joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e4d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4cabb0]
cmp dword [eax + 0x30], 0
je 0x45e57a
cmp dword [ebx + 0x94], 0
jne 0x45e574
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45e460
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45e574
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45e53a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45e574
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041bc38
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45e549
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45f0dc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45f111
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404324
jmp 0x45f11e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404288
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x460198
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4601d9
mov eax, esi
call fcn.00446328
test al, al
je 0x4601d9
mov eax, dword [ebx + 0x84]
call fcn.00446024
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4601d9
push 0
mov eax, dword [ebx + 0x84]
call fcn.00446024
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x461614
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004046e4
xor eax, eax
push ebp
push 0x461686
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, esi
add edi, edi
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + edi*8 + 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004632b8
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + edi*8 + 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004633cc
cmp esi, dword [ebx + 0x30]
je 0x461670
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004633cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46168d
lea eax, [ebp - 4]
call fcn.00404234
ret

Function at 0x464a04
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 5
ja 0x464a30
cmp dword [esp + 4], 5
jne 0x464a2c
cmp dword [esp + 8], 1
jae 0x464a30
xor eax, eax
jmp 0x464a32
mov al, 1
mov byte [0x4cabec], al
add esp, 0x94
ret
Function at 0x47eb0c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.00456730
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x4910e4
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 1
jne 0x491105
cmp dword [esp + 8], 0
jne 0x491117
cmp dword [esp + 0x10], 2
jne 0x491113
cmp dword [esp + 4], 5
je 0x491117
xor eax, eax
jmp 0x491119
mov al, 1
mov byte [0x4c96dc], al
add esp, 0x94
ret
Function at 0x7f3bd9
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x80ff3d
call fcn.0083ce96
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
jmp 0x7f3bee
jmp 0x7f3a82
pushal
lea esp, [esp + 0x20]
jmp 0x8383fb
push ax
lea esp, [esp + 2]
cmp edi, esi
jmp 0x83827c
jb 0x838394
neg ax
jmp 0x83aad3
jmp 0x83cdd5
je 0x7f3bb0
not eax
setg ah
lea eax, [eax + edi]
jmp 0x83cdbf
push eax
call fcn.00838445
pushal
rdtsc
rdtsc
mov dword [esp + 4], ebp
popal
jmp 0x83842f
lea esi, [esi + 8]
mov ecx, dword [esi]
pop esi
jmp 0x838451
lea esp, [esp + 8]
test ecx, ecx
je 0x7f3bb0
mov di, word [esp]
jmp 0x838492
add dl, 0xc4
bsr esi, ecx
jmp 0x8384cd
mov di, dx
xor edi, edi
call fcn.0080e88e
mov dx, 0x6722
jmp 0x83847c
add esi, ecx
push ebx
mov ebx, ebp
jmp 0x8384f2
lea esp, [esp + 4]
je 0x7f3bb0
stc
cmp esi, ecx
jmp 0x8384d8
mov edx, dword [eax + 0x7c]
btr esi, ebp
mov esi, dword [eax + 0x78]
jmp 0x8384a2
jbe 0x7f3bb0
mov ax, di
jmp 0x838591
add ebx, 0xffffffec
mov dword [ebx], edx
pop ebx
test edx, edx
push edx
jmp 0x8384a9
push esi
pushal
xchg edi, esi
mov dword [esp + 4], ebp
call fcn.00838532
cmp eax, ebx
lea esp, [esp + 4]
jae 0x83826e
jmp 0x839661
sub eax, edx
mov dl, byte [esp]
call fcn.008395d8
pushal
jmp 0x83968f
mov dword [ebp - 0xc], ebx
call 0x839698
out 0x66, al
push dword [esp + 2]
lea esp, [esp + 2]
mov dword [ebp - 4], eax
call fcn.008396dd
enter 0x43f, 0x6b
push ss
mov esi, 0x4c4de717
not dword [ecx]
nop
adc ecx, dword [edx - reloc.WSOCK32.dll___WSAFDIsSet]
invalid
mov eax, dword [ebp - 0x14]
pushfd
add esi, eax
call fcn.0083ab27
push 0x4fb5e189
add dword [ebx - reloc.WSOCK32.dll___WSAFDIsSet], 0xa566f430
aam 0x47
out dx, al
lea esp, [esp + 4]
jmp 0x83826e
pushal
not esi
rdtsc
mov dword [esp + 0x1c], edi
popal
push cx
jmp 0x83cecc
push edi
mov dword [esp], ebx
lea esp, [esp + 4]
test edi, edi
jmp 0x838399
lea esp, [esp + 2]
call fcn.0080e946
jmp fcn.007f3dc9
Function at 0x80336b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], bp
pushal
mov byte [esp + 5], dh
mov byte [esp + 6], cl
call fcn.0080345e
jno 0x8033f0
jae 0x8033ec
test dword [ebp - reloc.WSOCK32.dll___WSAFDIsSet], ecx
dec ebp
scasb al, byte es:[edi]
invalid

Function at 0x805c1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc edx, 0xc5cc7ae5
jle 0x805c65
jg 0x805ca9
or eax, 0x95660393
and dword [esi - reloc.WSOCK32.dll___WSAFDIsSet], edx
aam 0x8d
xor bh, 0x2b
add byte [eax], al
not eax
mov al, byte [esp]
mov ah, al
mov edx, esi
lea eax, [esi*4]
mov ax, word [esp]
rcr dl, cl
jmp 0x805cb2
mov edx, esi
lea eax, [esi*4]
jmp 0x805c75
not eax
mov al, byte [esp]
mov ah, al
jmp 0x805c93
jp 0x805cc8
shr al, cl
jmp 0x805cca
shr al, cl
inc bl
rdtsc
jmp 0x805cd4
mov ax, bx
sbb eax, 0xd52ce44a
jp 0x805d28
lea edx, [eax*4]
jmp 0x805d2f
not dh
mov eax, edx
bts dx, bp
mov dx, 0xd4c8
jmp 0x805dec
sub bl, 0xb2
mov ax, 0x39cc
not dx
neg edx
jge 0x805cf5
jl 0x805d31
push edx
fmul dword [esi + 0x29]
fcomp dword [ecx]
mov esp, 0x3fcca535
mov byte [ebp + ecx*4 + 0x8514], ah
add byte [eax], al
lea edx, [eax*4]
jmp 0x805d0b
not dh
mov eax, edx
bts dx, bp
call fcn.00805dc2
xlatb
mov dx, 0xd4c8
call fcn.00805dd6
xor al, 0xbc
push edx
xor eax, 0x890276c4
sbb dword [eax - 0x75], edi
aaa
movsb byte es:[edi], byte [esi]
sub bh, byte [eax - 0x3463d521]
bound ebx, qword [ebp - 0x1f276f1]
invalid
rol bl, 0
sub esp, 0x10
jle 0x805e73
jg 0x805e4d
fst dword [edx + ecx*8 - 0x53]
pop esp
lahf
inc ecx
ret
xchg byte [esp + 8], dl
and ax, 0x342d
push esp
call fcn.00805e84
lahf
mov edx, esi
mov byte [esp + 0xc], bl
jmp 0x805eec
xchg byte [esp + 8], dl
and ax, 0x342d
push esp
mov edx, esi
jmp 0x805ec0
mov byte [esp + 0xc], bl
jmp 0x805eec
lea esp, [esp + 0x14]
neg bl
mov ax, word [esp]
pushal
sub eax, esi
jmp 0x806402
mov dx, 0x8d65
mov ax, di
rdtsc
xchg dl, al
pushal
call 0x806342
frstor dword [esi - 0x79]
sar dword [edi + reloc.WSOCK32.dll___WSAFDIsSet], 0xf
xor dword [ebx + reloc.WSOCK32.dll___WSAFDIsSet], ecx
and al, 0xeb
inc eax
xchg edi, eax
bswap edx
setg dh
lea eax, [ecx + 0x1a]
xchg dword [esp], ebp
mov esi, 0xf29c7ad6
jmp 0x80637e
mov edx, 0xb8e90680
lea edx, [esi*4]
jmp 0x80649c
rdtsc
xchg cx, bp
rdtsc
push dword [esp]
ret 4
js 0x806489
bsf ax, di
mov dx, di
jmp 0x80636d
bsf ax, di
mov dx, di
mov edx, 0xb8e90680
lea edx, [esi*4]
lea esp, [esp + 0x20]
sub bl, 0x6f
jmp 0x806330

Function at 0x805dd6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, 0xf4c4
cmc
mov edx, ebp
neg eax
xchg dword [esp], ecx
call fcn.00805e24
sbb esi, dword [edx + 0x6d]
jl 0x805e3b
not ah
push dword [esp + 0xc]
ret 0x10
cmp eax, 0xc2c1660c
pop es
xchg dword [esp + 8], ecx
setae dl
mov ah, 0x95
pushfd
jmp 0x805e26
Function at 0x80e7db
Capabilities:
Encode data using xor

Disassembly:
pushfd
lea esp, [esp + 4]
push sp
lea esp, [esp + 2]
jmp 0x80e7ec
push ecx
pushfd
mov cx, 0xe18a
pop ecx
setns ch
xchg cl, ch
jmp 0x80e82a
lea edx, [edx + esi]
setnp dh
xchg dword [esp + 2], edx
xchg byte [esp + 0x14], dl
jmp 0x80e83e
push edx
xchg dh, dl
mov ecx, 0x82e26b70
pushal
mov ecx, 0xf6709014
mov dx, 0x81c0
jmp 0x80e814
mov dword [esp + 5], ebp
mov dl, 0x46
mov ebp, dword [esp]
lea ecx, reloc.WSOCK32.dll___WSAFDIsSet
lea ebp, [eax + ecx]
setno dl
jmp 0x80e907
push di
lea esp, [esp + 2]
mov ecx, dword [esp + 0x24]
lea esp, [esp + 0x28]
jmp 0x7f2f0a
mov ecx, dword [esp]
mov ebp, dword [esp + 5]
mov edx, dword [esp + 0x20]
mov ch, byte [esp]
mov cl, ah
mov cx, sp
jmp 0x80e8ac

Function at 0x80ef9c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax + 8], reloc.WSOCK32.dll___WSAFDIsSet
jmp 0x7f2521
and dword [eax + 4], 0
clc
cmc
and dword [eax], 0
jmp 0x7f24bc
jmp 0x80facf
mov dword [eax + 0xc], reloc.WSOCK32.dll___WSAFDIsSet
call fcn.007f250b
sbb dword [ecx + 0x62eb4c89], ecx
cmp dword [esi + eax*4], esp
loop 0x7f2548
xchg ebx, eax
or ah, byte [ebp - 0x4a17]
invalid
jmp 0x7f24f5
dec eax
xchg dword [ecx - 0x63], ebp
jb 0x7f2579
sti
xor dword [eax], esi
or ah, byte [ecx + ebx*2 + 0x27506749]
add bl, byte [ebx]
outsd dx, dword [esi]
rcl byte [ebx - 0x36]
jmp fcn.007f2540
scasd eax, dword es:[edi]
inc esp
pop esp
push edx
mov esi, 0xf9ee47d4
lea esp, [esp + 4]
jmp 0x7f253b
jmp 0x7f24d2

Function at 0x810314
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x8102e1
rdtsc
lea esp, [esp + 3]
jmp 0x81033d
sub edi, 4
mov eax, dword [esp]
lea ebx, [esp + ecx]
rdtsc
lea eax, [ebx - 0x83]
jmp 0x8103e7
mov ebx, esi
pushfd
dec dh
call fcn.0081038f
adc cl, byte [ebp + 0x5097641d]
mov esp, 0x26eb8c1e
mov eax, dword [reloc.WSOCK32.dll___WSAFDIsSet]
jmp 0x810373
add eax, ecx
mov dl, byte [esp]
mov ebx, esi
bsr ebx, ebx
jne 0x810407
mov ebx, dword [esp]
jmp 0x81045d
mov eax, dword [esi - 4]
mov ebx, dword [esp]
not bx
bsf ebx, ecx
jns 0x81038d
mov ebx, esi
pushfd
dec dh
jmp 0x8103b6
jmp 0x81045a
cmc
jbe 0x810444
pushfd
mov word [esp], ax
push dword [esp + 1]
jmp 0x810497
pushfd
mov word [esp], ax
jmp 0x810493
mov ebx, dword [esp]
mov edx, eax
bswap ebx
mov bx, ax
jmp 0x810409
mov ebx, eax
not bl
mov bx, 0x683e
neg bh
jmp 0x8104a6
mov bx, 0xb768
bsr ebx, edx
ja 0x810466
mov ebx, eax
jmp 0x8104bc
push dword [esp + 1]
lea esp, [esp + 8]
not edx
lea ebx, [ebx*4]
jmp 0x81047c
not edx
jmp 0x810556
not bl
mov bx, 0x683e
neg bh
call fcn.00810504
hlt
clc
call fcn.008105c4
mov eax, 0x5cedf29b
mov esi, 0x711f7a2
fidivr dword [esi + 0x56cffc68]
bt bx, si
jg 0x810540
clc
jmp 0x810541

Function at 0x825524
Capabilities:
Encrypt data using aes

Disassembly:
not ebp
mov dword [ecx], edx
jmp 0x82552e
xchg ebp, ebx
setb dl
movzx edx, byte [eax + 4]
jmp 0x825556
Function at 0x825a2c
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
jmp 0x825a13
and edx, esi
sub esp, 0x13
lea esp, [esp + 3]
mov edx, dword [edx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
sub esp, 5
jmp 0x8259e8
shr edi, 0x18
pushal
pop dword [esp + 0xf]
add esp, 0x18
call fcn.00825a44
pop edx
iretd
jmp 0x8259fe

Function at 0x825a44
Capabilities:
Encrypt data using aes

Disassembly:
movzx edi, byte [edi*4 + 0x7fbf70]
jmp 0x825a46
jmp 0x825a2e
xor ecx, edi
jmp 0x825a7c
and edx, ebp
xor ecx, edx
lea esp, [esp + 0x40]
jmp 0x825a66

Function at 0x825b5d
Capabilities:
Encrypt data using aes

Disassembly:
cmp ebx, 0x7fd798
jmp 0x825b42
xor edx, ecx
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x24]
jmp 0x825b21
jne 0x7f0d2b
lea ebx, [esi + 0x12]
jmp 0x825b91
jmp 0x825b37
mov esi, dword [esp]
mov bh, byte [esp]
mov ebp, 0x914b3adf
jmp 0x825bc3
bswap edi
mov di, 0xcb96
pop edi
bswap ebx
mov bh, byte [esp]
jmp 0x825b5f
push 0xa
lea eax, [ecx*4]
not bl
pop eax
jmp 0x825b75
lea esp, [esp + 4]
pop ebp
pop ebx
ret

Function at 0x825cb5
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 3
add esp, 0
mov byte [esp], ah
jmp 0x825ceb
lea esp, [esp + 1]
push esi
mov esi, ecx
jmp 0x825cd5
Function at 0x825e85
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, edx
shr edi, 0x18
jmp 0x825e90
mov edi, dword [edi*4 + reloc.WSOCK32.dll___WSAFDIsSet]
and edi, ecx
mov edi, dword [edi*4 + reloc.WSOCK32.dll___WSAFDIsSet]
jmp 0x825ec9
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x825f05
xor edi, dword [ebx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
jmp 0x825f82
and ebx, ecx
push sp
lea esp, [esp + 2]
lea esp, [esp + 0x20]
jmp 0x825eef
movzx ebx, byte [ebp]
pop ebp
call fcn.00825f37
mov ebx, dword [ebx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
and ebx, ecx
clc
jmp 0x825ff6
push ebp
mov ebp, esi
add ebp, 2
jmp 0x825f4d
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
stc
call fcn.00825f66
mov dword [eax], edi
pop eax
inc edi
mov edi, ecx
jmp 0x826025
mov ebx, dword [ebx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
lea edi, [esp + ebx]
inc edi
jmp 0x82624e
mov byte [esp + 0x12], ch
call fcn.008260a5
push dx
sub esp, 0x14
push word [esp + 4]
lea esp, [esp + 0x18]
popal
jmp 0x826163
sub esp, 3
mov word [esp], ax
lea esp, [esp + 3]
jmp 0x82618c
and edx, ecx
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
mov edx, dword [esi + 8]
jmp 0x826126
lea ebp, [ebp*4]
lea ebp, reloc.WSOCK32.dll___WSAFDIsSet
mov edx, dword [ebp]
pop ebp
jmp 0x82613c
lea edi, [ebx - 0x34]
jmp 0x82619c
mov dword [esi + 4], edi
btr edi, eax
pushfd
mov ebx, dword [ebx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
jmp 0x826176
mov edi, edx
pushfd
pop word [esp]
lea esp, [esp + 2]
jmp 0x8261f4
and edi, ecx
mov edi, dword [edi*4 + reloc.WSOCK32.dll___WSAFDIsSet]
stc
jmp 0x8261dd
and ebx, ecx
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x826218
shr edi, 0x18
pushfd
mov edi, dword [edi*4 + reloc.WSOCK32.dll___WSAFDIsSet]
cmc
jmp 0x8261a9
stc
jmp 0x82622a
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
movzx ebx, byte [esi + 0xa]
pushfd
jmp 0x826202
mov ebx, dword [ebx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
sub esp, 0x10
push esi
and ebx, ecx
jmp 0x8264f7
mov edi, edx
stc
shr edi, 0x18
pushal
jmp 0x8260e7

Function at 0x825f66
Capabilities:
Encrypt data using aes

Disassembly:
movzx ebx, byte [esi + 5]
sub esp, 6
jmp 0x825fa8
mov edx, dword [edx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
and edx, ecx
pushfd
push word [esp]
jmp 0x825fcf
mov dword [esp], ebx
lea esp, [esp + 2]
and edx, ecx
sub esp, 0xb
add esp, 3
jmp 0x825f8a
dec edx
jmp 0x82601d
lea esp, [esp + 4]
lea esp, [esp + 2]
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
mov edx, dword [esp]
jmp 0x825fb9
mov edx, dword [esi + 4]
push eax
mov eax, esi
jmp 0x826007
Function at 0x82608b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx ebx, byte [esi + 6]
jmp 0x8260c7
mov bx, 0xbde9
mov ebx, dword [esp + 2]
jmp 0x826075
and ebx, ecx
sub esp, 0x14
pop word [esp + 0xd]
lea esp, [esp + 2]
jmp 0x8261c7
mov ebx, dword [ebx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
sub esp, 0x12
lea esp, [esp + 2]
jmp 0x8260b1
pushal
mov bp, word [esp]
mov ax, bx
mov esi, 0x64f02e0e
xchg edi, ebp
mov dword [esp + 8], edx
jmp 0x8260f0
and edx, ecx
push edx
push ebp
jmp 0x826106
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
mov ebx, eax
movzx ebx, byte [esi + 9]
jmp 0x826120

Function at 0x8262dc
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
xor edi, dword [edx*4 + reloc.WSOCK32.dll___WSAFDIsSet]
jmp 0x826308

Function at 0x826838
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x403
jmp 0x82638d
jmp 0x8272f1
call 0x826919
jge 0x7f1629
les esp, [ecx]
les ebx, [eax]
fild dword [ebx - 0x2a]
inc ebx
pop esp
push edx
in eax, 0x90
adc ecx, dword [edx + reloc.WSOCK32.dll___WSAFDIsSet]
add eax, dword [eax]
xchg ebx, eax
cmp cl, bh
and eax, 0x5df5f2c3
and al, byte [esp + ebx*2 + 0x52]
insd dword es:[edi], dx
push esp
invalid
jns 0x7f1614
imul edx, dword [ebx + eax], reloc.WSOCK32.dll___WSAFDIsSet
call 0x82698b
loope 0x7f168e
arpl word [edx - 0x4ddde83], bx
mov word [esp], bp
jmp 0x826893
lea esp, [esp + 4]
je 0x7f158f
cmp al, 0x2f
call fcn.0082683e
cmp bl, 0x41
inc ecx
jb 0x7f15a5
clc
jmp 0x8268d2
cmp bl, 0x5a
push dx
lea esp, [esp + 2]
jbe 0x7f1667
ja 0x7f15a5
sbb dword [0xe627d48d], 0x9bfc6ef1
jbe 0x8268a6
inc esi
jno 0x826967
jmp 0x826fb0
and al, 1
jmp 0x8269a9
jne 0x7f1575
je 0x7f1667
lea esp, [esp + 4]
mov dl, byte [ecx + 2]
call fcn.00826a06
retf 0xd84a
lea esp, [esp + 0x14]
cmp bl, 0x2f
push si
lea esp, [esp + 2]
jmp 0x82697f
lea esp, [esp + 0x1c]
jb 0x7f15fe
call fcn.00826930
mov edx, dword [ebp - 8]
jmp 0x8266f4
cmp bl, 0x61
pushal
pop word [esp + 2]
lea esp, [esp + 2]
jmp 0x826a34
Function at 0x828fb2
Capabilities:
Hash data with md5

Disassembly:
test edi, edi
jmp 0x829079
xchg edx, ebx
inc dl
cmc
jmp 0x828f53
sub esp, 0x1d
mov byte [esp + 3], bl
mov word [esp + 0xe], bp
lea esp, [esp + 1]
jmp 0x828f38
xor ecx, ecx
xchg dx, bx
jmp 0x828f81
cmp eax, 0x40
jne 0x7f1d6e
lea eax, [eax + edi]
push ax
lea esp, [esp + 2]
jmp 0x828f0e
or edx, ebx
push dx
lea esp, [esp + 2]
jmp 0x828f66
movzx edx, byte [eax + 1]
btc bx, dx
movzx ebx, byte [eax]
shl edx, 8
jmp 0x828d77
movzx ebx, byte [eax - 1]
pushal
lea esp, [esp + 0xa]
lea esp, [esp + 2]
jmp 0x828f9f
lea eax, [esi + 0x1a]
jmp 0x828d6d
movzx ebx, byte [eax - 2]
jmp 0x828fa9
shl edx, 8
or edx, ebx
mov ebx, edi
pushfd
jmp 0x828f89
shl edx, 8
call 0x828fb2
adc byte [ebp - 0x25f6dbdc], cl
sub esp, 0x1c
jmp 0x829007
lea esp, [esp + 0x58]
inc ecx
jmp 0x828fe6
mov dword [esp], eax
lea esp, [esp + 1]
lea esp, [esp + 3]
inc dword [ebp + 8]
jmp 0x828f24
add eax, 4
cmp ecx, 0x10
jb 0x828d6d
jae 0x82902c
jmp 0x7c0b7972
push dword [esp]
push sp
lea esp, [esp + 2]
mov dword [ebp + ecx*4 - 0x40], edx
jmp 0x828fbc
lea ecx, [esi + 8]
jmp 0x82926e
mov ax, word [esp]
mov cx, word [esp]
mov eax, 0xb0e8e32d
setle ch
jmp 0x829016
jmp 0x828fd3
jne 0x828d9f
call fcn.00829061
mov al, dl
xor eax, eax
jmp 0x7f1d6e
lea eax, [ebp - 0x40]
pushal
lea esp, [esp + 0x20]
call fcn.0080e6ab
jmp 0x82919d

Function at 0x829049
Capabilities:
Hash data with md5

Disassembly:
test edi, edi
jmp 0x829079
xchg edx, ebx
inc dl
cmc
jmp 0x828f53
sub esp, 0x1d
mov byte [esp + 3], bl
mov word [esp + 0xe], bp
lea esp, [esp + 1]
jmp 0x828f38
xor ecx, ecx
xchg dx, bx
jmp 0x828f81
cmp eax, 0x40
jne 0x7f1d6e
lea eax, [eax + edi]
push ax
lea esp, [esp + 2]
jmp 0x828f0e
or edx, ebx
push dx
lea esp, [esp + 2]
jmp 0x828f66
movzx edx, byte [eax + 1]
btc bx, dx
movzx ebx, byte [eax]
shl edx, 8
jmp 0x828d77
movzx ebx, byte [eax - 1]
pushal
lea esp, [esp + 0xa]
lea esp, [esp + 2]
jmp 0x828f9f
lea eax, [esi + 0x1a]
jmp 0x828d6d
movzx ebx, byte [eax - 2]
jmp 0x828fa9
shl edx, 8
or edx, ebx
mov ebx, edi
pushfd
jmp 0x828f89
shl edx, 8
call 0x828fb2
adc byte [ebp - 0x25f6dbdc], cl
sub esp, 0x1c
jmp 0x829007
lea esp, [esp + 0x58]
inc ecx
jmp 0x828fe6
mov dword [esp], eax
lea esp, [esp + 1]
lea esp, [esp + 3]
inc dword [ebp + 8]
jmp 0x828f24
add eax, 4
cmp ecx, 0x10
jb 0x828d6d
jae 0x82902c
jmp 0x7c0b7972
push dword [esp]
push sp
lea esp, [esp + 2]
mov dword [ebp + ecx*4 - 0x40], edx
jmp 0x828fbc
lea ecx, [esi + 8]
jmp 0x82926e
mov ax, word [esp]
mov cx, word [esp]
mov eax, 0xb0e8e32d
setle ch
jmp 0x829016
jmp 0x828fd3
jne 0x828d9f
call fcn.00829061
mov al, dl
xor eax, eax
jmp 0x7f1d6e
lea eax, [ebp - 0x40]
pushal
lea esp, [esp + 0x20]
call fcn.0080e6ab
jmp 0x82919d

Function at 0x829084
Capabilities:
Hash data with md5

Disassembly:
push eax
jmp 0x8290a7
mov word [esp + 2], bp
jmp 0x8290e9
mov dword [eax + 0x10], reloc.WSOCK32.dll___WSAFDIsSet
jmp 0x829113
lea esp, [esp + 8]
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
jmp 0x8290d3
mov dword [eax + 0x14], reloc.WSOCK32.dll___WSAFDIsSet
ret
Function at 0x838445
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 6]
lea esp, [esp + 2]
push esi
jmp 0x838401

Function at 0x8d6612
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.008d52be
mov eax, dword [eax + 0x1c]
jmp 0x8d65cf
lea esp, [esp + 0x28]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x8d6594
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x8d52b9
lea esp, [esp + 2]
mov dword [esp + 0x28], edi
jmp 0x8d65aa
Function at 0x4013b2
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x34], esi
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41a318]
mov dword [ebp - 0x24], eax
mov eax, dword [0x41a31c]
mov dword [ebp - 0x2c], eax
call fcn.004013ab
mov edi, dword [ebp - 0x10]
mov ecx, dword [0x41a320]
add edi, 0x23f
mov eax, dword [0x41a324]
push 0x20
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], eax
pop esi
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov edx, dword [ebp - 0x14]
mov eax, edx
shl eax, 4
add eax, ecx
mov dword [ebp - 0x1c], 0xedeb2e40
cmp dword [0x476248], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x476244]
cmove eax, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0
cmp dword [0x476248], 0x3eb
mov dword [0x476244], eax
mov eax, dword [0x475cd0]
cmove eax, dword [ebp - 0x1c]
mov dword [0x475cd0], eax
lea eax, [edi + edx]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 4]
sub ebx, eax
mov dword [ebp - 8], eax
mov eax, ebx
mov dword [0x476240], 0xf4ea3dee
shl eax, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
mov eax, ebx
shr eax, cl
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x30]
add edi, 0x61c88647
mov dword [ebp - 0x10], edi
dec esi
jne 0x401404
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
pop edi
mov dword [esi + 4], ebx
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret