joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021990
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10067040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10016422
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10016422
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10021a07
cmp word [ecx], dx
je 0x10021a07
mov eax, dword [0x1002a5ac]
push edi
dec eax
push eax
push 0x1002a498
call fcn.1002192f
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10021a7a
cmp word [eax], dx
je 0x10021a7a
mov eax, dword [edi]
test eax, eax
je 0x10021a2b
cmp word [eax], dx
je 0x10021a2b
lea eax, [ebp - 0x10]
push eax
call fcn.10021312
jmp 0x10021a34
lea eax, [ebp - 0x10]
push eax
call fcn.100213ad
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10021aa4
mov eax, dword [0x1002a494]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1002a188
call fcn.1002192f
add esp, 0xc
test al, al
je 0x10021aa4
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10021a6f
cmp word [eax], di
je 0x10021a6f
lea eax, [ebp - 0x10]
push eax
call fcn.10021312
pop ecx
jmp 0x10021aa6
lea eax, [ebp - 0x10]
push eax
call fcn.100213ad
jmp 0x10021a6c
mov eax, dword [edi]
test eax, eax
je 0x10021a91
cmp word [eax], dx
je 0x10021a91
lea eax, [ebp - 0x10]
push eax
call fcn.100212c7
pop ecx
jmp 0x10021aa4
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10021b6f
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100217b4
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10021b6f
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10021b6f
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10021b6f
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10021afc
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1001985c
test ebx, ebx
je 0x10021b6a
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1001985c
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10021b6f
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10021b6f
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10023422
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10021b71
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a552
leave
ret
Function at 0x10024d10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10024d3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10024d3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1000100c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x1003bfe8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x10001050
call ebx
test eax, eax
jns 0x10001046
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x1003bfec], eax
mov dword [0x1003bfe8], 1
mov eax, dword [0x1003bfec]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000106c
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000109c
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x10001092
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x10001087
push dword [eax + 0xc]
call dword [eax + 8]
jmp 0x1000108c
push dword [eax + 4]
call dword [eax]
test eax, eax
je 0x1000109b
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x10001fe2
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
push esi
mov esi, ecx
test eax, eax
jg 0x10001ff4
call fcn.100016a4
test eax, eax
jle 0x1000200f
push edi
movzx ecx, byte [esi]
movzx ecx, byte [ecx + 0x10033450]
mov edi, edx
shl edi, 3
xor ecx, edi
xor edx, ecx
inc esi
dec eax
test eax, eax
jg 0x10001ff5
pop edi
mov eax, edx
and eax, 0x7fffffff
pop esi
ret

Function at 0x10006f4d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add cl, byte [ebx - 0x173eefbb]
adc byte [ebp - 0x77bd0bab], cl
add cl, byte [ebx - 0x173eefbb]
or byte [ebp - 0x3d7c0bab], cl
add cl, byte [eax + 0x10458b02]
lea edx, [ebp - 0xc]
add edx, 3
mov byte [edx], al
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0

Function at 0x10006f87
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
cmp eax, edx
jb 0x10006f9a
jmp 0x10006fd8
mov eax, 1
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
jmp 0x10006f81
mov eax, dword [ebp - 8]
add eax, dword [ebp + 8]
movzx eax, byte [eax]
movzx eax, al
lea edx, [ebp - 0xc]
add edx, dword [ebp - 4]
movzx edx, byte [edx]
movzx edx, dl
xor eax, edx
mov edx, dword [ebp - 8]
add edx, dword [ebp + 8]
mov byte [edx], al
mov eax, 1
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 4
jne 0x10006f8d
mov dword [ebp - 4], 0
jmp 0x10006f8d
leave
ret 0xc
Function at 0x483cb5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0x483c96
xchg dword [esp + 4], ecx
call fcn.00483c71
pushfd
jmp 0x47aab0
neg ebp
jmp 0x483cd6
inc ax
jmp 0x483cc0
lea esp, [esp + 3]
pushfd
lea esp, [esp + 1]
jmp 0x483c87
mov ebp, dword [esp + 0x2c]
xchg di, ax
cmc
jl 0x483d4c
neg ecx
jmp 0x483d4e
jae 0x483c9e
inc ax
call fcn.00483ce0
and byte [esi - 0x47], 0xe7
mov cx, 0xade7
neg ecx
rdtsc
call fcn.00483dd3
mov cs, word [eax]
sahf
stc
or bl, ah
and byte [ebp + 0x4baf5c35], ah
push esp
jmp 0x483d36
rdtsc
jmp 0x483d7b
sub esp, 0xbc
mov esi, esp
lea eax, [eax*4]
call fcn.00483e0c
ror dword [ebx - 0x25], 0xbe
dec ebp
mov edx, 0xbb58796e
lea edi, [esp]
pushfd
mov bl, 0x3d
bswap esi
dec bx
jmp 0x483e22
jae 0x483d52
jb 0x483d52
Function at 0x49e008
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
jmp 0x49e027
push 0xf048b7dc
jmp 0x49e05d
jno 0x49e03d
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0x49e045
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0x49e076
mov ebp, dword [esp + 0x2c]
lea edx, reloc.KERNEL32.dll_GetModuleHandleA
xchg cl, bl
jmp 0x49e0a4
mov ebx, 0xffdfa87b
xchg edi, ebp
jmp 0x49e047
pushfd
jmp 0x49e00e
jmp 0x49e0c0
mov edi, esp
mov cx, word [esp]
lea ebx, [ebx*4]
mov ebx, ebp
inc al
jmp 0x49f003
lea edi, [edi*4]
not bh
lea esi, [esp]
rcl cx, 8
jp 0x49e079
stc
jmp 0x49e0c1
stc
sub esp, 0xc0
jmp 0x49e07b
sbb ah, ch
jmp 0x49ecb6
sbb ah, ch
lea edx, [ebx*4]
btr ax, cx
bsr dx, bp
inc edx
jmp 0x49e52f
not dl
add ebp, 0x460e1b5e
bt dx, si
jg 0x49e4dc
jle 0x49e4e4
bsf edx, ecx
jge 0x49e53b
rdtsc
mov cx, word [esp]
mov edx, esp
mov eax, dword [esp]
jmp 0x49e558
inc edx
inc eax
ror ebp, 0
setg dh
call fcn.0049e6db
rdtsc
mov cx, word [esp]
jmp 0x49e56e
xchg dl, dh
jmp 0x49e575
mov edx, esp
mov eax, dword [esp]
xchg dl, dh
ror ebp, 0
sub esp, 0x15
jge 0x49e5a5
jl 0x49e5ef
xor al, 0xbb
sub ecx, dword [esi - 0x43]
pop ebp
sbb bl, byte [edx + esi + 0x694fa455]
mov byte [ebx], ch
inc edx
std
int3
mov word [esp + 4], sp
neg ax
bsf cx, si
inc dx
lea eax, [ecx*4]
jmp 0x49e613
inc dx
lea eax, [ecx*4]
jmp 0x49e613
mov word [esp + 4], sp
neg ax
bsf cx, si
jmp 0x49e5d9
mov ah, al
bsf eax, ecx
jo 0x49e6a4
btc cx, di
call fcn.0049e64b
jnp 0x49e665
lea esp, [esp + 1]
lea esp, [esp + 0x14]
inc ebp
mov ecx, dword [esp]
xchg cx, ax
jmp 0x49e5fd
invalid
btc cx, di
setp dh
jmp 0x49e79a
add ebp, dword [esi]
pushal
push word [esp + 2]
jnp 0x49e70f
not dx
jmp 0x49e730
jbe 0x49e729
neg dx
bswap edx
jmp 0x49e72e
not dx
jmp 0x49e746
neg dx
bswap edx
jmp 0x49e6f0
lea esp, [esp + 2]
jmp 0x49e772
lea esp, [esp + 2]
jmp 0x49e772
mov ecx, dword [esp]
sub ebp, 0x3f6782a
xchg edx, eax
sub esp, 4
jmp 0x49e706
lea edx, [ebx*4]
btr ax, cx
bsr dx, bp
jmp 0x49e52e
mov edx, dword [esp]
lea eax, reloc.KERNEL32.dll_GetModuleHandleA
clc
jmp 0x49fab1
jnp 0x49faa2
seto dh
dec ah
jmp 0x49ed8e
seto dh
dec ah
mov edx, dword [esp]
lea eax, reloc.KERNEL32.dll_GetModuleHandleA
clc
lea ecx, reloc.KERNEL32.dll_GetModuleHandleA
jmp 0x49e508
Function at 0x4a5d23
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf048b7dc
jmp 0x4a5d70
mov dword [esp + 4], ebx
jmp 0x4a5d1e
mov dword [esp + 4], ebx
call 0x4a5d3a
mov dword [esp + 4], ebp
pushal
call 0x4a5d46
popfd
push ss
test bl, ah
push ds
in eax, dx
or eax, 0x8d7e1b8b
insd dword es:[edi], dx
scasb al, byte es:[edi]
mov byte [esp], bl
mov dword [esp + 4], esp
call 0x4a5d23
mov byte [esp + 0x22], ch
jmp 0x4a5d86
pop word [esp]
lea esp, [esp]
push word [esp]
jbe 0x4a5d1a
ja 0x4a5d04
neg si
jmp 0x4a5d98
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
pushfd
jmp 0x4a415e
ja 0x4a5dae
bsf di, bx
jmp 0x4a5db2
bsf di, bx
mov edi, dword [esp + 0x2c]
mov cl, byte [esp]
jmp 0x4a5e05
jmp 0x4a5de8
sub esp, 0xbc
mov ebp, esp
btc ebx, eax
jae 0x4a5dbb
neg bh
jmp 0x4a5e2c
neg bh
mov ecx, dword [esp]
cpuid
rdtsc
lea esi, [esp]
pushfd
lea ebx, [eax*4]
jmp 0x4a5dd1
mov ecx, dword [esp]
call fcn.004a5e16
idiv byte [esi - 0x14]
mov eax, dword [esi - reloc.KERNEL32.dll_GetModuleHandleA]
cmpsb byte [esi], byte es:[edi]
push ebp
aam 0x56
aam 0x4a
sub eax, 0x80c13adc

Function at 0x4a5d3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf048b7dc
jmp 0x4a5d70
mov dword [esp + 4], ebx
jmp 0x4a5d1e
mov dword [esp + 4], ebx
call 0x4a5d3a
mov dword [esp + 4], ebp
pushal
call 0x4a5d46
popfd
push ss
test bl, ah
push ds
in eax, dx
or eax, 0x8d7e1b8b
insd dword es:[edi], dx
scasb al, byte es:[edi]
mov byte [esp], bl
mov dword [esp + 4], esp
call 0x4a5d23
mov byte [esp + 0x22], ch
jmp 0x4a5d86
pop word [esp]
lea esp, [esp]
push word [esp]
jbe 0x4a5d1a
ja 0x4a5d04
neg si
jmp 0x4a5d98
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
pushfd
jmp 0x4a415e
ja 0x4a5dae
bsf di, bx
jmp 0x4a5db2
bsf di, bx
mov edi, dword [esp + 0x2c]
mov cl, byte [esp]
jmp 0x4a5e05
jmp 0x4a5de8
sub esp, 0xbc
mov ebp, esp
btc ebx, eax
jae 0x4a5dbb
neg bh
jmp 0x4a5e2c
neg bh
mov ecx, dword [esp]
cpuid
rdtsc
lea esi, [esp]
pushfd
lea ebx, [eax*4]
jmp 0x4a5dd1
mov ecx, dword [esp]
call fcn.004a5e16
idiv byte [esi - 0x14]
mov eax, dword [esi - reloc.KERNEL32.dll_GetModuleHandleA]
cmpsb byte [esi], byte es:[edi]
push ebp
aam 0x56
aam 0x4a
sub eax, 0x80c13adc
Function at 0x4a5d46
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf048b7dc
jmp 0x4a5d70
mov dword [esp + 4], ebx
jmp 0x4a5d1e
mov dword [esp + 4], ebx
call 0x4a5d3a
mov dword [esp + 4], ebp
pushal
call 0x4a5d46
popfd
push ss
test bl, ah
push ds
in eax, dx
or eax, 0x8d7e1b8b
insd dword es:[edi], dx
scasb al, byte es:[edi]
mov byte [esp], bl
mov dword [esp + 4], esp
call 0x4a5d23
mov byte [esp + 0x22], ch
jmp 0x4a5d86
pop word [esp]
lea esp, [esp]
push word [esp]
jbe 0x4a5d1a
ja 0x4a5d04
neg si
jmp 0x4a5d98
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
pushfd
jmp 0x4a415e
ja 0x4a5dae
bsf di, bx
jmp 0x4a5db2
bsf di, bx
mov edi, dword [esp + 0x2c]
mov cl, byte [esp]
jmp 0x4a5e05
jmp 0x4a5de8
sub esp, 0xbc
mov ebp, esp
btc ebx, eax
jae 0x4a5dbb
neg bh
jmp 0x4a5e2c
neg bh
mov ecx, dword [esp]
cpuid
rdtsc
lea esi, [esp]
pushfd
lea ebx, [eax*4]
jmp 0x4a5dd1
mov ecx, dword [esp]
call fcn.004a5e16
idiv byte [esi - 0x14]
mov eax, dword [esi - reloc.KERNEL32.dll_GetModuleHandleA]
cmpsb byte [esi], byte es:[edi]
push ebp
aam 0x56
aam 0x4a
sub eax, 0x80c13adc

Function at 0x4a5d61
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf048b7dc
jmp 0x4a5d70
mov dword [esp + 4], ebx
jmp 0x4a5d1e
mov dword [esp + 4], ebx
call 0x4a5d3a
mov dword [esp + 4], ebp
pushal
call 0x4a5d46
popfd
push ss
test bl, ah
push ds
in eax, dx
or eax, 0x8d7e1b8b
insd dword es:[edi], dx
scasb al, byte es:[edi]
mov byte [esp], bl
mov dword [esp + 4], esp
call 0x4a5d23
mov byte [esp + 0x22], ch
jmp 0x4a5d86
pop word [esp]
lea esp, [esp]
push word [esp]
jbe 0x4a5d1a
ja 0x4a5d04
neg si
jmp 0x4a5d98
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
pushfd
jmp 0x4a415e
ja 0x4a5dae
bsf di, bx
jmp 0x4a5db2
bsf di, bx
mov edi, dword [esp + 0x2c]
mov cl, byte [esp]
jmp 0x4a5e05
jmp 0x4a5de8
sub esp, 0xbc
mov ebp, esp
btc ebx, eax
jae 0x4a5dbb
neg bh
jmp 0x4a5e2c
neg bh
mov ecx, dword [esp]
cpuid
rdtsc
lea esi, [esp]
pushfd
lea ebx, [eax*4]
jmp 0x4a5dd1
mov ecx, dword [esp]
call fcn.004a5e16
idiv byte [esi - 0x14]
mov eax, dword [esi - reloc.KERNEL32.dll_GetModuleHandleA]
cmpsb byte [esi], byte es:[edi]
push ebp
aam 0x56
aam 0x4a
sub eax, 0x80c13adc

Function at 0x4e820c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jb 0x4e6b5e
mov ecx, edx
mov ax, bp
mov cx, word [esp]
jmp 0x4e7ffe
sub esp, 0xc
lea esp, [esp + 0xc]
add eax, 4
cmp ecx, 0x10
jmp 0x4e7e61
push di
lea esp, [esp + 2]
call fcn.004b360a
xor eax, eax
jmp 0x4e6b34
lea ecx, [esi + 8]
mov al, 0x9e
bswap eax
lea eax, [ebp - 0x40]
jmp 0x4e7f2f
clc
mov dword [ebp + ecx*4 - 0x40], edx
lea esp, [esp + 0x10]
inc ecx
jmp 0x4e7e77
sub esp, 0xc
lea esp, [esp + 1]
pop dword [esp]
lea esp, [esp + 3]
or edx, ebx
jmp 0x4e8071
push dword [esp + 2]
push dword [esp + 3]
shl edx, 8
jmp 0x4e80b4
Function at 0x5b8ef3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x43]
xchg dx, si
jmp 0x5b8f23
mov ah, 0x10
not esi
neg esi
bswap edx
std
rdtsc
jmp 0x5b8f53
xchg ah, al
mov dl, byte [esp]
mov dx, word [esp]
mov si, dx
mov dx, word [esp]
mov al, dh
jmp 0x5b8fb4
bsr si, si
mov dl, byte [esp + 2]
sub esp, 0x10
mov ax, 0xd50d
mov eax, 0x87f5774d
mov dx, bx
jmp 0x5b8fde
push ecx
mov si, dx
mov word [esp], di
not eax
lea esi, [edi + ebp]
xchg word [esp + 1], dx
jmp 0x5b8f8c
xchg word [esp + 7], ax
mov edx, dword [esp + 9]
add dh, bl
mov esi, edi
rdtsc
jmp 0x5b945c
rcr ax, 6
lea esi, reloc.KERNEL32.dll_GetModuleHandleA
mov dh, 0x54
mov ah, byte [esp + 3]
pop word [esp + 1]
dec eax
jmp 0x5b8fc8
cmc
mov edx, dword [esp + 4]
sub esp, 0x18
mov dh, 0x93
mov dword [esp + 0x13], eax
rcr dx, 6
jmp 0x5b904b
mov al, ch
setbe dl
shl al, cl
bswap esi
lea eax, [ebp*4]
push dword [esp + 2]
jmp 0x5b901a
bswap eax
mov dword [esp + 0x18], esp
mov byte [esp + 0x13], al
bsf ax, di
push word [esp + 0x18]
pushfd
jmp 0x5b91fd
lea esp, [esp + 0xb]
pushfd
xchg word [esp + 2], ax
pop dx
add esp, 0
push word [esp + 1]
jmp 0x5b9035
sub esp, 4
lea esp, [esp + 0x44]
xchg dx, ax
lea edx, [eax + ebx]
pushal
push dword [esp + 0xb]
jmp 0x5b90f7
mov ah, byte [esp + 2]
bsr eax, edi
inc si
mov al, byte [esp + 0x17]
adc dx, sp
mov si, di
jmp 0x5b908b
rcl dl, 0
xchg dword [esp + 0x14], eax
mov ax, 0xda12
jmp 0x5b911e
mov si, word [esp + 3]
std
rdtsc
std
mov edx, 0x4a4ebbdf
xchg word [esp + 0xb], ax
jmp 0x5b90c6
mov ax, bx
xchg dword [esp + 0x10], edx
clc
rdtsc
setp dl
bswap edx
jmp 0x5b90dc
xchg esi, eax
mov si, word [esp + 6]
push dword [esp + 0x12]
call fcn.005b9148
inc esi
int1
ljmp 0xff3d
lea esi, reloc.KERNEL32.dll_GetModuleHandleA
mov al, 0x62
neg esi
mov al, 0x50
mov esi, 0x8d992b39
xchg esi, eax
jmp 0x5b9108
sub esp, 0x15
cmc
dec dx
mov dword [esp + 0x1a], esp
lea edx, reloc.KERNEL32.dll_GetModuleHandleA
shr dh, cl
jmp 0x5b90b1
setg dl
dec dl
mov word [esp + 0x11], si
and dx, 0xe552
bswap edx
push dword [esp + 0x1f]
jmp 0x5b9172
push word [esp + 0xe]
mov dword [esp + 0xb], esi
mov dx, di
push word [esp + 4]
add esp, 0xa
std
jmp 0x5b9075

Function at 0x5b9217
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5b9260
clc
push dword [esp + 5]
btr eax, esp
mov esi, dword [esp + 1]
pop dword [esp]
mov esi, 0xec667cbd
jmp 0x5b924a
Function at 0x5b9419
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 6], dl
inc eax
xchg dl, al
lea esi, [ebx*4]
lea esi, [edi*4]
xchg edx, eax
jmp 0x5b93d4
bsf si, si
neg al
rdtsc
setnp al
push dword [esp + 1]
lea eax, [esi*4]
jmp 0x5b9388
xchg si, dx
bswap esi
sub esp, 0xd
xchg byte [esp + 0x18], ah
xchg ah, dl
bswap eax
jmp 0x5b93ef
push dword [esp + 1]
mov si, 0x730b
mov esi, dword [esp + 0xa]
lea esp, [esp + 1]
push dword [esp + 3]
mov eax, 0x3512e1ce
jmp 0x5b93be
mov dh, al
mov dx, 0x23a7
mov dl, byte [esp + 0xc]
pushfd
push word [esp + 0xc]
cld
jmp 0x5b943a
xchg word [esp + 7], ax
push ebp
not edx
push word [esp + 0x14]
jmp 0x5b9424
xchg word [esp + 2], dx
mov si, 0x9dc2
jmp 0x5b93a6
pop word [esp + 2]
pop dword [esp + 0xa]
mov al, 0x8e
push word [esp + 6]
jmp 0x5b9446
pop esi
pushfd
std
lea esi, [esp + esi]
mov ah, dh
mov al, dh
jmp 0x5b9402
mov edx, 0x610f6408
mov word [esp + 6], ax
lea eax, [eax + edx]
jmp 0x5b94c4
pop word [esp + 0xb]
mov esi, ebp
rcr al, cl
shr si, cl
jmp 0x5b94ac
mov si, word [esp + 0xe]
lea esi, [esi*4]
lea esi, [esi + edi]
lea esi, [esi*4]
mov word [esp + 0xb], ax
neg ax
jmp 0x5b9476
pop word [esp + 2]
cld
call fcn.005b94f2
or dl, byte [ebx + 0x75956603]
nop
adc al, 0x8a
in eax, dx
sbb al, 0xed
add dword [esi - 0x46], esp
packssdw mm1, qword [edi]
xor dword [ebp + reloc.KERNEL32.dll_GetModuleHandleA], ecx
mov esi, edi
mov dx, 0x6b0f
rdtsc
lea esp, [esp + 7]
mov si, di
lea edx, [esi*4]
not eax
jmp 0x5b948c
Function at 0x5bb534
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [ecx + ecx]
mov word [esp + 1], cx
mov dh, byte [esp + 3]
not dh
jmp 0x5bb554
mov eax, 0xaf762f76
pop word [esp]
xor ah, 0xce
lea eax, [edx*4]
jmp 0x5bb589
pushfd
mov ax, di
add esp, 2
mov dh, 0x82
pop dx
sub esp, 0
jmp 0x5bb5b5
rdtsc
ror dh, 5
mov dh, 0xfd
lea esp, [esp + 2]
lea edx, [edi*4]
rdtsc
jmp 0x5bb573
mov byte [esp], ch
push bx
setnp ah
mov ax, cx
dec esi
bswap eax
jmp 0x5bb61a
rdtsc
not dl
xchg dl, dh
mov esi, 0xca4b2aa
xchg dx, si
xchg si, ax
jmp 0x5bb59f
clc
mov si, word [esp + 2]
mov ax, word [esp]
mov esi, dword [esp]
inc al
jmp 0x5bb5f8
push word [esp]
setl dh
mov dh, 0xc7
lea esp, [esp + 2]
neg ah
lea edx, reloc.KERNEL32.dll_GetModuleHandleA
jmp 0x5bb5c7
mov esi, 0x288f682a
pop dx
neg edx
add esp, 0
and dx, dx
std
jmp 0x5bb62f
rol si, 2
mov si, 0x8c60
xchg dx, ax
mov ax, cx
cld
xchg byte [esp + 1], ah
jmp 0x5bb5e1
shr dl, 2
lea edx, [edx*4]
lea esi, [ecx + ecx]
xor eax, 0x3260a386
mov eax, esp
lea eax, [esi + edi]
jmp 0x5bb8a4
mov edx, esi
shl ax, 0xd
xchg byte [esp], al
call fcn.005bb6a2
btr edx, eax
neg ax
rol dx, cl
mov al, ch
mov dh, 0xc0
xchg byte [esp], al
jmp 0x5bb7b3
btc dx, bx
stc
ror al, cl
stc
lea edx, [edi + edi]
mov al, cl
jmp 0x5bb84e

Function at 0x5bdbbe
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.005bc7aa
jmp 0x5bdc11
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x5bdbfb
push ebx
mov ebx, eax
jmp 0x5bdc79
mov eax, dword [eax]
jmp 0x5bdbce
lea esp, [esp + 2]
mov dword [esp + 0x64], edi
lea esp, [esp + 0x64]
jmp 0x5bdbc0
lea ebx, [ebx + 8]
mov eax, dword [ebx]
pop ebx
push eax
jmp 0x5bc7a5
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x403203
pop dword [ebp - 0x50]
mov eax, 0xf92d8027
sub eax, 0xf8ed4e24
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x3164360
sub dword [ebp - 0x60], 0xb4c3fe15
mov dword [ebp - 0x5c], 0x30a8fde7
sub dword [ebp - 0x5c], 0xfe75b1a2
mov dword [ebp - 0x58], 0xcae9bac4
sub dword [ebp - 0x58], 0x7e9d7696
mov dword [ebp - 0x54], 0x9ffb507b
sub dword [ebp - 0x54], 0x9ffb507b
lea eax, [ebp - 0x60]
push eax
mov eax, 0x6530b1f3
add eax, 0x9b0fce99
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x2c614c9f
add dword [ebp - 0x60], 0x48111cb7
mov dword [ebp - 0x5c], 0xcdf3691d
sub dword [ebp - 0x5c], 0x8c8707a8
mov dword [ebp - 0x58], 0x1211a6d5
sub dword [ebp - 0x58], 0xaea23a69
mov dword [ebp - 0x54], 0x86058b8f
sub dword [ebp - 0x54], 0x86058b8f
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xc674127a
sub eax, 0xc63391a6
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x35cdd
push 0
call eax
mov ecx, 0x44d7
xor esi, esi
add esi, eax
mov edx, 0x750f6470
sub edx, 0x74ce5470
add edx, dword [ebp - 0x50]
mov edi, 0x6c64afd1
add edi, 0x2a354f4e
xor dword [ebp - 0x28], 0x700bde49
mov ebx, dword [edx]
mov dword [ebp - 0xc], 0x792746d
add ebx, edi
sub dword [ebp - 0x38], ebx
mov dword [esi], ebx
add esi, 0xb96e6587
add esi, 0x46919a7d
add edx, 0xb266751e
add edx, 0x4d998ae6
loop 0x403321
add eax, 0xe475efdf
add eax, 0x1b8b1650
mov ebx, eax
add eax, 5
mov ecx, 0xd22e0da
add ecx, 0xf31d1f26
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x401d8d
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x401dc5
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x401dd3
add edx, 0x20
cmp eax, edx
jne 0x401de4
test bx, bx
je 0x401e19
add esi, 2
add edi, 2
jmp 0x401db5
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x401df2
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x401e00
add edx, 0x20
sub ecx, edx
je 0x401e19
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x401dae
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret