joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482a22
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x482a5a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00480ad9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00480ab1
jmp 0x482a66
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x484118
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48415a
call fcn.0048a3fc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48415a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x484151
xor eax, eax
jmp 0x484162
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00484168
pop edi
pop esi
pop ebx
ret 4

Function at 0x48a92c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48a95a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48a978
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048a892
jmp 0x48a978
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48a978
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048a892
test edi, edi
mov eax, edi
jne 0x48a962
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x408918
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
and edx, edi
call fcn.0040892e
xor dword [eax], ebx
dec edi
inc eax
cmp eax, ecx
jne fcn.00408918
dec edx
ret
Function at 0x472120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0048eb40
add esp, 0xc
jle 0x47213a
jnp 0x47213c
jns 0x47214a
jmp 0x472140
xchg esp, esp
jae 0x472144
ja 0x472146
js 0x47214a
and edx, 0x65b073b1
mov cl, 0x73
mov al, 0x65
mov byte [ebp - 3], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], cl
mov byte [ebp - 6], al
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], cl
mov byte [ebp - 5], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], 0x74
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], al
mov byte [ebp - 7], 0x4e
add ecx, 0
mov edx, edx
jb 0x472189
jge 0x47219e
pushf
mov esp, esp
xchg edx, edi
xchg edx, edi
jle 0x472195
xchg edi, edi
popf
jae 0x47219b
jl 0x47219e
add eax, 0x13ade8
add byte [ebx + 0x75c985c8], cl
or byte [edi + 0x5e], bl
call fcn.00473550
mov ecx, eax
test ecx, ecx
jne 0x4721b1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
rol esp, 0
jg 0x4721b6
jb 0x4721d7
pushf
ror eax, 0
xor edi, dword [esp]
xor edi, dword [esp]
cld
xor edx, 0x7bbd
xor edx, 0x7bbd
popf
jae 0x4721d4
jae 0x4721d7
mov esp, 0x52f0558d
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.00476d20
mov esi, eax
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0048eb40
add esp, 0xc
test esi, esi
jne 0x472201
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
lea esp, [esp]
lea ecx, [ecx]
add edx, dword [esp]
sub edx, dword [esp]
jge 0x472222
pushf
ror esp, 0
cmp edx, dword [esp]
add esp, 0
popf
jp 0x47221d
lea eax, [eax]
jl 0x472222
ljmp 1:0xe0c8e856
push esi
call fcn.004902f0
add esp, 4
xor ecx, dword [esp]
xor ecx, dword [esp]
jmp 0x472233
mov eax, eax
jle 0x472237
jbe 0x47224e
pushf
jns 0x47223d
add ecx, 0
sub esp, 0
jnp 0x472245
popf
je 0x472249
jbe 0x47224b
ja 0x47224e
mov esi, 0x8b0c4d8b
push ebp
or byte [ecx + 0x52], dl
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x473580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0048eb40
add esp, 0xc
jns 0x47359b
jne 0x4735ae
pushf
xor edx, dword [esp]
xor edx, dword [esp]
popf
jae 0x4735a9
mov ebx, ebx
je 0x4735ae
mov edi, 0x45c666b0
invalid
mov al, 0x66
