joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4066f4
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.00406613
mov dword [esp + 0x14], eax
test bl, 8
je 0x406736
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x429dc8], eax
jmp 0x4068b5
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x406753
test eax, eax
je 0x4068a4
test bl, 2
je 0x40686d
push esi
push 0x425248
call fcn.00406af5
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406776
push str..
push 0x425248
call ebp
jmp 0x40677c
push esi
call fcn.00406ceb
xor eax, eax
cmp word [esi], ax
jne 0x40678d
cmp word [0x425248], 0x5c
jne 0x406795
push 0x4082b0
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x425248
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406856
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x4067df
cmp word [esp + 0x4a], 0
je 0x406838
cmp word [esp + 0x4a], ax
jne 0x4067df
cmp word [esp + 0x4c], 0
je 0x406838
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00406af5
test byte [esp + 0x1c], 0x10
je 0x406806
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x406838
push ebx
push esi
call fcn.004066f4
jmp 0x406838
push edi
push esi
call fcn.00406560
test eax, eax
jne 0x406830
test edi, edi
je 0x406828
push esi
push 0xfffffffffffffff1
call fcn.00405d15
xor eax, eax
push eax
push esi
call fcn.00406218
jmp 0x406838
inc dword [0x429dc8]
jmp 0x406838
push esi
push 0xfffffffffffffff2
call fcn.00405d15
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4067c1
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x4068b4
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x18], ecx
je 0x4068a4
push esi
call fcn.004065aa
test eax, eax
je 0x4068b4
push esi
call fcn.00406531
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00406560
test eax, eax
jne 0x4068ac
test edi, edi
je 0x4068a4
push esi
push 0xfffffffffffffff1
call fcn.00405d15
xor eax, eax
push eax
push esi
call fcn.00406218
jmp 0x4068b4
inc dword [0x429dc8]
jmp 0x4068b4
push esi
push 0xffffffffffffffe5
call fcn.00405d15
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x4068f6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x406952
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004062b3
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x4069c4
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x4069c4
cmp dword [ebp + 0x18], 1
je 0x4069c9
cmp dword [ebp + 0x18], 2
je 0x4069c9
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x4069ce
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406a31
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406a7b
test edi, edi
jne 0x406a3e
mov word [esi], ax
jmp 0x406a7d
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x406b78
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406b9a
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406e17
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42789c], 0
push esi
jne 0x406e51
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406e28
mov dword [ecx*4 + 0x427898], edx
inc ecx
cmp ecx, 0x100
jl 0x406e23
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406e7b
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x427898]
inc esi
sub edx, 1
jne 0x406e63
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x4099ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ad8
push ebx
push 0x409ae4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a6c
mov al, 0x6a
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004099c0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a75
call fcn.004099c0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ac6
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x6819345b
nop
nop
nop
nop
nop
test eax, eax
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x3614771b
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x404809
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
rdtsc
mov dword [ebp - 4], eax
cmp dword [0x404805], 0
jne 0x404814
mov dword [0x404805], eax
rdtsc
xor eax, edx
xor edx, edx
mov ebx, 5
div ebx
add edx, 3
mov ecx, edx
loop 0x404834
mov eax, dword [ebp - 4]
cmp dword [0x404805], eax
jne 0x40480f
mov esp, ebp
pop ebp
ret
Function at 0x416a0e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x416a26], 0x3ed5a8
je 0x416b6d
jmp 0x416a2a
xor ebx, 0xf7998c9c
mov edx, 0xfe04e9f6
xor edx, 0xfe2f76dd
mov ebx, 0xff392694
call fcn.00416a69
mov edx, 0xfe918e6e
mov edx, 0xfdb36a42
mov edx, 0xfb769a39
mov ebx, 0xfc79b454
cmp eax, 0x8401642e
jne 0x401698
jmp 0x416b07
call fcn.00416b3d
jmp 0x416b6d
mov edx, 0xfb3bbe3e
mov dword [0x416a26], 0x3ed5a8
mov edx, 0xfdd855af
jmp 0x416acc
lds ebx, [ecx + 0x75]
in eax, 0x5d
punpckhdq mm5, mm5
inc edx
or byte [ecx], ah
stosd dword es:[edi], eax
push 0x63cd2e44
inc esp
cld
pop esi
or byte [esi - 0xa], ch
dec ebx
push ss
das
loope 0x416be0
add dword [ecx], esp
stosd dword es:[edi], eax
jp 0x416bf3
cld
pop esi
or byte [esi - 0xa], ch
dec ebx
push ss
das
loope 0x416bf0
add dword [ecx], eax
aam 0x5c
or esp, dword [esi - 0xa]
dec edi
or dword [ecx], esp
leave
dec edi
or ah, byte [eax - 0x1d]
dec ebx
push ss
add dword [0x81c6985b], ecx
mov ecx, dword [edi + 0x41]
test byte [esi], ch
add dword fs:[edi + 0x4b0df909], eax
nop
mov cl, 0xde
add dword fs:[esi + ebp + 0x4281bf04], eax
and eax, 0x9b4ad201
add edx, edx
dec edx
wait
xor al, 0x84
add eax, esp
cmpsd dword [esi], dword es:[edi]
inc ecx
add dword [esi + ebp - 0x2d0e759c], eax
push cs
add esp, ebp
in al, dx
inc ecx
cmovo eax, dword [ecx + edx*8 + 0x6c11bf71]
imul esp, dword fs:[ebx + 0x2d], 0x3b7b0164
jnp 0x416c2d
mov dl, byte [ebp + 0x10e2ec6]
in al, dx
mov eax, dword [0xd184400f]
jno 0x416bbf
xchg ebp, eax
invalid
adc dword [esp - 0x16], ebp
cmpsb byte [esi], byte es:[edi]
jmp 0x6ef1106b
out 0xc5, eax
mov al, byte [0xff909a5]
dec ebx
nop
cmp cl, 0xde
je 0x416bcb
inc esi
sub dh, byte [esp + eax*4 + 0x2e]
mov word [edi + 0x65], fs
rcr byte [ebx + 0xe0881c6], 1
inc eax
test byte [ebp - 0x36], bh
add al, byte [ecx + 0x26813055]
cmovo eax, dword [edi + ebx + 0x6fef1661]
xor byte fs:[ecx - 0x7bbff1bf], al
invalid

Function at 0x416c7a
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp dword [0x416c92], 0xd70dd0
je 0x416dc8
jmp 0x416c96
xor ebx, 0xf92107c9
xor edx, 0xfaba3742
mov ebx, 0xf8180b60
xor edx, 0xf7a5b2e4
xor edx, 0xf979a97b
call fcn.00416d54
xor ebx, 0xfdec8d43
xor edx, 0xf7b1a64c
xor edx, 0xfb777566
cmp eax, 0x74e06336
jne 0x401698
jmp 0x416da7
jmp 0x416dc8
call fcn.00416cf7
mov ebx, 0xff754c3c
jmp 0x416d0d
mov ebx, 0xf7451d4a
mov dword [0x416c92], 0xd70dd0
jmp 0x416d65
mov edi, 0x33b33c16
invalid

Function at 0x422ec2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
pushal
cmp dword [0x422edb], 0xf7d77d
je 0x423011
jmp 0x422edf
xor edx, 0xfe8b8684
mov ebx, 0xf9b2e8ae
mov edx, 0xc9cfb7
call fcn.00422fa3
mov edx, 0xfe11dfd0
xor edx, 0xf866bafe
xor edx, 0xfa3262af
cmp eax, 0x1d48de52
jne 0x401698
jmp 0x422f6a
call fcn.00422f4b
jmp 0x423011
mov edx, 0xf8fcfa64
mov dword [0x422edb], 0xf7d77d
mov ebx, 0xf84b2089
jmp 0x422f1c
xchg ebp, eax
wait
mov ah, 0x1d
push edx
fimul word [eax - 0xa]
invalid
Function at 0x423ac0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x1e
push 0x423abc
call fcn.00404920
cmp eax, 0
jne 0x423ae7
push 0x7560
call fcn.00404dad
mov esp, ebp
pop ebp
ret 0x18
cmp dword [0x423af9], 0xa7dd21
je 0x423c33
jmp 0x423afd
mov edx, 0xfb80ebce
mov edx, 0xff112167
mov edx, 0xfe3785aa
call fcn.00423b4f
xor ebx, 0xfb18a2fc
xor edx, 0xfe85a43b
xor ebx, 0xfa06e20c
cmp eax, 0xcca32c94
jne 0x401698
jmp 0x423be0
call fcn.00423b33
jmp 0x423b7a
jmp 0x423c33
mov dword [0x423af9], 0xa7dd21
jmp 0x423b73
jmp 0x423c45
mov dword [0x423c3d], esi
mov dword [0x402ba5], 0
mov dword [0x423c35], ebp
mov dword [0x423c39], esp
mov dword [0x423c41], 0
pushal
mov esi, 0x423ebd
push esi
push dword fs:[0]
mov dword fs:[0], esp
mov esi, dword [0x423c3d]
cmp dword [ebp + 0x14], 0
jne 0x423c9b
mov esi, dword [ebp + 8]
rdtsc
xor ax, dx
mov word [esi], ax
mov word [ebp - 0x1a], ax
mov eax, dword [ebp + 0xc]
mov ebx, 4
mul ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ebx, 4
mul ebx
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x423ccf
push 0x40
push 0x3000
push dword [ebp - 4]
push 0
call dword [fcn.004294da]
jmp 0x423cd2
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0x10]
call fcn.00423aa9
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x10]
xor ecx, ecx
mov dword [esi], ecx
add esi, 4
inc ecx
cmp ecx, ebx
jne 0x423ce8
cmp dword [ebp + 0x1c], 0
jne 0x423d0c
push 0x40
push 0x3000
push dword [ebp - 4]
push 0
call dword [fcn.004294da]
jmp 0x423d0f
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
pop dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.00423aa9
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x14], 0
jbe 0x423d58
cld
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.00423aa9
push dword [ebp - 0xc]
pop dword [ebp - 8]
call fcn.00423d95
inc dword [ebp - 0x14]
mov eax, dword [0x423aa5]
cmp dword [ebp - 0x14], eax
jne 0x423d35
cmp dword [ebp + 0x18], 0
jne 0x423d90
push 0x8000
push 0
push dword [ebp - 0xc]
call dword [fcn.004294e6]
push 0x8000
push 0
push dword [ebp - 0x10]
call dword [fcn.004294e6]
jmp 0x423ebb
jmp 0x423ee2
pop dword fs:[0]
add esp, 0x24
mov ebp, dword [0x423c35]
mov esp, dword [0x423c39]
cmp dword [0x423c41], 1
jne 0x423f0b
push 0x7561
call fcn.00404dad
mov dword [0x423af9], 0x1eb99d
rdtsc
xor dword [0x423b80], eax
xor dword [0x423b55], eax
xor dword [0x423bf2], eax
call fcn.00423b4f
mov dword [0x423b24], eax
call fcn.00423b33
nop
nop
push 0x423abc
call fcn.00404af0
mov esp, ebp
pop ebp
ret 0x18
Function at 0x423d95
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
cmp eax, ecx
ja 0x423da9
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
rol eax, cl
xor edx, edx
mov ebx, ecx
div ebx
pushal
mov edi, dword [ebp - 0x10]
xor ecx, ecx
xor ebx, ebx
cmp ebx, edx
jne 0x423dc2
cmp dword [edi], 0xffffffff
je 0x423dc2
jmp 0x423dd1
cmp dword [edi], 0xffffffff
je 0x423dc8
inc ebx
add edi, 4
inc ecx
cmp ecx, dword [ebp + 0xc]
jne 0x423db7
mov esi, dword [ebp - 8]
mov ebx, dword [edi]
mov dword [edi], 0xffffffff
mov dword [esi], ebx
add dword [ebp - 8], 4
popal
dec ecx
cmp ecx, 0
jne 0x423d9b
cmp dword [ebp + 0x14], 0
jne 0x423e0c
mov ax, word [ebp - 0x1a]
mov esi, dword [ebp + 8]
add esi, 2
mov ecx, 2
xor word [esi], ax
add esi, 2
add ecx, 2
cmp ecx, dword [ebp + 0xc]
jne 0x423dfe
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
xor edi, edi
cmp dword [ebp + 0x14], 0
jne 0x423e5b
mov edx, dword [esi]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
mov edx, dword [esi + 4]
mov ebx, dword [ebp + 8]
add ebx, edx
mov bl, byte [ebx]
xor bl, cl
rol ecx, 1
xor al, cl
rol ecx, 1
push ecx
mov edx, dword [esi]
mov ecx, dword [ebp + 8]
add ecx, edx
mov byte [ecx], bl
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 8]
add ecx, edx
mov byte [ecx], al
pop ecx
add esi, 8
add edi, 2
mov eax, dword [ebp + 0xc]
cmp edi, eax
jne 0x423e1c
jmp 0x423eba
mov edx, dword [esi]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
mov edx, dword [esi + 4]
mov ebx, dword [ebp + 8]
add ebx, edx
mov bl, byte [ebx]
xor al, cl
rol ecx, 1
xor bl, cl
rol ecx, 1
push ecx
mov edx, dword [esi]
mov ecx, dword [ebp + 8]
add ecx, edx
mov byte [ecx], bl
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 8]
add ecx, edx
mov byte [ecx], al
pop ecx
add esi, 8
add edi, 2
mov eax, dword [ebp + 0xc]
cmp edi, eax
jne 0x423e5b
cmp dword [ebp + 0x14], 1
jne 0x423eba
mov esi, dword [ebp + 8]
mov ax, word [esi]
add esi, 2
mov ecx, 2
xor word [esi], ax
add esi, 2
add ecx, 2
cmp ecx, dword [ebp + 0xc]
jne 0x423eac
ret

Function at 0x42576b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
rdtsc
xor eax, edx
xor edx, edx
mov ebx, 0x100
div ebx
mov dword [ebp - 8], edx
add dword [ebp - 8], 0x100
push 3
push 0x425db2
call fcn.00404920
cmp eax, 0
jne 0x4257b8
mov dword [0x425db2], 0
push dword [ebp - 8]
call dword [fcn.004294ee]
push 5
push 0x425db2
call fcn.00404920
cmp eax, 0
jne 0x4257cd
push 0x7547
call fcn.00404dad
mov esp, ebp
pop ebp
ret 8
call fcn.004274d5
mov eax, dword [ebp + 8]
add eax, 0x2bc
cmp dword [0x4257ec], 0x582734
je 0x42593d
jmp 0x4257f0
mov ebx, 0xfbc1d404
xor ebx, 0xfef565a8
xor ebx, 0xf86449cd
xor ebx, 0x989511
call fcn.004258c2
xor ebx, 0xfe616c44
xor edx, 0xfd2240a7
xor ebx, 0xff59adbd
mov ebx, 0xfd730ae4
cmp eax, 0x1eb5594c
jne 0x401698
jmp 0x425894
mov edx, 0x5939056f
mov dword [0x4257ec], 0x582734
jmp 0x425909
call fcn.004258d4
jmp 0x42593d
cmpsd dword [esi], dword es:[edi]
dec ecx
invalid
Function at 0x429752
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push 0x78
push 0x42974e
call fcn.00404920
cmp dword [0x429776], 0x7f7103
je 0x4298be
jmp 0x42977a
mov ebx, 0xf71cb7a3
Function at 0x10001850
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, 0x10
mov esi, 0x39956f8
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
add esi, 0xfffffffe
xor ecx, ecx
test esi, esi
jle 0x100018e2
jmp 0x10001880
movzx edi, byte [edx + ecx]
shr edi, 2
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax], bl
movsx edi, byte [edx + ecx]
movzx ebx, byte [edx + ecx + 1]
and edi, 3
shr ebx, 4
shl edi, 4
or edi, ebx
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax + 1], bl
movsx ebx, byte [edx + ecx + 1]
movzx edi, byte [edx + ecx + 2]
and ebx, 0xf
add ebx, ebx
shr edi, 6
add ebx, ebx
or edi, ebx
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax + 2], bl
movsx edi, byte [edx + ecx + 2]
and edi, 0x3f
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax + 3], bl
add ecx, 3
add eax, 4
cmp ecx, esi
jl 0x10001880
cmp ecx, dword [ebp + 8]
jge 0x1000195e
movzx esi, byte [ecx + edx]
shr esi, 2
mov bl, byte [ebp + esi - 0x44]
mov esi, dword [ebp + 8]
dec esi
mov byte [eax], bl
cmp ecx, esi
jne 0x10001921
movsx ecx, byte [ecx + edx]
and ecx, 3
add ecx, ecx
mov dl, byte [ebp + ecx*8 - 0x44]
mov byte [eax + 1], dl
pop edi
mov byte [eax + 2], 0x3d
add eax, 3
pop esi
mov word [eax], 0x3d
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [ecx + edx + 1]
movsx ecx, byte [ecx + edx]
movzx edx, byte [esi]
and ecx, 3
shl ecx, 4
shr edx, 4
or ecx, edx
movzx ecx, byte [ebp + ecx - 0x44]
mov byte [eax + 1], cl
movsx edx, byte [esi]
and edx, 0xf
movzx ecx, byte [ebp + edx*4 - 0x44]
pop edi
mov byte [eax + 2], cl
add eax, 3
pop esi
mov word [eax], 0x3d
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10003940
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
xor dword [0x399e210], eax
push ebx
push esi
push edi
mov edi, dword [0x399519c]
call edi
mov ebx, dword [0x3995194]
xor dword [0x399e210], eax
push 0x399622c
call ebx
test eax, eax
je 0x10003981
push 0x39998a4
push eax
call dword [0x3995190]
test eax, eax
je 0x10003981
push 0x399e210
call eax
mov ecx, dword [0x399e210]
mov eax, ecx
xor edx, edx
or esi, 0xffffffff
div esi
lea esi, [ecx + eax]
rdtsc
xor ecx, eax
mov dword [0x399e210], ecx
call edi
xor dword [0x399e210], eax
push 0x399622c
call ebx
test eax, eax
je 0x100039c7
push 0x39998a4
push eax
call dword [0x3995190]
test eax, eax
je 0x100039c7
push 0x399e210
call eax
mov ecx, dword [0x399e210]
push esi
mov eax, ecx
xor edx, edx
or esi, 0xffffffff
div esi
add eax, ecx
push eax
push 0x3995968
push 0x104
push 0x39a9c60
call dword [0x39952f4]
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x1000d7a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x399f588
mov dword [ebp - 4], 0x10
call dword [0x39952a4]
push 0x399f588
call dword [0x39952a8]
or ecx, 0xffffffff
mov edx, 0x399f588
test eax, eax
je 0x1000d7ed
movzx esi, byte [edx]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x399f6c8]
inc edx
dec eax
jne 0x1000d7d4
mov edi, dword [0x39954d4]
not ecx
mov esi, ecx
push esi
push 0x399e504
push 0x399f5a0
call edi
lea ebx, [esi + esi]
push ebx
push 0x399e504
push 0x399f54c
call edi
lea ecx, [esi + esi*2]
push ecx
push 0x399e504
push 0x399f5dc
call edi
push esi
push 0x399e580
push 0x399f670
call edi
push ebx
push 0x399e580
push 0x399f630
call edi
add esp, 0x3c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000da30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x101
lea eax, [ebp - 0x104]
push eax
push ecx
call dword [0x39954e4]
mov edx, eax
or eax, 0xffffffff
lea ecx, [ebp - 0x104]
test edx, edx
je 0x1000da7a
push esi
lea esp, [esp]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x399f6c8]
inc ecx
dec edx
jne 0x1000da60
pop esi
not eax
mov esp, ebp
pop ebp
ret

Function at 0x1000daf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x39a9ed4]
sub esp, 0x104
push ebx
mov ebx, dword [0x39953a8]
push esi
push edi
push 1
push 5
push eax
call ebx
push eax
call ebx
mov edi, dword [0x399540c]
mov esi, eax
lea esp, [esp]
push esi
call dword [0x39953e4]
test eax, eax
je 0x1000dbb7
push 0xfffffffffffffff0
push esi
call dword [0x399541c]
test eax, 0x40000000
jne 0x1000db9c
push 0x101
lea ecx, [ebp - 0x104]
push ecx
push esi
call dword [0x39954e4]
or ecx, 0xffffffff
lea edx, [ebp - 0x104]
test eax, eax
je 0x1000db7f
nop
movzx ebx, byte [edx]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x399f6c8]
inc edx
dec eax
jne 0x1000db60
mov ebx, dword [0x39953a8]
not ecx
test ecx, ecx
je 0x1000db96
xor eax, eax
cmp ecx, dword [eax*8 + 0x399e528]
je 0x1000dbcd
inc eax
cmp eax, 0xb
jb 0x1000db87
xor eax, eax
test al, 0x20
je 0x1000dbb7
push 0
push 0x1b
push 0x100
push esi
call edi
push 0xc01b0000
push 0x1b
push 0x101
push esi
call edi
push 3
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x1000db20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [eax*8 + 0x399e52c]
jmp 0x1000db98