joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439460
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 4]
mov esi, ecx
push eax
lea ecx, [ebp - 8]
push ecx
xor edi, edi
push edx
mov dword [ebp - 4], edi
call fcn.004123a0
test al, al
je 0x439583
mov ecx, dword [esi + 4]
cmp ecx, edi
je 0x439576
mov eax, dword [esi + 8]
cmp eax, edi
je 0x439576
lea edx, [ebp - 0xc]
push edx
push edi
push eax
push 0x6801
push ecx
mov byte [ebp + 0xb], 0
mov dword [ebp - 0xc], edi
call dword [0x441004]
test eax, eax
je 0x4394dd
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push edx
push edi
push 1
push edi
push eax
call dword [0x441008]
test eax, eax
je 0x4394dd
mov byte [ebp + 0xb], 1
mov eax, dword [ebp - 0xc]
cmp eax, edi
je 0x4394eb
push eax
call dword [0x44100c]
cmp byte [ebp + 0xb], 0
je 0x43955e
mov ecx, dword [str.ENCMONET]
push ebx
push ecx
call dword [0x4410d8]
mov edx, dword [ebp - 4]
mov esi, eax
add esi, esi
lea ebx, [esi + edx]
push ebx
call dword [0x441428]
mov edi, eax
add esp, 4
test edi, edi
je 0x439559
mov eax, dword [str.ENCMONET]
push esi
push eax
push edi
call fcn.00439a2c
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
push ecx
push edx
add edi, esi
push edi
call fcn.00439a2c
mov eax, dword [ebp + 0xc]
add esp, 0x18
push ebx
sub edi, esi
push edi
push eax
call fcn.00412480
test al, al
jne 0x43954d
mov byte [ebp + 0xb], al
push edi
call dword [0x441420]
add esp, 4
jmp 0x43955d
mov byte [ebp + 0xb], 0
pop ebx
mov ecx, dword [ebp - 8]
push ecx
call dword [0x441420]
mov al, byte [ebp + 0xb]
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 8]
push edx
call dword [0x441420]
add esp, 4
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x439590
Capabilities:
Create new key via cryptacquirecontext
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebx
mov ebx, dword [0x44103c]
push esi
push edi
push 0
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
mov edi, ecx
push 0
lea esi, [edi + 4]
push esi
call ebx
test eax, eax
jne 0x4395d5
push 8
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push esi
call ebx
test eax, eax
jne 0x4395d5
push str.A_cryptographic_service_handle_could_not_be_acquired._n
call dword [0x44149c]
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
add edi, 8
push edi
push 0
push 0
push 0x8003
push eax
call dword [0x441038]
test eax, eax
jne 0x43960a
call dword [0x441124]
push eax
push str.Error_call_to_function_failed:CryptCreateHash__last_error___d_n
call dword [0x44149c]
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
ret
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x439680
Capabilities:
Hash data via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov dword [esi], vtable.EncryptData.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00439590
test al, al
je 0x4396ce
mov edx, dword [ebp + 8]
mov eax, edx
push edi
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4396b0
sub eax, edi
push 0
sar eax, 1
push eax
mov eax, dword [esi + 8]
push edx
push eax
call dword [0x441048]
pop edi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x439720
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
mov ebx, ecx
push eax
lea ecx, [ebp - 4]
push ecx
push esi
mov dword [ebp - 8], 0
call fcn.004123a0
test al, al
je 0x43983b
push esi
mov byte [ebp + 0xb], 0
call fcn.00439610
mov esi, dword [0x4410d8]
test al, al
je 0x439773
mov edx, dword [str.ENCMONET]
push edx
call esi
add eax, eax
add dword [ebp - 4], eax
sub dword [ebp - 8], eax
mov byte [ebp + 0xb], 1
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x43981a
mov eax, dword [ebx + 8]
test eax, eax
je 0x43981a
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push 0x6801
push ecx
xor bl, bl
mov dword [ebp - 0xc], 0
call dword [0x441004]
test eax, eax
je 0x4397c7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push ecx
push 0
push 1
push 0
push edx
call dword [section..rdata]
test eax, eax
je 0x4397c7
mov bl, 1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4397d5
push eax
call dword [0x44100c]
test bl, bl
je 0x4397f0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
call fcn.00412480
test al, al
jne 0x4397f0
xor bl, bl
cmp byte [ebp + 0xb], 0
je 0x439803
mov eax, dword [str.ENCMONET]
push eax
call esi
add eax, eax
sub dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [0x441420]
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [ebp + 0xb], 0
je 0x43982e
mov edx, dword [str.ENCMONET]
push edx
call esi
add eax, eax
sub dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [0x441420]
add esp, 4
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x2e0011b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x2e001114
push 0x2e0010f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x2e0011e5
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ebx, 0x2e0010f4
push ebx
call edi
mov dword [0x2e0010f4], esi
test esi, esi
jne 0x2e001249
mov dword [0x2e0010f4], 0xbb40e64e
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
call edi
pop edi
pop esi
mov dword [section..data], 0x44bf19b1
pop ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x7e4b2d9e
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x7fc00ec6
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4ed81d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
jmp 0x4ed834
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
movzx esi, byte [eax + 1]
movzx edi, byte [eax + 5]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 4]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 6]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 7]
shl esi, 8
xor esi, edi
xor esi, dword [ecx + 4]
movzx edi, byte [eax + 8]
movzx ebx, byte [eax + 0xd]
mov dword [ebp - 0x14], esi
movzx esi, byte [eax + 9]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xa]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xb]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xc]
xor edi, dword [ecx + 8]
xor edx, dword [ecx]
shl esi, 8
xor esi, ebx
movzx ebx, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl esi, 8
xor esi, ebx
shl esi, 8
xor esi, eax
xor esi, dword [ecx + 0xc]
mov dword [ebp - 0xc], edi
shr edi, 8
mov ebx, esi
shr ebx, 0x10
mov eax, 0xff
and edi, eax
and ebx, eax
mov ebx, dword [ebx*4 + 0x4f9120]
xor ebx, dword [edi*4 + 0x4f9520]
mov edi, edx
shr edi, 0x18
xor ebx, dword [edi*4 + 0x4f8d20]
mov edi, dword [ebp - 0x14]
and edi, eax
xor ebx, dword [edi*4 + 0x4f9920]
mov dword [ebp - 8], esi
xor ebx, dword [ecx + 0x10]
shr esi, 8
mov edi, edx
shr edi, 0x10
and edi, eax
and esi, eax
mov dword [ebp - 4], edi
mov edi, dword [esi*4 + 0x4f9520]
mov esi, dword [ebp - 4]
xor edi, dword [esi*4 + 0x4f9120]
mov esi, dword [ebp - 0x14]
mov dword [ebp + 8], edx
mov dword [ebp - 0x10], ebx
shr esi, 0x18
xor edi, dword [esi*4 + 0x4f8d20]
mov esi, dword [ebp - 0xc]
and esi, eax
xor edi, dword [esi*4 + 0x4f9920]
mov esi, dword [ebp - 0x14]
shr esi, 0x10
shr edx, 8
and esi, eax
and edx, eax
mov dword [ebp - 4], edx
mov edx, dword [esi*4 + 0x4f9120]
mov esi, dword [ebp - 4]
xor edx, dword [esi*4 + 0x4f9520]
mov esi, dword [ebp - 0xc]
shr esi, 0x18
xor edx, dword [esi*4 + 0x4f8d20]
mov esi, dword [ebp - 8]
and esi, eax
xor edx, dword [esi*4 + 0x4f9920]
mov esi, dword [ebp - 0x14]
xor edx, dword [ecx + 0x18]
xor edi, dword [ecx + 0x14]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0xc]
shr edx, 0x10
shr esi, 8
and edx, eax
mov edx, dword [edx*4 + 0x4f9120]
and esi, eax
xor edx, dword [esi*4 + 0x4f9520]
mov esi, dword [ebp - 8]
shr esi, 0x18
xor edx, dword [esi*4 + 0x4f8d20]
mov esi, dword [ebp + 8]
and esi, eax
xor edx, dword [esi*4 + 0x4f9920]
mov esi, dword [ebp - 0x18]
xor edx, dword [ecx + 0x1c]
sar esi, 1
add ecx, 0x20
dec esi
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], esi
je 0x4edbae
Function at 0x4f5254
Capabilities:
Check for vm using instruction vpcext

Disassembly:
not dh
push esi
mov si, word [esp]
mov dh, byte [esp]
jmp 0x4f5263
mov dword [esp], edi
mov dword [esp], edx
mov dx, word [esp]
mov dx, si
setnp dl
lea edx, [0xd4dab6c0]
jmp 0x4f5220
mov word [esp + 1], ax
mov byte [esp + 2], dl
jmp 0x4f5236
lea edx, [ecx*4]
mov dh, byte [esp]
mov si, 0x7b75
lea esi, [esi + 0x63]
push ebp
lea esi, [ecx + esi]
jmp 0x4f52a1
setg dh
mov si, word [esp]
xchg dx, si
pop esi
mov dh, ch
jmp 0x4f52d1
lea esi, [edi*4]
lea ebp, [edx + 7]
not edx
mov esi, 0xbccff351
pop ebp
mov edx, ebp
jmp 0x4f5289
lea edx, [ecx*4]
mov dh, 0xa3
mov edx, 0xc83cf742
lea edx, [esp + 0x159a]
mov dx, bx
pop edx
jmp 0x5894de
push 0xa1b5deb1
call fcn.00501627
pop ebx
pushal
mov ecx, 0x6245e0ce
xchg ecx, eax
mov cl, 0x78
push ecx
push ss
pop ebx
sbb edi, dword [ebx + 0x21]
cmp al, 0xb2
xor byte [ebx - 0x5aba4b53], 0x32
aaa
or eax, 0xfb39d95b
cdq
push esp
sbb ah, byte [esi*4 + 0x203ed7a4]
nop
jbe 0x589551
fcomp dword [ebx + 0x3e]
outsb dx, byte [esi]
xchg edi, eax
dec eax
push es
push cs
xlatb
xchg ebp, eax
xchg ecx, eax
push esi
stosb byte es:[edi], al
mov dword [0x85b65def], eax
js 0xcc009f1f
retf
bound ecx, qword [ebp + 0xb]
pop es
mov cl, 0x1f
pop ds
sar esp, 1
dec ecx
cmpsd dword [esi], dword es:[edi]
jge 0x589553
outsd dx, dword [esi]
jbe 0x5895a2
or cl, byte [edi - 0x77]
notrack call fcn.004fd3d9
jl 0x589594
salc
inc ecx
xchg ebp, eax
loop 0x5895c0
leave
mov dword [0xab38fc19], eax
fist dword [edi - 0x21433271]
xchg ecx, eax
in al, 1
ja 0x58952a
xchg edi, eax
invalid
int 0xbc
ficom word [ecx - 0x3088fe1c]
add ebx, dword [ebp + 0x12a017e4]
sahf
scasb al, byte es:[edi]
hlt
jb 0x5895ec
jecxz 0x589530
push esi
dec edx
dec edx
invalid
dec ecx
les eax, [edx + 0x3d4ebc84]
or al, 0x9f
out 0x64, al
xlatb
sub al, 0x3d
rol byte ss:[ebp + 0x5e], 1
cmp al, 0x81
dec edi
cmp esi, dword [ebx - 0x2d]
inc ebp
push 0x1c
push ds
pop edx
pop edx
or ah, bh
pop esp
fidivr word [edx]
push edx
mov dl, 0x44
sbb eax, ebp
mov bh, 0xb4
or al, 0x6c
out dx, al
retf 0x6913
pop ds
in eax, 0x61
pushfd
pop edx
mov edx, 0x9841297
pop edi
stosd dword es:[edi], eax
or dword [edi - 0x55], ebx
cmp eax, 0xc1f441bd
sbb byte [0x2c76686a], bh
enter 0x2c79, 0xfffffffffffffff6
fcmovu st(0), st(0)
and byte [eax + edx*2], ch
mov ah, 0x14
mov dh, 0x30
add ebx, eax
jp 0x589661
les edx, [ebx - 0x2b]
jmp 0x5895e3
mov ebx, 0x3033376d
repne cmpsd dword [esi], dword es:[edi]
les esi, [ebp - 0x62]
fsub qword [ebx + ecx*2 - 0x55]
xchg dword [edi], ecx
retf 0xc1ec
Function at 0x4fea8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dx, bx
jmp 0x4feac1
xchg byte [esp + 5], dh
mov dh, bh
neg dx
jmp 0x4fee57
add bl, al
mov ax, cx
mov dl, byte [esp]
cmp ax, 0xb60
jmp 0x4feb1a
mov ax, dx
xchg edx, eax
mov edx, 0x6ba569b8
bsf ax, bx
jmp 0x4fec0b
mov dh, dl
mov dx, word [esp]
jmp 0x4febaf
ja 0x4fed3c
rdtsc
jmp 0x4fed3e
rdtsc
mov ax, word [esp]
sub esp, 6
jmp 0x4feb7d
mov eax, esi
jmp 0x4feb27
pop word [esp + 0x10]
mov edx, dword [esp + 0x13]
adc dl, cl
call fcn.004feb65
rol byte [ebx + 0x3784153a], 0xfe
rol dword [ebx - 0x1c85e914], 0x66
pop dword [esp + 0x10]
inc cl
sub esp, 0x16
jp 0x4feb41
pop word [esp + 0x10]
jmp 0x4feb8c
bts edx, ebp
neg al
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x4feb57
mov edx, dword [esp + 0x13]
adc dl, cl
jmp 0x4feb4c
add cl, 0x30
rol edx, cl
je 0x4feb3d
mov eax, esi
rdtsc
mov ax, word [esp]
sub esp, 6
bts edx, ebp
jmp 0x4feb80
jo 0x4feb02
mov dh, dl
mov dx, word [esp]
jmp 0x4febaf
rdtsc
dec edi
mov edx, 0x161c0ef7
jmp 0x4feaee
jb 0x4fead0
jae 0x4fead0

Function at 0x4ff01f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov esp, edx
jmp 0x4ff054
push edi
jmp 0x4ff05c
pushfd
lea ebp, [eax + edx - 0x40]
push esi
jmp 0x4ff03e
push ecx
mov esi, ecx
mov edi, edx
jmp 0x4ff0e6
mov ecx, eax
cld
rep movsb byte es:[edi], byte [esi]
call fcn.004ff07b
pop edi
pop esi
jmp 0x4ff12b
popfd
jmp 0x4fe957

Function at 0x501efb
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], ax
mov eax, ebp
pop eax
neg bl
lea eax, [ebx*4]
lea eax, [eax*4]
mov al, 0x4d
jmp 0x501f14
dec ax
jmp 0x501f03
js 0x501ed9
xchg word [esp], ax
mov eax, ebp
jmp 0x501f11
pop eax
jmp 0x501ee0
dec ah
jns 0x501f4b
mov eax, 0x45f0147d
sub esp, 0xa
neg eax
mov ax, word [esp]
dec ax
jmp 0x501f55
neg eax
mov ax, word [esp]
dec ax
jmp 0x501f55
mov eax, 0x45f0147d
sub esp, 0xa
jmp 0x501f35
lea esp, [esp + 2]
jmp 0x501fb0
jmp 0x501f77
lea esp, [esp + 8]
dec bl
mov ax, di
neg ax
jl 0x501f8d
mov ax, word [esp]
jmp 0x501f8f
Function at 0x50815b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x508036
mov dword [esp + 0x24], eax
jmp 0x50805d
call 0x507577
jmp 0x508103
pop ecx
sub ecx, 0x1001ac23
jmp 0x508073
popal
jmp fcn.0050807f
mov dword [ecx + 0x1001b60e], eax
jmp 0x508085
push ebp
mov ebp, eax
movzx ebx, byte [ebp]
pop ebp
jmp 0x5080e4
inc dword [esp + 8]
jmp 0x508166
add ebx, 0xdc4c4914
cmp ebx, 0xdc4c49e0
je 0x50814e
jne 0x50754a
pushfd
cmp dword [esp + 4], 0
jmp 0x5082bb
mov ah, byte [esp]
mov eax, 0x837a0dac
mov eax, dword [esp]
lea esp, [esp + 4]
sub eax, 0x7b39433f
jmp 0x50823e
call 0x50815b
push edx
push ebx
push ebx
je 0x5081a9
popal
insb byte es:[edi], dx
jne 0x5081bc
inc ebp
js 0x50819b
add byte [eax - 0x18], dl
sub byte [esi + edi*8 - 0xbb11601], al
invalid
popfd
jmp 0x50818e
ret
xor eax, 0xeb18b60f
sbb ah, byte [eax + 0x76]
adc eax, esp
push edx
loopne 0x5081f9
lcall 0xec90, 0x27d48d1d
inc esi
jno 0x508222
invalid
jae 0x5081b3
call dword [eax + 0x7b37078e]
jmp 0x508147
nop
mov es, word [edi]
aaa
jnp 0x5081a5
mov word [ecx + 0x34b2dc3], es
xchg edi, eax
ret
add byte [edx + 0x6d], dh
mov dl, 0xff
invalid
call 0x508250
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add cl, ch
pop esi
invalid
jne 0x5080a0
pushal
jmp 0x507572

Function at 0x508250
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x508036
mov dword [esp + 0x24], eax
jmp 0x50805d
call 0x507577
jmp 0x508103
pop ecx
sub ecx, 0x1001ac23
jmp 0x508073
popal
jmp fcn.0050807f
mov dword [ecx + 0x1001b60e], eax
jmp 0x508085
push ebp
mov ebp, eax
movzx ebx, byte [ebp]
pop ebp
jmp 0x5080e4
inc dword [esp + 8]
jmp 0x508166
add ebx, 0xdc4c4914
cmp ebx, 0xdc4c49e0
je 0x50814e
jne 0x50754a
pushfd
cmp dword [esp + 4], 0
jmp 0x5082bb
mov ah, byte [esp]
mov eax, 0x837a0dac
mov eax, dword [esp]
lea esp, [esp + 4]
sub eax, 0x7b39433f
jmp 0x50823e
call 0x50815b
push edx
push ebx
push ebx
je 0x5081a9
popal
insb byte es:[edi], dx
jne 0x5081bc
inc ebp
js 0x50819b
add byte [eax - 0x18], dl
sub byte [esi + edi*8 - 0xbb11601], al
invalid
popfd
jmp 0x50818e
ret
xor eax, 0xeb18b60f
sbb ah, byte [eax + 0x76]
adc eax, esp
push edx
loopne 0x5081f9
lcall 0xec90, 0x27d48d1d
inc esi
jno 0x508222
invalid
jae 0x5081b3
call dword [eax + 0x7b37078e]
jmp 0x508147
nop
mov es, word [edi]
aaa
jnp 0x5081a5
mov word [ecx + 0x34b2dc3], es
xchg edi, eax
ret
add byte [edx + 0x6d], dh
mov dl, 0xff
invalid
call 0x508250
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add cl, ch
pop esi
invalid
jne 0x5080a0
pushal
jmp 0x507572
Function at 0x50f0b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
jmp 0x50f0be
mov dword [esp], eax
jmp 0x50f0be
push dword [esp + 2]
jle 0x50f094
jg 0x50f09d
mov esp, eax
pushfd
lea ebp, [eax + edx - 0x40]
jmp 0x50f0cb
push esi
push edi
push ecx
jmp 0x50f242
pop edi
pop esi
popfd
jmp fcn.0050f108
cld
rep movsb byte es:[edi], byte [esi]
pop ecx
jmp 0x50f135
mov esi, ecx
mov edi, eax
mov ecx, edx
jmp 0x50f1e2
Function at 0x516d0c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 8], esi
call fcn.00516bea
xchg al, dl
sub esp, 0xa
mov dh, byte [esp + 7]
cmp edx, edi
lea esp, [esp + 2]
jmp 0x516c3d
Function at 0x51a5b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x518e86
lea edx, [edx + 0x7e]
sub esp, 1
cmc
push ax
push word [esp]
lea esp, [esp + 1]
jmp 0x51a5d5
pop dword [esp + 0x12]
add esp, 5
lea esp, [esp + 2]
jmp 0x51a599
xchg dword [esp + 0x1c], edx
cmc
stc
call fcn.0051a5bf
mov di, bx
mov dword [esp], ebx
popal
jmp 0x51a649
pop ecx
lea edi, [0xcdeaeb64]
mov edi, dword [esp]
lea esp, [esp + 4]
jmp 0x51a633
pop esi
jmp 0x51a697
mov ecx, edx
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x51a61f
popfd
jmp 0x518ead

Function at 0x52182b
Capabilities:
Encrypt data using aes

Disassembly:
adc bh, dh
pushfd
jmp 0x5217e4
and bh, 0xd7
bsr ebp, edi
lea ebx, [ebx + esi]
shl edx, 8
rcr ebx, cl
jmp 0x5217a8
mov dword [ecx + 0xc], edx
jmp 0x521803
xor edx, esi
shl edx, 8
xor edx, eax
jmp 0x5217ce
and eax, esi
jmp 0x52180f
mov eax, edx
shr eax, 0x10
mov esi, 0xff
jmp 0x5217ed
mov eax, dword [eax*4 + 0x4f8920]
jmp 0x521837
bts bp, ax
movzx eax, byte [eax + 0xf]
mov ebp, ebx
jmp 0x5217be
lea esp, [esp + 0x40]
xor eax, 0x1000000
or ebx, ecx
bswap ebx
jmp 0x5218f4
lea esp, [esp + 3]
jmp 0x521895
sbb bh, 0xb6
mov edi, dword [edi*4 + 0x4f8920]
sub esp, 0xf
push dword [esp + 4]
neg ebp
jmp 0x521868
lea esp, [esp + 0x10]
and edi, 0xff0000
sub bh, dh
mov bl, byte [esp]
jmp 0x5218ca
shr edi, 8
mov ebp, esi
mov bp, word [esp]
setbe bh
and edi, esi
jmp 0x521880
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov di, 0xc7e7
jmp 0x521917
movzx edi, byte [edi*4 + 0x4f8920]
jmp 0x521901
mov edi, edx
mov bp, word [esp]
mov bh, 0x42
mov ebx, dword [esp]
jmp 0x5218ba
xor eax, edi
lea edi, [ebx*4]
lea edi, [edi - 0x63f98a0a]
jmp 0x522806
mov edi, edx
lea ebp, [ebp*4]
shr edi, 0x18
cmc
jmp 0x5218da
lea esp, [esp + 4]
xor eax, dword [ecx]
mov di, dx
bswap edi
bsr edi, ebx
push ebp
jmp 0x521c8f
mov ebp, 0xff00
and edi, ebp
xor eax, edi
jmp 0x521943
lea esp, [esp + 4]
lea edi, [ecx + 0x10]
pushfd
call fcn.00521a8e
lea esi, [esi*4]
lea esi, [esi + 0x4f8920]
mov edi, dword [esi]
pop esi
jmp 0x521959
push sp
lea esp, [esp + 2]
push esi
mov esi, edi
jmp 0x521d31
mov edi, edx
push edi
and edi, esi
neg ebp
jmp 0x522531

Function at 0x521b24
Capabilities:
Encrypt data using aes

Disassembly:
xor edx, ecx
lea ecx, [edi - 0x1767]
jmp 0x521b55
mov dword [eax + 0x14], edx
pushal
mov ecx, dword [eax + 8]
jmp 0x521b3f
Function at 0x57eca3
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x57edbe
pop dx
mov edx, dword [esp]
xchg dh, dl
lea esp, [esp + 2]
lea eax, [eax + 0x2f]
mov dh, cl
call fcn.0057ed09

Function at 0x57ed57
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov byte [esp], ch
add esp, 0
xchg dword [esp + 8], ecx
jmp 0x57ed69
sub esp, 9
rdtsc
mov edx, dword [esp + 3]
mov byte [esp + 2], bh
lea esp, [esp + 1]
jmp 0x57eda4

Function at 0x598cc8
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ebx], ebp
lodsd eax, dword [esi]
sbb ebx, dword [eax - 0x6a]
cmp byte [edx + 0x21362fdc], 0xe1
das
and ecx, esp
mov esp, 0x6b06a9a8
pop eax
frstor dword [ebx + 0x7c]
add dl, al
xor eax, 0x25396b06
mov dh, byte [edi - 0x58]
mov al, 0x41
jb 0x598c1a
pop eax
stosd dword es:[edi], eax
and edi, dword [esp + esi*8 + 0x60]
fmul st(7)
fisub dword [ecx + 0x27536f28]
aam 0x38
lea esi, [ecx + 0x1d]
scasb al, byte es:[edi]
invalid
call 0xe175acbf
adc dword [ebx - 0x37], ebx
cmp al, 0x99
or eax, 0xe759aa88
fnstenv [ecx - 0x5d76b625]
push ebp
jae 0x598c16
pushal
mov dword [0x3b250fda], eax
mov ebp, 0xd4d5b282
jle 0x598c10
fcompi st(5)
mov ecx, 0x27822841
mov ch, 0x25
dec esp
mov edi, 0x34a63702
push ebx
scasb al, byte es:[edi]
push ds
push edi
mov esi, 0xcb540789
fisttp qword [esi + 0x5f]
dec ebx
adc esp, dword [eax]
dec byte [edx - 0x7b]
invalid
push ds
mov al, byte [0xa23d6e7]
cmp ah, byte [0x38aa3c7c]
pop edi
stosb byte es:[edi], al
adc eax, 0x3a5fcf5e
leave
popal
hlt
mov dword [esp], 0x3e819da8
call fcn.004fd3d9
out 0x71, al
loope 0x598c58
and al, 0xa8
popfd
cmp dword [esi], 0xf64705e8
jmp esi
jae 0x598ca9
call 0x72e16d51
mov al, 0xea
ja 0x598cca
xor byte [ecx - 0x31], 0xf0
push 0xab6899fe
push ds
test dword [0xa83e8f7c], edx
movsb byte es:[edi], byte ss:[esi]
ret

Function at 0x654c71
Capabilities:
Parse pe header

Disassembly:
call fcn.00653064
mov dword [esp], edi
mov eax, dword fs:[0x30]
jmp 0x654cb2
mov eax, dword [eax + 8]
push eax
jmp 0x65305f
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x654c7c