joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64251f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esi*4]
mov byte [esp + 2], dl
jmp 0x642544
Function at 0x6464c2
Capabilities:
Encode data using xor

Disassembly:
fldl2t
salc
or eax, dword [eax]
add byte [eax + 0x2ed3b426], bh
xchg ecx, eax
retf 0xcb5b
jmp 0x6464cf
in al, dx
outsb dx, byte [esi]
cld
wait
jbe 0x646488
inc esi
cmc
jle 0x6464ac
jg 0x64650b
jo 0x6464ba
popal
add bl, dh
inc ecx
jo 0x646542
mov word [esp + 1], bp
add dl, bl
jno 0x6464f5
rcl ecx, cl
xchg cx, ax
xchg cx, ax
mov eax, dword [esp]
jmp 0x6466ac
mov word [esp + 1], bp
jmp 0x6464d4
les esi, [edi + 0x5e]
test eax, 0x12ec83c8

Function at 0x64e614
Capabilities:
Encode data using xor

Disassembly:
xchg byte [esp + 4], al
mov eax, dword [esp + 0x1e]
lea esp, [esp + 0x2c]
jmp 0x63419a
jmp 0x64e58a

Function at 0x64e6ba
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 1]
jmp 0x64e700
mov dword [esp + 2], ebp
call fcn.0064e7b3
in al, 0xc2
mov esp, 0x6fc44eed
pop ebx
xchg edx, eax
adc ch, bl
mov cl, 0x69
mov byte [ebx], ch
inc edx
Function at 0x6652ce
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x665781
and edi, 0xff0000
jmp 0x665133
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
jmp 0x6650f4
and edi, esi
mov ebp, dword [esp]
mov bp, 0xb6b8
mov bx, word [esp]
xchg bx, bp
jmp 0x66510a
mov ebx, dword [ecx + 4]
and eax, 0xff000000
sub esp, 0x17
lea esp, [esp + 3]
jmp 0x6651b0
lea esp, [esp + 4]
popal
shr edi, 8
sub esp, 2
lea esp, [esp + 2]
jmp 0x665121
xor eax, edi
jmp 0x66518d
clc
shl bp, cl
lea ebp, reloc.mscoree.dll__CorExeMain
movzx edi, byte [edi*4 + 0x63d200]
mov ebp, dword [esp]
jmp 0x665160
mov edi, edx
lea ebp, reloc.mscoree.dll__CorExeMain
mov bp, word [esp]
mov ebp, dword [esp]
jmp 0x665273
xor eax, edi
mov edi, edx
shr edi, 0x18
jmp 0x665176
xor eax, dword [ecx]
jmp 0x6651e2
xor eax, edi
lea edi, [esi*4]
mov di, cx
push edi
lea esp, [esp + 0x18]
jmp 0x6651b9
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
jmp 0x665236
xor eax, ebx
push esi
mov esi, ecx
jmp 0x66520e
cmc
mov ebp, 0xff00
and edi, ebp
jmp 0x6651cf
add esi, 0x14
mov dword [esi], ebx
pop esi
mov bh, 0xe3
xchg bh, bl
jmp 0x66521e
push ebp
mov ebp, ecx
jmp 0x66524c
shl ax, 8
lea eax, reloc.mscoree.dll__CorExeMain
lea eax, reloc.mscoree.dll__CorExeMain
mov eax, dword [ecx + 8]
jmp 0x6651eb
add ebp, 0x18
mov dword [ebp], eax
pop ebp
mov ebx, 0x6b98586
bswap ebx
jmp 0x66529f
lea esp, [esp + 3]
jmp 0x665289
and edi, esi
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
lea ebp, reloc.mscoree.dll__CorExeMain
bswap ebp
jmp 0x665204
mov dword [ecx + 0x1c], edx
jmp 0x6652ae
bswap ebx
xor edx, eax
neg ebx
sub esp, 5
pop word [esp]
jmp 0x66525c
mov ebx, 0x772cb379
add ebx, 0x8937368b
pushal
lea esp, [esp + 0x20]
jmp 0x631fb5
push dx
lea esp, [esp + 2]
jmp 0x66514f
mov edi, esi
shr ecx, 8
sub esp, 8
mov edi, edx
call fcn.006652d9
and ecx, esi
push edi
mov edi, ecx
jmp 0x66534d
pop ebp
bswap edi
mov ecx, edx
mov di, 0xb7c8
lea edi, [esp + ecx]
jmp 0x6652ef
shr edi, 0x10
push cx
lea esp, [esp + 2]
and edi, esi
jmp 0x665360
lea edi, [edi*4]
lea edi, reloc.mscoree.dll__CorExeMain
mov ecx, dword [edi]
pop edi
stc
jmp 0x665328
push bx
lea esp, [esp]
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
call fcn.00665335
daa
mov al, 0x26
inc ecx
mov al, 4
cmp ebp, dword [ebp + reloc.mscoree.dll__CorExeMain]
sub edi, dword [esi + reloc.mscoree.dll__CorExeMain]
jns 0xf86e77d1
mov dword [esp + 8], eax
clc
popal
add ebp, 0xc
mov edx, dword [ebp]
jmp 0x66531a
mov eax, edi
push ebp
pushal
jmp 0x665388

