joyce8/EMBER2024-capa huggingface dataset:
Function at 0x950450
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x95046e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x950463
pop esi
ret

Function at 0x953b0a
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00953b89
jae 0x953b16
xor ecx, ecx
call fcn.00953b89
jae 0x953b40
xor eax, eax
call fcn.00953b89
jae 0x953b51
mov al, 0x10
call fcn.00953b89
adc al, al
jae 0x953b32
jne 0x953b7e
stosb byte es:[edi], al
jmp 0x953b17
call fcn.00953b95
dec ecx
loop 0x953b5d
mov eax, ebp
call fcn.00953b93
jmp 0x953b7f
lodsb al, byte [esi]
shr eax, 1
je 0x953ba5
adc ecx, 2
mov ebp, eax
jmp 0x953b7f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00953b93
cmp eax, 0x7d00
jae 0x953b7d
cmp eax, 0x500
jae 0x953b7e
cmp eax, 0x7f
ja 0x953b7f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x953b17
pop ebp
ret 8

Function at 0x991f49
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.00ad27ba

Function at 0x9ba20f
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
mov eax, dword [eax + 4]
test edi, 0x66113c46
cmp eax, 0x42792bda
add eax, 8
push eax
call fcn.0094eadc
pop ecx
pop esi
mov bx, dx
xchg bx, di
mov edi, eax
movsx ebx, cx
bswap bx
mov bx, 0x331a
rep movsb byte es:[edi], byte [esi]
not bl
sete bl
bswap esi
pop edi
pop esi
movzx cx, ah
stosd dword es:[edi], eax
bswap cx
movsx ebx, bp
cbw
mov ecx, 3
movsx ebx, cx
rep movsd dword es:[edi], dword [esi]
pop eax
sbb edi, edi
pop edi
mov dword [edi], eax
rcl bh, cl
shr ebx, cl
cmp ebp, eax
mov ebx, dword [ebp - 0x70]
clc
push ebx
cmp edi, 0x29803894
jmp 0x9b8f80
add ebx, 4
stc
clc
push ebx
test sp, 0x440e
mov ebx, dword [ebx]
test ebx, ebx
je 0x9b8fa0
push ebx
call fcn.0094ead6
add esp, 4
xchg bl, bl
pop ebx
call fcn.0094ead6
add esp, 4
cwde
not ax
push dword [esp + 0x30]
popfd
lea esp, [esp + 0x40]
call fcn.00995963
stosd dword es:[edi], eax
movzx ax, cl
lodsd eax, dword [esi]
push esi
clc
cmc
push edi
clc
test sp, bx
test eax, 0x3e303414
test eax, eax
je 0x9af482
push eax
jmp 0x9af44e

Function at 0xa0aaac
Capabilities:
Authenticate hmac

Disassembly:
mov dword [ebp - 4], 0
jmp 0xa9111b
stosd dword es:[edi], eax
lodsd eax, dword [esi]
jmp 0xa6a5fa
push ebp
mov ebp, esp
sub esp, 0x98
jmp 0x9d8af7
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x9d724d
stosd dword es:[edi], eax
jmp 0xa6c78d
mov dword [ebp - 0xc], 0
jmp 0xa202fb
push 8
call fcn.0094eadc
add esp, 4
xchg di, si
movsx edi, cx
mov dword [ebp - 8], eax
movsx esi, bp
mov edi, eax
cbw
mov esi, 0x95323e
movsx ax, dh
lodsd eax, dword [esi]
jmp 0xa08869
Function at 0xad39aa
Capabilities:
Authenticate hmac

Disassembly:
push esi
pushfd
mov esi, 0x149741e
call fcn.00a6a3ea
Function at 0xafc1b2
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
xor dword [esp + 0xc], 0x1b9e1148
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.00a6aa05
push esi
jne 0xa0ee59
cmc

Function at 0xb06693
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x20]
call fcn.009d6b0b

Function at 0xb08071
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
mov dword [esp + 4], 0xfd091814
pushfd
call fcn.00934bf7
Function at 0x9dccd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9dcd1c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9dcce2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9dcd80
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9dcdd2
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9dcdd8
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9f52c5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f4f85

Function at 0x9fa0bf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f9f3e

Function at 0x9ff670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x9ff69d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x9ff69d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x29a4404e
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x79cb7ffe
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x135ccc77
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x35be5b8
jmp 0x135cccf1
mov byte [esp], bl
push word [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 4], ebp
push ecx
jmp 0x135ccc99
push dword [esp + 1]
js 0x135ccc60
jns 0x135ccd4c
lea esp, [esp + 2]
mov dword [esp + 8], esi
pushfd
mov byte [esp + 2], al
push dword [esp]
jmp 0x135ccca3
push word [esp + 3]
call 0x135ccc83
je 0x135cccb9
mov word [esp + 5], dx
pop word [esp + 1]
jmp 0x135cccce
mov word [esp + 5], dx
pop word [esp + 1]
pop word [esp + 1]
jmp 0x135ccd07
pop word [esp + 1]
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x135ccd0f
mov dword [esp + 4], ebp
push ecx
jmp 0x135ccc99
jmp 0x135ccd2b
mov dword [esp + 8], edi
lea esp, [esp + 8]
pushfd
jmp 0x135ccbf4
sub esp, 0x15
push dword [esp + 0xb]
lea esp, [esp + 1]
jmp 0x135ccdb7
bswap ebp
bsf ecx, esi
ja 0x135ccd15
sub esp, 0x15
call 0x135ccd5a
mov byte [esp], bl
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x135cccea
mov esi, dword [esp + 0x44]
stc
jmp 0x135cce98
mov dh, 0xab
lea edi, [esp + 0x18]
call fcn.135cce2f
pushfd
xor dl, byte [ebp - 0x5c]
and ebp, dword [ecx - 0x17]
jns 0x135ccdef
jmp 0x135cce35
out 0x65, eax
cmc
pushfd
outsd dx, dword [esi]
fst qword [edi]
xchg esi, eax
add al, 0x63
sahf
and byte [edi - 0xe7c6d2], al
xor al, 0x24
jne 0x135ccdc2
mov dh, 0xab
call 0x135ccdf8
invalid
lea edx, reloc.KERNEL32.DLL_IsDebuggerPresent
push di
push esp
xchg bx, ax
mov bx, cx
jmp 0x135ccf15
sub esp, 4
rdtsc
xchg byte [esp + 2], bl
lea ebx, [ecx + ecx]
jmp 0x135cceff
lea edx, [ebx + ebp]
stc
js 0x135ccede
sub esp, 4
jmp 0x135ccf2b
lea esp, [esp + 4]
add esi, 0x700ce469
clc
jmp 0x135ccf56
setb dl
lea esp, [esp + 2]
lea esp, [esp + 4]
add esi, 0x465651eb
setg bl
jmp 0x135ccef4
rdtsc
xchg byte [esp + 2], bl
lea ebx, [ecx + ecx]
jmp 0x135cceff
jp 0x135ccf6c
xor ax, bx
xor eax, ebx
or dx, dx
jmp 0x135ccf91
xor ax, bx
or dx, dx
add dx, dx
dec esi
pushfd
lea edx, reloc.KERNEL32.DLL_IsDebuggerPresent
bswap eax
call fcn.135cd4fa
push ecx
fdiv qword [edx + 0x15]
in al, 0x22
mov ecx, 0x2bd8b929
jmp 0x135ccf59
add dx, dx
jmp 0x135ccf75
Function at 0x135ccc83
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x35be5b8
jmp 0x135cccf1
mov byte [esp], bl
push word [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 4], ebp
push ecx
jmp 0x135ccc99
push dword [esp + 1]
js 0x135ccc60
jns 0x135ccd4c
lea esp, [esp + 2]
mov dword [esp + 8], esi
pushfd
mov byte [esp + 2], al
push dword [esp]
jmp 0x135ccca3
push word [esp + 3]
call 0x135ccc83
je 0x135cccb9
mov word [esp + 5], dx
pop word [esp + 1]
jmp 0x135cccce
mov word [esp + 5], dx
pop word [esp + 1]
pop word [esp + 1]
jmp 0x135ccd07
pop word [esp + 1]
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x135ccd0f
mov dword [esp + 4], ebp
push ecx
jmp 0x135ccc99
jmp 0x135ccd2b
mov dword [esp + 8], edi
lea esp, [esp + 8]
pushfd
jmp 0x135ccbf4
sub esp, 0x15
push dword [esp + 0xb]
lea esp, [esp + 1]
jmp 0x135ccdb7
bswap ebp
bsf ecx, esi
ja 0x135ccd15
sub esp, 0x15
call 0x135ccd5a
mov byte [esp], bl
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x135cccea
mov esi, dword [esp + 0x44]
stc
jmp 0x135cce98
mov dh, 0xab
lea edi, [esp + 0x18]
call fcn.135cce2f
pushfd
xor dl, byte [ebp - 0x5c]
and ebp, dword [ecx - 0x17]
jns 0x135ccdef
jmp 0x135cce35
out 0x65, eax
cmc
pushfd
outsd dx, dword [esi]
fst qword [edi]
xchg esi, eax
add al, 0x63
sahf
and byte [edi - 0xe7c6d2], al
xor al, 0x24
jne 0x135ccdc2
mov dh, 0xab
call 0x135ccdf8
invalid
lea edx, reloc.KERNEL32.DLL_IsDebuggerPresent
push di
push esp
xchg bx, ax
mov bx, cx
jmp 0x135ccf15
sub esp, 4
rdtsc
xchg byte [esp + 2], bl
lea ebx, [ecx + ecx]
jmp 0x135cceff
lea edx, [ebx + ebp]
stc
js 0x135ccede
sub esp, 4
jmp 0x135ccf2b
lea esp, [esp + 4]
add esi, 0x700ce469
clc
jmp 0x135ccf56
setb dl
lea esp, [esp + 2]
lea esp, [esp + 4]
add esi, 0x465651eb
setg bl
jmp 0x135ccef4
rdtsc
xchg byte [esp + 2], bl
lea ebx, [ecx + ecx]
jmp 0x135cceff
jp 0x135ccf6c
xor ax, bx
xor eax, ebx
or dx, dx
jmp 0x135ccf91
xor ax, bx
or dx, dx
add dx, dx
dec esi
pushfd
lea edx, reloc.KERNEL32.DLL_IsDebuggerPresent
bswap eax
call fcn.135cd4fa
push ecx
fdiv qword [edx + 0x15]
in al, 0x22
mov ecx, 0x2bd8b929
jmp 0x135ccf59
add dx, dx
jmp 0x135ccf75

Function at 0x135cce2f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ebx + 0x6e]
pop edx
jmp 0x135cce74
sub esp, 0xa8
mov ebp, esp
mov ebx, dword [esp]
sub esp, 0x1a
jmp 0x135cced3
xchg ebx, eax
rdtsc
setg bh
mov al, byte [esp]
mov dl, 0x97
not bh
jmp 0x135ccea5
jge 0x135ccf48
sub esp, 0xc
lea esp, [esp + 2]
jmp 0x135ccf4f
sub esp, 0xc
lea esp, [esp + 2]
mov ecx, esi
jmp 0x135ccebb
Function at 0x135d4410
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, ebp
sub esp, 0x1c
jmp 0x135d444b
lea esp, [esp + 0x38]
dec ebp
mov edx, ecx
mov bl, byte [esp]
jmp 0x135d4435
lea eax, reloc.KERNEL32.DLL_IsDebuggerPresent
lea edx, [eax + ebx]
mov bh, byte [esp]
jmp 0x135d444f
jp 0x135d441b
jnp 0x135d441b
sub ebp, 0x25e48fa9
mov edx, 0x649404c2
bt eax, edx
js 0x135d44ec
jns 0x135d44a2
xchg ebx, eax
pop ds
invalid
lea ebx, [ecx*4]
bt dx, bp
jne 0x135d44bd
sub esp, 3
jmp 0x135d44a7
sub esp, 0xc
jmp 0x135d44ef
mov ebx, edi
not edx
lea esp, [esp + 3]
jmp 0x135d44c8
sub esp, 3
mov ebx, edi
not edx
lea esp, [esp + 3]
jmp 0x135d4562
mov edx, ecx
xchg bh, dl
add bx, 0xc4c4
add ebp, dword [edi]
btr dx, bp
jmp 0x135d4532
sub esp, 0xc
lea esp, [esp + 0xc]
dec ebp
bswap ebx
mov eax, 0x77a13b7
jmp 0x135d4486
bsr ax, di
rdtsc
or dx, sp
jmp fcn.135d453c
xchg bh, dl
add bx, 0xc4c4
jmp 0x135d44d6
or dx, sp
jmp fcn.135d453c
jnp 0x135d44fd
bsr ax, di
rdtsc
jmp 0x135d451c
rol ebp, 0
adc bx, ax
jns 0x135d44cd
mov edx, ecx
jmp 0x135d4513

Function at 0x135f6563
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
jmp 0x135f655f
pushal
pop word [esp + 0x11]
mov word [esp + 9], si
lea esp, [esp + 2]
jmp 0x135f6621
lea esp, [esp + 4]
jmp 0x135dd8cf
lea edx, [edx*4]
cmc
mov eax, ebx
jmp 0x135f6582
lea esp, [esp + 4]
push ebp
mov ebp, esp
mov dx, word [esp]
jmp 0x135f6549
mov ecx, dword [ebp + 8]
mov edx, dword [esp]
cmc
xchg dh, al
sub esp, 0xc
jmp 0x135f65e5
sub esp, 0x18
clc
mov ah, 0xfd
mov eax, 0xd75c313a
jmp 0x135f656c
mov edx, 0x10b
cmc
clc
pushfd
jmp 0x135f660b
setl dl
add eax, ecx
mov edx, 0xe2452eab
mov dx, cx
jmp 0x135f65b2
mov eax, dword [ecx + 0x3c]
setb dh
lea esp, [esp + 0xc]
and dword [ebp - 0xc], 0
jmp 0x135f65c8
lea esp, [esp + 8]
je 0x135f63db
mov al, byte [esp]
rcl al, cl
clc
jmp 0x135f661a
lea esp, [esp + 4]
cmp word [eax + 0x18], dx
pushfd
push dword [esp + 3]
jmp 0x135f65f5
xor eax, eax
jmp 0x135f676a
lea esp, [esp + 0x1c]
push esi
push edx
jmp 0x135f6654
mov edx, eax
add edx, 0x78
mov esi, dword [edx]
pop edx
call 0x135f6662
inc eax
mov byte [esp], ah
jmp 0x135f66a8
add esi, ecx
push ebp
mov ebp, eax
jmp 0x135f6692

Function at 0x136939af
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x24], eax
jmp 0x13693955
jmp 0x13693a8b
add ebx, 0xf42ca683
jmp 0x1369393d
lea esp, [esp + 2]
popfd
ret
je 0x136939a1
jne 0x135b97db
or eax, dword [esi + reloc.KERNEL32.DLL_IsDebuggerPresent]
cmpsd dword [esi], dword es:[edi]
cmp ebp, dword [ebx - reloc.KERNEL32.DLL_IsDebuggerPresent]
jmp 0xbab934c2
cmp ebx, 0xf42ca74f
jmp 0x13693927
popal
inc dword [esp + 8]
push si
mov byte [esp], ch
jmp 0x13693921
add byte [eax], al
add byte [ebp + 0x53], dl
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
cmp eax, 0xeb3c6671
dec esi
in al, dx
jg 0x136939a9
mov bh, byte [ecx + 0x2e]
retf 0xc650
pop ecx
sub ecx, fcn.135b981d
mov dword [ecx + 0x13693884], eax
movzx ebx, byte [eax]
jmp 0x1369390b
Function at 0x1369bd8a
Capabilities:
Encode data using xor

Disassembly:
call 0x136998b3
jmp 0x1369a372
mov word [esp + 0x19], sp
lea esp, [esp + 0x1e]
lea esp, [esp + 2]
lea esp, [esp + 4]
push 0
jmp 0x1369a368
pushal
push edi
jmp 0x1369a345
pushfd
cmp dword [esp + 4], 0
jne 0x1369a38f
je 0x1369a3a5
pop eax
sub eax, 0xd3a5ae88
jmp 0x1369a3ab
jmp 0x1369a400
pushal
jmp 0x136998ae
call 0x1369a3bb
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add cl, ch
add byte [ecx], al
add byte [eax], al
call 0x1369a3c5
jmp 0x1369bb7d
inc dword [esp + 8]
popfd
ret
call 0x1369a454
jmp 0x1369bd53
call 0x1369bb60
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
and byte [eax + ebx*8], cl
push cs
jmp 0x1369bd1d
pop eax
sub eax, 0xee6283e
jmp 0x1369bb50
inc dword [esp + 8]
popfd
ret
call 0x1369bd2f
inc edi
je 0x1369bd73
outsb dx, byte gs:[esi]
jne 0x1369bd7d
je 0x1369bd8d
je 0x1369bd93
add cl, ch
add eax, 0x60fffffe
jmp 0x1369a44f
pop eax
sub eax, 0x4a141868
jmp 0x1369bd7a
out dx, eax
pushal
jmp 0x1369a3c0
call 0x1369bd8a
add byte [eax], al
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
mov ebx, 0xeb4a05fb
leave
bnd je 0x1369bd7f
sti
add eax, 0xf2c9eb4a
je 0x1369bd7f
lea edi, [ebp + edx*4 - 0x1c]
popal
int1
nop
arpl word [ecx - 0xa659ce0], ax
in al, 0x9c
cmp dword [esp + 4], 0
jne 0x1369be68
je 0x1369bd74
jmp 0x1369bbbe

Function at 0x1369bed0
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1369a5a9
push eax
call fcn.135c2229
jmp 0x1369a5a4
jmp 0x1369be87

Function at 0x1369bf3f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [eax*4]
mov dword [esp], ecx
mov dword [esp], ecx
lea ebp, [esi*4]
jmp 0x1369c1dc
mov di, 0xb575
mov di, 0xdf35
pop ebp
lea edi, [ebp*4]
call fcn.1369bf6c
pop ecx
lea ebp, [edx + 0x74]
mov ebp, eax
mov edi, 0x3caf233f
mov di, 0xb494
mov ebp, dword [esp]
jmp 0x1369bf82
bswap ebp
bswap ebp
mov bp, word [esp]
lea ebp, [ebp*4]
not cx
mov bp, sp
jmp 0x1369c00b
Function at 0x1369bfc5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push dword [esp + 0x1c]
push word [esp + 0xb]
lea esp, [esp + 2]
jmp 0x1369bfe3
lea esp, [esp + 0x24]
push 0
pushfd
push eax
pushfd
jmp 0x1369bff5
mov byte [esp], cl
mov ax, word [esp + 1]
setl ah
push word [esp + 2]
jmp 0x1369c038
pushal
lea edx, [esi*4]
mov edx, ecx
rdtsc
mov dword [esp + 0x14], edi
jmp 0x1369c061
mov eax, edx
lea esp, [esp + 2]
mov dword [esp], edx
mov edx, dword [esp]
mov eax, edx
setge dh
jmp 0x1369c022
lea edi, [edx*4]
not dl
mov edi, dword [esp + 0x14]
mov edx, dword [esp]
jmp 0x1369c0ad
rdtsc
rdtsc
rdtsc
mov edi, dword [esp]
lea edx, reloc.KERNEL32.DLL_IsDebuggerPresent
not al
jmp 0x1369c04b
jmp 0x1369c171
mov edx, dword [esp + 0x20]
mov ah, dh
mov eax, dword [esp]
setns ah
jmp 0x1369c0da
lea edx, [ecx*4]
xchg dl, ah
mov edx, dword [esp]
setg dl
mov dx, word [esp]
mov dl, 0x54
jmp 0x1369c097
jne 0x1369c081
je 0x1369c106
rcl byte [esi - 0x3c], cl
mov dword [reloc.KERNEL32.DLL_IsDebuggerPresent], eax
pop ebx
int 0x22
out dx, al
stc
fdivr dword [ebx]
adc cl, byte [ebp + 0x4424848d]
invalid
lea eax, reloc.KERNEL32.DLL_IsDebuggerPresent
mov eax, dword [esp + 0x24]
lea esp, [esp + 0x28]
cmp dword [esp + 4], 0
jmp 0x1369c0c4
pushal
jmp fcn.1369a5c9
inc dword [esp + 8]
jmp 0x1369c1ad
popfd
ret

Function at 0x1372c058
Capabilities:
Parse pe header

Disassembly:
pop word [esp]
push word [esp]
push word [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 4], esi
call fcn.1372bfd8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x328a6e2f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x904304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x13a65fea
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0xb941b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00b94140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00b94140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00b94140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00b94140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xb94bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb94c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xba687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xb94c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xb94c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x4120e1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41210f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41212d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00412047
jmp 0x41212d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41212d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00412047
test edi, edi
mov eax, edi
jne 0x412117
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5d18c1
Capabilities:
Encode data using xor

Disassembly:
fucomp st(3)
xor edi, ecx
mov ds, word [edx + edx*4 - 0x605386b0]
and dl, dh
add dword [ecx - 0x684f561c], ebp
test eax, 0x91d097b0
add byte [ebx], dh
and ah, bl

Function at 0x651323
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xc8
mov edi, dword [ebx]
das
mov byte [0xa11da865], al
sub bl, byte [esp + edi - 0x24bb9892]
mov cl, 0xe1
mov bl, 0x1c
sbb byte [edi - 0x6e8800c8], cl
push dword [edi - 0x6f]
or bh, byte [edi + 0x28823cc2]
les edi, [0xb18aec1f]
jbe 0x651375
mov ecx, dword [esi]
mov dword [0x1d21546f], eax
and dword [eax - 0x17], ebx
dec esp
stc
and bh, cl
xor dl, byte [esi - 0x40ad4c84]
and dword [edx + 0x5f625ff2], 0xffffffc0
stc
cli
fadd qword [edi + 0xf21a2e1]
jnp 0x65133b
sbb eax, 0xbd4bccd4
mov ebx, 0x7db06c1e
mov ebp, 0xb06c1ebb
jge 0x65137b
inc dword [ebx]
xchg edx, eax
loop 0x6513c1
add edx, dword [edx + 0x78e341e2]
jecxz 0x6513fa
loop 0x6513ec
mov byte [0xec822eb5], 0xa3
sub eax, 0x7db42ad0
cmp byte [ecx + 0x5c], 0x2f
inc edx
pop ecx
or dword [ecx], edx
jmp dword [ecx + 0x33]
outsb dx, byte [esi]
add eax, dword [0xd80108c0]
dec esi
dec esp
jl 0x6513db
mov ecx, ecx
mov dh, 0x69
adc al, 0xfa
adc byte [edi + 0x7272ef24], dh
aas
pop ecx
test al, 7
aas
xor bh, al
jno 0x6513e2
jmp 0x65142d
cmp ebp, edx
xchg ecx, eax
imul eax, ecx, 0xf42fd9cf
test dword [ecx - 0x48101dc1], esp
aas
mov bh, 0x3f
inc ecx
dec edx
call 0xe4b5cc6f
sub ch, bl
and dh, bh
push ds
and al, 0x1f
and byte [eax], 0x71
invalid
cmp byte fs:[ecx], dh
mov bl, 0x49
cmp eax, 0x95c5621c
adc eax, 0xbf50ac7d
sub ebp, dword [eax]
mov dl, 0xdd
pop es
xchg edi, eax
mov dword [edx + esi*2], esi
mov eax, 0x152f048c
inc dword [ebx]
pop ds
imul edi, dword [ecx - 0x36], 0xffffff92
invalid