joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421000
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x218
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.modules_spyscanlog.log
lea eax, [esp + 0x1c]
push 0x208
push eax
call fcn.00405320
lea ecx, [esp + 0x24]
push ecx
call fcn.00404d60
add esp, 0x10
test al, al
je 0x4210ca
xor edx, edx
lea eax, [esp + 0x18]
mov dword [esp + 0xc], edx
push 0x42ec48
mov dword [esp + 0x14], edx
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], edx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4210ca
push esi
push 0x10
lea ecx, [esp + 0x10]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
mov edi, dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x10
cmp eax, 0x10
jne 0x4210c4
cmp dword [esp + 8], 1
jne 0x4210c4
push 0
push 0
push esi
mov dword [esp + 0x18], 1
call dword [sym.imp.MSVCRT.dll_fseek]
push esi
push 0x10
lea edx, [esp + 0x1c]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call edi
add esp, 0x20
push esi
call edi
add esp, 4
pop edi
pop esi
add esp, 0x218
ret

Function at 0x4210e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x218
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.modules_spyscanlog.log
lea eax, [esp + 0x20]
push 0x208
push eax
call fcn.00405320
xor ecx, ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x1c], ecx
push 0x42e9c8
mov dword [esp + 0x24], ecx
push edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], ecx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x42116d
push esi
push 0x10
lea eax, [esp + 0x14]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 0x10
jne 0x421163
cmp dword [esp + 0xc], 1
je 0x421179
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x218
ret
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x421188
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x24], ecx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [ebx + 0x24]
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x218
ret

Function at 0x421370
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x9ba308
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x9f2c93
jmp 0x9f2cf3
mov eax, 0x5a4d
jmp 0x9f2c77
push ebx
pop word [esp]
lea esp, [esp]
lea esp, [esp + 2]
jmp 0x9f2e4a
jmp 0x9dc17f
test ecx, ecx
jne 0x9f2c6b
je 0x9f2ca9
push esi
jmp 0x9f2f3b
leave
ret 8
xor eax, eax
jmp 0x9f2e0f
jmp 0x9f3449
cmp word [ecx], ax
mov esi, dword [eax + 0x78]
cmc
stc
jmp 0x9f2f58
add esi, ecx
push edi
mov edi, eax
jmp 0x9f2f89
pushal
bswap esi
mov dword [esp + 0x14], ebp
popal
jmp 0x9f32c4
lea edi, [edi + 0x7c]
mov eax, dword [edi]
pop edi
push edx
jmp 0x9f2f5f
test eax, eax
push ax
call fcn.009f2fd0
mov ebx, esi
add ebx, 0x20
mov eax, dword [ebx]
pop ebx
jmp 0x9f303e
cmc
setae al
mov al, byte [esp]
push ebx
jmp 0x9f30e0
lea edx, [edx - 0x18]
mov dword [edx], eax
pop edx
je 0x9f2d51
jne 0x9f31f5
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0x9f2d1f