Function at 0x665396
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 2
lea esp, [esp + 2]
popal
jmp 0x66542e
mov edi, dword [esp]
and edx, ebp
xor ecx, edx
mov edx, 0x3586ac4
jmp 0x6653b8
shr edi, 0x18
movzx edi, byte [edi*4 + 0x63d200]
xor ecx, edi
mov edi, ebp
jmp 0x6653ce
and edx, esi
pushfd
mov edx, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
jmp 0x6653f4
Function at 0x665556
Capabilities:
Encrypt data using aes

Disassembly:
push 0xa
mov ah, byte [esp]
bswap eax
push esp
call fcn.00665540
das
stosd dword es:[edi], eax
cmp ebx, dword [esi - 0x53]
sbb cl, byte [esi - 0x27]
cmp byte [ebp - 0x7ee3db9c], cl
sti
sub dl, ch
arpl word [eax], ax
lea esp, [esp + 0x1c]
cmp ebx, 0x63ea28
jne 0x631fb5
mov ebp, esp
jmp 0x665516
push dword [esp + 3]
jmp 0x66552c

Function at 0x665a46
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop word [esp]
jmp 0x665a87
lea esp, [esp + 2]
and edi, ecx
push edx
jmp 0x665a71

Function at 0x665c97
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edx, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
jmp 0x665c8f
jmp 0x665c77
and edx, ecx
call 0x665c97
cmp eax, 0x224648d
lea esp, [esp + 2]
jmp 0x665d1a
mov ebx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov di, 0xbc89
not edi
jmp 0x665cf2
mov dword [esi + 8], edi
mov di, 0xbfa3
lea edi, [esi*4]
mov edi, 0x6a871492
btc di, dx
jmp 0x665cbb
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
jmp 0x665d04
sub esp, 0x18
pop dword [esp + 6]
jmp 0x665d40
lea esp, [esp + 8]
xor edi, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
mov edx, dword [esi + 0xc]
jmp 0x665cd9
push dword [esp + 5]
lea esp, [esp + 3]
jmp 0x665de3
and edi, ecx
clc
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
sub esp, 0x1b
jmp 0x665d2a
mov bl, bh
add bl, 0x36
movzx ebx, byte [esi + 0xe]
and ebx, ecx
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
bts bx, di
jmp 0x665db3

Function at 0x665cb3
Capabilities:
Encrypt data using aes

Disassembly:
mov ebp, esi
jmp 0x665c49
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
pushfd
setbe bl
push ebp
jmp 0x665c25
add ebp, 0xd
movzx ebx, byte [ebp]
pop ebp
and edx, ecx
call fcn.00665c8d
inc esp
aad 0x45
sub al, 0xdf
arpl si, dx
inc esi
aam 0xb3
dec esi
invalid
stc
push di
mov byte [esp], dl
lea esp, [esp + 2]
lea esp, [esp + 0x14]
jmp 0x665c3b
lea esp, [esp + 3]
and ebx, ecx
jmp 0x665c67
Function at 0x6e119a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bl, dl
mov dword [esp + 0x12], ecx
xchg dword [esp + 4], edi
xchg byte [esp + 0x14], ch
jmp 0x6e193e
add esp, 8
lea esi, [eax + esi]
std
jmp 0x6e1184
shr dh, 3
pop di
push dx
btc eax, eax
xchg bl, dl
mov al, bh
jmp 0x6e1254
xchg ch, cl
mov dh, dl
cpuid
xchg byte [esp + 0x10], bl
mov edi, dword [esp + 7]
inc ah
jmp 0x6e122c
cmp al, 0xae
xchg byte [esp + 0x11], dh
inc al
mov word [esp + 0x11], si
setle cl
neg di
jmp 0x6e1340
xchg dword [esp], ecx
mov byte [esp + 0x13], dh
bsr dx, ax
mov dh, byte [esp + 1]
stc
mov esi, 0xf1ca9779
jmp 0x6e1242
bswap ebp
mov dh, byte [esp + 0x14]
neg bp
pop bx
inc ah
setnp al
jmp 0x6e12df
mov word [esp + 0xb], si
xchg bl, bh
cld
xchg byte [esp + 7], ch
sub esp, 0x1e
pop word [esp + 0x15]
jmp 0x6e1295
cld
seto al
mov dh, bh
shr ax, 5
xchg cx, si
push ebp
jmp 0x6e1322
xchg si, ax
push word [esp + 0x21]
pushfd
lea esp, [esp + 0x32]
xchg dword [esp + 2], esi
rdtsc
jmp 0x6e12c9
mov edi, dword [esp + 0x1e]
pop dword [esp + 8]
bswap edx
mov ebp, 0x269cf969
lea esi, [edx*4]
not bl
jmp 0x6e12b3
push word [esp + 2]
pop ecx
push ecx
call fcn.006e1353
inc esp
les ebx, [edx + 0x3d]
int3
mov word [esp + 9], sp
mov edi, dword [esp + 0x16]
seto ch
mov al, bl
xchg edi, eax
push dx
jmp 0x6e1308
mov bl, dl
btc cx, di
sete ch
mov cx, bp
mov cl, 0x62
mov bp, word [esp + 2]
jmp 0x6e127e
xchg byte [esp + 9], al
stc
mov byte [esp + 0x1d], cl
xchg word [esp + 7], ax
pop word [esp + 4]
rdtsc
jmp 0x6e1375

Function at 0x6e15b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6e15f0
rdtsc
lea ecx, [eax + edx]
mov edi, ecx
lea edi, [edx + esi]
rdtsc
mov bp, di
jmp 0x6e15da

Function at 0x6e1f0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, byte [esp + 2]
rcr ch, 2
mov ch, byte [esp + 4]
jmp 0x6e1f83
and al, ch
std
rdtsc
lea esp, [esp + 3]
mov ax, si
jmp 0x6e1f66
mov ax, word [esp + 8]
rdtsc
bswap esi
cmc
mov word [esp + 9], dx
bt di, bx
jmp 0x6e1f3b
lea eax, [ecx - 0xae]
push word [esp + 0x19]
mov bh, 0xb5
lea edx, [ecx*4]
jmp 0x6e1fab
rdtsc
mov ebp, dword [esp + 2]
inc edi
bswap eax
sub esp, 0x12
xchg dword [esp + 4], ebp
jmp 0x6e1f51
inc edx
mov si, word [esp + 0xb]
xchg word [esp + 0x15], di
jmp 0x6e1fd6
mov bx, 0x7730
cld
neg bh
push dword [esp + 0xe]
mov byte [esp + 0x19], ch
xchg byte [esp + 0x15], ah
jmp 0x6e1f95
mov cx, 0xd760
xchg byte [esp + 2], bl
pushal
setne ah
jmp 0x6e34f8
lea ebp, [ebp*4]
mov cx, sp
lea esp, [esp + 0x1e]
bswap ecx
setns dl
xchg cx, dx
jmp 0x6e1fc0
shl ecx, cl
mov eax, dword [esp]
rdtsc
call fcn.006e2106
mov edi, 0x318502d
mov eax, ebx
mov bp, 0xf023
xchg edx, eax
bts eax, edx
lea esi, [ebx + ebx]
jmp 0x6e1fee
lea esi, [ecx*4]
lea edi, [ebp + 0x63]
neg esi
lea esp, [esp + 0x24]
add esp, 0
inc ch
jmp 0x6e200f

Function at 0x6e321a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
inc ch
xchg dx, ax
sbb ebx, 0x1cba2045
pop bx
jmp 0x6e2c6e
Function at 0x6e3377
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0
mov eax, dword [esp + 2]
mov ax, 0x33b1
push word [esp + 0xa]
jmp 0x6e33a2
shr bh, cl
cld
clc
bswap ebx
neg ebp
pop word [esp + 1]
jmp 0x6e33c3

Function at 0x6e3620
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
mov ch, cl
adc bl, ah
not eax
xchg byte [esp + 1], bh
jmp 0x6e3652
mov word [esp + 2], si
bswap ecx
mov word [esp + 2], di
btc ebx, edi
jmp 0x6e360a
mov si, 0x4067
mov bp, 0xa85c
push esi
not cx
setb bl
push word [esp + 4]
jmp 0x6e36a2
sub edx, esi
mov al, 0x6a
bt eax, eax
xchg dx, si
mov ah, 0xdc
stc
jmp 0x6e36b5
mov di, cx
mov ah, 0xff
pushal
sub esp, 0xd
mov dx, word [esp + 0x38]
setbe dh
jmp 0x6e368c
pushfd
mov word [esp + 0xa], cx
lea esi, reloc.mscoree.dll__CorExeMain
popal
cld
add esp, 0x15
jmp 0x6e37c1
xchg ebx, edx
mov byte [esp], bh
mov dh, byte [esp]
mov cx, 0x583
push bx
cpuid
jmp 0x6e3740
mov dx, bp
rdtsc
push word [esp + 4]
xchg dword [esp + 3], edx
btr ecx, ebx
jmp 0x6e371f
cld
neg dl
setge cl
bt edx, ebx
mov dh, 0xd0
mov eax, dword [esp]
jmp 0x6e36e6
rdtsc
inc cl
pop dword [esp]
lea esp, [esp + 1]
mov ah, cl
push word [esp]
jmp 0x6e3750
mov al, dl
mov al, 0x3d
xchg byte [esp], cl
xchg byte [esp], bl
push ebp
bsr ecx, ebp
jmp 0x6e36f8
xchg dword [esp], eax
add esp, 2
mov di, word [esp + 3]
xchg di, bp
cpuid
mov ebp, esp
jmp 0x6e3792
neg di
mov ah, 0xa
shl dl, cl
pop cx
neg edi
rdtsc
jmp 0x6e370f
mov bp, si
push word [esp + 2]
push word [esp + 1]
mov ecx, dword [esp + 2]
jmp 0x6e37aa
lea ecx, reloc.mscoree.dll__CorExeMain
xchg cx, dx
neg edi
xchg dword [esp], eax
mov dh, byte [esp + 1]
shl si, 0xb
jmp 0x6e377b
pop dword [esp]
mov ax, word [esp + 2]
sub esp, 0x1e
xor cx, 0x3fa9
jmp 0x6e39b3
lea edx, [eax*4]
lea esp, [esp + 2]
lea esp, [esp + 3]
lea edx, [esp + ebp]
lea esp, [esp + 2]
xchg byte [esp], cl
jmp 0x6e376c
bsf edi, edi
mov di, word [esp + 0x23]
bt bx, bp
sub esp, 0x15
lea esp, [esp + 0x49]
mov ch, byte [esp]
call fcn.006e37dc
push ecx
les ebx, [edx + 0x3d]
int3
xchg esi, ecx
mov cx, ax
btr di, si
push dword [esp + 0x20]
mov word [esp + 8], bp
btr ecx, edi
jmp 0x6e37f2
mov bh, ch
xchg byte [esp + 2], al
setp ah
sub esp, 0xe
btr esi, ebx
lea edx, reloc.mscoree.dll__CorExeMain
jmp 0x6e3821

Function at 0x6e39cd
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
cpuid
pop dword [esp + 0x14]
btr ebx, esi
mov byte [esp + 6], dh
cpuid
jmp 0x6e39e2
xchg bh, cl
xchg esi, ecx
mov al, ch
rdtsc
sub esp, 0x1c
pop dword [esp + 0x11]
jmp 0x6e3a3a
push dword [esp + 0xd]
mov bp, dx
mov ch, bh
pop dword [esp + 5]
pop dword [esp + 3]
lea ecx, [eax*4]
jmp 0x6e3a01
pop edi
mov ah, ch
mov al, byte [esp + 0x2a]
xchg word [esp + 0x27], bp
add esp, 0x20
xchg bh, dh
jmp 0x6e3a17
Function at 0x6e3b46
Capabilities:
Parse pe header

Disassembly:
xchg dword [esp], ebp
jmp 0x6e3b4f
mov si, ax
xchg word [esp + 2], di
push dword [esp + 1]
setae dh
lea edi, [ecx*4]
mov bh, byte [esp + 8]
jmp 0x6e3c74
pushfd
cmc
dec ax
pop ebx
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x6e3b8d
inc di
pop ebp
setns dl
lea ebp, [edx + esi]
xchg dword [esp], esi
not bp
jmp 0x6e3bb9
rdtsc
neg ebx
lea edx, [ecx + ebp]
mov eax, ebp
setae dl
btc bx, si
jmp 0x6e3c26

Function at 0x6e3ba3
Capabilities:
Parse pe header

Disassembly:
mov di, 0x506d
call fcn.006e39cd
push eax
xchg edx, ebp
shr si, cl
push word [esp + 2]
setno dh
jmp 0x6e3a6a
xchg byte [esp + 1], bh
rdtsc
xchg cx, ax
clc
mov bx, 0xb3e0
lea ebp, [esp + 0xb5]
jmp 0x6e3a96
mov ecx, 0xb03fd422
lea ebp, reloc.mscoree.dll__CorExeMain
rdtsc
pop ebx
lea esp, [esp + 0xa]
mov dl, cl
jmp 0x6e3a4d
rdtsc
adc bl, dl
btc si, ax
dec dl
mov edi, dword [esp]
shr dx, cl
jmp 0x6e3adf
mov di, word [esp + 2]
add esp, 2
mov cx, di
cmc
not dx
neg bh
jmp 0x6e3a80
sub esp, 0x14
xchg bp, cx
mov ch, 0x98
mov byte [esp + 7], bh
push word [esp + 0x11]
bsf bp, dx
jmp 0x6e39f8
mov ecx, 0xe27fb060
lea esp, [esp]
cmp ah, 0xfc
jmp 0x6e3dfe
adc bl, 0x2f
mov edi, 0x226d4d61
mov ecx, 0x66740392
neg esi
rdtsc
jmp 0x6e3ac9
xchg edx, edi
btc ax, di
mov bx, 0xcc1a
ror esi, 5
mov di, 0x9935
sbb edx, ecx
jmp 0x6e3aaf
cmp edx, edx
btr cx, dx
pop ax
mov ebx, dword [esp]
not ah
add esp, 0
jmp 0x6e3b72
shr al, cl
mov bl, 0xb1
pop word [esp + 2]
std
not edx
pop dx
jmp 0x6e3b10
lea ecx, [ecx + ecx]
sbb dx, 0xf93
lea ebp, [edx*4]
lea edx, [edx + ebp]
xchg word [esp], si
call fcn.006e3b46
popal
call 0x6e3ba3
ficom word [ecx - 0x3f]
mov al, byte [0xd240b253]
inc eax
daa
sal byte [eax], cl
ror dword [edx - 0x1b], cl
adc al, 0x66
push dword [esp + 3]
sub esp, 4
std
lea esp, [esp + 4]
jmp 0x6e3bed
push sp
call fcn.006e3bfc
push edx
call fcn.006e3c10
lea esp, [esp + 2]
lea esp, [esp + 4]
popfd
lea esp, [esp + 4]
jmp 0x6e3bc8
sub esp, 0x1e
bt si, di
xchg ebp, esi
add esp, 0x17
dec di
xchg bx, ax
jmp 0x6e3b36
lea ecx, [ecx*4]
lea ebp, [esp + 0x87]
xchg ebp, ebx
mov bh, byte [esp]
mov byte [esp], al
mov byte [esp], al
jmp 0x6e3ccb
pop dword [esp]
mov word [esp + 3], si
pop word [esp + 1]
jmp 0x6e3afb
Function at 0x6e3bd5
Capabilities:
Parse pe header

Disassembly:
xor esp, 0xffffffb1
ljmp 0x71c4
push eax
jmp 0x6e1ffa
inc dword [eax + 0x62a00c]
pushfd
call fcn.006e112c
invalid
call 0x6e1fff
jmp 0x6e224a
je 0x6df767
lea esp, [esp + 8]
popal
jmp 0x6df4db
pop eax
sub eax, 0x6e1fff
cmp dword [eax + reloc.mscoree.dll__CorExeMain], 0
jmp 0x6e21d2
call 0x6e24f8
jmp 0x6e3cb2
movzx ebx, word [eax + 0x3c]
jmp 0x6e3cf7
push eax
jmp 0x6e3c4d
push ecx
lea esp, [esp + 3]
mov byte [esp], bl
mov byte [esp], cl
lea esp, [esp + 1]
jmp 0x6e3c9c
pop dword [esp]
mov dword [esp], esp
push ecx
mov word [esp + 1], di
push eax
mov dword [esp + 4], ebp
jmp 0x6e3c37
mov dword [esp], esi
call fcn.006e3c86
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x6e3d19
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x6e3ce1
je 0x6e2556
sub eax, 0x10000
jmp 0x6e3cb6
add ebx, eax
cmp word [ebx], 0x4550
je 0x6df760
jne 0x6e3ce7
insd dword es:[edi], dx
in eax, dx
jge 0x6e3d0e
mul dword [ecx]
jge 0x6e3d0c
insb byte es:[edi], dx
or eax, dword [esi]
loopne 0x6e3d60
rol dword [ebx + 0x26], cl
aad 0x32
salc
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x6e24f3
pop dword [eax]
xchg esi, eax
int1
add dl, ah
xor edi, dword [ebp + reloc.mscoree.dll__CorExeMain]
add ecx, dword [esi + reloc.mscoree.dll__CorExeMain]
invalid

Function at 0x6e3bfc
Capabilities:
Parse pe header

Disassembly:
push word [esp + 2]
mov dword [esp + 4], eax
mov dword [esp], ecx
push sp
lea esp, [esp + 2]
jmp 0x6e3bcf

Function at 0x6e3c10
Capabilities:
Parse pe header

Disassembly:
pop word [esp]
pushfd
lea esp, [esp + 2]
mov dword [esp], ebx
call fcn.006e3bd5
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0x6e3c49
mov ch, 0xa4
xlatb
pop dword ds:[esp]
Function at 0x6e3e80
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov di, 0x506d
call fcn.006e39cd
push eax
xchg edx, ebp
shr si, cl
push word [esp + 2]
setno dh
jmp 0x6e3a6a
xchg byte [esp + 1], bh
rdtsc
xchg cx, ax
clc
mov bx, 0xb3e0
lea ebp, [esp + 0xb5]
jmp 0x6e3a96
mov ecx, 0xb03fd422
lea ebp, reloc.mscoree.dll__CorExeMain
rdtsc
pop ebx
lea esp, [esp + 0xa]
mov dl, cl
jmp 0x6e3a4d
rdtsc
adc bl, dl
btc si, ax
dec dl
mov edi, dword [esp]
shr dx, cl
jmp 0x6e3adf
mov di, word [esp + 2]
add esp, 2
mov cx, di
cmc
not dx
neg bh
jmp 0x6e3a80
sub esp, 0x14
xchg bp, cx
mov ch, 0x98
mov byte [esp + 7], bh
push word [esp + 0x11]
bsf bp, dx
jmp 0x6e39f8
mov ecx, 0xe27fb060
lea esp, [esp]
cmp ah, 0xfc
jmp 0x6e3dfe
adc bl, 0x2f
mov edi, 0x226d4d61
mov ecx, 0x66740392
neg esi
rdtsc
jmp 0x6e3ac9
xchg edx, edi
btc ax, di
mov bx, 0xcc1a
ror esi, 5
mov di, 0x9935
sbb edx, ecx
jmp 0x6e3aaf
cmp edx, edx
btr cx, dx
pop ax
mov ebx, dword [esp]
not ah
add esp, 0
jmp 0x6e3b72
shr al, cl
mov bl, 0xb1
pop word [esp + 2]
std
not edx
pop dx
jmp 0x6e3b10
lea ecx, [ecx + ecx]
sbb dx, 0xf93
lea ebp, [edx*4]
lea edx, [edx + ebp]
xchg word [esp], si
call fcn.006e3b46
popal
call 0x6e3ba3
ficom word [ecx - 0x3f]
mov al, byte [0xd240b253]
inc eax
daa
sal byte [eax], cl
ror dword [edx - 0x1b], cl
adc al, 0x66
push dword [esp + 3]
sub esp, 4
std
lea esp, [esp + 4]
jmp 0x6e3bed
push sp
call fcn.006e3bfc
push edx
call fcn.006e3c10
lea esp, [esp + 2]
lea esp, [esp + 4]
popfd
lea esp, [esp + 4]
jmp 0x6e3bc8
sub esp, 0x1e
bt si, di
xchg ebp, esi
add esp, 0x17
dec di
xchg bx, ax
jmp 0x6e3b36
lea ecx, [ecx*4]
lea ebp, [esp + 0x87]
xchg ebp, ebx
mov bh, byte [esp]
mov byte [esp], al
mov byte [esp], al
jmp 0x6e3ccb
pop dword [esp]
mov word [esp + 3], si
pop word [esp + 1]
jmp 0x6e3afb
Function at 0x41c465
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041bfb8

Function at 0x421244
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004210ba

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401058
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
jmp 0x40109d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403cc0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_printf]
push edi
push str._nCopyright_Dialogic_Corporation_1998._All_rights_reserved._n
call esi
push 0x409940
push str._n_tCTC_Key_Query_Program_Version__s_n_n
call esi
push str._n_nSearching_for_keys..._n_n
call esi
push 1
push 0x4099c0
call fcn.004032a0
add esp, 0x18
mov ebx, eax
mov edi, 0x4099c4
test ebx, ebx
jne 0x403e3f
mov eax, dword [edi - 4]
cmp eax, 6
ja case.default.0x403d0d
jmp dword [eax*4 + 0x403e94]
push str._nCtc_key_type_:_CTC_FULL_KEY
call esi
mov eax, dword [edi]
add esp, 4
cmp eax, 1
jne 0x403e1b
mov eax, dword [edi + 8]
push eax
push str._t_tSerial_No.:__d_n
call esi
add esp, 8
jmp 0x403e2c
push str._nCtc_key_type_:_CTC_OEM_KEY
call esi
mov eax, dword [edi]
add esp, 4
cmp eax, 1
jne 0x403e1b
mov ecx, dword [edi + 8]
push ecx
push str._t_tSerial_No.:__d
call esi
mov edx, dword [edi + 4]
push edx
push str._tNo._of_clients_:__d_n
call esi
add esp, 0x10
jmp 0x403e2c
push str._nCtc_key_type_:_CTC_MID_KEY
call esi
mov eax, dword [edi]
add esp, 4
cmp eax, 1
jne 0x403e1b
mov eax, dword [edi + 8]
push eax
push str._t_tSerial_No.:__d_n
call esi
add esp, 8
jmp 0x403e2c
push str._nCtc_key_type_:_CTC_LOW_KEY
call esi
mov eax, dword [edi]
add esp, 4
cmp eax, 1
jne 0x403e1b
mov ecx, dword [edi + 8]
push ecx
push str._t_tSerial_No.:__d_n
call esi
add esp, 8
jmp 0x403e2c
push str._nCtc_key_type_:_CTC_DESK_KEY
call esi
mov eax, dword [edi]
add esp, 4
cmp eax, 1
jne 0x403e1b
mov edx, dword [edi + 8]
push edx
push str._t_tSerial_No.:__d_n
call esi
add esp, 8
jmp 0x403e2c
push str._nCtc_key_type_:_CTC_MON_KEY
call esi
mov eax, dword [edi]
add esp, 4
cmp eax, 1
jne 0x403e1b
mov eax, dword [edi + 8]
push eax
push str._t_tSerial_No.:__d_n
call esi
add esp, 8
jmp 0x403e2c
push str._nCtc_key_type_:_CTC_H150
call esi
mov eax, dword [edi]
add esp, 4
cmp eax, 1
jne 0x403e1b
mov ecx, dword [edi + 8]
push ecx
push str._t_t_tSerial_No.:__d_n
call esi
add esp, 8
jmp 0x403e2c
push str._t_tNOT_PRESENT_n
jmp 0x403e27
push str._nCtc_key_name_type_not_found
call esi
add esp, 4
add edi, 0x10
cmp edi, 0x409a34
jb 0x403cf9
pop edi
pop esi
pop ebx
ret
lea eax, [ebx - 7]
cmp eax, 4
ja case.0x403e47.8
jmp dword [eax*4 + 0x403eb0]
push str.No_key_present_n
call esi
add esp, 4
jmp 0x403e89
push str.Internal_HASP_error_n
call esi
add esp, 4
jmp 0x403e89
push str.Internal_seed_table_error_n
call esi
add esp, 4
jmp 0x403e89
push str.No_OEM_key_present_n
call esi
add esp, 4
jmp 0x403e89
push ebx
push str.Error_:__d_n
call esi
add esp, 8
push 0
call dword [sym.imp.MSVCRT.dll_exit]
lea ecx, [ecx]
adc al, 0x3d
inc eax
add byte [edi + 0x3d6f0040], bh
inc eax
add byte [edi - 0x47ffbfc3], dl
cmp eax, 0x3dd90040
inc eax
add dl, bh
cmp eax, 0x3e4e0040
inc eax
add byte [esi + 0x3e], bh
inc eax
add byte [edx + 0x3e], bl
inc eax
add byte [esi + 0x3e], ah
inc eax
add byte [edx + 0x3e], dh
inc eax
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
nop
nop
Function at 0x403efa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050d0
push 0x4040a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x409a30], 0xffffffff
or dword [0x409a34], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4099a4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x4099a0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x409a38], eax
call fcn.00404043
cmp dword [0x409980], 0
jne 0x403f7d
push 0x404040
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00404028
push 0x40600c
push 0x406008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x40999c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x409998]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x406004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00403cc0
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret