joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100063d0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x100611b0]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.1000a270
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.1000a310
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.1000d1df
add esp, 0x68
ret

Function at 0x10006b10
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x100611b0]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.10008dd0
add esp, 8
test eax, eax
jne 0x10006b7b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.1000d1df
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x10006b90
push esi
lea ecx, [esp + 0x14]
call fcn.1000a270
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.1000a310
test edi, edi
je 0x10006bae
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.1000d1df
add esp, 0x6c
ret

Function at 0x10006c20
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x100611b0]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.10008fd0
add esp, 4
test eax, eax
jne 0x10006c7e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.1000d1df
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.1000a310
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.1000d1df
add esp, 0x64
ret

Function at 0x10006ca0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x100611b0]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.100090c0
add esp, 8
test eax, eax
jne 0x10006d1f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.1000d1df
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.10009e50
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.1000d1df
add esp, 0x74
ret
Function at 0x10486058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104861a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1048607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1048606a
add dl, dl
jne 0x10486089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104860dc
xor eax, eax
add dl, dl
jne 0x10486096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1048617d
add dl, dl
jne 0x104860a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104860b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104860bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104860c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104860d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10486075
mov eax, 1
add dl, dl
jne 0x104860ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104860f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104860e1
sub eax, ebx
mov ebx, 1
jne 0x10486128
mov ecx, 1
add dl, dl
jne 0x1048610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10486119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10486105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10486075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1048613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1048614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10486136
cmp eax, 0x7d00
jae 0x1048616d
cmp eax, 0x500
jb 0x10486168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10486075
cmp eax, 0x7f
ja 0x10486170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10486075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1048619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10486075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10620058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.106201a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1062007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1062006a
add dl, dl
jne 0x10620089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106200dc
xor eax, eax
add dl, dl
jne 0x10620096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1062017d
add dl, dl
jne 0x106200a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106200b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106200bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106200c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106200d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10620075
mov eax, 1
add dl, dl
jne 0x106200ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106200f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106200e1
sub eax, ebx
mov ebx, 1
jne 0x10620128
mov ecx, 1
add dl, dl
jne 0x1062010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10620119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10620105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10620075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1062013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1062014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10620136
cmp eax, 0x7d00
jae 0x1062016d
cmp eax, 0x500
jb 0x10620168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10620075
cmp eax, 0x7f
ja 0x10620170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10620075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1062019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10620075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x406520
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b1d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x44
call fcn.00406a60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x54
call fcn.00406a60
mov byte [ebp - 4], 1
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x64
call fcn.00406a60
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], 0
push 0x28
push 0
mov edx, dword [ebp - 0x1c]
add edx, 8
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x14
push 0
mov eax, dword [ebp - 0x1c]
add eax, 0x30
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x40100b
Capabilities:
Execute shellcode via indirect call
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x4010ad
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x40102e
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011b8
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401048
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011b8
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x401134
mov word [ebx], 0x5c
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011b8
mov dword [ebp - 0x108], eax
push 0x401023
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x4011ad
push 0x3e8
call eax
test eax, eax
je 0x4011ad
push eax
push 0x40
push 0x3000
push 0x10000
push 0
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
je 0x40119a
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x4010a7]
jmp 0x4011be
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x40108c]
jmp 0x4011be
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x40104d]
push 0x10
push 0x4010a7
push eax
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x49cfaf
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea esp, [esp + 2]
xchg dword [esp], esi
pushal
lea esi, [esi + 0xe]
call fcn.0049cf99
pop word [esp]
call fcn.0049cff4
add edx, 0xb9e91f10
jmp 0x49dd78
sub esp, 4
je 0x49ddc0
mov eax, 0x723fe1c9
jmp 0x49de18
call 0x49de3b
mov byte [eax], dl
xchg cl, ah
adc dh, dl
push ss
lea ebx, reloc.COMCTL32.dll_InitCommonControlsEx
push ds
mov ebx, gs
loopne 0x49ddc7
bsr ax, dx
bsr eax, ebx
mov eax, 0x2c40ff6b
push dword [esp + 8]
ret 0xc
cmp eax, 0x2379e7b5
mov eax, 0xb5413ec
jmp 0x49dfa7

Function at 0x49d11e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0488928
jmp 0x49d078
seto bh
mov ch, byte [esp]
jmp 0x49d0db
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
pushfd
jmp 0x49cf2f
jmp 0x49d0c5
mov ebp, dword [esp + 0x2c]
rcr cl, 3
jnp 0x49d09c
bsr eax, ebp
jmp 0x49d0f7
bsr eax, ebp
sub esp, 3
lea esp, [esp + 3]
call fcn.0049d104
lodsb al, byte [esi]
xor esp, dword [ebx - reloc.COMCTL32.dll_InitCommonControlsEx]
neg cl
jp 0x49d0b2
jnp 0x49d0b2
lea edi, [esp]
lea ebx, [ecx + ebp]
bsr edx, edi
jmp 0x49d169
sub esp, 3
lea esp, [esp + 3]
jmp 0x49d0e1
pop dword [esp]
jmp 0x49d08e
jb 0x49d17f
rdtsc
xchg al, cl
jmp 0x49d183
rdtsc
xchg al, cl
jmp 0x49d1bd
mov ah, 0x25
not dx
mov ebx, edx
mov ah, 0x25
not dx
mov ebx, edx
jmp 0x49d18c
sub esp, 0xc0
mov esi, esp
bt cx, dx
jg 0x49d185
mov dword [reloc.COMCTL32.dll_InitCommonControlsEx], eax
fidiv dword [ebp - 8]
jle 0x49d1a7
jne 0x49d1c7
outsb dx, byte [esi]
or eax, edi
dec ebx
inc ebp
aad 0x45
sub al, 0xdf
push 0xdfbd0fc4

Function at 0x49d24f
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr ax, ax
xchg ecx, edx
mov eax, dword [esp]
mov cl, 0x35
jmp 0x49d219
mov dword [esp], ecx
stc
jo 0x49d1ef
jno 0x49d1f9
Function at 0x4a7bb3
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0xf151f3ee
jmp 0x4a7956
add eax, 0xb9e91f10
jmp 0x4a79c4
add al, ch
mov al, 0x52
jmp 0x4a7892
adc dx, 0x3151
jns 0x4a7835
add al, ch
mov al, 0x52
bsf ax, ax
jmp 0x4a7896
mov ax, di
mov ah, dl
rdtsc
mov eax, 0xe6b563d7
add cl, 0x91
jmp 0x4a784b
call fcn.004a7ab5
movsb byte es:[edi], byte [esi]
sub bh, byte [eax - 0x3963d521]
dec edi
fistp qword [edx - 0x629d17b7]
in al, dx
inc esi
bsf ax, ax
mov eax, ecx
neg edx
je 0x4a787c
dec dx
jmp 0x4a78aa
setbe dh
or edx, edi
jmp 0x4a7908
lea esp, [esp + 4]
not cl
lea eax, [ebp*4]
mov ax, word [esp]
rdtsc
jmp 0x4a786b
sub esp, 0x19
call fcn.004a7922
insb byte es:[edi], dx
invalid
setge dh
add dx, 0x3a48
sub esp, 0x13
pushfd
lea esp, [esp + 3]
xchg dword [esp + 0x18], ecx
jmp 0x4a78d7
shl eax, 2
jp 0x4a794c
xchg dh, dl
mov dh, bh
bswap edx
bsf edx, eax
jmp 0x4a6f07
xchg dh, dl
mov dh, bh
bswap edx
jmp 0x4a794e
jmp 0x4a7936
bsf edx, eax
jmp 0x4a6f07
pushfd
clc
jle 0x4a7a58
jg 0x4a799d
mov esp, 0x2bd8b929
popfd
fimul word [edx - 0x28]
mov edi, 0x826b884a
cmp eax, 0x4244c87
mov edx, 0xd502f9b1
cmp dx, cx
mov dl, 0x37
bswap edx
lea ecx, [ecx + 0x25]
jmp 0x4a78ed
mov dx, 0x8595
bts edx, edi
jne 0x4a7a0d
mov dl, byte [esp]
jmp 0x4a6f47
add esp, 3
lea esp, [esp + 1]
jmp 0x4a7a5f
bsr dx, dx
mov edx, esp
push di
lea esp, [esp + 2]
jmp 0x4a79ed
sub esp, 0
jmp 0x4a79e3
push di
lea esp, [esp + 2]
jmp 0x4a79ed
jle 0x4a79a9
bsr dx, dx
mov edx, esp
jmp 0x4a79c9
mov esp, esi
mov dh, 0x4b
push cx
or dl, 0xd4
je 0x4a7a2b
add edx, 0x9ce09451
lea esp, [esp + 2]
jmp 0x4a7ac6
mov dl, byte [esp]
jmp 0x4a6f47
call fcn.004a7a41
clc
hlt
add esp, 3
lea esp, [esp + 1]
mov eax, dword [eax + reloc.COMCTL32.dll_InitCommonControlsEx]
mov dh, bh
jmp 0x4a7987
push eax
ret
xchg dx, ax
jmp 0x4a78c2

Function at 0x4bb7c5
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 2
lea esp, [esp + 2]
xor edx, esi
jmp fcn.004bb7af

Function at 0x4bbc3e
Capabilities:
Encrypt data using aes

Disassembly:
and ecx, esi
stc
mov ecx, dword [ecx*4 + reloc.COMCTL32.dll_InitCommonControlsEx]
jmp 0x4bbba2
lea esp, [esp + 1]
lea esp, [esp + 0x24]
popal
jmp 0x4bbb7a
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + reloc.COMCTL32.dll_InitCommonControlsEx]
jmp 0x4bbbd4
and edi, 0xff000000
sub esp, 0xc
jmp 0x4bbc1c
lea esp, [esp + 0x24]
and ecx, 0xff0000
sub esp, 3
mov byte [esp], dh
lea esp, [esp + 3]
jmp 0x4bbbb0
and edx, esi
call 0x4bbc3e
mov bl, 0x23
inc esi
mov ch, 0xd
sub al, 0xb4
sub cl, byte [ebp - 0x44]
jp 0x4bbc3b
pushal
mov dword [reloc.COMCTL32.dll_InitCommonControlsEx], eax
xor ecx, edi
dec di
mov edi, edx
jmp 0x4bbc06
mov eax, edx
lea eax, [eax*4]
lea eax, reloc.COMCTL32.dll_InitCommonControlsEx
mov edx, dword [eax]
pop eax
jmp 0x4bbc43
push edi
mov esi, 0x50519c89
jmp 0x4bbc24
sub esp, 6
sub esp, 0x1a
push word [esp + 0xc]
lea esp, [esp + 2]
shr edi, 0x18
call fcn.004bbe1d
xor ebp, dword [edx + reloc.COMCTL32.dll_InitCommonControlsEx]
push edi
iretd
Function at 0x548620
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x16
mov di, 0x3bea
push word [esp + 0x21]
jmp 0x5484bf
add esp, 0xf
mov bp, di
lea ebp, [eax + ebx]
pushal
cld
or edx, 0x784a588d
jmp 0x548480
xchg esi, ebx
sete ah
lea edi, reloc.COMCTL32.dll_InitCommonControlsEx
mov bl, 0xf1
lea esi, [edx + edi]
jmp 0x5484eb
mov si, word [esp + 0x21]
rdtsc
xchg ah, al
neg ecx
xchg word [esp + 2], cx
lea esp, [esp + 0x1b]
jmp 0x5484a9
push ecx
xchg byte [esp + 0x1d], ch
xchg dword [esp + 0x16], ecx
bt cx, cx
jmp 0x548503
mov ax, word [esp + 0xe]
mov dword [esp + 0x1c], eax
mov bx, 0xa23
lea eax, [edx + 0x1a]
bts si, bx
rdtsc
jmp 0x5484d5
push word [esp + 0xc]
mov bh, byte [esp + 0x12]
xchg ebx, eax
setae dl
xchg byte [esp + 0x24], ah
jmp 0x548534
mov cx, 0x3306
pop cx
sub esp, 0x1b
cld
or ecx, 0xce74efa5
lea esp, [esp + 8]
jmp 0x548496
mov ch, byte [esp + 0x23]
xchg esi, edi
mov edx, esp
cpuid
lea esp, [esp + 7]
sub esp, 0xa
jmp 0x5485ac
mov word [esp], dx
xchg ebp, ecx
bt cx, dx
push ecx
pop dword [esp]
mov word [esp + 1], cx
jmp 0x54851b
push cx
mov ax, bx
rdtsc
call fcn.005485d8
sbb cl, byte [esi + 0x22967b1c]
lahf
out 0x11, al
nop
and si, 0xb8c1
sub esp, 0x17
lea esp, [esp + 0x44]
lea edi, [ecx*4]
setae bh
cpuid
jmp 0x548568
mov eax, 0xd4a21d2d
pop word [esp + 0x19]
std
sub esp, 5
pop bp
mov bp, 0xd11e
jmp 0x54857e
lea esi, [ebx + esi]
mov cl, bl
std
jmp 0x548553

Function at 0x549203
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], bp
call 0x54920d
cli
rdtsc
pop ebx
jmp 0x549247
mov ecx, edi
mov ah, byte [esp + 3]
mov si, bx
push di
rdtsc
xchg word [esp + 3], ax
jmp 0x549231

Function at 0x54920d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], bp
call 0x54920d
cli
rdtsc
pop ebx
jmp 0x549247
mov ecx, edi
mov ah, byte [esp + 3]
mov si, bx
push di
rdtsc
xchg word [esp + 3], ax
jmp 0x549231

Function at 0x5492d0
Capabilities:
Parse pe header

Disassembly:
call fcn.0054900b
call fcn.0054934d
pop dword [esp]
pushfd
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 0x10], esp
pushfd
jmp 0x54932e
mov dword [esp + 0x10], ebp
pushfd
mov dword [esp + 0x10], esi
pushal
mov dword [esp + 0xb], eax
push word [esp + 0x10]
jmp 0x549365
mov eax, dword [eax + 0xc]
jmp 0x54938f
lea esp, [esp + 2]
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
mov eax, dword fs:[0x30]
jmp 0x54934f
push eax
jmp 0x549006
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x549379
Function at 0x54934d
Capabilities:
Check for peb beingdebugged flag
Parse pe header

Disassembly:
call fcn.00544094
push eax
jmp 0x54408f
jmp 0x549399
movzx ebx, word [eax + 0x3c]
jmp 0x549402
dec cl
push 0x408b86eb
jmp 0x5492d5
mov eax, dword [eax + 0xc]
jmp 0x54938f
mov cl, byte [edi]
lahf
cli
or ecx, esi
and byte [eax + 0x41a05136], ah
pop ebp
lodsb al, byte [esi]
mov edi, 0x648d3186
and al, 2
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x5493d4
xor byte [ebx], cl
mov word [edx], es
xchg esp, eax
je 0x54934a
sbb dword [ecx - 0x708e418], ecx
invalid
je 0x549049
sub eax, 0x10000
jmp 0x54939d
add ebx, eax
cmp word [ebx], 0x4550
push eax
inc ebp
je 0x544432
jne 0x5493da
dec ebp
rcl byte [esi + 0x31], 0xc0
and ebp, ebp
jge 0x549407
je 0x5493a3
fisttp qword [bp - 0x24]
mov ebx, 0xe34dbf56
jae 0x54943d
in eax, 0x44
mov ch, 0x24
mov edx, 0xc5dd2cdd
push ecx
shl dword [eax - reloc.COMCTL32.dll_InitCommonControlsEx], 0x40
daa
sar byte [ebx - 0x3b], cl
push edi
invalid
Function at 0x401d60
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401dab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401da4
test esi, esi
je 0x401da4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401d80
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401f90
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4020b8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40201e
cmp eax, 4
jne 0x402040
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40202e
cmp edx, 4
je 0x40202e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401f90

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x579c3429
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x5ef3649f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10004377
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10004386
pop dword [ebp - 0x14]
mov eax, 0xdb2e8dd1
sub eax, 0xcb2e4a4b
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x18c4c3cf
add dword [ebp - 0x24], 0x358d817c
mov dword [ebp - 0x20], 0xc73307ed
add dword [ebp - 0x20], 0x6b004458
mov dword [ebp - 0x1c], 0x1d8217d0
add dword [ebp - 0x1c], 0x2eca2c5e
mov dword [ebp - 0x18], 0x2467cc36
sub dword [ebp - 0x18], 0x2467cc36
lea eax, [ebp - 0x24]
push eax
mov eax, 0xa9d4b6ea
add eax, 0x662b996e
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x35fb8e71
sub dword [ebp - 0x24], 0xc189251b
mov dword [ebp - 0x20], 0xd500411a
sub dword [ebp - 0x20], 0x9393dfa5
mov dword [ebp - 0x1c], 0x5a4ebd9a
add dword [ebp - 0x1c], 0x920aed2
mov dword [ebp - 0x18], 0x5c2d8424
sub dword [ebp - 0x18], 0x5c2d8424
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x24553d79
add eax, 0xebab1303
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x36ebc
push 0
call eax
mov ecx, 0xc92ea22a
add ecx, 0x36d1a753
mov edx, eax
mov esi, 0xe43c34f3
add esi, 0x2bc4730d
add esi, dword [ebp - 0x14]
mov ebx, 0xced01dab
sub ebx, 0x99a7525
xor dword [ebp - 4], esi
mov edi, dword [esi]
sub dword [ebp - 0x10], eax
sub edi, ebx
xor dword [ebp - 8], 0x5c612801
mov dword [edx], edi
mov dword [ebp - 0xc], 0x358eb119
add edx, 4
add esi, 0x1dbd5e9f
sub esi, 0x1dbd5e9b
loop 0x100044a8
add eax, 0x118c7
xor ebx, ebx
add ebx, eax
add eax, 0xb8a77de9
sub eax, 0xb8a77de4
mov ecx, 0x68652e59
add ecx, 0xa79ad1a7
add ecx, dword [ebp - 0x14]
call ebx
leave
ret