joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423ffe
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x43dc70
push 0xffff
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x424039
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x424057
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
xor al, al
jmp 0x424129
push 0
push 0
push 0
push 6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x424099
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
xor al, al
jmp 0x424129
push 0x43dc84
push 0xffff
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x4240cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4240e8
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
xor al, al
jmp 0x424129
push 0
push 0
push 0
push 6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x424127
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
xor al, al
jmp 0x424129
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4241e4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x70], ecx
mov eax, dword [ebp - 0x70]
cmp dword [eax + 0x24], 0
jne 0x4241fa
xor al, al
jmp 0x424251
push 0
push 0x10000001
push 0x4c8
mov ecx, dword [ebp - 0x70]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x424220
mov al, 1
jmp 0x424251
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42424f
mov eax, dword [ebp - 4]
push eax
push 0x43dca4
lea ecx, [ebp - 0x6c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x4250b3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov byte [ebp - 0xc], 0
mov byte [ebp - 8], 0
xor eax, eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x244]
shr edx, 0x18
mov byte [ebp - 8], dl
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x244]
shr ecx, 0x10
mov byte [ebp - 7], cl
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x244]
shr eax, 8
mov byte [ebp - 6], al
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + 0x244]
mov byte [ebp - 5], dl
mov word [ebp - 4], 0
jmp 0x42511a
mov ax, word [ebp - 4]
add ax, 1
mov word [ebp - 4], ax
mov ecx, dword [ebp - 4]
and ecx, 0xffff
mov edx, dword [ebp + 0xc]
and edx, 0xffff
cmp ecx, edx
jge 0x42517d
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + eax]
mov byte [ebp - 0xc], dl
mov eax, dword [ebp - 0xc]
and eax, 0xff
mov ecx, dword [ebp - 4]
and ecx, 0xffff
and ecx, 0x80000003
jns 0x42515f
dec ecx
or ecx, 0xfffffffc
inc ecx
xor edx, edx
mov dl, byte [ebp + ecx - 8]
xor eax, edx
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp + 8]
mov dl, byte [ebp - 0xc]
mov byte [ecx + eax], dl
jmp 0x42510e
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x42b037
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, 1
test eax, eax
je 0x42b0ac
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xbb8
jbe 0x42b06b
jmp 0x42b0ac
mov dword [ebp - 0xc], 0
push 0x43dec8
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42b0a0
push 0
push 0x10000002
push 0x52c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x42b0a2
jmp 0x42b0ac
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42b049
mov esp, ebp
pop ebp
ret

Function at 0x42bce9
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, 1
test eax, eax
je 0x42bd50
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 4]
cmp ecx, 0x1f4
jbe 0x42bd1d
jmp 0x42bd50
mov dword [ebp - 0x10], 0
push 0x43ded4
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42bd50
push 0
push 0x10000002
push 0x52c
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x24], 0
jne 0x42bd5d
xor al, al
jmp 0x42bdc7
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
je 0x42bd97
mov edx, dword [ebp + 0xc]
and edx, 0xffff
push edx
push 0xffff0001
push 0x4c8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp - 8], eax
jmp 0x42bdbb
mov edx, dword [ebp + 0xc]
and edx, 0xffff
push edx
push 0xffff0002
push 0x4c8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42bdc5
xor al, al
jmp 0x42bdc7
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x42cac2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435043
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], 0
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x90]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
mov dword [ebp - 4], 1
push 0x43defc
lea ecx, [ebp - 0xa4]
push ecx
mov ecx, dword [ebp - 0xac]
call fcn.0042d168
mov dword [ebp - 0xb0], eax
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x80]
push ecx
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa4]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push 0x64
lea edx, [ebp - 0x70]
push edx
push 0x43df08
push 0x43df18
push 0x43df1c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x90]
call dword [0x4360bc]
lea ecx, [ebp - 0x90]
push ecx
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov edx, dword [ebp - 0xa8]
or edx, 1
mov dword [ebp - 0xa8], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x90]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x432803
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 8], 0
je 0x43281c
xor eax, eax
jmp 0x432961
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00432e7f
test eax, eax
jne 0x432837
xor eax, eax
jmp 0x432961
mov ecx, dword [ebp - 0x14]
call fcn.00432fd1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43284f
xor eax, eax
jmp 0x432961
push 0x40
push 0x3000
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x432872
xor eax, eax
jmp 0x432961
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.004330b8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0xa0], 0
jbe 0x4328ac
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
cmp dword [eax + 0xa4], 0
jbe 0x4328ac
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00432aef
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00432bdd
test eax, eax
jne 0x4328d4
push 0x8000
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x432961
lea ecx, [ebp - 0x10]
push ecx
push 0x40
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
mov dword [edx + 0x34], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
add eax, dword [edx + 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], eax
push 0
push 1
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
call dword [eax + 4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43294a
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x14]
call dword [edx + 4]
push 0x8000
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], 0
xor eax, eax
jmp 0x432961
mov edx, dword [ebp - 0x14]
mov dword [edx], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax + 8], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x432e7f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0x40
jae 0x432e96
xor eax, eax
jmp 0x432fab
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x432eb9
xor eax, eax
jmp 0x432fab
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0x3c]
add ecx, 0xf8
cmp dword [ebp + 0xc], ecx
jae 0x432ed4
xor eax, eax
jmp 0x432fab
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
cmp dword [ecx], 0x4550
je 0x432efb
xor eax, eax
jmp 0x432fab
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x16]
and ecx, 0x2000
test ecx, ecx
jne 0x432f18
xor eax, eax
jmp 0x432fab
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x16]
and ecx, 2
test ecx, ecx
jne 0x432f2f
xor eax, eax
jmp 0x432fab
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x14]
cmp ecx, 0xe0
je 0x432f47
xor eax, eax
jmp 0x432fab
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
add eax, 0xf8
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], eax
mov dword [ebp - 4], 0
jmp 0x432f6a
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
xor edx, edx
mov dx, word [ecx + 6]
cmp dword [ebp - 4], edx
jge 0x432fa6
mov eax, dword [ebp - 4]
imul eax, eax, 0x28
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x28
mov esi, dword [ebp - 8]
mov esi, dword [esi + 0x14]
mov edx, dword [edx + eax + 0x14]
add edx, dword [esi + ecx + 0x10]
cmp edx, dword [ebp + 0xc]
jbe 0x432fa4
xor eax, eax
jmp 0x432fab
jmp 0x432f61
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1001609
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1001a90
call fcn.010017b4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1002370
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10013c4
cmp eax, esi
jne 0x10013b7
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10013c7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100139e
xor esi, esi
inc esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x10013da
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1001409
mov eax, dword [0x100236c]
test eax, eax
jne 0x1001403
mov dword [0x100236c], esi
push 0x10010b8
push 0x10010ac
call fcn.01001300
pop ecx
pop ecx
test eax, eax
je 0x1001409
jmp 0x100152d
mov dword [0x1002034], esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x100142d
push 0x10010a8
push 0x10010a0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100236c], 2
cmp dword [ebp - 0x20], ebx
jne 0x100143a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1002374], ebx
je 0x100145b
push 0x1002374
call fcn.01001729
pop ecx
test eax, eax
je 0x100145b
push ebx
push 2
push ebx
call dword [0x1002374]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x100152d
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x10014c5
cmp cx, bx
je 0x1001480
cmp dword [ebp - 0x1c], ebx
jne 0x10014c5
movzx ecx, word [eax]
cmp cx, bx
je 0x1001495
cmp cx, 0x20
ja 0x1001495
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1001480
test byte [ebp - 0x40], 1
je 0x10014a1
movzx ecx, word [ebp - 0x3c]
jmp 0x10014a4
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1002030], eax
cmp dword [0x1002024], ebx
jne 0x100150a
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x10014d6
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x100146a
cmp dword [0x1002034], ebx
jne 0x1001518
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1002030]
jmp 0x1001539
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010017f9
ret
call fcn.01001901
jmp 0x1001361

Function at 0x424c14
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00424ae8

Function at 0x427ac5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00427483
Function at 0x4e264e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 3]
jns 0x4e2692
mov dword [esp + 4], eax
jmp 0x4e2696
mov dword [esp + 4], eax
call 0x4e267c
mov byte [esp + 1], bl
mov dword [esp], ebp
mov byte [esp], dl
mov dword [esp], ecx
mov dword [esp + 4], ecx
pushfd
jmp 0x4e27bb
mov dword [esp + 0xc], edx
jmp 0x4e26ec
push dword [esp + 4]
mov dword [esp + 0xc], edx
call 0x4e2762
mov word [esp + 1], ax
push dword [esp + 1]
jl 0x4e26e4
push dword [esp + 4]
jmp 0x4e26be
Function at 0x4e2710
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf04cd818
jmp 0x4e2866
mov byte [esp + 5], ah
jmp 0x4e272c
mov byte [esp + 5], ah
mov dword [esp + 0x10], ebx
push ax
lea esp, [esp + 2]
jmp 0x4e26f1
mov dword [esp + 0xc], esp
jmp 0x4e270b
mov dword [esp + 0xc], esp
call 0x4e2738
push word [esp + 3]
jmp 0x4e278f
mov dword [esp + 0x10], ebx
push ax
lea esp, [esp + 2]
jmp 0x4e2707
pop word [esp]
lea esp, [esp + 1]
mov dword [esp + 0xc], esi
pushal
mov word [esp + 0x15], dx
call fcn.004e27e9
mov word [ecx - 0x7699dbdc], cs
inc esp
and al, 1
push dword [esp]
je 0x4e26c4
jne 0x4e26ce
mov dword [esp + 0xc], esi
pushal
mov word [esp + 0x15], dx
jmp 0x4e279b
jns 0x4e274a
pop word [esp]
lea esp, [esp + 1]
jmp 0x4e2779
mov word [esp + 0x17], ax
mov word [esp + 3], si
lea esp, [esp + 6]
jmp 0x4e2819
lea esp, [esp + 2]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x4e2937
mov dl, 0x30
stc
jmp 0x4e2870
mov ebp, dword [esp + 0x2c]
inc bl
jno 0x4e2836
mov dl, 0x30
jmp 0x4e2886
cpuid
mov ah, 0xc2
mov cx, word [esp]
jmp 0x4e284c
lea esi, [esp]
sub esp, 0x1e
jbe 0x4e28e5
mov dword [esp + 8], esi
adc dx, si
pop ecx
call fcn.004e28c3
xor ecx, edi
stc
jmp 0x4e2870
adc dx, si
pop ecx
lea esp, [esp + 2]
jmp 0x4e2a01
mov dword [esp + 8], esi
jmp 0x4e289f
pushfd
jmp 0x4e23c5
mov bh, dh
btr ebx, ebx
mov al, 0x6e
sub dx, si
mov ax, 0x94bd
cmc
bswap edx
stc
jmp 0x4e2a52
mov ecx, ebp
rdtsc
shr bl, cl
jmp 0x4e2966
jb 0x4e293d
mov bh, dh
btr ebx, ebx
call 0x4e29aa
sub dx, si
mov ax, 0x94bd
jmp 0x4e294b
mov dx, 0x18c9
btr cx, sp
jle 0x4e295a
jg 0x4e295a
mov eax, 0xa9ab95f1
mov eax, 0x36fde3db
rdtsc
mov edx, ebp
jmp 0x4e29e0
lea ecx, [ecx + 0x58]
xchg al, bl
mov edx, 0x62e0b987
lea eax, [ecx + esi]
mov ax, di
xchg dword [esp], ecx
jmp 0x4e2a2c
sub esp, 0xa8
mov edi, esp
setle al
mov edx, 0x76bd505f
jmp 0x4e2988
lea ebx, [eax - 0xa7]
jmp 0x4e2a3c
bswap eax
rdtsc
rdtsc
bsf bx, di
push dword [esp]
ret 4
dec ebp
mov dl, 0x57
lea ebx, reloc.KERNEL32.dll_RtlUnwind
sbb bl, 0xe0
jmp 0x4e2dbd
jnp 0x4e2a16
lea ebx, [eax - 0xa7]
jmp 0x4e2a3c
xchg dx, ax
xor ebp, 0x6c1726f7
xchg dx, bx
jmp 0x4e2b23
lea esp, [esp + 0x24]
add ebp, 0x3b54be08
bsr eax, eax
jmp 0x4e2aeb
mov byte [esp + 3], cl
push dword [esp + 0x1c]
pop dword [esp + 0xd]
jmp 0x4e2a95
mov dx, word [esp]
mov bh, bl
mov dl, 0x90
mov edx, 0x4744c446
call fcn.004e2af5
retf
jmp 0x4e2aab
mov dl, 0x90
mov edx, 0x4744c446
call fcn.004e2b94
popal
invalid
jb 0x4e2ab9
mov dx, word [esp]
mov bh, bl
jmp 0x4e2ad5
xchg edx, eax
pushal
mov byte [esp + 0x10], al
pushfd
shr bh, 2
jae 0x4e2ad3
mov byte [esp + 3], cl
push dword [esp + 0x1c]
pop dword [esp + 0xd]
jmp 0x4e2a95
jne 0x4e2a5c
xchg dx, ax
jmp 0x4e2a5e
Function at 0x4e2762
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf04cd818
jmp 0x4e2866
mov byte [esp + 5], ah
jmp 0x4e272c
mov byte [esp + 5], ah
mov dword [esp + 0x10], ebx
push ax
lea esp, [esp + 2]
jmp 0x4e26f1
mov dword [esp + 0xc], esp
jmp 0x4e270b
mov dword [esp + 0xc], esp
call 0x4e2738
push word [esp + 3]
jmp 0x4e278f
mov dword [esp + 0x10], ebx
push ax
lea esp, [esp + 2]
jmp 0x4e2707
pop word [esp]
lea esp, [esp + 1]
mov dword [esp + 0xc], esi
pushal
mov word [esp + 0x15], dx
call fcn.004e27e9
mov word [ecx - 0x7699dbdc], cs
inc esp
and al, 1
push dword [esp]
je 0x4e26c4
jne 0x4e26ce
mov dword [esp + 0xc], esi
pushal
mov word [esp + 0x15], dx
jmp 0x4e279b
jns 0x4e274a
pop word [esp]
lea esp, [esp + 1]
jmp 0x4e2779
mov word [esp + 0x17], ax
mov word [esp + 3], si
lea esp, [esp + 6]
jmp 0x4e2819
lea esp, [esp + 2]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x4e2937
mov dl, 0x30
stc
jmp 0x4e2870
mov ebp, dword [esp + 0x2c]
inc bl
jno 0x4e2836
mov dl, 0x30
jmp 0x4e2886
cpuid
mov ah, 0xc2
mov cx, word [esp]
jmp 0x4e284c
lea esi, [esp]
sub esp, 0x1e
jbe 0x4e28e5
mov dword [esp + 8], esi
adc dx, si
pop ecx
call fcn.004e28c3
xor ecx, edi
stc
jmp 0x4e2870
adc dx, si
pop ecx
lea esp, [esp + 2]
jmp 0x4e2a01
mov dword [esp + 8], esi
jmp 0x4e289f
pushfd
jmp 0x4e23c5
mov bh, dh
btr ebx, ebx
mov al, 0x6e
sub dx, si
mov ax, 0x94bd
cmc
bswap edx
stc
jmp 0x4e2a52
mov ecx, ebp
rdtsc
shr bl, cl
jmp 0x4e2966
jb 0x4e293d
mov bh, dh
btr ebx, ebx
call 0x4e29aa
sub dx, si
mov ax, 0x94bd
jmp 0x4e294b
mov dx, 0x18c9
btr cx, sp
jle 0x4e295a
jg 0x4e295a
mov eax, 0xa9ab95f1
mov eax, 0x36fde3db
rdtsc
mov edx, ebp
jmp 0x4e29e0
lea ecx, [ecx + 0x58]
xchg al, bl
mov edx, 0x62e0b987
lea eax, [ecx + esi]
mov ax, di
xchg dword [esp], ecx
jmp 0x4e2a2c
sub esp, 0xa8
mov edi, esp
setle al
mov edx, 0x76bd505f
jmp 0x4e2988
lea ebx, [eax - 0xa7]
jmp 0x4e2a3c
bswap eax
rdtsc
rdtsc
bsf bx, di
push dword [esp]
ret 4
dec ebp
mov dl, 0x57
lea ebx, reloc.KERNEL32.dll_RtlUnwind
sbb bl, 0xe0
jmp 0x4e2dbd
jnp 0x4e2a16
lea ebx, [eax - 0xa7]
jmp 0x4e2a3c
xchg dx, ax
xor ebp, 0x6c1726f7
xchg dx, bx
jmp 0x4e2b23
lea esp, [esp + 0x24]
add ebp, 0x3b54be08
bsr eax, eax
jmp 0x4e2aeb
mov byte [esp + 3], cl
push dword [esp + 0x1c]
pop dword [esp + 0xd]
jmp 0x4e2a95
mov dx, word [esp]
mov bh, bl
mov dl, 0x90
mov edx, 0x4744c446
call fcn.004e2af5
retf
jmp 0x4e2aab
mov dl, 0x90
mov edx, 0x4744c446
call fcn.004e2b94
popal
invalid
jb 0x4e2ab9
mov dx, word [esp]
mov bh, bl
jmp 0x4e2ad5
xchg edx, eax
pushal
mov byte [esp + 0x10], al
pushfd
shr bh, 2
jae 0x4e2ad3
mov byte [esp + 3], cl
push dword [esp + 0x1c]
pop dword [esp + 0xd]
jmp 0x4e2a95
jne 0x4e2a5c
xchg dx, ax
jmp 0x4e2a5e

Function at 0x4eb2fc
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x4eb336
mov dl, 0x81
call fcn.004eb320
std
insb byte es:[edi], dx
add dword [esi - 0x2b], edi
mov dh, 0x95
lea ecx, [eax]
and al, byte [edx]
pop edi
popfd
sbb al, 0x89
push 0xffffffffffffff85
xor al, 0x27
Function at 0x5ba69d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, ax
bsf ecx, edi
jmp 0x5ba6d6
pop edi
sub esp, 0xe
add esp, 4
mov si, di
mov ch, cl
pop esi
jmp 0x5ba6c0

Function at 0x5ba8ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pop ecx
mov ebp, 0xbeb0464c
btc cx, di
jmp 0x5ba931
mov bp, word [esp + 0xa]
pop eax
add esp, 0x16
add esp, 0
jmp 0x5ba95a
neg cl
pop word [esp]
cpuid
sub esp, 0x14
cpuid
push dword [esp + 0x14]
jmp 0x5ba91a
sbb bp, 0xbf9f
add dh, ah
xchg bp, bx
not bl
std
jmp 0x5baa90
lea esi, [edx*4]
neg ch
cpuid
lea esp, [esp]
cld
mov ah, byte [esp]
jmp 0x5ba944
lea eax, [ecx + edi]
lea ecx, [eax + edi]
mov dh, byte [esp]
xor al, 0x24
call fcn.005ba9f9
jge 0x5ba99e
add dh, cl
adc al, 0x6a
test dword [esi - 0x45], esp
insb byte es:[edi], dx
inc ebx
mov bx, 0x436c
setb dl
lea esi, [edi*4]
cld
mov dl, bl
cmp ebx, edi
jmp 0x5ba997
inc edi
xchg word [esp + 0x11], di
setne bl
rdtsc
pushal
lea esp, [esp + 0x41]
jmp 0x5ba9ad
mov bx, word [esp]
pushal
btr bx, sp
inc dh
cpuid
rdtsc
jmp 0x5ba9d1