joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x42af1823
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..text_1
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x45f556af
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4017fc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x42dbb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x42dc61
test eax, edx
je 0x42dc64
push 0
push 0
cmp word [eax - 0xa], 2
je 0x42dbe1
push edx
mov edx, eax
mov eax, esp
call fcn.00445d8c
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x42dbf7
push eax
lea eax, [esp + 8]
call fcn.00445d8c
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x42dc06
movzx eax, word [eax]
sub eax, ecx
jmp 0x42dc2d
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x42dc47
add ecx, 4
js 0x42dc1e
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x42dc44
push eax
mov eax, ecx
mov edx, 2
call fcn.00445158
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x42dc2b
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x42dc2d
xor eax, eax
ret
test eax, eax
je 0x42dc74
test edx, edx
jne 0x42dbc8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x435128
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0044548c
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.004c8ed2
mov edi, eax
cmp edi, 0x104
jbe 0x4350d2
mov eax, edi
add eax, eax
call fcn.00443324
mov esi, eax
jmp 0x4350d4
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.004c8ed2
push edi
push esi
call fcn.004c92de
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x43510d
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4350f7
mov eax, esp
cmp esi, eax
je 0x43511a
mov eax, esi
call fcn.00443340
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x435154
cmp bl, 0
je 0x435150
cmp bl, 0x41
jl 0x43514b
cmp bl, 0x5a
jg 0x43514b
or bl, 0x20
xor al, bl
inc esi
jmp 0x43512f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x435094
Function at 0x4665e4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4665ea
ret

Function at 0x4e76f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea edi, [edi + 0x6c025ddd]
call fcn.0051af7f
bswap edi
pushal
mov dword [esp + 0x1c], esi
pushal
pushfd
lea edi, [edi - 0x660b65ff]
not di
mov edi, eax
mov byte [esp + 4], 0x27
jmp 0x56de86
lea esp, [esp + 0x40]
call fcn.004eec39
add esi, edi
mov ebx, dword [ebp - 4]
sal si, 0xf
mov esi, dword [ebp - 8]
jmp 0xe0d0cb
clc
add esp, 4
push 0x9998ece2
mov byte [esp], 0x3c
mov byte [esp], al
lea esp, [esp + 4]
jmp 0x54b216

Function at 0x4ebb89
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0057ddd8
inc esp
and cl, dh
pushal
lea ecx, [ecx]
push ebx
jmp 0x55adc9
mov edi, dword [esp + 0x20]
lea esp, [esp + 0x24]
cwde
pop esi
lea ecx, [edi + 0x7c41ca5b]
pop ebx
push 0x15c7d891
mov ebx, eax
mov byte [esp], 0xc9
pushal
pushfd
pushfd
lea esp, [esp + 0x2c]
call fcn.004e8510
bt ecx, edi
push edx
test eax, eax
push 0x2a67a93b
lea esp, [esp + 8]
jne 0x4e8dcd
pushal
call fcn.00e0dc31
movzx ax, al
xchg bx, ax
movzx ax, dl
mov eax, edi
sets bh
lea edi, [edx - 0x6bb73b27]
call fcn.00e1f904
clc
cmp ch, cl
cmp eax, 0x800
lea esp, [esp + 0x28]
jbe 0x4ed423
pushal
pushfd
pushfd
lea esp, [esp + 0x28]
je 0xe3e7b7
push edi
mov dword [esp], ebx
pushal
jmp 0x4e7b84
jmp 0xe2c367
mov ebx, eax
pushfd
lea esp, [esp + 8]
call fcn.004e8510
bt sp, di
stc
cmp bx, di
test eax, eax
jle 0x57d933
pushal
lea esp, [esp + 0x20]
jne 0x4e8dcd
jmp 0xe0edc3
lea esp, [esp + 8]
call fcn.004eec39
stc
setbe bh
or si, cx
shr esi, cl
mov ebx, dword [ebp - 4]
adc si, ax
mov esi, dword [ebp - 8]
cmc
add esp, 4
push 0x1182d996
push 0x18537490
lea esp, [esp + 8]
jmp 0x54b216
push 0x16d2b9a1
lea esp, [esp + 4]
call fcn.0054877c
pushfd
pushfd
bswap bx
mov dword [esp + 4], esi
mov bh, byte [esp]
jmp 0x51620b
push ebx
clc
stc
test edi, edi
mov word [esp], 0x5469
lea esp, [esp + 4]
je 0x55b360
push 0x176738ec
pushfd
movzx eax, word [esi]
call fcn.005138b1
lea esp, [esp + 0x28]
call fcn.0052518c
jmp 0x57670d
jmp 0x52eab5
pushal
pushfd
mov word [esp], 0x1bdf
mov dword [esp + 0x20], eax
push 0x25b2ac73
push dword [esp + 8]
jmp 0x55628d
pushal
rdtsc
lea edi, [ecx + 0x4531b159]
jmp 0x4e91c0
call fcn.0052518c
not bl
lea ebx, [ebp + 0x474ad37e]
pushfd
pop ebx
push esi
jmp 0x4ea11d
push esi
push 0x3e731d37
mov ebx, eax
pushfd
lea esp, [esp + 8]
call fcn.004e8510
pushal
clc
pushfd
test eax, eax
pushal
push esi
call fcn.0054aef5
push esi
bswap di
push ebp
mov edi, eax
mov byte [esp], cl
pushfd
jmp 0x526bcd
jmp 0xe1f30a
jmp 0xe2961d
pushfd
pushfd
lea esp, [esp + 8]
jne 0x4e8dcd
jmp 0x55b2b4
jmp 0x4e7c30
push 0x55c88ab6
mov dword [esp], eax
jmp 0x57122b
pushal
mov byte [esp + 4], dh
lea esp, [esp + 0x20]
je 0xe3e7b7
jmp 0xe24188
Function at 0x4ed3a8
Capabilities:
Encode data using xor

Disassembly:
bswap di
movsx edi, cl
jmp 0xe0f4a5
mov dword [eax + 4], edi
dec di
mov edi, dword [eax + 0x14]
mov dword [esp], 0xdad0ff4
call fcn.004ee760
in eax, dx
in al, 0x6e
mov cl, 0x24
inc dword [edx + ecx]
and esp, dword [0x4045ec47]
mov eax, dword [0xa0b509b9]
aaa
xor al, 0x4e
invalid
mov edi, dword [eax + 0x10]
mov word [esp], ax
jmp 0x52d9dd

Function at 0x5138b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ecx, word [esi + 2]
jmp 0x55b334
pushal
inc ebx
clc
add eax, ecx
mov byte [esp + 0x10], 0xa7
stc
stc
cmp ebx, eax
mov word [esp + 0x18], dx
mov byte [esp], bl
mov dword [ebp - 4], ebx
mov dword [esp + 0x1c], ebx
push 0xb9f0e594
lea esp, [esp + 0x30]
jl 0xe25a4c
pushal
btc eax, ebp
btr ecx, ecx
lahf
mov ecx, dword [ebp + 8]
sub esp, 0xffffffe0

Function at 0x51409d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x38]
je 0x530880
bswap dx
pushal
pushfd
cdq
mov edx, dword [ebp + 0x10]
pop eax
lea eax, [edx - 0x712c4ab8]
jmp 0xe3eed9
sal eax, 0x1e
sub ebx, ebx

Function at 0x51c0aa
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
pushal
call fcn.004eea37
jmp 0xe26c9b
pushfd
cmc
pushfd
mov dword [esp + 4], ebp
test sp, 0xb168
lea ebp, [esp + 4]
jmp 0x551146
pushfd
mov dword [esp], edx
pushfd
pushfd
mov dword [esp + 4], 0x560bbb
jmp fcn.004ea526
clc
push ecx
pushal
clc
cmp dword [ebp + 0xc], 0
pushfd
pushal
pushfd
lea esp, [esp + 0x48]
jg 0x547390
cmc
jmp 0x56ba0a
pushal
movzx ax, al
not ax
lahf
movzx eax, word [ebx]
pushal
push dword [esp]
mov dword [esp + 0x40], esi
jmp 0x55c5f8
call [esi + fcn.00c8a30f]
ret 0x8168
stc
sub esp, 0xfffffffc
ja 0x546e13
push ecx
clc
cmp dword [ebp + 0xc], 0
call fcn.005558e9
add dl, byte [edx - 0xe2556]
mov al, byte [0xffbd12b2]
mov esi, 0x5e94d93f
test al, 0xc6
psubusb mm4, qword [edx + 0x3c]
lds ecx, [ecx + 0x14]
inc ebx
mov esp, dword [eax]
stc
outsb dx, byte [esi]
or cl, al
or al, 0xa1
jp 0x551129
mov dl, 0x14
mov ah, 0xf
mov dl, 0x7e
rcr byte [ebp - 0xd], cl
or eax, 0x5b57b6e3
mov edx, 0x47427612
cmc
mov dh, 0x8d
sbb dword [esi - 0x122cc292], 0xc735f5ea
scasw ax, word es:[edi]
lcall 0x5e6a, 0x8a3ce1b9
cld
sbb byte [0x7214d434], bl
adc ebx, dword [esi - 0x5ef74aee]
jne 0x55120d
invalid
or esp, esp
ljmp 0x7fcd
lea esp, [esp + 0x40]
jo 0x4e750d
pushal
mov dword [esp + 0x1c], edi
bswap di
mov word [esp], 0x67ee
mov di, word [esp + 4]
movzx di, dl
mov dword [esp + 0x18], 0
movsx di, bl
movzx di, dl
movsx di, dl
bswap edi
mov dword [esp + 0x14], 0
not edi
pushfd
movzx di, al
mov dword [esp + 0x14], 0
jmp 0xe33aa7
sub eax, eax
pushfd
pushal
mov byte [esp + 0xc], 0x27
pushal
mov esp, ebp
pushfd
jmp 0xe30e09
push 0x9e522896
call fcn.0053c08d
mov ebp, dword [esp + 4]
pushal
push 0xbc1ba619
push dword [esp + 0x2c]
ret 0x38
pop edi
mov dword [esp + 0xc], 0
call fcn.00578b7e
pushfd
lea edx, [ebp - 0x20c]
pushfd
pushal
pushfd
mov byte [esp + 0xc], 0xd9
lea esp, [esp + 0x30]
jmp 0x52be98
Function at 0x51f733
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], 0x830f42da
pushfd
lea esp, [esp + 0x34]
jb 0xe327a0
cdq
dec bh
dec dword [esi + 0x28]
cwde
lahf
cdq
rdtsc
mov byte [ebp - 1], 1
inc dword [ecx]
rdtsc
cdq
setle dh
pop ebx
cwde
movsx ax, bl
mov edx, dword [esi]
lahf
pushfd
call fcn.00544ffb
xor dl, byte [edi + ebx*4 + 0x79]
add dl, byte [ebp + 0x2a50c550]
mov bl, 0xe2
cmp dword [ebx], eax
dec ebp
mov esp, 0x6a2103b8
mov ebx, 0xb9a705c5
add esp, dword [esi + esi*2 + 0xf]
mov gs, word [edi - 0x666b493f]
inc ecx
mov al, 0xd1
jecxz 0x51f753
inc eax
invalid

Function at 0x526bc2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
jmp 0xe26d5a
lea esp, [esp + 0xc]
je 0x56c262
pushal
mov eax, dword [ebp + 0x10]
bswap ebx
mov byte [esp], ch
jmp 0x54879d

Function at 0x527f22
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebx
setno bh
mov ebx, eax
push eax
push 0x33446da1
pushfd
lea esp, [esp + 0xc]
jmp 0x530885
shld eax, edi, cl
mov eax, dword [ebp - 8]
pushal
pushfd
jmp 0x54878e
test eax, 0xffff0000
call fcn.00510daa

Function at 0x52eb2a
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0055fdd9
clc
cmp dword [ecx + 4], eax
lea esp, [esp + 8]
jg 0x54ad21
jbe 0xe26c34
bswap dx
lea edx, [ebp + 0x196955b6]
xchg dh, cl
lea esp, [esp]
clc
mov cl, al
bt di, 0xc
mov dx, 0x48b8
bswap edx
call fcn.0051d80c
call fcn.00559075
pushfd
call fcn.0050e26d
xchg di, ax
mov eax, dword [esi + 8]
xchg di, bp
pop edi
not bp
movsx ebp, cl
bswap bp
not bp
pop ebp
pushal
push esi
mov byte [esp], 0xeb
push dword [esp + 0x24]
ret 0x2c
jmp 0xe1a42e

Function at 0x534ecd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], edi
lea esp, [esp + 4]
jno 0xe1a249
push 0x50012993
mov dword [esp], eax
jmp 0x5374c2
lea eax, [edi - 0x564e9f1a]
movsx ax, dl
setp al
push ebx
pushfd
mov eax, esi
push dword [esp]
lea esp, [esp + 8]
call fcn.00514d3b
movzx ebx, bl
mov bh, dh
mov ebx, eax
push edx
push 0x6f6c8d20
lea esp, [esp + 8]
jmp 0x530885
call fcn.0057787e

Function at 0x536f93
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x14]
je 0x530880
jmp 0x517f66

Function at 0x548798
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00e295a5
bswap ebx
lea ebx, [ebp - 4]
jmp 0xe239ac
jmp 0xe2c4eb
lea esp, [esp + 0x20]
call fcn.004e9be0
btr si, bp
shr si, 7
test al, ch
lea esi, [ebp*2 + 0x7728e04f]
mov esi, dword [ebp - 4]
pushfd
pushal
mov dword [esp], 0x9166bafd
cmp cx, 0xe78e
test eax, eax
pushal
mov byte [esp + 4], dl
lea esp, [esp + 0x44]
je 0x56c262
rdtsc
rdtsc
xchg dh, al
mov ecx, dword [ebp + 0x14]
cwde
pushal
mov edx, dword [ebp - 8]
push dword [esp + 8]
xchg dword [esp + 0x20], ecx
call fcn.00e2c9de
pushfd
sub ebx, ebx
sub esp, 0xfffffffc
test bl, 0x53
test esi, 0xffff0000
pushfd
jmp 0x5364f4

Function at 0x54ad27
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], bl
mov dword [esp], 0x4e96af
pushal
pushfd
pushal
call fcn.0052e193
Function at 0x54ad39
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
mov dword [esp + 0x24], edi
mov byte [esp], dh
call fcn.004ed608
lea esp, [esp + 0x24]
jbe 0x4ee308
pushfd
lea esi, [eax - 1]
mov byte [esp], bh
mov byte [esp], ch
pushal
lea esp, [esp + 0x24]
jmp 0x4ee30d

Function at 0x551048
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
mov esi, dword [ebp - 8]
cmp al, ah
stc
cmp bx, 0x8f74
cmc
add esp, 8
push ebx
pushal
lea esp, [esp + 0x24]
jmp 0x54b216

Function at 0x57787e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
movsx eax, al
push ebx
pushfd
mov eax, esi
mov byte [esp], cl
pushfd
pushfd
pushal
lea esp, [esp + 0x2c]
call fcn.00514d3b
seta bh
pushfd
movzx bx, cl
bswap ebx
mov ebx, eax
pushal
pushal
push dword [esp]
pushfd
lea esp, [esp + 0x4c]
jmp 0x530885

Function at 0x57cd01
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], dx
lea esi, [eax - 1]
pushal
lea esp, [esp + 0x24]
jmp 0x4ee30d

Function at 0x57cd74
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x16
cmp dx, bx
mov byte [esp], bl
mov word [esp + 4], 0x4337
lea esp, [esp + 0x28]
je 0x558888
pushal
pushfd
jmp 0x54ad47

Function at 0xe189de
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
bt sp, 1
sub ecx, ecx
pushfd
push dword [esp + 0x18]
test eax, eax
jmp 0xe0f7a5
lea esp, [esp + 0x28]
jle 0xe19fda
push 0x713d52ab
shld dx, di, 6
pop edx
lea edx, [esi + 8]
pushfd
bt bp, si
test dl, cl
pushfd
test dword [edx], 0x80000000
jmp 0x4ee6ca
rdtsc
push ebp
cmp bx, 0x78df
sal ax, cl
aas
movzx bp, bl
mov ebp, esp
adc dh, bl
clc
rcl al, 4
movzx eax, word [esi + 2]
sub dh, 0x4b
movzx edx, word [esi]
jmp 0xe303df
push esi
push 0x692eb204
stc
add eax, edx
cmc
add esp, 8
jno 0x5786ed
bt bx, 0xc
cmc
sub ecx, ecx
call fcn.0052d3a2

Function at 0xe19ff9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, byte [ebp - 1]
movsx si, al
xchg si, di
xchg esi, edi
xchg edi, esi
mov edi, dword [esp + 0x20]
bswap si
jmp 0x553bc3
ror ch, 4
lea ecx, [0x55f01c58]
bsr cx, di
push esi
mov eax, dword [edi + eax*8 + 8]
pushfd
mov ecx, eax
clc
call fcn.0054c5d3
bswap bx
movzx ebx, dl
mov ebx, dword [ebp + 0x10]
push 0xc08bc8d0
mov dword [esp], 0
call fcn.0056a56e
pushal
jmp 0x513a8a
mov dword [esp + 4], edx
pushal
call fcn.004eaf95
lea esp, [esp + 0x44]
je 0x558888
pushal
lea esp, [esp + 0x20]
jbe 0x4ee308
call fcn.0057cd01
Function at 0xe2c2a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push 0x300a1c04
lea esp, [esp + 0x24]
jne 0xe39d4d
setle dl
rcl ch, cl
push ebx
push esp
shl dl, cl
neg dh
mov ebx, dword [ebp + 0xc]
btr cx, bx
mov dword [esp], esi
push ebp
neg esi
mov esi, dword [eax + 1]
bts cx, ax
rol dl, 6
clc
shld cx, dx, cl
sub esi, 0x13a5b738
mov cx, 0x9efc
bt dx, 0xf
push esp
xor esi, dword [eax + 0x11]
movsx ax, al
cdq
mov word [esp + 4], si
xchg dword [esp + 4], edi
call fcn.0057e5a7
inc eax
sub esp, 0xfffffff8
jno 0xe322dd
pushfd
cmc
stc
cmp byte [eax], cl
push dword [esp]
pushfd
lea esp, [esp + 0xc]
jb 0x57b5fa
jne 0xe39d4d
inc ch
movsx edx, dl
btr cx, di
xadd cx, dx
push ebx
pushfd
bt si, bp
xchg ebx, ecx
mov ebx, dword [ebp + 0xc]
xadd dh, ch
pushal
xchg dword [esp + 0x20], esi
bts dx, bp
mov esi, dword [eax + 1]
shl dx, 0xa
btr dx, dx
bsr cx, bx
movzx cx, cl
sub esi, 0x13a5b738
clc
bswap dx
movsx cx, bl
lea edx, [esp - 0x4e9638ee]
xor esi, dword [eax + 0x11]
xchg edx, ecx
lea ecx, [esp + 0x29721a2e]
push 0xd17c31e8
xchg dl, ch
mov dword [esp + 0x20], edi
cdq
lea esp, [esp + 0x20]
jbe 0x54749e
not di
mov edi, dword [ebp + 8]
xchg cx, dx
mov ecx, 0x80c83656
mov al, bh
mov ecx, ebx
cdq
not ax
call fcn.0052e087
bt edx, esp
stc
call fcn.00e38edb
bt ax, bx
stc
push ebx
call int.00561796

Function at 0xe3124b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ecx, esi
pushfd
pushfd
lea esp, [esp + 0xc]
jg 0x51b52b
bsr edx, edx
rcr dl, cl
setae al
clc
lea eax, [esi + ecx]
ror dl, 1
btr dx, 3
sal dl, cl
sal dh, cl
cdq
pushal
pushal
stc
sub eax, edx
setbe dl
shr dx, cl
shrd dx, ax, 4
sar eax, 1
bsf dx, dx
movzx edx, word [edi + eax*8 + 4]
test edx, 0x99135ad9
cmc
stc
push 0x333f7bf1
cmp dx, bx
jmp 0xe1a003

Function at 0xe32292
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
add esp, 8
pushal
mov word [esp + 0x18], cx
push dword [esp]
lea esp, [esp + 0x24]
jmp 0x54b216
Function at 0x40dc30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x43c080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x459d3a44
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
sub eax, 0x17d8ad51
je 0x40dd7d
jmp 0x40dc6c
mov eax, dword [ebp - 0x24]
sub eax, 0x2b303842
je 0x40dde8
jmp 0x40dc7f
mov eax, dword [ebp - 0x24]
sub eax, 0x2beb5e54
je 0x40ddfa
jmp 0x40dc92
mov eax, dword [ebp - 0x24]
sub eax, 0x384be433
je 0x40dd0a
jmp 0x40dca5
mov eax, dword [ebp - 0x24]
sub eax, 0x459d3a44
je 0x40dcbd
jmp 0x40dcb8
jmp 0x40de01
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
push eax
mov edx, esp
mov dword [ebp - 0x14], ecx
mov dword [edx], eax
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
mov ecx, dword [ebp - 0x14]
mov edi, dword [edx]
not byte [edi]
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
add byte [edi], 0x79
sub byte [edi], 0x35
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
imul byte [edi]
inc edi
loop 0x40dcdb
mov dword [ebp - 0x18], 0x384be433
jmp 0x40de01
mov ecx, dword [0x43d54c]
mov eax, dword [0x43d548]
mov edx, ecx
sub edx, 0xf42fe8fd
sub edx, 1
add edx, 0xf42fe8fd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2beb5e54
mov ecx, 0x17d8ad51
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x40de01
mov ecx, dword [0x43d54c]
mov eax, dword [0x43d548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2beb5e54
mov ecx, 0x2b303842
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x40de01
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425ee0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x18], 0x17d8ad51
jmp 0x40dc56
Function at 0x4267ab
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4267ea
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4267ea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4267ea
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4267ea
cmp dword [ecx + 0x74], 0xe
jbe 0x4267ea
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42df4b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42dfe8
push ebx
push esi
call fcn.0042df14
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042dea8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42df95
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42dfe7
push edi
push eax
call fcn.0042c9e0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42dfb5
call fcn.0042ca2e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42dfe6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042dea8
add esp, 0x20
test eax, eax
jne 0x42dfd4
push edi
call fcn.0042ca2e
jmp 0x42dfdc
push ebx
call fcn.0042ca2e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42f1f7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x437c20
push 0x437c18
push str.FlsAlloc
push 0x1f
call fcn.0042f0b6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42f22b
push dword [ebp + 8]
mov ecx, esi
call dword [0x435144]
call esi
jmp 0x42f231
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42f275
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x437c30
push 0x437c28
push str.FlsGetValue
push 0x21
call fcn.0042f0b6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42f2ac
push dword [ebp + 8]
mov ecx, esi
call dword [0x435144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42f2b4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x437c38
push 0x437c30
push str.FlsSetValue
push 0x22
call fcn.0042f0b6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42f2ee
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x435144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4345d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4345fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4345fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret