joyce8/EMBER2024-capa huggingface dataset:
Function at 0x583830
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x1254b5c]
xor edx, edx
cmp eax, edx
jne 0x583856
xor eax, eax
mov byte [eax + 0x1254a5c], al
inc eax
cmp eax, 0x100
jl 0x58383e
mov dword [0x1254b5c], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x1254a5c
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x5838e7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x5838ba
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x583888
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x5838f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x583943
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x58392a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x58a2f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d1f3e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0058ac10
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x1123794
call fcn.005bff98
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x58a383
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005bff98
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x58a37c
push 0
mov ecx, eax
call fcn.00581460
mov dword [esi + 0xc], eax
jmp 0x58a385
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x58a385
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x5c2711
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5c2749
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005c06fe
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005c06d6
jmp 0x5c2755
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5c3e06
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5c3e48
call fcn.005c9b30
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5c3e48
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5c3e3f
xor eax, eax
jmp 0x5c3e50
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005c3e56
pop edi
pop esi
pop ebx
ret 4

Function at 0x5ca060
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5ca08e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5ca0ac
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005c9fc6
jmp 0x5ca0ac
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5ca0ac
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005c9fc6
test edi, edi
mov eax, edi
jne 0x5ca096
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10001022
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebp
push esi
push edi
lea eax, [esp + 0xc]
mov ebp, ecx
push eax
push 0x40
push dword [esp + 0x1c]
mov esi, edx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
mov edi, ebp
push dword [esp + 0x1c]
rep movsb byte es:[edi], byte [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x4029d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, eax
xor eax, eax
test esi, esi
je 0x402a28
cmp byte [ebx + esi - 1], 0xa
je 0x4029fc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x40a484], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x403040
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x403204
mov edx, dword fs:[0x18]
xor eax, eax
mov edi, dword [0x40a484]
cmp dword [edx + 0x24], edi
je 0x403127
test byte [0x404068], 8
jne 0x4031b0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x404078], 8
jne 0x403173
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4030c9
cmp esi, 3
jbe 0x403132
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x4030da
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x409358]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
jmp 0x4030c9
mov dword [esp], 0x404078
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x4030a0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x4030a0
mov dword [esp], 0x404068
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x40308b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x403093
mov eax, 0xffffffff
jmp 0x403127

Function at 0x403270
Capabilities:
Accept command line arguments
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___wargv
mov esi, dword [eax]
call sym.__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x4032e0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x403366
cmp ax, 9
je 0x403354
cmp ax, 0x20
je 0x403354
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x4033b2
cmp ax, 0x22
je 0x4033c0
mov dword [ebp - 0x54], 0
add ebx, 2
movzx eax, word [ebx]
test ax, ax
je 0x403366
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x403310
test edi, 1
jne 0x403310
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x403354
cmp ax, 0x20
je 0x403354
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x4033d2
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.wWinMain@16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x54], 1
jmp 0x40332b
and dword [ebp - 0x54], 1
jne 0x403324
xor edi, 1
jmp 0x40332b
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x40337f
Function at 0x1017536e
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
bsf bp, bp
rdtsc
not bl
bsr bx, bp
jmp 0x10175358

Function at 0x101978b5
Capabilities:
Encrypt data using speck

Disassembly:
imul esi, dword gs:[edx], 0x58
das
jmp 0x10163339
call fcn.10197b3c
jmp 0x10163380
push ebx
jmp 0x101979ab
jmp 0x1019794e
push dword [esp + 1]
jmp 0x101978f8
lea esp, [esp + 2]
jmp 0x101978e2
movzx edx, byte [ecx + 1]
jmp 0x10197992
lea esp, [esp + 8]
jb 0x101634d7
mov edx, edi
sub esp, 0x1a
xchg byte [esp + 0xf], dl
jmp 0x101978bb
pop word [esp + 3]
lea esp, [esp + 2]
jmp 0x10197974
pushal
lea esp, [esp + 0x20]
cmp dword [ebp + 0xc], 3
pushfd
push dword [esp + 2]
jmp 0x10197938
movzx ecx, byte [ecx + 2]
sub esp, 0x1f
pop word [esp + 0x17]
lea esp, [esp + 1]
jmp 0x101979a0
lea esp, [esp + 4]
jne 0x1016340c
stc
jmp 0x1019795e
shl edx, 8
or eax, edx
lea esp, [esp + 0x18]
jmp 0x101634d7
or eax, ecx
lea esp, [esp + 0x1c]
jmp 0x1016340c
push esi
lea esi, [edi*4]
lea ecx, reloc.KERNEL32.dll_FreeLibrary
jmp 0x10197c38
mov esi, eax
lea edx, reloc.KERNEL32.dll_FreeLibrary
shr ecx, 0x12
call fcn.101979f1
lea esp, [esp + 0xc]
cmp dword [ebp + 0xc], 2
jmp 0x10197a5e
jmp 0x10197a24
mov edi, eax
call fcn.10197a91
ja 0x10197a46
or al, 0xff
dec ebp
out 0x74, al
adc ebp, esi
sub al, 0x97
dec cl
jb 0x101633b1
mov edi, ecx
jmp 0x10197a48
mov ecx, eax
bts dx, cx
cmc
push 0x3f
jmp 0x10197a13
push edi
mov dl, byte [esp]
mov cx, word [esp]
bswap esi
jmp 0x10197aa9

Function at 0x10197d56
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x10197d5f
mov byte [edx + 2], 0x3d
jmp 0x101977cd
call fcn.10197de1
inc esi
jno 0x10163592
lds edx, [esi + 0x18643594]
cmp dl, ch
inc edx
inc esp
neg esi
sub ecx, ebp
sbb ecx, dword [ecx + 3]
add byte [edx + 0x6950209f], cl
cmp eax, 0x56f51191
jmp 0x10197e4f
bnd jp 0x1016353e
salc
mov edx, 0x9cd294f2
invalid
rcr dword [eax - 0x55], cl
cmp dword [ebp + 0xc], 3
jmp 0x10198054
pop edi
jmp 0x10197f08
push ebp
push dword [esp + 1]
jmp 0x10197f81
jb 0x10163503
jae 0x10197d75
mov word [eax], cs
sahf
stc
or dh, cl
and ah, byte [ebp + 0x68af5c35]
push esp
invalid
lea esp, [esp + 4]
mov byte [edx + 1], cl
jmp 0x10197d40
cmp edi, 0x34
push dx
pushal
lea esp, [esp + 2]
jmp 0x10197d9c
cmp edi, 0x1a
jae 0x101634ed
lea ecx, [edi + 0x41]
jmp 0x1016352f
lea ecx, [edi + 0x47]
jmp 0x1016352f
lea esp, [esp + 0x20]
jae 0x10163519
lea ecx, reloc.KERNEL32.dll_FreeLibrary
jmp 0x10197d86
mov byte [edx + 2], cl
jmp 0x101977cd
pop esi
mov bx, sp
xchg bl, bh
pop ebx
mov ebp, 0xeb260c7
call fcn.10197865
lea esp, [esp + 8]
mov byte [edx + 3], 0x3d
jmp 0x1019785f
jne 0x10197922
cmp ebx, 0x1a
call fcn.10197feb
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0x10198093

Function at 0x10197de1
Capabilities:
Encrypt data using speck

Disassembly:
xor ecx, ecx
cmp edi, eax
jmp 0x10197e13
jae 0x10163560
bswap ecx
jmp 0x10197e29
cmp edi, eax
lea esp, [esp + 4]
jmp 0x10197dcb
push dx
lea esp, [esp + 2]
jmp 0x10197e47
lea ecx, [edi - 4]
jmp 0x1016352f
setne cl
call 0x10197e31
Function at 0x10234a25
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr ebp, esi
jmp 0x10234a65
mov byte [esp + 0x3e], ah
bsf ax, sp
lea ebx, reloc.KERNEL32.dll_FreeLibrary
rdtsc
xchg dword [esp + 0x18], eax
xchg byte [esp + 0x15], ah
jmp 0x10234a4f

Function at 0x10234b96
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr si, bx
rdtsc
clc
mov bl, byte [esp + 2]
jmp 0x10234c38
not ah
mov eax, dword [esp + 2]
lea ecx, [edx*4]
jmp 0x10234c12
bsr ebx, edi
push word [esp + 1]
mov byte [esp + 7], cl
cpuid
rdtsc
xchg edx, edi
jmp 0x10234be8
bsf dx, dx
neg bx
xchg word [esp + 5], si
push bp
push word [esp + 8]
bswap edx
jmp 0x10234c60
mov bx, word [esp + 3]
ror esi, cl
dec dh
not di
cmc
pop dword [esp]
jmp 0x10234bfe
pop word [esp]
rdtsc
pop word [esp + 3]
lea esp, [esp + 4]
jmp 0x10234cb0
xchg byte [esp + 4], bl
neg cx
mov edi, dword [esp]
bsf ax, di
mov dword [esp + 3], esi
mov bp, 0x5ba7
jmp 0x10234c4a
mov word [esp], si
push dword [esp + 2]
mov bx, cx
pop word [esp + 1]
dec ebx
jmp 0x10234cde
mov dx, word [esp + 2]
bsf ax, sp
push dword [esp + 1]
pop di
mov word [esp + 3], ax
xchg ecx, edx
jmp 0x10234c97
cmc
push word [esp + 5]
xchg byte [esp], dh
cpuid
lea ecx, [ecx + ebp]
jmp 0x10234d2f
add esp, 4
and bp, 0xf4ee
or cl, bl
push word [esp + 2]
xchg al, cl
dec di
jmp 0x10234cc8
mov edi, dword [esp + 1]
xchg word [esp], bp
mov ebx, dword [esp + 1]
jmp 0x10234d47
mov cx, word [esp + 6]
pop dword [esp]
xchg word [esp + 2], si
mov dh, byte [esp + 3]
cpuid
shl ebx, 0x1a
jmp 0x10234d19
lea edi, [ebx*4]
mov word [esp + 1], bp
xchg bl, ah
rdtsc
xchg dx, ax
jmp 0x10234dab
pop word [esp + 0x16]
bsr ax, cx
mov eax, 0xb9cb4cf
jmp 0x10234dc1
lea ebp, reloc.KERNEL32.dll_FreeLibrary
xchg dh, cl
pop dword [esp + 0xa]
bt dx, dx
pop bx
pop word [esp + 0x1c]
jmp 0x10234d75
sub esp, 0x1b
lea ebx, reloc.KERNEL32.dll_FreeLibrary
sub esp, 2
pop eax
push dword [esp + 5]
sub esp, 0x17
jmp 0x10234d8b
add esp, 0x16
add esp, 5
lea edi, [ecx + edi]
neg cl
mov ebx, edx
bt bx, bp
jmp 0x10234e19
mov bh, al
lea esp, [esp + 0xf]
mov bp, cx
rdtsc
setnp ch
mov esi, esp
jmp 0x10234de5
not eax
push word [esp + 8]
xchg ecx, eax
sub esp, 2
mov al, cl
sub esp, 0x10
jmp 0x10234dfb

Function at 0x10234f34
Capabilities:
Execute anti-debugging instructions

Disassembly:
not edx
jmp 0x10234f3c
pop word [esp + 9]
xchg dword [esp], ebx
pop esi
and si, 0xae19
mov edi, 0xf15e3da2
xchg di, dx
jmp 0x1023519d
bt ecx, ecx
mov word [esp + 1], di
btc cx, cx
lea eax, reloc.KERNEL32.dll_FreeLibrary
not cx
push dword [esp]
jmp 0x10234f63
pop dword [esp + 3]
lea ebx, [ebx*4]
mov al, dh
setno ch
mov bx, 0x7e54
mov al, 0xbf
jmp 0x10234f79
sets cl
pop dword [esp]
xchg word [esp], dx
mov si, 0xd7a0
mov edx, eax
lea ecx, [eax + ecx]
jmp 0x10234fc6
pop bx
bswap ecx
setne ah
lea edi, [edx + 0xa0]
rcr dl, 6
push word [esp + 0xd]
jmp 0x102350c8

Function at 0x102352c6
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1023530b
pop dword [esp + 0x10]
pop bp
pop eax
pushal
lea esi, [ecx + ebx]
cpuid
jmp 0x102352f5
Function at 0x1023613b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
add esp, 0
add esp, 0x15
jmp 0x1023614a
not dx
mov ebx, dword [esp + 8]
bswap eax
xchg word [esp + 9], bx
setb dl
jmp 0x10236207
mov cx, 0xcf5f
mov byte [esp + 0xf], bh
xchg dword [esp + 0xe], ecx
dec ecx
sub esp, 0x19
xchg ecx, eax
jmp 0x102361d2
btc si, di
xchg al, ah
xchg al, ah
pop word [esp + 0x2a]
setp ah
cpuid
jmp 0x102361b3
mov cl, ch
cmc
not ecx
mov word [esp + 0xa], di
mov ecx, 0xef7292cb
pop di
jmp 0x10236174
not bl
pop ecx
mov bl, 0x45
not si
cmc
mov dword [esp + 0x1b], edx
jmp 0x102361e1
mov edi, eax
xchg ebx, eax
mov cl, al
rol dx, 4
inc edi
dec cx
jmp 0x10236187
bsf si, di
bsr ebx, esp
not dl
xchg dword [esp + 0x17], esi
bsf di, bp
push word [esp]
jmp 0x1023624b
not ax
mov bx, bp
push word [esp + 3]
mov byte [esp + 9], ah
lea ebp, [esp + esi]
rdtsc
jmp 0x102361a0
mov dx, word [esp + 0x10]
popal
lea esp, [esp]
mov cl, 0x28
jmp 0x10236275
mov ebp, 0xdfe915e2
pop eax
rcr cl, 2
sub esp, 0x1e
push word [esp]
jmp 0x1023621d
pop ecx
mov byte [esp + 5], ah
lea esi, [ebx + esi]
cpuid
mov ax, 0x4421
add esp, 0x21
jmp 0x10236233
mov dh, 0xf9
rdtsc
push word [esp]
xchg bp, ax
mov dword [esp], ebx
jmp 0x102362a2
lea ecx, reloc.KERNEL32.dll_FreeLibrary
xchg word [esp], ax
xchg dl, bh
mov si, word [esp]
not ebx
xchg byte [esp], ch
jmp 0x1023625e
xchg cx, ax
call fcn.10236315
enter 0xfffffffffffff25c, 0xffffffffffffff95
sar byte fs:[esi], 1
test eax, 0xab5839
dec eax
jmp 0x10236309
bts cx, ax
pop di
push edx
rcr ecx, cl
setp dl
mov dword [esp], edx
jmp 0x1023628c
retf

Function at 0x1023b5be
Capabilities:
Parse pe header

Disassembly:
call fcn.102347a0
jmp 0x1023b5e1
mov dword [esp], ecx
push word [esp]
mov word [esp + 3], si
mov byte [esp + 2], ah
push word [esp]
mov dword [esp + 8], esi
jmp 0x1023b692
mov eax, dword [eax + 8]
push eax
jmp 0x1023479b
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x1023b627
pushfd
mov dword [esp + 8], edi
lea esp, [esp + 8]
mov eax, dword fs:[0x30]
jmp 0x1023b64b

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4014f8
Capabilities:
Get file size

Disassembly:
mov eax, 0x46dce0
call fcn.004549fc
sub esp, 0x134
push ebx
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4015ce
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push ebx
push 4
push ebx
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x4015c7
push esi
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x4015bd
lea eax, [ebp + 0xb]
push 1
push eax
lea ecx, [ebp - 0x3c]
push dword [ebp + 0xc]
mov byte [ebp - 0x3d], bl
call fcn.00401889
push 0x103
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00401a19
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.00454a50
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0x3c]
call fcn.00401093
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x14]
push esi
call fcn.0040149a
add esp, 0xc
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x401690
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 4
push esi
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
cmp ebx, esi
je 0x4016ed
push edi
push esi
push esi
push esi
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
je 0x4016e5
push dword [ebp + 0xc]
push dword [ebp - 4]
push edi
call fcn.004015f3
add esp, 0xc
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4016f3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov byte [ebp - 4], 0x13
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0x86
mov byte [ebp - 1], 7
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
call fcn.00454b4e
mov esi, eax
pop ecx
test esi, esi
je 0x401741
xor edx, edx
test ebx, ebx
jbe 0x401741
sub edi, esi
mov eax, edx
lea ecx, [edx + esi]
and eax, 3
mov al, byte [ebp + eax - 4]
xor al, byte [edi + ecx]
inc edx
cmp edx, ebx
mov byte [ecx], al
jb 0x40172b
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret