joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cec6
Capabilities:
Check os version
Get token membership

Disassembly:
push ebp
lea ebp, [esp - 0xf0]
sub esp, 0x170
mov eax, dword [0x1004d0e0]
xor eax, ebp
mov dword [ebp + 0xec], eax
push esi
push edi
xor edi, edi
mov dword [ebp - 0x6c], 0x114
push 0x110
lea eax, [ebp - 0x68]
mov dword [ebp - 0x7c], edi
push edi
push eax
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], edi
call fcn.100255c0
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1001cfc2
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1001cfc2
cmp dword [ebp - 0x68], 6
jb 0x1001cf73
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x78]
push eax
push 4
lea eax, [ebp - 0x80]
push eax
push 0x12
push dword [ebp - 0x70]
call esi
test eax, eax
je 0x1001cfc2
cmp dword [ebp - 0x80], 3
jne 0x1001cf73
lea eax, [ebp - 0x78]
push eax
push 4
lea eax, [ebp - 0x74]
push eax
push 0x13
push dword [ebp - 0x70]
call esi
test eax, eax
je 0x1001cfc2
cmp dword [ebp - 0x74], edi
jne 0x1001cf8b
lea eax, [ebp - 0x74]
push eax
push 1
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x1001cfc2
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x44
push eax
lea eax, [ebp + 0xa8]
push eax
push edi
push 0x16
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1001cfc2
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0xa8]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1001cfc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x70], edi
je 0x1001cfdb
push dword [ebp - 0x70]
call esi
mov dword [ebp - 0x70], edi
cmp dword [ebp - 0x74], edi
je 0x1001cfe5
push dword [ebp - 0x74]
call esi
cmp dword [ebp - 0x7c], edi
mov ecx, dword [ebp + 0xec]
setne al
xor ecx, ebp
pop edi
pop esi
call fcn.1002211a
add ebp, 0xf0
leave
ret
Function at 0x1001d3b3
Capabilities:
Get disk information

Disassembly:
push 0x4dc
mov eax, 0x1003ba3e
call fcn.10022cff
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x4e4], esi
xor ebx, ebx
mov dword [ebp - 0x4e4], esi
push 0xc8
lea eax, [ebp - 0xe0]
mov dword [ebp - 0x18], ebx
push ebx
push eax
mov word [ebp - 0x14], bx
call fcn.100255c0
push 0x3e8
lea eax, [ebp - 0x4c8]
push ebx
push eax
call fcn.100255c0
add esp, 0x18
test edi, edi
je 0x1001d508
lea eax, [ebp - 0x4c8]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1001d4c2
mov ax, word [ebp - 0x4c8]
test ax, ax
je 0x1001d4c2
xor edx, edx
movzx ecx, ax
movzx eax, cx
cmp eax, 0x61
je 0x1001d4a9
cmp eax, 0x41
je 0x1001d4a9
cmp eax, 0x62
je 0x1001d4a9
cmp eax, 0x42
je 0x1001d4a9
mov word [ebp - 0x18], ax
mov ax, word [ebp + edx - 0x4c6]
mov word [ebp - 0x16], ax
xor eax, eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0xe0]
push 0x64
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1001d508
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov dword [ebp - 0x4e4], eax
lea eax, [ebp - 0xe0]
push eax
push edi
call fcn.1002aee3
add esp, 0xc
test eax, eax
je 0x1001d4c5
add ebx, 4
lea edx, [ebx + ebx]
movzx eax, word [ebp + edx - 0x4c8]
mov ecx, eax
test ax, ax
jne 0x1001d439
push edi
jmp 0x1001d50d
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x4e0]
call fcn.10012874
mov eax, dword [ebp - 0x4e4]
and dword [ebp - 4], 0
lea ecx, [edi + eax*2]
push ecx
lea ecx, [ebp - 0x4e0]
call fcn.10012732
lea eax, [ebp - 0x4e0]
mov ecx, esi
push eax
call fcn.1001280c
lea ecx, [ebp - 0x4e0]
call fcn.1001340c
jmp 0x1001d514
push 0x100437a4
mov ecx, esi
call fcn.10012874
mov eax, esi
call fcn.10022cbd
ret

Function at 0x1001d51c
Capabilities:
Get process image filename

Disassembly:
push 0x22c
mov eax, 0x1003ba78
call fcn.10022cff
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x234], esi
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov ecx, dword [ebp + 8]
push eax
push ecx
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x234], esi
call fcn.1001d195
pop ecx
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x220], ebx
jne 0x1001d5bf
push edi
push ebx
push 0x1010
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x1001d57e
push 0x100437a4
mov ecx, esi
call fcn.10012874
jmp 0x1001d5da
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.100255c0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.10012757
cmp dword [ebp - 0x21c], 8
lea edx, [ebp - 0x230]
mov ecx, esi
cmovae edx, dword [ebp - 0x230]
call fcn.1001d3b3
lea ecx, [ebp - 0x230]
call fcn.1001340c
mov eax, esi
call fcn.10022cbd
ret
Function at 0x1001d8aa
Capabilities:
Check os version
Get token membership

Disassembly:
push ebp
lea ebp, [esp - 0xf0]
sub esp, 0x170
mov eax, dword [0x1004d0e0]
xor eax, ebp
mov dword [ebp + 0xec], eax
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x68]
push 0x110
push edi
push eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], edi
call fcn.100255c0
add esp, 0xc
mov dword [ebp - 0x6c], 0x114
lea eax, [ebp - 0x70]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1001d9a2
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1001d9a2
cmp dword [ebp - 0x68], 6
jb 0x1001d957
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x78]
push eax
push 4
lea eax, [ebp - 0x80]
push eax
push 0x12
push dword [ebp - 0x70]
call esi
test eax, eax
je 0x1001d9a2
cmp dword [ebp - 0x80], 3
jne 0x1001d957
lea eax, [ebp - 0x78]
push eax
push 4
lea eax, [ebp - 0x74]
push eax
push 0x13
push dword [ebp - 0x70]
call esi
test eax, eax
je 0x1001d9a2
cmp dword [ebp - 0x74], edi
jne 0x1001d96f
lea eax, [ebp - 0x74]
push eax
push 1
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x1001d9a2
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x44
push eax
lea eax, [ebp + 0xa8]
push eax
push edi
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1001d9a2
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0xa8]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x70], edi
je 0x1001d9b2
push dword [ebp - 0x70]
call esi
cmp dword [ebp - 0x74], edi
je 0x1001d9bc
push dword [ebp - 0x74]
call esi
cmp dword [ebp - 0x7c], edi
mov ecx, dword [ebp + 0xec]
setne al
xor ecx, ebp
pop edi
pop esi
call fcn.1002211a
add ebp, 0xf0
leave
ret

Function at 0x1001d9d9
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1004d0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1001da2e
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1001da34
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x10], 0
pop ebx
je 0x1001da44
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x14], 0
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
call fcn.1002211a
leave
ret
Function at 0x10020da9
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [0x1004d0e0]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], eax
push edi
mov edi, dword [esp + 0x34]
test cl, 7
je 0x10020dde
push 0xffffffffffffffce
pop eax
jmp 0x10020eb1
test ecx, ecx
je 0x10020eaf
push ebp
push esi
lea ebp, [ecx - 1]
push 8
shr ebp, 3
pop esi
cmp edx, 1
jne 0x10020e4b
mov edx, ebx
sub edi, eax
sub edx, eax
inc ebp
mov dword [esp + 0x10], edx
mov ecx, eax
mov dword [esp + 0x18], esi
mov al, byte [edi + ecx]
xor al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
sub esi, 1
jne 0x10020e07
mov ecx, dword [esp + 0x1c]
mov edx, ebx
push ebx
call fcn.10020b5f
push 8
pop esi
push esi
push ebx
push dword [esp + 0x20]
call fcn.10023940
mov edx, dword [esp + 0x20]
add esp, 0x10
mov eax, dword [esp + 0x14]
add edx, esi
add ebx, esi
mov dword [esp + 0x10], edx
add edi, esi
sub ebp, 1
jne 0x10020e01
jmp 0x10020ead
sub eax, ebx
sub ebx, edi
mov dword [esp + 0x10], eax
inc ebp
push esi
lea eax, [esp + 0x28]
push edi
push eax
call fcn.10023940
mov ecx, dword [esp + 0x28]
lea eax, [ebx + edi]
push eax
mov edx, edi
mov dword [esp + 0x28], eax
call fcn.10020b5f
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov edx, dword [esp + 0x18]
mov dword [esp + 0x20], esi
mov al, byte [ecx + edx]
xor byte [edx], al
inc edx
sub esi, 1
jne 0x10020e82
push 8
pop esi
push esi
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x1c]
call fcn.10023940
sub dword [esp + 0x1c], esi
add esp, 0xc
add edi, esi
sub ebp, 1
jne 0x10020e54
pop esi
pop ebp
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.1002211a
add esp, 0x20
ret

Function at 0x10021a36
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10021a12
pop esi
leave
ret 8

Function at 0x1002f4dc
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002f45e

Function at 0x100380c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100380ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100380ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41ce04
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x41d440
call fcn.0041d0c8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x41ce64
cmp eax, 0xffffffff
je 0x41ce64
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41ce5d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41ce5d
cmp edx, 0x10000000
jae 0x41ce5d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41ce5a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41ced0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x41cf0e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x41cf06
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x41cf10
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x41cef6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41cfe0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x41d011
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x41d011
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x41d011
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41f0a0
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x4223d8
call fcn.0041fd98
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x423e5c
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x41ee75
cmp eax, esi
jne 0x41ee68
xor esi, esi
inc esi
mov edi, esi
jmp 0x41ee78
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41ee4c
xor esi, esi
inc esi
cmp dword [0x423e60], esi
jne 0x41ee8a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x41eec4
cmp dword [0x423e60], ebx
jne 0x41eebe
mov dword [0x423e60], esi
push 0x401028
push 0x401018
call fcn.004bf000
pop ecx
pop ecx
test eax, eax
je 0x41eec4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41efee
mov dword [0x423ae0], esi
cmp dword [0x423e60], esi
jne 0x41eee7
push 0x401014
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x423e60], 2
test edi, edi
jne 0x41eef4
xor eax, eax
mov ecx, 0x423e5c
xchg dword [ecx], eax
cmp dword [0x423e70], 0
je 0x41ef20
push 0x423e70
call fcn.0041fbf0
pop ecx
test eax, eax
je 0x41ef20
push ebx
push 2
push ebx
mov esi, dword [0x423e70]
mov ecx, esi
call dword [0x42486c]
call esi
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov ecx, dword [eax]
test ecx, ecx
je 0x41eead
mov dword [ebp - 0x20], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp ax, si
ja 0x41ef8b
test ax, ax
je 0x41ef5a
test edx, edx
jne 0x41ef8b
test ax, ax
je 0x41ef5a
cmp ax, si
ja 0x41ef5a
add ecx, 2
mov dword [ebp - 0x20], ecx
movzx eax, word [ecx]
jmp 0x41ef45
test byte [ebp - 0x3c], 1
je 0x41ef66
movzx eax, word [ebp - 0x38]
jmp 0x41ef69
push 0xa
pop eax
push eax
push ecx
push ebx
push 0x400000
call main
mov dword [0x423adc], eax
cmp dword [0x423af4], 0
jne 0x41efd3
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp eax, 0x22
jne 0x41ef9c
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x1c], edx
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x41ef34
cmp dword [0x423ae0], 0
jne 0x41efe7
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x423adc]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.0041fce5
jmp 0x41ee23

Function at 0x41fad4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x422418
call fcn.0041fd98
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x41fb34
cmp eax, 0xffffffff
je 0x41fb34
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41fb2d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41fb2d
cmp edx, 0x10000000
jae 0x41fb2d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41fb2a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x74a012
Capabilities:
Check for software breakpoints

Disassembly:
xor bl, al
inc cl
lea eax, [esp + eax + 4]
sub ecx, ecx
inc ecx
mov ecx, dword [eax + ecx*2 - 2]
push 0x2526511f
shl byte [esp + 2], 0xc2
jnp 0x98f194
mov dword [ebp], ecx
call 0x984f13
jmp 0x7fe2ac
sbb ebp, 4
mov dword [esp + 4], 0xd795ac16
jmp 0x822965

Function at 0x74a031
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.009619f3

Function at 0x74f4ca
Capabilities:
Check for software breakpoints

Disassembly:
jae 0x98311e
call fcn.007d0d28

Function at 0x74feea
Capabilities:
Check for software breakpoints

Disassembly:
push 0x11145be
add edi, 2
call fcn.009728c5

Function at 0x7512c9
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [ebp], edi
lea esp, [esp + 0x10]
jmp fcn.009619f3

Function at 0x751400
Capabilities:
Check for software breakpoints

Disassembly:
mov esi, dword [esp + 8]
jmp 0x8458eb
lea esp, [esp + 0xc]
jmp fcn.009619f3

Function at 0x751945
Capabilities:
Check for software breakpoints

Disassembly:
push 0x789e2231
lea esp, [esp + 0x18]
jmp fcn.0085a49e
call fcn.007b229c
lahf
in al, dx
mov bh, 0x3d
mov bh, 0x3d
push esp
bound esp, qword [ebx - 0x18b55ec5]
add dword [esp], ecx
jb 0x751992
hlt
and al, bh
xchg esi, eax
in eax, dx
xor byte [esi - 0x59731862], dl
daa
int1
xchg ecx, eax
mov byte [0xaf4f37cf], al
jns 0x751945
leave
imul ecx, dword [ecx + 0x39], 0xffffff86
push cs
fnstcw word [ecx - 0x177073d4]
test byte [edi], al
mov bl, 0xfb
or al, 0x60
int1
fld xword [esi - 0x1c]
sbb al, 0xeb
jecxz 0x75195b
adc al, 0xef
das
clc
enter 0x36cb, 0xffffffffffffffe5
pop ds
call 0x2b8bb821
sbb eax, 0xfa3840b5
sbb al, 0xa1
scasd eax, dword es:[edi]
adc edi, dword [edx + 0x77f54f03]
invalid

Function at 0x751f61
Capabilities:
Check for software breakpoints

Disassembly:
call fcn.00992ea0
mov eax, 0x5abd3f3b
mov ax, word [ebp + eax - 0x5abd3f3b]
mov ecx, 0xce180f00
add cl, byte [ebp + 2]
push 0x16b7f0b7
shl byte [esp], 0xa6
adc ebp, 1
shl dword [esp], 0x2a
shr ax, cl
jmp 0x78a510
push 0x52a544bf
mov word [ebp], ax
lea esp, [esp + 8]
jmp fcn.009619f3

Function at 0x7528a6
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.0085a49e

Function at 0x757e67
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x7d03f3
push 0x7f0f8d18
mov dword [esp + 4], 0x9022253a
sub cl, 0x3b
ror dword [esp + 3], 0xad
shl word [esp + 0xc], 0xa7
neg dword [esp + 0xc]
xor cl, 0x22
not word [esp + 4]
shr dword [esp + 8], 2
xor bl, cl
lea ecx, [esp + ecx + 0x18]
jmp 0x7e70b1
jmp 0x95b518
mov dword [ecx], edx
lea esp, [esp + 0x18]
jmp fcn.009619f3
not cl
dec byte [esp + 6]
neg cl
jmp 0x7b6470

Function at 0x758e7d
Capabilities:
Check for software breakpoints

Disassembly:
dec word [esp + ebp*4 - 0x35f4bf]
xor bl, cl
lea ecx, [esp + ecx + 0x10]
xor bp, 0x6d0d
mov bp, word [ebp + ecx - 0xd103c]
push 0xe4944086
sal dword [esp + 0xb], 0x3f
sbb esi, 1
mov word [esi], bp
lea esp, [esp + 0x14]
jmp fcn.0085a49e
Function at 0x75b00b
Capabilities:
Check for software breakpoints

Disassembly:
mov word [ebp], dx
lea esp, [esp + 4]
jmp fcn.009619f3

Function at 0x75be6f
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0x18]
jmp fcn.009619f3

Function at 0x75e35c
Capabilities:
Check for software breakpoints

Disassembly:
push 0x9d829d0c
push 0xa114533c
lea esp, [esp + 0x20]
jmp fcn.009619f3

Function at 0x75e38a
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x7ba154
mov dword [esi], edx
push 0x6c1c1296
lea esp, [esp + 0xc]
jmp fcn.0085a49e

Function at 0x75f2c5
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0x18]
je 0x7ca06f
mov eax, 0x6e2f0a98
btc eax, eax
mov eax, dword [ebp + ebx*4]
push 0xd34d79f
mov dword [esp], eax
call fcn.00995eac
mov dword [ebp], edx
push 0xf298039f
lea esp, [esp + 0x14]
jmp fcn.009619f3
mov eax, dword [ebp]
call eax
mov ebp, dword [ebp - 4]
push 0x7909409
mov dword [ebp], eax
mov ebx, dword [esp + 4]
mov esi, dword [esp]
call fcn.007569f0
mov eax, 0x8385321d
xchg ah, al
jmp 0x770503

Function at 0x7600bc
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov edx, dword [esp + 0x1c]
push 0x6e037ea8
jmp 0x8564b6
call 0x7d5f75

Function at 0x76011c
Capabilities:
Check for software breakpoints

Disassembly:
not dx
jmp 0x84f0c3
not di
push 0xf2b966b6
jmp 0x77fde7

Function at 0x761790
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.009619f3

Function at 0x761e7b
Capabilities:
Check for software breakpoints

Disassembly:
call fcn.0079a467
mov edx, 0x4da570b2
and dx, dx
mov edx, dword [ebp + edx - 0x4da570b2]
mov eax, 0x62b89417
jge 0x809e2a
mov eax, dword [edi]
mov ecx, 0x861a1081
mov edx, dword [edi + 4]
bt ecx, 0xbc
sal ecx, cl
mov cl, byte [ecx + edi - 0xc3420fa]
jo 0x81402f
mov ebp, edi
pop eax
lea edi, [esi + ebp*4 + 0x38198e16]
bswap esi
pop ecx
lea edx, [esi*2 - 0x7c409cc]
pop ebp
pop edi
pop ebx
jmp 0x761e5c
push 0x29b44407
adc edi, 5
shl byte [esp + 1], 0x81
jne 0x7bbe75
mov al, byte [eax + ebp - 0x62b89413]
adc ebp, 6
mov byte ss:[edx], al
call fcn.007c7bdf
jl 0x7f3751
call fcn.007f4cf0
xchg ecx, esi
popfd
lea edi, [esi - 0x17ee60e3]
jmp 0x78e83d

Function at 0x76214a
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.009619f3

Function at 0x76283c
Capabilities:
Check for software breakpoints

Disassembly:
shr esi, 8
push 0x77b07807
xor esi, ebx
inc eax
xor esi, 0x438f5108
mov dword [esp + 8], 0x5123af2c
mov dword [esp + 4], 0x5ab19ca4
xor dword [esp + 4], 0xc32eb3b1
dec edx
jmp 0x7d6e25
push 0x30ab0a27
push 0x37b5e50a
lea esp, [esp + 0x18]
jne 0x839540
jmp 0x951c74
Function at 0x763ea4
Capabilities:
Check for software breakpoints

Disassembly:
mov byte [ecx], dl
setle byte [esp + 7]
jge 0x811de6
lea esp, [esp + 0xc]
jno fcn.009619f3
push 0x1d9469ba
lea esp, [esp + 0xc]
jne 0x7b055c
push 0x7819c92c
mov eax, 0x5c1d9c8f
push eax
mov eax, dword [ebp + eax - 0x5c1d9c8f]
jmp 0x7dd184
sal dl, cl
mov word [esi], dx
push 0xb4b1fb2c
call fcn.00797bad
push 0x45a0b793
jmp 0x78519b
mov eax, dword [ebp + ebx*4]
call fcn.0078738c
mov ecx, 0xce34e7a8
inc cx
not ecx
mov ecx, ebp
call fcn.007c3397
mov edx, 0xab2ace29
movzx dx, byte [esi]
mov cl, byte [esi + 2]
add esi, 2
jmp 0x789977

Function at 0x768e88
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0x10]
jno fcn.0080a109

Function at 0x768e92
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.009619f3

Function at 0x769ff1
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x79cdd7
mov word [ebp], dx
jmp 0x7a9d5f
lea esp, [esp + 0xc]
jmp fcn.009619f3

Function at 0x76ab8f
Capabilities:
Check for software breakpoints

Disassembly:
sal ebp, 0x8d
not al
btr ebp, ebp
xor bl, al
mov dword [esp + ebp - 0x6000], ebp
btc ebp, 0x9d
lea eax, [esp + eax + 4]
mov bp, word [ebp + eax - 0x20006000]
sar dword [esp], 0x9a
shr byte [esp], 0x83
sbb esi, 2
mov word [esi], bp
lea esp, [esp + 4]
jmp fcn.0085a49e

Function at 0x76dfbd
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [edx], eax
lea esp, [esp + 0x28]
jmp fcn.009619f3

Function at 0x77023a
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Encrypt data using speck

Disassembly:
and word [esp + 0xc], 0x5f19
jae 0x81c57b
sub dword [esp + 8], 0x22170b1e
inc word [esp + 0xa]
neg ax
push 0x6fbcb68f
rol ax, 1
jmp 0x96cabf
xor bx, ax
sub esi, 2
mov word [esi], ax
jmp 0x992523
ror byte [esp + 9], 0x64
jb 0x98c209
dec ax
dec dword [esp + 0xc]
not ax
xor ax, 0xd236
shr word [esp + 2], 9
jp 0x98783d
not ax
jbe 0x754390
setbe byte [esp + 8]
rol dl, 1
add dl, 0xd
rol dl, 1
xor bl, dl
add dword [esp + 4], 0xfa016582
sar word [esp + 8], 0x44
sar dword [esp + 2], 0x51
push 0x6830f380
lea esp, [esp + 0x14]
jmp fcn.0085a49e