joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401760
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xcc
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [0x404078]
test eax, eax
jne 0x4017b9
mov edi, dword fs:[0x18]
mov ebx, dword [edi + 0x34]
push 0x40216c
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push str.__wine_dbg_get_channel_flags
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
cmovne ecx, eax
mov eax, 0x404078
lock xchg dword [eax], ecx
mov dword [edi + 0x34], ebx
mov edi, dword [ebp + 8]
mov eax, dword [0x404078]
push esi
call eax
add esp, 4
movzx eax, al
bt eax, edi
jae 0x40196f
mov ecx, dword [0x404104]
mov ebx, dword fs:[0x18]
xor eax, eax
cmp ecx, dword [ebx + 0x24]
je 0x401974
lea edi, [ebp - 0xd8]
test byte [0x404005], 8
je 0x401880
mov eax, dword [0x404078]
test eax, eax
jne 0x401839
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x10], eax
push 0x40216c
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push str.__wine_dbg_get_channel_flags
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
cmovne ecx, eax
mov eax, 0x404078
lock xchg dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x34], eax
mov eax, dword [0x404078]
push 0x404005
call eax
add esp, 4
test al, 8
je 0x401880
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, eax
mov edx, 0x10624dd3
mul edx
shr edx, 6
imul eax, edx, 0x3e8
sub ecx, eax
lea eax, [ebp - 0xd8]
push ecx
push edx
push str._3u._03u:
push eax
call dbg.sprintf
add esp, 0x10
lea edi, [eax + ebp]
add edi, 0xffffff28
test byte [0x404015], 8
je 0x4018ed
mov eax, dword [0x404078]
test eax, eax
jne 0x4018cc
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x10], eax
push 0x40216c
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push str.__wine_dbg_get_channel_flags
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
cmovne ecx, eax
mov eax, 0x404078
lock xchg dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x34], eax
mov eax, dword [0x404078]
push 0x404015
call eax
add esp, 4
test al, 8
je 0x4018ed
push dword [ebx + 0x20]
push str._04x:
push edi
call dbg.sprintf
add esp, 0xc
add edi, eax
push dword [ebx + 0x24]
push str._04x:
push edi
call dbg.sprintf
add esp, 0xc
mov edx, dword [ebp + 8]
cmp edx, 3
ja 0x401942
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x401942
add edi, eax
lea eax, [ebp - 0xd8]
sub eax, edi
add eax, 0xc8
mov edx, dword [edx*4 + 0x402190]
inc esi
sub esp, 0x18
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp], edi
mov dword [esp + 4], eax
call dbg.snprintf
add esp, 0x18
lea edi, [ebp - 0xd8]
push edi
call dword [sym.imp.ucrtbase.dll_strlen]
add esp, 4
mov esi, eax
push 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
add esp, 4
push eax
push esi
push 1
push edi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
jmp 0x401974
mov eax, 0xffffffff
add esp, 0xcc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4019e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push 1
call sym.__configure_wide_argv
add esp, 4
call sym.__initialize_wide_environment
call sym.___p___argc
mov edi, dword [eax]
call sym.___p___wargv
mov ebx, dword [eax]
call sym.__get_initial_wide_environment
mov esi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
xor edx, edx
cmp word [eax + ecx + 0x5c], 2
sete dl
inc edx
push edx
call sym.__set_app_type
add esp, 4
push esi
push ebx
push edi
call dbg.wmain
add esp, 0xc
push eax
call sym._exit
int3

Function at 0x401a70
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x44
xor ebx, ebx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov esi, eax
xor eax, eax
jmp 0x401a9b
xor edx, edx
test eax, eax
je 0x401ae7
add esi, 2
mov ebx, edx
movzx ecx, word [esi]
cmp ecx, 9
je 0x401a90
test ecx, ecx
je 0x401ae7
cmp cx, 0x20
jne 0x401ab1
test eax, eax
je 0x401ae7
xor edx, edx
cmp ecx, 0x22
je 0x401ac2
cmp ecx, 0x5c
jne 0x401a96
inc ebx
mov edx, ebx
jmp 0x401a96
xor ecx, ecx
test eax, eax
sete cl
test bl, 1
cmove eax, ecx
jmp 0x401a96
movzx ecx, word [esi + 2]
add esi, 2
cmp cx, 0x20
je 0x401ae0
movzx eax, cx
cmp eax, 9
je 0x401ae0
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
test byte [ebp - 0x20], 1
jne 0x401b0b
mov word [ebp - 0x1c], 1
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
movzx ecx, word [ebp - 0x1c]
push ecx
push esi
push 0
push eax
call dbg._wWinMain@16
add esp, 0x44
pop esi
pop ebx
pop ebp
ret
Function at 0x405ebb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 2
jne 0x405f07
mov eax, dword [esi + 4]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp + 8]
push eax
push 0x20
push dword [ebp + 0xc]
call fcn.00405999
xor edx, edx
mov dword [esi + 4], edx
xor eax, eax
push ebx
movzx ebx, byte [ebp + eax - 0x20]
mov ecx, eax
and ecx, 3
shl ecx, 3
shl ebx, cl
xor edx, ebx
inc eax
cmp eax, 0x20
jb 0x405eec
mov dword [esi + 4], edx
pop ebx
cmp dword [esi], 3
jne 0x405f2f
lea eax, [ebp - 0x20]
push eax
push 0x20
add esi, 4
push esi
push 0x20
push dword [ebp + 0xc]
call fcn.00405999
push 0x20
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0041c000
add esp, 0xc
pop esi
leave
ret 8

Function at 0x40ac5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
and dword [edi + 4], 0
and dword [edi], 0
mov eax, 0x8000
cmp dword [ebp + 0xc], eax
jae 0x40ac78
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
push esi
push dword [edi + 0xc]
call fcn.0041c000
xor eax, eax
inc eax
add esp, 0xc
xor bl, bl
cmp dword [ebp + 0xc], eax
jbe 0x40ac9b
xor bl, byte [eax + esi]
inc eax
cmp eax, dword [ebp + 0xc]
jb 0x40ac92
push 8
mov ecx, edi
call fcn.004096da
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
and dword [esi + 0x14], 0
cmp bl, byte [eax]
jne 0x40acf9
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0040aaf8
mov edi, eax
test edi, edi
je 0x40acf9
push 1
mov ecx, esi
call fcn.0040abe2
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
imul eax, eax, 0x28
add eax, dword [esi]
mov dword [esi + 0x14], ecx
lea ecx, [eax + 0xc]
mov dword [ecx], edi
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x1c]
push 3
mov dword [eax + 0x24], ecx
pop ecx
mov dword [eax], 0x28
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
jmp 0x40ad59
push 1
mov ecx, esi
call fcn.0040abe2
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
imul eax, eax, 0x28
add eax, dword [esi]
mov dword [esi + 0x14], ecx
lea ecx, [eax + 0xc]
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x1c]
mov dword [eax + 0x24], ecx
push 3
pop ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
xor edx, edx
mov dword [eax], 0x16
xor ecx, ecx
cmp dword [esi + 0x14], edx
jle 0x40ad59
xor edi, edi
mov eax, dword [esi]
add eax, edi
cmp dword [eax + 0x14], edx
jne 0x40ad45
lea ebx, [eax + 0xc]
mov dword [eax + 0x14], ebx
cmp dword [eax + 0x24], edx
jne 0x40ad50
lea ebx, [eax + 0x1c]
mov dword [eax + 0x24], ebx
inc ecx
add edi, 0x28
cmp ecx, dword [esi + 0x14]
jl 0x40ad36
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40cda7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
cmp dword [0x437808], ebx
jne 0x40cdc0
mov ecx, 0x437800
call fcn.0040cd68
mov esi, dword [ebp + 0xc]
mov ecx, esi
and ecx, 0xf
mov eax, esi
xor edx, edx
sub eax, ecx
cmp byte [ebp + 0x14], bl
setne dl
cmp byte [ebp + 0x10], bl
je 0x40ce12
mov ecx, dword [0x437808]
cmp ecx, ebx
je 0x40ce2e
push edx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x40ce4f
push str.CryptProtectMemory_failed
mov esi, 0x4325ac
push esi
call fcn.004063ad
pop ecx
pop ecx
mov ecx, esi
call fcn.00401000
push 2
mov ecx, esi
call fcn.00406353
jmp 0x40ce4f
mov ecx, dword [0x43780c]
cmp ecx, ebx
je 0x40ce2e
push edx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x40ce4f
push str.CryptUnprotectMemory_failed
jmp 0x40cdf3
call dword [0x42a098]
xor ecx, ecx
cmp esi, ebx
jbe 0x40ce4f
mov dl, al
add dl, 0x4b
mov eax, dword [ebp + 8]
add eax, ecx
mov bl, dl
add bl, cl
xor byte [eax], bl
inc ecx
cmp ecx, esi
jb 0x40ce3f
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4173ff
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x42965d
call fcn.0041a250
push ecx
push ebx
push esi
mov esi, ecx
push 1
lea ecx, [esi + 4]
mov dword [ebp - 0x10], esi
call fcn.00409640
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
lea ecx, [esi + 0x4b38]
call fcn.00412274
lea ecx, [esi + 0x98d0]
call fcn.00412c8d
lea ecx, [esi + 0xe65c]
mov byte [ebp - 4], 5
call fcn.0040a9da
push 1
lea ecx, [esi + 0xe694]
mov byte [ebp - 4], 6
call fcn.00409640
lea eax, [esi + 0xe6a4]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0xe6b4]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0xe6c4]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0xa
mov dword [esi], eax
mov dword [esi + 0x4b34], ebx
mov byte [esi + 0x4c38], bl
mov byte [esi + 0x4c48], bl
mov byte [esi + 0x4c49], bl
mov byte [esi + 0x4c4a], bl
mov dword [esi + 0x1c], 1
call fcn.00410e3e
push ebx
mov ecx, esi
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0xe6d8], ebx
mov dword [esi + 0xe6dc], ebx
call fcn.0041555c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x45a2a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x4c], 0x4c667e
call fcn.004ae1e7

Function at 0x45a2ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp + 4], esp
mov dword [esp + 0x24], edi
pushal
jmp 0x4a8d6b
push 0x8ca6729d
mov dword [esp + 0x44], 0
mov byte [esp + 8], ch
mov dword [esp + 0x40], 0
push dword [esp + 8]
pushfd
mov dword [ebp + 0xc], eax
call fcn.004cada2
mov dword [ebp - 4], edi
pushfd
push dword [esp + 4]
lea esp, [esp + 0x14]
call fcn.00458390
cmp ah, bh
btr bx, 0xd
mov ebx, dword [ebp - 4]
pushal
jmp 0x507394
test eax, eax
pushal
push eax
call fcn.004a9eb7

Function at 0x4aa134
Capabilities:
Encode data using xor

Disassembly:
push 0x9ecb6b38
test esi, esi
call fcn.004d1ca8

Function at 0x4c1b07
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x4a2b7e7b
push ebp
pushal
jmp 0x4d5644
mov dword [esp + 0x24], 0x7737394d
mov byte [esp], bl
mov dword [esp], 0x5b397322
pushfd
mov dword [esp + 0x24], 0x90ed9f94
pushal
mov byte [esp + 4], 0x52
push ecx
lea esp, [esp + 0x48]
jmp fcn.00454058
Function at 0x4c2b3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x25042c19
push 0xd8e07a2b
jmp 0x4b08aa
mov dword [esp], eax
pushfd
pushal
pushal
mov word [esp + 4], ax
push dword [esp + 0x44]
ret 0x48
lea esp, [esp + 0x50]
jb 0x4b4cd8
cwde
rdtsc
cwde
movzx dx, al
dec dword [esi + 0x28]
not ebx
rdtsc
mov byte [ebp - 1], 1
rdtsc
bswap bx
mov ch, ah
pop ebx
jmp 0x4ef547
call fcn.004eb2b3
jmp 0x4c94e7
pushfd
inc edx
pushal
dec eax
bt ecx, 0x19
test esp, 0xc1f0390d
pushfd
stc
add ecx, 0xc
cmp dh, 0xaf
stc
stc
jmp 0x4e35ca
cmp edx, eax
jmp 0x4579a7
rdtsc
mov edx, dword [esi]
push 0x3496472
lea ecx, [ebp + 0x7b86e7b7]
cwde
mov eax, dword [edx + 8]
movsx cx, al
mov ecx, esi
mov word [esp], 0x76d2
mov dword [esp], 0x4a847c
pushfd
jmp 0x4a5128

Function at 0x4cef87
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
je 0x4ee7ae
rdtsc
lahf
pushfd
bswap ax
movzx edx, word [esi]
call fcn.004b1a2c

Function at 0x4e2911
Capabilities:
Execute anti-debugging instructions

Disassembly:
jle 0x4ee7ba
call fcn.004a11bf
jmp 0x459553
pushfd
pushfd
mov edi, eax
mov byte [esp + 4], 0x6c
mov word [esp + 4], 0x89c2
jmp 0x4e7f9f
movsx edi, bl
mov dword [esp], esi
jmp 0x4ae65a
stc
xor ebx, ebx
cmp ah, dl
stc
add edx, eax
stc
cmp al, dl
mov dword [ebp - 8], esi
cmp edi, edx
bt esi, ebx
mov dword [ebp - 4], ebx
stc
call fcn.004e7264
outsd dx, dword [esi]
jge 0x4b2bae
cmp esi, dword [edi]
out 0x16, eax
inc ebx
shr byte [eax + 0x52547587], cl
xor dword [ebx], ebp
lodsb al, byte [esi]
sbb eax, edi
cli
fnstenv [edi - 0x48d3c854]
mov esp, 0xdabf223c
invalid
mov byte [esp + 8], 0x50
pushal
lea esp, [esp + 0x2c]
jne 0x4ee7cc
rdtsc
sub dl, ah
movsx ax, dl
push ebx
aad 0x3a
daa
push esi
bsf si, bx
mov esi, dword [ecx + 0x2c]
movsx ax, al
bsf dx, ax
cmp bl, 0x91
movzx edx, word [esi]
adc ah, 0xc0
ror ah, 2
movzx eax, word [esi + 2]
clc
clc
jo 0x4b2c0f
pushfd
xor ebx, ebx
cmc
clc
add edx, eax
bt si, si
cmc
mov dword [ebp - 8], esi
bt di, 8
mov byte [esp], 0xfb
cmp ah, 0xc4
cmp edx, esi
mov dword [ebp - 4], ebx
pushal
test bp, bp
mov byte [esp + 4], ch
push dword [esp + 8]
test edx, edx
mov byte [esp + 8], 0xf
lea esp, [esp + 0x28]
js 0x4a21a2
jle 0x4ee7ba
push esp
pushfd
pushfd
pushfd
mov dword [esp + 0xc], edi
push edx
push 0x627c307e
mov word [esp], dx
push 0x64618b6b
lea esp, [esp + 0x18]
jmp 0x4d501a
Function at 0x4eac6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebp
pushfd
mov byte [esp], 0xd8
pushal
push dword [esp + 0x24]
ret 0x38
pushfd
movsx bx, dl
mov edi, dword [esp + 4]
push esi
pop ebx
pushal
mov ebx, dword [esp + 0x28]
push dword [esp]
mov esp, ebp
pushal
call fcn.0045bda1
jmp 0x4c54f1
jle 0x4be92a
lahf
lea esp, [esp]
cdq
movzx edx, word [edi + ebx*8 + 4]
cwde
mov ecx, dword [ebp + 0x18]
call fcn.004fb1b6
neg dword [eax - 0xb]
pop ecx
sub al, 0xe0
push ss
hlt
pushfd
mov esp, ebp
not bp
jmp 0x4a50b6
pushal
lea esp, [esp + 0x44]
jle 0x4be92a
mov ch, cl
mov edx, ebp
movsx dx, al
lea esp, [esp]
rdtsc
pushal
movzx edx, word [edi + ebx*8 + 4]
lahf
mov ecx, dword [ebp + 0x18]
call fcn.004f4079
jmp 0x4c3783
lea esp, [esp + 0x54]
jl 0x4d5215
rdtsc
movzx edx, word [edi]
or al, 0x5f
neg ax
das
add ax, 0x690
movzx eax, word [edi + 2]
clc
add edx, eax
jl 0x4fa39a
bt cx, si
sub ebx, ebx
clc
pushfd
test edx, edx
pushal
jmp 0x4c699d
cmp bh, ch
pushfd
pushfd
cmp esp, ebx
sub ebx, ebx
stc
test edx, edx
mov word [esp + 4], 0x99e0
lea esp, [esp + 8]
jns 0x4e953d
jle 0x4be92a
cwde
mov cl, ah
movzx cx, al
lea esp, [esp]
push esp
movzx edx, word [edi + ebx*8 + 4]
bswap cx
mov ecx, dword [ebp + 0x18]
lahf
lea eax, [edi*4 + 0x1d107648]
mov eax, dword [ebp + 0x10]
call fcn.004d0c47
jmp 0x4a960e

Function at 0x4ecab1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x3c]
jne 0x4c6573
push edx
movzx ax, cl
rdtsc
xchg cx, dx
movzx edx, word [edi + 8]
push 0x7767586c
cwde
mov eax, dword [edi + 4]
push esi
movsx cx, dl
pushfd
mov ecx, dword [edi]
call fcn.004b8928
mov cl, 0x93
retf 0xbecf
pushfd
mov dword [esp + 0x3c], edi
bswap di
bswap di
lea edi, [edi - 0x7aa81055]
bswap di
mov edi, dword [ebp + 0xc]
jmp 0x4da5bb

Function at 0x4ed722
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x18], eax
mov dword [esp + 4], edi
mov dword [esp + 0x14], 0x45bcbd
jmp 0x4a50e0
call fcn.004d4043
pushfd
pushfd
lea esp, [esp + 8]
jl 0x4bd8eb
movsx si, al
pushfd
mov edi, dword [esp + 4]
cwde
mov esi, dword [esp + 8]
lahf
rdtsc
movzx eax, bl
rdtsc
mov ebx, dword [esp + 0xc]
bswap cx
xchg ch, dh
push dword [esp + 4]
mov ecx, dword [ebp + 0x14]
setge ah
push 0xbffbd948
mov edx, dword [ebp + 0x10]
cwde
movzx ax, dl
cwde
mov eax, dword [ebp + 0xc]
mov word [esp + 4], 0x8895
jmp 0x4a98ca
push 0x72f9b2ff
jmp 0x4d4a7d
movsx bx, dl
rdtsc
pop esi
cwde
pop ebx
mov cl, 0xd9
bswap cx
lahf
bswap ax
mov ecx, dword [ebp + 0x14]
cdq
mov edx, dword [ebp + 0x10]
jmp 0x4f1ffe
jmp 0x4a7d5e
mov dword [esp + 0x18], ecx
jmp 0x4f67ed
push dword [esp]
bt bx, 1
pushal
cmp ebx, edx
push dword [esp]
push 0x80daf8d6
mov dword [ebp - 4], ebx
lea esp, [esp + 0x38]
jbe 0x4c2815
pushal
pushfd
mov byte [esp + 4], 0xca
lea esp, [esp + 0x24]
jl 0x4bd8eb
cwde
pop edi
jmp 0x4f4517
setnp al
movzx ax, dl
mov eax, dword [ebp + 0xc]
jmp 0x5088bc
jmp 0x4b2ec1
mov byte [esp + 4], 0x2d
push 0x53a12edf
mov dword [esp + 0x18], edx
pushfd
jmp 0x4599f7
Function at 0x4ef50f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ah
pushal
lea esp, [esp + 0x2c]
jl 0x4d5215
rcl ax, 8
rdtsc
adc ax, si
pushfd
jmp 0x4d8466
bt cx, 0xf
cmp eax, 2
lea esp, [esp + 0x14]
js 0x4b0116
pushfd
mov word [esp], 0x6bc3
pushfd
mov dword [ebp - 4], eax
pushfd
jmp 0x4ae256

Function at 0x4f4426
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [eax + 8], edi
bswap ax
cwde
mov eax, dword [esi + 0x28]
jmp 0x4c2b3f
jmp 0x4a96ca
lea esp, [esp + 0x50]
jns 0x4c2b21
mov dword [eax + 8], edi
push 0x3760ad48
mov byte [esp], al
mov eax, dword [esi + 0x28]
pushal
jmp 0x4ada4d

Function at 0x4fee5c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0xb8
mov edx, dword [ebp + 0x10]
mov word [esp], 0xa9da
push 0x11359ac9
mov byte [esp + 4], 1
jmp 0x506e33
movzx ecx, word [edi + ebx*8 + 4]
sete dl
not al
bswap ax
mov eax, dword [ebp + 0x18]
jmp 0x4f9130
mov dword [esp + 4], eax
pushfd
call fcn.004cee76

Function at 0x50739d
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ebx, edx
jmp 0x4d33d6
mov word [esp], ax
mov dword [ebp - 4], ebx
pushfd
push 0x63740148
lea esp, [esp + 0x30]
jl 0x4bd8eb
not edi
bswap di
cwde
push esi
mov edi, dword [esp + 4]
call fcn.00457b90
lea esp, [esp + 0xc]
je 0x4ee7ae
xchg al, dh
pushal
rdtsc
movzx edx, word [esi]
inc al
setbe al
movzx eax, word [esi + 2]
pushfd
mov byte [esp + 4], bl
inc ebx
stc
bt cx, 2
add edx, eax
pushfd
jmp 0x4a1e33
pushfd
jmp 0x506e3d
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp int.00401219
Function at 0x743f5e
Capabilities:
Encode data using xor

Disassembly:
fxch st(6)
pop ss
add dword [0xaf953a1c], esi
ret 0xcb40
push 0x44836549
lea esp, [esp + 0x18]
je 0x808c85
cmp ah, ah
pushal
add eax, edi
stc
cmp eax, edx
call fcn.00744967
mov byte [edi - 0x46], cl
inc esi
sbb ecx, ebp
mov byte [ecx + 0x3094c43c], dh
inc esi
sal dword [esi], cl
add byte [ebx + 0x7d], bh
rol bh, 0x32
add al, 0x8f
rcr dword [eax - 0x42], 0xb1
cmpsd dword [esi], dword es:[edi]
push ds
leave
mov al, byte [0x84e51ca1]
popfd
add dh, dl
xor eax, 0x1c4746d3
stosd dword es:[edi], eax
lodsb al, byte [esi]
les eax, [ebx - 0x28]
or byte [esi], 0x71
in al, dx
add dh, bl
inc ebp
inc esi
aas
jp 0x743f35
fucom st(5)
invalid

Function at 0x74b85d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
clc
mov word [esp], 0xa78c
movzx ecx, word [edi + ecx*2]
xor di, ax
mov edi, dword [edx + 0x1c]
test cl, ah
cmc
stc
stc
add edi, eax
cmp dl, bl
mov edi, dword [edi + ecx*4]
pushfd
push dword [esp + 4]
test edi, edi
pushal
mov word [esp], 0xe6d4
push dword [esp]
lea esp, [esp + 0x30]
je 0x808c85
cmp ax, 0x42b3
cmp al, cl
add eax, edi
cmp bp, di
test dh, 0x4a
pushfd
cmp eax, edx
call fcn.00760b93
invalid

Function at 0x75e9de
Capabilities:
Encode data using xor

Disassembly:
sub al, al
pushal
call fcn.0076696d
pushfd
mov ebx, 0xe92fe412
add byte [ebx + edi*4 - 0x16d01bee], bl
sbb cl, 0xc7
xor ebx, dword [ebp + 0x46fb5e18]
xor byte [edi + 0x6409f879], bl
push edx
rol dword [ecx + 0x20], 0x16
movsd dword es:[edi], dword [esi]
mov bl, 0x1a
cmp al, 0x97
mov edi, edx
cld
arpl word [ebp - 0x480e6544], si
push cs
arpl word [edi + 0x3edf731e], sp
imul byte [esi + 0x189f1ff5]
jae 0x74c0bf
sbb eax, 0xd5ba2a9b
invalid
lea esp, [esp + 0x44]
jae 0x808c92
cmc
sar edi, cl
shl bh, 2
neg edi
mov ebx, eax
ror edi, 0x11
shrd di, di, 3
sal edi, cl
stc
mov edi, eax
lea ecx, [edi + 0x1595af59]
bswap cx
shrd cx, di, cl
test bx, bx
mov ecx, 0x104
cmp dh, 0xaf
cmp ah, ah
jmp 0x74c0b8

Function at 0x76450b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x20], 0x807e98
jmp 0x7691c5
push ebp
call fcn.00749346
pushfd
jmp 0x7454de
lea esp, [esp + 4]
jns 0x75f25d
push 0x35546631
lea esp, [esp + 4]
je 0x808c85
bts cx, bx
add edx, eax
push edx
and ch, 0xc4
not ecx
mov ecx, dword [esi + 0x7c]
stc
cmc
jmp 0x75f8b1
or al, 0x88
push ebp
inc bp
aas
aaa
bsf eax, eax
mov ebp, esp
adc ax, bp
stc
sub esp, 0x18
btr eax, ebp
push esi
pushfd
mov dword [esp], edi
bsf ax, si
sub ax, 0x48d4
pushal
pop eax
mov dword [esp + 0x18], ebx
bt cx, 6
mov dword [esp + 0x14], edx
sub ah, 0x87
mov eax, dword [ebp + 8]
cmc
jmp 0x80dd4b
pushfd
pushfd
push 0x9b516160
mov dword [esp + 0x28], eax
push 0x4ce8ea73
push edx
push dword [esp]
push dword [esp + 0x34]
ret 0x38
bt sp, 0xf
cmc
test eax, eax
push 0x43d15de9
push 0x62a74a7b
lea esp, [esp + 0x1c]
je 0x808c85
cmc
dec edx
not esi
bsf si, cx
mov esi, dword [eax + 0x3c]
ror dl, 1
setle dl
rcl dx, cl
inc dh
add esi, eax
setb dh
shr edx, 5
mov edx, dword [esi + 0x78]
pushfd
test edx, edx
mov byte [esp], bh
jmp 0x75fe3b
Function at 0x76ef60
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
call fcn.0076240a
push ebp
lea esp, [esp + 8]
jae 0x75b5e6
test al, cl
jmp 0x762c06

Function at 0x775acd
Capabilities:
Encode data using xor

Disassembly:
clc
cli
imul ecx, dword [ebx - 0x26], 0xb469bb6c
pop esi
adc dword [edi - 0x61b1dce2], esi
xor dword [ebx], esp
lcall 0x8265, 0x45689adf
or al, 0xe9
iretd
invalid
clc
test bl, 0xd0
add dl, dl
call fcn.0075e6ad
and edx, dword [edx]
movsd dword es:[edi], dword [esi]
jae 0x775ac7
push ss
dec ebp
jb 0x775a94
mov dh, 0x23
inc edx
movsb byte es:[edi], byte [esi]
adc esp, dword [edi + 0x10]
jnp 0x775b51
mov dl, 0x64
pop es
sbb byte [edi + 0x59], bh
mov esp, 0x21baa512
and al, 0x8f
xchg ebx, eax
invalid
pop esp
or al, 0x54
mov bh, 0xc
xor al, 0xd5
out dx, al
xor eax, 0xef749e23
invalid

Function at 0x80712f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp al, dh
repne scasb al, byte es:[edi]
push dword [esp]
mov byte [esp + 4], 0x63
mov word [esp], bp
lea esp, [esp + 0x28]
jne 0x775aa9
not al
mov ax, si
push ebx
lahf
mov byte [edi - 1], 0
movzx ax, cl
pop eax
sets ah
push ebx
sets al
movsx ax, al
lahf
lea eax, [0x76f8af]
jmp 0x76010a