joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009e9e
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x100225ce
call fcn.1000cca3
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.10021e04
test eax, eax
je 0x10009ec9
call fcn.10009e8f
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x10023938
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10009f24
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.1000bb01
pop ecx
pop ecx
push edi
push esi
call fcn.10021e04
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.1000a299
push eax
push esi
push 0x100249ec
call fcn.1000bb01
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x10009f1d
ret
cmp ebx, edi
je 0x10009f2f
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x10009fe0
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x10009f8c
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x10009ee8
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x10009fe0
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x10009fe0
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x10009ee8
mov eax, esi
call fcn.1000cd0f
ret
Function at 0x1000a7a8
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xf98]
mov eax, 0x1018
call fcn.1000c370
mov eax, dword [0x1002b19c]
xor eax, ebp
mov dword [ebp + 0xf94], eax
mov eax, dword [ebp + 0xfa4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xfa0]
xor ebx, ebx
mov esi, 0x7ff
push esi
mov dword [ebp - 0x78], eax
lea eax, [ebp + 0x795]
push ebx
push eax
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x7c], 1
mov byte [ebp + 0x794], bl
call fcn.1000c3a0
push esi
lea eax, [ebp - 0x6b]
push ebx
push eax
mov byte [ebp - 0x6c], bl
call fcn.1000c3a0
push edi
call fcn.1000ecb7
add esp, 0x1c
cmp eax, ebx
je 0x1000a838
push eax
push dword [ebp + 0xfa8]
push dword [ebp - 0x78]
call fcn.10021e04
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jmp 0x1000a99a
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x70]
push eax
push 0x20019
push ebx
push dword [0x1002b174]
push SysReAllocString
call edi
test eax, eax
je 0x1000a860
xor eax, eax
jmp 0x1000a99a
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0xfa8]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x7c]
push eax
push ebx
push dword [ebp - 0x80]
push dword [ebp - 0x70]
call esi
test eax, eax
je 0x1000a891
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000a99a
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x794]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push 0x10025608
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x800
call esi
test eax, eax
je 0x1000a8bb
xor ebx, ebx
inc ebx
jmp 0x1000a881
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x70]
push eax
push 0x20019
push ebx
push str.SOFTWAREOracleJavaDeploy
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x1000a8b6
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.deployment.modified.timestamp
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x800
call esi
test eax, eax
jne 0x1000a8b6
lea eax, [ebp + 0x794]
push eax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x74], 0x800
call fcn.10021e04
pop ecx
pop ecx
test eax, eax
js 0x1000a997
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x7c]
push eax
push ebx
push dword [ebp - 0x80]
push dword [ebp - 0x70]
call esi
test eax, eax
jne 0x1000a8b6
push dword [ebp - 0x70]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
call fcn.10021e04
test eax, eax
jne 0x1000a997
lea eax, [ebp - 0x70]
push eax
push 0x20006
push ebx
push dword [0x1002b174]
push SysReAllocString
call edi
test eax, eax
jne 0x1000a859
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push 1
push ebx
push dword [ebp - 0x80]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1000a881
push dword [ebp - 0x70]
call esi
push dword [ebp - 0x78]
push dword [ebp - 0x80]
call fcn.10021e04
pop ecx
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp + 0xf94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c2c7
add ebp, 0xf98
leave
ret
Function at 0x1000c2c7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002b19c]
jne 0x1000c2d1
repz ret
jmp fcn.10011efc

Function at 0x10021e04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10021e13
pop dword [ebp - 0x3c]
mov eax, 0xe7a8063f
add eax, 0x285a17d4
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3d497
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0xecb118a6
add ecx, 0x134f2db5
xor edi, edi
add edi, eax
mov ebx, 0xd388fa13
sub ebx, 0xc385d213
add ebx, dword [ebp - 0x3c]
mov esi, 0x608b6d3c
mov dword [ebp - 0x14], 0x4ab53c38
mov edx, dword [ebx]
sub dword [ebp - 0x14], edx
sub edx, esi
xor dword [ebp - 0x20], ecx
mov dword [edi], edx
add dword [ebp - 0xc], 0x462fe651
add edi, 0x15fb3ae
add edi, 0xfea04c56
add ebx, 4
loop 0x10021e69
add eax, 0xdff96e02
add eax, 0x20079e3d
xor ebx, ebx
add ebx, eax
add eax, 0x58966f4c
add eax, 0xa76990b9
mov ecx, 0x10000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x40a720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xf08dc]
salc
add al, 0x57
jne 0x40a91b
push 0x4107f8
mov dword [0x4107f8], 0xf194
call dword [0x19c020]
mov eax, dword [0xf65c0808]
sub dword [edx + eax + 0xf], 0xffffff85
insb byte es:[edi], dx
add dword [eax], eax
add byte [eax + 0x4108d2], ah
mov esi, 0x6f080c
test al, al
jl 0x40a79e
mov edi, dword [0x5dc168]
or al, 0x68
rol dword [eax], 0x83
cmp byte [ecx], al
push eax
push cs
xor ecx, ecx
push 4
mov cl, byte [esi]
push ecx
call edi
add esp, 8
jmp 0x40a792
mov ebp, 0x8a36c8c0
inc esi
jg 0x40a7e0
test al, al
jne 0x40a769
mov ecx, dword [0xd41080b]
and edi, esp
pop es
inc ecx
add byte [ecx + 0x27], dh
add ecx, dword [edi]
sbb byte [edi + 1], 0
add byte [edi], cl
test byte [eax], cl
mov al, 0
dec esp
adc dword [ebp + 4], 7
inc edx
xor dword [eax + 2], 0x2f
and edi, edi
sub byte [eax], al
add dh, ch
test al, 0x4a
add dword [edi + 0x3e7076], esi
je 0x40a79e
push ds
clc
adc eax, 0xf51bc16c
mov ecx, eax
add esp, 4
mov dword [0x4108e0], ecx
or byte [ecx], al
lodsd eax, dword [esi]
mov edi, 0x2ab80a77
add byte [eax], al
add cl, ch
sbb al, 1
add byte [eax], al
cmp ecx, 3
pop es
or dh, dl
sub eax, dword [eax]
out dx, al
add byte [esi + edi + 1], dl
add byte [eax], al
cmp ecx, 4
ja 0x40a83d
mov eax, 0xb23002c
jmp 0xa740a9d2
add byte [ebx], dh
rol byte [ebx - 0x38f0fe17], 0xc0
add eax, 0x33
jmp 0xa740a8cd
mov edx, dword [ebp + 8]
pop edi
mov dword [edx], eax
mov ebx, dword [edi - 0x24]
or byte [ecx], al
xor eax, eax
cmp esi, 1
invalid
Function at 0x2e014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e0302bf
call fcn.2e00153c
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014b76
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014bdc
lea eax, [ebp - 0x14]
mov edi, 0x2e032941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014bd3
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014bd3
inc eax
push eax
call fcn.2e01963f
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014bc5
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010c49
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e01963f
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001586
ret 8

Function at 0x2e01963f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x2e01964e
pop dword [ebp - 0x18]
mov eax, 0x75575171
sub eax, 0x4755bb23
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xf199e457
add dword [ebp - 0x28], 0x5cb860f4
mov dword [ebp - 0x24], 0xd9c9b982
sub dword [ebp - 0x24], 0xa7966d3d
mov dword [ebp - 0x20], 0x9fb102b6
sub dword [ebp - 0x20], 0x5364be88
mov dword [ebp - 0x1c], 0xe046ba45
sub dword [ebp - 0x1c], 0xe046ba45
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x24e8269b
add dword [ebp - 0x28], 0x4f8a42bb
mov dword [ebp - 0x24], 0x84a2557c
add dword [ebp - 0x24], 0xbcca0bf9
mov dword [ebp - 0x20], 0x4154e1ff
add dword [ebp - 0x20], 0x221a8a6d
mov dword [ebp - 0x1c], 0xad370eda
add dword [ebp - 0x1c], 0x52c8f126
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x6d19e48c
add eax, 0xc0e93c30
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x424e1
push 0
call eax
mov ecx, 0xb7526cf8
sub ecx, 0xb7521fa8
xor edx, edx
add edx, eax
mov edi, 0x2e056e00
add edi, dword [ebp - 0x18]
mov esi, 0x398ebe40
add esi, 0xf493bc87
mov ebx, dword [edi]
add dword [ebp - 0xc], ebx
sub ebx, esi
mov dword [ebp - 4], 0x432e539e
mov dword [edx], ebx
xor dword [ebp - 0xc], 0x3a44f1c5
add edx, 0x9f7c5b0a
sub edx, 0x9f7c5b06
add edi, 4
loop 0x2e019767
add eax, 0x941f5cbd
sub eax, 0x941e34aa
mov ebx, eax
add eax, 0xf5b689c8
add eax, 0xa49763d
mov ecx, 0x32388191
add ecx, 0xfbc77e6f
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10008013
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10008052
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10008052
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10008052
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10008052
cmp dword [ecx + 0x74], 0xe
jbe 0x10008052
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000accf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000ad6c
push ebx
push esi
call fcn.1000ac98
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000ac2c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000ad19
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000ad6b
push edi
push eax
call fcn.1000bc8a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000ad39
call fcn.10009774
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000ad6a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000ac2c
add esp, 0x20
test eax, eax
jne 0x1000ad58
push edi
call fcn.10009774
jmp 0x1000ad60
push ebx
call fcn.10009774
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000afd9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012668
push 0x10012660
push str.FlsAlloc
push 0x1f
call fcn.1000aef5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b00d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10011140]
call esi
jmp 0x1000b013
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000b057
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012678
push 0x10012670
push str.FlsGetValue
push 0x21
call fcn.1000aef5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b08e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10011140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000b096
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012680
push 0x10012678
push str.FlsSetValue
push 0x22
call fcn.1000aef5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b0d0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10011140]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10010750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001077d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001077d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x47a050
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47a07d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47a07d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x47d2a3
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x47d2de
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x47d2c5
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x47d2d6
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x47d2e0
inc edi
add eax, 0x28
cmp edi, esi
jb 0x47d2bb
xor eax, eax
pop edi
pop esi
ret
Function at 0x130090e
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1300938
push word [esp + 3]
jae 0x13008f8
lea esp, [esp + 2]
mov dword [esp + 0x1c], ebp
pushal
pop dword [esp]
mov dword [esp + 0x34], esi
jmp 0x1300964
lea esp, [esp + 2]
mov dword [esp + 0x1c], ebp
pushal
jmp 0x130095d
pop dword [esp]
mov dword [esp + 0x34], esi
call fcn.01300943
add dword [edi + reloc.kernel32.dll_GetProcAddress], edx
mov ah, byte [0x8d6ec754]
or al, 0x32

Function at 0x1300943
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
push word [esp]
jmp 0x1300a0d
js 0x1300aad
push bx
mov dword [esp], edx
lea esp, [esp + 3]
pushal
lea esp, [esp + 3]

Function at 0x13011af
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, dl
jmp 0x1301194
mov eax, edi
push dword [esp + 2]
mov al, 0x41
jmp 0x13011c6
btc ax, bx
jbe 0x130118c
mov ah, dl
mov eax, edi
push dword [esp + 2]
mov al, 0x41
jmp 0x13011c6
rol cl, 0
adc ax, 0x8c4e
jae 0x13011fe
dec al
xchg al, ah
mov eax, dword [esp]
setg ah
not eax
jmp 0x130121a
dec al
jmp 0x13011e8

Function at 0x1301269
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 4], al
jmp 0x130128e
lea esp, [esp + 0xc]
not cl
clc
ja 0x13012fa
jbe 0x13012cc
insd dword es:[edi], dx
jmp [edi + 0xa]
mov ah, 0x15
lea eax, [ebx*4]
btc ax, di
jmp 0x1301307
mov ah, 0x15
lea eax, [ebx*4]
btc ax, di
call fcn.013012b6

Function at 0x130127f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], eax
lea eax, [esi*4]
call fcn.01301269
Function at 0x13012b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], ax
jmp 0x13012db
push bp
mov eax, dword [esp + 3]
lea esp, [esp + 2]
jmp 0x1301323
xchg ecx, eax
jmp 0x1301331
sub bl, cl
rol ax, cl
je 0x130130c
xchg ecx, eax
jmp 0x1301331
dec esi
neg ecx
jle 0x13013c0
bsf ecx, ebp
lea ecx, reloc.kernel32.dll_GetProcAddress
cmc
lea ecx, [edx + ebx]
jmp 0x1301397
mov ax, 0xa552
xchg al, ah
mov ecx, esp
mov eax, 0x62979c4e
jmp 0x13013a0
lea ecx, reloc.kernel32.dll_GetProcAddress
cmc
lea ecx, [edx + ebx]
jmp 0x1301356
mov ax, 0xa552
call fcn.01301381
not ah
neg dl
lea ecx, [ebx + edi]
mov cx, 0xe38d
bsf ax, ax
jmp 0x1301462
bsf ecx, ebp
jmp 0x1301375
rol ecx, cl
bsr ecx, esi
jmp 0x130144c
lea ecx, [ecx - 0x9e]
dec ecx
jmp 0x130146b
rol dl, 0
je 0x130141c
lea ecx, [ecx - 0x9e]
dec ecx
sub esp, 0x18
jmp 0x13014b0
jge 0x1301415
rol ecx, cl
bsr ecx, esi
jmp 0x130141a
sub esp, 0x18
pop ax
mov ecx, dword [esp + 3]
mov al, dl
mov cl, byte [esp + 0xc]
lea esp, [esp + 4]
jmp 0x130149a
lea esp, [esp + 2]
jmp 0x13014b8
pop ax
mov ecx, dword [esp + 3]
jmp 0x1301474
lea esp, [esp + 0x10]
xor dl, 0xd0
call 0x13014c5
call 0x35489c8
jle 0x1301be9
jg 0x13015da
or esp, dword [edx + reloc.kernel32.dll_GetProcAddress]
bts ax, si
jns 0x1301538
lea eax, [esp - 0xe3]
mov ax, 0x96
jmp 0x130151c
lea esp, [esp + 8]
xor dl, 0x79
mov eax, dword [esp]
jmp 0x13014eb
mov eax, edx
call fcn.01301545
adc ebx, dword [ecx + reloc.kernel32.dll_GetProcAddress]
jae 0x1301525
or dword [eax - 0x65], ebp
jae 0x1301525
push 0x573efa0f
fisttp word [edi + 0x2a]
fst dword [edi - 0x4e]
lodsd eax, dword [esi]
mov esp, 0x1d24848d
invalid
lea eax, [esp - 0xe3]
mov ax, 0x96
jmp 0x130151c
neg cx
jbe 0x1301510
ja 0x1301510
shl eax, 2
rcl ch, cl
bts ecx, ecx
jmp 0x13015b2
mov ecx, ebx
call fcn.0130157e
mov cx, bp
xchg ah, ch
jmp 0x1301bee
mov cx, bp
xchg ah, ch
rol dl, 0
setno al
jmp 0x130156d
Function at 0x13014c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], ax
jmp 0x13012db
push bp
mov eax, dword [esp + 3]
lea esp, [esp + 2]
jmp 0x1301323
xchg ecx, eax
jmp 0x1301331
sub bl, cl
rol ax, cl
je 0x130130c
xchg ecx, eax
jmp 0x1301331
dec esi
neg ecx
jle 0x13013c0
bsf ecx, ebp
lea ecx, reloc.kernel32.dll_GetProcAddress
cmc
lea ecx, [edx + ebx]
jmp 0x1301397
mov ax, 0xa552
xchg al, ah
mov ecx, esp
mov eax, 0x62979c4e
jmp 0x13013a0
lea ecx, reloc.kernel32.dll_GetProcAddress
cmc
lea ecx, [edx + ebx]
jmp 0x1301356
mov ax, 0xa552
call fcn.01301381
not ah
neg dl
lea ecx, [ebx + edi]
mov cx, 0xe38d
bsf ax, ax
jmp 0x1301462
bsf ecx, ebp
jmp 0x1301375
rol ecx, cl
bsr ecx, esi
jmp 0x130144c
lea ecx, [ecx - 0x9e]
dec ecx
jmp 0x130146b
rol dl, 0
je 0x130141c
lea ecx, [ecx - 0x9e]
dec ecx
sub esp, 0x18
jmp 0x13014b0
jge 0x1301415
rol ecx, cl
bsr ecx, esi
jmp 0x130141a
sub esp, 0x18
pop ax
mov ecx, dword [esp + 3]
mov al, dl
mov cl, byte [esp + 0xc]
lea esp, [esp + 4]
jmp 0x130149a
lea esp, [esp + 2]
jmp 0x13014b8
pop ax
mov ecx, dword [esp + 3]
jmp 0x1301474
lea esp, [esp + 0x10]
xor dl, 0xd0
call 0x13014c5
call 0x35489c8
jle 0x1301be9
jg 0x13015da
or esp, dword [edx + reloc.kernel32.dll_GetProcAddress]
bts ax, si
jns 0x1301538
lea eax, [esp - 0xe3]
mov ax, 0x96
jmp 0x130151c
lea esp, [esp + 8]
xor dl, 0x79
mov eax, dword [esp]
jmp 0x13014eb
mov eax, edx
call fcn.01301545
adc ebx, dword [ecx + reloc.kernel32.dll_GetProcAddress]
jae 0x1301525
or dword [eax - 0x65], ebp
jae 0x1301525
push 0x573efa0f
fisttp word [edi + 0x2a]
fst dword [edi - 0x4e]
lodsd eax, dword [esi]
mov esp, 0x1d24848d
invalid
lea eax, [esp - 0xe3]
mov ax, 0x96
jmp 0x130151c
neg cx
jbe 0x1301510
ja 0x1301510
shl eax, 2
rcl ch, cl
bts ecx, ecx
jmp 0x13015b2
mov ecx, ebx
call fcn.0130157e
mov cx, bp
xchg ah, ch
jmp 0x1301bee
mov cx, bp
xchg ah, ch
rol dl, 0
setno al
jmp 0x130156d

Function at 0x1340a3c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ebp, 0xffffb1c
test byte [ebx - 1], bl
invalid
lea esp, [esp + 0x20]
dec eax
cmc
push ebp
push dword [esp + 1]
jmp 0x1340a5c
mov byte [esp + 3], dh
lea esp, [esp + 1]
and al, 1
jmp 0x1340a26
cmp byte [eax], cl
jmp 0x1340a6a
cmp eax, esi
lea esp, [esp + 8]
je 0x134097a
jmp 0x1340a46
jne 0x1340964
je 0x134097a
int1
insb byte es:[edi], dx
loop 0x13409ff
je 0x1340a41
stc
fdivr dword [ebx]
adc cl, byte [ebp + 0x244c8a1c]
add al, 0x56

Function at 0x1342230
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
dec ebx
jmp 0x1342248
mov dword [ebp - 8], edi
jmp 0x1342265

Function at 0x1342246
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
neg al
mov eax, dword [esi + 0x1c]
add edi, ecx
jmp 0x134225e
jmp 0x1342227
add eax, ecx
call fcn.01342230
mov dword [ebp - 0x14], eax
push ebp
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x13422a4
lea esp, [esp + 4]
js 0x1340ed1
jns 0x1340f9f
Function at 0x134340a
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
mov eax, dword [ecx + eax*4]
jmp 0x1343414
pushal
pop dword [esp + 0x13]
lea esp, [esp + 0x20]
add eax, dword [ebp + 8]
jmp 0x134343e

Function at 0x1350727
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
test eax, eax
je 0x12f362e
jmp 0x135076e
cmp ax, di
btc eax, edi
jmp 0x1350742
push dword [esp]
jmp 0x13506ff
mov edi, dword [ebp + 8]
rdtsc
neg dx
lea ebx, reloc.kernel32.dll_GetProcAddress
jmp 0x1350752
cld
mov bx, 0x95a8
lea eax, reloc.kernel32.dll_GetProcAddress
not ax
jmp 0x135072c
mov eax, 0xd13b6ba7
cmc
add eax, 0x2ec4ba58
jmp 0x13507ef
pushal
lea eax, reloc.kernel32.dll_GetProcAddress
mov bx, cx
pushfd
mov cx, word [esp]
jmp 0x135070d
popfd
xchg ecx, ebx
cpuid
mov cx, word [esp]
jmp 0x13507d4
mov bp, 0x328c
stosd dword es:[edi], eax
mov ebx, dword [esp]
neg bh
lea edx, [eax + 0xdf]
jmp 0x135077f
mov ebx, ebp
add ebx, 0xfffffff8
mov eax, dword [ebx]
pop ebx
dec cx
jmp 0x1350795
lea eax, [ebp - 4]
call fcn.0135080c
aad 0x4d
frstor dword [edi + edx*2 + reloc.kernel32.dll_GetProcAddress]
sub esp, esi
push ebx
scasd eax, dword es:[edi]
mov dh, 0x61
popal
lea eax, reloc.kernel32.dll_GetProcAddress
jmp 0x13507be
stosw word es:[edi], ax
rdtsc
push ebx
jmp 0x13507af