Function at 0x9c7c14
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, ax
xchg al, dl
mov edx, ebp
rdtsc
cmc
jmp 0x9c7c6b
xchg dword [esp], esi
mov edx, dword [esp]
sub esp, 0x13
cmc
mov edx, dword [esp + 0x10]
lea esp, [esp + 3]
jmp 0x9c7d04
rdtsc
lea edx, reloc.mscoree.dll__CorExeMain
lea esi, [esi + 0x22]
mov eax, 0x87e9f670
add eax, 0x3c16763
bswap edx
seto al
xchg dword [esp + 0x10], esi
jmp 0x9c7cd3
Function at 0x9c9f21
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf09b8eac
jmp 0x9c9f30
lea esp, [esp + 0x34]
jmp 0x9c9f46
mov dword [esp + 7], ecx
mov word [esp + 2], bp
mov dword [esp + 0x34], edi
jmp 0x9c9f0b
mov eax, 0xc89c1184
mov edi, eax
sub esp, 0x16
jae 0x9c9f4c
lea esp, [esp + 2]
jmp 0x9ca023
pushfd
jmp 0x9c7e19
jmp 0x9ca01f
inc bx
jle 0x9c9f9b
jg 0x9c9f9b
or eax, 0x8b781989
imul ebp, dword [ebp + reloc.mscoree.dll__CorExeMain], 0xffffffd9
int 0x4f
fistp qword [edx - 0x629d47b7]
in al, dx
jmp 0x9c9fdf
stc
jne 0x9c9fbe
lea eax, reloc.mscoree.dll__CorExeMain
mov bh, 0xf7
jmp 0x9c9fa8
lea ebp, [esp + 0x14]
sbb ax, sp
jb 0x9c9f7b
inc ah
jmp 0x9c9fe1
mov ebx, esi
mov ecx, esi
setae ah
mov ax, 0x793
jmp 0x9c9fc8
lea eax, reloc.mscoree.dll__CorExeMain
mov bh, 0xf7
jmp 0x9c9fa8
mov edx, 0xefc26cb
neg al
js 0x9ca001
bswap ecx
jmp 0x9ca003
inc ah
sub esp, 0xac
mov edi, esp
jmp 0x9c9f7d
neg esi
lea eax, [esp + ebx]
mov ax, cx
rdtsc
bt edx, esi
jmp 0x9ca031
bswap ecx
jmp 0x9c9feb
inc esi
lea ecx, reloc.mscoree.dll__CorExeMain
xchg edx, eax
mov cx, dx
call 0x9ca08b
inc ebp
rcl dword [ecx + 0x30], 0xc3
and eax, ebx
jp 0x9ca074
lea esp, [esp + 2]
mov esi, dword [esp + 0x40]
setne ah
cpuid
jmp 0x9c9f51
js 0x9ca005
jns 0x9ca005
mov eax, 0x158b29cb
xchg ecx, eax
mov cx, dx
jmp 0x9ca09f
xchg dx, ax
lea ebp, [ebp + 0x1f]
lea ecx, reloc.mscoree.dll__CorExeMain
call fcn.009ca3ee
imul eax, dword [edx - reloc.mscoree.dll__CorExeMain], 0xffffff87
ror dword [edi], 1
pushfd
invalid
push esp
jmp 0x9ca100
mov edx, dword [esp]
pushal
setno al
jmp 0x9ca0e8
mov edx, dword [esp]
pushal
setno al
mov ah, bh
jmp 0x9ca13e
mov ah, bh
sub esp, 0x16
jmp 0x9ca141
lea esp, [esp + 4]
add esi, 0x145bd3e3
inc ax
jbe 0x9ca0d9
ja 0x9ca0c3
sub esp, 5
jmp 0x9ca163
sub esi, 0x3c712a09
lea edx, [esi + ebp]
rol eax, cl
jle 0x9ca110
sub esp, 5
jmp 0x9ca14d
sub esp, 0x16
mov eax, esi
lea esp, [esp + 2]
lea esp, [esp + 0x34]
jmp 0x9ca126
lea esp, [esp + 1]
jmp 0x9ca167
lea esp, [esp + 1]
lea esp, [esp + 4]
sub esi, 0x780f1404
xchg ch, dl
mov ch, byte [esp]
jmp 0x9ca1c3
jno 0x9ca19e
neg al
mov ax, word [esp]
jmp 0x9ca2fd
neg al
mov ax, word [esp]
lea ecx, reloc.mscoree.dll__CorExeMain
jmp 0x9ca2c9
setae ah
push bx
lea esp, [esp + 2]
add esi, dword [ebp]
dec al
jmp 0x9ca188
lea ecx, reloc.mscoree.dll__CorExeMain
jmp 0x9ca2c9

Function at 0x9ca337
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], ax
bts eax, esp
jmp 0x9ca39f
jnp 0x9ca355
mov al, 0xd4
push dword [esp + 3]
jmp 0x9ca35b

Function at 0x9db49d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x20]
jmp fcn.009ba308
Function at 0x9f1e82
Capabilities:
Encrypt data using aes

Disassembly:
rdtsc
jmp 0x9f1ebf
lea edi, [edx + edi]
mov edi, dword [esp + 3]
jmp 0x9f1e04
rcr di, cl
jmp 0x9f1de9
lea esp, [esp + 4]
lea edi, [ecx + 0x10]
stc
xor ebx, eax
jmp 0x9f1e14
clc
clc
mov dword [edi], eax
jmp 0x9f1e78
add bx, sp
neg bx
jmp 0x9f1e5b
mov eax, dword [ebx]
pop ebx
xor eax, ebx
mov dword [ecx + 0x14], ebx
jmp 0x9f1e3b
mov dword [ecx + 0x18], eax
xchg bh, bl
mov bh, byte [esp]
jmp 0x9f1e80
push ebx
mov ebx, ecx
add ebx, 8
jmp 0x9f1e51
xor edx, eax
push esi
mov esi, ecx
jmp 0x9f1e8b
add esi, 0x1c
mov dword [esi], edx
pop esi
bswap ebx
lea edx, [ecx + ebx]
jmp 0x9f1ed5
mov eax, edi
jmp 0x9f1ef9
btc bx, bp
mov ebx, 0x9c53e0
jmp 0x9f18b0
mov ecx, edx
not di
inc edi
dec edi
jmp 0x9f1f0a
mov edx, dword [eax + 0xc]
setge ch
mov edi, dword [esp]
mov edi, dword [esp]
mov cx, bp
jmp 0x9f1ee3
shr ecx, 8
lea edi, [eax + esi]
pushal
pushal
jmp 0x9f2077
mov edi, edx
and edx, esi
call fcn.009f1f2c
lea esp, [esp + 2]
jmp 0x9f1f86
xor ecx, edi
mov edi, edx
lea edi, [edx*4]
jmp 0x9f1fc6
and edi, 0xff000000
xor ecx, edi
sub esp, 0x18
btr edi, ebx
jmp 0x9f1f55
lea esp, [esp + 0x18]
xor ecx, dword [ebx]
xor di, 0x48bc
jmp 0x9f1fcd
and edx, ebp
cmc
xor ecx, edx
jmp 0x9f1fb0
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
jmp 0x9f2016
lea esp, [esp + 0x40]
and ecx, 0xff0000
sub esp, 0x16
lea esp, [esp + 2]
lea esp, [esp + 0x14]
jmp 0x9f1fa0
mov edx, edi
mov dword [edx], ecx
pop edx
mov edx, 0x8159989a
mov dx, 0x759a
jmp 0x9f205e
mov dx, word [esp]
mov dh, byte [esp]
rcl dx, 2
mov edx, dword [esp]
push edx
jmp 0x9f2000
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
jmp 0x9f1fe9
xor edx, ecx
mov cx, sp
jmp 0x9f20d9
mov dh, byte [esp]
mov edx, dword [eax + 4]
jmp 0x9f2048
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + reloc.mscoree.dll__CorExeMain]
jmp 0x9f203a
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
push bp
call fcn.009f20aa
lea ebx, reloc.mscoree.dll__CorExeMain
mov ebx, dword [esp]
mov bl, byte [esp]
jmp 0x9f211d
pop edi
lea ebx, [eax + ebp]
pop esi
call 0x9f2107
lea esp, [esp + 4]
pop ebp
mov bx, word [esp]
bswap ebx
jmp 0x9f21d2
mov ebx, dword [esp]
lea esp, [esp + 4]
ret

Function at 0x9f1f2c
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp]
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x9f1f3d
mov edx, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
jmp 0x9f1f74
shr edi, 0x18
movzx edi, byte [edi*4 + 0x9c3bdc]
pushfd
pop word [esp]
jmp 0x9f1f5e

Function at 0x9f20aa
Capabilities:
Encrypt data using aes

Disassembly:
xor ecx, edx
mov dx, di
mov dword [eax + 0x18], ecx
btc edx, ecx
jmp 0x9f20b0
mov dword [eax + 0x1c], edx
push ebp
clc
jmp 0x9f20b8
lea esp, [esp + 2]
jmp 0x9f2084
mov edx, dword [eax + 0xc]
pushal
xor edx, ecx
jmp 0x9f2091
lea esp, [esp + 0x28]
cmp ebx, 0x9c5404
jne 0x9f18b0
xchg bl, ah
jmp 0x9f20fc
setge al
push 0xa
pop eax
mov edi, dword [esp]
jmp 0x9f20e6
Function at 0xbc9bf4
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bh
mov dx, word [esp + 4]
rol edi, cl
bsr ebp, ebx
mov bh, ah
jmp 0xbc9c3f
jmp 0xbc9bde
mov eax, dword [esp + 4]
neg ebx
add esp, 3
mov bx, word [esp + 1]
mov eax, dword [esp]
lea edi, [eax + ebx]
jmp 0xbc9c27

Function at 0xbca07f
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf ax, di
rdtsc
lea esp, [esp + 0x13]
pop edi
jmp 0xbca081
jmp 0xbca069
mov ebp, 0x9223375a
rdtsc
xchg edx, esi
bswap edx
xchg bl, ah
add esp, 0
jmp 0xbca14b
bsf ax, di
neg dx
bt edx, ecx
bsr esi, ebp
xchg byte [esp + 2], al
shr ecx, cl
call fcn.00bca11c
xchg di, cx
mov si, word [esp + 0x14]
add dx, dx
cpuid
xchg cx, di
bswap edx
jmp 0xbca1c3
mov bp, word [esp + 0xc]
sbb al, 0xd4
lea esi, reloc.mscoree.dll__CorExeMain
xchg byte [esp + 0x16], dh
mov ecx, dword [esp + 0x15]
shr di, cl
jmp 0xbca1de
bts cx, si
sbb dx, 0xfbfd
xchg dx, cx
xchg word [esp + 0x16], dx
sbb di, 0x8b88
mov cx, di
jmp 0xbca1a0
lea eax, [edi*4]
bswap esi
call 0xbca1ed
cwde
xchg word [esp + 0x16], bp
mov ax, word [esp + 0x11]
xchg dword [esp + 0xf], ebp
cld
jmp 0xbca234
mov dword [esp + 0x13], edi
add ebx, ebp
lea eax, [ecx*4]
setae ch
jmp 0xbca264
rdtsc
pop word [esp + 3]
mov word [esp + 8], ax
mov di, 0x15a6
mov dword [esp + 0x16], edx
shr cx, cl
jmp 0xbca21e
lea ebp, [esp - 0xcc]
mov bp, 0x1665
mov cx, word [esp + 0x15]
jmp 0xbca290
inc dx
mov word [esp + 0x16], dx
setne ah
xchg dh, ah
lea ebp, [esp + edx]
mov esi, 0x9c7a8213
jmp 0xbca24d
mov ecx, eax
push word [esp + 0xc]
call fcn.00bca27a
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi + 0x46], bh
int1

Function at 0xbca11e
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov dx, 0x434f
xchg dword [esp], esi
add esp, 3
jmp 0xbca203
std
push word [esp + 0x15]
lea edi, reloc.mscoree.dll__CorExeMain
inc ax
rdtsc
not bp
jmp 0xbca163
add esp, 2
xchg word [esp + 0xf], bx
push word [esp + 0xc]
not cl
neg ax
mov ch, byte [esp + 3]
jmp 0xbca18b
Function at 0xbca4a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 0x12]
push dword [esp + 0x1a]
mov di, 0xe7da
clc
jmp 0xbca43c
setbe dl
setg bl
rdtsc
bts bp, cx
xchg byte [esp + 0xd], ah
lea eax, [eax + ecx]
jmp 0xbca3e0
mov ebx, dword [esp + 3]
mov eax, 0x57830e5
mov word [esp], si
sub esp, 0x1f
jmp 0xbca464
mov dword [esp + 3], edx
add esp, 6
sbb dx, 0x1c78
not bh
add esp, 3
mov bl, dh
jmp 0xbca40b
add esp, 0
sub esp, 0xe
bts ebx, edi
mov dword [esp + 4], edi
inc dl
popal
jmp 0xbca421
push dword [esp + 0x1a]
rdtsc
bswap edx
push dword [esp + 0x10]
add esp, 0x17
jmp 0xbca477
pop ebp
pop si
mov word [esp + 0x1a], bp
mov dh, 0x12
xchg byte [esp + 0xa], ch
neg bx
jmp 0xbca44e
xchg bp, ax
rdtsc
lea edi, [ebx + esi]
rcl bx, cl
bsf bx, di
lea ecx, reloc.mscoree.dll__CorExeMain
jmp 0xbca540
mov si, word [esp + 0x10]
xchg edi, ecx
ror eax, 0x1b
lea edi, [ebx*4]
jmp 0xbca3f6
mov cx, 0xb99f
add esp, 7
pop word [esp]
mov bp, dx
bsr ax, si
mov esi, edi
jmp 0xbca502
push dword [esp + 2]
inc edi
cmc
mov si, word [esp + 6]
lea ebp, [esp + ecx]
lea ecx, [ebx*4]
jmp 0xbca4b6
rol al, 7
push esi
xchg dword [esp + 3], edi
xchg edi, eax
mov ax, 0xd546
clc
jmp 0xbca519
mov ax, word [esp + 1]
mov bh, dh
bswap ebx
lea edi, [ebp*4]
sete bl
rdtsc
jmp 0xbca4ec
mov dl, 0xb0
inc ebp
mov dword [esp + 1], ebx
setne cl
sub esp, 0x19
pop bx
call fcn.00bca568
push ebx
dec eax
inc ebp
dec esp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax - 0x1a], ah
je 0xbca550
out dx, al
or al, 0x97
xchg cl, dh
mov ch, byte [esp + 2]
not bl
pop bp
cpuid
pop dword [esp + 4]
jmp 0xbca4d5
Function at 0xbca674
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, 0x7b
bsf esi, esi
bswap edi
xchg dh, bl
mov eax, dword [esp + 6]
rdtsc
jmp 0xbca690
mov edi, ebp
rdtsc
jmp 0xbca65e
xchg bh, ah
lea ecx, [edx*4]
rcl bx, 0
cld
jmp 0xbca6da
rdtsc
mov bh, bl
ror bp, cl
bswap ecx
mov ax, 0xe901
mov byte [esp + 1], cl
jmp 0xbca67a
mov si, sp
mov al, byte [esp + 4]
push dword [esp + 4]
sub esp, 5
jmp 0xbca70d
push dword [esp + 7]
pop dword [esp + 3]
mov word [esp + 6], di
mov dx, si
mov bh, byte [esp + 0xc]
pop eax
jmp 0xbca6c4
mov si, ax
mov al, ch
clc
mov bx, word [esp + 2]
bsf dx, cx
xchg word [esp], cx
jmp 0xbca739
pop dword [esp + 2]
add esp, 3
pop ebx
mov cx, word [esp + 6]
xchg word [esp + 3], cx
bswap edx
jmp 0xbca6f1
pop ebx
rcr dx, 9
setnp cl
neg ah
xchg word [esp], bp
jmp 0xbca783
mov dword [esp], esp
bts eax, ebp
mov byte [esp + 1], cl
mov dword [esp], ebp
mov dh, byte [esp + 5]
mov ah, dh
jmp 0xbca723
cpuid
btc eax, edx
mov word [esp], di
not bp
not ah
jmp 0xbca7ae
mov ebx, dword [esp]
cpuid
shl ax, 7
setg bh
lea esp, [esp + 1]
cmp si, dx
jmp 0xbca76d
mov al, bl
mov edi, esp
mov edx, ecx
shr ecx, 6
bsf eax, esp
neg bp
jmp 0xbca7c0
mov word [esp], di
rdtsc
cld
mov word [esp], ax
lea edi, [eax + ebp]
bswap edx
jmp 0xbca798
neg cl
add esp, 0
std
setns ch
neg ecx
not cl
jmp 0xbca993
push word [esp + 1]
call 0xbca80e
bt esi, eax
mov word [esp + 6], bx
bswap esi
push dword [esp]
rdtsc
bsr edx, ebp
jmp 0xbca9ca
lea esp, [esp + 0xc]
mov dx, 0xe321
bsf edi, edx
mov dx, 0xbcff
pop dword [esp + 5]
mov bh, 0x30
jmp 0xbcaa22
popal
pushal
lea esp, [esp + 0x1d]
call fcn.00bcaa3a
popal
jmp 0xbcaa95
xchg dx, ax
lea ecx, [edi*4]
cld
mov byte [esp + 0xe], cl
lea esp, [esp + 3]
lea esp, [esp + 0x18]
jmp 0xbcaa0c
and al, 0x20
mov word [esp], di
jmp 0xbcaad7
lea esp, [esp + 3]
mov dword [esp + 7], ebp
push word [esp + 0xb]
pushfd
jmp 0xbcaaec
mov byte [esp], al
mov byte [esp], dh
pushal
pop dword [esp + 7]
lea esp, [esp + 0xa]
pop dword [esp + 3]
jmp 0xbcaac1
mov byte [esp + 0x10], ch
pop word [esp + 0xa]
lea esp, [esp + 0xc]
mov dword [esp], edx
pop word [esp]
push word [esp + 2]
call fcn.00bcab21
imul esp, dword [ecx], 0x7e
cmp bl, byte [edx]
push 0xffffffffffffff95
push ss
test bl, ah
push ds
cld
pop es

Function at 0xbcc4bb
Capabilities:
Parse pe header

Disassembly:
popfd
jmp 0xbcc4c9
lea esp, [esp + 2]
mov esi, dword [esp + 0x5c]
lea esp, [esp + 0x60]
jmp 0xbcc4a5
lea esp, [esp + 4]
push edx
push esi
pop word [esp + 1]
jmp 0xbcc503
lea esp, [esp + 2]
mov dword [esp], eax
call fcn.00bcc4ed

Function at 0xbcc4e3
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1e
pop si
call fcn.00bcc4bb

Function at 0xbcc4ed
Capabilities:
Parse pe header

Disassembly:
mov word [esp], di
mov dword [esp], edx
mov dword [esp], ecx
push edx
jmp 0xbcc50f
pushfd
mov word [esp + 1], ax
pop word [esp]
lea esp, [esp + 1]
pushfd
lea esp, [esp + 1]
jmp 0xbcc556
mov dword [esp], ebx
call fcn.00bcc53c
Function at 0xbcc53c
Capabilities:
Parse pe header

Disassembly:
pop word [esp]
mov byte [esp], cl
pushal
lea esp, [esp + 2]
mov dword [esp + 0x1c], esp
jmp 0xbcc574
push esi
mov dword [esp], esp
mov dword [esp + 0x1c], ebp
call fcn.00bcc55e
in eax, 0xb7
call 0xfe974628
mov al, 0xe1
stosd dword es:[edi], eax
mov ecx, ecx
loope 0xbcc5af
arpl word [edx - 0x3861f00b], bx

Function at 0xbcc55e
Capabilities:
Parse pe header

Disassembly:
call fcn.00bcc0aa
push dword [esp]
pop dword [esp]
pop word [esp]
jmp 0xbcc5a5
lea esp, [esp + 2]
mov dword [esp + 0x18], esi
push si
pushfd
pop word [esp + 1]
push dword [esp + 1]
jmp 0xbcc7ff
push eax
jmp 0xbcc0a5
mov edi, eax
mov eax, dword [edi]
pop edi
mov eax, dword [eax + 8]
jmp 0xbcc5f7
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push edi
jmp 0xbcc629
pushfd
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
mov eax, dword fs:[0x30]
jmp 0xbcc6bc
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
sub eax, reloc.comctl32.dll_MenuHelp
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x1903870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ebx, eax
jnp 0x297a5f3
rcr di, 3
pushal
setnp ch
mov edi, eax
jmp 0x29783f2
lea esp, [esp + 0x2c]
jae 0x296a38e
shl di, 0xa
xadd bx, cx
jmp 0x16004d6
btc cx, sp
mov ecx, 0x104
cmc
push 0x544b94c3
pushfd
clc
xor al, al
pushfd
bt di, si
bt bp, bp
repne scasb al, byte es:[edi]
call fcn.01903ffe
xchg esi, eax
cmp edi, dword [ecx - 4]
jns 0x297a540
xchg esi, eax
fbstp tbyte [ebp - 0x2a99543b]
lea ebp, [edx]
movsb byte es:[edi], byte [esi]
xor esp, dword [ebp + 0x357c8a33]
lea ecx, [ecx + 0x4dddb96a]
invalid
mov ah, 0x23
inc edx
xchg ebp, eax
fnstsw word [ebx + 0x4b00fd3f]
invalid
enter 0x6bb8, 0xffffffffffffff92
test byte [esi + 0x21], 0xcd
pushal
daa
mov byte cs:[0x35eb816], al
rol dword [ebx + 0x4af3d47c], 1
test al, 0x22
shl byte [edx - 0x25], cl
push cs
jne 0x297a561
js 0x297a542
and byte cs:[0x14606c9b], dh
sar bl, 1
retf
xlatb
in al, dx
lea ebx, [edi]
ja 0x297a644
mov eax, esi
test dword [eax], ecx
in al, dx
adc dword [eax + 0x49], ebp
test eax, 0x1cd888eb
les ebp, [ebx + 0x78]
jmp 0x93dc571b
js 0x297a5d1
das
mov cl, 0x44
xchg ecx, eax
sahf
inc esp
je 0x297a575
xchg ebp, eax
sti
btc cx, bp
cmc
mov edi, eax
call fcn.0297edc2
clc
sal dword [ecx - 0xb48b0ba], cl
jbe 0x297a67c
ficom dword [edi]
daa
push ecx
js 0x297a5e6
in al, 0x95
or dh, byte [ecx + 0x78cb5606]
call 0xd313d4a6
inc eax
fiadd word [esi + 0x38580cab]
test al, 0x86
xchg edi, eax
int 0x64
pop ss
imul edx, ecx, 0x3e
sub dword [ebp - 0x27], ecx
pop ebp
invalid
push ebx
ljmp 0xbc03
sbb ebx, dword [ecx + 0x3b]
mov eax, 0x3cbd4d2c
rol dword [esi], 1
insb byte es:[edi], dx
sbb dword [ecx + 0x6c786316], esi
cmp byte [edx + 0x520718e4], dl

Function at 0x296a034
Capabilities:
Encode data using xor

Disassembly:
jmp 0x2974f56
mov edi, dword [esp + 4]
jmp 0x190376c
mov bx, word [esp + 4]
mov esi, dword [esp + 8]
pop ebx
mov byte [esp], cl
push 0xaf6ae382
mov ebx, dword [esp + 0xc]
pushal
pushfd
mov byte [esp + 8], ch
mov esp, ebp
movzx bp, al
push ebx
call fcn.0297b41f
add byte [eax], al
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
inc esi
jb 0x2974fed
add byte gs:[eax + 0x42], bh
lodsd eax, dword [esi]
dec edx
movsd dword es:[edi], dword [esi]
mov bh, 0xf4
inc edx
or byte [edi + 0x6f6f8a19], bh
push ebx
out 0x84, al
fisub dword [ebp + edx*2 + 0x19]
push es
push ebp
sbb dword [esi], eax
xor dword [ebp - 0x477c279c], ecx
stosb byte es:[edi], al
adc ebp, edx
jecxz 0x2974f9d
jae 0x2974fc9
pop edi
or al, 0xda
and dl, byte [eax - 0xa]
mov bl, 0x2c
mov eax, 0xf6ee50bd
and al, 0x13
dec ebx
scasd eax, dword es:[edi]
mov edi, 0xed190835
cmpsb byte [esi], byte es:[edi]
jmp 0x2974fed
jnp 0x2974fca
invalid
mov esi, 0x185ce1ea
and eax, 0x39bd0d8e
sbb byte [0x39bd0d8e], ah
jg 0x2974fcf
mov esp, gs
and eax, 0x63b74252
xchg edx, eax
ja 0x2974fde
and eax, 0x9d09eb54
fldcw word [ebx + 0x6a4934c4]
pop eax
lahf
dec eax
inc esi
test dh, ch
mov dword [ebx - 0x271b1f68], eax
test eax, 0xf4b7a50e
adc al, 0x6e
iretd
Function at 0x407ce0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CRC32.0
mov dword [ebp - 4], 0x4c11db7
mov dword [ebp - 8], 0
jmp 0x407d0b
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xff
jg 0x407da0
push 8
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00407dd0
shl eax, 0x18
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [edx + ecx*4 + 4], eax
mov dword [ebp - 0xc], 0
jmp 0x407d45
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jge 0x407d7c
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx*4 + 4]
shl eax, 1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + ecx*4 + 4]
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 4]
xor eax, ecx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + edx*4 + 4], eax
jmp 0x407d3c
push 0x20
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4 + 4]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00407dd0
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + edx*4 + 4], eax
jmp 0x407d02
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x408760
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x40
mov eax, dword [ebp + 0xc]
push eax
push 0x663520
call fcn.00408b60
add esp, 0xc
push 0x40
push 0x574ab0
push 0x663520
push 0x663520
call fcn.00408a70
add esp, 0x10
movzx ecx, byte [ebp + 0x14]
test ecx, ecx
jne 0x408811
mov dword [ebp - 4], 0
jmp 0x4087ac
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x10
jge 0x40880f
push 0x20
mov eax, dword [0x5ad090]
push eax
push 0x663500
call fcn.00545160
add esp, 0xc
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x30
add ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x5ad090]
push edx
call fcn.00408970
add esp, 8
push 0x20
mov eax, dword [0x5ad08c]
push eax
mov ecx, dword [0x5ad090]
push ecx
call fcn.00408ad0
add esp, 0xc
push 0x20
push 0x663500
mov edx, dword [0x5ad08c]
push edx
call fcn.00545160
add esp, 0xc
jmp 0x4087a3
jmp 0x408886
mov dword [ebp - 8], 0xf
jmp 0x408823
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x408886
push 0x20
mov ecx, dword [0x5ad08c]
push ecx
push 0x663500
call fcn.00545160
add esp, 0xc
mov edx, dword [ebp - 8]
imul edx, edx, 0x30
add edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x5ad08c]
push eax
call fcn.00408970
add esp, 8
push 0x20
mov ecx, dword [0x5ad090]
push ecx
mov edx, dword [0x5ad08c]
push edx
call fcn.00408ad0
add esp, 0xc
push 0x20
push 0x663500
mov eax, dword [0x5ad090]
push eax
call fcn.00545160
add esp, 0xc
jmp 0x40881a
push 0x40
push 0x574af0
push 0x663520
push 0x663520
call fcn.00408a70
add esp, 0x10
push 0x40
push 0x663520
mov ecx, dword [ebp + 8]
push ecx
call fcn.00408bb0
add esp, 0xc
mov esp, ebp
pop ebp
ret