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xd], 0x4d
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x6d
mov byte [ebp - 8], 0x55
mov byte [ebp - 7], 0x6a
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], al
mov byte [ebp - 4], 0
jmp 0x4735e4
nop
je 0x4735ef
xchg esp, esp
jne 0x4735eb
jne 0x4735ef
mov ebx, 0xf04d8a43
mov cl, byte [ebp - 0x10]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 6]
mov dl, byte [ebp - 0xf]
dec cl
dec al
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0xa]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 5]
dec dl
mov byte [ebp - 6], bl
mov bl, byte [ebp - 0xe]
mov byte [ebp - 0xf], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 5], al
mov al, byte [ebp - 8]
dec dl
mov byte [ebp - 0xe], bl
mov bl, byte [ebp - 0xc]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 7]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0xd], cl
mov byte [ebp - 8], al
mov byte [ebp - 0xc], bl
mov byte [ebp - 7], dl
call fcn.00473550
test eax, eax
je 0x4736d2
stc
shl ecx, 0
jae 0x473663
mov ecx, ecx
jb 0x473663
sub eax, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00476d20
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
mov edi, eax
call fcn.0048eb40
add esp, 0xc
test edi, edi
je 0x4736d2
jge 0x473685
lea eax, [eax]
jp 0x47369d
pushf
or esp, 0
xor esi, ebx
xor esi, ebx
jg 0x473694
popf
xchg ebx, ebx
jae 0x47369a
jnp 0x47369d
sub eax, 0xcc4de857
add dword [eax], eax
push edi
call fcn.004902f0
add esp, 4
sub esp, 0
cmp ecx, 0x7e42
jne 0x4736b1
je 0x4736b3
jle 0x4736cc
pushf
jno 0x4736b9
xor eax, 0x3bbe
xor eax, 0x3bbe
popf
mov edx, edx
jne 0x4736c9
jg 0x4736cc
xor eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x476d20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x476da1
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x476da1
ror esi, 0x18
rol esi, 0x18
shr eax, 0
jnp 0x476d3f
jae 0x476d48
jle 0x476d43
nop
jb 0x476d48
mov ebp, 0xf981e4
add byte [ecx], al
add byte [ebx + 0x15], dh
cmp ecx, 0x10000
jae 0x476d65
mov eax, eax
jb 0x476d54
jne 0x476d5c
jne 0x476d58
je 0x476d5c
mov ebp, 0xe8535148
mov ebp, 0xeb000091
adc eax, 0x97ffe283
push ecx
push ebx
call 0x47ff20
jmp 0x476d7a
and edx, 0xffffffff
xchg edi, eax
xchg edi, eax
ja 0x476d73
jle 0x476d6e
jl 0x476d70
jbe 0x476d73
mov ebx, 0x36e85351
js 0x476d7a
push ecx
push ebx
call fcn.0048e5b0
add byte [ebx - 0x3f7af73c], al
add esp, 8
test eax, eax
je 0x476dac
push edx
pop edx
jl 0x476d85
jp 0x476d9a
js 0x476d89
jg 0x476d8b
lea edi, [edi + 0xc35]
lea edi, [edi - 0xc35]
jnp 0x476d9a
call 0x5da2cbfd
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0x46e4cc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x477430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x11
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.0048eb40
add esp, 0xc
jo 0x47744b
je 0x47744d
cmp edi, 0x4478
push ecx
pop ecx
jl 0x47745f
xchg edi, ecx
xchg edi, ecx
nop
jge 0x47745f
sub eax, 0x76b166b0
mov al, 0x66
mov cl, 0x76
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x52
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x17], al
mov byte [ebp - 0x16], 0x73
mov byte [ebp - 0x15], 0x7a
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0x11], cl
mov byte [ebp - 0x10], al
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0
jg 0x4774a4
sub esi, 0
xchg esp, esp
jle 0x4774c4
pushf
jmp 0x4774af
and esp, 0xffffffff
jmp 0x4774b4
call fcn.004774b9
Function at 0x47d1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0048eb40
add esp, 0xc
or esp, 0
js 0x47d211
xchg edi, edi
jno 0x47d202
lea edx, [edx + 0x4cf4]
lea edx, [edx - 0x4cf4]
jns 0x47d211
xor dword [ecx - 0x398a4f9a], 0xc67af445
inc ebp
invalid
mov cl, 0x66
mov al, 0x75
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 7], 0x4a
mov byte [ebp - 8], 0x6e
mov byte [ebp - 5], 0x67
mov byte [ebp - 0xa], al
mov byte [ebp - 3], 0
mov byte [ebp - 0xe], al
mov byte [ebp - 4], 0x70
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 9], cl
mov byte [ebp - 6], 0x6f
add edx, 0x4dfb
sub edx, 0x4dfb
jne 0x47d260
lea esp, [esp]
jmp 0x47d25c
je 0x47d260
mov edx, 0xfc4d8aad
mov cl, byte [ebp - 4]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 0xf]
mov dl, byte [ebp - 0xd]
dec cl
dec al
mov byte [ebp - 4], cl
mov cl, byte [ebp - 9]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 0xc]
dec dl
mov byte [ebp - 0xf], bl
mov bl, byte [ebp - 0xa]
dec cl
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 6]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 8]
dec al
dec bl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0x10]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 7]
dec cl
mov byte [ebp - 6], dl
mov dl, byte [ebp - 5]
mov byte [ebp - 8], cl
mov cl, byte [ebp - 0xe]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0x10], al
mov byte [ebp - 7], bl
mov byte [ebp - 5], dl
mov byte [ebp - 0xe], cl
mov edx, edx
je 0x47d2e1
mov eax, eax
lea ebx, [ebx + 0x1933]
lea ebx, [ebx - 0x1933]
jl 0x47d2dc
jbe 0x47d2de
jne 0x47d2e1
add eax, 0xff626ae8
dec dword [ebx + 0xff685f0]
test byte [edi - 0x3f000000], dh
loopne 0x47d2f3
call fcn.00473550
mov esi, eax
test esi, esi
je 0x47d3a7
shl eax, 0
rol ecx, 0
jno 0x47d31d
pushf
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
jl 0x47d304
call fcn.0047d309
Function at 0x481a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x46e298]
push ebx
push esi
cmp eax, 1
push edi
jne 0x481be6
push 0xd
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048eb40
add esp, 0xc
and esi, 0xffffffff
js 0x481abc
test esi, 0x679c
js 0x481acd
jl 0x481ac6
jb 0x481ac8
jno 0x481aca
jns 0x481acd
lcall 0x48ec, 0x45c675b0
mov al, 0x75
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 9], al
mov byte [ebp - 0x12], al
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 8], 0
mov byte [ebp - 0x11], 0x55
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], 0x6a
mov byte [ebp - 0xb], 0x76
ja 0x481b03
jp 0x481b05
xchg edx, edi
xchg edx, edi
js 0x481b1c
jle 0x481b0d
lea esi, [esi + 0x3c30]
lea esi, [esi - 0x3c30]
jns 0x481b1c
mov ecx, 0x8aec4d8a
inc ebp
int1
mov cl, byte [ebp - 0x14]
mov al, byte [ebp - 0xf]
mov bl, byte [ebp - 0xa]
mov dl, byte [ebp - 0x13]
dec cl
dec al
mov byte [ebp - 0x14], cl
mov cl, byte [ebp - 0xe]
dec bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 9]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 0x12]
mov byte [ebp - 0x13], dl
mov dl, byte [ebp - 0xd]
dec cl
dec al
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0x11]
dec bl
mov byte [ebp - 9], al
mov al, byte [ebp - 0xc]
dec dl
mov byte [ebp - 0x12], bl
mov bl, byte [ebp - 0x10]
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 0xb]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0x11], cl
mov byte [ebp - 0xc], al
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xb], dl
rol esi, 0x12
rol esi, 0xe
jnp 0x481b84
jne 0x481b8e
jge 0x481b88
jne 0x481b8a
je 0x481b8e
ljmp 0xffff:0x19bde8c5
call fcn.00473550
test eax, eax
jne 0x481ba0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ecx + 0x6985]
sub ecx, 0x6985
jg 0x481bae
jae 0x481bbb
pushf
jl 0x481bb4
popf
mov edx, edx
jb 0x481bbb
or dword [ebp + 0x5051ec4d], 0xff515be8
jmp [edx + 0xd]
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00476d20
push 0xd
lea edx, [ebp - 0x14]
mov esi, eax
push 0
push edx
mov dword [ebp - 4], esi
call fcn.0048eb40
add esp, 0xc
test esi, esi
je 0x481b97
mov dword [0x46e298], esi
jmp 0x481be9
mov dword [ebp - 4], eax
mov edx, edx
ror edi, 0x1c
rol edi, 0x1c
rol ebx, 0x13
ror ebx, 0x13
jp 0x481c0c
pushf
or eax, eax
xor edi, 0
lea esp, [esp]
popf
xchg esi, edi
xchg esi, edi
jnp 0x481c0c
mov eax, 0x53fc5d8b
mov ebx, dword [ebp - 4]
push ebx
call fcn.004902f0
add esp, 4
shr ecx, 0
shl esp, 0
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
xor ecx, dword [esp]
xor ecx, dword [esp]
ja 0x481c4a
pushf
nop
push edi
add edi, 0x10b8
ror edi, 0x16
pop edi
or esi, 0
popf
ja 0x481c43
jne 0x481c45
jl 0x481c47
jbe 0x481c4a
add eax, 0x5e5fd3ff
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4860d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x46e448
call fcn.00484350
add esp, 0xc
mov byte [0x46e448], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x486b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048eb40
add esp, 0xc
jae 0x486b7b
jnp 0x486b91
pushf
jg 0x486b81
jg 0x486b83
lea esp, [esp]
popf
lea esi, [esi]
jge 0x486b8c
jns 0x486b8e
jp 0x486b91
add eax, 0x66b06db1
mov cl, 0x6d
mov al, 0x66
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x54
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 4], cl
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x49
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 7], 0x62
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 6], 0x6f
test dword [esp], ecx
lea ecx, [ecx + 0x1fed]
lea ecx, [ecx - 0x1fed]
call 0x486bef
add esp, 4
xchg ecx, eax
xchg ecx, eax
je 0x486c12
pushf
cmp esi, dword [esp]
not ecx
not ecx
lea esi, [esi + 0x4051]
lea esi, [esi - 0x4051]
popf
js 0x486c0f
jne 0x486c12
xor eax, 0x8aec558a
dec ebp
int1
mov dl, byte [ebp - 0x14]
mov cl, byte [ebp - 0xf]
mov al, byte [ebp - 0xa]
mov bl, byte [ebp - 5]
dec dl
dec cl
mov byte [ebp - 0x14], dl
mov dl, byte [ebp - 0x13]
dec al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0xe]
dec bl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 9]
mov byte [ebp - 5], bl
mov bl, byte [ebp - 4]
dec dl
dec cl
mov byte [ebp - 0x13], dl
mov dl, byte [ebp - 0x12]
dec al
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 9], al
mov al, byte [ebp - 8]
mov byte [ebp - 4], bl
mov bl, byte [ebp - 3]
dec dl
dec cl
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 0x11]
dec al
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0xc]
dec bl
mov byte [ebp - 8], al
mov al, byte [ebp - 7]
mov byte [ebp - 3], bl
mov bl, byte [ebp - 0x10]
dec dl
dec cl
dec al
dec bl
mov byte [ebp - 0x11], dl
mov dl, byte [ebp - 0xb]
mov byte [ebp - 0xc], cl
mov byte [ebp - 7], al
mov byte [ebp - 0x10], bl
mov cl, byte [ebp - 6]
dec dl
dec cl
mov byte [ebp - 0xb], dl
mov byte [ebp - 6], cl
or esp, 0
xchg ecx, ecx
jnp 0x486caf
jns 0x486cab
jp 0x486caf
mov esp, 0xd2cce867
add byte [eax], al
call fcn.00493f80
mov edx, eax
test edx, edx
jne 0x486cc3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xchg esi, esi
xor eax, 0
shr eax, 0
jb 0x486ce0
pushf
not ecx
not ecx
ror edi, 1
rol edi, 1
jmp 0x486cd9
popf
mov esi, esi
jae 0x486ce0
mov eax, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
push edx
call fcn.00476d20
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.0048eb40
add esp, 0xc
test esi, esi
jne 0x486d0b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmc
xchg ecx, ecx
ja 0x486d17
jbe 0x486d12
jle 0x486d14
jbe 0x486d17
lcall 0, 0x95d3e856
push esi
call fcn.004902f0
add esp, 4
cmp edx, ecx
std
cld
shl esp, 0
jnp 0x486d34
xchg ebx, eax
xchg ebx, eax
jle 0x486d2d
jnp 0x486d2f
ja 0x486d31
jp 0x486d34
mov ecx, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x488810
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x46ed80]
push esi
push edi
push eax
push 0x46ec2d
mov byte [0x46ec2c], 0x45
call fcn.00484620
mov edx, dword [0x46ed80]
mov al, 0x2d
mov byte [0x46ec32], al
mov byte [0x46ec33], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x46ec31], cl
mov byte [0x46ec34], cl
mov esi, 0x46ec35
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x45ea69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x48885f
mov byte [esi], 0
pop edi
mov eax, 0x46ec2c
pop esi
ret
Function at 0x4914f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xf
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048eb40
add esp, 0xc
lea ecx, [ecx]
jns 0x491526
pushf
xchg esp, esp
popf
xchg esp, esp
lea edi, [edi + 0x617]
lea edi, [edi - 0x617]
js 0x491523
js 0x491526
sub eax, 0x72b173b0
mov al, 0x73
mov cl, 0x72
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], al
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], cl
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 8], al
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0xc], 0x32
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x46
mov byte [ebp - 7], 0x74
call fcn.00473550
test eax, eax
jne 0x491573
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00476d20
push 0xf
lea edx, [ebp - 0x14]
mov esi, eax
push 0
push edx
mov dword [ebp - 4], esi
call fcn.0048eb40
add esp, 0xc
test esi, esi
jne 0x4915a1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
rol edi, 2
ror edi, 2
sub esp, 0
jno 0x4915b3
xchg edx, eax
xchg edx, eax
jb 0x4915b0
jo 0x4915b3
xor eax, 0xed37e856
invalid
push esi
call fcn.004902f0
add esp, 4
push esi
pop esi
jnp 0x4915d3
pushf
inc ebx
dec ebx
test ecx, 0x580c
popf
xchg edx, ebx
xchg edx, ebx
jp 0x4915d3
or dword [ebx + 0x4d8b0c45], 0xff515008
push ebp
cld
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x17f7367
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 4]
jmp 0x17f7398
push dword [esp + 5]
jne 0x17f7382
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x17f73c2

Function at 0x17f737d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf17e8774
jmp 0x17f73a8
call 0x17f72fb
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x17f73c2
neg ebp
je 0x17f73c8
mov ecx, ebx
lea eax, [esp + 0xea]
jmp 0x17f7893
pushfd
jmp 0x17f7283
mov ecx, ebx
jmp 0x17f73d0
lea eax, [esp + 0xea]
jmp 0x17f7893
lea edi, [esp + 4]
jmp 0x17f7678
rdtsc
mov esi, dword [esp]
rdtsc
bsr si, bp
jl 0x17f74c9
jge 0x17f74c9
bswap ecx
call fcn.017f7422
mov ebp, dword [esp + 0x2c]
btc eax, edx
jb 0x17f77e2
bswap ecx
pushfd
jmp 0x17f7473

Function at 0x17f9066
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x17f91a1
pop word [esp]
push ebx
mov dword [esp + 4], eax
pushfd
mov dword [esp + 4], ecx
pushfd
jmp 0x17f9095
mov byte [esp + 1], ch
mov byte [esp + 1], ch
mov word [esp], bx
lea esp, [esp]
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0x17f9101
mov dword [esp], edx
call fcn.017f90d7

Function at 0x17f90c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
push dword [esp + 6]
jg 0x17f90e1
jle 0x17f911f
out dx, al
invalid
pop word [esp + 4]
lea esp, [esp + 2]
mov dword [esp + 4], ebx
call fcn.017f9109
xor dword [edx + edx*2 + reloc.MSVCRT.dll_strncpy], edi
mov dword [ecx], ebx
js 0x17f9089
test al, 0xcb
pop word [esp + 4]
lea esp, [esp + 2]
mov dword [esp + 4], ebx
jmp 0x17f90ee

Function at 0x17f90d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], ax
call fcn.017f90c1

Function at 0x17f9109
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf17e8774
jmp 0x17f917c
mov dword [esp + 4], esp
jmp 0x17f9144
mov word [esp], sp
push word [esp]
jle 0x17f916d
lea esp, [esp + 1]
jmp 0x17f9157
pushfd
lea esp, [esp + 2]
lea esp, [esp]
lea esp, [esp + 2]
mov dword [esp], ebp
push dx
jmp 0x17f912e
lea esp, [esp + 3]
push esi
push edi
jmp 0x17f9177
lea esp, [esp + 1]
lea esp, [esp + 3]
push esi
push edi
jmp 0x17f95c6
cpuid
mov bp, ax
cpuid
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0x17f93af
call fcn.017f91b4
mov edi, dword [esp + 0x2c]
rdtsc
mov ecx, 0xaf54ec3f
neg cl
jp 0x17f9253
jnp 0x17f9253
pushfd
jmp 0x17f736e

Function at 0x1928caf
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [esp + 0x4c], edi
lea esp, [esp + 0x4c]
jmp 0x1928cca
Function at 0x41c3e9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
rcl di, 9
xadd di, si
bts di, 8
mov esi, dword [ebp + 4]
not di
movsx edi, bl
not di
mov edi, ebx
add esp, 4
cmc
cmpsb byte [esi], byte es:[edi]
jmp 0x41f46f
push 0x71e91d19
pushfd
lea esp, [esp + 8]
jne 0x41b4f2
test dh, 0xb4
stc
pushal
cmp byte [esi - 1], 0
call fcn.0041b4e8
pushfd
clc
xchg dword [esp], ebp
btc bp, 2
bts ebp, ebx
stc
adc bp, 0x5138
mov ebp, esp
stc
cmp byte [ecx - 0x77], dl
in eax, 0xf9
pushal
cmp ch, cl
mov dword [esp + 0x1c], ecx
bt di, 3
clc
stc
call fcn.0041ad59
cld
enter 0xffffffffffff989d, 0x65
mov eax, 0x3ad47aae
dec ecx
xlatb
jns 0x41f138
adc dword [ebx + 0x39], edi
insd dword es:[edi], dx
push eax
dec esi
push cs
loopne 0x41f109
sar byte [ecx + 0x2b], 1
jns 0x41f166
sbb eax, 0xbf1a6d67
jns 0x41f1a1
hlt
leave
dec esi
sub byte [edx - 0x49a7d451], bl
mov word [ecx], gs
adc ebp, dword [ebx - 0x628750d0]
aam 0x6a
invalid
jl 0x41f1c7
or al, 0xc7
add al, 0x24
mov esi, 0xf7b1ee04
aad 0x8d
xor al, 0x5d
stosd dword es:[edi], eax
pushal
pop esi
push esp
jmp 0x41f0da

Function at 0x41c609
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
push 0x7afee273
lea esp, [esp + 0x30]
je 0x41b41d
sbb dx, di
bsf dx, cx
mov esi, dword [eax + 0x3c]
shr dh, cl
dec dh
btr dx, bx
add esi, eax
rcl dh, 5
bt dx, 0xb
sal dx, 2
bswap edx
mov edx, dword [esi + 0x78]
test dl, 0x9e
test edx, edx
pushal
call fcn.0041b4c6