joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49524e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x495286
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00493305
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004932dd
jmp 0x495292
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x496940
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x496982
call fcn.0049c43b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x496982
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x496979
xor eax, eax
jmp 0x49698a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00496990
pop edi
pop esi
pop ebx
ret 4

Function at 0x49c96b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49c999
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49c9b7
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049c8d1
jmp 0x49c9b7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49c9b7
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049c8d1
test edi, edi
mov eax, edi
jne 0x49c9a1
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4eaed0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x458015
lea edi, [esi - 0x57015]
push edi
jmp 0x4eaeea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4eaef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eaee0
mov eax, 1
add ebx, ebx
jne 0x4eaf03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4eaf14
jne 0x4eaf33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eaf33
dec eax
add ebx, ebx
jne 0x4eaf20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4eaef8
add ebx, ebx
jne 0x4eaf2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4eaf85
xor ecx, ecx
sub eax, 3
jb 0x4eaf4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4eafba
sar eax, 1
mov ebp, eax
jmp 0x4eaf56
add ebx, ebx
jne 0x4eaf56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eaf24
inc ecx
add ebx, ebx
jne 0x4eaf64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eaf24
add ebx, ebx
jne 0x4eaf71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4eaf66
jne 0x4eaf82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4eaf66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4eafa4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4eaf96
jmp 0x4eaee6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4eafa4
add edi, ecx
jmp 0x4eaee6
pop esi
mov edi, esi
mov ecx, 0xf7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4eafc2
cmp byte [edi], 0
jne 0x4eafc2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4eafc7
lea edi, [esi + 0xe8000]
mov eax, dword [edi]
or eax, eax
je 0x4eb036
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xec164]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xec1c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4eaff4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xec1cc]
or eax, eax
je 0x4eb030
mov dword [ebx], eax
add ebx, 4
jmp 0x4eb011
call dword [esi + 0xec1dc]
mov ebp, dword [esi + 0xec1d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4eb06a
sub esp, 0xffffff80
jmp 0x401110
Function at 0x405dcd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a2c], 0
push esi
jne 0x405e04
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dde
mov dword [ecx*4 + 0x422a28], eax
inc ecx
cmp ecx, 0x100
jl 0x405dd9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e35
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a28]
xor eax, esi
inc ecx
dec edx
jne 0x405e17
pop edi
not eax
pop esi
ret 0xc

Function at 0x53e6cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x540168
sub eax, eax
test esi, esi
je 0x53e7a4
sub eax, 1
test ecx, ecx
je 0x53e7a2
test esi, 3
je 0x53e70a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x53e6ef
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x53e789
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x53e714
mov ecx, edx
test ecx, ecx
je 0x53e7a2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x53e78f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x53e7ac
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0053e82f
jae 0x53e7ba
xor ecx, ecx
call fcn.0053e82f
jae 0x53e7e9
xor eax, eax
call fcn.0053e82f
jae 0x53e7f9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0053e82f
adc al, al
jae 0x53e7db
jne 0x53e825
stosb byte es:[edi], al
jmp 0x53e7bd
call fcn.0053e83b
sub ecx, ebx
jne 0x53e802
call fcn.0053e839
jmp 0x53e821
lodsb al, byte [esi]
shr eax, 1
je 0x53e84b
adc ecx, ecx
jmp 0x53e81e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0053e839
cmp eax, 0x7d00
jae 0x53e81e
cmp ah, 5
jae 0x53e81f
cmp eax, 0x7f
ja 0x53e820
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x53e7bd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x4f8174
Capabilities:
Encode data using xor

Disassembly:
inc edi
xor ah, dh
rcl byte ss:[ebp - 0x54]
rcl byte [ebp - 0x54]
rcl byte [ebp - 0x54]
and dword [edx + eax], ebp
inc edx
mov ah, byte [edi - 2]
mov edx, 0x243178c8
push ebp
inc esi
clc
or byte [esi + 0xa578f8c], bh
push eax
pop ss
lcall 0x6b4b, 0x74935888
sar esi, cl
out 0x86, al
mov ss, word [edx - 2]
mov esp, 0xe834d115
push dword ss:[ecx]
or ebp, edi
mov ecx, 0x1af3d707
xlatb
or byte [ebx + 0x7e], bh
push edx
loope 0x4f8216
inc edi
insd dword es:[edi], dx
fstp qword [eax - 0x2037abc6]
invalid
dec esi
inc edi
into
aaa
js 0x4f8170
rol esi, 2
jo 0x4f8243
inc edi
mov cl, 0x1d
les edx, [eax + 0x6a3a3dbf]
insb byte es:[edi], dx
sbb eax, 0x3dbf90c4
cmp ch, byte [edx + 0x6c]
adc eax, 0x4b34d5cb
dec edx
pop ebx
dec esp
in al, dx
ja 0x4f81e2
jbe 0x4f81f0
push edi
rcr dl, 1
sbb al, 0x5a
or dword [ecx - 0x49], ebx
les ecx, [ecx + edi*8 + 0x5a]
and dword [eax], esi
dec esp
popfd
mov cl, 0xfc
pop edi
adc eax, 0xc5764bb3
sub esp, dword [eax - 0x53]
lahf
imul esp, dword [ebp - 0x23ace8fc], 0xffffffa1
dec ebp
xchg ebx, eax
cmp byte [eax - 0x214b5e2f], al
lcall 0x6890, 0xfff308ea
wait
pop edx
bnd jnp 0x4f81e2
insb byte es:[edi], dx
pop edi
out 0x59, eax
push edx
cmpsb byte [esi], byte es:[edi]
invalid
Function at 0x89e7fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
add esp, 0xf
jmp 0x89ef85
lea esp, [esp + 1]
sub ecx, edx
push edx
lea esp, [esp + 0x14]
pushal
push word [esp + 0x13]
jmp 0x89ec81
mov word [esp + 2], sp
lea esp, [esp + 2]
jmp 0x89e7db
mov edi, ecx
mov ecx, edx
cld
jmp 0x89ec6a
push edi
push ecx
mov esi, eax
jmp 0x89ec15
pushfd
lea esi, [ecx + edx - 0x40]
push esi
jmp 0x89ec30
pop ecx
pop edi
pop esi
jmp 0x89eca9
rep movsb byte es:[edi], byte [esi]
jmp 0x89ec51
lea esp, [esp + 5]
lea esp, [esp + 0xc]
lea esp, [esp + 1]
mov esp, ecx
jmp 0x89ec49
popfd
jmp 0x89d8b0
push edx
lea esp, [esp + 0x14]
pushal
jmp 0x89e7f1
jg 0x89e7e5
lea esp, [esp + 1]
sub ecx, edx
jmp 0x89ecd5

Function at 0x8a89cd
Capabilities:
Encode data using xor

Disassembly:
jmp 0x8924cb
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x8924e7
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x8924d3
jmp 0x8924f2
ret
jmp 0x8924c0

Function at 0x8d4aef
Capabilities:
Encode data using xor

Disassembly:
clc
call 0x8d4af1
or dword [0xd417e49d], 0x6b0c9e11
cmpsb byte [esi], byte es:[edi]
popal
arpl word [esi], ax
cmc
xor dh, byte [esi + 0x61]
mov al, byte [0x3f9e3eb]
jmp 0x8d4ad4
stc
add edx, edi
push edx
call 0x8d4afb
jecxz 0x8d4ae5
jmp 0x8d4ad4
rol byte [ecx], 0
add byte [ebp + 0xf042464], cl
lea esp, [esp + 4]
invalid
test dword [ebp - 6], ebx
invalid

Function at 0xf51212
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ecx, esi
xchg dword [esp + 6], edx
jmp 0xf5128d
mov byte [esp + 0x1f], ch
xor edi, esi
mov dl, dh
push dword [esp + 6]
inc cl
mov dx, bx
jmp 0xf51454
shr ah, 1
mov edx, 0x7394df88
inc bx
xchg ecx, ebp
add eax, ebp
pop cx
jmp 0xf51271
lea edi, [esi*4]
pop ebx
pushal
rdtsc
call fcn.00f512b5
fst dword [edx + ecx*8 - 0x53]
pop esp
mov edi, 0x3051c151
ret
mov ecx, ebp
push word [esp + 0xb]
xchg byte [esp + 0x18], cl
xchg dh, al
mov si, 0x2cfb
mov cx, word [esp + 0x14]
jmp 0xf512cb
rdtsc
btc edi, ebx
lea esp, [esp + 7]
xchg byte [esp], cl
sub esp, 0x16
push word [esp + 0xd]
jmp 0xf512ec
mov al, ah
rdtsc
cmc
pop dword [esp]
btr edx, edx
xchg cx, bx
jmp 0xf51345
xchg dword [esp + 0x24], ebx
mov byte [esp + 0x21], dh
cpuid
shr eax, 9
popal
xchg ch, dl
jmp 0xf51393
Function at 0xf512b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dx
xchg cx, di
jmp 0xf51325
mov ax, word [esp + 0xc]
lea edi, [eax*4]
lea eax, [edi + edi]
xchg edx, ebx
neg esi
xchg word [esp + 0x1f], di
jmp 0xf5137c
lea ebx, [esp + esi]
pop word [esp + 7]
pop di
mov byte [esp + 0x2e], ch
mov eax, dword [esp + 0x29]
push dword [esp + 0x32]
jmp 0xf51304
mov dl, 0xcc
mov ax, 0x86e5
sete bh
mov edi, ebp
rol dx, cl
rdtsc
jmp 0xf5143b
xchg byte [esp + 2], al
and cl, bh
mov edi, esi
mov si, word [esp + 0x16]
not bh
jmp 0xf5135b
rdtsc
pop word [esp + 0xd]
pop ebx
mov edi, dword [esp + 0x2f]
btc esi, ebx
call fcn.00f513c0
pop bp
stc
mov cx, 0x6ded
pop bp
mov dword [esp + 1], eax
add esp, 3
jmp 0xf51485
mov eax, dword [esp + 0x23]
xchg bh, cl
push dword [esp + 0x16]
bswap ebx
mov bp, bx
xchg byte [esp + 0x29], bl
jmp 0xf5140d
xchg word [esp + 0xc], cx
not esi
pop cx
cmc
rcl bp, cl
setl bh
jmp 0xf51519
push word [esp + 0x14]
lea ecx, [ebp + 0x1f]
cmc
setge dh
xchg dword [esp + 0x11], ebp
jmp 0xf51469
xchg word [esp + 4], bx
mov bh, byte [esp + 1]
mov al, 0x4e
mov eax, ecx
bsr cx, bp
pop ebx
jmp 0xf5152f
neg bx
lea esp, [esp + 0xc]
pop eax
xchg byte [esp + 4], bl
setns ch
mov ebx, eax
jmp 0xf514e7
pop ebp
neg bx
mov ax, 0xe915
xchg word [esp + 5], bx
xchg dword [esp + 0xe], esi
ror dh, 7
jmp 0xf51500
xchg byte [esp], cl
bsf ax, si
xor bp, 0xbd54
xchg ah, bl
jmp 0xf51b31
xchg dx, si
xchg ch, dl
not edx
bswap eax
mov dl, 0x44
lea esi, [edx + edx]
call fcn.00f515b2
xchg esp, eax
pop es
scasb al, byte es:[edi]
mov dword [esp + 0xa], ebp
pushal
mov byte [esp + 5], dh
push word [esp + 0x1d]
lea esp, [esp + 0x41]
shr ah, 1
jmp 0xf515f2
xchg byte [esp], al
mov ax, word [esp + 1]
pushal
btr eax, esp
pop eax
xchg byte [esp + 0x10], cl
jmp 0xf51609
mov cx, 0xda0d
lea ebx, [eax + edx]
xchg esi, edx
lea edx, [ecx*4]
mov al, 6
lea ebp, [esi + 0x2dd308c5]
jmp 0xf51656
Function at 0xf515b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ecx
mov ah, byte [esp]
jmp 0xf51636
mov cx, sp
rdtsc
add esp, 0
xchg bx, ax
stc
sub esp, 0x16
jmp 0xf5161f
stc
lea eax, [ebx + edi]
mov ebp, dword [esp + 0x15]
rdtsc
mov dl, dh
lea edi, [edx + edi]
jmp 0xf516fa
inc dx
xor eax, esi
mov bl, bh
mov ax, sp
not bp
mov byte [esp], bh
jmp 0xf515ba
sub esp, 0x1c
mov dword [esp + 0x11], eax
push word [esp + 8]
xchg dword [esp + 0x12], edx
push dword [esp + 0x25]
btc ebp, ebx
call fcn.00f516da
pushal
mov bh, byte [esp + 0x17]
lea ebx, [esi + 0xd5]
lea esp, [esp + 0x21]
mov word [esp], dx
lea ebp, [edx*4]
jmp 0xf5175c
xchg word [esp], cx
xchg bh, cl
lea ebp, [edx + edi]
lea ecx, [ecx + ebx]
bsr cx, bp
xchg si, cx
jmp 0xf517cf
inc si
cpuid
mov ah, byte [esp + 2]
lea eax, [ebx + edi]
inc cx
cmc
jmp 0xf51743
cld
pop ebp
mov dl, dh
mov bp, 0x441b
mov dl, dh
push edx
jmp 0xf517fd
mov cl, 0x9a
neg di
pushal
lea esp, [esp + 0x45]
lea edi, [ebp + 0x2360467]
jmp 0xf517e6
lea edx, [ebp + 0x645a275f]
btc eax, ebx
push word [esp]
cpuid
rcl dx, cl
lea edi, [esp + ecx]
jmp 0xf517ac
mov si, 0xb55b
cmc
lea edi, [ebp - 0xdf]
mov cl, 0xca
mov al, ah
rdtsc
jmp 0xf5180e
xchg byte [esp], cl
mov word [esp], di
inc esi
pushal
not cx
lea edx, [ebx + ebp]
jmp 0xf517b9
inc dl
xchg ch, dl
rdtsc
not ax
bsr cx, bp
cpuid
jmp 0xf519d7
rdtsc
shl bx, cl
sete ah
mov ebp, dword [esp]
call fcn.00f51845
hlt
not ch
lea ecx, [ecx - 0x23]
cld
xchg bp, si
mov bl, bh
inc dl
jmp 0xf51869
bsf dx, si
mov ebx, 0xcb5cdb84
mov al, ah
clc
setle ch
bsf si, ax
jmp 0xf51886
bswap ebp
btc eax, edi
xchg di, dx
btr edx, edx
mov eax, 0xa500de0e
cld
jmp 0xf51903
mov eax, 0x7dcc96f2
inc esi
not dh
lea ebx, [edx*4]
mov dl, byte [esp]
sub dx, 0xb7d8
jmp 0xf5193e

Function at 0xf51951
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 0xd]
mov cl, ch
bswap ecx
mov bp, dx
pop dword [esp + 0xe]
jmp 0xf51977
Function at 0xf51af2
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xf51cb7
lea ebx, [edi*4]
bsf ax, si
mov di, sp
bsf ax, ax
mov dx, 0x2dad
jmp 0xf51c98
mov bx, word [esp + 0x1b]
mov si, 0xeee5
mov dl, 0x5c
jmp 0xf51bae
pop esi
not ebx
add esp, 0x17
cpuid
mov bx, sp
xchg di, dx
jmp 0xf51b4e
mov dh, byte [esp + 0x1b]
pushal
pop si
mov byte [esp + 0x30], ah
xchg dword [esp + 0x30], eax
shr ah, 1
jmp 0xf51b64
mov byte [esp + 0x1b], ch
pop di
inc ecx
mov ebp, 0x23983ac8
mov di, 0x883d
bswap eax
jmp 0xf51c20
lea ebx, [ebx*4]
pop bx
shr esi, 0x1f
xchg dword [esp + 0xe], ebx
jmp 0xf51b93
rol bx, cl
bswap esi
bswap edi
pushal
pop dword [esp + 8]
mov ecx, 0x1dfc390a
jmp 0xf51b80
xchg word [esp + 3], cx
cpuid
stc
push dword [esp + 0xe]
rdtsc
mov word [esp + 0x14], dx
jmp 0xf51c4d
cpuid
add esp, 0
lea ecx, [edi*4]
lea edx, [ebp + 0x8f]
mov byte [esp + 1], bh
push dword [esp + 0x11]
jmp 0xf51bd8
mov bp, dx
rol di, cl
cpuid
bswap ebx
mov dl, 0xe4
bsf cx, ax
jmp 0xf51bfb
and dx, 0x5af2
rdtsc
pop dword [esp + 0xe]
mov byte [esp + 0xf], ch
sub ecx, eax
lea edi, [esp + edx]
jmp 0xf51c81
pop dword [esp + 0xe]
xchg dword [esp + 0xa], ebp
mov bh, byte [esp + 0x11]
shr eax, 0x1f
mov edi, dword [esp + 7]
lea edx, [ebp - 0xa7]
jmp 0xf51c32
neg ebx
rdtsc
bswap edi
mov bl, byte [esp]
xchg esi, eax
bswap ebx
jmp 0xf51bc5
xchg word [esp + 0x16], bp
mov si, 0x9861
pop dword [esp]
xchg ebp, eax
cpuid
jmp 0xf51fa6
mov eax, 0x64ee4616
xchg ebp, esi
cld
mov esi, ebp
pop edi
mov dl, 0x94
jmp 0xf51c6f
xchg di, dx
cmc
xchg byte [esp + 1], al
mov cl, 0x92
add cx, 0x9df6
lea ebx, [esi + 0xf5]
jmp 0xf51af7
lea edx, [ebx + esi]
inc edi
not cx
lea edx, [ebp + 0x58d75ec7]
shl si, cl
call fcn.00f51d73
push 0xfffffffffffffff9
imul ecx, dword [eax], 0x8a5808fb
adc al, 0x24
mov dl, byte [esp]
inc dl
lea edx, [ecx + ebx]
add ebx, ebp
mov cl, byte [esp]
cpuid
jmp 0xf51cd1
push esp
xchg dword [esp + 0x12], esi
lea edx, [ebx + edi]
lea edx, [ebx + esi]
pushal
lea esp, [esp + 0x59]
jmp 0xf51ced
mov bp, word [esp + 7]
pop word [esp + 4]
not ax
pushal
rdtsc
not eax
jmp 0xf51d13
Function at 0xf522a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub bx, 0x39f0
xchg word [esp + 5], cx
mov dh, byte [esp + 0xd]
bswap ecx
jmp 0xf5232b
mov dl, 0x84
mov ch, byte [esp + 0xd]
cld
mov dh, byte [esp + 0x17]
shr eax, 0x1b
jmp 0xf5237e
sub esp, 0
lea edi, [ebp*4]
mov byte [esp + 0x2a], ah
mov ax, 0x1899
shr ch, 5
sub edi, eax
jmp 0xf522e8
push dword [esp]
bsr dx, cx
push dword [esp + 0x12]
inc ebp
pop ax
inc cx
jmp 0xf522ff
add esp, 0x11
mov word [esp + 7], bx
lea esi, [edx*4]
sub esp, 0x18
xchg word [esp + 7], dx
jmp 0xf523b4
rdtsc
push dword [esp + 0x2a]
pop word [esp + 0x33]
xchg byte [esp + 6], al
setle bh
bsr bp, bp
jmp 0xf5233d
mov word [esp + 0xe], sp
push dword [esp + 0x1a]
rdtsc
not bp
xchg ecx, edx
xchg dword [esp + 0x26], edx
jmp 0xf5235b
add esp, 0x17
lea edi, [eax + 0x64148681]
mov edi, dword [esp + 0xe]
clc
xchg bh, cl
not eax
jmp 0xf523e7
mov dl, dh
xchg dword [esp + 0x32], ecx
pop esi
lea esp, [esp + 0xf]
not ax
mov ecx, 0x17b26874
jmp 0xf52394
lea ebx, [eax + edx]
cmc
neg ebp
mov dx, word [esp + 4]
pop eax
xchg di, dx
jmp 0xf529d3
push edx
lea esp, [esp + 0x21]
call fcn.00f52440
btr eax, esp
pop ebx
lea esp, [esp + 3]
lea esp, [esp + 8]
popal
pushal
jmp 0xf5248b

Function at 0xf52ab3
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 2], bl
pop word [esp + 1]
mov dx, 0xdbc7
jmp 0xf52ae5
mov dword [esp], eax
xchg dword [esp], eax
rdtsc
not si
push dword [esp + 2]
pop cx
jmp 0xf52b55
push esp
cpuid
mov dx, 0x6bfb
mov word [esp + 4], sp
rdtsc
sete bh
jmp 0xf52b09
pop bx
xchg byte [esp + 1], al
mov bx, dx
push dword [esp]
mov al, 0x9e
mov bh, byte [esp + 3]
jmp 0xf52b25

Function at 0xf54658
Capabilities:
Parse pe header

Disassembly:
call fcn.00f54015
call 0xf54631
push eax
jmp 0xf54010
Function at 0x4011c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x435084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
push esi
mov dword [ebp - 0x84], 0x33323156
mov dword [ebp - 0x80], 0x37363534
mov dword [ebp - 0x7c], 0x62613938
mov dword [ebp - 0x78], 0x66656463
mov dword [ebp - 0x74], 0x6a696867
mov dword [ebp - 0x70], 0x6e6d6c6b
mov dword [ebp - 0x6c], 0x7271706f
mov dword [ebp - 0x68], 0x76757473
mov dword [ebp - 0x64], 0x7a797877
mov dword [ebp - 0x60], 0x44434641
mov dword [ebp - 0x5c], 0x48474245
mov dword [ebp - 0x58], 0x4c494a4b
mov dword [ebp - 0x54], 0x504f4e4d
mov dword [ebp - 0x50], 0x54535251
mov dword [ebp - 0x4c], 0x58573055
mov word [ebp - 0x48], 0x5a59
mov byte [ebp - 0x46], 0
mov dword [ebp - 0x44], 0x6f666442
mov dword [ebp - 0x40], 0x53707773
mov dword [ebp - 0x3c], 0x4d377846
mov dword [ebp - 0x38], 0x365a304b
mov dword [ebp - 0x34], 0x3868546b
mov dword [ebp - 0x30], 0x3472474f
mov dword [ebp - 0x2c], 0x31694a48
mov dword [ebp - 0x28], 0x43744e55
mov dword [ebp - 0x24], 0x587a5035
mov dword [ebp - 0x20], 0x6a443351
mov dword [ebp - 0x1c], 0x7579626e
mov dword [ebp - 0x18], 0x71325756
mov dword [ebp - 0x14], 0x616c4c76
mov dword [ebp - 0x10], 0x63675965
mov dword [ebp - 0xc], 0x39416d52
mov word [ebp - 8], 0x4945
mov byte [ebp - 6], 0
jb 0x4012cd
mov esi, dword [eax]
jmp 0x4012cf
mov esi, eax
test ecx, ecx
je 0x401317
push edi
mov edi, ecx
mov al, byte [esi]
cmp al, 0x30
jl 0x4012e0
cmp al, 0x39
jle 0x4012f0
cmp al, 0x61
jl 0x4012e8
cmp al, 0x7a
jle 0x4012f0
cmp al, 0x41
jl 0x401312
cmp al, 0x5a
jg 0x401312
movsx eax, al
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.004114a0
add esp, 8
test eax, eax
je 0x401312
lea edx, [ebp - 0x44]
sub eax, edx
mov al, byte [ebp + eax - 0x84]
mov byte [esi], al
inc esi
dec edi
jne 0x4012d6
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00410f94
mov esp, ebp
pop ebp
ret

Function at 0x4018f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x40198c
push edi
push str.embedded_data.html
call fcn.00411a00
mov edi, eax
add esp, 4
test edi, edi
jne 0x401914
pop edi
pop ebp
ret
push esi
push edi
call fcn.00411998
add esp, 4
push 0x17
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push edi
mov esi, eax
call fcn.0041163a
add esp, 4
test esi, esi
je 0x401954
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, 1
jb 0x401954
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x40195a
pop esi
xor eax, eax
pop edi
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp edi, 0x400
jb 0x40196e
mov edi, 0x400
push edi
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004179b0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
mov eax, 1
pop edi
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402b80
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c698
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x435084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x430390
mov esi, eax
push 0x65
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x402c71
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x10]
mov dword [ebp - 0x18], eax
call fcn.00401f60
push str.minidownload.exe
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, esi
push str.minidownload.exe
push ecx
mov esi, eax
call fcn.004029f0
mov ebx, dword [ebp - 0x10]
push 0
push 0x20
push 2
push 0
push 7
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x402c4f
mov ecx, dword [ebp - 0x18]
push 0
lea eax, [ebp - 0x14]
push eax
push edi
push ecx
push esi
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x402c85
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebx - 0xc]
cmp edx, 0x4362cc
je 0x402c71
lea esi, [ebx - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x402c71
push esi
call fcn.00411ad6
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x2710
xor edi, edi
mov ecx, ebx
call fcn.00403e90
add esp, 8
test eax, eax
jne 0x402cbe
lea esi, [ebp - 0x10]
call fcn.00402800
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 3
call fcn.00402cf0
add esp, 4
lea esi, [ebp - 0x10]
mov edi, eax
call fcn.00402800
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret