joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001bdc
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
call fcn.01001beb
jmp fcn.01001b4b

Function at 0x407639
Capabilities:
Encode data using xor

Disassembly:
call fcn.00407545
sub ecx, ecx
sub ecx, 0xffffff8a
call 0x407639
rcr byte [esi - 0x7f], 0x76
push cs
ror dword [ecx - 0x4f], cl
sub esi, 0xfffffffc
xor dword [esi + 0xe], 0x65b149d3
sub esi, 0xfffffffc
loop 0x40763c
push 0xffffffffffffff8d
mov al, 0x65
shl dword [ecx - 0x49d365b2], cl
jo 0x40768f
jecxz 0x40765b
mov edi, 0x4cb33162
fsub st(5), st(0)
std
int3
invalid

Function at 0x40102a
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor ebx, ebx
pop ecx
test eax, eax
je 0x401078
push str.Windows_original_main_args:_n
call fcn.004010f9
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov esi, ebx
pop ecx
call edi
cmp dword [eax], ebx
jle 0x401078
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.004010f9
add esp, 0xc
inc esi
call edi
cmp esi, dword [eax]
jl 0x401058
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
mov edi, eax
lea ecx, [edi*4 + 4]
push ecx
call sub.jli.dll_JLI_MemAlloc
pop ecx
pop ecx
mov esi, eax
call sub.jli.dll_JLI_GetStdArgs
mov edx, ebx
test edi, edi
jle 0x4010b2
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, edi
jl 0x4010a7
mov ecx, dword [str.java]
mov dword [esi + edx*4], ebx
test ecx, ecx
jne 0x4010c1
mov ecx, dword [esi]
mov eax, dword [section..data]
test eax, eax
jne 0x4010cc
mov eax, dword [esi]
push ebx
push ebx
push ebx
push 1
push ecx
push eax
push 0x4021ac
push 0x4021b0
push 0x40300c
push 2
push 0x403004
push 2
push esi
push edi
call sub.jli.dll_JLI_Launch
add esp, 0x38
pop edi
pop esi
pop ebx
ret
Function at 0x4013c0
Capabilities:
Create process on windows

Disassembly:
mov al, byte [0x40c030]
mov edx, dword [esp + 4]
sub esp, 0x54
test al, al
je 0x4013d4
test edx, edx
je 0x40143a
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
lea ecx, [esp + 4]
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x40143a
mov ecx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 4]
push edx
call esi
mov al, 1
pop esi
add esp, 0x54
ret
xor al, al
add esp, 0x54
ret

Function at 0x40328d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40c540
cmp edx, dword [eax]
je 0x4032af
add eax, 8
inc ecx
cmp eax, 0x40c5d0
jl 0x4032a0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40c540]
jne 0x4033dd
mov eax, dword [0x40d090]
cmp eax, 1
je 0x4033b7
test eax, eax
jne 0x4032e0
cmp dword [0x40c044], 1
je 0x4033b7
cmp edx, 0xfc
je 0x4033dd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403317
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00405280
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405180
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40335a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405180
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40a49c
push edi
call fcn.00405040
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00405280
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00405290
lea eax, [ebp - 0xa0]
push 0x40a47c
push eax
call fcn.00405290
push dword [esi + 0x40c544]
lea eax, [ebp - 0xa0]
push eax
call fcn.00405290
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004066d5
add esp, 0x2c
pop edi
jmp 0x4033dd
lea eax, [ebp + 8]
lea esi, [esi + 0x40c544]
push 0
push eax
push dword [esi]
call fcn.00405180
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0xb616f2
Capabilities:
Encode data using base64

Disassembly:
cmp al, 0x30
jmp 0xba0190
call int.00ba01b7
jmp 0xba0214
cmp al, 0x2b
jmp 0xba01cd
call fcn.00ba049f
cmp al, 0x7a
call fcn.00ba015b
lea esp, [esp + 4]
jbe 0xb616ed
ja 0xb616d7
adc eax, 0x820ffffc
cmpsd dword [esi], dword es:[edi]
adc eax, 0x5473fffc
jb 0xb6173d
jae 0xba01ec
mov esp, 0x3ec3a436
mov gs, word [esi + 0x2ddebb2b]
xchg ebp, eax
into
pop ecx
mov eax, 0x24648d9b
add bh, byte [ecx]
jb 0xb616d7
clc
jmp 0xba0179
call 0xb616f2
clc
jo 0xba01a5
xor dword [eax - 0x3c], reloc.KERNEL32.dll_HeapSize
ja 0xba018d
cld
iretd
je 0xb616ed
cmp al, 0x2f
jne 0xb61727
je 0xb616ed
dec edi
invalid
cmp al, 0x39
jbe 0xb616ed
ja 0xb6173d
cmp bl, 0x41
jb 0xb61753
cmc
jmp 0xba0220
lea esp, [esp + 8]
mov bl, byte [ecx + 1]
mov byte [ebp - 1], bl
jmp 0xba01fa
cmp bl, 0x5a
call 0xba0229
mov ebp, 0x424648d
jbe 0xb617a4
ja 0xb61753
or dword [esi], reloc.KERNEL32.dll_HeapSize
sti
push ss
mov al, byte [0x5633a30f]
movsd dword es:[edi], dword [esi]
pop ss
xchg cx, ax
adc byte [ebx - 0x24cc5af6], dl

Function at 0xb6eba8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebx, ebx
setge dl
rol bh, cl
mov ebx, ebp
mov dx, 0x4c27
inc eax
jmp 0xb6ebaa
cpuid
sub esp, 0xbc
mov esi, esp
inc ch
jmp 0xb6eb8b
jb 0xb6eb63
xor ebx, ebx
setge dl
jmp 0xb6ebd9
jmp 0xb6eb79
jnp 0xb6ebc0
btc dx, bx
shl cl, cl
jmp 0xb6ebdd
btc dx, bx
shl cl, cl
add dh, 0xa2
rdtsc
bswap edx
sub esp, 0x11
jmp 0xb6ebe6
rol bh, cl
jmp 0xb6eb6a
add dh, 0xa2
rdtsc
bswap edx
jmp 0xb6ebcd
and edx, ecx
jbe 0xb6ed03
not ch
lea esp, [esp + 1]
jmp 0xb6ec9a
rol ebp, 0
jne 0xb6ecd2
je 0xb6eca9
int 0x57
invalid
shl eax, cl
mov eax, edi
lea edx, [esi + 0xb6]
jmp 0xb6ecb9
mov ax, 0x3c49
jmp 0xb6ece0
shl eax, cl
mov eax, edi
lea edx, [esi + 0xb6]
mov ax, 0x3c49
rol ebp, 0
stc
jmp 0xb6ef98
shr ax, 8
sub esp, 4
mov word [esp + 1], cx
mov edx, 0x2ff2c914
jmp 0xb6ed9c
not ch
lea esp, [esp + 1]
call fcn.00b6ec56
xchg al, dh
bt ecx, ebx
je 0xb6ed29
rdtsc
jmp 0xb6ed69
rol ebp, 0
jmp 0xb6ed0e
rdtsc
push ebx
lea esp, [esp + 4]
add ebp, 0x6cc36ac0
mov cl, byte [esp]
jmp 0xb6ed53
mov cx, word [esp]
mov eax, 0xa0818ef4
btr dx, bx
jle 0xb6ed24
jg 0xb6ed24
bsf dx, dx
jo 0xb6ed82
bsr eax, ecx
mov dh, byte [esp]
jmp 0xb6ed6c
push ebx
jmp 0xb6ed2c
add ebp, dword [edi]
mov cx, word [esp]
mov dh, 0xf
sub esp, 0xe
jmp 0xb6edac
bsr eax, ecx
mov dh, byte [esp]
jmp 0xb6ed6c
lea esp, [esp + 0x14]
inc ebp
mov ecx, ebx
mov al, ah
mov ecx, 0x7e956673
jmp 0xb6ed42
jae 0xb6edd6
mov ax, bp
lea esp, [esp + 2]
jmp fcn.00b6edbb
mov ax, bp
lea esp, [esp + 2]
jmp fcn.00b6edbb
mov word [esp + 1], cx
mov edx, 0x2ff2c914
jmp 0xb6ed9c
jae 0xb6ecea
shr ax, 8
sub esp, 4
jmp 0xb6eeba
Function at 0xb70bf0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0b60068
jmp 0xb70c64
push dword [esp + 1]
jmp 0xb70c32
push word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0xb70c5e
jbe 0xb70bfa
push word [esp + 3]
lea esp, [esp + 2]
jmp 0xb70c50
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0xb70c5e
or bl, ch
add al, 0xd7
or dword ds:[eax - reloc.KERNEL32.dll_HeapSize], ebp
invalid
pushfd
jmp 0xb70686
adc bp, sp
jle 0xb70c9c
setbe bl
xchg esi, eax
jmp 0xb70cf0
setbe bl
call fcn.00b70cbb
jae 0xb70c57
invalid
mov eax, 0x4c87d2f7
and al, 0x24
bsf ax, cx
jmp 0xb70cd7
sets dh
lea ebp, [edx + edx]
xchg dword [esp + 0x24], ecx
btc ebx, esi
sub esp, 2
jmp 0xb70d06
lea edi, [edi + ebp]
rdtsc
lea esi, [ebx*4]
lea edi, [edi + ebp]
lea ecx, [ecx - 0x1e]
not ebp
jmp 0xb70cc1
mov word [esp], bx
xchg si, ax
lea esp, [esp + 2]
push dword [esp + 0x24]
ret 0x28

Function at 0xb7603e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0xeb6217f0
jmp 0xb7627b
lea edx, [ecx + ebx]
jmp 0xb75fdf
sub esp, 0x11
add esp, 7
jmp 0xb76011
and edx, 0x7bc78b83
neg dl
call 0xb760ae
call 0x6f4b5473
stosd dword es:[edi], eax
pop ss
jle 0xb7605a
ror al, 0
jp 0xb75ffb
and edx, 0x7bc78b83
jmp 0xb76022
neg dl
jmp 0xb76003
pop dx
neg dh
jbe 0xb75fd6
lea edx, [ecx + ebx]
sub esp, 0x11
add esp, 7
jmp 0xb76011
lea esp, [esp + 2]
jmp 0xb76088
bswap eax
mov ax, bp
jmp 0xb76092
sub cl, al
mov ah, byte [esp]
mov eax, dword [esp]
jmp 0xb76060
dec esi
rdtsc
rdtsc
mov ax, 0x87d2
mov dx, 0xd1a1
jmp 0xb761a5
lea esp, [esp + 2]
jmp 0xb76107
xchg dx, ax
ror ah, cl
mov word [esp + 7], bx
jmp 0xb760bd
inc ah
jb 0xb7612a
mov edx, 0x8a19539e
mov eax, 0x84a827ea
jmp 0xb76114
inc ax
jmp 0xb76162
lea esp, [esp + 0xc]
neg bl
push edx
pop edx
mov dx, sp
jmp 0xb760df
rol bl, 0
bsr edx, esi
jne 0xb760ef
inc ax
mov al, cl
dec dl
jmp 0xb76144
mov edx, 0x8a19539e
mov eax, 0x84a827ea
jmp 0xb76114
jmp 0xb760d3
mov dh, 0xae
jmp 0xb76168
neg bl
shr edx, 0x1a
jbe 0xb761db
ja 0xb761c5
jecxz 0xb761d6
out dx, eax
mov bh, byte [ecx + 0x42]
retf
mov al, cl
dec dl
mov dh, 0xae
call fcn.00b76185
jns 0xb76148
js 0xb76148
invalid
mov eax, esp
inc bl
mov dx, 0x336
sub esp, 0xe
jns 0xb76142
xchg dx, ax
ror ah, cl
mov word [esp + 7], bx
lea esp, [esp + 2]
jmp 0xb76107
bswap eax
bts ax, ax
jmp 0xb761e1
xchg ecx, eax
pushal
out 0x1d, eax
insb byte es:[edi], dx
bswap eax
bts ax, ax
mov edx, ebx
bsr ax, bp
jmp 0xb76227
bts eax, eax
call fcn.00b76206
jg 0xb761f6
xchg ebx, eax
test byte [0x5ac447c2], 0x3d
int3
ret 0xc447
jg 0xb7625c
mov eax, ecx
cmc
jmp 0xb761e9
mov eax, ecx
cmc
bts eax, eax
shl edx, 2
mov al, byte [esp]
jmp 0xb7626e
cmc
jns 0xb762d5
adc eax, 0x6e06d320
jmp 0xb74748
mov ah, ch
sub esp, 0x17
jmp 0xb762f5
lea esp, [esp + 1]
jmp 0xb762b7
pop word [esp + 0xe]
bsr eax, eax
lea esp, [esp + 1]
mov edx, dword [edx + reloc.KERNEL32.dll_HeapSize]
bsf eax, edx
jno 0xb762df
jo 0xb76301
pushal
in al, 0x7a
sbb eax, 0x11965fec
and eax, 0x9310d513
or ah, byte [ebp - 0x2cdfea2c]
push es
outsb dx, byte [esi]
adc eax, 0x6e06d320
jmp 0xb74748
mov ax, bx
jmp 0xb74786
jae 0xb762ab
pop word [esp + 0xe]
bsr eax, eax
jmp 0xb76282
mov ax, bx
jmp 0xb74786
Function at 0xb76a51
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg al, dh
inc edx
inc ax
jmp 0xb76b57
lea esp, [esp]
inc al
jl 0xb769a3
jge 0xb76a3b
call 0xb76a63
jmp 0xb78129
push si
lea edx, [eax + ebp]
jmp fcn.00b769ad
call 0xb780a1
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
mov bh, 0x66
test dword [eax + reloc.KERNEL32.dll_HeapSize], eax
mov esp, 0xe1e9fffe
jmp 0x1f3f80b4
lea esp, [esp + 4]
sub eax, 0x80875444
jmp 0xb78091
lea eax, [ebp*4]
bswap eax
mov eax, esi
mov ax, di
mov eax, dword [esp]
jmp 0xb780db

Function at 0xb76b4f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xb77fd5
push eax
call fcn.00b63cd9
jmp 0xb76a0e
Function at 0xb7cb69
Capabilities:
Encode data using xor

Disassembly:
popal
push di
pushfd
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp fcn.00b6300a
call fcn.00b7cbe4
out dx, eax
mul cl
and byte [ebx], bh
mov ebp, ebp
loope 0xb7cb96
mov ebp, 0x54a7b35e
invalid
mov byte [0x533f2cdd], al
lea esp, [esp + 4]
pushal
jmp 0xb7cb3b

Function at 0xb9f204
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0xb9f254
lea edx, [edi*4]
mov edx, dword [eax + 0xc]
mov ecx, edx
mov di, 0x7ab0
jmp 0xb9f23e
shr ecx, 8
jmp 0xb9f297
pushal
mov dword [esp + 0x1c], edi
pushal
pop dword [esp + 0xd]
lea esp, [esp + 0x1c]
popal
jmp 0xb9f206
mov ecx, dword [ecx*4 + reloc.KERNEL32.dll_HeapSize]
sub esp, 0
jmp 0xb9f29e
mov edi, edx
stc
and ecx, esi
jmp 0xb9f281
shr edi, 0x10
and edi, esi
pushal
jmp 0xb9f30c
stc
and edi, 0xff000000
stc
call fcn.00b9f2e6
sub dword [edi + reloc.KERNEL32.dll_HeapSize], edi
add dword [eax + reloc.KERNEL32.dll_HeapSize], edx
lea ebx, [edi + ebp*2]
jbe 0xb9f2f7
salc
mov dh, 0
pushal
jmp 0xb9f35b
mov edi, dword [edi*4 + reloc.KERNEL32.dll_HeapSize]
sub esp, 2
lea esp, [esp + 2]
lea esp, [esp + 0x28]
and ecx, 0xff0000
jmp 0xb9f2a6
xor ecx, dword [ebx]
jmp 0xb9f380
and edx, ebp
xor ecx, edx
lea esp, [esp + 0x48]
jmp 0xb9f326
shr edi, 0x18
movzx edi, byte [edi*4 + 0xb6c070]
xor ecx, edi
jmp 0xb9f33c
add ebx, 4
jmp 0xb9f3bf
lea edi, [eax + 0x10]
xor ecx, dword [eax]
not dl
lea edx, [ecx + ebp]
jmp 0xb9f36a
mov dword [eax + 0x14], edx
rcl ch, 7
mov ecx, dword [esp]
sub esp, 8
jmp 0xb9f3e3
mov edx, dword [eax + 4]
pushal
xor edx, ecx
mov cl, bl
jmp 0xb9f38c
mov dword [edi], ecx
not edx
mov edx, ecx
mov edx, dword [esp]
mov edx, dword [esp]
jmp 0xb9f3a2
pop word [esp + 1]

Function at 0xb9f2f2
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, edx
pushal
jmp 0xb9f2ea
xor ecx, edi
jmp 0xb9f2d0
and edx, esi
call 0xb9f2f2
dec byte [ebx - 0x3f8f6aec]

Function at 0xb9f832
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0xb9f8a1
and ebx, ecx
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_HeapSize]
jmp 0xb9f87b
movzx ebx, byte [esi + 6]
call fcn.00b9f865
push word [esp + 3]
mov byte [esp + 2], ah
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.KERNEL32.dll_HeapSize]
jmp 0xb9f834

Function at 0xb9f865
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
jmp 0xb9f884
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_HeapSize]
and ebx, ecx
sub esp, 0x15
pushal
jmp 0xb9f8d7
pushal
and edx, ecx
mov edx, dword [edx*4 + reloc.KERNEL32.dll_HeapSize]
jmp 0xb9f902
lea esp, [esp + 1]
lea esp, [esp + 0x58]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_HeapSize]
movzx ebx, byte [esi + 9]
jmp 0xb9f8ba
lea esp, [esp + 0x20]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_HeapSize]
btr edx, esi
jmp 0xb9f930
and edx, ecx
stc
jmp 0xb9f8ec

Function at 0xb9fa92
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + reloc.KERNEL32.dll_HeapSize]
sub esp, 0x15
cmc
lea esp, [esp + 1]
jmp 0xb9fac5
and edx, ecx
lea esp, [esp + 0x18]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_HeapSize]
mov edx, esp
jmp 0xb9faaf
Function at 0xb9fbd5
Capabilities:
Encode data using base64
Encrypt data using aes

Disassembly:
push eax
jmp 0xb9fbbb
mov eax, edx
lea eax, [eax*4]
lea eax, reloc.KERNEL32.dll_HeapSize
mov edx, dword [eax]
jmp 0xb9fbe1
pop word [esp]
lea esp, [esp + 2]
and edx, ecx
jmp 0xb9fb93
pop eax
and ebx, ecx
sub esp, 1
add esp, 0
lea esp, [esp + 1]
jmp 0xb9fc8c
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_HeapSize]

Function at 0xb9fbf3
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
jmp 0xb9fc3f
mov ecx, esi
lea ecx, [ecx + 0xc]
mov dword [ecx], edi
pop ecx
jmp 0xb9fc24
lea esp, [esp + 4]
jne 0xb614c9
je 0xb614df
dec edi
rol byte [esi + 0x21], 1
rcl byte [esi]
int 0x5c
scasd eax, dword es:[edi]
mov dh, 0xa1
xor edi, dword [edx*4 + reloc.KERNEL32.dll_HeapSize]
dec dword [ebp - 4]
pushfd
push ecx
jmp 0xb9fc16

Function at 0xb9fc09
Capabilities:
Encode data using base64
Encrypt data using aes
Reference aes constants

Disassembly:
movzx ebx, byte [esi + 0xe]
jmp 0xb9fb87
lea esp, [esp + 0x34]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_HeapSize]
jmp 0xb9fb4c
mov edi, dword [edi*4 + reloc.KERNEL32.dll_HeapSize]
and ebx, ecx
cmc
jmp 0xb9fb62
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_HeapSize]
call fcn.00b9fbd5
sub esp, 0x1e
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.KERNEL32.dll_HeapSize]
and edi, ecx
jmp 0xb9fb7b
pop word [esp]
lea esp, [esp + 2]
shr edi, 0x18
jmp 0xb9fba9

Function at 0xba0041
Capabilities:
Encode data using base64

Disassembly:
mov word [esp], bx
jmp 0xba0083
mov word [esp + 1], sp
mov dword [esp], ebp
mov ebp, edi
and ebp, 0xbbe3d808
mov bp, 0x2dda
jmp 0xba006d

Function at 0xba015b
Capabilities:
Encode data using base64

Disassembly:
mov byte [esp + 2], ah
push word [esp + 3]
lea esp, [esp + 2]
jmp 0xba0180

Function at 0xba01b7
Capabilities:
Encode data using base64

Disassembly:
cmp al, 0x30
jmp 0xba0190
call int.00ba01b7
jmp 0xba0214
cmp al, 0x2b
jmp 0xba01cd
call fcn.00ba049f
cmp al, 0x7a
call fcn.00ba015b
lea esp, [esp + 4]
jbe 0xb616ed
ja 0xb616d7
adc eax, 0x820ffffc
cmpsd dword [esi], dword es:[edi]
adc eax, 0x5473fffc
jb 0xb6173d
jae 0xba01ec
mov esp, 0x3ec3a436
mov gs, word [esi + 0x2ddebb2b]
xchg ebp, eax
into
pop ecx
mov eax, 0x24648d9b
add bh, byte [ecx]
jb 0xb616d7
clc
jmp 0xba0179
call 0xb616f2
clc
jo 0xba01a5
xor dword [eax - 0x3c], reloc.KERNEL32.dll_HeapSize
ja 0xba018d
cld
iretd
je 0xb616ed
cmp al, 0x2f
jne 0xb61727
je 0xb616ed
dec edi
invalid
cmp al, 0x39
jbe 0xb616ed
ja 0xb6173d
cmp bl, 0x41
jb 0xb61753
cmc
jmp 0xba0220
lea esp, [esp + 8]
mov bl, byte [ecx + 1]
mov byte [ebp - 1], bl
jmp 0xba01fa
cmp bl, 0x5a
call 0xba0229
mov ebp, 0x424648d
jbe 0xb617a4
ja 0xb61753
or dword [esi], reloc.KERNEL32.dll_HeapSize
sti
push ss
mov al, byte [0x5633a30f]
movsd dword es:[edi], dword [esi]
pop ss
xchg cx, ax
adc byte [ebx - 0x24cc5af6], dl
Function at 0xba0229
Capabilities:
Encode data using base64

Disassembly:
cmp al, 0x30
jmp 0xba0190
call int.00ba01b7
jmp 0xba0214
cmp al, 0x2b
jmp 0xba01cd
call fcn.00ba049f
cmp al, 0x7a
call fcn.00ba015b
lea esp, [esp + 4]
jbe 0xb616ed
ja 0xb616d7
adc eax, 0x820ffffc
cmpsd dword [esi], dword es:[edi]
adc eax, 0x5473fffc
jb 0xb6173d
jae 0xba01ec
mov esp, 0x3ec3a436
mov gs, word [esi + 0x2ddebb2b]
xchg ebp, eax
into
pop ecx
mov eax, 0x24648d9b
add bh, byte [ecx]
jb 0xb616d7
clc
jmp 0xba0179
call 0xb616f2
clc
jo 0xba01a5
xor dword [eax - 0x3c], reloc.KERNEL32.dll_HeapSize
ja 0xba018d
cld
iretd
je 0xb616ed
cmp al, 0x2f
jne 0xb61727
je 0xb616ed
dec edi
invalid
cmp al, 0x39
jbe 0xb616ed
ja 0xb6173d
cmp bl, 0x41
jb 0xb61753
cmc
jmp 0xba0220
lea esp, [esp + 8]
mov bl, byte [ecx + 1]
mov byte [ebp - 1], bl
jmp 0xba01fa
cmp bl, 0x5a
call 0xba0229
mov ebp, 0x424648d
jbe 0xb617a4
ja 0xb61753
or dword [esi], reloc.KERNEL32.dll_HeapSize
sti
push ss
mov al, byte [0x5633a30f]
movsd dword es:[edi], dword [esi]
pop ss
xchg cx, ax
adc byte [ebx - 0x24cc5af6], dl
Function at 0xba035d
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
cmp dl, 0x30
jmp 0xb9fc9f
Function at 0xba0427
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jne 0xb61727
je 0xb61800
mov eax, dword [reloc.KERNEL32.dll_HeapSize]
call 0xa17b55fd
push ebx
loope 0xba0477
mov word [esp], dx
jmp 0xba040a

Function at 0xba0443
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jb 0xb9fcb8
clc
jmp 0xba0477
push word [esp + 2]
mov word [esp + 3], sp
lea esp, [esp + 2]
jmp 0xba042d

Function at 0xba04b4
Capabilities:
Encrypt data using aes

Disassembly:
push edx
jmp 0xba0bd9
lea esp, [esp + 4]
cmp cl, 0x30
jmp 0xba04d9
jb 0xb9fcf6
cmp cl, 0x39
jmp 0xba0515
jbe 0xb9fd23
ja 0xb9fcf6
mov eax, 0x403
jmp 0xba0559
lea esp, [esp + 4]
jmp 0xb9fd39
pop ebx
call fcn.00ba0b6b
lea esp, [esp + 4]
pop edi
xchg bl, bh
lea ebx, [eax + ebp]
lea ebx, [edi*4]
jmp 0xba0b85
Function at 0xba0594
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], edx
jmp 0xba059d
lea esp, [esp + 4]
cmp cl, 0x3d
push edi
pop word [esp]
lea esp, [esp + 2]
jmp 0xba05dc
setne bl
inc ebx
inc ebx
call fcn.00ba05c6
lea esp, [esp]
mov dword [edi], ebx
lea esp, [esp + 4]
mov bl, byte [ebp - 1]
jmp 0xb9ff62

Function at 0xba05c0
Capabilities:
Encode data using base64

Disassembly:
je 0xb9fd23
jne 0xb61727
lea esp, [esp + 8]
je 0xb9fd23
stc
cmp cl, 0x3d
jmp 0xba0537
push dword [esp + 3]
jmp 0xba0584

Function at 0xbd6d3c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 0x10]
lea esp, [esp + 2]
jmp 0xbd6d5b
xor esi, esi
clc
pushal
jmp 0xbd6d26
mov dword [esp + 0x2c], ecx
jmp 0xbd6d85
add edi, ebx
sub esp, 0x10
cmc
lea esp, [esp + 0x34]
jmp 0xbd6d42
cmp ecx, esi
je 0xb659eb
cmc
call fcn.00bd6d67
push 0xb6e580
jmp 0xbd6dbf
call dword [eax + 0x94]
rdtsc
rdtsc
mov ah, al
jmp 0xbd6df6
mov eax, dword [0xb6e54c]
ror edx, cl
clc
mov ecx, dword [eax]
jmp 0xbd6de0
Function at 0xc9b664
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp], bl
xchg byte [esp], ch
push sp
lea ebx, [eax*4]
jmp 0xc9b3f7
mov ch, dl
mov bx, 0x16d1
xchg cl, bh
mov word [esp], si
mov cx, ax
setl cl
jmp 0xc9b38f
mov cl, 0xbc
pop bx
mov bx, word [esp + 1]
mov cx, ax
mov byte [esp], dh
mov cx, word [esp]
jmp 0xc9b3a5
mov ecx, edi
push word [esp + 4]
xchg bx, cx
pop ecx
pop word [esp]
jmp 0xc9b427
mov ecx, 0xdac11774
mov cx, word [esp + 2]
mov bl, byte [esp]
lea ecx, [eax*4]
mov dword [esp], edx
push edi
jmp 0xc9b3e1
mov cx, sp
mov ecx, edx
setp bh
setns ch
call fcn.00c9b411
push edi
jb 0xc9b4a3
je 0xc9b4a1
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0xc9b4b0
insb byte es:[edi], dx
push edi
add byte [ebx + 0x3784153a], al
jmp 0xc9b3cc
xchg dword [esp + 0x13], ecx
lea ebx, [ebx + ebx]
mov bl, 0x29
xchg byte [esp + 0x26], ch
jmp 0xc9b4b1
je 0xc9b4c7
add cl, byte [ebp - 0xe4d567]
dec dword [ecx + reloc.KERNEL32.dll_HeapSize]
jmp 0xc9b483
ror byte [edx - 0x72dddb84], cl
sbb al, 0xad
add byte [eax], al
add byte [eax], al
mov bh, byte [esp + 0x22]
lea ebx, [ebp*4]
mov ch, cl
lea esp, [esp + 2]
mov bx, dx
mov ecx, eax
jmp 0xc9b4dc
setge ch
lea ecx, reloc.KERNEL32.dll_HeapSize
mov ebx, dword [esp + 0x2b]
mov cx, 0xbb84
mov ecx, dword [esp]
mov cl, dh
jmp 0xc9b515
pushal
lea esp, [esp + 0x46]
mov bx, 0xab73
mov cx, bx
xchg bl, ch
xchg cx, bx
call fcn.00c9b44a
mov cx, di
bswap ecx
lea ecx, [ebp*4]
call fcn.00c9b570
insb byte es:[edi], dx
jae 0xc9b59d
jb 0xc9b58e
insd dword es:[edi], dx
jo 0xc9b597
push edi
add byte [esi], bl
mov ebx, 0xc6bd45d4
mov bx, sp
pop bx
mov cx, word [esp + 6]
mov ecx, eax
mov bl, byte [esp + 0xd]
jmp 0xc9b4ff
lea esp, [esp + 1]
jmp 0xc9b5bc
inc esp
popal
je 0xc9b600
inc esi
outsd dx, dword [esi]
jb 0xc9b60c
popal
je 0xc9b5f9
add byte [edx - 0x15], al
aam 0xeb
sub al, 0x53
je 0xc9b5ff
je 0xc9b612
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[eax + edx*2 + 0x74], cl
outsd dx, dword [esi]
inc esp
push eax
add byte [eax + 0x66012474], cl
mov dword [esp + 4], ebx
mov byte [esp + 1], dh
mov word [esp + 4], bx
pushal
mov dword [esp + 9], ebx
pushal
lea esp, [esp + 0x47]
call 0xc9b5a6
push word [esp + 2]
call fcn.00c9b683
push edx
popal
imul esi, dword [ebx + 0x65], 0x65637845
jo 0xc9b65d
imul ebp, dword [edi + 0x6e], reloc.KERNEL32.dll_HeapSize
cmpsb byte [esi], byte es:[edi]
ror dword [ebx - reloc.KERNEL32.dll_HeapSize], 1
pop esp
and al, 8
or byte [ebx - 0x163f6059], bh
mov ebx, 0xe9c09fa7
lea ebx, [esi*4]
sbb al, 0xb5
add byte [eax], al
add byte [eax], al
lea ebx, [ebx*4]
mov cx, word [esp + 0x22]
add byte [esi - 0x75], ah
dec esp
and al, 0x22
jmp 0xc9b531
mov byte [esp + 3], ch
call fcn.00c9b62d
out 0, al
add byte [eax], al
cmp dword [eax], ebx
jnp fcn.00c9b664
invalid
je 0xc9b68b
pop es
lea esp, [esp + 5]
mov byte [esp + 3], cl
mov dword [esp], esp
jmp 0xc9b645

Function at 0xca012f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0xe], eax
pop word [esp + 7]
mov bp, word [esp + 6]
jmp 0xca0131
jmp 0xca0119
push word [esp + 0xf]