joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b565
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x46b67d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46b67d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0049a6af
mov esi, eax
test esi, esi
je 0x46b67d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x46b67d
mov ecx, esi
call fcn.0046b4f0
cmp edi, eax
jge 0x46b67d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x46b603
mov dword [esp + 0x34], 1
jmp 0x46b65e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x46b67d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00469d40
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x4728c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x502668]
xor edx, edx
cmp eax, edx
jne 0x4728e6
xor eax, eax
mov byte [eax + 0x502568], al
inc eax
cmp eax, 0x100
jl 0x4728ce
mov dword [0x502668], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x502568
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x472977
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x47294a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x472918
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x472980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4729d3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4729ba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x479370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a7c6e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00479c90
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4b4bd4
call fcn.004989f0
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x479403
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004989f0
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4793fc
push 0
mov ecx, eax
call fcn.004704f0
mov dword [esi + 0xc], eax
jmp 0x479405
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x479405
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x49b053
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49b08b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0049910a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004990e2
jmp 0x49b097
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49c74a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49c78c
call fcn.004a21fd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49c78c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49c783
xor eax, eax
jmp 0x49c794
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049c79a
pop edi
pop esi
pop ebx
ret 4
Function at 0x4a272d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a275b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a2779
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a2693
jmp 0x4a2779
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a2779
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a2693
test edi, edi
mov eax, edi
jne 0x4a2763
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4027b0
Capabilities:
Enumerate process modules
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x40721b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push ebx
push esi
mov esi, dword [0x40b36c]
push 0
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x408b60
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.00403ce0
test eax, eax
je 0x40281f
push 0x169
push eax
lea ecx, [esp + 0x10]
call fcn.00403c80
mov ecx, eax
test eax, eax
mov dword [esp + 0x10], ecx
jne 0x402839
lea eax, [esp + 8]
push str._Tenio_Error__Create_ComponentFactory_in_TenFact.dll_Fail_n
push eax
jmp 0x402829
lea ecx, [esp + 8]
push str._Tenio_Error__Load_TenFact.dll_Fail._n
push ecx
call fcn.00403fc0
mov ecx, dword [esp + 0x18]
add esp, 8
test ecx, ecx
je 0x402852
mov edx, dword [ecx]
push 0
push esi
call dword [edx + 0x20]
test eax, eax
mov dword [esp + 0xc], eax
je 0x402852
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 0x10]
push 0
push 8
mov dword [esp + 0x248], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40291a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40291a
push edi
mov ecx, 0x88
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x224
push eax
push ebx
call sub.KERNEL32.dll_Module32First
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop edi
test eax, eax
je 0x4028ca
mov ecx, dword [esp + 0x30]
push str.TenioDllFreeMap
push ecx
call esi
test eax, eax
je 0x4028bb
call eax
lea edx, [esp + 0x14]
push edx
push ebx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x4028a9
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esp + 0xc]
push 1
mov edx, dword [ecx]
call dword [edx + 8]
lea eax, [esp + 0x14]
push eax
push ebx
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x402913
mov ecx, dword [esp + 0x30]
push str.TenioSetDllSafe
push ecx
call esi
test eax, eax
je 0x402904
push 0
call eax
add esp, 4
lea edx, [esp + 0x14]
push edx
push ebx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x4028ed
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Tenio_Uninitialize_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
pop ebx
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
add esp, 0x23c
ret
Function at 0x402bb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x407268
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
mov edi, ecx
push 0x40b9b8
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
call fcn.004057bd
add esp, 4
push str...hcq.dll
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.00404f98
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [edi + 0xc8], eax
je 0x402d06
push str.DllGetClassObject
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x402c65
mov eax, dword [edi + 0xc8]
push eax
jmp 0x402d00
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push 0x408db8
push 0x408a70
call eax
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x402cf9
test eax, eax
jl 0x402cf9
mov edx, dword [ecx]
lea esi, [edi + 0xcc]
push esi
push 0x408a50
push 0
push ecx
call dword [edx + 0xc]
mov ebp, eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi]
test eax, eax
je 0x402ce4
test ebp, ebp
jl 0x402ce4
mov edx, dword [eax]
push 0x10
push eax
call dword [edx + 0xc]
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov eax, dword [edi + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi], 0
jmp 0x402d06
mov ecx, dword [edi + 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x403fc0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x40b058]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x404400
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40446d
mov al, byte [esp + 0x14]
test al, al
je 0x40446d
cmp al, 0x20
je 0x404465
cmp al, 9
jne 0x4044b0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40445d
mov esi, dword [esp + 0x120]
test esi, esi
je 0x4044a3
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x4044a3
test ebx, ebx
je 0x4044a3
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x4044a3
push ebx
push edx
push esi
call dword [0x40b06c]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call dword [sym.imp.MSVCRT.dll__mbschr]
add esp, 8
test eax, eax
jne 0x404576
cmp byte [esp + 0x14], 0x5c
je 0x404576
test ebx, ebx
je 0x4044a3
mov edi, dword [esp + 0x120]
test edi, edi
je 0x4044a3
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x4044a3
mov esi, dword [sym.imp.MSVCRT.dll__mbsrchr]
push 0x5c
push ebx
call esi
add esp, 8
test eax, eax
jne 0x404507
push 0x2f
push ebx
call esi
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x40452e
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x404559
cmp ebp, esi
jle 0x404559
push esi
push ebx
push ebp
push edi
call dword [0x40b068]
add esp, 0x10
mov byte [esi + edi], 0
jmp 0x404559
mov esi, dword [esp + 0x10]
push ebp
push ebx
mov ecx, esi
call fcn.004048a0
test eax, eax
je 0x40454b
push ebx
push ebp
push edi
call dword [0x40b06c]
add esp, 0xc
push 0x40b548
push ebp
push edi
mov ecx, esi
call fcn.00404950
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push ebp
push edi
call fcn.00404950
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.00404400
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0xa23081
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov word [esp + 1], dx
push dword [esp + 2]
jle 0xa23087
mov dword [esp + 0x10], esp
pushfd
mov byte [esp + 2], bl
mov dword [esp + 0x10], ebp
jmp 0xa2309a
mov dword [esp + 0xc], ebx
jmp 0xa2305f
mov dword [esp + 0x10], esp
jmp 0xa23091
pushfd
mov byte [esp + 2], bl
mov dword [esp + 0x10], ebp
call fcn.00a230cc

Function at 0xa230cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0xa2315f
push sp
pop word [esp]
pop word [esp]
lea esp, [esp]
push word [esp]
jmp 0xa230ce
jmp 0xa230b3
js 0xa230e4
mov dword [esp + 0x10], esi
jmp 0xa230e8
mov dword [esp + 0x10], esi
call 0xa230ee
jp 0xa23155
pop dword [esp]
pushal
mov word [esp + 0x15], cx
jmp 0xa231d8
mov eax, 0x84aaeb22
lea esi, [esp + 0x20]
bt eax, ebp
rdtsc
pushal
mov ebp, dword [esp + 0x4c]
mov esi, 0xf71f2b0c
xchg al, bh
jmp 0xa23109
xchg ecx, eax
retf
jmp 0xa23129
lea esp, [esp + 0x14]
lea esp, [esp + 2]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
pushfd
jmp 0xa23011

Function at 0xa230ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0xa2315f
push sp
pop word [esp]
pop word [esp]
lea esp, [esp]
push word [esp]
jmp 0xa230ce
jmp 0xa230b3
js 0xa230e4
mov dword [esp + 0x10], esi
jmp 0xa230e8
mov dword [esp + 0x10], esi
call 0xa230ee
jp 0xa23155
pop dword [esp]
pushal
mov word [esp + 0x15], cx
jmp 0xa231d8
mov eax, 0x84aaeb22
lea esi, [esp + 0x20]
bt eax, ebp
rdtsc
pushal
mov ebp, dword [esp + 0x4c]
mov esi, 0xf71f2b0c
xchg al, bh
jmp 0xa23109
xchg ecx, eax
retf
jmp 0xa23129
lea esp, [esp + 0x14]
lea esp, [esp + 2]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
pushfd
jmp 0xa23011
Function at 0xa2448b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
jns 0xa24474
js 0xa244b2
xchg word [esp + 1], dx
pop word [esp + 1]
jmp 0xa244c5
mov word [esp + 1], dx
bt edx, eax
mov dx, 0xbb29
jmp 0xa24494
Function at 0xa24733
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xa247c4
neg bl
mov al, byte [esp]
neg dl
jmp 0xa24818
lea esp, [esp]
lea esp, [esp + 1]
jmp 0xa24756
add esp, 3
jns 0xa24777
lea esp, [esp]
lea esp, [esp + 1]
call fcn.00a24796
push esi
jge 0xa2482f
mov edx, ecx
mov ax, sp
jmp 0xa2488c
mov edx, ecx
mov ax, sp
setge dh
not ax
add bl, 0xff
cmp dh, 0x1f
jmp 0xa24846
jle 0xa2485c
bswap edx
lea edx, [eax + eax]
jmp 0xa24861
bswap edx
lea edx, [eax + eax]
jmp 0xa24894
xchg ah, dl
bsf ax, sp
jmp 0xa2489f
bsf ax, sp
lea edx, [edx + edx]
jmp 0xa248a2
setge dh
not ax
jmp 0xa2483a
add bl, 0xc
neg ah
jnp 0xa24863
xchg ah, dl
jmp 0xa2486f
lea edx, [edx + edx]
mov eax, ebx
neg dx
jg 0xa248e7
rcr dx, cl
mov dx, 0x4bbe
jmp 0xa24bc8
rcr dx, cl
mov dx, 0x4bbe
jmp 0xa24bc8
jmp 0xa248cc
lea esp, [esp + 2]
jmp fcn.00a2309f
jmp 0xa24a19
shl eax, 2
mov dl, byte [esp]
pushfd
push word [esp + 3]
je 0xa24b03
lea esp, [esp + 2]
jmp fcn.00a2309f
Function at 0xa3d3b5
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xf8
lea edx, reloc.oleaut32.dll_SysFreeString
call fcn.00a3cf12
cmp edi, dword [edx + edx*2 + reloc.oleaut32.dll_SysFreeString]
test al, 0xcb
mov ebp, esp
inc bx
jnp 0xa3cef2
mov dh, 0xf8
jmp 0xa3cf2d
lea edx, reloc.oleaut32.dll_SysFreeString
jmp 0xa3cefa
jns 0xa3cfbc
and edx, edi
jmp 0xa3cfbe
and edx, edi
sub esp, 0xc0
jmp 0xa3cf08
lea esi, [esp]
not ebp
neg al
jmp 0xa3cf57
jmp 0xa3d14e
movzx edx, byte [edi]
shl ebx, cl
jne 0xa3d1a7
mov bx, word [esp]
jmp 0xa3d18f
not bl
xchg cl, ch
not cl
call fcn.00a3d1ea
or al, 0x8a
sbb byte [edi - 0x76], bh
mov byte [esi + 0x29dabf2f], ch
push cs
ret 0x8b66
mov bx, word [esp]
not bl
xchg cl, ch
not cl
mov bh, 0xbc
jmp 0xa3d1f7
ror cx, cl
jmp 0xa3d217
add dl, al
mov bx, bp
mov cx, 0x7a4
mov ebx, dword [esp]
bt ecx, ebp
jmp 0xa3d2e4
mov bl, dl
bsr ecx, esi
je 0xa3d266
jne 0xa3d250
cmp eax, 0xbf4c25b5
xchg ebp, eax
sub eax, 0xae5334a6
int 0x57
neg edx
jge 0xa3d0ea
jl 0xa3d0ea
mov ecx, 0x9828d30b
inc ch
lea ecx, [ebp*4]
jmp 0xa3d294
mov ecx, 0x9828d30b
inc ch
lea ecx, [ebp*4]
mov cx, word [esp]
pushal
lea esp, [esp + 0x20]
xor bl, 0x6c
jmp 0xa3d2b1
mov cx, word [esp]
pushal
jmp 0xa3d279
push bx
jmp 0xa3d2c3
mov cx, dx
mov ecx, dword [esp]
neg ecx
jle 0xa3d29b
push bx
jmp 0xa3d306
pop cx
mov cx, sp
mov ch, byte [esp]
jmp 0xa3d2f0
not cx
jmp 0xa3d382
jle 0xa3d22c
jg 0xa3d22c
ror bl, 0
lea ecx, reloc.oleaut32.dll_SysFreeString
bswap ecx
mov cx, 0xfe0c
jmp 0xa3d2cd
pop cx
mov cx, sp
mov ch, byte [esp]
jmp 0xa3d2cb
pushal
mov cx, 0x64a0
bts ecx, eax
jmp 0xa3d366
pushal
mov cx, 0x64a0
bts ecx, eax
xchg dword [esp + 0x16], ecx
bsr ecx, edi
lea esp, [esp + 0x20]
sub bl, 4
jmp 0xa3d390
xchg dword [esp + 0x16], ecx
bsr ecx, edi
jmp 0xa3d34d
rol bl, 0
mov cx, si
bsf cx, si
jbe 0xa3d33e
ja 0xa3d328
lea ecx, reloc.oleaut32.dll_SysFreeString
neg ecx
jmp 0xa3d75c
bswap ecx
lea ecx, [edx*4]
call fcn.00a3d4c4
stosd dword es:[edi], eax
and dh, byte [eax - 0x1cecdd29]
sbb dh, byte [ebp - 0x17]
push ebx
idiv bh
jmp dword [esi - 0x47]
jb 0xa3d39e
bswap ecx
lea ecx, [edx*4]
jmp 0xa3d3a7

Function at 0xa441d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bx
bsf ebx, edi
jbe 0xa441dd
xchg dh, dl
jmp 0xa441e7
lea esp, [esp + 0xc]
xor esi, 0x1d50ae1c
jmp 0xa441bb
xchg dh, dl
mov edx, ecx
jmp 0xa44224
mov edx, ecx
mov edx, dword [esp]
jmp 0xa44227
rdtsc
mov bx, 0xc2b1
mov bh, ah
clc
sub esp, 0x1f
pop ebx
jmp 0xa44258
mov edx, dword [esp]
xor esi, 0x729ad9c8
mov dx, di
inc ah
jmp 0xa44238
js 0xa4420e
rdtsc
mov bx, 0xc2b1
jmp 0xa44283
mov bh, ah
clc
sub esp, 0x1f
jmp 0xa4421a

Function at 0xa4426a
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
jmp 0xa4428b
mov bx, 0x8a51
xchg dword [esp], ebx
jmp 0xa442ad
lea esp, [esp + 4]
not esi
lea edx, reloc.oleaut32.dll_SysFreeString
lea eax, [edx*4]
mov ebx, 0xb4994c9
jmp 0xa442e3

Function at 0xa69b47
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 1], ch
push word [esp + 1]
lea esp, [esp + 2]
jmp 0xa69b47
pop esi
pushfd
add esp, 1
sub esp, 5
jmp 0xa69b31
push esi
mov esi, ecx
add esi, 0x14
mov dword [esi], ebx
jmp 0xa69b13
Function at 0xa69be8
Capabilities:
Encrypt data using aes

Disassembly:
neg edi
lea esp, [esp + 2]
jmp 0xa69c1f
shr ecx, 8
mov edi, dword [esp]
call fcn.00a69c09

Function at 0xa69c09
Capabilities:
Encrypt data using aes

Disassembly:
xchg dh, al
mov eax, edi
rcr ch, 1
jmp 0xa69bdc
pushal
sub esp, 5
mov word [esp + 1], cx
xchg byte [esp + 2], al
lea esp, [esp + 1]
mov dword [esp + 0x1c], edx
jmp 0xa69c40
rcl edx, 0x1f
neg cl
mov edx, dword [eax + 0xc]
not ecx
jmp 0xa69bbe
dec di
sub esp, 0x1e
call fcn.00a69be8
mov edi, edx
jmp 0xa69c2a
and ecx, esi
cmc
jmp 0xa69c6c
sub esp, 0xe
mov dword [esp + 6], esp
push dword [esp + 2]
lea esp, [esp + 2]
lea esp, [esp + 0x14]
popal
jmp 0xa69bff
lea eax, reloc.oleaut32.dll_SysFreeString
mov ecx, dword [eax]
pop eax
pushal
push word [esp]
jmp 0xa69c78
push eax
mov eax, ecx
lea eax, [eax*4]
jmp 0xa69c56
lea esp, [esp + 2]
shr edi, 0x10
and edi, esi
jmp 0xa6a98f
push bp
lea esp, [esp]
lea esp, [esp + 2]
jmp 0xa6a2b3
mov di, word [esp]
mov edi, edx
stc
and edx, esi
jmp 0xa69caa
add ebx, 4
adc dx, 0x6200
jmp 0xa69d4d
xor ecx, dword [eax]
adc dh, dl
mov dl, 0xc
pushal
lea esp, [esp + 0x20]
jmp 0xa69ccb
pushal
lea ecx, [edx - 0x10]
mov dword [esp + 0x10], eax
cmc
popal
jmp 0xa69d22
xor edx, ecx
shr cx, 1
push ebx
jmp 0xa69cee
add ebx, 0x14
mov dword [ebx], edx
pop ebx
mov ecx, dword [eax + 8]
call fcn.00a69d0c
push word [esp + 2]
pushal
lea esp, [esp + 2]
jmp 0xa69d99
mov dword [edi], ecx
mov dx, si
mov edx, dword [eax + 4]
pushfd
jmp 0xa69d04
mov edx, dword [eax + 0xc]
sub esp, 0x10
mov word [esp + 0xb], cx
jmp 0xa69d78
mov ebx, eax
add ebx, 0x18
mov dword [ebx], ecx
pop ebx
jmp 0xa69d58
xor edx, ecx
stc
clc
clc
jmp 0xa69da0
setns ah
push 0xa
jmp 0xa69e57
xor ecx, edx
sub edx, ecx
push ebx
jmp 0xa69d6e
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x38]
cmp ebx, 0xa3c004
jne 0xa6962c
je 0xa69d7f
inc ebx
invalid
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
mov dx, 0xb315
bts dx, di
jmp 0xa69ce1
pop ebp
setp bh
jmp 0xa69e0e
lea esp, [esp + 4]
pop edi
pop esi
mov ebx, ebp
jmp 0xa69dd8
pop ebx
ret
mov eax, dword [esp]
mov ebp, edi
mov ebx, dword [esp]
not bp
jmp 0xa69dee
bswap edi
mov edi, edx
xor ecx, edx
lea esp, [esp + 0x1c]
jmp 0xa69dc6
xor ecx, edi
and edx, ebp
bsf di, bp
dec di
jmp 0xa69ef3
popal
lea eax, [eax*4]
lea eax, reloc.oleaut32.dll_SysFreeString
movzx edi, byte [eax]
pop eax
jmp 0xa69f46
neg ah
mov dword [esp + 0x1c], edi
sub esp, 0x1e
mov byte [esp + 0xe], cl
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
jmp 0xa6a123
shr edi, 0x18
push eax
pushal
mov ch, dh
jmp 0xa6a246
mov edx, dword [edx*4 + reloc.oleaut32.dll_SysFreeString]
push ax
mov byte [esp], dl
sub esp, 0x16
jmp 0xa6a280
and edi, 0xff000000
sub esp, 0x13
add esp, 0xf
xor ecx, edi
mov di, word [esp]
jmp 0xa69cc0
mov edi, dword [ebx]
pop ebx
lea esp, [esp + 0x44]
and ecx, 0xff0000
jmp 0xa6a4e5
push ebx
mov ebx, edi
lea ebx, [ebx*4]
lea ebx, reloc.oleaut32.dll_SysFreeString
jmp 0xa6a870