joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fa7a
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x41bed0
call fcn.00408cb8
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x4301e0], edi
jne 0x40fabe
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40faa9
mov dword [0x4301e0], ebx
jmp 0x40fabe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x40fabe
mov dword [0x4301e0], 2
mov eax, dword [0x4301e0]
cmp eax, ebx
jne 0x40fade
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x40fba0
cmp eax, 2
je 0x40fae7
cmp eax, edi
jne 0x40fb0f
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x40fafa
mov eax, dword [0x43007c]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x40fb16
xor eax, eax
jmp 0x40fba0
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.0040e030
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x40fb49
cmp esi, edi
jne 0x40fb5e
mov ecx, dword [ebp - 0x20]
call fcn.0040ae28
mov esi, eax
cmp esi, edi
je 0x40fb0f
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x40fb91
cmp dword [ebp + 0x14], edi
jne 0x40fb7b
push edi
push edi
jmp 0x40fb81
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x40fb9d
push esi
call fcn.0040abd0
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.00408cf3
ret
Function at 0x40fba9
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x41bee0
call fcn.00408cb8
xor esi, esi
cmp dword [0x4301e4], esi
jne 0x40fbed
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40fbd8
mov dword [0x4301e4], edi
jmp 0x40fbed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x40fbed
mov dword [0x4301e4], 2
mov eax, dword [0x4301e4]
cmp eax, 2
je 0x40fccc
cmp eax, esi
je 0x40fccc
cmp eax, 1
jne 0x40fc32
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x40fc1b
mov eax, dword [0x43007c]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x40fc39
xor eax, eax
jmp 0x40fcde
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.0040e030
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x40fc6f
cmp edi, esi
jne 0x40fc88
lea ecx, [ebx + ebx]
call fcn.0040ae28
mov edi, eax
cmp edi, esi
je 0x40fc32
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40fcbb
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x40fca5
push esi
push esi
jmp 0x40fcab
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x40fcc7
push edi
call fcn.0040abd0
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x40fcde
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.00408cf3
ret
Function at 0x410524
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [ebp - 0xc], ebx
je 0x41058c
push 0x3d
push esi
call fcn.00410711
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 8], eax
je 0x41058c
cmp esi, eax
je 0x41058c
xor ecx, ecx
cmp byte [eax + 1], cl
mov eax, dword [0x42fa90]
sete cl
cmp eax, dword [0x42fa94]
mov dword [ebp - 4], ecx
jne 0x410572
mov edi, eax
call fcn.004104c5
mov dword [0x42fa90], eax
cmp eax, ebx
jne 0x4105cb
cmp dword [ebp + 0xc], ebx
je 0x410594
cmp dword [0x42fa98], ebx
je 0x410594
call fcn.0040ff38
test eax, eax
je 0x4105cb
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x4106cf
push 4
pop ecx
call fcn.0040ae28
cmp eax, ebx
mov dword [0x42fa90], eax
je 0x41058c
mov dword [eax], ebx
cmp dword [0x42fa98], ebx
jne 0x4105cb
push 4
pop ecx
call fcn.0040ae28
cmp eax, ebx
mov dword [0x42fa98], eax
je 0x41058c
mov dword [eax], ebx
mov edi, dword [ebp - 8]
mov ebx, dword [0x42fa90]
sub edi, esi
push esi
call fcn.00410478
mov edi, eax
test edi, edi
pop ecx
jl 0x410625
cmp dword [ebx], 0
je 0x410625
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.0040abd0
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x41060c
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov esi, eax
jmp 0x410659
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x410603
mov edx, edi
shl edx, 2
mov ecx, ebx
call fcn.0040ae9e
test eax, eax
mov esi, dword [ebp + 8]
je 0x410659
jmp 0x410654
cmp dword [ebp - 4], 0
jne 0x4106c8
test edi, edi
jge 0x410635
neg edi
lea edx, [edi*4 + 8]
mov ecx, ebx
call fcn.0040ae9e
test eax, eax
je 0x41058c
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [0x42fa90], eax
cmp dword [ebp + 0xc], 0
je 0x4106b3
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410664
sub eax, edx
lea ecx, [eax + 2]
call fcn.0040ae28
mov edi, eax
test edi, edi
je 0x4106b3
mov ecx, esi
sub eax, esi
mov dl, byte [ecx]
mov byte [eax + ecx], dl
inc ecx
test dl, dl
jne 0x41067f
mov ecx, dword [ebp - 8]
add eax, ecx
mov ecx, dword [ebp - 4]
mov byte [eax], dl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x4106ac
or dword [ebp - 0xc], 0xffffffff
push edi
call fcn.0040abd0
pop ecx
cmp dword [ebp - 4], 0
je 0x4106c0
push esi
call fcn.0040abd0
pop ecx
mov eax, dword [ebp - 0xc]
jmp 0x41058f
push esi
call fcn.0040abd0
pop ecx
xor eax, eax
jmp 0x41058f
Function at 0x48f620
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0044db6c
test al, al
je 0x48f6de
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
jmp 0x48f6bc
cmp word [esi + 0x5f2], 0
je 0x48f671
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5f4]
call dword [esi + 0x5f0]
mov al, byte [esi + 0x5e8]
or al, byte [ebp - 9]
jne 0x48f693
cmp dword [ebp - 4], 0
jbe 0x48f68f
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x48f693
xor ebx, ebx
jmp 0x48f695
mov bl, 1
test bl, bl
jne 0x48f6de
mov eax, dword [0x49e4d4]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x48f6de
mov eax, dword [0x49e4d4]
mov eax, dword [eax]
call fcn.00466e78
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x48f6de
cmp byte [esi + 0x588], 0
jne 0x48f6de
mov edx, 0xfffffdf3
mov eax, esi
call fcn.0046e6b0
cmp eax, 4
jne 0x48f64e
mov byte [esi + 0x5e8], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4991ac
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x499242
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x499258
mov eax, 0x499288
call fcn.0040cdb8
push 0
push 0
push 0xe
push esi
call sub.user32.dll_SendMessageA
mov ebx, eax
inc ebx
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004047dc
lea eax, [ebp - 4]
call fcn.004046a8
push eax
push ebx
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0x4014
push 0x8bf00c00
push 0
call fcn.0042b8ac
cmp eax, 0xa6e774
jne 0x499222
mov eax, 0x4992b8
call fcn.00430c48
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004041e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499249
lea eax, [ebp - 4]
call fcn.00404190
ret
Function at 0x4992c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4992c8
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404640
xor eax, eax
push ebp
push 0x499444
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x49945c
mov edx, 0x49946c
mov eax, 0x499478
call fcn.00434160
mov eax, edi
call fcn.00404190
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404650
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x499421
mov eax, ebx
call fcn.00402800
mov esi, eax
push 0x4015
push 0x83855200
push 0
call fcn.0042b8ac
cmp eax, 0xc0c0f0
jne 0x499354
mov eax, 0x4994a8
call fcn.00430c48
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00404650
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4994b0
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.004088fc
push dword [ebp - 0x18]
push 0x4994bc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.004088fc
push dword [ebp - 0x1c]
push 0x4994bc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.004088fc
push dword [ebp - 0x20]
push 0x4994bc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.004088fc
push dword [ebp - 0x24]
mov eax, edi
mov edx, 7
call fcn.00404510
push 0x4015
push 0x8912ae00
push 0
call fcn.0042b8ac
cmp eax, 0xa10da7
jne 0x49941a
mov eax, 0x4994c8
call fcn.00430c48
mov eax, esi
call fcn.00402820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49944b
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004041b4
lea eax, [ebp - 4]
call fcn.00404190
ret
Function at 0x1024864
Capabilities:
Encode data using xor

Disassembly:
jmp 0x102486e
pushal
call 0x1024874
pop ebp
sub ebp, 0x10
sub ebp, 0xc24864
jmp 0x102488a
mov eax, 0xc24864
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c7
mov edx, 0x190fec56
xor byte [eax], dl
inc eax
dec ecx
jne 0x10248a1
jmp 0x10248b4
fstp qword [ebx + 0x566adfdd]
push esi
push esi
xlatb
xchg edi, eax
scasb al, byte es:[edi]
push esi
push esi
push esi
push ebp
wait
out dx, al
push ebx
push esi
push esi
push esi
in al, dx
jle 0x1024922
push esi
push esi
mov eax, dword [0xdd9e55b4]
xlatb
pop edx
push esi
push esi
push esi
push ebp
xchg ebx, eax
push es
invalid
pop ecx
shl dword [edx + 0xba9a9a9], cl
xchg esp, eax
pop edx
push esi
fstp st(2)
jb 0x1024982
push esi
push esi
push esi
xchg esi, eax
xor byte [esi + 0x56], dh
mov bh, 0xf7
push esi
push edi
jp 0x10249b2
pop es
mov esi, 0x56565653
mov edi, 0x56565405
add ebx, ebx
cmp dh, byte [edx + 0x56]
test eax, 0x23a95a23
pop esi
mov esi, 0x565656d2
fucomp st(3)
pop esi
push esi
push esi
push esi
xlatb
cmpsd dword [esi], dword es:[edi]
lea ebx, [ebx - 0x1c]
adc edi, 0xe45b8da7
and dword [ebp - 0x61], 0x68d7a4d7
xor al, 0xc4
xlatb
movsb byte es:[edi], byte [esi]
xlatb
push 0x8465c434
aad 0xbe
push ebx
push ds
pop ecx
rcr byte [eax], cl
push esi
push esi
push esi
pop ecx
ficomp word [esi]
push esi
push esi
push esi
xor ch, bl
dec edx
outsd dx, dword [esi]
salc
lodsd eax, dword [esi]
mov esi, 0x564cd259
push esi
push esi
salc
lodsd eax, dword [esi]
mov edi, 0x5647d259
push esi
push esi
xor bh, dl
lodsd eax, dword [esi]
test eax, 0x43d25973
push esi
push esi
push esi
pop ss
mov edi, 0xa9a9a99a
jg 0x10249d0
test eax, 0x6f1a7fa9
outsd dx, dword [esi]
push edi
aad 0x97
push ebx
aad 0xbe
push edx
mov edi, 0xa9a9a9eb
jg 0x10249c7
outsd dx, dword [esi]
push esp
aad 0x97
push eax
aad 0xbc
push edx
aad 0xbe
push ebx
mov edi, 0xa9a9a9fd
fnstsw word [edx + 0x72]
invalid

Function at 0x409ce1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ce1
lcall 0x5de5, 0x8b10c483
jmp loc.0095f1ac
Function at 0x4010a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x4010a8
mov eax, esi
pop esi
ret

Function at 0x401258
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x18], 0x751
cmp dword [ebp - 0x18], 0x15bf
jle 0x401335
and dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0x58c
cmp dword [ebp - 0x1c], 0x2521
jle 0x4013c6
sbb byte [eax], al
dec ebx
and byte [eax + 0x557d24c7], ah
invalid
mov dword [ebp - 0xc], 0x1f
jmp 0x4013d6
inc ebp
hlt
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x4015fa
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 8]
je 0x4013f3
mov byte [ebp - 1], 1
jmp 0x4013f7
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 3], al
mov dword [ebp - 0x20], 0x44c
cmp dword [ebp - 0x20], 0x1c1a
jle 0x4014c0
dec ebp
push es
ficomp word [ebx]
jg 0x4013c7
test eax, 0x95160919
xor dword [ecx*8 + 0x6122ba38], edi
inc ecx
mov edi, 0x27d4c8da
hlt
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 0xc]
je 0x4014d3
mov byte [ebp - 2], 1
jmp 0x4014d7
mov byte [ebp - 2], 0
mov al, byte [ebp - 2]
mov byte [ebp - 4], al
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
and eax, ecx
je 0x4014ef
and dword [ebp - 0x14], 0
jmp 0x4014fc
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
or eax, ecx
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 0x14]
mov byte [ebp - 5], al
sti
mov dword [ebp - 0x24], 0x128d
cmp dword [ebp - 0x24], 0x156c
jle 0x4015e3
cld
dec edx
mov cl, 0xdd
or eax, 0x151b06ac
xor dword [edi - 0x1589402e], esp
jge 0x401501
pop ebx
invalid
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
movzx eax, byte [ebp - 5]
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x4013cf
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4cdf22
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 0x2c], esp
call fcn.004cdf5b
and eax, 0xae5334a6
push ecx
push ebp
fisttp dword [ebx + 0x2e]
fnsave dword [ecx]
mov esi, 0x50662889
push ax

Function at 0x4cdfd8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4cdfa2
bswap eax
mov al, ah
btr dx, si
jg 0x4cdfb8
lea ebp, reloc.WSOCK32.dll___WSAFDIsSet
mov edi, 0x3764358c
mov dx, 0xccf
pop word [esp]
xchg edx, eax
jmp 0x4cdfbf
Function at 0x4e105a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esi + edi]
xchg dword [esp], eax
lea ebx, reloc.WSOCK32.dll___WSAFDIsSet
lea eax, [esi - 0xe]
xchg dword [esp + 4], ecx
jmp 0x4e1011

Function at 0x4e10c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0xc], ecx
not bx
mov bl, 0xcc
jmp 0x4e109b

Function at 0x4e112a
Capabilities:
Execute anti-debugging instructions

Disassembly:
sbb al, 0xee
mov ah, dl
btr ax, dx
bswap eax
xchg dword [esp], ecx
jmp 0x4e1114

Function at 0x4e178c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push dword [esp + 2]
jp 0x4e17af
push word [esp + 3]
jmp 0x4e17bf
mov dword [esp], ebp
jmp 0x4e1776
push word [esp + 3]
pop word [esp + 3]
jmp 0x4e1835
pop word [esp + 3]
mov dword [esp + 4], esi
jmp 0x4e1839
mov dword [esp + 4], esi
call fcn.004e1805

Function at 0x4e1805
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x4e1854
lea esp, [esp]
push dword [esp + 1]
jge 0x4e17ef
jl 0x4e1818
lcall 0xfbf0, 0x1aef881a
ror byte [ecx - 0x72f7db84], cl
and al, 8
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x4e1854
pushfd
jmp 0x4e115c

Function at 0x4e380f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf04d1d8c
jmp 0x4e38b1
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x3c], edi
lea esp, [esp + 0x3c]
jmp 0x4e391a
lea edi, [esp]
mov dx, di
shl ebx, 0x1b
js 0x4e3894
jns 0x4e38d4
add al, byte [ebp + 0xa8f7c15]
mov ah, 0xa7
into
lea eax, [esi - 0x8f]
jmp 0x4e3854
setge dh
rol bx, cl
jbe 0x4e386a
lea eax, [esi - 0x8f]
jmp 0x4e3854
rdtsc
mov bx, 0x6be9
sub esp, 0xc0
jmp 0x4e38be
rdtsc
mov esi, dword [esp + 0x2c]
mov ecx, 0x49b03cb
jmp 0x4e3884
mov ebp, esp
mov dx, sp
mov ch, byte [esp]
mov ebx, edi
mov ecx, esi
jmp 0x4e38f2
rdtsc
mov bx, 0x6be9
jmp 0x4e389a
jmp 0x4e3936
push sp
mov ebx, eax
rdtsc
lea esp, [esp + 2]
stc
jl 0x4e38dc
stc
lea eax, [ebx + 0x3a]
setle ah
dec edx
inc bx
jmp 0x4e3923
pushfd
jmp 0x4e30f7
dec edx
inc bx
mov edx, 0xad88e99
jmp 0x4e3955
stc
lea eax, [ebx + 0x3a]
setle ah
jmp 0x4e3920
bswap eax
jmp 0x4e40b5
sub esi, 0x7d501fb5
stc
jnp 0x4e393f
bswap eax
mov bl, 0xc4
setno dh
jmp 0x4e40ba
neg bx
call 0x4e39af
xchg ebx, edx
rol esi, 0
bsr bx, sp
jl 0x4e3a39
jge 0x4e3a44
jecxz 0x4e39bd
jne 0x4e3a09
xchg edi, eax
invalid
neg bx
call fcn.004e39c6
mov ax, 0x30b2
call fcn.004e39f5
int3
std
outsb dx, byte [esi]
ljmp 0x228b
dec ecx
xchg dl, dh
push dword [esp]
ret 4
mov ax, 0x6c35
call fcn.004e3a91
xor ch, byte [0x6c35b866]
mov ax, 0x6c35
jmp 0x4e3a3d
lea esp, [esp + 1]
rol esi, 0
jbe 0x4e39a7
ja 0x4e3984
xchg bh, ah
jmp 0x4e3abe
mov dx, bp
mov ax, di
lea edx, reloc.WSOCK32.dll___WSAFDIsSet
bswap edx
jmp 0x4e3a9b
and eax, esp
and bh, ah
add esi, dword [edi]
jmp 0x4e3a7b
push word [esp + 6]
xchg dl, ah
pop ebx
jmp 0x4e3a64
jmp 0x4e3b14
lea edx, [esi*4]
mov bx, 0x2401
lea eax, [eax + ebp]
lea ebx, [edx*4]
sub esp, 0xf
je 0x4e3c79
push word [esp + 6]
xchg dl, ah
pop ebx
lea esp, [esp + 1]
jmp 0x4e3a68
mov bl, 0xc4
setno dh
inc esi
jmp 0x4e3cff
Function at 0x4e5a97
Capabilities:
Encode data using base64

Disassembly:
bts ebx, ecx
jmp 0x4e5ae7
neg edi
call fcn.004e5a9c
bswap ecx
jmp 0x4e5bb9
sub esp, 0xd
lea esp, [esp + 1]

Function at 0x4e5bcb
Capabilities:
Encode data using base64

Disassembly:
pop word [esp]
xchg byte [esp], cl
mov cx, 0x9bc5
push word [esp + 1]
jmp 0x4e5bf9

Function at 0x4e5bdd
Capabilities:
Encode data using base64

Disassembly:
mov word [esp + 1], cx
jmp 0x4e5c4f
xchg word [esp + 1], ax
xchg byte [esp + 2], ch
jmp 0x4e5cba
xchg word [esp + 1], cx
dec bx
jo 0x4e5c39
xchg word [esp + 1], ax
jmp 0x4e5c63
xchg byte [esp + 2], ch
jmp 0x4e5cba
xchg ecx, eax
add ebp, 0x3d9fead
sub esp, 0x1d
lea esp, [esp + 4]
add ebp, 0x4c239a7f
mov cx, 0x4915
mov bl, dl
lea ebx, [ecx + edi]
jmp 0x4e5c69

Function at 0x520a46
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jmp fcn.004f565e

Function at 0x71ac0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edi
mov eax, 0x75cfd278
mov dword [esp + 8], esp
lea esp, [esp + 0xe]
jmp 0x71abee
pop dword [esp]
shl cx, 4
lea ebp, [edi + 0x54]
push word [esp + 6]
sub esp, 0x13
push cx
jmp 0x71abac
mov ebp, 0xe932772b
rdtsc
mov eax, 0xac562a95
jmp 0x71ac2a
mov ebp, 0xd22257a2
mov word [esp + 6], dx
push bp
bsr esi, ebp
xchg dword [esp + 3], edi
jmp 0x71abd8
mov dh, dl
cpuid
push dword [esp]
jmp 0x71abc2
lea edi, [ebx + esi]
shr ah, 6
pop ebp
push di
push word [esp + 0xd]
jmp 0x71ad51
push word [esp + 8]
xchg word [esp + 8], di
lea ebp, [eax + ebp]
mov edx, ebp
xchg dh, ah
jmp 0x71ac14
xchg bl, dl
rcl edx, cl
mov dh, 0xc8
mov ebp, 0x6a65b2ce
cmc
mov ax, bx
jmp 0x71ac50
stc
mov si, ax
mov edx, 0x5223f3c2
setno ch
lea ebx, [eax + esi]
not eax
jmp 0x71ac66
sub esp, 0x10
popal
xchg bh, dh
std
xchg bp, si
mov esi, 0x4eee3b9f
jmp 0x71aca8

Function at 0x71ae8f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [ecx*4]
lea edi, reloc.WSOCK32.dll___WSAFDIsSet
mov bh, 0xd4
jmp 0x71aeb4
neg dl
mov cl, al
jmp 0x71ae79
push word [esp + 4]
lea ecx, [eax + ebp]
add esp, 1
lea esp, [esp + 0x17]
neg dh
lea ebx, reloc.WSOCK32.dll___WSAFDIsSet
jmp 0x71aec5
push dword [esp + 0x13]
add esp, 0x16
not bh
rdtsc
rdtsc
inc cx
jmp 0x71ae95
pushal
mov dword [esp + 0x1f], edi
stc
stc
pushfd
mov byte [esp + 0xd], dh
jmp 0x71aefb

Function at 0x71b0c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ebp, edx
mov ah, byte [esp + 0x30]
push dword [esp + 0x32]
jmp 0x71b0d8
mov al, byte [esp + 0x37]
cpuid
clc
pop ax
mov byte [esp + 1], ch
pop dword [esp + 0x1d]
jmp 0x71b172
mov ecx, 0x327b0925
mov eax, dword [esp + 0x10]
push ecx
push dword [esp + 0x25]
rdtsc
jmp 0x71b147
rdtsc
std
add esp, 0xf
lea ebp, [esp + edx]
mov ebx, esi
xchg cl, bh
jmp 0x71b10c
mov dword [esp + 0x12], edx
sub esp, 0x1e
lea esp, [esp + 0x4b]
mov cl, byte [esp]
call fcn.0071b2da
jae 0x71b1b0
test dword [esi + 0x58], esp
pop ax
xchg cx, bp
push dword [esp + 8]
mov cx, word [esp + 0xe]
mov dword [esp + 0x23], eax
bswap edi
jmp 0x71b131
lea esi, reloc.WSOCK32.dll___WSAFDIsSet
xchg word [esp + 0x29], si
bswap eax
xchg dword [esp + 7], edi
pop di
mov dh, 0xed
jmp 0x71b122
mov edx, edx
iretd
Function at 0x71b49a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, reloc.WSOCK32.dll___WSAFDIsSet
pop word [esp + 1]
pushfd
bswap ebx
rdtsc
pop edi
jmp 0x71b4b7
jmp 0x71b480
not dl
xchg cl, ch
xchg bh, ah
pop word [esp + 8]
mov ax, dx
xchg edx, esi
jmp 0x71b514
add esp, 0
mov ah, byte [esp + 0xc]
xchg dword [esp + 3], ebp
mov dword [esp + 1], esp
bsf ebx, eax
bts ax, cx
jmp 0x71b49c
mov ebx, 0x3b9d82fb
lea ebp, [ecx + ecx]
mov edx, ecx
mov bp, sp
mov ebx, dword [esp]
jmp 0x71b5c7
pop word [esp + 3]
dec edi
sub esp, 0
pop bp
mov byte [esp + 1], dl
pop ecx
jmp 0x71b4fe
lea ecx, [esp + edx]
mov dx, sp
mov bl, cl
mov dword [esp + 0x17], edx
pop word [esp + 0x14]
bts ebp, edi
jmp 0x71b538
btc di, dx
setp dl
pop word [esp + 0x12]
push dword [esp + 0x1c]
push word [esp + 0x19]
neg edx
jmp 0x71b54e
setl dh
xchg byte [esp + 1], ch
btc esi, esi
xchg word [esp], bx
and di, 0xc031
pushal
jmp 0x71b574

Function at 0x71b72a
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x71b754
push word [esp]
push dword [esp + 4]
pop word [esp + 2]
lea esp, [esp + 3]
jmp 0x71b714