmp ecx, 0x10
jge 0x5c50f3
inc ecx
mov dword [0x10042560], ecx
push 0
push 0x100425a8
call dword [0x100302e8]
jmp 0x5c4fa2
xor eax, eax
jmp 0x5c5188
test esi, esi
jle 0x5c4fa2
mov ebx, dword [0x100302e8]
push 1
push 0x100425a8
call ebx
test eax, eax
jne 0x5c4fa2
cmp dword [esi*4 + 0x10042568], edi
je 0x5c515f
mov eax, dword [0x10042560]
lea esi, [eax - 1]
test esi, esi
jl 0x5c514d
cmp dword [esi*4 + 0x10042568], edi
je 0x5c5149
dec esi
jns 0x5c513d
test esi, esi
jge 0x5c515d
cmp eax, 0x10
jge 0x5c5158
inc eax
mov dword [0x10042560], eax
lea esi, [eax - 1]
jmp 0x5c515f
je 0x5c5177
xor ecx, ecx
test esi, esi
jl 0x5c5177
lea eax, [ecx*4 + 0x10042568]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x5c5165
push 0
push 0x100425a8
call ebx
jmp 0x5c4fa2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5c83a2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035870
push 0x10011a4c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, edx
push 0x1c
lea eax, [ebp - 0x3c]
push eax
push ecx
call dword [0x100300e8]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x5c8439
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x5c8439
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
cmp esi, edi
jb 0x5c8439
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x5c8439
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c87d2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035880
push 0x10011a4c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [0x100300e8]
test eax, eax
je 0x5c8859
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x5a4d
jne 0x5c8852
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ecx], 0x4550
jne 0x5c8852
cmp word [ecx + 0x14], 0
je 0x5c8852
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6f0e76
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
mov byte [esp + 3], ch
lea esp, [esp + 5]
push esp
jmp 0x6f0efc
lea esp, [esp + 1]
mov dword [esp + 0x20], esi
push esp
call fcn.006f0ebf

Function at 0x6f0ebf
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 1], ecx
pop dword [esp]
mov word [esp], dx
jmp 0x6f0ea0

Function at 0x711835
Capabilities:
Encrypt data using aes

Disassembly:
pushal
pop dword [esp + 0x16]
jmp 0x71197d
jmp 0x7116b3
movzx ebx, byte [esi + 0x11]
mov edx, ebp
setl dh
jmp 0x711993
push esp
pushal
lea esp, [esp + 0x11]
lea esp, [esp + 3]
jmp 0x71219a
lea edi, [edi - 8]
mov eax, dword [edi]
pop edi
lea edi, [esi + 0x5d]
bsf di, ax
jmp 0x7116ba
mov eax, edx
push edi
mov edi, edx
jmp 0x71169c
mov di, 0x82e7
mov edi, dword [ecx - 8]
jmp 0x711740
add dword [ebp - 4], 4
cmc
clc
call fcn.00711725
push edx
jmp 0x711874
mov edx, ecx
lea edx, [edx + 4]
mov dword [edx], eax
pop edx
jmp 0x711882
push ebx
mov ebx, edx
lea ebx, [ebx + 4]
jmp 0x7118e5
sub esp, 0x1c
mov dword [esp + 0x17], esi
pop word [esp + 5]
push dword [esp + 6]
lea esp, [esp + 2]
jmp 0x7118f1
add ecx, 0x10
push edx
push dword [esp + 2]
lea esp, [esp + 8]
sub edx, 0x10
jmp 0x7118ac
mov dword [ebx], edi
pop ebx
lea esp, [esp + 0x40]
sub ebx, 4
jmp 0x7118c7
lea esp, [esp + 0x1c]
cmp dword [ebp - 4], ebx
pushal
mov word [esp], dx
push dword [esp + 0x1c]
jmp 0x711925
mov word [esp + 0x10], di
lea esp, [esp + 0x24]
jl 0x6e3ec3
xchg al, ah
mov ax, 0x2acf
jmp 0x7119da
xchg edx, edi
mov dword [ebp - 4], ecx
lea ebx, [ecx + edi]
setg dh
jmp 0x711989
lea esp, [esp + 0x1c]
cmp eax, 1
call fcn.00711952
mov ecx, 0xff
jmp 0x6e3f64
mov ebx, dword [ebx*4 + 0x6edea8]
mov dh, byte [esp]
call fcn.007119bf
in al, dx
bound eax, qword [0x587943f4]
lea esp, [esp + 8]
jle 0x6e3fd2
not bh
mov di, word [esp]
lea ecx, [eax - 1]
jmp 0x71195e
mov al, byte [esp]
mov eax, dword [ebp - 8]
jmp 0x6e3ea3
mov edi, dword [esp + 0x10]
mov bl, 0x5c
lea esi, [ebx*4]
push edx
mov bx, sp
jmp 0x712206
pushal
push edx
lea esp, [esp + 0x1d]
mov word [esp + 3], sp
lea esp, [esp + 3]
jmp 0x7121c5
lea esp, [esp + 0x18]
pop esi
mov bx, 0x4841
pop ebx
jmp 0x7121e8

Function at 0x711948
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esi, [esi - 4]
mov dword [esi], eax
pop esi
not ah
mov eax, dword [edx]
call fcn.007117ab
push word [esp + 1]
push esi
mov esi, ecx
jmp 0x7117d4
stc
pop word [esp]
jmp 0x7117ff
Function at 0x711a26
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
sub esp, 0x12
jmp 0x711ab1
mov ebx, dword [ebx*4 + 0x6edea8]
call fcn.00711acb
and ebx, ecx
sub esp, 0x1a
pop dword [esp + 0x10]
lea esp, [esp + 2]
jmp 0x711b16
lea esp, [esp + 8]
movzx ebx, byte [esi + 2]
sub esp, 0xc
jmp 0x711a55
sub esp, 0xa
mov bx, 0x725b
cmp bx, 0xbb40
pop word [esp + 1]
jmp 0x711a77
push word [esp + 0xd]
lea esp, [esp + 0xb]
lea esp, [esp + 1]
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + 0x6eeaa8]
jmp 0x711a90
lea esp, [esp + 0xc]
movzx ebx, byte [esi + 5]
and edx, ecx
call 0x711afc
mov edx, 0xeb04ec83
insb byte es:[edi], dx
lea edx, [0xa81fec85]
sbb eax, 0x8e731486
dec edx
lodsd eax, dword [esi]
cmp ebp, dword [ebx - 0x6101c232]
jmp 0x24d5a821
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + 0x6ee6a8]
xchg bl, bh
mov bl, 0x3c
sub esp, 0xc
jmp 0x711aec

Function at 0x711acb
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 3
push esp
lea esp, [esp + 1]
jmp 0x711a61

Function at 0x711afc
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
sub esp, 0x12
jmp 0x711ab1
mov ebx, dword [ebx*4 + 0x6edea8]
call fcn.00711acb
and ebx, ecx
sub esp, 0x1a
pop dword [esp + 0x10]
lea esp, [esp + 2]
jmp 0x711b16
lea esp, [esp + 8]
movzx ebx, byte [esi + 2]
sub esp, 0xc
jmp 0x711a55
sub esp, 0xa
mov bx, 0x725b
cmp bx, 0xbb40
pop word [esp + 1]
jmp 0x711a77
push word [esp + 0xd]
lea esp, [esp + 0xb]
lea esp, [esp + 1]
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + 0x6eeaa8]
jmp 0x711a90
lea esp, [esp + 0xc]
movzx ebx, byte [esi + 5]
and edx, ecx
call 0x711afc
mov edx, 0xeb04ec83
insb byte es:[edi], dx
lea edx, [0xa81fec85]
sbb eax, 0x8e731486
dec edx
lodsd eax, dword [esi]
cmp ebp, dword [ebx - 0x6101c232]
jmp 0x24d5a821
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + 0x6ee6a8]
xchg bl, bh
mov bl, 0x3c
sub esp, 0xc
jmp 0x711aec

Function at 0x711dec
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
clc
jmp 0x711e9d
mov edi, dword [edi*4 + 0x6edea8]
clc
call fcn.00711df2
movzx ebx, byte [esi + 0xa]
jmp 0x711f65
mov ebx, dword [ebx*4 + 0x6edea8]
push edx
call 0x711f14
push edx
lea esp, [esp + 0x28]
xor edi, dword [edx*4 + 0x6eeea8]
sub esp, 0x10
jmp 0x711f8d
lea edx, [edx + edi]
mov dx, 0x9201
jmp 0x711fe1
mov edx, dword [esi + 0xc]
call fcn.00711fca

Function at 0x711df2
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop word [esp]
lea esp, [esp + 2]
jmp 0x711e79
push dword [esp + 0x12]
and ebx, ecx
lea esp, [esp + 0x44]
xor edi, dword [ebx*4 + 0x6eeaa8]
jmp 0x711ec1
lea esp, [esp + 2]
mov edi, dword [edi*4 + 0x6ee2a8]
pushal
stc
mov word [esp + 0x10], bx
jmp 0x711e41
and edi, ecx
sub esp, 2
stc
sub esp, 0x14
mov dword [esp + 0xb], eax
jmp 0x711e5d
mov ebx, dword [esp]
sbb bx, 0x9e52
mov bl, byte [esp]
jmp 0x711eaa
Function at 0x711fe9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push esi
jmp 0x71205c
pop esi
clc
sub esp, 0x14
mov byte [esp + 7], dh
pushal
jmp 0x712232
mov esi, edi
lea esi, [esi*4]
lea esi, [esi + 0x6edea8]
mov edi, dword [esi]
jmp 0x712043
cmc
sub esp, 4
push word [esp + 3]
lea esp, [esp + 5]
lea esp, [esp + 1]
jmp 0x712165
movzx ebx, byte [esi + 0xe]
pushal
push dword [esp + 0xe]
mov ebx, dword [ebx*4 + 0x6edea8]
jmp 0x71208b
lea esp, [esp + 0x64]
xor edi, dword [ebx*4 + 0x6eeaa8]
inc bl
lea ebx, [ebp*4]
sub bl, bh
jmp 0x7120ac
mov byte [esp + 0xe], ch
jmp 0x712144
xor edi, dword [ebx*4 + 0x6ee6a8]
sub esp, 0x10
push dword [esp + 2]
jmp 0x7120e5
pushal
sub esp, 0x14
and ebx, ecx
lea esp, [esp + 0x6c]
jmp 0x7120fd
xor edi, dword [edx*4 + 0x6eeea8]
pushal
lea esp, [esp + 0x20]
dec dword [ebp - 4]
pushal
jmp 0x7121b8
and edx, ecx
pushal
push dword [esp + 0x14]
lea esp, [esp + 0x38]
jmp 0x712120
and edx, ecx
sub esp, 0x16
lea esp, [esp + 2]
mov edx, dword [edx*4 + 0x6edea8]
jmp 0x712114
mov byte [esp + 0xb], ch
mov dword [esi + 0xc], edi
push edx
call fcn.00712197
lea esp, [esp + 4]
leave
push esp
pop word [esp]
lea esp, [esp + 2]
jmp 0x712212
ret
and edi, ecx
mov edi, dword [edi*4 + 0x6ee2a8]
and ebx, ecx
jmp 0x7120cd

Function at 0x714b30
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 0xc], bx
lea esp, [esp + 2]
lea esp, [esp + 0x24]
je 0x6e44fd
clc
call int.00714a74
push word [esp + 3]
pushal
jmp 0x714a94

Function at 0x71745e
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x12
lea esp, [esp + 2]
jmp 0x7174e7
lea esp, [esp + 2]
jmp 0x7174f5
or edx, edi
lea edi, [ebp*4]
mov di, word [esp]
sub esp, 0xa
not di
jmp 0x71749a
lea esp, [esp + 2]
jmp 0x7174b3
shl edx, 8
push edx
clc
pop word [esp]
mov byte [esp], bh
jmp 0x7174ce
lea esp, [esp + 0x3c]
movzx edi, byte [eax + 4]
mov dword [esp + ecx*4 + 0xc], edx
mov dx, word [esp]
jmp 0x7176c3
bts edi, edi
lea esp, [esp + 0x1c]
movzx edi, byte [eax + 3]
shl edx, 8
jmp 0x717524
lea esp, [esp + 2]
or edx, edi
stc
mov edi, 0x6f9f4dee
lea edi, [ebp + 0x6f]
jmp 0x717540
shl edx, 8
pushal
pop dword [esp + 0x16]
mov byte [esp + 0xc], ah
push word [esp + 0x1b]
jmp 0x7175b3
sub esp, 0x1e
mov dh, 0xb0
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
movzx edx, byte [eax + 5]
jmp 0x717681

Function at 0x7fe1de
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x8c36da58
xchg byte [esp + 4], al
rol dx, cl
inc bl
inc ebp
mov bx, word [esp + 4]
jmp 0x7fe208
pop dword [esp]
neg dh
mov bl, 0x90
mov eax, dword [esp + 5]
push dword [esp + 6]
jmp 0x7fe1c3
mov di, dx
xchg dword [esp + 0x1a], ebx
sub esp, 0x16
sub esp, 0
rdtsc
jmp 0x7fe219
mov esi, dword [esp + 1]
xor ecx, esi
lea esp, [esp + 3]
pop eax
xchg byte [esp], cl
pushal
jmp 0x7fe1ef
push word [esp + 0x2e]
not esi
mov bl, 0xf0
mov cl, ch
sub esp, 0xe
lea esp, [esp + 0x4b]
jmp 0x7fe25c
rdtsc
sub esp, 0x16
xchg word [esp + 0x11], bx
mov eax, ecx
mov bx, word [esp + 6]
mov eax, dword [esp + 0x11]
jmp 0x7fe23a
Function at 0x7fe4a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 3]
mov ch, byte [esp + 5]
mov di, 0x4fd3
mov dl, 0x14
mov ah, byte [esp + 8]
and al, 8
xchg ebp, eax
inc dl
rdtsc
lea ebp, [eax*4]
jmp 0x7fe48b

Function at 0x7fe97c
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc edx
pop dword [esp + 2]
pop dword [esp + 1]
clc
mov di, word [esp + 0xa]
not bx
jmp 0x7fe95e
mov di, dx
mov bl, 0x80
mov dword [esp + 0xb], eax
xchg byte [esp + 8], cl
pop dword [esp + 0xd]
rol di, cl
jmp 0x7fe8cf
mov cl, 0xd2
inc bx
lea esp, [esp + 0xd]
lea ecx, [esi*4]
bswap esi
inc bp
jmp 0x7fe8eb
mov dh, byte [esp + 0x17]
xchg dword [esp + 4], esi
mov dl, dh
mov ecx, 0xcde162d0
xchg dx, bp
lea edx, [ecx + ebx]
jmp 0x7fe907
mov ebx, 0x2b37c6cc
xchg dword [esp + 0xc], esi
rdtsc
cmc
xchg ch, dl
mov di, 0x71a1
jmp 0x7fe99b
xchg esi, edi
mov edx, 0xedd9e40e
push dword [esp + 0xa]
pop dword [esp + 2]
shr bh, 3
sub bl, ah
jmp 0x7fe944
stc
xor edi, esi
lea eax, [ecx + 0x5b]
jmp 0x7fe92d
xchg esi, edi
xchg ch, dl
mov byte [esp + 1], dh
push word [esp + 0x10]
xor esi, esi
jmp 0x7feb05
rdtsc
mov cx, 0x34cb
mov edx, 0x5c1de870
neg bx
mov dx, word [esp + 6]
xchg bx, di
jmp 0x7fe984
mov bx, word [esp + 0x10]
lea esp, [esp + 8]
not ax
lea esi, [ebp - 0x17]
mov word [esp + 2], dx
mov byte [esp + 7], ch
call fcn.007fe9f5
mov si, 0xc529
xchg dh, al
mov ax, word [esp]
pushal
mov si, word [esp + 0x1c]
mov eax, dword [esp + 1]
jmp 0x7fec44
xchg byte [esp + 0xd], cl
push dword [esp + 2]
pop edx
xchg bx, ax
mov word [esp + 0x10], bx
clc
jmp 0x7febd4
mov edi, 0xf616eb3a
xor cx, 0xb8cc
pushal
lea ecx, [ecx + 0x6248d07b]
mov dh, byte [esp + 0xf]
setge ah
jmp 0x7feb57
mov bx, 0x7bad
btc edx, edi
cpuid
rdtsc
xchg byte [esp + 0xd], al
inc ecx
jmp 0x7fec26
btc edi, ebx
mov dword [esp + 0x17], eax
xchg cx, dx
sub esp, 0xa
setle ch
pop edi
jmp 0x7feb8f
mov dl, 0x7c
mov ecx, dword [esp + 9]
mov edi, dword [esp + 0x11]
mov bp, 0xf2c7
xchg ah, bl
not ebp
jmp 0x7febb5
push dword [esp + 0x16]
lea ebx, [esp + esi]
mov eax, 0xa3a8f5d4
call fcn.007fec89
movsb byte es:[edi], byte [esi]
aaa
cmpsd dword [esi], dword es:[edi]
ret 0x9631
mov edi, 0xb460c6e2
shr eax, 5
mov ax, 0xb6ed
inc ecx
pushal
pop dword [esp + 0x12]
jmp 0x7febe8
mov si, bx
mov edi, dword [esp + 1]
pop si
mov dl, 0x24
push word [esp + 0x1d]
popal
jmp 0x7fec0a
lea ebp, [edi + ebp]
xchg word [esp + 3], bx
ror ah, 1
popal
lea ecx, [esi*4]
ror ch, 5
jmp 0x7feb75

Function at 0x7fed0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, byte [esp + 0x25]
jmp 0x7fed9b
not dx
bsr ax, bp
mov dh, byte [esp]
sub esp, 0
btc eax, edi
jmp 0x7fed81
neg ax
lea ecx, [eax - 0x11]
mov byte [esp], ah
mov edi, dword [esp]
mov eax, dword [esp]
inc ebp
jmp 0x7fedb4
lea esp, [esp + 0x2f]
mov eax, 0x4bea4f5a
cpuid
mov cx, word [esp]
rdtsc
add esp, 0
jmp 0x7fed13
setno ch
mov ecx, dword [esp]
mov edx, 0xf8d542aa
not esi
rdtsc
mov edx, dword [esp]
jmp 0x7feddf
xchg byte [esp], dl
add esp, 0
ror ch, 5
mov al, ah
mov si, di
rdtsc
jmp 0x7fee20
mov si, 0x3cfb
cpuid
lea ecx, [ecx*4]
btc ecx, edi
call fcn.007fee00
ljmp 0xbd
Function at 0x800fc9
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov word [esp], bx
mov byte [esp], bh
lea esp, [esp + 0xb]
mov byte [esp], ch
call fcn.00800fa4

Function at 0x801039
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Parse pe header

Disassembly:
call fcn.00800022
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x801017
pushal
mov dword [esp + 0x13], esi
mov dword [esp + 0x15], ebp
mov dword [esp + 0x60], edi
lea esp, [esp + 0x60]
jmp 0x800fdc
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x80001d
push dword [esp]
jmp 0x801004
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x521ee0
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00521f5f
jae 0x521eec
xor ecx, ecx
call fcn.00521f5f
jae 0x521f16
xor eax, eax
call fcn.00521f5f
jae 0x521f27
mov al, 0x10
call fcn.00521f5f
adc al, al
jae 0x521f08
jne 0x521f54
stosb byte es:[edi], al
jmp 0x521eed
call fcn.00521f6b
dec ecx
loop 0x521f33
mov eax, ebp
call fcn.00521f69
jmp 0x521f55
lodsb al, byte [esi]
shr eax, 1
je 0x521f7b
adc ecx, 2
mov ebp, eax
jmp 0x521f55
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00521f69
cmp eax, 0x7d00
jae 0x521f53
cmp eax, 0x500
jae 0x521f54
cmp eax, 0x7f
ja 0x521f55
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x521eed
pop ebp
ret 8
Function at 0x40193e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401951
push esp
mov dword [ebp - 0x24], 0x4016b5
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019f0
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019d1
pop ebp
ret 0x10

Function at 0x4038f7
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040f6], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404650], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045e4], eax
mov dword [0x4040ee], eax
mov dword [0x4045d0], 0x30
mov dword [0x4045d4], 2
jmp 0x40393c
mov dword [0x4045d8], 0x40321a
mov dword [0x4045dc], 0
mov dword [0x4045e0], 0
mov dword [0x4045f8], 0x40454d
mov dword [0x4045f0], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045e8], eax
mov dword [0x4045fc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045ec], eax
push 0x4045d0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040ee]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.lofegaswer_huijd
push str.lisclass
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404648], eax
push 5
push dword [0x404648]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404648]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404600]
jmp 0x403a10
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a02
mov eax, dword [0x404608]
jmp 0x403a2b
call 0x402c21
ret