joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421fc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
or ebp, 0xffffffff
jmp 0x421fe2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421fe9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421fd8
mov eax, 1
add ebx, ebx
jne 0x421ffb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x421ff0
jne 0x42200c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421ff0
xor ecx, ecx
sub eax, 3
jb 0x422020
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x422092
mov ebp, eax
add ebx, ebx
jne 0x42202b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x422038
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42205c
inc ecx
add ebx, ebx
jne 0x422048
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42203d
jne 0x422059
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42203d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42207c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42206d
jmp 0x421fde
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42207c
add edi, ecx
jmp 0x421fde
pop esi
mov edi, esi
mov ecx, 0x558
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42209a
cmp byte [edi], 5
jne 0x42209a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42209f
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x422117
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x22238]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x222a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4220cc
mov ecx, edi
jns 0x4220fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x222ac]
or eax, eax
je 0x422111
mov dword [ebx], eax
add ebx, 4
jmp 0x4220e9
call dword [esi + 0x222a8]
mov ebp, dword [esi + 0x222b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42214b
sub esp, 0xffffff80
jmp 0x40473a

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x100363f0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x54
mov eax, dword [esp + 0x64]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x44], eax
mov eax, dword [0x1005fce8]
mov dword [esp + 0x48], eax
mov ecx, dword [0x1005fce4]
mov dword [esp + 0x4c], ecx
add eax, 0xb7abdfb6
sub eax, 1
sub eax, 0xb7abdfb6
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x48]
imul eax, ecx
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x3c]
and eax, 1
cmp eax, 0
sete al
mov byte [esp + 0x39], al
cmp ecx, 0xa
setl cl
mov byte [esp + 0x3a], cl
and al, cl
mov byte [esp + 0x3b], al
mov cl, byte [esp + 0x3a]
mov al, byte [esp + 0x39]
xor al, cl
mov byte [esp + 0x38], al
mov cl, byte [esp + 0x38]
mov al, byte [esp + 0x3b]
or al, cl
mov byte [esp + 0x37], al
mov al, byte [esp + 0x37]
test al, 1
jne 0x1003648a
jmp 0x10036602
mov eax, dword [esp + 0x40]
add eax, 0x16
mov dword [esp + 0x2c], eax
mov eax, dword [0x1005e324]
add eax, 0xf05c1a4b
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
cmp dword [eax], 1
sete al
mov byte [esp + 0x1f], al
mov eax, dword [0x1005fce8]
mov dword [esp + 0x20], eax
mov ecx, dword [0x1005fce4]
mov dword [esp + 0x24], ecx
add eax, 0x1db9d6ca
sub eax, 1
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
sub edx, 0x1db9d6ca
imul eax, edx
and eax, 1
cmp eax, 0
sete ah
cmp ecx, 0xa
setl cl
mov dl, ah
xor dl, 0xff
mov byte [esp + 0x1a], dl
mov al, cl
xor al, 0xff
mov byte [esp + 0x1b], al
mov ch, 1
xor ch, 1
mov byte [esp + 0x1c], ch
and dl, 0xff
and ah, ch
and al, 0xff
and cl, ch
or dl, ah
mov byte [esp + 0x1d], dl
or al, cl
mov byte [esp + 0x1e], al
mov cl, byte [esp + 0x1e]
mov al, byte [esp + 0x1d]
xor al, cl
mov byte [esp + 0x19], al
mov al, byte [esp + 0x19]
mov dl, byte [esp + 0x1c]
mov ah, byte [esp + 0x1b]
mov cl, byte [esp + 0x1a]
or cl, ah
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
mov byte [esp + 0x18], al
mov al, byte [esp + 0x18]
test al, 1
jne 0x10036562
jmp 0x10036602
mov cl, byte [esp + 0x1f]
xor eax, eax
test cl, 1
mov dword [esp + 0x14], eax
jne 0x100365fc
jmp 0x1003657a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov bh, byte [edx + eax]
mov esi, 0x16
xor edx, edx
div esi
mov eax, dword [esp + 0x10]
mov bl, byte [ecx + edx]
mov dl, bh
xor dl, 0xff
and dl, 0x6e
mov cl, 0xff
xor cl, 0x6e
and bh, cl
mov dh, bl
xor dh, 0xff
and dh, 0x6e
and bl, cl
mov ecx, dword [esp + 0x44]
or dl, bh
or dh, bl
xor dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, 1
sub eax, ecx
cmp eax, 0xd
mov dword [esp + 0x14], eax
jne 0x1003657a
mov eax, dword [0x1005e324]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add eax, 0xf05c1a4b
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov dword [eax], 1
jmp 0x100365fc
add esp, 0x54
pop esi
pop ebx
ret
mov eax, dword [0x1005e324]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0xf05c1a4b
mov dword [esp], eax
mov eax, dword [esp]
mov eax, dword [eax]
jmp 0x1003648a
Function at 0x100398a0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x50
mov eax, dword [esp + 0x60]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x44], eax
mov eax, dword [0x1005fcb8]
mov dword [esp + 0x48], eax
mov eax, dword [0x1005fcb4]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x48]
mov ecx, eax
add ecx, 0x2f154706
sub ecx, 1
sub ecx, 0x2f154706
imul eax, ecx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x3c]
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
xor al, 0xff
mov byte [esp + 0x36], al
mov ch, dl
xor ch, 0xff
mov byte [esp + 0x37], ch
mov ah, 1
xor ah, 1
mov byte [esp + 0x38], ah
and al, 0xff
and cl, ah
and ch, 0xff
mov byte [esp + 0x39], ch
and dl, ah
mov byte [esp + 0x3a], dl
or al, cl
mov byte [esp + 0x3b], al
mov cl, byte [esp + 0x3a]
mov al, byte [esp + 0x39]
or al, cl
mov byte [esp + 0x35], al
mov cl, byte [esp + 0x37]
mov al, byte [esp + 0x36]
mov ah, byte [esp + 0x35]
mov dl, byte [esp + 0x3b]
xor dl, ah
mov byte [esp + 0x33], dl
or al, cl
mov byte [esp + 0x34], al
mov al, byte [esp + 0x33]
mov dl, byte [esp + 0x38]
mov cl, byte [esp + 0x34]
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x10039978
jmp 0x10039ab3
mov eax, dword [esp + 0x40]
add eax, 0x1f
mov dword [esp + 0x2c], eax
mov eax, dword [0x1005e33c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
cmp dword [eax + 0x2f4ebfd3], 1
sete al
mov byte [esp + 0x1b], al
mov eax, dword [0x1005fcb8]
mov dword [esp + 0x1c], eax
mov ecx, dword [0x1005fcb4]
mov dword [esp + 0x20], ecx
sub eax, 0x544af1b
sub eax, 1
add eax, 0x544af1b
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
mov byte [esp + 0x19], dl
xor al, cl
mov byte [esp + 0x1a], al
mov cl, byte [esp + 0x1a]
mov al, byte [esp + 0x19]
or al, cl
mov byte [esp + 0x18], al
mov al, byte [esp + 0x18]
test al, 1
jne 0x10039a0d
jmp 0x10039ab3
mov cl, byte [esp + 0x1b]
xor eax, eax
test cl, 1
mov dword [esp + 0x14], eax
jne 0x10039aad
jmp 0x10039a25
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov bh, byte [edx + eax]
mov esi, 0x1f
xor edx, edx
div esi
mov eax, dword [esp + 0x10]
mov bl, byte [ecx + edx]
mov dl, bh
xor dl, 0xff
and dl, 0x3f
mov cl, 0xff
xor cl, 0x3f
and bh, cl
mov dh, bl
xor dh, 0xff
and dh, 0x3f
and bl, cl
mov ecx, dword [esp + 0x44]
or dl, bh
or dh, bl
xor dl, dh
mov byte [ecx + eax], dl
add eax, 0xa521f16e
add eax, 1
sub eax, 0xa521f16e
cmp eax, 8
mov dword [esp + 0x14], eax
jne 0x10039a25
mov eax, dword [0x1005e33c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add eax, 0x2f4ebfd3
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov dword [eax], 1
jmp 0x10039aad
add esp, 0x50
pop esi
pop ebx
ret
mov eax, dword [0x1005e33c]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x2f4ebfd3
mov dword [esp], eax
mov eax, dword [esp]
mov eax, dword [eax]
jmp 0x10039978
Function at 0x10044cb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x4c], eax
mov eax, dword [0x1005fc10]
mov dword [esp + 0x50], eax
mov ecx, dword [0x1005fc0c]
mov dword [esp + 0x54], ecx
sub eax, 0x3fa6ce88
sub eax, 1
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x58]
add eax, 0x3fa6ce88
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x50]
imul eax, ecx
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x40]
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
mov byte [esp + 0x3e], dl
xor al, cl
mov byte [esp + 0x3f], al
mov cl, byte [esp + 0x3f]
mov al, byte [esp + 0x3e]
or al, cl
mov byte [esp + 0x3d], al
mov al, byte [esp + 0x3d]
test al, 1
jne 0x10044d45
jmp 0x10044e73
mov eax, dword [esp + 0x48]
add eax, 0x1f
mov dword [esp + 0x38], eax
mov eax, dword [0x1005e390]
cmp dword [eax - 0x49d1a050], 1
sete al
mov byte [esp + 0x2b], al
mov eax, dword [0x1005fc10]
mov dword [esp + 0x2c], eax
mov eax, dword [0x1005fc0c]
mov dword [esp + 0x30], eax
xor eax, eax
sub eax, 1
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
add eax, ecx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
imul eax, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
mov byte [esp + 0x1f], al
mov al, byte [esp + 0x1f]
test al, 1
jne 0x10044dcf
jmp 0x10044e73
mov cl, byte [esp + 0x2b]
xor eax, eax
test cl, 1
mov dword [esp + 0x18], eax
jne 0x10044e6c
jmp 0x10044de7
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov dl, byte [edx + eax]
mov byte [esp + 0x17], dl
mov edi, 0x1f
xor edx, edx
div edi
mov eax, dword [esp + 0x10]
mov edi, edx
mov dh, byte [esp + 0x17]
mov bl, byte [esi + edi]
mov bh, dh
xor bh, 0xff
mov dl, bl
and dl, bh
xor bl, 0xff
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
cmp eax, 3
mov dword [esp + 0x18], eax
jne 0x10044de7
mov eax, dword [0x1005e390]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add eax, 0xb62e5fb0
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov dword [eax], 1
jmp 0x10044e6c
add esp, 0x5c
pop esi
pop edi
pop ebx
ret
mov eax, dword [0x1005e390]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0xb62e5fb0
mov dword [esp], eax
mov eax, dword [esp]
mov eax, dword [eax]
jmp 0x10044d45
Function at 0x1004e53d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1004e57c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004e57c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004e57c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1004e57c
cmp dword [ecx + 0x74], 0xe
jbe 0x1004e57c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1005122d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100512ca
push ebx
push esi
call fcn.100511f6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1005118a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10051277
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100512c9
push edi
push eax
call fcn.1004f207
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10051297
call fcn.1004f1cd
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100512c8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1005118a
add esp, 0x20
test eax, eax
jne 0x100512b6
push edi
call fcn.1004f1cd
jmp 0x100512be
push ebx
call fcn.1004f1cd
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10051537
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10059078
push 0x10059070
push str.FlsAlloc
push 0x1f
call fcn.10051453
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005156b
push dword [ebp + 8]
mov ecx, esi
call dword [0x10057148]
call esi
jmp 0x10051571
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100515b5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10059088
push 0x10059080
push str.FlsGetValue
push 0x21
call fcn.10051453
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100515ec
push dword [ebp + 8]
mov ecx, esi
call dword [0x10057148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100515f4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10059090
push 0x10059088
push str.FlsSetValue
push 0x22
call fcn.10051453
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005162e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10057148]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10056c70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10056c9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10056c9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4013ed
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov ax, 2
push 0x403046
push eax
call sub.wsock32.dll_WSAStartup
or eax, eax
je 0x401420
push str.Socket_Error
push 1
push 0x1194
push dword [ebp + 8]
call section..text
xor eax, eax
leave
ret 4
push dword [ebp + 8]
call fcn.0040142e
xor eax, eax
leave
ret 4
Function at 0x6aec7c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov word [esp + 3], bx
pop dword [esp + 1]
xchg dword [esp + 0x1c], esi
push si
jmp 0x6aecc3
lea esp, [esp + 2]
lea esi, [esi - 0xbb]
push ax
call fcn.006aeca8

Function at 0x6aecd4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6aed11
pop word [esp + 1]
jmp 0x6af58e
mov dword [esp + 8], ecx
pushfd
push word [esp + 1]
jb 0x6aecfb
pop word [esp + 1]
push ebp
pop word [esp + 1]
mov dword [esp], ebp
lea esp, [esp + 2]
jmp 0x6af315
mov dword [esp], esp
call 0x6aed4d
or dword [edx], reloc.MSVFW32.dll_DrawDibDraw
dec dword [edx]
iretd
pushal
push word [esp + 0x26]
jbe 0x6aee9a
lea esp, [esp + 0x42]
jmp 0x6aed88
lea esp, [esp + 2]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
pushal
mov byte [esp + 0x13], ah
jmp 0x6af099
push ebp
pop word [esp + 1]
mov dword [esp], ebp
jmp 0x6af311

Function at 0x6aed9e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push eax
pop dword [esp + 1]
lea esi, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x6aedf8
push eax
call fcn.006aedd3
lea esp, [esp + 1]
mov byte [esp], bl
lea esp, [esp + 3]
jmp 0x6aee3a
push edx
jmp 0x6aee5f
push esi
pushfd
push dword [esp + 2]
jl 0x6aee22
push edx
mov dword [esp + 6], ecx
pop word [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 4], edi
jmp 0x6aee76
mov dword [esp + 6], ecx
pop word [esp + 2]
lea esp, [esp + 2]
jmp 0x6aee72
mov dword [esp + 4], edi
lea esp, [esp + 4]
pushfd
jmp 0x6aec9c

Function at 0x6aedfe
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push eax
pop dword [esp + 1]
lea esi, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x6aedf8
push eax
call fcn.006aedd3
lea esp, [esp + 1]
mov byte [esp], bl
lea esp, [esp + 3]
jmp 0x6aee3a
push edx
jmp 0x6aee5f
push esi
pushfd
push dword [esp + 2]
jl 0x6aee22
push edx
mov dword [esp + 6], ecx
pop word [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 4], edi
jmp 0x6aee76
mov dword [esp + 6], ecx
pop word [esp + 2]
lea esp, [esp + 2]
jmp 0x6aee72
mov dword [esp + 4], edi
lea esp, [esp + 4]
pushfd
jmp 0x6aec9c
Function at 0x6b05fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
call fcn.006aecd4
push 0xf06a018c
jmp 0x6aee80
mov dword [esp], esi
push word [esp + 5]
lea esp, [esp + 2]
call fcn.006aec7c
call fcn.006aedb4
add ecx, 0xf82b3ec4
jmp 0x6b049d
sete ah
call fcn.006aef7f
fisttp qword [edi - 0x21]
mov edx, 0xe0759149
jbe 0x6aeea3
loopne 0x6aeee8
popfd
in al, dx
inc esi
jno 0x6aef0a
lea esp, [esp + 0x42]
mov dword [esp], esp
call fcn.006aed63
invalid
bsr cx, bx
jl 0x6aeee1
jge 0x6aeee1
imul esi, edi, 0x67
add dh, cl
cmp dh, byte [ebx - 0x18]
jle 0x6aeed1
call 0xf9f7419
xor al, 0xf
rdtsc
lea ebp, [esp + 0x1c]
mov ah, dl
not bh
xor dword [ebp - reloc.MSVFW32.dll_DrawDibDraw], ecx
loop 0x6aeebb
xlatb
rdtsc
jmp 0x6aeea6
fnstcw word [eax]
sbb esi, dword [edx + 0x6d]
mov esi, dword [esp + 0x48]
mov eax, 0xb7f4e22f
jmp 0x6aeebc
sub esp, 0xa4
mov edi, esp
cld
jmp 0x6aeeef
stc
je 0x6aef34
sub esp, 0xa
lea ebx, [edx + edi]
lea esp, [esp + 2]
jmp 0x6aef14
in al, dx
sbb byte [ebp - 0x38], dh
je 0x6aeed6
lea esp, [esp + 2]
mov ebx, esi
rol edx, cl
jmp 0x6aef52
push sp
call 0x6aef3c
aam 0x4a
fdivr dword [edi - 0x108971b6]
jg 0x6aef49
jmp 0xca87174
sub esp, 0xa
lea ebx, [edx + edi]
jmp 0x6aef10
and esi, dword [ebx - reloc.MSVFW32.dll_DrawDibDraw]
adc dword [eax + reloc.MSVFW32.dll_DrawDibDraw], edx
push esp
jge 0x6aef1e
push sp
jmp 0x6aef20
push dword [esp + 2]
jmp 0x6aed3c
mov ax, word [esp]
inc al
jmp 0x6b052f
sub esp, 0xf
mov ah, dh
xchg byte [esp + 0xb], ah
lea esp, [esp + 3]
jmp 0x6b0540
jl 0x6b05c6
lea eax, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x6b05cc
push ecx
ret
xchg byte [esp + 0xb], ah
lea esp, [esp + 3]
jmp 0x6b0540
jae 0x6b0519
sub esp, 0xf
mov ah, dh
jmp 0x6b0556
lea eax, reloc.MSVFW32.dll_DrawDibDraw
mov esp, edi
sub eax, 0x32d16ec7
jmp 0x6b0576
push ax
push word [esp]
jo 0x6b02e7
push dword [esp + 2]
mov dword [esp], esi
push word [esp + 5]
lea esp, [esp + 2]
mov dword [esp + 4], eax
jmp 0x6aec96

Function at 0x6b3ad4
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0x6b3ab9
clc
jmp 0x6b3aba
clc
lea esi, [esp + 4]
rcr ch, cl
jmp 0x6b3ae0
mov edi, dword [esp + 0x30]
mov ebx, ebp
bts si, cx
jmp 0x6b3aa3
jg 0x6b3af6
btc bp, bp
rdtsc
jmp 0x6b3b3a
btc bp, bp
rdtsc
jmp 0x6b3b3a
sub esp, 0xbc
mov ebp, esp
mov ch, 0x1d
dec ecx
jmp 0x6b3b4b
js fcn.006b3b24
jns fcn.006b3b24
Function at 0x6b6195
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
dec edi
jmp 0x6b61a0
add ebx, eax
jno 0x6b6258
xchg dl, bl
mov ax, word [esp]
xchg dx, ax
lea edx, [edx + ebp]
sub esp, 9
jmp 0x6b6260
xchg dx, ax
lea edx, [edx + ebp]
sub esp, 9
jmp 0x6b6260
xchg dl, bl
mov ax, word [esp]
jmp 0x6b6242
cmc
add esp, 2
jmp 0x6b68e3
mov byte [esp + 3], ch
lea esp, [esp + 3]
jmp 0x6b685d
inc dh
jne 0x6b66e1
lea ebx, [edi + ebp]
mov eax, edi
bsf bx, dx
not bh
jmp 0x6b66a8
sbb edx, 0x58ec3606
inc dh
lea esp, [esp + 4]
inc edi
jmp 0x6b6683
lea ebx, [eax - 0xdd]
jmp 0x6b66ca
bsf bx, dx
not bh
lea ebx, [eax - 0xdd]
lea edx, [edx*4]
jmp 0x6b6703
lea ebx, [edi + ebp]
mov eax, edi
jmp 0x6b66be
xchg al, dl
mov bl, byte [esp]
stc
jmp 0x6b670c
ror edi, 0
ja 0x6b66e8
xchg al, dl
jmp 0x6b6726
add edi, dword [esi]
and ah, 5
jbe 0x6b6769
mov edx, dword [esp]
mov ah, byte [esp]
shl al, 3
jmp 0x6b676e
mov bl, byte [esp]
stc
jmp 0x6b670c
sete dl
mov eax, 0x1cb44734
lea edx, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x6b6699
mov ah, byte [esp]
shl al, 3
jmp 0x6b676e
mov edx, dword [esp]
jmp 0x6b6753
rdtsc
jmp 0x6b6740
rol edi, 0
bsr eax, ebp
jbe 0x6b678c
rdtsc
sete dl
mov eax, 0x1cb44734
lea edx, reloc.MSVFW32.dll_DrawDibDraw
sbb edx, 0x58ec3606
jmp 0x6b669f
jge 0x6b626a
mov byte [esp + 3], ch
lea esp, [esp + 3]
jmp 0x6b685d

Function at 0x6b6a3f
Capabilities:
Execute anti-debugging instructions

Disassembly:
add cl, dl
dec edx
jno 0x6b6a67
bswap eax
jmp 0x6b6a44
mov ax, word [esp]
setae al
mov eax, ecx
mov eax, ecx
mov ah, byte [esp]
mov al, byte [esp]
jmp 0x6b6a0d
rol dl, 0
jmp 0x6b6a23
dec edi
setge ah
mov edx, esi
rcr ah, 0
bswap eax
jmp 0x6b6a44

Function at 0x6b6bb6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
dec bl
xchg dx, ax
sub esp, 0x1f
jmp 0x6b6bff
neg dh
clc
rdtsc
jmp 0x6b6c3f
jnp 0x6b6c31
pop dword [esp + 4]
xchg word [esp + 8], ax
jmp 0x6b6be4
lea esp, [esp + 3]
lea esp, [esp + 0x14]
inc bl
mov dx, word [esp]
mov eax, 0xc81a732c
jmp 0x6b6c5a
pop dword [esp + 4]
xchg word [esp + 8], ax
neg dh
clc
rdtsc
add esp, 4
jmp 0x6b6c0c
mov dx, ax
jmp 0x6b7ae3
xchg dl, ah
mov eax, ebx
mov dl, byte [esp]
lea edx, reloc.MSVFW32.dll_DrawDibDraw
stc
jmp 0x6b88cb
push ebx
lea edx, [ebp*4]
xchg byte [esp], dh
jmp 0x6b6c93
add eax, 0x57eeb9a3
jmp 0x6b6cb9
add eax, 0xdedd8f6c
jmp 0x6b6c6e
mov eax, dword [eax + reloc.MSVFW32.dll_DrawDibDraw]
ror dh, 4
je 0x6b6cf7
lea edx, [eax*4]
mov dx, word [esp]
jmp 0x6b6c7b
sub esp, 0x17
jmp 0x6b7297
neg dx
jns 0x6b6cd5
not edx
jmp 0x6b6cdd
mov dx, word [esp]
jmp 0x6b6c7b
not edx
jmp 0x6b6cdd
mov esp, ebp
pushal
lea edx, reloc.MSVFW32.dll_DrawDibDraw
pop dword [esp + 0x11]
lea edx, [edi*4]
jmp 0x6b6d00
lea edx, [eax*4]
jmp 0x6b6ccf
mov dl, 0xf2
lea edx, [ebx + esi]
push eax
ret
setbe dh
lea edx, [ecx + edx]
bsf edx, eax
jmp 0x6b6cb1
shl eax, 2
setbe dh
lea edx, [ecx + edx]
bsf edx, eax
sub esp, 0x17
inc edx
lea esp, [esp + 3]
jmp 0x6b6c8c
bsr dx, ax
jnp 0x6b7288
shl eax, 2
jmp 0x6b6d29
jl 0x6b6c44
mov dx, ax
jmp 0x6b7ae3