joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bb264
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5bb27b
add esp, 0xfffffff0
call fcn.00407fec
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004bb9a8
mov eax, dword [0x5f2970]
cmp byte [eax], 0
jne 0x5bb2a8
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x5f2c9c]
cmp word [eax + 2], 0
jne 0x5bb2c2
mov eax, dword [0x5f2c9c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005bd538
mov eax, dword [0x5f2dd0]
cmp word [eax + 2], 0
jne 0x5bb2dc
mov eax, dword [0x5f2dd0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005bd73c
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4ecc6c]
call fcn.004f2dd0
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5bdcb4
mov dl, 1
mov eax, dword [0x4847c4]
call fcn.00407950
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x4847c4]
call fcn.00407950
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4f1694]
call fcn.004fc3e0
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5bb4c4
mov eax, dword [0x5f2b54]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004fc878
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5bdf9c
mov dl, 1
mov eax, dword [0x4847c4]
call fcn.00407950
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5f2b54]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00421d1c
test eax, eax
je 0x5bb3f6
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00421b58
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00421d00
test eax, eax
je 0x5bb40e
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a2e4
push ebx
push 0x5bcf14
call fcn.005b0958
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5f2970]
cmp byte [eax], 0
jne 0x5bb45f
mov eax, ebx
call fcn.005bb6a8
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005be1d4
mov eax, ebx
call fcn.005bee40
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5bb4bc
call fcn.00408044
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bb9ec
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5bba8e
cmp dword [ebx + 0xac], 0
jne 0x5bba88
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5bb928
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5bba88
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5bba4e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5bba88
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004a698c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5bba5d
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5bbccc
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x5f9760]
cmp dword [eax + 0x188], 0
je 0x5bbe46
test bl, bl
jne 0x5bbd91
cmp dword [esi + 0xb4], 0
jne 0x5bbd86
mov eax, esi
call fcn.005bec90
push eax
push 0x5bbbc0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5bbd57
mov eax, dword [0x5f9760]
cmp byte [eax + 0xeb], 0
je 0x5bbd57
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5bbd38
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5bbd57
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5bbd40
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5bbd86
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a698c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5bbd66
inc dword [esi + 0xb4]
jmp 0x5bbe46
cmp dword [esi + 0xb4], 0
jle 0x5bbe46
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5bbe46
cmp dword [esi + 0x58], 0
je 0x5bbdfb
mov eax, dword [0x5f9760]
cmp byte [eax + 0xeb], 0
je 0x5bbdfb
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5bbddc
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5bbdfb
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5bbde4
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5bbe2a
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a698c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5bbe0a
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5ad7b8]
call fcn.0040b7e0
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5bcaa0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5bcafd
cmp byte [ebx + 0xeb], 0
jne 0x5bcafd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409888
mov eax, dword [esi]
test eax, eax
je 0x5bcaea
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5bcb0a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409ae0
jmp 0x5bcb0a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409ae0
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5be3bc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5be42d
mov eax, esi
call fcn.0051eb48
test al, al
je 0x5be42d
mov eax, dword [ebx + 0x98]
call fcn.0051e778
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5be42d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x5be41e
push 0
mov eax, dword [ebx + 0x98]
call fcn.0051e778
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.005153bc
jmp 0x5be42d
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005be1f4
pop esi
pop ebx
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0xa0a7424
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3e1d1826
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x5f3dd6
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + reloc.MSVCRT.dll_strncpy], 0x8088405
inc edx
mov dword [ebx + reloc.MSVCRT.dll_strncpy], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x5f681a
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [reloc.MSVCRT.dll_strncpy]
xor ebx, ebx
mov bl, al
xor bl, dl
shr eax, 8
xor eax, dword [ebx*4 + reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
and eax, 0xff
add dword [reloc.MSVCRT.dll_strncpy], eax
imul eax, dword [reloc.MSVCRT.dll_strncpy], 0x8088405
inc eax
mov dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
movzx ebx, al
xor bl, byte [0x5000f743]
shr eax, 8
xor eax, dword [ebx*4 + reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
ret

Function at 0x5f688a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
pushal
mov byte [ebp - 1], 0
mov dword [reloc.MSVCRT.dll_strncpy], 0x12345678
mov dword [reloc.MSVCRT.dll_strncpy], 0x23456789
mov dword [reloc.MSVCRT.dll_strncpy], 0x34567890
movzx ecx, byte [0x5000f748]
test ecx, ecx
je 0x5f6917
xor esi, esi
mov dl, byte [esi + 0x5000f749]
call fcn.005f681a
inc esi
cmp esi, ecx
jb 0x5f68be
xor esi, esi
call fcn.005f6872
xor byte [esi + 0x5000f724], al
mov dl, byte [esi + 0x5000f724]
call fcn.005f681a
inc esi
cmp esi, 0xc
jb 0x5f68d0
mov al, byte [0x5000f72f]
test word [0x5000f90e], 8
jne 0x5f690b
cmp al, byte [0x5000f919]
jne 0x5f6917
mov byte [ebp - 1], 1
jmp 0x5f6917
cmp al, byte [0x5000f913]
jne 0x5f6917
mov byte [ebp - 1], 1
popal
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret

Function at 0x5f69aa
Capabilities:
Encode data using xor

Disassembly:
pushal
mov edi, dword [reloc.MSVCRT.dll_strncpy]
cmp dword [reloc.MSVCRT.dll_strncpy], edi
jae 0x5f69bf
mov edi, dword [reloc.MSVCRT.dll_strncpy]
test edi, edi
je 0x5f69ea
sub dword [reloc.MSVCRT.dll_strncpy], edi
lea esi, reloc.MSVCRT.dll_strncpy
add esi, dword [reloc.MSVCRT.dll_strncpy]
add edi, esi
call fcn.005f6872
xor byte [esi], al
mov dl, byte [esi]
call fcn.005f681a
inc esi
cmp esi, edi
jb 0x5f69d7
popal
ret

Function at 0x5f69ee
Capabilities:
Encode data using xor

Disassembly:
pushal
lea esi, reloc.MSVCRT.dll_strncpy
mov edi, esi
add edi, dword [reloc.MSVCRT.dll_strncpy]
call fcn.005f6872
mov dl, byte [esi]
xor byte [esi], al
call fcn.005f681a
inc esi
cmp esi, edi
jb 0x5f69fd
popal
ret
Function at 0x5f71fa
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [reloc.MSVCRT.dll_strncpy]
add dword [reloc.MSVCRT.dll_strncpy], eax
cmp byte [0x5000f840], 0
jne 0x5f7260
cmp dword [reloc.MSVCRT.dll_strncpy], 0
jle 0x5f7260
mov eax, dword [reloc.MSVCRT.dll_strncpy]
lea edx, reloc.MSVCRT.dll_strncpy
mov ecx, dword [reloc.MSVCRT.dll_strncpy]
mov eax, dword [reloc.MSVCRT.dll_strncpy]
call fcn.005f59f2
test eax, eax
jge 0x5f7260
mov dword [reloc.MSVCRT.dll_strncpy], 5
push 0x50005b6c
push dword [0x5000f854]
push 0x50005b8c
mov eax, 0x5000f838
mov edx, 3
call fcn.005f496a
ret
mov eax, dword [reloc.MSVCRT.dll_strncpy]
test eax, eax
je 0x5f729c
add dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov esi, dword [reloc.MSVCRT.dll_strncpy]
xor ebx, ebx
mov bl, al
xor bl, byte [esi + 0x5002a800]
shr eax, 8
xor eax, dword [ebx*4 + reloc.MSVCRT.dll_strncpy]
inc esi
cmp esi, dword [reloc.MSVCRT.dll_strncpy]
jb 0x5f727c
mov dword [reloc.MSVCRT.dll_strncpy], eax
cmp dword [reloc.MSVCRT.dll_strncpy], 0x10000
jb 0x5f72cd
mov esi, 0x5002a800
mov edi, esi
add esi, dword [reloc.MSVCRT.dll_strncpy]
sub esi, 0x8000
mov ecx, 0x8000
cld
rep movsb byte es:[edi], byte [esi]
mov dword [reloc.MSVCRT.dll_strncpy], 0x8000
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
mov dword [reloc.MSVCRT.dll_strncpy], 0
ret
Function at 0x5fa076
Capabilities:
Encode data using xor

Disassembly:
cmp dword [reloc.MSVCRT.dll_strncpy], 0x8000
jle 0x5fa0db
pushal
mov edx, dword [reloc.MSVCRT.dll_strncpy]
sub edx, 0x8000
mov esi, 0x5002a800
mov edi, esi
add esi, edx
mov ecx, 0x2000
cld
rep movsd dword es:[edi], dword [esi]
mov ebx, 0xffff
sub dword [ebx*4 + reloc.MSVCRT.dll_strncpy], edx
dec ebx
jns 0x5fa0a5
mov esi, edx
shl esi, 2
add esi, 0x50082b44
mov ebx, esi
add ebx, 0x20000
mov edi, 0x50082b44
cld
lodsd eax, dword [esi]
sub eax, edx
stosd dword es:[edi], eax
cmp esi, ebx
jb 0x5fa0c8
popal
mov dword [reloc.MSVCRT.dll_strncpy], 0x8000
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
sub eax, dword [reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
cmp dword [reloc.MSVCRT.dll_strncpy], 0x8000
jle 0x5fa10b
mov dword [reloc.MSVCRT.dll_strncpy], 0x8000
mov eax, dword [reloc.MSVCRT.dll_strncpy]
lea edx, reloc.MSVCRT.dll_strncpy
mov ecx, dword [reloc.MSVCRT.dll_strncpy]
mov eax, dword [reloc.MSVCRT.dll_strncpy]
call fcn.005f5a1e
cmp eax, dword [reloc.MSVCRT.dll_strncpy]
je 0x5fa158
mov dword [reloc.MSVCRT.dll_strncpy], 3
push 0x50008a38
push dword [0x5000f854]
push 0x50008a5c
mov eax, 0x5000f838
mov edx, 3
call fcn.005f496a
ret
mov eax, dword [reloc.MSVCRT.dll_strncpy]
add eax, dword [reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
add dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
add dword [reloc.MSVCRT.dll_strncpy], eax
pushal
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov esi, dword [reloc.MSVCRT.dll_strncpy]
xor ebx, ebx
mov bl, al
xor bl, byte [esi + 0x5002a800]
shr eax, 8
xor eax, dword [ebx*4 + reloc.MSVCRT.dll_strncpy]
inc esi
cmp esi, dword [reloc.MSVCRT.dll_strncpy]
jb 0x5fa18c
mov dword [reloc.MSVCRT.dll_strncpy], eax
popal
ret
Function at 0x662f1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf064df8c
jmp 0x662fa5
lea esp, [esp + 3]
mov dword [esp + 4], ebp
pushal
mov dword [esp + 0x19], ecx
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0x662f32
jmp 0x662ef7
push si
jmp 0x663086
mov dword [esp + 0x1c], esi
pushal
push word [esp + 0x1b]
jne 0x662f1c
push si
call fcn.00662fd3
push ebx
retf 0x9465
stc
lea ebp, [edi*4]
xchg word [esp + 3], si
jmp 0x662fba
sub esp, 0xb
jmp 0x662fae
jp 0x662f8f
stc
lea ebp, [edi*4]
jmp 0x662ffb
lea esp, [esp + 3]
jmp 0x662fe5
mov esi, dword [esp + 0x34]
mov dl, byte [esp]
shl ch, 3
jnp 0x66309d
jp 0x6630ca
xchg word [esp + 3], si
lea esp, [esp + 3]
call 0x66300a
sub byte [ebp + 0xb09f], cl
add byte [esi + 0xf], ah
mov dword [reloc.MSVCRT.dll_strncpy], eax
mov ecx, 0xf000071
xor dword [esi - 0x79], esp
invalid
pop word [esp + 0xb]
lea esp, [esp + 2]
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
pushfd
jmp 0x662a7a
jmp 0x6630e7
sub esp, 0xc
bsr bp, ax
jmp 0x6630ee
sub esp, 0xc
bsr bp, ax
lea edi, [esp + 0x14]
shl bx, cl
jmp 0x663134
bswap eax
mov ax, 0xfb23
mov ax, dx
mov ebx, esi
rdtsc
neg cx
jmp 0x663165
rdtsc
jmp 0x6631c7
lea ecx, [eax + eax]
bsr ax, ax
mov edx, dword [esp]
lea edx, [edx + ebx]
mov ecx, dword [esp]
mov edx, 0x761d3462
jmp 0x66314c
jnp 0x6631c0
cpuid
shl dx, cl
jmp 0x66310d
mov edx, dword [esp]
lea edx, [edx + ebx]
mov ecx, dword [esp]
jmp 0x663124
inc esi
rol dh, cl
je 0x663186
lea ecx, [edx + esi]
bsf dx, bp
rol cx, cl
jmp 0x6631a1
ja 0x663114
lea ecx, [eax + eax]
bsr ax, ax
jmp 0x663141
bsf dx, bp
rol cx, cl
jmp 0x6631a1
lea ecx, [edx + esi]
jmp 0x663170
xchg dl, dh
clc
xchg dx, ax
sub esp, 0x1d
lea esp, [esp + 1]
call fcn.006631d6
movsd dword es:[edi], dword [esi]
aam 0x47
inc edi
out dx, al
add esi, 0x3dc63042
mov ch, cl
inc ax
jns 0x66318b
js 0x663270
cli
jns 0x66319f
mov byte [ebx - 0x31], bh
fcomp qword [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
in al, 0x3b
cpuid
shl dx, cl
rdtsc
sub esp, 0xac
mov ebp, esp
bswap ecx
jmp 0x6630f7
lea esp, [esp + 0x1c]
inc esi
cmc
jnp 0x663278
mov edx, esp
clc
jmp 0x66327d
sub esp, 0x1d
lea esp, [esp + 1]
jmp 0x6631ee
xchg dl, dh
clc
xchg dx, ax
jmp 0x66322d
jmp 0x6633c4
mov dl, byte [esp]
mov ecx, dword [esp]
jmp 0x6633cd
jnp 0x663356
lea eax, reloc.MSVCRT.dll_strncpy
jmp 0x66335c
lea eax, reloc.MSVCRT.dll_strncpy
call fcn.006632aa
jmp 0x66339d
cpuid
mov dword [esp + 0x18], esi
lea edx, [ecx + esi]
jmp 0x6633ac
neg edx
popal
call fcn.006633d6
invalid
mov edx, esp
clc
mov dl, byte [esp]
mov ecx, dword [esp]
not esi
dec ax
jmp 0x6632c4

Function at 0x662fd3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push dword [esp + 0x1d]
pop dword [esp + 0xa]
xchg dword [esp + 0x20], ebp
call fcn.00662f64
Function at 0x67e734
Capabilities:
Encode data using xor

Disassembly:
call 0x67e7cc
xchg cx, ax
adc byte [ebx + 0x5816327e], dl
xchg ecx, eax
or bl, byte [edx]
xlatb
in eax, 0x50
ror dword [edx - 0x1b], cl
mov ecx, ebp
xchg ch, cl
mov dl, 0x57
jmp 0x64e63b
movzx ecx, word [ebp + 0xc]
push ebx
lea ebx, reloc.MSVCRT.dll_strncpy
mov dh, 0xc3
jmp 0x64e694
push esi
inc si
bsr esi, ecx
sub esp, 0xd
lea esp, [esp + 1]
jmp 0x64e67d
mov esi, dword [ebp + 8]
jmp 0x64e6ce
mov ebx, dword [ebp + 0xc]
setae dh
mov dh, al
push bp
lea esp, [esp + 2]
jmp 0x64e66a
shr esi, 0x10
shr ebx, 0x10
lea esp, [esp + 0xc]
jmp 0x64e6de
movzx esi, si
bsr edx, esp
jmp 0x67e680
mov edx, eax
call 0x67e688
dec edx
lea esp, [esp + 4]
movzx ebx, bx
jmp 0x67e6b5
imul edx, ecx
imul ecx, esi
mov dword [ebp + 0xc], esi
push ebx
jmp 0x67e6c5
mov esi, dword [esp]
jmp 0x67e6f9
sub esp, 0x17
mov dword [esp + 0xa], edi
mov word [esp + 0x13], sp
clc
jmp 0x67e721
lea esp, [esp + 4]
imul eax, ebx
lea esi, [ebx*4]
mov esi, ebx
jmp 0x67e6e3
lea esp, [esp + 3]
lea esp, [esp + 0x14]
imul esi, dword [ebp + 0xc]
add eax, ecx
call fcn.0067e70b
jmp 0x67e79c
mov dword [ebp], edx
pop ebp
jmp 0x67e76c
mov dword [ebx], esi
pop ebx
pushfd
jmp 0x67e774
push ebx
mov ebx, edi
add ebx, 4
jmp 0x67e755
cmp eax, ecx
pushfd
lea esp, [esp + 0x10]
jae 0x64e5f7
jb 0x67e97c
xor ch, 1
add byte [eax], al
push es
lahf
punpckhdq mm3, qword [ecx + 0x66f06c19]
add eax, esi
inc esp
jb 0x67e782
jge 0x67e79b
div dword [esp + edi*2]
dec edi
salc
lea esp, [esp]
cmc
push ebp
mov ebp, edi
jmp 0x67e736
clc
add esi, 0x10000
call fcn.0067e94c
call fcn.0067e9be

Function at 0x826546
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x823ffb
call fcn.00824000
call 0x8260e5
jmp 0x82658c
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x826619
pop eax
jmp 0x8265c3
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x8260e0
sub eax, 0x4260e5
push eax
jmp 0x823f4e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x8265a2
Function at 0x1001e789
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi]
or eax, dword [edi + 4]
je 0x1001e7dc
mov ecx, 8
mov esi, 0x13cee4d1
sub ebx, ebx
sub eax, eax
mov al, byte [edi]
inc edi
mul esi
rol ebx, 5
xor ebx, eax
dec ecx
jne 0x1001e7a5
test ebx, ebx
jne 0x1001e7ba
mov ebx, esi
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
shr ecx, 2
je 0x1001e7cd
xor dword [edi], ebx
add edi, 4
dec ecx
jne 0x1001e7c5
mov ecx, dword [ebp + 0x10]
and cl, 3
je 0x1001e7dc
xor byte [edi], bl
inc edi
dec cl
jne 0x1001e7d5
pop ebx
pop edi
pop esi
leave
ret

Function at 0x100245e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, 0x5e9212fc
mov edx, 0xa761f0f7
sub eax, eax
mov esi, dword [ebp + 0xc]
lea edi, [esi - 1]
inc edi
cmp byte [edi], 0
jne 0x100245f8
cmp esi, edi
je 0x10024621
mov al, byte [esi]
inc esi
imul ecx, eax, 0x71b2c107
ror edx, 6
xor ecx, edx
imul edx, eax, 0xebae624d
ror ebx, 7
xor edx, ebx
mov ebx, ecx
cmp esi, edi
jb 0x10024602
and ebx, 0x7fffffff
cmp ebx, 0x7fffffab
jb 0x10024635
sub ebx, 0x7fffffab
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov dword [eax + 4], edx
pop ebx
pop edi
pop esi
leave
ret

Function at 0x100247ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push ebp
mov ebp, dword [ebp + 8]
mov ebx, dword [ebp + 0x8c]
mov ecx, dword [ebp + 0x94]
test ecx, ecx
je 0x10024800
lea edx, [esi + ecx]
cmp edx, edi
jbe 0x100247e3
mov edx, edi
mov al, byte [esi]
xor bl, al
mov byte [esi], bl
ror ebx, 8
dec ecx
inc esi
cmp esi, edx
jb 0x100247e3
test ecx, ecx
jne 0x100248a9
xor ebx, dword [ebp + 0x90]
mov edx, dword [ebp]
sub edi, 4
jmp 0x10024849
mov eax, 0x9c4e
mul edx
mov ecx, 0x7fffffab
div ecx
mov ecx, dword [ebp + 4]
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov dword [ebp + 4], ecx
mov eax, dword [ebp + 8]
shr eax, 0x1b
mov ecx, dword [ebp + eax*4 + 0xc]
sub ecx, dword [ebp + 4]
mov dword [ebp + 8], ecx
mov dword [ebp + eax*4 + 0xc], edx
xor ebx, ecx
mov ecx, dword [esi]
xor ebx, ecx
mov dword [esi], ebx
mov ebx, ecx
add esi, 4
cmp esi, edi
jbe 0x10024808
add edi, 4
mov ecx, edi
sub ecx, esi
je 0x100248a6
mov eax, 0x9c4e
mul edx
mov ecx, 0x7fffffab
div ecx
mov ecx, dword [ebp + 4]
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov dword [ebp + 4], ecx
mov eax, dword [ebp + 8]
shr eax, 0x1b
mov ecx, dword [ebp + eax*4 + 0xc]
sub ecx, dword [ebp + 4]
mov dword [ebp + 8], ecx
mov dword [ebp + eax*4 + 0xc], edx
xor ebx, ecx
mov dword [ebp + 0x90], ebx
mov ecx, 4
mov al, byte [esi]
xor bl, al
mov byte [esi], bl
ror ebx, 8
dec ecx
inc esi
cmp esi, edi
jb 0x10024897
mov dword [ebp], edx
mov dword [ebp + 0x8c], ebx
mov dword [ebp + 0x94], ecx
pop ebp
pop ebx
pop edi
pop esi
leave
ret