joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8bda21
Capabilities:
Execute anti-debugging instructions

Disassembly:
setnp al
jmp 0x8bda6c
btc ax, cx
mov dx, word [esp + 0x1e]
xchg ch, cl
adc si, 0x76a3
inc eax
not ebx
jmp 0x8bdad0
mov cl, dh
lea edx, [edx + esi]
mov byte [esp], ch
bswap esi
mov dx, 0xd7d0
jmp 0x8bdaf8
setb dl
xchg di, dx
mov byte [esp + 3], bl
xchg si, ax
pop bp
bswap ecx
jmp 0x8bdaa2
mov ch, 0xcd
pop dword [esp + 0x12]
add esp, 0x13
neg bh
mov bl, 0x24
add esp, 2
jmp 0x8bdab8
bswap ebp
rdtsc
xchg bp, cx
dec si
mov byte [esp + 2], bh
pop di
jmp 0x8bdb46
mov byte [esp], al
mov ecx, dword [esp + 2]
mov bh, 0x44
mov edi, 0xbb675937
mov ebp, dword [esp + 2]
bsr bx, ax
jmp 0x8bdae2
xchg ebp, eax
xchg bl, ah
not si
mov edx, 0x2f5b07a
stc
xchg si, bx
jmp 0x8bdb55
mov eax, 0xf0f39664
mov esi, eax
mov si, ax
rdtsc
rdtsc
mov esi, 0x2462c5b8
jmp 0x8bdb10
push ecx
btc dx, ax
not ch
xchg dword [esp], eax
pop bx
pop edx
jmp 0x8bdb26
mov bl, dl
xchg bx, si
ror ebx, cl
bswap edx
rdtsc
xchg ah, bh
jmp 0x8bdce9
mov edx, 0x7e2821a8
lea eax, reloc.KERNEL32.dll_VirtualQuery
call fcn.008bdc42
inc esp
neg esi
sub dword [eax - 0x15], ecx
bswap edi
cpuid
bswap eax
and edx, esp
mov dx, word [esp]
xchg dl, al
jmp 0x8bdb67

Function at 0x8bdec1
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap esi
bsr edx, esi
xchg word [esp + 6], si
pop dword [esp + 7]
jmp 0x8bdedd
mov dx, 0xd024
jmp 0x8bdeab
not ch
btc esi, eax
lea esp, [esp + 9]
lea ebp, [eax + esi]
add esp, 0
jmp 0x8bdfc3
xchg byte [esp + 8], al
xchg word [esp + 3], cx
mov di, 0x1b16
xchg word [esp], ax
pop word [esp + 1]
rcr bx, cl
jmp 0x8bdec7
mov al, bh
mov ah, dh
mov edx, ecx
cmc
sub esp, 0x12
neg ebx
jmp 0x8bdf77
mov byte [esp], ah
adc si, 0x569e
add esp, 0
mov dl, ch
lea edi, reloc.KERNEL32.dll_VirtualQuery
xchg di, cx
jmp 0x8bdf12
rdtsc
neg esi
mov byte [esp + 0xf], ch
pop word [esp + 0xe]
call fcn.008bdfa4
retf
sub ebx, ebp
cld
mov edx, dword [esp + 0x10]
xchg byte [esp + 2], al
shl eax, 6
mov edi, ebx
jmp 0x8bdf40
mov byte [esp + 2], ah
mov di, word [esp + 0xd]
mov bl, 0x22
lea ebp, [ebp + 0xce]
bswap eax
not ah
jmp 0x8bdf56
rdtsc
std
neg al
mov ax, dx
mov si, 0xe96d
xchg ecx, ebx
jmp 0x8bdf28

Function at 0x8bdfa4
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov dword [esp + 0xb], edi
inc bh
xchg word [esp + 0xc], si
neg ch
jmp 0x8bdfa9
inc ecx
xchg esi, edi
jmp 0x8bdf8e
mov word [esp + 0x12], bx
setae dl
mov byte [esp + 0xf], dh
mov dword [esp + 9], esi
jmp 0x8bdfd6
mov word [esp + 5], dx
xchg dword [esp + 8], eax
mov edx, eax
pop dx
lea esp, [esp + 0xc]
bts edi, esi
jmp 0x8bf73b
pop word [esp + 2]
Function at 0x8be25e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
jmp 0x8be29c
xchg si, bp
mov bl, byte [esp]
setno dh
add esp, 0
push ebx
add esp, 3
jmp 0x8be400
pop word [esp]
inc edi
mov cx, bp
rdtsc
lea esi, [esp + ecx]
lea esp, [esp + 3]
jmp 0x8be286
bsr cx, si
lea esp, [esp]
mov edi, 0xfc0cac05
mov byte [esp + 1], al
jmp 0x8be3ce
add esp, 0
xchg dword [esp], ebp
rdtsc
mov eax, 0xd95e0b08
mov dword [esp], ebx
add di, bx
jmp 0x8be2c9
mov byte [esp], ch
lea ebx, [edx + 0x98]
xchg bh, ch
lea ebp, [edi + edi]
mov dh, byte [esp + 1]
xchg word [esp], bp
jmp 0x8be32f
mov edi, dword [esp]
mov ah, cl
mov cx, 0xfd9f
not cl
mov al, byte [esp + 1]
lea ecx, [edi*4]
jmp 0x8be2f4
btc si, bx
xchg cl, bl
cld
pushal
pushfd
mov ebp, 0x909ee1c2
jmp 0x8be37f
bswap ecx
mov ax, word [esp + 2]
not dx
mov bh, 0x63
or eax, 0xdeb473a6
cpuid
jmp 0x8be367
bt ecx, esp
bswap edx
lea esi, [edx + edi]
clc
mov dh, bl
mov ah, 0xe8
jmp 0x8be317
lea ebp, [ecx + edx]
lea edx, reloc.KERNEL32.dll_VirtualQuery
mov dword [esp], esi
cld
mov cl, 0x2c
call fcn.008be3ad
xchg esp, eax
pop es
scasb al, byte es:[edi]
lea esp, [esp + 0x1e]
mov bl, byte [esp + 2]
mov byte [esp + 1], ah
add esp, 4
pop dx
push word [esp + 1]
jmp 0x8be33f
bsr ebp, ebp
bswap edi
lea ebp, [ebx*4]
xchg esi, ebx
mov byte [esp], cl
pop ax
jmp 0x8be358
rdtsc
mov ah, byte [esp + 1]
push word [esp]
lea ebx, reloc.KERNEL32.dll_VirtualQuery
mov dl, bh
clc
jmp 0x8be2df

Function at 0x8be42e
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts ebx, esp
mov edi, 0xd094f075
sub esp, 0x19
lea esp, [esp + 0xc]
jmp 0x8be436
mov byte [esp + 2], bl
xchg bh, cl
jmp 0x8be418
mov word [esp + 3], sp
lea eax, [eax + ebx]
lea edi, [edi*4]
xchg dword [esp + 9], edi
push word [esp + 0xe]
Function at 0x8c1895
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 2
add esp, 4
lea esp, [esp + 1]
pushal
clc
rcl dx, 0xb
jmp 0x8c183f
not ebx
mov ch, byte [esp]
rdtsc
xor ax, 0xda2f
lea ebx, [edx + edi]
lea edi, [ecx - 0x39]
jmp 0x8c185e
lea esi, [eax*4]
cld
cmp dx, cx
xchg ecx, eax
xchg bx, dx
jmp 0x8c189d
call 0x8c1895
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
pushfd
stc
std
sub esp, 7
jmp 0x8c181e
not ah
stc
mov ebp, dword [esp]
cmc
rol edx, 7
cmc
jmp 0x8c18e4
pop eax
lea ebx, reloc.KERNEL32.dll_VirtualQuery
lea edi, [esp + esi]
bsr edi, edx
lea ebp, [ecx + ebx]
jmp 0x8c190e
lea esi, [edx + ebx]
mov dx, di
rdtsc
mov cx, ax
sub esp, 0x11
push dword [esp + 9]
jmp 0x8c18ce
mov esi, ebx
lea esi, [eax*4]
mov di, bp
mov dh, byte [esp]
jmp 0x8c1937
push word [esp + 1]
mov ah, byte [esp + 0x11]
xchg edx, eax
cld
xchg bl, dh
add esp, 0x12
jmp 0x8c18f8
bswap ebx
mov edx, 0x3612d94a
xchg byte [esp], ah
bsr dx, cx
not ah
jmp 0x8c19b5
btc dx, sp
btc ax, bx
mov byte [esp], dl
std
setne dl
lea esp, [esp]
jmp 0x8c1921
xchg byte [esp], ch
bswap ebp
mov di, word [esp]
call fcn.008c194b
xchg byte [esp + 7], al
setl cl
bswap eax
mov ecx, 0xdacd825
pushal
mov dword [esp + 0x23], eax
jmp 0x8c1993
mov edx, ebp
push dword [esp + 7]
dec eax
lea ebx, [ebx + edi]
dec ch
mov esi, dword [esp + 0x1f]
jmp 0x8c19e1
bsf ecx, esp
rdtsc
mov edx, dword [esp]
lea edx, reloc.KERNEL32.dll_VirtualQuery
mov byte [esp], ah
xchg byte [esp], al
jmp 0x8c1961
mov dl, byte [esp + 0x23]
add esp, 0
lea esi, [ecx + esi]
push word [esp + 0x26]
call fcn.008c1acb
movsd dword es:[edi], dword [esi]
aam 0x66
not eax
not ax
xchg word [esp + 0x17], bp
pop dword [esp + 0x17]
mov bl, dh
not bl
mov ecx, 0xee979356
jmp 0x8c19cb

Function at 0x8c2130
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg cl
lea esp, [esp]
mov ecx, 0xd894c174
sub esp, 0x14
jmp 0x8c20ab
bswap ebx
mov eax, dword [esp]
rdtsc
lea ecx, reloc.KERNEL32.dll_VirtualQuery
mov byte [esp], ch
mov al, 0xa0
jmp 0x8c2081
mov dword [esp + 0xc], esp
neg ax
cmp al, 0x60
dec di
bsf dx, dx
jmp 0x8c20ed
lea edi, [edi*4]
cpuid
dec cl
inc ch
xchg byte [esp], ch
std
jmp 0x8c2097
xchg ecx, ebx
xchg word [esp + 1], bx
btr edi, ecx
mov bh, byte [esp + 8]
xchg word [esp + 5], cx
jmp 0x8c2107
bswap ebx
mov dword [esp + 3], esi
lea eax, reloc.KERNEL32.dll_VirtualQuery
mov ah, 0x4c
lea esp, [esp + 0xb]
mov word [esp + 3], si
jmp 0x8c20d4
xchg dword [esp + 2], edx
bt ax, bp
cpuid
mov word [esp + 6], si
bswap esi
lea ebp, [ecx*4]
jmp 0x8c2156
pop ebx
rdtsc
mov ebp, 0x47e646ce
cpuid
mov di, 0xb0f6
jmp 0x8c20c1
seto cl
clc
mov bh, 0xee
sub cx, 0x7bd0
push word [esp]
jmp 0x8c21ad
pop bx
xchg dl, ah
xchg word [esp + 1], bp
lea esp, [esp + 5]
std
mov di, bx
jmp 0x8c2140
xchg word [esp + 1], di
xchg si, ax
mov cx, word [esp + 4]
push word [esp + 1]
mov bx, word [esp]
bsr si, cx
jmp 0x8c2182
Function at 0x8c2328
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 8]
pop dword [esp + 0xd]
mov esi, dword [esp + 0x23]
bsf edi, eax
jmp 0x8c2348
pushal
mov eax, 0x8d08b66f
bsf ax, di
mov ah, bh
xchg dword [esp + 0x19], eax
sub esp, 2
jmp 0x8c22f2
push edx
xchg bp, bx
mov ebp, dword [esp + 0xb]
jmp 0x8c2308
rdtsc
xchg byte [esp + 8], dl
bsf esi, edx
mov byte [esp + 0x15], dl
jmp 0x8c2519
mov ebp, 0x8aed79a9
mov ax, word [esp + 0x18]
xchg byte [esp + 1], ch
lea ebp, [esp + esi]
mov edx, ecx
lea ecx, [ebp - 0x82]
jmp 0x8c2332
lea ebp, reloc.KERNEL32.dll_VirtualQuery
mov edx, 0x6688a0ff
mov dh, bh
cpuid
lea ecx, reloc.KERNEL32.dll_VirtualQuery
mov edx, ecx
jmp 0x8c2379
lea esp, [esp + 0x43]
lea esi, [esp + ebp]
mov ah, bh
std
bsr bp, sp
cpuid
jmp 0x8c23a0
mov ax, word [esp + 0xd]
lea ecx, [ebx + 0x90]
sub esp, 0xd
mov dword [esp + 0x2d], eax
mov word [esp + 0x25], bx
push dword [esp + 0x22]
jmp 0x8c23d7

Function at 0x8c2957
Capabilities:
Access peb ldr_data

Disassembly:
push dword [esp + 2]
pop word [esp + 3]
push word [esp]
jmp 0x8c2921
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
pushfd
or byte [ecx - 0x63fbdb8c], cl
lea esp, [esp + 2]
call 0x8c2957
jo 0x8c2924
jg 0x8c2951
jmp 0xcc9abac
out 0x11, al
nop
adc ecx, dword [edx + reloc.KERNEL32.dll_VirtualQuery]
and al, 0x8d
and al, 2
jmp 0x8c2941
Function at 0x4026e4
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026f2
call dword [0x47501c]
or eax, eax
je 0x4026f3
ret
mov al, 1
jmp fcn.00402770

Function at 0x4026fc
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40270a
call dword [0x475020]
or eax, eax
jne 0x40270b
ret
mov al, 2
jmp fcn.00402770

Function at 0x402714
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x40274c
test edx, edx
je 0x402736
push eax
mov eax, ecx
call dword [0x475024]
pop ecx
or eax, eax
je 0x402745
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402770
mov dword [eax], edx
mov eax, ecx
call dword [0x475020]
or eax, eax
jne 0x40272f
ret
mov al, 1
jmp fcn.00402770
test edx, edx
je 0x402760
push eax
mov eax, edx
call dword [0x47501c]
pop ecx
or eax, eax
je 0x402745
mov dword [ecx], eax
ret

Function at 0x402770
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x477004]
test ecx, ecx
je 0x402780
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402799]
jns 0x402794
call fcn.00405d88
mov eax, dword [eax + 4]
jmp fcn.00403960

Function at 0x402c30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402cc8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ca8
xor eax, eax
push ebp
push 0x402ca1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ce4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ca8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402f48
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402f62
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x402f62
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402f4e
mov al, 0xa
jmp fcn.00402770
ret

Function at 0x402f94
Capabilities:
Terminate process

Disassembly:
cmp dword [0x47701c], 0
je 0x402953
call dword [0x47701c]
mov eax, 0xd2
jmp fcn.00403960
push eax
push ecx
mov eax, dword [eax]
call fcn.00402f64
pop ecx
pop eax
je 0x402fa3
jmp ebx
pop ecx
jmp 0x402944

Function at 0x402fac
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00402f64
mov eax, ebx
pop ebx
jne 0x402fc1
pop ecx
jmp 0x402944
ret
Function at 0x40383c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4774a4
mov esi, 0x477038
mov edi, 0x47703c
cmp byte [ebx + 0x24], 0
jne 0x40386b
cmp dword [edi], 0
je 0x40386b
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x40385a
cmp dword [0x477040], 0
je 0x4038b2
call fcn.004037b8
cmp byte [0x477048], 0
je 0x403898
mov edx, 0x47502c
mov eax, 0x47721c
call fcn.00405624
call fcn.004055a7
jmp 0x4038ab
push 0
push 0x47504c
push 0x47502c
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x477040], eax
cmp byte [ebx + 0x24], 2
jne 0x4038c2
cmp dword [esi], 0
jne 0x4038c2
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.0040368c
cmp byte [ebx + 0x24], 1
jbe 0x4038d2
cmp dword [esi], 0
je 0x4038ef
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4038ef
call fcn.00405028
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x4038ef
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.00403664
cmp byte [ebx + 0x24], 1
jne 0x4038fd
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403908
call fcn.00403808
cmp dword [ebx], 0
jne 0x403915
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x4038b2

Function at 0x4039a4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004026e4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x477049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40396c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x403ff8
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00403fbc
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00403fbc
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x403fa4
ret

Function at 0x4040a0
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402770
test ecx, ecx
je fcn.00403fbc
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x403fa4
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret
Function at 0x42b5f8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x42b629
je 0x42b683
sub eax, 7
je 0x42b64a
dec eax
je 0x42b674
sub eax, 0x17
je 0x42b704
jmp 0x42b742
add eax, 0xffffff00
sub eax, 9
jb 0x42b6f0
add eax, 0xffffff09
sub eax, 0xb
jb 0x42b6da
jmp 0x42b742
mov eax, ebx
call fcn.0043b82c
mov edi, eax
test edi, edi
je 0x42b7a2
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xc8]
test al, al
je 0x42b7ab
jmp 0x42b7a2
test byte [ebx + 0x44], 0x20
jne 0x42b7ab
jmp 0x42b7a2
mov edx, esi
mov eax, ebx
call fcn.00428ee4
cmp dword [esi + 0xc], 0xffffffff
jne 0x42b7ab
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00406900
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.0042797c
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0042b4a8
test eax, eax
je 0x42b7ab
mov dword [esi + 0xc], 1
jmp 0x42b7ab
mov edx, esi
mov eax, ebx
call fcn.0042b56c
test al, al
jne 0x42b7ab
jmp 0x42b7a2
mov eax, ebx
call fcn.0042855c
test al, al
jne 0x42b7ab
jmp 0x42b7a2
mov eax, ebx
call fcn.0042db28
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x42b7a2
cmp dword [0x475750], 0
je 0x42b7a2
mov eax, dword [0x475750]
cmp ebx, dword [eax + 0x24]
jne 0x42b7a2
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x475750]
call fcn.00428e00
jmp 0x42b7a2
mov eax, dword [0x477730]
cmp byte [eax + 0x20], 0
je 0x42b7a2
mov eax, dword [0x477730]
cmp dword [eax + 0x1c], 0
je 0x42b7a2
mov eax, dword [esi]
mov edx, dword [0x477730]
cmp eax, dword [edx + 0x1c]
jne 0x42b7a2
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.0043b740
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb9
call fcn.00402f94
jmp 0x42b7ab
mov edx, esi
mov eax, ebx
call fcn.00428ee4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42dc68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call fcn.0042d81f
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x42dcf5
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0042d86a
push eax
push esi
push dword [ebp + 8]
call fcn.0042d81f
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0042d85a
pop eax
pop ss
dec eax
mov ch, 0x88
popfd
jl 0x42dcdf
invalid
Function at 0x42df50
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x42df31
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x42df4f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
inc esp
or bh, bh
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x42dfad
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x42df94
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x42df9d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x42dfa7
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x42df89
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x42df13
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x42dffa
dec eax
je 0x42dff1
sub eax, 3
je 0x42dfe8
mov dword [ebp - 4], 0x40
jmp 0x42e017
mov dword [ebp - 4], 4
jmp 0x42dffd
mov dword [ebp - 4], 0x20
jmp 0x42dffd
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x42e049
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x42dfc9
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0042d85a
cmp esi, dword [ecx + 0x75ff1c36]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x42e055
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42df5c
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x42df31
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x42df4f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
inc esp
or bh, bh
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x42dfad
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x42df94
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x42df9d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x42dfa7
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x42df89
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x42df13
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x42dffa
dec eax
je 0x42dff1
sub eax, 3
je 0x42dfe8
mov dword [ebp - 4], 0x40
jmp 0x42e017
mov dword [ebp - 4], 4
jmp 0x42dffd
mov dword [ebp - 4], 0x20
jmp 0x42dffd
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x42e049
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x42dfc9
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0042d85a
cmp esi, dword [ecx + 0x75ff1c36]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x42e055
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42f3e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movsb byte es:[edi], byte [esi]
add byte [eax], al
add byte [eax - 0x78b5b], al
je 0x42f3de
invalid
inc dword [eax]
je 0x42f3de
invalid
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.0042d86a
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.0042d7cb
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp fcn.0042f7d2
Function at 0x42f540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add al, byte [eax]
add byte [ebx - 0x6fb43], al
inc dword [ebx]
jne fcn.0042f5e4
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e