joyce8/EMBER2024-capa huggingface dataset:
Function at 0x517d70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56eef8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5cf024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x517daa
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x517dcb
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x517db7
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.0040b020
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x517dfc
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x4924924
je 0x517f47
lea eax, [ebx + 4]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x10], 0
call fcn.0051db0e
add esp, 4
mov edi, eax
mov dword [ebp - 0x10], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.004279a0
mov dword [ebp - 4], 1
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
movss xmm3, dword [ebx]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
movd xmm1, eax
addsd xmm0, qword [ecx*8 + 0x596760]
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x596760]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x517ed7
divss xmm0, xmm3
call fcn.0040b0b0
call fcn.0053be00
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x517ebb
cmp eax, 0x200
jae 0x517eb9
shl eax, 3
cmp eax, ecx
jae 0x517ebb
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00426db0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040b020
mov edx, dword [eax]
jmp 0x517eda
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x517f0d
mov dword [ecx + eax*8], edi
jmp 0x517f1f
cmp esi, edx
jne 0x517f16
mov dword [ecx + eax*8], edi
jmp 0x517f23
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x517f23
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0051bc15
int3
Function at 0x5180c0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555e48
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5cf024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
call fcn.004092a0
mov ecx, eax
test ecx, ecx
je 0x518215
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebx]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x51816c
lea ecx, [eax - 1]
test ecx, ecx
js 0x51821f
cmp ecx, eax
jg 0x51821f
cmp word [edx + ecx*2], 0x5c
jne 0x51816c
push ecx
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.0040d130
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
push eax
call fcn.00477830
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x518175
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x518175
push ebx
lea ecx, [ebp - 0x10]
call fcn.00477830
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
mov eax, dword [eax - 0xc]
cmp eax, dword [ecx - 0xc]
jge 0x5181e4
push 0x5c
push ecx
call fcn.0051f59b
add esp, 8
test eax, eax
jne 0x518196
or eax, 0xffffffff
jmp 0x51819a
sub eax, dword [edi]
sar eax, 1
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0040d130
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x5181c6
push dword [edi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.005180c0
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x5181e4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x518203
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00408f80
push 0x80070057
call fcn.00408f80
int3
Function at 0x5196e0
Capabilities:
Query service status
Start service

Disassembly:
sub esp, 0x20
mov eax, dword [0x5cf024]
xor eax, esp
mov dword [esp + 0x1c], eax
push edi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x519717
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0051dacc
add esp, 0x20
ret
push esi
push 0x14
push 0x594948
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
call edi
test esi, esi
je 0x519774
lea eax, [esp + 8]
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [esp + 0x10], xmm0
movq qword [esp + 0x20], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x519771
cmp dword [esp + 0xc], 4
je 0x51978b
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x51978b
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0051dacc
add esp, 0x20
ret
push esi
call edi
mov ecx, dword [esp + 0x24]
xor eax, eax
pop esi
pop edi
xor ecx, esp
call fcn.0051dacc
add esp, 0x20
ret

Function at 0x51ccd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5cf024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x51ccf5
xor eax, eax
jmp 0x51cd51
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x51cd22
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x51cd22
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x51cdd6
cmp dword [edi + 0x4c], 0
je 0x51cd4b
mov ecx, edi
call fcn.0051c94b
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x51cd61
push dword [edi + 0x4c]
push ebx
call fcn.0051c597
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x51cd50
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0051dacc
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x57129c]
mov ecx, dword [ebp - 0x2c]
call esi
test eax, eax
js 0x51cd4b
cmp eax, 1
jle 0x51cda9
cmp eax, 3
jne 0x51cd4b
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x51cd3d
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x51cdc6
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0052c095
add esp, 0x10
cmp esi, eax
jne 0x51cd4b
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x51cd4b
mov ax, bx
jmp 0x51cd50

Function at 0x53598d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0053563e
Function at 0x535998
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005357c8
Function at 0x50baf3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push si
lea esp, [esp + 2]
mov dword [esp + 4], esp
pushal
pop dword [esp + 0xb]
jmp 0x50bb65
pop dword [esp]
lea esp, [esp + 1]
lea esp, [esp + 3]
push ebx
push esp
pushfd
jmp 0x50babc
push 0xf04fec6c
jmp 0x50bc22
jmp 0x50bad2
lea esp, [esp + 0x1c]
jmp 0x50bc9f
mov dword [esp + 0x1c], ebp
call fcn.0050bb0b
pushfd
mov word [esp], cx
mov word [esp + 1], cx
mov byte [esp + 4], ah
lea esp, [esp + 2]
mov dword [esp + 0x1c], edi
jmp 0x50bb4c
mov di, dx
bswap edx
jmp 0x50bbfb
mov esi, dword [esp + 0x2c]
rol eax, cl
jno 0x50bbab
xchg ebp, edx
jmp 0x50bbb6
mov ax, 0x3525
lea ecx, [ebx*4]
mov dl, al
jmp 0x50bbd7
pushfd
jmp 0x50bae2

Function at 0x50bb0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], dl
jmp 0x50bb36
lea esp, [esp + 2]
push word [esp + 1]
jne 0x50baf5
mov byte [esp + 1], dl
mov dword [esp], eax
mov dword [esp + 0x1c], esi
jmp 0x50bb3d
mov dword [esp], eax
mov dword [esp + 0x1c], esi
call fcn.0050bb43
xor dword [ecx - reloc.MSVCRT.dll___dllonexit], ecx
mov dword [esp], eax
pop word [esp]

Function at 0x50bb43
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
pop word [esp]
jmp 0x50bb6e

Function at 0x50bcf8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
push edi
pop word [esp]
lea esp, [esp + 2]
push edx
push esp
call fcn.0050baf3
xchg ebp, edx
mov di, dx
jmp 0x50bbf9
sub esp, 0xc0
jmp 0x50bbe3
mov edi, esp
bswap ecx
neg ah
jb 0x50bc05
jae 0x50bc47
jmp 0x6f3bd46c
bswap edx
lea ebp, [esp]
mov bh, byte [esp]
mov edx, esp
jmp 0x50bbbd
lea ecx, [edx*4]
mov ebx, esi
mov edx, ecx
rdtsc
not dx
mov dx, word [esp]
jmp 0x50bc31
btr ax, di
jb 0x50bc66
bsf ax, sp
neg eax
bswap eax
jmp 0x50bc84
lea ecx, [edx*4]
jmp 0x50bc0c
bswap eax
mov dx, 0xd72a
lea eax, [esi + ebp]
jmp 0x50bc6e
bsf ax, sp
neg eax
jmp 0x50bc50
rol esi, 0
jne 0x50bcca
dec dx
jmp 0x50bca5
mov dx, 0xd72a
lea eax, [esi + ebp]
jmp 0x50bc6e
mov ax, sp
xchg dx, ax
mov cl, bh
jmp 0x50bcb3
neg ah
jmp 0x50bcd6
dec dx
mov ax, sp
xchg dx, ax
mov cl, bh
neg ah
mov cx, bx
xchg ah, dl
rol esi, 0
mov eax, edx
jmp 0x50cd99
push eax
pushfd
lea esp, [esp + 3]
mov byte [esp], ch
lea esp, [esp + 1]
jmp 0x50bb9a
btc ax, dx
je 0x50bd62
jne 0x50bd62
mov dword [reloc.MSVCRT.dll___dllonexit], eax
xor al, 0xb6
and al, 0x43
mov esi, 0x8d4e2741
add eax, 0x8e9494d4
lea eax, reloc.MSVCRT.dll___dllonexit
not dh
mov eax, 0xb2025a5d
rdtsc
jmp 0x50bd0a
mov dx, word [esp]
mov cx, word [esp]
mov dx, word [esp]
jmp 0x50bd20
xor esi, 0x5c1cce0d
bswap ecx
rdtsc
call fcn.0050bd88
ret
jmp 0x50bd3e
jle 0x50c083
lea eax, [ebx + ebp]
jmp 0x50c086
lea eax, [ebx + ebp]
ror esi, 0
jle 0x50bdde
mov dx, word [esp]
mov cx, word [esp]
mov dx, word [esp]
lea eax, reloc.MSVCRT.dll___dllonexit
not dh
jmp 0x50bd28
lea esp, [esp + 0x10]
not esi
rdtsc
mov edx, dword [esp]
bsr cx, ax
jmp 0x50be1e
sub esp, 0x13
mov cl, byte [esp + 8]
lea esp, [esp + 3]
jmp 0x50c275
mov edx, dword [esp]
mov ah, 0xb2
jmp 0x50c30d
stc
js 0x50cae7
mov edx, dword [esp]
mov ah, 0xb2
sub esp, 0x13
mov cl, byte [esp + 8]
lea esp, [esp + 3]
jmp 0x50c275
Function at 0x50e10c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf04fec6c
jmp 0x50e119
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x50e23a
mov ebx, 0xa199636e
neg eax
jbe 0x50e20c
setge ah
jmp 0x50e1ab
mov bl, byte [esp]
mov edi, dword [esp + 0x2c]
mov eax, dword [esp]
neg ebp
ja 0x50e16d
jbe 0x50e14d
setge ah
jmp 0x50e1ab
pushfd
jmp 0x50daf4

Function at 0x50e18c
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x3df2a62
jmp 0x50de94
clc
call fcn.0050de18
stosd dword es:[edi], eax
sub al, 0xa2
lds esi, [ebx + eax*4]
mov edi, 0x3bc8a939
mov dword [eax - reloc.MSVCRT.dll___dllonexit], ebx
ror byte [edi], 0x86
mov dh, 0
add byte [eax], al
shl ah, cl
jmp 0x50dad1
dec ax
jmp 0x50df17
mov ax, dx
not eax
btc ax, bx
jmp 0x50e134
jg 0x50ded4
mov ax, dx
not eax
call 0x50df24
aad 0x8b
add al, 0x24
inc eax
mov ah, dh
mov al, cl
lea eax, [edi - 0x29]
jmp 0x50e336
sub esp, 3
add esp, 2
neg al
pushfd
lea esp, [esp + 1]
push dword [esp + 0xc]
ret 0x10
lea ebx, [ebx - 0x40]
shr al, cl
mov ax, bx
mov ax, 0xae57
lea eax, [eax + 0x83]
xchg dword [esp + 8], ebx
jmp 0x50df59
push edx
ret
neg ah
jmp 0x50df97
mov esp, edi
push edi
lea eax, [ebx*4]
bt eax, ebx
jbe 0x50dfaf
ja 0x50dfee
mov bl, byte [esp]
jmp 0x50e170
sub esp, 0xbc
jmp 0x50e175
call 0x50e18c
mov esi, esp
dec dl
jae 0x50e1ce
lea ebx, [edx + 0x90]
or dx, di
call fcn.0050e1ec
sub eax, dword [edx - 3]
lea ebp, [esp + 4]
pushfd
pop ecx
mov dx, word [esp]
jmp 0x50e152
or dx, di
lea ebx, [edx + 0x90]
jmp 0x50e1b8
xchg dword [esp], ebx
push sp
pushfd
bts eax, edx
pushfd
lea esp, [esp + 2]
jmp 0x50df7a
Function at 0x5100a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x67af9ddd
jmp 0x51017e
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x50faba
stc
jge 0x51008a
jl 0x5100d0
jmp 0x510153
pushfd
xchg byte [esp + 1], al
add esp, 0
ja 0x51013d
pop eax
jmp 0x50fb28
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x50faba
pop eax
jmp 0x50fb28
bswap eax
mov al, byte [esp]
bswap eax
not ax
mov edx, dword [edx + reloc.MSVCRT.dll___dllonexit]
jmp 0x5100b3
bsr eax, edi
jge 0x5101a0
lea eax, [eax + ecx]
mov eax, edi
mov ah, byte [esp]
jmp 0x510183
jmp 0x510168
mov ah, byte [esp]
mov esp, esi
mov eax, 0x29ae8de4
xchg ah, al
jmp 0x5101cb
lea eax, [eax + ecx]
mov eax, edi
jmp 0x510180
push edx
ret
setne dl
jmp 0x5101f2
dec al
jne 0x5101a7
je 0x5101a7
inc dl
mov dl, byte [esp]
mov ah, byte [esp]
jmp 0x5101c0
neg ax
jns 0x51024d
mov al, 0xe2
mov dl, 0x32
jmp 0x51022b
lea eax, [edx*4]
neg ah
jmp 0x510314
lea eax, [edx*4]
neg ah
jmp 0x510314
mov al, 0xe2
mov dl, 0x32
jmp 0x510202
pushal
jmp 0x51026a
pushal
ror bl, 0
rdtsc
bsr dx, ax
jne 0x5102aa
rdtsc
jmp 0x510281
rdtsc
lea esp, [esp + 0x20]
dec bl
dec dx
jmp 0x5102c2
mov ax, 0xa320
lea edx, reloc.MSVCRT.dll___dllonexit
xor ax, dx
jmp 0x5102e7
jmp 0x51027f
xor ax, dx
jmp 0x5102e7
jne 0x51028f
mov ax, 0xa320
lea edx, reloc.MSVCRT.dll___dllonexit
jmp 0x5102ac
jmp 0x51033d
neg bl
rdtsc
lea edx, reloc.MSVCRT.dll___dllonexit
or ah, dh
jbe 0x5102d1
dec ax
bswap eax
mov edx, 0xcca831ae
xchg dx, ax
mov ax, 0xf1f1
call fcn.0051035e
inc edi
invalid
xor bl, 0x5b
mov al, 0x6c
inc dx
jge 0x510269
jl 0x510253
xchg dx, ax
mov ax, 0xf1f1
dec dh
jmp 0x510391
dec ax
bswap eax
mov edx, 0xcca831ae
jmp 0x510327
rol bl, 0
jno 0x5103c6
not dh
jmp 0x5103b0
neg eax
sub esp, 0x19
lea esp, [esp + 0x12]
jmp 0x510533
not dh
neg eax
sub esp, 0x19
lea esp, [esp + 0x12]
lea esp, [esp + 3]
jmp 0x510431
lea esp, [esp + 3]

Function at 0x51040c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x510411
clc
jp 0x5103f6
jnp 0x5103f6
pushal
mov dword [esp + 0x1c], ebp
popal
mov edx, dword [eax]
lea eax, reloc.MSVCRT.dll___dllonexit
jmp 0x5104d0
rdtsc
not ah
cmc
jmp 0x51043f
jmp 0x510455
lea eax, [eax*4]
setg al
mov dword [ebx + esi], edx
neg ebx
ja 0x510474
rdtsc
not ah
cmc
jmp 0x51043f
Function at 0x510804
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dl, dh
bswap edx
mov cl, byte [esp]
jmp 0x510c90
xor esi, 0x47c5ba59
neg dh
jmp 0x510c70
lea eax, reloc.MSVCRT.dll___dllonexit
push ebp
lea esp, [esp + 2]
lea ecx, [ebp*4]
jmp 0x510dc7
neg esi
mov ecx, ebp
mov dx, 0x983c
mov ax, word [esp]
mov al, 0x83
jmp 0x510c24
lea esp, [esp + 2]
lea ecx, [ebp*4]
rdtsc
jmp 0x510dc9
jl 0x510c32
lea eax, reloc.MSVCRT.dll___dllonexit
push ebp
jmp 0x510c5a
lea eax, [edi*4]
mov ax, word [esp]
mov eax, 0xc7f64a12
mov dx, ax
setp dl
jmp 0x510c4a
rdtsc
mov byte [esp + 0x17], al
lea esp, [esp + 3]
jmp 0x510cf4
jae 0x510ce4
sub esp, 0x1b
rcl ch, 4
jmp 0x510ca8
lea esp, [esp + 0x18]
xor esi, 0x29ab03a9
xchg ecx, edx
mov edx, dword [esp]
xchg edx, eax
mov ecx, 0x597b8f35
jmp 0x510cf6
sub esp, 0x1b
rcl ch, 4
rdtsc
mov byte [esp + 0x17], al
lea esp, [esp + 3]
jmp 0x510cc8
lea ecx, reloc.MSVCRT.dll___dllonexit
btr ecx, esp
ja 0x510d86
jbe 0x510d86
or eax, 0x8d7e1b8b
movsd dword es:[edi], dword ds:[esi]
sub al, 0xa2
lds esi, [esi + eax*4]
mov ecx, 0x1cee8198
add al, 0x87
push ebx
sub esi, 0x5387041c
mov dl, 0xec
setnp dh
mov al, 0x12
mov al, byte [esp]
dec eax
jmp 0x510cbe
jle 0x510d51
bsf ax, dx
inc ah
jmp 0x510d57
add esi, dword [ebp]
clc
jle 0x510d6f
mov al, ah
jmp 0x510d71
bsf ax, dx
inc ah
jmp 0x510d32
mov al, ah
call fcn.00510d59
mov edx, 0x44b5d23c
test byte [ecx + ecx - 0x41f40767], 0x28
dec ebx
loop 0x510da3
neg esi
dec ah
jmp 0x510d28
call 0x7715290e
je 0x510e10
mov ecx, edi
rdtsc
btc cx, ax
not ax
lea esp, [esp + 2]
jmp 0x510d15
sub dword [edx + reloc.MSVCRT.dll___dllonexit], esi
invalid

Function at 0x5136cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
not al
pushal
bt ebx, ecx
neg ecx
xchg dword [esp + 0x20], esi
jmp 0x5136b6

Function at 0x51eb46
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0x500e38

Function at 0x54d5b6
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x10]
and ecx, 0xff0000
jmp 0x54d709
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x54d5a0
push dx
sub esp, 0x14
xchg word [esp + 0x10], di
lea esp, [esp + 2]
jmp 0x54d607
push ebx
mov dword [esp], esi
push dword [esp + 3]
lea esp, [esp + 1]
xor ecx, edi
jmp 0x54d5e1
and edx, ebp
pushfd
mov edi, dword [esp + 3]
jmp 0x54d635
mov edx, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x50989c]
sub esp, 1
jmp 0x54d5f7
xor ecx, edx
lea esp, [esp + 0x20]
xor ecx, dword [ebx]
bswap edi
jmp 0x54d6d2
clc
mov edi, edx
and edx, esi
jmp 0x54d61e
mov edx, dword [eax + 4]
cmc
call fcn.0054d6ac
add eax, dword [eax + reloc.MSVCRT.dll___dllonexit]
mov edi, 0x47b4ad3d
mov cl, 0x8c
sub esp, 0x18
pop word [esp + 0xa]
rcl dx, cl
lea esp, [esp + 2]
jmp 0x54d657
add ebx, 4
mov dh, al
lea edx, [eax + edx]
mov dword [edi], ecx
jmp 0x54d66d
mov dl, bl
lea edi, [eax + 0x10]
xor ecx, dword [eax]
setnp dh
jmp 0x54d68a
and edi, 0xff000000
xor ecx, edi
mov di, 0x5b9a
mov di, bx
jmp 0x54d650
Function at 0x58dcea
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 1], di
mov dword [esp], eax
call ecx
jmp 0x58dd20
mov dword [0x50ba0c], eax
jmp 0x504a95

Function at 0x66b21a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 2]
xchg dword [esp], eax
xchg ah, ch
mov dword [esp], ebp
rdtsc
jmp 0x66b23a
mov ecx, 0x274114fc
add esp, 3
jmp 0x66b204
pop word [esp]
mov byte [esp], ch
pop ax
cmc
clc
rdtsc
jmp 0x66b27f
mov ax, 0xdbfd
lea edx, [edx*4]
xchg byte [esp + 1], ch
mov cl, byte [esp + 1]
jmp 0x66b224
mov ch, 0x21
lea esp, [esp]
mov edx, dword [esp]
sub esp, 0xe
cld
mov ax, word [esp + 0xa]
jmp 0x66b269

Function at 0x66b870
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
pop edx
lea ecx, [edi*4]
lea esp, [esp + 6]
jmp 0x66b818
push dword [esp + 1]
mov ecx, dword [esp + 0xa]
xchg dword [esp + 2], eax
xchg edx, eax
shr ax, 0xb
clc
jmp 0x66b704
mov byte [esp], al
bswap edx
xchg dword [esp], ecx
mov cx, word [esp + 1]
xchg ch, dh
jmp 0x66b793
lea esp, [esp]
sbb eax, 0x58ea206d
clc
cmc
std
bsf dx, dx
jmp 0x66b72f
push dword [esp + 5]
add esp, 7
shr ch, 0
neg ch
lea esp, [esp + 3]
xchg dl, cl
jmp 0x66b745
pop eax
rdtsc
shl al, 0
btr edx, edi
mov cx, bx
jmp 0x66b7e3
lea ecx, [eax + ebx]
push esp
mov ecx, ebx
xchg byte [esp + 6], al
mov ah, cl
rdtsc
jmp 0x66b77d
mov dword [esp + 6], ecx
mov dword [esp + 3], eax
neg eax
setp ah
mov dword [esp + 5], edi
xchg byte [esp], dl
jmp 0x66b769
lea esp, [esp]
setle dl
mov dx, 0xf8f2
bswap edx
mov al, 0xeb
jmp 0x66b7f7
mov eax, 0xd98ef8ba
mov dx, word [esp]
cmp dx, cx
mov dl, cl
not edx
mov dh, 1
jmp 0x66b7cd
setae al
lea edx, [ecx + esi]
mov edx, ebp
xchg word [esp + 2], cx
pushfd
pop cx
jmp 0x66b841
bsr ax, di
stc
xchg dword [esp + 1], edx
mov ax, si
pop edx
push dword [esp]
jmp 0x66b7b7
lea edx, [ebp*4]
mov byte [esp + 2], bl
xchg byte [esp + 2], cl
pop dx
jmp 0x66b853
mov dword [esp], ebp
pop cx
rcl ax, cl
dec ah
xchg dl, al
mov al, byte [esp + 4]
jmp 0x66b82a
bswap edx
xchg dx, cx
add esp, 0
std
not ax
push cx
jmp fcn.0066bfea
neg ch
mov cx, 0xa75d
btc eax, ebp
xchg byte [esp + 0xf], dh
neg edx
jmp 0x66b71a

Function at 0x66bdf3
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 0xe], cx
pop dword [esp + 1]
jmp 0x66be1c

Function at 0x66c89e
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0066b079
pushfd
lea esp, [esp + 1]
lea esp, [esp + 0x24]
jmp 0x66c924
call fcn.005be936
jmp 0x66b074

Function at 0x66da5c
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.0066d07f
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x66d07a
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x66d9e0
pushal
mov word [esp + 0xd], bx
pop dword [esp + 7]
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
jmp 0x66d9fc
pop word [esp]
push dword [esp + 1]
mov dword [esp + 0x14], esi
jmp 0x66da2f
Function at 0x10001320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1000133d
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001372
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x1000136e
lea ecx, [ecx]
cmp esi, eax
jae 0x10001372
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001360
cmp esi, eax
jb 0x10001379
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002e60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x102184e0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x121]
lea edi, [ebp - 0x128]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x12c], 0
mov byte [ebp - 0x121], 0
call fcn.100029a0
add esp, 4
pop edi
test al, al
jne 0x10002ef4
push 0x11c
lea ecx, [ebp - 0x120]
push 0
push ecx
call fcn.100b52f0
add esp, 0xc
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10002ee4
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x118]
jmp 0x10002f00
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b197c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x12c]
cmp eax, 6
ja 0x10002f1c
jne 0x10002f0c
cmp ecx, 1
jae 0x10002f1c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b197c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.100b197c
mov esp, ebp
pop ebp
ret