joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416a00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f708
push 0x41af78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x416a66
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3d]
jmp 0x416aef
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x4550
je 0x416a8d
mov byte [ebp - 0x3e], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3e]
jmp 0x416aef
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0xd8]
cmp dword [ebp + 0xc], eax
jb 0x416ac8
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + 0xd8]
mov eax, dword [ebp - 0x3c]
add edx, dword [eax + 0xdc]
cmp dword [ebp + 0xc], edx
jae 0x416ac8
mov byte [ebp - 0x3f], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3f]
jmp 0x416aef
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x40]
jmp 0x416aef
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416b90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x45fb80]
mov dword [ebp - 4], eax
jmp 0x416ba9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x416bc6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x416ba0
mov esp, ebp
pop ebp
ret
Function at 0x416bd0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x45fb90], eax
je 0x416bee
mov eax, 0x10dd
jmp 0x416cd0
mov eax, dword [0x45fba0]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x416c6d
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
xor eax, eax
mov al, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x416c4b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x10], 0
je 0x416c4b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.00416d40
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00418dca
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x416bf6
mov dword [0x45fba0], 0
call fcn.00416ce0
mov ecx, dword [0x45fb9c]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x416cba
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00418dca
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x416c85
mov dword [0x45fb9c], 0
mov dword [0x45fb90], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x417240
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x417255
xor eax, eax
jmp 0x4172ca
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x10000
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x417282
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x38d
jae 0x4172c5
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
cmp dword [eax + edx + 0x40], 0
je 0x4172c3
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x4172bf
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x4172c3
xor eax, eax
jmp 0x4172ca
jmp 0x417279
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x417380
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x45fb94], 0
je 0x417399
mov eax, dword [0x45fb94]
jmp 0x417439
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x4173ab
xor eax, eax
jmp 0x417439
push 8
call fcn.00419ca0
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x417401
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x4173ea
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00418dca
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x45fb94], eax
mov dword [0x45fb98], 0
mov eax, dword [ebp - 8]
jmp 0x417439
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x41741b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x4173cb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x45fb9c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x45fb9c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x417c60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.00417d30
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x417d1c
cmp dword [ebp - 4], 0x50000000
jb 0x417c9c
cmp dword [ebp - 4], 0x80000000
ja 0x417c9c
mov dword [ebp - 4], 0x80010000
jmp 0x417c75
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.0041a740
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x417cc2
jmp 0x417d1c
cmp dword [ebp - 0x10], 0x10000
jne 0x417d05
cmp dword [ebp - 0x14], 0x10000
jb 0x417d05
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x417cf8
mov eax, dword [ebp - 0x24]
jmp 0x417d1e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x417d17
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.00417d30
add esp, 4
mov dword [ebp - 4], eax
jmp 0x417c75
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x417d70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.00417e40
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x417e34
cmp dword [ebp - 4], 0x50000000
jb 0x417db1
cmp dword [ebp - 4], 0x80000000
ja 0x417db1
mov dword [ebp - 4], 0x4fff0000
jmp 0x417d8a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.0041a740
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x417dd7
jmp 0x417e34
cmp dword [ebp - 0x10], 0x10000
jne 0x417e1a
cmp dword [ebp - 0x14], 0x10000
jb 0x417e1a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x417e0d
mov eax, dword [ebp - 0x24]
jmp 0x417e36
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x417e2f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.00417e40
add esp, 4
mov dword [ebp - 4], eax
jmp 0x417d8a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x417e80
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x45fbd0], 0
je 0x417e96
xor eax, eax
jmp 0x4180b1
cmp dword [0x45fbcc], 0
je 0x417ea9
mov eax, dword [0x45fbcc]
jmp 0x4180b1
push 0x24
push 0
push 0x45fba8
call fcn.0041a740
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x45fba8], eax
push 0
push 0
push 0x454008
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x45fbac], eax
cmp dword [0x45fbac], 0
jne 0x417f4e
mov dword [0x45fbd0], 1
cmp dword [0x45fbac], 0
je 0x417f01
mov eax, dword [0x45fbac]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x45fbb0], 0
mov dword [0x45fbb4], 0
mov dword [0x45fbb8], 0
mov dword [0x45fbbc], 0
mov dword [0x45fbc0], 0
mov dword [0x45fbc4], 0
mov dword [0x45fbc8], 0
xor eax, eax
jmp 0x4180b1
push str.ImagehlpApiVersionEx
mov ecx, dword [0x45fbac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45fbb0], eax
push str.SymInitialize
mov edx, dword [0x45fbac]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45fbb4], eax
push str.SymSetOptions
mov eax, dword [0x45fbac]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45fbb8], eax
push str.SymGetOptions
mov ecx, dword [0x45fbac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45fbbc], eax
push str.SymLoadModule64
mov edx, dword [0x45fbac]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45fbc0], eax
push str.SymGetModuleInfo64
mov eax, dword [0x45fbac]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45fbc4], eax
push str.SymFromName
mov ecx, dword [0x45fbac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45fbc8], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.0041a740
add esp, 0xc
mov word [ebp - 8], 7
cmp dword [0x45fbb0], 0
je 0x418030
cmp dword [0x45fbb4], 0
je 0x418030
cmp dword [0x45fbc0], 0
je 0x418030
cmp dword [0x45fbc4], 0
je 0x418030
cmp dword [0x45fbc8], 0
jne 0x418035
jmp 0x417ee2
lea eax, [ebp - 8]
push eax
call dword [0x45fbb0]
mov ecx, dword [ebp - 8]
and ecx, 0xffff
cmp ecx, 7
jge 0x418052
jmp 0x417ee2
push 0
push 0
mov edx, dword [0x45fba8]
push edx
call dword [0x45fbb4]
test eax, eax
jne 0x41806c
jmp 0x417ee2
cmp dword [0x45fbbc], 0
je 0x4180a2
cmp dword [0x45fbb8], 0
je 0x4180a2
call dword [0x45fbbc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and al, 0xf8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
or ecx, 4
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x45fbb8]
mov dword [0x45fbcc], 0x45fba8
mov eax, dword [0x45fbcc]
mov esp, ebp
pop ebp
ret

Function at 0x418dd5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4541fc]
jne 0x418ddf
repz ret
jmp fcn.0041c7ea
Function at 0x422ff4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041c1f9
and dword [ebp - 4], 0
cmp dword [0x4606fc], 0
mov ebx, eax
jne 0x4230a5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x423156
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4412bc
push edi
call esi
test eax, eax
je 0x423156
push eax
call fcn.0041c187
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4606fc], eax
call esi
push eax
call fcn.0041c187
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x460700], eax
call esi
push eax
call fcn.0041c187
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x460704], eax
call esi
push eax
call fcn.0041c187
pop ecx
mov dword [0x46070c], eax
test eax, eax
je 0x4230a5
push 0x441264
push edi
call esi
push eax
call fcn.0041c187
pop ecx
mov dword [0x460708], eax
mov eax, dword [0x460708]
cmp eax, ebx
je 0x4230fd
cmp dword [0x46070c], ebx
je 0x4230fd
push eax
call fcn.0041c202
push dword [0x46070c]
mov esi, eax
call fcn.0041c202
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4230fd
test edi, edi
je 0x4230fd
call esi
test eax, eax
je 0x4230f4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4230f4
test byte [ebp - 0xc], 1
jne 0x4230fd
or dword [ebp + 0x10], 0x200000
jmp 0x423136
mov eax, dword [0x460700]
cmp eax, ebx
je 0x423136
push eax
call fcn.0041c202
pop ecx
test eax, eax
je 0x423136
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x423136
mov eax, dword [0x460704]
cmp eax, ebx
je 0x423136
push eax
call fcn.0041c202
pop ecx
test eax, eax
je 0x423136
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4606fc]
call fcn.0041c202
pop ecx
test eax, eax
je 0x423156
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x423158
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x427620
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.00424c00
mov eax, dword [0x4541fc]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x427685
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x427685
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.00420dae
add eax, 0x40
push eax
call fcn.00436e58
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00418dd5
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.00436d20
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x427714
call fcn.00427540
test eax, eax
jle 0x427714
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00418dd5
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00418dd5
add esp, 0x108
ret
Function at 0x6354d6
Capabilities:
Encrypt data using aes

Disassembly:
push 0x640bf8
jmp 0x6355e1
mov ax, word [esp]
mov eax, dword [esp]
jmp 0x6355d0
jmp 0x635520
mov esi, dword [ebx]
pop ebx
sub esp, 7
lea esp, [esp + 3]
jmp 0x635536
lea esi, [eax + ebx]
pop si
lea esp, [esp + 2]
push ebx
mov ebx, 0x641574
jmp 0x63550a
lea esp, [esp + 4]
and dword [ebx], 0
jmp 0x63558c
push 0x640be8
call fcn.0063556f
push edx
push edi
test esi, esi
jne 0x6354f4
je 0x635564
lea esp, [esp + 8]
test edi, edi
push ebx
jmp 0x6355fc
push 0x16
call 0x6355ba
lea esp, [esp + 4]
pop eax
jmp 0x635472
push edi
call fcn.0064b6e4
pop eax
bsr si, bp
jmp 0x635622
lea esp, [esp + 4]
jne 0x635488
je 0x6354c0
lea esp, [esp + 4]
je 0x6354c0
call fcn.00686aa2
or byte [edx - 0x6148fb6b], bh
jmp 0xf6e946b1
mov esi, eax
test esi, esi
push eax
jmp 0x63560c

Function at 0x6415e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x64161a
push word [esp + 2]
lea esp, [esp + 2]
jmp 0x6416f4
push dword [esp]
js 0x641604
push word [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x2c], edx
jmp 0x6416f8
mov dword [esp + 0x2c], edx
call fcn.0064169e
call fcn.006417b9
lea esi, [esi*4]
jmp 0x6417fd
xchg dx, bp
xchg cx, ax
jmp 0x6417dc
xchg dx, bp
xchg cx, ax
lea edi, [esp]
mov bx, 0x2ff9
jmp 0x641820
xchg ebx, eax
mov dx, ax
xor ecx, ebp
jnp fcn.0064180a
jp fcn.0064180a
add edx, 0x89190d89
jmp 0x643be2
mov esi, dword [esp + 0x2c]
not dl
add dl, 0x76
jno 0x6417d6
jo 0x6417c0
lea edx, [ecx + edi]
sub esp, 0xc0
mov ebp, esp
lea edx, [esi + edi]
jmp 0x6417e5
jmp 0x643bfd
not bh
clc
jmp 0x643c34
shr bh, 2
mov bh, 0x74
jmp 0x643c3d
lea esp, [esp + 2]
jmp 0x643c6b
js 0x643c06
shr bh, 2
mov bh, 0x74
jmp 0x643c0b
mov esp, esi
lea ebx, [ebp*4]
sub esp, 0x1a
jb 0x643c0d
lea esp, [esp + 2]
jmp 0x643c6b
push edx
ret

Function at 0x6415f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xf], bp
mov dword [esp + 0x28], ecx
call fcn.006415e0

Function at 0x641684
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0634690
jmp 0x64171b
lea esp, [esp + 3]
push edi
push word [esp + 1]
jnp 0x6416c5
jp 0x6416af
lea esp, [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 0x24], edi
jmp 0x6416db
lea esp, [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x64174b
lea esp, [esp + 0x24]
jmp 0x64174b
bswap eax
mov al, ch
bsr di, bx
jnp 0x6416fd
jp 0x641702
mov eax, dword [reloc.MSVCRT.dll___dllonexit]
xlatb
loopne 0x641752
lea esi, [esi*4]
jmp 0x6417fd
pushfd
jmp 0x6415e2
xor al, 0x8d
add byte [eax], al
add byte [eax], al
lea eax, [esi + edi]
mov si, word [esp]
jmp 0x64179e
xchg dword [esp + 0x10], ecx
mov ch, byte [esp]
btc eax, ebp
mov bl, byte [esp]
neg bh
mov cl, bl
jmp 0x641844
push dword [esp + 0x10]
ret 0x14
Function at 0x685e99
Capabilities:
Encrypt data using aes

Disassembly:
lea ecx, [ecx + edi]
jmp 0x6870ff
pushfd
add esp, 2
lea esp, [esp + 2]
jmp 0x6862e6
lea esp, [esp + 2]
popal
mov bp, 0x50fb
dec ebp
bsr bp, cx
jmp 0x685eb4
add esp, 2
jmp 0x685e83
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
lea ebp, [eax + ebp]
jmp 0x685ee9
and edi, esi
sub esp, 5
push word [esp + 3]
lea esp, [esp + 3]
jmp 0x685e9e
mov ebp, 0xff00
push ax
push word [esp]
and edi, ebp
jmp 0x685f3f
xor eax, dword [ecx]
bsf di, si
bsr edi, ecx
mov di, word [esp]
cmp edi, ecx
jmp 0x685f29
lea edi, [ecx + 0x10]
jmp 0x685f4d
xor eax, edi
ror edi, 0x11
mov di, dx
lea esp, [esp + 8]
jmp 0x685ef8
xor ebx, eax
push ecx
mov dword [edi], eax
mov ax, 0x5396
jmp 0x685f8d
sub esp, 0x11
pop word [esp + 1]
lea esp, [esp + 3]
jmp 0x685f99
neg eax
mov eax, dword [esp]
mov eax, dword [ecx + 8]
xor eax, ebx
jmp 0x685f77
mov dword [ecx + 0x14], ebx
mov bh, byte [esp]
mov dword [ecx + 0x18], eax
inc ebx
jmp 0x685fa9
lea ebx, [ecx + ebx]
lea ebx, [ecx + ebp]
jmp 0x685fd2
xor edx, eax
sub esp, 6
lea esp, [esp + 2]
mov dword [ecx + 0x1c], edx
jmp 0x687268
mov ecx, dword [ecx*4 + reloc.MSVCRT.dll___dllonexit]
call fcn.00686023
pushfd
cmc
push word [esp + 3]
lea esp, [esp + 2]
push ebx
jmp 0x6860b8
lea ebx, [ebx*4]
lea ebx, reloc.MSVCRT.dll___dllonexit
mov edx, dword [ebx]
pop ebx
jmp 0x6860c7
pushal
mov bx, word [esp]
mov ax, bx
mov dword [esp + 0x10], edx
popal
jmp 0x6860a2
clc
shr edi, 0x18
stc
push edx
jmp 0x6861b3
xor ecx, edx
jmp 0x68610b
pushfd
lea esp, [esp]
and ecx, esi
clc
push esi
jmp 0x68606d
lea esp, [esp + 0x5c]
xor ecx, dword [ebx]
mov di, 0x649c
call fcn.006860f5
push eax
lea esp, [esp + 4]
add ebx, 4
mov dword [edi], ecx
jmp 0x68612a
add edx, 0xace3872e
jmp 0x686170
mov edx, dword [ebx]
pop ebx
stc
sub esp, 1
push si
lea esp, [esp + 3]
jmp 0x68618e
push ebx
mov ebx, eax
add ebx, 4
jmp 0x68614f
xor edx, ecx
mov cl, al
mov ecx, 0x588673b5
btc ecx, eax
call fcn.00686178
mov edx, 0x3bc8a939
xchg byte [edx + ebx - 0x57e51078], bl
invalid
movzx edi, byte [edi*4 + 0x63f3c0]
pushal
xor ecx, edi
and edx, ebp
jmp 0x6860d2
shr ecx, 8
dec di
mov di, sp
mov edi, edx
jmp 0x6860e8
mov eax, edi
mov edx, 0xa84e5834
mov edx, dword [eax + 0xc]
mov ecx, edx
jmp 0x685a02
mov ebx, 0x640bc4
lea esp, [esp + 0x14]
jmp 0x6859fa

Function at 0x686201
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x686209
xor edx, ecx
sub esp, 2
stc
jmp 0x6861eb
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x28]
cmp ebx, 0x640be8
jmp 0x686252
push 0xa
pop eax
mov bp, sp
mov bl, byte [esp]
jmp 0x68623c
jne 0x6859fa
mov bx, 0xa31f
lea ebx, [ecx + edx]
not eax
jmp 0x686218

Function at 0x6865d8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x1b
lea esp, [esp + 3]
jmp 0x686614
mov dword [esi], edi
mov di, 0xec2a
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
neg di
jmp 0x6865fe
Function at 0x686801
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 2
lea esp, [esp + 2]
jmp 0x686822
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
stc
jmp 0x686865
and edi, ecx
stc
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
call fcn.0068683c
movzx ebx, byte [esi + 0xa]
clc
pushal
jmp 0x68690b
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
and ebx, ecx
call fcn.006868c6

Function at 0x686919
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
lea esp, [esp + 4]
jmp 0x686925
xor edi, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
lea edx, [ebp + 0xd2]
not edx
mov edx, 0x61ca1728
not dl
jmp 0x686e3c
mov edx, dword [esi + 0xc]
cmc
mov dword [esi + 8], edi
call fcn.00686a9a
xor esi, esi
jmp 0x687359
pop esi
jmp 0x686f79
call 0x68747f
mov ch, 0x3b
stosd dword es:[edi], eax
into
cmp eax, 0xb21c9d8a
aad 0x24
wait
in eax, dx
imul edi, ecx, 0x8db6b98
stosd dword es:[edi], eax
jmp 0x68718e
call 0x687500
and byte [edx + 0x2daa5f38], ch
dec ebx
iretd
lea eax, [eax + ebp]
mov eax, dword [esp]
jmp 0x687397
call 0x687406
jmp 0x6a036f97
pushfd
jmp 0x687473
push edi
xor eax, eax
lea esp, [esp + 4]
jmp 0x686e5e
test ebx, ebx
jmp 0x687377
jns 0x6873c3
mov ebx, 0x8b9c0d92
cmp ebx, dword [ebx - 0x17]
sar edx, 1
invalid
mov edi, dword [ebx]
pop ebx
jmp 0x686e48
jl 0x68707d
jge 0x686fa5
in eax, dx
jae 0x687369
xchg byte [ebp - 0x3e], dh
mul cl
and byte [ebx - 0x66], ah
cmc
push ebx
mov ebx, ebp
lea ebx, [ebx - 8]
jmp 0x68736f
mov eax, dword [ebp - 0x10]
setno dh
setg dl
mov edx, dword [eax + esi*4]
jmp 0x687462
mov ax, word [esp]
mov al, byte [esp]
jmp 0x6873e5
in eax, dx
cli
invalid
lea esp, [esp + 0x20]
test eax, eax
je 0x68701e
and byte [ebp + 0x4b840fc0], al
cld
invalid
jne 0x68742a
dec esp
leave
pop ecx
cmp bl, cl
jge 0x6873ca
push 0xfffffffffffffff8
lahf
push 0xffffffffffffffdb
or esp, dword [edx + reloc.MSVCRT.dll___dllonexit]
or al, 0xe8
outsb dx, byte [esi]
or edi, ebp
jmp dword [eax - 0x15]
mov eax, dword [ebp + 0xc]
call fcn.00657f5b
pushal
jmp 0x6873c7
inc esi
cmp esi, ebx
jle 0x686fa5
jmp 0x68707d
pushfd
mov eax, 0xbca6ff02
mov ah, 0x8a
pop eax
add edx, dword [ebp + 8]
jmp 0x6873a8
mov eax, dword [ebp - 0xc]
lea esp, [esp + 4]
jmp 0x686ee8

Function at 0x686b72
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
lea esp, [esp + 2]
jmp 0x686b9a

Function at 0x686b8a
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
jmp 0x686b06