joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12bcb4a
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
rol eax, 3
shl cx, 0x26
lea eax, [ecx + eax - 0x275d9276]
inc cl
adc dx, cx
xor ebx, eax
xor dx, cx
adc edi, eax
rol edx, cl
mov eax, dword [ebp + edx - 0x40fc0006]
sar cx, 6
mov edx, dword [ebp + edx - 0x40fc0002]
shr cl, 0x63
mov dword [esp], ecx
mov cl, byte [ebp + 8]
shr dword [esp + 2], 0xe5
adc ebp, 5
jmp 0x12be27e

Function at 0x12be054
Capabilities:
Execute syscall

Disassembly:
add ebp, eax
mov dword [esp + ecx - 0x7f], ebp
ret 4
xor eax, 0x8830529
dec byte [esp + 3]
xor ebx, eax
call fcn.0115887d
sysenter
call fcn.00ca585a
sbb byte [ecx - 0x2efff8e3], 0xc8
rol dword [esp], 0xd7
jae 0xd6049e
mov dword [ebp - 4], eax
cld
test ebx, ebx
call fcn.00d6a69b
mov edi, 0xb214ce7e
stc
inc ebp
loop 0x12be0ac
mov byte [edi + 0x1e], ch
je 0x12be057
lea ebx, [esi]
jno 0x12be088
invalid
mov edx, 0x605f1d6f
jne 0x12be0a2
loope 0x12be042
insd dword es:[edi], dx
scasb al, byte es:[edi]
ret
or bl, al
mov eax, dword [0xc26358a6]
sbb byte [edi - 0x46], ch
pushfd
cmp al, 0x26
test dword [edi - 0x6839c3ae], edi
adc al, byte [ebp + 0x4c8a5ac0]
pop edx
mov cl, byte [esi + 2]
add esi, 2
mov edx, 0xebb96299
shr ax, cl
ror dx, 0x62
mov word [esi], ax
movzx ecx, dl
or dx, cx
lea edi, [edi + ecx - 0xaa]
mov eax, edx
ror dl, 0xe5
mov eax, dword [ecx + edi - 0xa6]
adc edx, 0x50afbcb9
shr dl, 0xc7
add dl, ch
xor eax, ebx
sal cl, cl
and dl, dh
lea eax, [eax + edx*2 + 0x7264f6b5]
rol eax, 1
push edx
inc eax
rol eax, 3
push edx
xchg dword [esp + edx*2 - 0x78d22800], edx
and dword [esp + edx - 0x3c6913fc], ecx
xor ebx, eax
neg edx
dec cx
jge 0xd1cc5b

Function at 0x12be238
Capabilities:
Check for software breakpoints

Disassembly:
xor edx, dword [edi + edx*2]
xor edx, ebx
sal al, 7
ror edx, 3
dec ax
not edx
and eax, eax
movsx ecx, ax
dec edx
imul eax, eax
rol edx, 1
shr eax, 0x46
sal ecx, 0xd7
xor ebx, edx
cbw
btc ecx, ecx
adc esi, edx
mov bp, word [eax + ebp - 0x24fffec]
movzx edx, cl
jmp fcn.00d20823
push 0x5035718a
xor edi, eax
call int.0119bd24
std
xor ch, byte [edi - 0x21615642]
cmp al, 0xcc
push 0x5ff7a61a
xor byte [edx + 0x499c5641], ah
mov esi, 0x9aa49303
sbb ecx, esp
movsd dword es:[edi], dword [esi]
sub al, 0x4c
mov esi, dword [esp + 8]
dec eax
mov dword [esp + 8], 0xd4e7ac7f
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.0126663b
shld eax, edx, cl
call fcn.00cc73ae
mov edx, 0x108dc287
bt edx, 0x91
movzx eax, dx
lea edi, [edi + edx*4 - 0x42370a20]
xor edx, edx
jp 0x1211730
cwde
lea ecx, [ecx + edx - 0x22d407c]
bswap ecx
inc ax
jo 0x14bad95
jnp 0xd6c500
dec ecx
sub edx, edx
setge dl
or dx, dx
xor ebx, ecx
shr edx, 0x5c
sal eax, 0x13
add ebp, ecx
add dl, byte [eax + esi - 0xa800000]
mov ecx, eax
xadd ecx, eax
call fcn.012dd736
Function at 0x12c55b7
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
add cx, dx
jnp 0x11ac921
imul ecx, ecx
bswap edx
sub dword [esp], 0xf31ef187
call fcn.011c42ba
lea ecx, [eax*8 - 0x3f4ed500]
cdq
pop edi
lea edi, [edi + edx*2 - 4]
idiv eax
bt edx, edx
xchg cx, ax
xor edx, dword [edi + edx]
shr eax, 0x54
bswap eax
or ax, cx
xor edx, ebx
sar eax, cl
adc edx, eax
xor edx, 0x4799bb96
shr cl, cl
jo 0x11de456
rol edx, 1
inc edx
xor ebx, edx
bts ecx, 0x28
adc ebp, edx
lea edx, [eax*4 - 0x7379c4e4]
add eax, ebp
jmp eax
inc eax
ror edx, cl
bswap ecx
xor ebx, eax
sar ecx, 0xe
adc edi, eax
jmp edi
add al, dh
movzx ecx, ax
mov dx, word [eax + ebp - 0x625ba8]
not ax
mov ax, word [ebp + eax*4 - 0x18a915a]
mov cl, byte [ebp + ecx - 0x5ba4]
jne 0x128046b
mov eax, dword [ebp + ecx*2 - 0xadc]
xor eax, ebx
bswap eax
pop edx
sub eax, 0x9d94541d
ror eax, 2
jmp 0xd3cae0
mov dword [esp + edx - 0x43a78fa1], ecx
jne 0x1236db4

Function at 0x12d016f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
xor eax, ebx
add dl, ch
dec eax
bt cx, cx
not cl
and cx, cx
bswap eax
xchg cx, dx
dec ecx
not eax
neg eax
push edx
xor ebx, eax
and dx, 0x8527
lea edx, [edx + ecx*4 - 0x74c6765f]
bts dx, dx
adc esi, eax
mov dword [esp + ecx - 0x1b807e4d], esi
ret
mov dword [esp + ecx - 3], ecx
ror word [esp + ecx - 2], cl
ror eax, 1
lea eax, [eax + ecx*2 - 0x3b19338e]
ror ecx, cl
not ecx
bt dx, dx
ror eax, 1
sal word [esp + edx - 0xf4fffe], 0xce
or ecx, 0xf02d8d92
shl edx, 0x58
neg eax
inc word [esp + edx*2 + 2]
xor ebx, eax
not ecx
sal cx, 2
ror edx, 0x90
lea edi, [edi + ecx - 4]
and dword [esp + ecx], ecx
ror edx, 0xf3
bswap edx
mov dword [edi + ecx*8], eax
pop ecx
jns fcn.00cb9d91
mov word [ecx + edi - 0x543b21fc], ax
sub ecx, edx
lea edx, [edx - 0x3feda177]
lea ebp, [ebp + edx*2 - 0x788fca0]
mov eax, dword [ebp + ecx*2 - 0x2112046e]
btr cx, dx
shl ecx, cl
jp 0x123eb88

Function at 0x12d1781
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor
Execute anti-debugging instructions

Disassembly:
push 0x79a2fabf
not dword [esp + 8]
shr eax, 8
push 0xef1cea90
push 0xb7b14298
jmp 0x12acfc2

Function at 0x12dd33e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
shr dword [esp + 0xc], 0x25
adc esi, eax
pop eax
xadd cl, dl
push edx
mov eax, dword [ebp]
bt edx, 0x13
add dword [esp + 0xc], edx
setae byte [esp + 0xc]
mov edx, dword [ebp + 4]
jne 0x130c345
sysenter
push esi
mov dword [esp], 0xdabcbbc6
call fcn.01325ea3
mov edx, 0xc39f4915
xadd dl, dh
sbb ebp, 1
movsx eax, dl
jmp 0x129a68a
rol dword [esp + 2], cl
or ecx, ecx
adc ebp, 8
btr cx, cx
mov dword [eax], edx
lea edx, [ecx + 0x2b0cdd02]
mov dword [esp + edx - 0x1d7a3b7f], esi
ret 0xc
Function at 0x12e3f90
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + eax - 0x3efe], 0x4bbc2ba7
shr al, 0x81
bswap edx
mov dword [esp + eax*2 - 0x7cf6], eax
or al, cl
xchg ecx, eax
lea edx, [eax + edx - 0xfad8556]
inc eax
ror edx, 2
inc ecx
xor ebx, edx
lea edi, [edi + eax*2 - 0x184]
imul eax, dword [esp + eax - 0xb4]
sal al, 0xc4
inc dword [esp + eax - 0x2aaafbf6]
mov dword [eax + edi - 0x2aaafc00], edx
movsx edx, cx
shl eax, 0xeb
pop edx
pop eax
pop edx
pop ecx
jne fcn.011b0a0e
mov ecx, 0xe72b951b
not ecx
lea ebp, [ebp + ecx - 0x18d46ae8]
not cx
mov eax, dword [ebp + ecx*4 - 0x6352546c]
xor eax, ebx
sar cx, 0xa6
ror eax, 2
and ecx, 0x7613f503
xor eax, 0x33051711
sub cx, 0x320
movsx edx, cx
sar dl, 0xa2
not eax
bswap eax
setp cl
jb 0xd73ce0
and ecx, 0xed3cf593
xor ebx, eax
bts ecx, ecx
adc esi, eax
rol edx, cl
lea eax, [ecx + edx + 0x1dbf50be]
lea ebp, [ecx + ebp - 0x10f002]
movzx ecx, byte [ebp + ecx*2 - 0x21e002]
inc ax
xor cl, bl
neg dl
rol cl, 1
mul edx
sbb eax, eax
or al, 0x83
adc cl, al
rol cl, 1
add al, ah
adc cl, al
or eax, eax
not cl
xor bl, cl
add ecx, esp
bt ax, ax
btc eax, edx
mov eax, dword [ecx + edx*2 - 0x3ba03e2c]
lea edi, [edx + edi - 0x1dd01f1a]
movsx ecx, dl
shr dx, 0xc1
mov dword [edi + edx - 0x1dd00f8b], eax
jne fcn.00cb9d91
clc
pop esp
popfd
dec dword [edx]
daa
or ah, byte [edi]
ja 0x12e4095
push ebp
rcr dword [ecx], cl
sbb byte [ebx + ecx + 0x63], dl
pxor mm2, qword [edx]
sbb byte [eax + 0x45], 0xb6
mov al, 0x8b
sbb dl, byte [ebx]
jne 0x12e4128
cmp al, 0x46
cmp al, 0x82
xor edx, eax
inc ebx
hlt
leave
movzx edx, cx
xor dl, cl
mov edx, dword [ebp + edx*4 - 0x15400]
mov eax, 0x63867e88
rol ecx, 0x2e
xor edx, ebx
sar al, 0x47
sbb cx, 0x14b7
adc eax, eax
inc edx
xor al, ah
ror cl, 7
shr ecx, 0xaf
xor edx, 0xdf936414
inc edx
dec ax
call fcn.00d420ec
inc bp
xor ecx, esi
dec eax
cwde
jmp 0x130219c
bts esi, 0x17
dec esp
add esi, esp
dec eax
or esi, eax
inc ebx
mov esi, dword [esi + ebp - 0x4e20]
inc ecx
sar ah, 0x21
dec ecx
neg edx
btr cx, 0x9c
dec edx
lea edi, [edi + ebp - 0x4e24]
dec ecx
bt esp, ecx
inc edx
mov dword [edi + ebp - 0x4e20], esi
dec edx
lea esi, [ecx + ebx*2 - 0x52748cc7]
dec ecx
lea ecx, [esp + eax*4 - 0x297b505c]
jb fcn.0126f980
call fcn.0113ff88

Function at 0x12f6177
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
add esi, 4
shrd ax, dx, cl
mov word [esi], ax
pop ecx
pop ecx
pop edx
pop ecx
pop ecx
pop edx
jmp ebp
neg cx
or cl, byte [ecx + esi + 4]
mov dword [esp + 0xc], 0x92a4b2a0
dec word [esp + 4]
jle 0x12cffbf
Function at 0x12f6191
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
btr eax, 0x2a
bt si, 0xad
not edi
add eax, eax
shr eax, 0xed
bswap edi
mov dword [esp + ebp - 0xbacdbfb], eax
xor edi, 0x93104da7
dec edi
shl dword [esp + ebp - 0xbacdbfb], 0x6f
sub ax, ax
sal dword [esp + ebp - 0xbacdbfb], 0x21
adc edi, ebx
inc word [esp + ebp*2 - 0x1759b7f6]
xor si, 0x9931
shr word [esp + ebp - 0xbacdbfb], 0x6d
mov dword [esp + ebp*2 - 0x1759b7d6], edx
mov dword [esp + ebp*8 - 0x5d66dfb4], ecx
sub dword [esp + ebp*4 - 0x2eb36fec], 0x348eb283
lea ebp, [esp + ebp*2 - 0x1759b7f2]
movzx ebx, ax
cdq
lea eax, [eax + ebp - 0xec]
sbb byte [esp + ebx*2 + 1], 0x94
jnp 0xd4742a
mov esp, eax

Function at 0x12f63f7
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
dec ecx
call fcn.0128b589
neg eax
xor ebx, eax
add ebp, eax
rol ecx, 0xf5
mov eax, dword [esi + ecx - 0x20000000]
not cx
sal ecx, 0x16
mov edx, dword [edx + esi - 0xcafc]
jae 0xd79ca4
jp 0xd8fd31
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x12e137f
and cx, 0x18b1
adc cl, byte [esi + 8]
add esi, 6
call fcn.012a960c
jmp 0x15b1a00
mov dword [esp + 8], 0x79064aa1
inc edx
mov dword [esp], 0x472bc829
sar dword [esp + 0xc], 0x67
xor eax, 0xe5b61534
sar dword [esp + 0xa], 0xff
not word [esp + 0xd]
jp 0xd33d4c
std
or al, 0x99
xchg esi, eax
cdq
mov ebp, 0x3be010e8
push 0x5c997fa8
lea esp, [esp + 0xc]
je 0x11f4c88

Function at 0x130ee89
Capabilities:
Encode data using base64

Disassembly:
test eax, eax
lea esp, [esp + 0x10]
je 0xd54d6e
push edi

Function at 0x130f32e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
dec ebx
push 0xffb021b6
mov dword [esp + 8], 0x8c2d9f36
push 0x8ba85e17
lea esp, [esp + 0x10]
jne 0x1182ac8

Function at 0x1310457
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov edx, dword [ebp + ecx - 0x11800000]
mov ecx, dword [ebp + ecx*4 - 0x45fffffc]
js 0xd3d76f
neg al
lea ebp, [eax + ebp + 8]
rol al, 7
mov dword ss:[edx + eax*2], ecx
call fcn.01230eff
mov eax, 0x8e38a83e
mov eax, dword [esi]
mov edx, 0x9f3cdc8c
inc dl
add esi, 4
xor eax, ebx
push edx
neg edx
sal word [esp + edx - 0x60c32372], 0x4b
rol eax, 3
mov ecx, edx
add dword [esp + edx - 0x60c32373], 0x4182d19b
inc eax
rol eax, 1
inc eax
inc ecx
ror cx, 0xc8
rol eax, cl
xor ebx, eax
sal ecx, 0xf7
sub dword [esp + edx - 0x60c32373], edx
setno byte [esp + ecx - 0x11800000]
adc edi, eax
sar byte [esp + ecx*2 - 0x23000000], 0x46
movsx eax, byte [esp + ecx - 0x11800000]
jp 0xcd916c

