joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10097c10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100d7218
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10109610]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x3c]
call fcn.100a8bc0
add esi, 0x34
push esi
mov edi, eax
mov dword [esp + 0x30], 0
call fcn.100a6d30
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov edx, ecx
add edx, edx
mov esi, eax
mov ebx, edi
xor eax, eax
add edx, edx
rep stosd dword es:[edi], eax
push ebx
cmp edx, 0x10
jb 0x10097c80
call fcn.100b5ef2
jmp 0x10097c85
call fcn.100b3773
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4

Function at 0x10097e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100d31d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x10109610]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.10097e50
push 2
push eax
mov dword [esp + 0x30], 0
call fcn.10097d80
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x10097edb
push eax
call fcn.100b2e51
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x10097ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100d31d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x10109610]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.10097e80
push 0x348
push eax
mov dword [esp + 0x30], 0
call fcn.10097d80
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x10097f4e
push eax
call fcn.100b2e51
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x10097f70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100d31d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x10109610]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.10097ef0
push 0x1bb8d
push eax
mov dword [esp + 0x30], 0
call fcn.10097d80
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x10097fce
push eax
call fcn.100b2e51
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
Function at 0x10097ff0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100d31d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x10109610]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.10097f70
push 1
push eax
mov dword [esp + 0x30], 0
call fcn.10097d80
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x1009804b
push eax
call fcn.100b2e51
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x10098060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100d31d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x10109610]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.10097ff0
push 1
push eax
mov dword [esp + 0x30], 0
call fcn.10097d80
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x100980bb
push eax
call fcn.100b2e51
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x100980d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100d5de8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x10109610]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.10098060
push 1
push eax
mov dword [esp + 0x30], 0
call fcn.10097d80
mov eax, dword [esp + 0x14]
add esp, 8
test eax, eax
je 0x10098131
push eax
call fcn.100b2e51
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100994e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100d6240
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10109610]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x10109610]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ecx]
push 1
push 0x1010b22c
mov dword [esp + 0x28], edx
xor edx, edx
push edx
push eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
push eax
mov eax, dword [esi + 0x80]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], vtable.CryptoPP::ArraySink.0
mov dword [esp + 0x30], vtable.CryptoPP::ArraySink.1.0
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret 8
Function at 0x10099f20
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100d7218
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push edi
mov eax, dword [0x10109610]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
xor edi, edi
push ecx
mov dword [esp + 0x14], edi
call fcn.100a6a50
push eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x30], edi
call fcn.100a7de0
push eax
push esi
call fcn.100a6a50
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov edx, ecx
add edx, edx
mov ebx, edi
xor eax, eax
add edx, edx
rep stosd dword es:[edi], eax
push ebx
cmp edx, 0x10
jb 0x10099f90
call fcn.100b5ef2
jmp 0x10099f95
call fcn.100b3773
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x24
ret 8

Function at 0x100ac8d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100d5ce6
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x10109610]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov eax, dword [0x10109610]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea esi, [edi + 0x10]
mov ecx, 0x100
mov dword [esp + 0x20], edi
mov dword [edi + 0xc], 0xffffffff
mov dword [edi], vtable.CryptoPP::MessageQueue.0
mov dword [edi + 4], vtable.CryptoPP::MessageQueue.1.0
call fcn.10098f60
mov dword [esp + 0x48], 2
xor ebx, ebx
lea esi, [edi + 0x38]
push 8
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], esi
mov dword [esi], ebx
call fcn.100b33f2
add esp, 4
cmp eax, ebx
je 0x100aca10
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea ecx, [esp + 0x14]
push ecx
push esi
mov byte [esp + 0x50], 3
call fcn.100ace90
mov byte [esp + 0x48], 4
lea esi, [edi + 0x50]
push 8
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], esi
mov dword [esi], ebx
call fcn.100b33f2
add esp, 4
cmp eax, ebx
je 0x100ac9e7
mov dword [esi], eax
xor edx, edx
mov dword [eax + 4], edx
xor ecx, ecx
mov dword [eax], ecx
mov edx, dword [esi]
mov dword [edx], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea eax, [esp + 0x1c]
push eax
push esi
mov byte [esp + 0x50], 5
call fcn.100ad220
mov eax, edi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100b2e5c
add esp, 0x40
ret
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], ebx
call fcn.100b2f04
push 0x10100900
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], vtable.std::bad_alloc.0
call fcn.100b6335
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ebx
call fcn.100b2f04
push 0x10100900
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], vtable.std::bad_alloc.0
call fcn.100b6335
int3
Function at 0x100af180
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100d6769
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10109610]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov edi, dword [esp + 0x20]
mov ecx, edi
call fcn.100a6960
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
push ecx
mov dword [esp + 0x20], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
push edx
push edi
mov ecx, esi
mov dword [esp + 0x1c], 1
call eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x100b2e5c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10109610]
jne 0x100b2e66
repz ret
jmp fcn.100b900a

Function at 0x100c9e25
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100bc336
and dword [ebp - 0x14], 0
cmp dword [0x1010e280], 0
mov dword [ebp - 0x18], eax
jne 0x100c9ed8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100c9f80
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100c9f80
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1010e280], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1010e284], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1010e288], eax
call edi
push eax
call esi
mov dword [0x1010e290], eax
test eax, eax
je 0x100c9ed8
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1010e28c], eax
mov eax, dword [0x1010e28c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100c9f31
cmp dword [0x1010e290], ecx
je 0x100c9f31
push eax
call esi
push dword [0x1010e290]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100c9f31
test ebx, ebx
je 0x100c9f31
call edi
test eax, eax
je 0x100c9f28
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100c9f28
test byte [ebp - 8], 1
jne 0x100c9f31
or dword [ebp + 0x10], 0x200000
jmp 0x100c9f64
mov eax, dword [0x1010e284]
cmp eax, dword [ebp - 0x18]
je 0x100c9f64
push eax
call esi
test eax, eax
je 0x100c9f64
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100c9f64
mov eax, dword [0x1010e288]
cmp eax, dword [ebp - 0x18]
je 0x100c9f64
push eax
call esi
test eax, eax
je 0x100c9f64
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1010e280]
call esi
test eax, eax
je 0x100c9f80
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100c9f82
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b2e5c
leave
ret
Function at 0x63d3cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 1]
xchg dword [esp], eax
call fcn.0063d3aa

Function at 0x63d3f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 8], ebp
push di
push ebp
lea esp, [esp + 2]
jmp 0x63d41c
call fcn.0063d383
jne 0x63d3dd
lea esp, [esp + 2]
mov dword [esp + 8], ebp
jmp 0x63d432
push di
push ebp
lea esp, [esp + 2]
jmp 0x63d41c

Function at 0x63d52e
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc bx
pushfd
xchg dword [esp + 8], ecx
mov ah, 0x69
call fcn.0063d615
push edx
aad 0x45
sub al, 0xdf
insd dword es:[edi], dx
les esi, [edi + 0x5e]
test eax, 0x8b95ebc8
cld
mov eax, dword [esp]
clc
ja 0x63d59f
jbe 0x63d573
arpl di, bp
jg 0x63d571
jmp 0xca157cc

Function at 0x63d9dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
btr dx, sp
xor edx, 0xaeea655f
mov dx, word [esp]
xchg dword [esp], edx
jmp 0x63da41
pushfd
lea edx, [edx + 0xb]
call fcn.0063da24
Function at 0x64078d
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ax
bsr edx, edi
xchg dx, ax
xchg dl, ah
xchg dword [esp], esi
call fcn.00640761
rcr dl, 3
xchg dword [esp + 8], esi
xchg al, dh
lea edx, reloc.KERNEL32.dll_WriteConsoleW
jmp 0x6407d4
xor eax, eax
dec dh
call fcn.006407be

Function at 0x6407b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp]
xchg dword [esp], edx
xchg dx, ax
jmp 0x64079e

Function at 0x64099e
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6409ed
rdtsc
xchg word [esp], dx
lea edx, reloc.KERNEL32.dll_WriteConsoleW

Function at 0x640b96
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
jmp 0x640dbb
clc
jmp 0x640cbb
bswap ebx
stc
lea edx, [esp + 0xc9]
cmp edi, eax
lea edx, [esp + 0xc9]
cmp edi, eax
jno 0x640ba7
bswap ebx
stc
jmp 0x640bef
push edx
jmp 0x640d80
mov dx, word [esp]
mov edx, ebp
jmp 0x640d93
cmc
jnp 0x640ecf
jp 0x640ecf
mov bl, 0x3b
stosd dword es:[edi], eax
into
cmp eax, 0xb21c9b89
aad 0x24
nop
jmp 0xa9d4b86b
mov dl, ch
jmp 0x640d3a
jp 0x640d3d
mov dx, word [esp]
mov edx, ebp
jmp 0x640d43
lea esp, [esp + 4]
xor al, 0x70
mov dl, 0xf
lea edx, [ecx + ebx]
cmp edx, 0xafd715e9
jmp 0x640d6a
rol al, 0
mov dh, al
lea edx, [ebx + ebp]
lea edx, [esi*4]
mov dh, dl
mov edx, ecx
jmp 0x640d45
jns 0x640ba0
js 0x640ba0
xchg dl, al
bt ax, di
not dh
call fcn.00640e07
push es
mov ebx, dword [ebx]
jle 0x640d66
cmp dword [esi + reloc.KERNEL32.dll_WriteConsoleW], ebp
xor dword [ebp + reloc.KERNEL32.dll_WriteConsoleW], ecx
fadd qword [ecx]
dec esi
rdtsc
lea eax, [ecx + edi]
or ax, 0x1dc
jno 0x640dc7
jo 0x640e2c
stc
jg 0x640ddd
mov bh, byte [ecx + 0x36]
rcl dword [eax - 0x3a]
mov eax, dword [reloc.KERNEL32.dll_WriteConsoleW]
pop ebp
and al, 0xd7
fsubr qword [bx]
jno 0x640e61
pushfd
adc dl, 0xe4
jmp 0x640e65
xchg dl, al
bt ax, di
not dh
jmp 0x640dcf
pushfd
adc dl, 0xe4
jmp 0x640ddd
sub cl, al
lea edx, reloc.KERNEL32.dll_WriteConsoleW
btc ax, dx
jmp 0x640dff

Function at 0x641cf8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x641e25
mov dword [esp], ebp
lea edx, [edx + 0xa]
pushfd
push word [esp + 1]
call fcn.00641cfd
add bl, 0x15
mov dl, 0x1c
lea eax, [esi*4]
jmp 0x642150
lea edx, [ecx + ebp]
mov al, byte [esp]
rcl eax, 0xf
jb 0x64208c
jae 0x64208c
mov ecx, 0xb681b0f0
bswap ecx
call fcn.006421c8
out dx, eax
imul edi, ecx, 0x8d86b98
stosd dword es:[edi], eax
ret 0xb77d
invalid
Function at 0x647885
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6476cc
mov dword [esp + 0x28], eax
jmp 0x64774e
mov dword [esp + 0x28], eax
jmp 0x6477e9
call 0x64757b
jmp 0x647810
call 0x647593
jmp 0x647887
mov ecx, 0xa2efae76
mov ecx, dword [esp]
push edi
lea esp, [esp + 8]
jmp 0x647726
sub ecx, 0x10017147
mov dword [ecx + reloc.KERNEL32.dll_WriteConsoleW], eax
jmp 0x647772
popal
push edx
call fcn.00647738
bswap edx
lea esp, [esp]
lea esp, [esp + 1]
push ecx
mov dx, bx
mov dx, 0x7d8a
jmp 0x647a4e
movzx ebx, byte [eax]
add ebx, 0x5f8dca1e
jmp 0x647794
cmp ebx, 0x5f8dcaea
je 0x6477f8
jne 0x647552
push 0
jmp 0x6477ce
pushfd
pushal
lea esp, [esp + 0x20]
jmp 0x647826
jmp 0x6478b3
popal
popfd
lea esp, [esp + 4]
ret
movzx ebx, byte [eax]
add ebx, 0xcb528c04
jmp 0x6478bb
retf
pop eax
sub eax, 0x564f793c
jmp 0x6478d7
cmp dword [esp + 4], 0
jne 0x6477e4
pushal
jmp 0x647576
mov dl, ah
not ecx
mov dx, 0x9f77
pop ecx
mov dx, word [esp]
mov edx, 0x3e5aae7b
call fcn.0064780e
push eax
jmp 0x6478a9
call 0x647885
pop edi
pop edi
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
outsb dx, byte [esi]
js 0x6478ec
je 0x647885
jmp 0x64785e
pop ecx
sub ecx, 0x1001719b
mov dword [ecx + reloc.KERNEL32.dll_WriteConsoleW], eax
jmp 0x6477f0
call fcn.0063462f
jmp 0x64758e
inc dword [esp + 8]
popfd
ret 4
cmp ebx, 0xcb528cd0
je 0x64791f
jne 0x64755b
mov dword [esp + 0x24], eax
jmp 0x6481ad
call 0x6478e7
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
jp 0x647939
push esi
jmp 0x647874
and al, 0x24
mov ecx, dword [esp]
mov dx, word [esp]
mov dl, byte [esp]
mov cx, 0x2a43
pop ebx
mov edx, 0xbd8d8fb
jmp 0x647847
bswap ecx
not ecx
push ebx
not dl
lea edx, reloc.KERNEL32.dll_WriteConsoleW
mov cl, byte [esp]
jmp 0x6479cd
popal
jmp 0x6481d5
popfd
ret

Function at 0x648152
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], eax
jmp 0x6480d8
call 0x647841
jmp 0x648135
popal
inc dword [esp + 8]
push edx
lea esp, [esp + 4]
jmp 0x648115
cmp ebx, 0x792ecd8c
jmp 0x6480ff
je 0x648148
jne 0x647833
xchg ebx, eax
push ss
test bl, ah
push ds
scasb al, byte es:[edi]
jnp 0xcf1ff2e
lea ecx, [esi + ebp*4]
scasb al, byte es:[edi]
mov ecx, 0xc39dc39d
cwde
sbb cl, byte [eax - 0x513e511]
jg 0x648111
popfd
ret
popfd
ret
mov bh, byte [ecx + 0x35]
rcl byte [eax - 0x3a]
mov eax, dword [reloc.KERNEL32.dll_WriteConsoleW]
push 0
pushfd
jmp 0x648172
pop eax
sub eax, 0x6e10563f
jmp 0x648142
call 0x648152
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
sub ebx, ecx
pop eax
into
test eax, 0x2435e758
push edi
mov esi, 0x7c2e8189
add dword [eax], edx
movzx ebx, byte [eax]
add ebx, 0x792eccc0
jmp 0x6480e4
cmp dword [esp + 4], 0
jne 0x648117
pushal
jmp 0x64783c
Function at 0x66b5c3
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 1], bl
jmp 0x66b618
pushal
mov dword [esp + 8], edi
stc
sub esp, 0x1d
lea esp, [esp + 1]
jmp 0x66b636
shr edi, 0x10
and edi, esi
push ebp
jmp 0x66b602
lea ebp, [ebp*4]
lea ebp, reloc.KERNEL32.dll_WriteConsoleW
mov edi, dword [ebp]
jmp 0x66b677
lea esp, [esp + 0x1c]
popal
jmp 0x66b620
lea esp, [esp + 4]
and edi, 0xff000000
jmp 0x66b759
pop ebp
lea esp, [esp + 0x14]
and ecx, 0xff0000
clc
push edx
jmp 0x66b661
xor ecx, edi
mov edi, edx
and edx, esi
call fcn.0066b69c
mov edx, dword [eax + 4]
pushfd
pushal
pushfd
jmp 0x66b7d4
mov ecx, dword [eax + 8]
jmp 0x66b7a8
mov edi, eax
add edi, 0x14
mov dword [edi], edx
pop edi
jmp 0x66b788
xor ecx, edx
push esi
mov esi, eax
jmp 0x66b7b3
add esi, 0x18
mov dword [esi], ecx
pop esi
mov edx, dword [eax + 0xc]
jmp 0x66b81f
lea esp, [esp + 0x4c]
cmp ebx, 0x63c950
jmp 0x66b7f0
xor edx, ecx
push esp
push edi
jmp 0x66b79e
push 0xa
mov bl, 0x6d
jmp 0x66b800
jne 0x66b070
mov al, byte [esp]
bswap ebp
mov al, byte [esp]
jmp 0x66b7da
pop eax
mov bp, 0xc820
mov bh, 0x43
mov edi, dword [esp]
jmp 0x66b84b
xor edx, ecx
pushal
stc
mov dword [eax + 0x1c], edx
jmp 0x66b7be
pop ebp
lea ebx, [edx + ebp]
pop ebx
ret
mov esi, 0xdafb9bef
mov ebp, 0x336b347f
mov bl, dh
lea esp, [esp + 4]
pop esi
jmp 0x66b828

Function at 0x66b69c
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 2
lea esp, [esp + 2]
jmp 0x66b6d1
jmp 0x66b686
and edx, ebp
mov di, word [esp]
btr di, si
pushal
jmp 0x66b700
xor ecx, edi
rol edi, 0x1d
neg edi
pushfd
lea esp, [esp]
jmp 0x66b69e
mov edx, dword [edx*4 + reloc.KERNEL32.dll_WriteConsoleW]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x63b128]
jmp 0x66b6b4
lea edi, [ebx*4]
jmp 0x66b725
xor ecx, edx
cmp di, 0xa3f7
lea esp, [esp + 0x24]
xor ecx, dword [ebx]
jmp 0x66b6e5
btr edx, edi
inc dx
jmp 0x66b737
lea edi, [eax + 0x10]
mov dx, word [esp]
xor ecx, dword [eax]
lea edx, [edi*4]
jmp 0x66b70f
add ebx, 4
bt dx, ax
not edx
inc dl
jmp 0x66b77a
mov dword [edi], ecx
push sp
xchg dl, dh
ror edx, cl
lea esp, [esp + 2]
jmp 0x66b764
Function at 0x66ba8e
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.0066c009
ror dword [edx - 0x1b], cl
adc al, 0x68
adc eax, 0xb073a58c
int 0xed
pop eax
mov ebx, 0x32e90d92
test al, 3
add byte [edi + 0x3318392e], al
cmp al, 0xa2
dec ecx
and byte [eax + 0x46], al
xchg edx, eax
cld
les esi, [edi + 0x5e]
test eax, 0x953c8d
add byte [eax], al
add byte [esi - 0x55b21629], al
add eax, dword [eax]
jnp 0x631111
lea edi, [edx*4]
xchg bh, dl
jmp 0x66bb0a
int 0x5c
pop esp
xor dword [eax - reloc.KERNEL32.dll_WriteConsoleW], 0xa2dc3060
adc byte [esi - 0x18], ah
cmpsb byte [esi], byte es:[edi]
invalid
push ebx
call 0x631131
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0x63109d
add al, 2
push 6
add al, 0xad
xor byte [esi - 0x746cef6f], cl
in al, dx
mov ebp, esp
push ecx
push ecx
jmp 0x6310d3
lea esp, [esp + 4]
jmp 0x6310e9
lea ebx, [esp - 0xb4]
sete cl
call 0x66ba9a
mov dword [ebp - 4], ecx
pushfd
jmp 0x66bb45
lea esp, [esp + 8]
jle 0x631083
jg 0x66ba69
mov cx, 0x2b76
lea esp, [esp + 4]
lea ecx, [eax - 1]
jmp 0x66ba78
not dx
inc edi
inc dh
jmp 0x66bb1e
mov dx, 0xf1f4
rcr dh, 2
rcl edx, 8
add esi, 0x10
mov dh, ah
jmp 0x66bad2
bt dx, cx
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_WriteConsoleW]
bsf edx, eax
jmp 0x66bae8
mov edx, dword [esi]
shr edi, 7
mov edi, edx
cmc
jmp 0x66bb2c
sub esp, 0
shr edi, 0x18
clc
cmc
jmp 0x66bb69
mov ecx, 0xff
lea esp, [esp + 4]
jmp 0x6310af
mov edi, dword [edi*4 + reloc.KERNEL32.dll_WriteConsoleW]
and edi, ecx
call fcn.0066bb53
mov edi, dword [edi*4 + reloc.KERNEL32.dll_WriteConsoleW]
jmp 0x66bfd5
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_WriteConsoleW]
movzx ebx, byte [esi + 2]
call fcn.0066bd30
and ebx, ecx
sub esp, 3
pushal
lea esp, [esp + 3]
jmp 0x66be1e