joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f960
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43f993
push esi
call fcn.00442a50
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43f98c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43fa19
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43fa02
mov eax, dword [esi + 8]
test eax, eax
je 0x43f9b7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43f9fe
cmp eax, 2
je 0x43fa02
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43f9aa
cmp eax, 3
je 0x43f9dd
cmp eax, 1
jne 0x43f9aa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43f9aa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43f9aa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043fa40
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43fa28
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043fa40
add esp, 4
pop esi
ret

Function at 0x467c10
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x467c48
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00465cc4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00465c9c
jmp 0x467c54
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x469302
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x469344
call fcn.0046efe4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x469344
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46933b
xor eax, eax
jmp 0x46934c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00469352
pop edi
pop esi
pop ebx
ret 4

Function at 0x46f514
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46f542
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46f560
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046f47a
jmp 0x46f560
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46f560
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046f47a
test edi, edi
mov eax, edi
jne 0x46f54a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x650814f8
Capabilities:
Create process on windows
Create process suspended
Query environment variable
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x818]
push ebx
sub esp, 0x89c
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp], 0x1388
call ebx
push eax
mov dword [esp + 4], esi
mov dword [esp + 8], 0x400
mov dword [esp], str.SYSTEMROOT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], str._system32wininit.dll
call sym._strcat
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov edi, eax
lea eax, [ebp - 0x870]
mov dword [esp + 0xc], eax
mov eax, dword [0x65083020]
mov dword [esp], edi
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x65083040
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
mov dword [esp + 8], esi
lea esi, [ebp - 0x418]
mov dword [esp], esi
mov dword [esp + 4], str.regsvr32.exe___s_
call sym._sprintf
lea edx, [ebp - 0x858]
xor eax, eax
mov ecx, 0x10
mov dword [ebp - 0x85c], 0x44
mov edi, edx
lea edx, [ebp - 0x86c]
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 4
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x85c]
mov dword [esp + 0x24], edx
mov dword [esp + 4], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
mov dword [esp], 0x1388
call ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
push ebx
push ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x65081824
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], 0x65090094
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort
Function at 0x6508219c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x650821bb
mov eax, 0
jmp 0x650821ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x650821de
mov eax, 0
jmp 0x650821ff
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x650821fa
mov eax, 0
jmp 0x650821ff
mov eax, 1
leave
ret

Function at 0x65082201
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x65082260
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x65082258
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x65082258
mov eax, dword [ebp - 4]
jmp 0x65082274
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x65082235
mov eax, 0
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x403e59
pop dword [ebp - 8]
mov eax, 0xdb5d7bb8
sub eax, 0xdb1d3d5f
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xd8db5860
add dword [ebp - 0x18], 0x7576eceb
mov dword [ebp - 0x14], 0x89fe3164
add dword [ebp - 0x14], 0xa8351ae1
mov dword [ebp - 0x10], 0x1d762d32
add dword [ebp - 0x10], 0x2ed616fc
mov dword [ebp - 0xc], 0x1f889987
add dword [ebp - 0xc], 0xe0776679
lea eax, [ebp - 0x18]
push eax
mov eax, 0xf7e5ae04
sub eax, 0xf7a52d78
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xf5b34ce8
add dword [ebp - 0x18], 0x7ebf1c6e
mov dword [ebp - 0x14], 0xf117b515
add dword [ebp - 0x14], 0x5054ac60
mov dword [ebp - 0x10], 0x3532428d
add dword [ebp - 0x10], 0x2e3d29df
mov dword [ebp - 0xc], 0x781d5c6c
sub dword [ebp - 0xc], 0x781d5c6c
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x37b88e8f
sub eax, 0x37780dbb
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x39049
push 0
call eax
mov ecx, 0x5115
xor edx, edx
add edx, eax
mov ebx, 0xe579cd47
sub ebx, 0xe538bd47
add ebx, dword [ebp - 8]
mov esi, 0xbbc63025
add esi, 0x9c5a499d
xor dword [ebp - 4], 0x8fa03491
mov edi, dword [ebx]
mov dword [ebp - 4], 0x8b08ab54
sub edi, esi
sub dword [ebp - 4], 0x44947969
mov dword [edx], edi
sub dword [ebp - 4], 0xa3bae71f
add edx, 4
add ebx, 0xe615cc68
sub ebx, 0xe615cc64
loop 0x403f77
add eax, 0x13727
mov ebx, eax
add eax, 5
mov ecx, 0xbb143821
sub ecx, 0xbad43821
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10110e20
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x100440
jmp 0x10110e66
jmp 0x10110ddf
lea esp, [esp]
mov dword [esp + 4], ebp
call 0x10110e20
fimul word [edx - 0x28]
mov edi, 0xef7cf44a
jg 0x10110e0f
jmp 0xa611a842
cli
popfd
insb byte es:[edi], dx
fimul dword [ebx]
xchg ecx, eax
add dword [eax - 0x6d], esp
push edx
mov edx, dword [edx]
and bh, 0x12
lodsb al, byte [esi]
adc edi, edi
je 0x10110e47
add edi, dword [ebx - 0x1c]
pushal
jmp 0x10110efa
retf 0x1c8b
mov si, word [esp]
sub esp, 5
jne 0x10110ea2
xchg ebx, edi
jmp 0x10110e8c
rdtsc
mov ah, dl
mov bx, word [esp]
mov ebp, dword [esp + 0x2c]
jmp 0x10110e50
pushfd
jmp 0x10110a4b
push word [esp + 2]
lea esp, [esp + 3]
jmp 0x10110ead
xchg ebx, edi
push word [esp + 2]
lea esp, [esp + 3]
lea edi, [esp + 4]
push esi
jmp 0x10110edf
bswap edx
lea esp, [esp + 2]
jmp 0x10111028
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x10110e86
push word [esp + 3]
jge 0x10110eb4
bswap edx
lea esp, [esp + 2]
jmp 0x10111028
push dword [esp + 0x12]
push dword [esp + 0x11]
pop word [esp + 0x25]
lea esp, [esp + 2]
jmp 0x10110ed1
jb 0x10110fcb
mov dx, 0xbd97
jmp 0x10110fcf
mov dx, 0xbd97
sub esp, 0xb8
mov esi, esp
xchg ah, ch
shr ax, 5
jmp 0x10110f23

Function at 0x10135cee
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x10135d26
mov dword [esp], ebx
lea esp, [esp + 2]
push esi
mov esi, ecx
jmp 0x10135d10

Function at 0x10135d2d
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x10135d26
mov dword [esp], ebx
lea esp, [esp + 2]
push esi
mov esi, ecx
jmp 0x10135d10

Function at 0x10135de2
Capabilities:
Encrypt data using aes

Disassembly:
movzx ebx, byte [esi + 0x11]
jmp 0x10135e2f
add esi, 0x10
mov edi, dword [esp]
cmc
dec di
jmp 0x10135e14
mov edx, dword [esi]
call fcn.10135f0b
cmp ah, byte [edx + edi + 0x4c6aac5d]
rol dword [ecx + 0x20], 1
shr dword [edi - 0x32], cl
push edx
shl byte [edi - 0x35ac6cae], 0x8b
sbb al, 0x9d
dec eax
les edx, [eax]
adc byte [esi - 9], ah
fisub dword [esi - 0x75]
cld
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
neg dx
mov di, sp
sub esp, 0x14
lea esp, [esp + 0x1c]
jmp 0x10135de8
Function at 0x10135ec0
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
mov bh, byte [esp]
lea ebx, [esi + ebp]
lea ebx, reloc.WINMM.dll_waveOutClose
jmp 0x10135ee1
sub esp, 0x19
lea esp, [esp + 1]
and ebx, ecx
jmp 0x10135ea2
bsf eax, esp
lea ebp, [esi + edi]
mov dword [esp + 0x14], esi
pushal
push dword [esp + 6]
jmp 0x10135eee
push edx
pushal
cpuid
lea ebx, reloc.WINMM.dll_waveOutClose
jmp 0x10135ecb
lea esp, [esp + 0x24]
popal
add edx, 2
movzx ebx, byte [edx]
pop edx
jmp 0x10135f5a
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
mov bx, word [esp]
jmp 0x10135f3c
lea ebp, reloc.WINMM.dll_waveOutClose
mov ebx, dword [ebp]
pop ebp
and ebx, ecx
jmp 0x10135f18
mov ebx, 0xf9268e6f
movzx ebx, byte [esi + 5]
pushal
jmp 0x10135f7e
push ebp
mov ebp, ebx
lea ebp, [ebp*4]
jmp 0x10135f2e
lea esp, [esp + 0x20]
xor edi, dword [edx*4 + reloc.WINMM.dll_waveOutClose]
lea edx, [edx + esi]
jmp 0x10135fa1
and edx, ecx
mov edx, dword [edx*4 + reloc.WINMM.dll_waveOutClose]
and edx, ecx
jmp 0x10135f66
mov edx, dword [ebx]
pop ebx
sub esp, 4
cmc
jmp 0x10135fd8
push ebx
mov ebx, esi
add ebx, 4
jmp 0x10135f8b
push ebx
mov ebx, esi
mov dword [ebx], edi
pop ebx
jmp 0x10135fc2

Function at 0x1013614d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.WINMM.dll_waveOutClose]
mov dx, word [esp]
push dx
jmp 0x101365ca
mov bh, byte [esp]
mov bh, 0xb4
jmp 0x101361a8
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
and ebx, ecx
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
cmp bl, 0xeb
jmp 0x1013617d
movzx ebx, byte [esi + 0xd]
stc
and edx, ecx
sub esp, 0x1a
jmp 0x101361db
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
mov ebx, dword [esp]
mov bx, cx
movzx ebx, byte [esi + 0xa]
jmp 0x10136193
mov word [esp + 0x16], cx
lea esp, [esp + 2]
jmp 0x1013621c
and ebx, ecx
pushal
add esp, 0x16
lea esp, [esp + 2]
lea esp, [esp + 0x30]
jmp 0x101361c8
and edx, ecx
call fcn.10136243
fst dword [ecx - 0x3f]
mov al, byte [0xd2599053]
inc eax
daa
shl byte [ebx + edx*8 + 0x4a], cl
in eax, 0x8b
adc al, 0x95
dec eax
les edx, [eax]
adc al, bh
mov edx, dword [edx*4 + reloc.WINMM.dll_waveOutClose]
clc
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x10136206
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutClose]
sub esp, 8
pop dword [esp]
mov word [esp], bx
jmp 0x101361f6
lea ebx, [ebx*4]
lea ebx, reloc.WINMM.dll_waveOutClose
mov edi, dword [ebx]
pop ebx
and edi, ecx
jmp 0x10136261
shr edi, 0x18
push ebx
mov ebx, edi
jmp 0x101362ca
sbb edi, 0x4467bc0d
sub esp, 0x10
mov edi, edx
clc
jmp 0x10136370
dec edi
mov di, word [esp]
sub esp, 0x16
lea esp, [esp + 2]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
jmp 0x101363a4
not dl
lea esp, [esp + 2]
mov edx, dword [esi + 8]
mov dword [esi + 4], edi
jmp 0x1013645a
Function at 0x10136243
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [esi + 0xc]
call fcn.1013628a
push ds
xchg esi, eax
add al, 0x63
sahf
sub al, 0x8c
or ebx, dword [ebx + reloc.WINMM.dll_waveOutClose]
cmp dword [ebp + reloc.WINMM.dll_waveOutClose], ecx
lea esp, [esp + 0x38]
xor edi, dword [edx*4 + reloc.WINMM.dll_waveOutClose]
jmp 0x1013622d
adc al, 0x9a
or byte [edi - 0x66], ch
pop edi
jbe 0x10136257
lea esp, [esp + 0x38]
xor edi, dword [edx*4 + reloc.WINMM.dll_waveOutClose]
jmp 0x1013622d
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
mov eax, 0xaf5ccd52
mov dh, 0x8b
cmp al, 0xbd
dec eax
enter 0x1010, 0xffffffffffffff83
in al, dx
or byte [edi - 0x7699dbfc], cl
sbb al, 0x24

Function at 0x1013628a
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esi + 8], edi
mov edi, dword [esp]
mov di, ax
jmp 0x101362aa
push dword [esp + 2]
add esp, 0
cmc
jmp 0x10136274
pushal
mov bh, 0x46
mov dword [esp], edx
pushfd
lea esp, [esp + 4]
jmp 0x101362f4
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
mov di, 0x75b3
push ebx
not edi
jmp 0x10136294
popal
shr edi, 0x18
push ebp
sub esp, 0
call 0x101362de
and ebx, ecx
jmp 0x10136340
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
pushfd
mov word [esp + 1], ax
call fcn.10136355
jl 0x1013638d
salc
inc ecx
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
mov bx, 0xfef2
movzx ebx, byte [esi + 0xe]
jmp 0x1013632a
dec eax
les edx, [eax]
adc bl, ch
invalid

Function at 0x1013a3be
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 2
sub esp, 0x18
pop word [esp + 5]
jmp 0x1013a41f
add eax, ecx
call fcn.1013a406
mov ebx, dword [esi + 0x18]
clc
jmp 0x1013a44b
push edi
mov edi, dword [esp]
lea edi, [edi + ebp]
mov di, 0x57ee
jmp 0x1013a480
mov ebp, esi
add ebp, 0x1c
mov eax, dword [ebp]
pop ebp
jmp 0x1013a48c
mov edi, dword [esi + 0x24]
mov dword [ebp - 0x10], eax
setle al
push ebp
jmp 0x1013a458
pushfd
mov byte [esp], bl
jmp 0x1013a592
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
js 0x1013a083
jns 0x1013a250
add eax, ecx
push cx
lea esp, [esp + 2]
lea esp, [esp + 8]
dec ebx
jmp 0x1013a4c5
add edi, ecx
push esp
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x1013a545

Function at 0x1013a406
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0x1013a43c
lea esp, [esp + 0x38]
push ebx
setge bh
mov ebx, 0x5ac994
jmp 0x1013a426

Function at 0x101f4b9e
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
mov dword [esp + 0x1c], ebp
push ebx
pop word [esp]
push word [esp + 1]
mov byte [esp], cl
mov dword [esp + 0x1c], esi
jmp 0x101f4bb1
pop word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esp
jmp 0x101f4b81
push ecx
mov dword [esp], ebx
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
mov eax, dword fs:[0x30]
jmp 0x101f4bf6
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x101f4be0
Function at 0x23b165
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x26f63b
setnp ch
dec dword [esi + 0x28]
jmp 0x265330
pushfd
mov byte [ebp - 1], 1
pushfd
movsx ax, cl
rdtsc
mov ebx, dword [esp + 0xc]
setno dh
pop edx
rdtsc
mov edx, dword [esi]
push dword [esp + 8]
jmp 0x295153
push ebp
mov dword [esp + 0x10], 0x270f07
pushfd
mov dword [esp + 0x10], eax
push dword [esp]
push dword [esp + 8]
pushfd
push dword [esp + 0x1c]
ret 0x20
mov eax, dword [edx + 8]
lea ecx, [esp + 0x39c78d1f]
jmp 0x2a3d32
setns cl
movzx cx, cl
mov ecx, esi
jmp 0x22cb32

Function at 0x253663
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xe16e68cc
lea ecx, [ecx + 0x72b9a79e]
call fcn.00294e5d
call fcn.0025a29a
push ebp
lea esp, [esp + 0x1c]
jle 0x29cd03
mov ecx, dword [ecx + 0x713ef]
pushal
pushal
lea ecx, [ecx + 0x72b9a79e]
mov word [esp], 0x81e6
xchg dword [esp + 0x40], ecx
push edi
push 0x5f954c2
mov dword [esp], esi
push dword [esp + 0x48]
ret 0x4c
pushal
mov ecx, dword [ecx + 0x713ef]
pushfd
jmp 0x26238d
jmp 0x23b155
jmp 0x25b95f

Function at 0x26ebd4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esi + 0xa82bce2]
cmc
bsr ax, di
mov ecx, dword [ebp + 8]
daa
movzx ax, bl
pushfd
mov eax, dword [esi + ebx*8 + 4]
cmp di, 0x9beb
test eax, eax
jmp 0x28f1a1
mov dword [esp + 0x2c], 0x21f0e8
mov dword [esp], 0xe60091c8
mov dword [esp + 0x28], edi
jmp 0x28c9fb
push 0x2551e0
push ecx
pushal
pushal
push dword [0x21d0a4]
pop dword [esp + 0x40]
mov word [esp + 0xc], 0xf2a7
mov byte [esp + 4], 0xd2
push dword [esp + 0x40]
ret 0x44
push ecx
mov dword [esp + 0x28], edx
jmp 0x26fee8
jmp 0x277baf
pushfd
mov dword [esp + 0x28], eax
pushfd
call fcn.0024a871
push 0x3a88fda8
push dword [esp]
mov dword [esp + 4], 0xff5dd838
pushfd
call fcn.00230a87
pushal
lea edx, [esi + 0x5000365b]
mov edx, dword [eax + 0xc]
jmp 0x240608
lea esp, [esp + 0x58]
jl 0x2309bd
lahf
rdtsc
pop edi
lahf
rdtsc
pop esi
mov bl, bl
sete dh
push ebp
xchg dl, ah
mov ebx, dword [esp + 4]
lea esp, [esp + 8]
mov cx, di
not dx
push edi
mov ecx, dword [ebp + 0x14]
pushfd
xchg ah, dl
mov edx, dword [ebp + 0x10]
jmp 0x2a9584
call fcn.00270ca4
call fcn.00230532
push ecx
pushfd
mov dword [esp], edx
pushfd
mov dword [esp], eax
jmp 0x24f02b
pushfd
mov dword [esp + 0x28], ecx
jmp 0x25342c
mov eax, dword [ebp + 0xc]
mov byte [esp + 4], 0xc8
pushal
jmp 0x2a10d3

Function at 0x285efd
Capabilities:
Encode data using xor

Disassembly:
mov word [esp], 0x851d
pushfd
mov ecx, dword [ecx + 0x36737]
call fcn.0025b6bd

Function at 0x29fb85
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], ebx
lea ebx, [ecx - 0x151a179c]
push 0x9c1c27f5
push 0x24cce0e7
mov ebx, 0x20245e
push ebx
push ecx
push 0x4cc08b11
mov ebx, dword [ebx + 0x5aed8]
pushfd
mov byte [esp], 0xf6
call fcn.002a58f5
invalid
pushal
mov byte [esp + 8], bh
mov byte [esp + 8], 0x88
call fcn.00264172
xchg dword [esp], ebx
bswap bx
movsx bx, cl
pushal
pop ebx
mov ebx, dword [esp + 0x20]
pushfd
lea esp, [esp + 0x20]
jae 0x255648
lea ebx, [ebx + 1]
jmp 0x240281
Function at 0x2aa0b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
test edi, edi
mov byte [esp], 0x28
mov byte [esp], bh
lea esp, [esp + 4]
je 0x277bb9
movzx ax, bl
pushfd
setnp dh
movzx edx, word [esi]
pushal
movzx eax, word [esi + 2]
pushal
call fcn.0022defc

Function at 0x2c1fa3
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x2e
pushal
lea esp, [esp + 0x2c]
jmp 0x2b1770

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x43d8b0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x504809
push 0x5239662a
call fcn.0052dcf2
and ah, byte [ecx - 0x2e72bb94]
or esp, edi
test ebx, edi
mov ds, word [esi]
out 0x67, al
sub dh, bl
pop ebx
xor byte [ecx - 0x2815311], ah
mov dh, 2
cmpsd dword [esi], dword es:[edi]
rol dword [esi - 9], cl
cmpsd dword [esi], dword es:[edi]
and al, 0x5a
cmp byte [edx + ebp*8 + 2], ah
invalid

Function at 0x43fc10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43fd1c
test eax, eax
je 0x43fd1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x45afe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x43fd03
lea edi, [eax + 4]
jmp 0x43fc67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x43fc7c
mov dword [ebp - 4], 2
jmp 0x43fc9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x43fc93
mov dword [ebp - 4], 1
jmp 0x43fc9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x43fd13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x43fcd6
mov byte [ecx], 0x3d
jmp 0x43fce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x43fced
mov byte [ecx], 0x3d
jmp 0x43fcf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x43fc64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret