joyce8/EMBER2024-capa huggingface dataset:
Function at 0xddae00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0xdf08f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0xddaed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.00dd77a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0xddae61
mov edx, dword [eax]
jmp 0xddae63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00dd9050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0xddaebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xddaebf
cmp esi, edi
je 0xddaebf
mov ecx, esi
call fcn.00dd2a00
push esi
call fcn.00de01c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00dd7990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0xddaef5
mov eax, dword [eax]
jmp 0xddaef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.00dd6640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0xddaf25
mov eax, dword [eax]
jmp 0xddaf27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0xddaf76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xddaf76
cmp esi, edi
je 0xddaf76
mov eax, dword [esi]
cmp eax, edi
je 0xddaf5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0xddaf6d
push eax
call fcn.00de01c8
add esp, 4
push esi
call fcn.00de01c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xddaf90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0xddaffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xddb035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00ddae00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0xddafc5
mov edi, 0xdf58b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xddb035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00ddae00
add edi, 4
add esp, 0xc
cmp edi, 0xdf58c0
jb 0xddb000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0xddb070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00de1082
mov esi, eax
add esp, 8
test esi, esi
je 0xddb107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0xddb102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00de0946
add esp, 8
test eax, eax
je 0xddb0e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0xddb0e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00de0946
add esp, 8
test eax, eax
jne 0xddb0c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0xddb102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0xddbf10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xdf09fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xddc002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00ddfdff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xddc002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00dd76e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00de020b
push 0x10
call fcn.00de01d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xddbfc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00dcc1c0
jmp 0xddbfc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00ddbb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xddbff0
mov ecx, edi
call fcn.00dcc2c0
push edi
call fcn.00de01c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xddc021
inc ebx
cmp ebx, 0x20
jb 0xddbf3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xddd250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xdf1808
push 0xde1288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xddd329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xddd329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00de01d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xddd329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xddd329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xddd32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00ddd351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xdddd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xdddd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xdddd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xdddd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xdddd94
push eax
push esi
call fcn.00de020b
add esp, 8
pop esi
ret 0x10

Function at 0xdddda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xddde22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xddde15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xdf6320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00ddfdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xddddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xddde30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xdddec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xdddeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xdf6320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00ddfdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xdddeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xddde6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xdde000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xdde131
push esi
call fcn.00de1145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00dd0080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xdde131
push 0
push ebp
call fcn.00dd03a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00dd0260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xdde08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00dd02f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xdde121
push 0xdf6918
push edi
call fcn.00ddf3f0
push eax
push ebx
push esi
call fcn.00dddf60
push 0xdf68f8
push edi
call fcn.00ddf3f0
push eax
push ebx
push esi
call fcn.00dddf60
push 0xdf68d8
push edi
call fcn.00ddf3f0
push eax
push ebx
push esi
call fcn.00dddf60
push 0xdf68c0
push edi
call fcn.00ddf3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00dddf60
push 0xdf68a0
push edi
call fcn.00ddf3f0
push eax
push ebx
push esi
call fcn.00dddf60
push 0xdf6888
push edi
call fcn.00ddf3f0
push eax
push ebx
push esi
call fcn.00dddf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xddf1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00ddf140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00ddf140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00ddf140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00ddf140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xddfbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xddfc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xdf187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xddfc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xddfc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x617f32
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
mov byte [esp + 2], bh
pushal
pop dword [esp + 0x11]
call fcn.00617dc7

Function at 0x617f84
Capabilities:
Execute anti-debugging instructions

Disassembly:
push sp
call fcn.00617f32
not dl
mov ah, 0xdc
jmp 0x617fbc
sub esp, 0xc0
jmp 0x618562
lea esi, [esp]
lea edi, [ebx + esi]
lea edi, [edx + 0x14]
lea eax, [ecx*4]
jmp 0x617fa6
push dword [esp + 2]
lea esp, [esp + 0xa]
lea esp, [esp + 3]
jmp 0x618022
sub esp, 0x19
mov dx, sp
mov dl, byte [esp + 1]
jmp 0x617fe6
lea edx, [ebx*4]
not ecx
bts eax, edi
inc cx
jmp 0x61804a
lea esp, [esp + 0x10]
xor ebp, 0x35f97f5a
bts ax, ax
jl 0x618008
jge 0x618095
lea ecx, [ebx*4]
jmp 0x61806d
inc ebp
neg cx
jne 0x618034
lea ecx, [ebx*4]
lea eax, [edx + edx]
jmp 0x618070
inc cx
jmp 0x61804a
lea eax, [edx + edx]
sub ebp, 0x71a2946a
neg dl
jmp 0x6180b9
mov ah, 0xe6
mov cx, 0xd4cb
bsf edx, esi
neg dx
pushal
jmp 0x6180eb
lea edx, [ebx*4]
not ecx
bts eax, edi
jmp 0x618069
bsf edx, esi
neg dx
pushal
jmp 0x6180eb
jg 0x61807e
mov ah, 0xe6
mov cx, 0xd4cb
jmp 0x6180a3
jmp 0x617ffc
jmp 0x6181b4
lea esp, [esp + 0x20]
dec ebp
mov dx, di
clc
jbe 0x6180d5
mov ecx, 0x809c38b1
mov al, byte [esp]
mov cx, bp
jmp 0x61815a
mov ebx, ebp
mov edx, 0xd8755f30
mov edx, esp
setns dl
neg ecx
jbe 0x6180d0
sub esp, 0x19
mov dx, sp
mov dl, byte [esp + 1]
push dword [esp + 2]
lea esp, [esp + 0xa]
jmp 0x617fee
mov cx, 0xf8ea
jmp 0x61817b
mov cx, 0xf8ea
jmp 0x61817b
neg cx
jmp 0x618165
dec ebp
mov dl, byte [esp]
bsr eax, esp
jle 0x618133
jg 0x61813e
rdtsc
jmp 0x61818d
add ebp, dword [esi]
shr ecx, 0x16
js 0x618144
neg cx
rdtsc
jmp 0x61818d
mov ecx, 0x809c38b1
mov al, byte [esp]
mov cx, bp
jmp 0x61815a
not al
mov cx, 0xa727
lea esp, [esp + 1]
jmp 0x61810c
mov dl, al
jmp 0x6181fe
mov edi, esp
sub esp, 1
jbe 0x618258
mov dl, al
not al
mov cx, 0xa727
lea esp, [esp + 1]
jmp 0x61810c
Function at 0x61d207
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x30], edx
bsr ax, di
setnp al
jmp 0x61d25b
neg ax
mov ah, byte [esp]
setbe al
lea edx, [edx - 0x29]
sete al
mov eax, dword [esp]
call fcn.0061d239
lea edx, [edx + 0x34]
rdtsc
xchg edx, eax
jmp 0x61d71e
not dl
mov eax, edi
lea edx, reloc.KERNEL32.dll_ExitThread
jmp 0x61d2e3
not dl
mov eax, edi
lea edx, reloc.KERNEL32.dll_ExitThread
jmp 0x61d2f9
rol bl, 0
mov ax, word [esp]
rcl dh, cl
jmp 0x61d4ad
xchg edx, eax
lea eax, [ebp*4]
mov dx, 0x1954
call fcn.0061d346
das
mov cl, 0x21
inc eax
mov bl, 3
xor byte [ebx], dh
sub al, byte [ebp - 2]
retf
dec bl
seto dl
neg ax
jbe 0x61d2d8
ja 0x61d2c2
pop eax
jmp 0x61d384
jmp 0x61d36e
mov dx, 0x1954
jmp 0x61d315
xor al, al
mov dl, 0xc2
bswap eax
jmp 0x61d473
add bl, 0xe4
xchg edx, eax
mov dh, 0xe0
dec dh
jg 0x61d351
xor al, al
mov dl, 0xc2
bswap eax
jmp 0x61d473
push bp
add dx, ax
jns 0x61d3db
mov eax, 0xcafa0b9
jmp 0x61d3bc
bsr ax, bx
mov dx, ax
and ebx, 0x3c
jmp 0x61d39a
lea esp, [esp + 2]
jmp 0x61d3e4
btr eax, ecx
mov al, byte [esp]
lea edx, [ecx*4]
jmp 0x61d437
mov eax, 0xcafa0b9
lea esp, [esp + 2]
sub edi, 4
shl dh, 1
jae 0x61d3c2
jb 0x61d3f5
retf
btr eax, ecx
mov al, byte [esp]
lea edx, [ecx*4]
jmp 0x61d437
mov bl, 0x3b
jmp 0x61d421
bswap edx
jmp 0x61d3b0
mov bx, 0xe562
bswap edx
jmp 0x61d44d
mov eax, dword [ebx + ebp]
neg bx
jbe 0x61d404
mov bl, 0x3b
mov bx, 0xe562
bswap edx
jmp 0x61d44d
mov dword [edi], eax
mov dl, byte [esp]
call 0x61d458
scasd eax, dword es:[edi]
rdtsc
not edx
jmp fcn.0061d488
neg bl
neg ax
jne 0x61d41d
bswap edx
bsr ax, bx
mov dx, ax
jmp 0x61d3b7
ja 0x61d308
xchg edx, eax
lea eax, [ebp*4]
jmp 0x61d368
dec bl
mov al, 0xbe
xchg dx, ax
xchg dx, ax
lea eax, [esi*4]
jmp 0x61d324

Function at 0x61d346
Capabilities:
Execute anti-debugging instructions

Disassembly:
sbb edx, 0x5a1b0304
jg 0x61d330
pop eax
jmp 0x61d384
Function at 0x61d458
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x30], edx
bsr ax, di
setnp al
jmp 0x61d25b
neg ax
mov ah, byte [esp]
setbe al
lea edx, [edx - 0x29]
sete al
mov eax, dword [esp]
call fcn.0061d239
lea edx, [edx + 0x34]
rdtsc
xchg edx, eax
jmp 0x61d71e
not dl
mov eax, edi
lea edx, reloc.KERNEL32.dll_ExitThread
jmp 0x61d2e3
not dl
mov eax, edi
lea edx, reloc.KERNEL32.dll_ExitThread
jmp 0x61d2f9
rol bl, 0
mov ax, word [esp]
rcl dh, cl
jmp 0x61d4ad
xchg edx, eax
lea eax, [ebp*4]
mov dx, 0x1954
call fcn.0061d346
das
mov cl, 0x21
inc eax
mov bl, 3
xor byte [ebx], dh
sub al, byte [ebp - 2]
retf
dec bl
seto dl
neg ax
jbe 0x61d2d8
ja 0x61d2c2
pop eax
jmp 0x61d384
jmp 0x61d36e
mov dx, 0x1954
jmp 0x61d315
xor al, al
mov dl, 0xc2
bswap eax
jmp 0x61d473
add bl, 0xe4
xchg edx, eax
mov dh, 0xe0
dec dh
jg 0x61d351
xor al, al
mov dl, 0xc2
bswap eax
jmp 0x61d473
push bp
add dx, ax
jns 0x61d3db
mov eax, 0xcafa0b9
jmp 0x61d3bc
bsr ax, bx
mov dx, ax
and ebx, 0x3c
jmp 0x61d39a
lea esp, [esp + 2]
jmp 0x61d3e4
btr eax, ecx
mov al, byte [esp]
lea edx, [ecx*4]
jmp 0x61d437
mov eax, 0xcafa0b9
lea esp, [esp + 2]
sub edi, 4
shl dh, 1
jae 0x61d3c2
jb 0x61d3f5
retf
btr eax, ecx
mov al, byte [esp]
lea edx, [ecx*4]
jmp 0x61d437
mov bl, 0x3b
jmp 0x61d421
bswap edx
jmp 0x61d3b0
mov bx, 0xe562
bswap edx
jmp 0x61d44d
mov eax, dword [ebx + ebp]
neg bx
jbe 0x61d404
mov bl, 0x3b
mov bx, 0xe562
bswap edx
jmp 0x61d44d
mov dword [edi], eax
mov dl, byte [esp]
call 0x61d458
scasd eax, dword es:[edi]
rdtsc
not edx
jmp fcn.0061d488
neg bl
neg ax
jne 0x61d41d
bswap edx
bsr ax, bx
mov dx, ax
jmp 0x61d3b7
ja 0x61d308
xchg edx, eax
lea eax, [ebp*4]
jmp 0x61d368
dec bl
mov al, 0xbe
xchg dx, ax
xchg dx, ax
lea eax, [esi*4]
jmp 0x61d324
Function at 0x624a9d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, byte [esp]
xchg byte [esp + 2], dl
mov dword [esp], eax
mov eax, ebx
rdtsc
rdtsc
jmp 0x624abf
mov dl, al
mov dh, byte [esp + 1]
lea edx, [ebp + ebp]
jmp 0x624a87
lea edx, [esp + edi]
call fcn.00624aa9

Function at 0x626e35
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x60c5d3
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x60c5ed
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x60c5dc
pop esi
jmp 0x60c5f8
ret 4
lea esp, [esp + 4]
push esi
lea esp, [esp + 4]
jmp 0x60c5c6
Function at 0x7310c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
cmc
xchg byte [esp], ah
clc
rdtsc
lea edi, [ecx + edx]
jmp 0x731057
cld
stc
lea esp, [esp]
neg eax
cmc
mov edi, eax
jmp 0x731039
setp al
std
xchg cx, ax
xchg cl, ah
lea edi, [ebx*4]
mov cl, ch
jmp 0x730feb
pop ebp
pushfd
mov bl, byte [esp + 0xa]
bswap ebx
pop dword [esp + 2]
bt edx, eax
jmp 0x731082
std
sub di, di
pop word [esp]
lea eax, [esp + eax]
sub esp, 9
mov esi, dword [esp + 5]
jmp 0x731023
inc dh
lea edx, [ebp*4]
push ecx
mov bh, byte [esp + 3]
cpuid
neg si
jmp 0x730ff9
cpuid
pop word [esp + 1]
sub esp, 0xe
dec ch
jmp 0x73109a
pop word [esp]
xchg edx, ecx
xchg byte [esp], ah
lea edx, [ebx*4]
mov edx, dword [esp + 3]
mov dh, 0x9a
jmp 0x73106c
xchg word [esp + 0xc], di
xchg byte [esp + 7], bl
pop word [esp + 2]
dec dh
xchg si, bp
add esp, 9
jmp 0x731193
add esp, 0x10
lea esi, reloc.KERNEL32.dll_ExitThread
jmp 0x73100f
clc
xchg bx, di
call fcn.00731147
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax + 0x66], dl
neg edx
neg dx
lea ecx, [edi*4]
pop ax
xchg dword [esp], ebp
bsr ecx, edx
lea esp, [esp + 3]
jmp 0x7310d0
not ah
mov dx, word [esp]
shl ebp, 0x17
xchg word [esp + 3], bp
cpuid
mov dword [esp], esi
jmp 0x7310e7

Function at 0x73112a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x73116e
xchg dword [esp + 5], esi
cmc
xchg byte [esp], ch
mov bx, ax
pop word [esp + 3]
sub esp, 0x10
jmp 0x731158
mov dl, 0x17
push dword [esp + 5]
bsr dx, di
xchg cx, di
jmp 0x731216
cld
xor ax, cx
mov al, byte [esp + 0xa]
lea ecx, [ebp*4]
mov ch, 0xc6
xchg byte [esp + 0x21], dh
jmp 0x73112c
lea ebp, [edx + ebp]
not ecx
rdtsc
pop word [esp + 2]
xchg ebx, esi
rdtsc
jmp 0x7311e6
clc
xchg di, ax
sub esp, 0xf
rdtsc
xchg cx, ax
rcl eax, cl
jmp 0x7311ab
add esp, 0x14
push dword [esp + 0xc]
btr edi, eax
xchg word [esp + 0xa], cx
pushal
jmp 0x7311fb
neg ah
xchg ch, cl
xchg word [esp + 8], dx
rcl ch, cl
mov word [esp + 0xe], ax
sub esp, 0x12
jmp 0x7311d0
adc cx, 0xde8e
xchg word [esp + 0x22], cx
mov word [esp + 0x2d], cx
xchg ah, dh
pop dword [esp + 4]
jmp 0x731240
mov dword [esp + 0x29], edi
mov word [esp + 0x31], dx
bts ebx, ebx
add esp, 0x37
pushfd
dec bp
jmp 0x7311c1
mov ax, 0x72f8
bts ebx, ebp
mov si, bp
xchg si, bx
mov ah, byte [esp]
jmp 0x731252
xchg ah, dh
bswap esi
sub esp, 0x18
lea esp, [esp + 0x4a]
mov ecx, dword [esp]
xor ebx, esi
jmp 0x73122a
mov eax, 0xd7047554
setno ch
shl ax, 0xa
dec eax
mov eax, 0x2a459b61
jmp 0x731856

Function at 0x731338
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 1
xchg cx, ax
neg edi
bt si, si
mov dword [esp + 2], ebx
jmp 0x731361
cld
jmp 0x731322
sub esp, 3
std
xchg byte [esp + 0xe], ch
pop ebp
mov edx, dword [esp + 7]

Function at 0x73158b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
and edi, 0xe91c0b05
mov edx, eax
mov dh, 0x6b
bsr edi, edx
jmp 0x73153e
Function at 0x7316bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, edx
rdtsc
mov edi, eax
pop dword [esp + 2]
stc
mov edi, edx
lea esp, [esp + 9]
xchg bx, ax
mov edx, dword [esp]
jmp 0x731524
mov word [esp + 1], cx
rdtsc
sub esp, 8
btr ebp, edx
mov dword [esp], esi
jmp 0x7315dd