Function at 0x1328c28
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
je 0x130ee7a

Function at 0x133478f
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
jmp 0xdb2321
lea esp, [esp + 4]
jne 0xda407b
jmp 0xd60262
Function at 0x1343afe
Capabilities:
Encode data using xor

Disassembly:
mov ebp, esp
adc al, 0xdb
popfd
retf
rol eax, 1
shr dword [esp + edx - 0x12cb58fe], 0x11
lea eax, [eax + edx + 0x7940d433]
jp 0x1242032
mov edx, 0xa11d1784
call fcn.012ff924
rcl dword [edi], cl
cwde
sahf
mov byte [0xcf06d8ad], al
dec ebx
sbb al, 0xb1
out dx, al
push eax
and eax, 0xcf3a7fc7
das
loope 0xcf456f
invalid
xor dx, dx
movzx ecx, dx
xor ebx, eax
lea edx, [ecx + ecx*8 + 0x7bbaf0bc]
add ebp, eax
mov esi, dword [esi + edx - 0x7bbaf0bc]
pop edx
jmp fcn.0130cff3
not edx
add al, 0x17
mov dword [esp + edx], 0x640791a2
xor eax, ebx
call fcn.0117f137
lea edi, [edi + eax - 0x74055c37]
mov eax, dword [eax + edi - 0x74055c33]
mov dword [esp], 0x77a42f30
mov edx, dword [esp]
cli
mov ecx, dword [ebx - 0x5c32c77c]
cli
mov eax, edi
inc esp
and al, 0
xor byte [edi], ch
movsb byte es:[edi], byte [esi]
ja 0x1343aa0
push esp
and al, 0
xor eax, ebx
and edx, 0xc9947c36
neg eax
and dl, dl
bswap eax
lea edx, [edx*4 + 0xcbaa83e]
sbb dword [esp + edx*2 - 0x2596b1fc], edx
jge 0xcf45b4
je 0x1343aee
xlatb
mov esi, 0x3e0eff08
sbb esi, ebp
jae 0x1343b03
sbb al, ch
imul eax, eax, 0x6a3c1210
dec edx
sbb byte [eax], 0xd
lodsb al, byte [esi]
push es
or bh, byte [ecx]
in eax, dx
aas
popfd
mov byte [ebx - 0x16], ch
mov ecx, dword [esi - 0x2dbc1ba9]
adc al, 0xf8
retf

Function at 0x14bac2a
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
je 0xc7cbbd

Function at 0x14bb041
Capabilities:
Encode data using base64

Disassembly:
mov edi, 0x6cb72b2a
imul edi, edi
movzx edi, byte [edx + edi - 0x2d5322e4]
xor edi, eax
call fcn.012b6358
push 0x131030a2
lea esp, [esp + 0x1c]
jne 0x12e3f79
mov edx, 0xaa27f29b
pop edi
mov edx, 0x5e97343c
lea ecx, [edx + edx*4 - 0x6477a5d3]
not eax
sal edx, 0x41
dec ecx
push ecx
mov dword [esi + ecx - 0x747c5f58], eax
not dl
inc byte [esp + ecx - 0x747c5f56]
imul ecx, dword [esp + ecx - 0x747c5f58]
sbb edi, 3
call fcn.00d4a8f1

Function at 0x14be387
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.00d063ed
bswap eax
xor ebx, ecx
sar edx, 0x6e
btc dx, ax
adc ebp, ecx
shr edx, 0x12
je 0x14d2916
sar cl, 0xc7
add ebp, edx
mov edx, dword [esp + ecx - 0x79c88cff]
ror byte [esp + ecx - 0x79c88cfd], 0x27
mov si, word [esi + edx*2 - 0x33d6206]
lea eax, [ecx*2 + 0x3081af25]
pop ecx
jae fcn.015b454f
add esi, 6
jmp 0x1291d90
or edx, dword [esi + edx]
mov cl, byte [esi + 4]
add esi, 2
shr edx, cl
push eax
mov dword [esi], edx
lea edx, [eax + 0x54075487]
mov dword [esp + edx - 0xaaa01b], ebp
ret
Function at 0x14c69d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edx + edi - 0x59cafffc]
sbb dx, dx
ror dx, 0x21
mov cl, byte [ecx + esi - 0x29a24d24]
cwde
lea esi, [esi + eax*2 - 0x8c30]
rol al, 0xa1
rol ax, 0x8f
bswap eax
shl dx, cl
lea ecx, [eax + eax*4 - 0x70f71373]
mov word [esi + eax*4 - 0x648c0000], dx
rol eax, 0x81
jmp edi
mov dword [esi + eax - 0x3314e642], ecx
sal eax, 0xf3
mov dword [esi + eax*2 - 0x64600000], edx
movzx ecx, bl
rol dword [esp + eax*2 - 0x64600000], 0xaa
js 0xcf8f05
mov ebx, dword [esp + eax - 0x322ffffc]
pop edx
pop eax
jne fcn.0130cff3
call fcn.00d5c345
add edi, eax
lea ecx, [edx*4 + 0x19a1c4a2]
or ecx, ecx
lea eax, [ecx + ecx*4 + 0x491b74b0]
mov dx, word [esi + edx*8 - 0x20011108]
bswap eax
jae 0xd94750
mov ecx, 0x691efc37
lea edi, [ecx + edi - 0x691efc3b]
mov edx, dword [ecx + edi - 0x691efc37]
lea eax, [ecx + ecx*4 + 0x995ccab]
cwde
xor edx, ebx
sub ecx, ecx
dec edx
not edx
xor edx, 0xf8af0a3d
rol edx, 1
btc ax, cx
add eax, eax
cwde
xor ebx, edx
cwde
and ecx, 0xbe9ce9ac
adc ebp, edx
xadd ecx, eax
xor eax, dword [esi + ecx*2 - 0xe6fc]
mov ecx, dword [ecx + esi - 0x737a]
push ebx
cpuid
push 0x3313e623
inc byte [esp + 2]
js 0x12a6251
sub esi, 8
push 0xfa945433
shl byte [esp + 4], 0xe1
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
mov dword [esi + eax - 0x3314e63e], ebx
pop ebx
jns 0x11db325
pop ecx
xor ebx, eax
jmp 0x11faa29

Function at 0x14d31d7
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov eax, dword [edi + eax*2 - 0x32]
mov dword [esp], ecx
sar ecx, cl
call fcn.01597110

Function at 0x1596522
Capabilities:
Execute syscall

Disassembly:
not dword [esp + 4]
lea esp, [esp + 8]
jne 0xd1f1fe
jmp 0x12e326a
Function at 0x159fddc
Capabilities:
Execute syscall

Disassembly:
mov eax, dword [edx + esi - 0x6f9f708a]
bswap edx
lea eax, [eax + edx - 0x1bf6e406]
adc cl, byte [esp + ecx - 0x49b9050]
jae 0x15a2748
xor ebx, eax
add esi, eax
neg dx
mov dword [esp + ecx - 0x49b9087], esi
ret
mov ecx, 0xfbeac3b
movzx cx, byte [ecx + edx - 0xfbeac3b]
not eax
push eax
lea ebp, [ebp + eax*2 - 0x6e2e564a]
pop edx
mov word [ebp + eax - 0x37172b26], cx
movzx ecx, dx
lea edi, [edx + edi - 0x37172b2a]
dec cl
mul edx
shl ecx, cl
mov edx, dword [edi + eax - 0x1c19c9a4]
xor edx, ebx
or eax, eax
mov dword [ebp], eax
push 0xa2821102
push 0x3d0d04a1
mov dword [esp + 8], 0xbe0da430
mov eax, dword [esi]
mov ecx, 0xea9bb404
push ecx
add esi, 4
xor eax, ebx
call fcn.015947e0
mov eax, 0x49ba41c
movzx edx, al
dec dx
mov dl, byte [edx + edi - 0x1b]
mov ecx, 0xeeb11f1e
setg cl
mov cl, byte [eax + edi - 0x49ba41a]
add ax, ax
add ax, ax
lea edi, [eax + edi - 0x49b906e]
push eax
and ax, word [esp + eax - 0x49b9070]
xor al, byte [esp + eax*8 - 0x24dc837f]
shr dl, cl
dec eax
mov ecx, eax
mov word [eax + edi - 0x49b90df], dx
and dword [esp + eax*2 - 0x93721be], ecx
ror eax, cl
movzx edx, al
lea ebp, [ebp + eax*2 - 0x126e4380]
div dword [esp + eax - 0x93721be]
inc ecx
bswap edx
mov eax, dword [ebp + eax*4 - 0xa4f8]
jl 0xc7dfe6
shl cx, 0x23
not edx
xor eax, ebx
xadd dword [esp + ecx*2 - 0x9370e00], ecx
jl 0x12dce8e
dec dl
bswap eax
neg eax
ror dword [esp + ecx*8 - 0x24dc8280], cl
jae 0xcff58d
mov eax, 0x9019f10d
mov edx, eax
call fcn.011f2329
sub edx, 0xb41b3b
not eax
xor byte [esp + ecx - 0x49b9087], 0x30
sal dx, 0x8f
jbe 0xd2914c

Function at 0x15a44d5
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
mov edx, 0x72900228
and eax, ecx
pop ecx
jne fcn.015a46db
shld dx, ax, cl
pop eax
inc eax
mov word [esi + eax*2 - 0x1f0], dx
jmp ebp
rol al, 0xe5
xor ebx, ecx
add ebp, ecx
xor dx, word [esi + eax - 0x76b967f7]
movzx ecx, al
sub al, ah
mov ax, word [esi + ecx*8 - 0x7b6]
push ecx
sal cl, 6
dec cl
mov cl, byte [esi + ecx - 0xbb]
adc esi, 3
neg word [esp + 1]
jae 0xda9385
mov ebp, dword [ebp + eax - 0xfe7f3df]
jnp 0xca48fc
rol edx, 2
cwde
bts cx, ax
mov dword [esp], 0x3a9f06aa
sbb edx, 0x2f964b0f
add ecx, eax
xor edx, 0x60b3533e
sar ecx, cl
shr dword [esp], 0xe7
and eax, ecx
ror edx, 2
sub edx, 0xfe2ba99d
neg edx
xchg cx, ax
inc edx
sal eax, 0x8b
ror edx, 2
inc eax
sub edx, 0xb3835438
add eax, dword [esp]
bt ax, cx
xor ebx, edx
btr ax, ax
inc ecx
shr eax, 0x24
add edi, edx
dec eax
jo 0x12be5e2
jge 0x13161f5

Function at 0x15a4a2d
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov eax, dword [edi + ecx - 0x59]
sub dx, 0xe437
xor eax, ebx
inc eax
not eax
ror eax, 1
not eax
mov dword [esp + ecx*4 - 0x164], edx
btr ecx, edx
xor ebx, eax
xchg ecx, edx
call fcn.012442bc
btr dx, dx
xor ecx, 0xda037d37
call fcn.012dbb6b
Function at 0x15ab1cd
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
adc edi, 8
mov dword ss:[edx], ecx
xchg dword [esp + 4], eax
mov ecx, 0xe404a23b
pop eax
pop ecx
jmp esi
add esi, edx
mov dword [esp], 0x6b8efba3
add word [esp + 5], 0xdcab
cwde
mov edx, dword [edi]
xor ecx, 0x5d127bb5
mov ecx, dword [edi + 4]
js 0x11adfab
Function at 0x15b0b61
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [eax]
lea eax, [edx + edx*8 - 0x60e09a66]
cwd
cwde
mov dword [edi + eax*4 - 0x94e8], ecx
xor ax, ax
lea ebp, [eax + ebp - 4]
mov ecx, 0xf715ec0a
ror al, 0x42
mov ecx, dword [eax + ebp]
mul eax
shr eax, 0x41
xor ecx, ebx
rol ecx, 2
not eax
lea ecx, [ecx + edx*2 + 0x6fa281af]
cdq
and dl, dh
bts eax, eax
ror eax, cl
rol edx, 1
shl cl, 3
cmovae ax, word [esp + eax - 0x509fbadf]
bswap eax
xor edx, 0xcb8c9726
neg byte [esp + eax - 0x4ea89f4f]
inc word [esp + ecx - 0x57b1fff8]
dec edx
ror al, 0x22
neg edx
rol edx, 1
shl word [esp + ecx - 0x57b1fff7], 0xeb
dec edx
xor ebx, edx
inc ax
add edi, edx
inc cl
movzx edx, cl
mov edx, dword [ecx + ebp - 0x57b1fff9]
not ax
btc ax, 0x80
dec eax
mov cl, byte [ebp + ecx - 0x57b1fff5]
sbb eax, 0xfa07ba9
or al, ah
lea ebp, [eax + ebp - 0x3f07e5e3]
shl eax, 0x43
sal eax, 0x68
sbb eax, 0x6076618
shl edx, cl
movsx ecx, word [esp + eax - 0x3927c1e8]
rol word [esp + ecx - 0x71], 0xa7
mov dword [ebp + ecx - 0x71], edx
mov dword [esp + eax*2 - 0x724f83d0], edi
ret
neg eax
call fcn.0120338e
mov edx, 0xac1e6ea0
and dx, 0x6bb4
mov eax, dword [edi]
jno 0xcbb2c5
mov ecx, 0x57b1dd90
mov eax, ecx
mov edx, dword [esi + eax - 0x57b1dd90]
neg al
lea esi, [esi + eax - 0x57b1dd6c]
xchg ecx, eax
not eax
xor edx, ebx
btr eax, eax
xadd cx, ax
push eax
sbb edx, 0x4a9fa89f
jmp 0x12a6c8a

Function at 0x15ba2b9
Capabilities:
Execute syscall

Disassembly:
neg ecx
xor dl, bl
push ecx
sub dl, 0x21
xor dl, 0xbe
push ecx
pop ecx
push ecx
inc dl
xor dl, 0xaf
xor dword [esp + 1], ecx
neg ecx
setbe byte [esp + ecx - 0x480735fd]
xor bl, dl
not ecx
sar dword [esp], cl
sal ecx, cl
lea edx, [esp + edx + 0xc]
rol cx, 0xa
mov dword [edx + ecx - 0x80000000], eax
ror word [esp + ecx - 0x7ffffffc], 0x4e
Function at 0x406520
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x4066f0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
xor eax, eax
mov ecx, 0x41
mov edi, esi
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40676b
lea ecx, [esp + 8]
push ecx
push esi
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x24]
push str.ProgramFilesDir
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x14]
push ecx
mov byte [esi + 0x104], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esi], 0
jne 0x40678c
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Program_Files
push esi
mov byte [esi + 2], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
pop edi
pop esi
add esp, 8
ret 4

Function at 0x4069b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4069c9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4069dd
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4069fe
cmp esi, eax
jae 0x4069d7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4069f0
cmp esi, eax
jae 0x4069d7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret