joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4888b0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00487130
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x528648], 0
jne 0x4888ed
cmp dword [0x528644], 0
je 0x4888ed
mov eax, dword [0x528644]
mov dword [0x528648], eax
cmp dword [0x528648], 0
je 0x48896a
mov ecx, dword [0x528648]
cmp dword [ecx + 8], 0
je 0x48896a
mov edx, dword [0x528648]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x48896a
mov ecx, dword [0x528648]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x48896a
mov eax, dword [0x528648]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x488939
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x488940
xor eax, eax
jmp 0x488a8d
mov ecx, dword [0x528648]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00473d40
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x488a8d
mov edx, dword [0x528644]
mov dword [0x528648], edx
jmp 0x488986
mov eax, dword [0x528648]
mov ecx, dword [eax + 4]
mov dword [0x528648], ecx
cmp dword [0x528648], 0
je 0x4889c6
cmp dword [0x528648], 0
je 0x4889c4
mov edx, dword [0x528648]
cmp dword [edx + 8], 0
je 0x4889c4
mov eax, dword [0x528648]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x4889c4
mov edx, dword [0x528648]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x4889c4
jmp 0x48891e
jmp 0x488978
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00487210
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x488a8b
mov eax, dword [ebp - 4]
mov dword [0x528648], eax
mov ecx, dword [0x528648]
mov dword [ecx], 0x52727464
mov edx, dword [0x528648]
mov dword [edx + 8], 0
mov eax, dword [0x528648]
mov ecx, dword [0x528644]
mov dword [eax + 4], ecx
mov edx, dword [0x528648]
mov dword [0x528644], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x528648]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x38c
jmp 0x488a57
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 1
jle 0x488a7b
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
jmp 0x488a4e
mov eax, dword [0x528648]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x48891e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x488d40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x520628]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x488d6b
push 0x57
push eax
call fcn.00628c07
xor eax, eax
jmp 0x488e24
push 0x1c
push 0
lea ecx, [ebp - 0x64]
push ecx
call fcn.00473d40
add esp, 0xc
push 0x1c
lea edx, [ebp - 0x64]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push edi
call fcn.005f5765
test eax, eax
jne 0x488d9a
xor eax, eax
jmp 0x488e24
push 0
push 0x40
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push esi
call fcn.005ecce7
test eax, eax
jne 0x488db8
xor eax, eax
jmp 0x488e24
movzx edx, word [ebp - 0x48]
cmp edx, 0x5a4d
jne 0x488dd2
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x58]
ja 0x488dd2
cmp dword [ebp - 0xc], 0x40
jae 0x488de1
push 0xc1
push esi
call fcn.0060c335
xor eax, eax
jmp 0x488e24
push 0
push 0xf8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.005347a3
test eax, eax
jne 0x488e05
xor eax, eax
jmp 0x488e24
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0x4550
je 0x488e1f
push 0xc1
push ebx
call fcn.00429164
xor eax, eax
jmp 0x488e24
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046e186
mov esp, ebp
pop ebp
ret 0xc

Function at 0x490f10
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00490c80
Function at 0x491cb0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.00473d40
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret

Function at 0x491f20
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.00473d40
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret
Function at 0x4cfb30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x4cfb49
mov esi, edi
mov edi, eax
jmp 0x4cfb4b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x4cfb5b
mov eax, ebx
jmp 0x4cfb65
push eax
push ebx
call fcn.00492c50
add esp, 8
test eax, eax
jne 0x4cfb6d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x4cfb89
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x4cfb74
cmp eax, dword [esi + 4]
jge 0x4cfba0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x4cfb90
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x4cfbc1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x4cfbbe
dec eax
test eax, eax
jg 0x4cfbb0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x5983c1
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push 0xfe0785f9
call fcn.00694c4f
call fcn.004064f0
test al, al
jmp 0x696fb8
push ecx
push 3
lea edx, [esp + 0x2e0]
jmp 0x6904fc
push 0x4d
push edx
call fcn.0040d78c
add esp, 0x1c
mov al, al
xchg si, ax
cbw
push ebx
lea esi, [esp + 0x318]
nop
setp ah
jmp loc.00417769
je 0x69050d
mov ecx, dword [esp + 0x14]
push ecx
xchg ch, al
rdtsc
lea edx, [esp + 0x6d8]
push edx
cwde
mov dx, dx
cdq
lea eax, [esp + 0xb14]
cdq
push eax
not cl
mov dh, 0xd
lea ecx, [esp + 0x950]
jmp 0x671130

Function at 0x5b0396
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov cl, byte [eax]
jmp 0x65a5e6
jne 0x5b03dd
sub eax, ecx
mov ch, 0x3d
push eax
lea eax, [esp + 0x18e8]
push eax
not cx
lea ecx, [esp + 0x274]
jmp 0x5f77fd
push 0x7e1d60e7
call fcn.00694c4f
mov byte [esp + 0x18e6], 0x47
mov byte [esp + 0x18e7], 0x3e
dec dl
inc dl
mov byte [esp + 0x18e8], 0
mov dword [esp + 0x284], esi
mov dword [esp + 0x280], edi
cmove ecx, ecx
mov byte [esp + 0x270], 0
lea ecx, [eax + 1]
dec dl
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test edi, 0x54b4a49c
test dl, dl
jmp 0x5398c1
call fcn.00404e60
mov byte [esp + 0x1bf0], 0x20
lahf
xchg cl, dl
lea eax, [esp + 0x18c8]
mov dl, 0xbd
cwd
sets dl
mov dword [esp + 0x364], esi
mov dword [esp + 0x360], edi
jmp 0x6864f0
test cl, cl
jne 0x5331d3
sub eax, edx
mov cl, dh
mov ecx, 0x33ae5a2c
push eax
lea ecx, [esp + 0x18cc]
jmp 0x681792
call fcn.00404e60
lea edx, [esp + 0x26c]
movsx eax, bx
xchg ecx, ecx
jmp loc.0040d118
inc eax
clc
jmp 0x6415cd
push ecx
movsx ecx, bp
cmovge cx, di
lea ecx, [esp + 0x354]
jmp 0x649905
mov byte [esp + 0x350], 0
bswap dx
mov cl, cl
lea edx, [eax + 1]
jmp 0x5331d3
Function at 0x5caa63
Capabilities:
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
mov edx, dword [ebp - 0x10c]
lea edi, [ebx + edx]
test cl, 6
sar edi, 1
mov eax, dword [eax + edi*4]
and dl, 0x35
sal dl, 0x20
clc
add eax, ecx
add dl, cl
lea esp, [esp]
and dl, bl
mov dl, byte [eax]
cmp dl, byte [esi]
jmp 0x404236
cmp word [ecx], ax
jmp 0x6874e5
lea eax, [eax + ecx]
mov dword [ebp - 0x10c], 0
cmp dx, bp
mov dword [ebp - 0x118], eax
clc
test di, 0x8503
test ebx, ebx
jmp 0x5c5acd
jae 0x6352ad
mov esi, dword [ecx + edx + 0x1c]
lea eax, [esi + eax*4]
test dh, bl
test bl, 0xe
cmp bl, 0xa0
mov eax, dword [eax + ecx]
test ebx, edi
jmp 0x6352a5
jmp 0x568d38
je 0x6370ee
lea ebx, [eax - 1]
add ax, si
seto ah
mov eax, dword [ecx + edx + 0x20]
jmp 0x543bb1
jae 0x6352ad
mov eax, dword [ecx + edx + 0x1c]
jmp 0x630c1c
cmp eax, edx
jmp 0x411594
or edi, 0xffffffff
mov dword [ebp - 0x11c], eax
cmp eax, esp
mov dword [ebp - 0x110], edi
stc
cmp esi, 0xffff
ja 0x651c83
sub esi, dword [ecx + edx + 0x10]
rol ah, cl
mov eax, esi
cmp ecx, ebp
cmp ecx, 0xeb8d6f21
cmp eax, dword [ecx + edx + 0x14]
jmp 0x568d23
jl 0x6370ee
jmp 0x5402a4
push ebp
jmp 0x67e6d8
mov eax, dword [ecx + 0x3c]
stc
cmp edi, edi
cmc
lea eax, [eax + ecx]
cmp cl, al
cmp dword [eax], 0x4550
jne 0x6874eb
mov edx, dword [eax + 0x78]
mov dword [ebp - 0x114], edx
stc
test bp, 0xa584
test edx, edx
jmp 0x600006
je 0x6874eb
mov eax, dword [eax + 0x7c]
push ebx
push edi
cmp edx, eax
cmc
jmp 0x5c4fb1
call fcn.0046e186
mov esp, ebp
pop ebp
jmp 0x53863a
lea eax, [eax + edi*4]
jmp 0x5698ce
test eax, eax
jne 0x5bd734
pop edi
shld si, bx, 0x18
neg ebx
pop ebx
ror cl, cl
btr esi, 7
xor eax, eax
mov esi, eax
inc ch
pop esi
add cx, si
bts ecx, esp
shld ecx, esp, 0x95
mov ecx, dword [ebp - 4]
test eax, esp
xor ecx, ebp
jmp 0x62eed2
cmp edi, dword [ecx + edx + 0x14]
jmp 0x58759e
pop ebp
jmp 0x459899
mov eax, dword [ecx + edx + 0x18]
test eax, eax
jmp 0x5873bb
mov ebp, esp
sub ah, 0x1f
lea esp, [esp - 0x120]
mov eax, dword [0x520628]
shld ecx, esi, 0x96
xor eax, ebp
cmp si, 0x5e0a
rol ch, 0x8e
xadd cl, ch
mov dword [ebp - 4], eax
cmp ecx, 0x2e8f75ae
mov ecx, dword [ebp + 8]
push esi
inc si
mov esi, dword [ebp + 0xc]
cmp bh, bl
stc
mov dword [ebp - 0x120], esi
test dx, 0xb022
test ecx, ecx
je 0x6874eb
test esi, esi
je 0x6874eb
mov eax, 0x5a4d
jmp 0x540fcd
je 0x5cb1b9
sub eax, eax
sal si, 0x24
sar si, 0x11
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e186
mov esp, ebp
jmp 0x64d57d
Function at 0x61831a
Capabilities:
Parse pe header

Disassembly:
push ebx
jmp 0x55f76f
push esi
jmp 0x58ac14
push edi
jmp loc.0041a5c8
mov dword [ebp - 4], eax
jmp 0x53d756
push ebp
cmovp ebp, ebp
mov ebp, esp
lahf
test edi, ebp
lea esp, [esp - 0x16c]
mov eax, dword [0x520628]
cmc
cmp di, bx
clc
xor eax, ebp
jmp 0x5ac314

Function at 0x631ba4
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
push ebp
mov ebp, esp
shrd ax, bx, 0xbf
push 0xffffffffffffffff
and ax, 0xdb2c
push 0x4e456b
sbb ax, bp
mov eax, dword fs:[0]
cmp di, 0xa130
test eax, 0x55a7c3be
push eax
bswap ax
sar ah, 0x2d
bts eax, eax
lea esp, [esp - 0x2c4]
movsx eax, dx
btc ax, cx
mov eax, dword [0x520628]
cmc
xor eax, ebp
jmp loc.004265a9
Function at 0x649927
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xfe1ef03f
call fcn.00694c4f
mov dword [ecx + 0x104], eax
jmp 0x64d078
mov ecx, dword [esp + 0x11c]
mov esi, dword [esp + 0x118]
ror eax, 0x26
stc
cmovge eax, edi
add esp, 4
mov eax, dword [esp + 0x14]
jmp loc.00428207

Function at 0x64f24b
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
call dword [0x4e743c]
mov edx, dword [esp + 0x30]
jmp 0x569c0d
push 2
jmp 0x629876
call fcn.004427a0
mov ecx, dword [esp + 0x1ec]
push ecx
jmp 0x5c10ad
call fcn.004427a0
mov eax, dword [esp + 0x20c]
push eax
jmp 0x68edc3
push ecx
jmp 0x64d362
mov byte [esp + 0x1330], bl
call fcn.00473d40
add esp, 0xc
cbw
bswap eax
push 0x1ff
lahf
movsx ax, al
mov eax, 0x432b9937
lea eax, [esp + 0xd19]
jmp 0x5fed02
mov byte [esp + 0xd20], bl
jmp 0x6116ae
push edx
jmp 0x595627
push ebx
jmp 0x6170dc
call fcn.00473d40
add esp, 0xc
movzx dx, cl
cdq
push 0x103
movzx dx, bl
xchg dx, dx
lea edx, [esp + 0x1329]
push ebx
jmp 0x59a9a9
cmp eax, ebx
jne 0x665fc7
lea esi, [esp + 0x20c]
jmp 0x634d5e
call fcn.00473d40
add esp, 0xc
movzx ecx, di
xchg ch, ch
not ch
push 0x104
lea ecx, [esp + 0x6d8]
jmp 0x690d5a
push edx
jmp 0x63115b
call fcn.00473d40
add esp, 0xc
mov ax, di
bswap ax
movsx ax, bh
push 0xff
bswap ax
lea eax, [esp + 0xb11]
jmp 0x609d96
call fcn.004509e1
add esp, 4
lea esi, [esp + 0x8c]
jmp 0x67b35e
call fcn.00473d40
add esp, 0xc
push 0x103
lea ecx, [esp + 0x1221]
jmp 0x5d8e9a
push ebx
jmp 0x58df2f
push 0x103
movsx eax, dx
mov eax, 0xf7804e8f
lea eax, [esp + 0xf19]
jmp 0x5a9462
push ebx
jmp 0x644e81
lea ecx, [esp + 0x1021]
jmp 0x66cf45
push ebx
push eax
jmp 0x688434
call fcn.00473d40
add esp, 0xc
not ecx
cmova ecx, ecx
jmp 0x6961de
mov byte [esp + 0x950], bl
jmp 0x5be159
push eax
jmp 0x66e074
mov byte [esp + 0x1440], 0xf
jmp 0x56bbe2
push edx
jmp 0x64cd53
call fcn.00473d40
add esp, 0xc
jmp 0x5f4e37
jmp 0x55faaf
mov byte [esp + 0x1440], 0xe
jmp 0x58589e
push eax
jmp 0x595a26
call fcn.0058a599
mov dword [esp + 0x30], eax
jmp 0x5b5849
mov byte [esp + 0x1228], bl
jmp 0x5abcc2
push 0xfe1ef03f
call fcn.00694c4f
push esi
jmp 0x634c62
push 0xff
lea edx, [esp + 0x949]
jmp 0x67fe44
push ebx
jmp loc.00402815
mov byte [esp + 0xf20], bl
jmp 0x5d7e4d
call fcn.00473d40
add esp, 0xc
push 0x104
movzx edx, cx
lea edx, [esp + 0xc10]
push ebx
jmp 0x5bbda4
mov byte [esp + 0x1440], 0x10
jmp loc.0040942e
push ebx
push edx
jmp 0x615472
mov byte [esp + 0xb18], bl
jmp 0x5ba843
call fcn.004509e1
add esp, 4
lea esi, [esp + 0x1ec]
jmp 0x62970c
push ebx
push ecx
jmp 0x66f241
push 0x1ff
jmp 0x607521
Function at 0x655cd3
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ecx
jmp loc.00432c8e
jne 0x5ace5d
cmp dword [ebp - 0x28], 0x666f736f
jne 0x5ace5d
cmp dword [ebp - 0x24], 0x76482074
jmp 0x5ae580
mov dword [esi], eax
mov dword [esi + 4], ebx
clc
test si, bp
mov dword [esi + 8], ecx
clc
mov dword [esi + 0xc], edx
cmp dword [ebp - 0x2c], 0x7263694d
jmp 0x563270
jne 0x5ace5d
mov eax, 0x40000003
cmp cl, 0xc
sub dl, 0x18
cwd
cpuid
mov dword [ebp - 0x2c], 0
cmc
jmp 0x693bba
lea ecx, [ebp - 0x30]
seto bl
mov ebx, 0x65
jmp 0x53cae8
je 0x607a85
xor eax, eax
bsf ebx, edi
cmp eax, 0x7c0866bf
inc dl
mov dword [ebp - 0x2c], eax
setl bl
bts ebx, edx
mov dword [ebp - 0x28], eax
rcr bl, 0xa7
add dl, 0x9a
sar dl, 0x14
mov dword [ebp - 0x24], eax
mov eax, 0x40000000
adc dl, cl
sub dh, 0x3a
clc
cpuid
stc
jmp 0x58c55d
call fcn.0046e186
mov esp, ebp
pop ebp
jmp fcn.004760c2
je 0x5ace5d
xor al, al
bsf edi, edx
clc
adc bx, bx
pop edi
xchg ecx, esi
btr cx, 0x80
and esi, 0xf0ac6f99
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
jmp 0x63a291
push ebp
add ax, sp
or ebp, ebx
mov ebp, esp
lea esp, [esp - 0x94]
bsr eax, edx
mov eax, dword [0x520628]
shl dh, 0xa4
sar dx, cl
xor eax, ebp
btc edx, esp
add dh, 0x12
xadd dl, dl
mov dword [ebp - 4], eax
bt ax, 0x9c
bswap edx
push ebx
rcl dx, 0x91
sar ah, 0x38
bts ebx, ebx
mov eax, 1
cpuid
push esi
sub si, sp
add esi, 0x46366c1f
bt esi, edx
lea esi, [ebp - 0x30]
cmp ax, sp
cmp bh, 6
clc
mov dword [esi], eax
mov dword [esi + 4], ebx
btc ax, bp
cwde
cmp ax, 0x26
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov eax, 0x332ca3af
bt ax, cx
setne ah
mov eax, dword [ebp - 0x28]
clc
stc
test cx, cx
sar eax, 0x1f
test cl, dh
clc
cmc
push edi
test bh, 0xa3
cmp si, ax
test al, 1
jmp 0x62dd8a
mov dword [esi], eax
clc
cmc
mov dword [esi + 4], ebx
clc
mov dword [esi + 8], ecx
test di, 0xad02
mov dword [esi + 0xc], edx
test byte [ebp - 0x2c], 1
jmp 0x63d4dd
Function at 0x67da29
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
lea eax, [esp + 0xd14]
mov dh, 0x27
push eax
push 0x200
not cl
jmp 0x428ec3
lea ecx, [esp + 0x1024]
rdtsc
push ecx
push 0x50f493
movsx edx, di
cwde
movzx edx, dx
lea edx, [esp + 0x50]
push edx
setge al
not eax
lea eax, [esp + 0x2e8]
jmp loc.006910ab
jbe 0x41dbe6
mov ecx, dword [esp + 0x14]
cwde
movsx ax, al
cdq
push ecx
lea edx, [esp + 0xc10]
xchg ecx, eax
mov ah, 0xb0
push edx
movzx edx, sp
jmp loc.00430255
jne 0x41dbe6
cmp eax, ebx
jmp 0x612310
push 0x7e003319
call fcn.00694c4f
push eax
jmp 0x6830d3
call edi
cmp byte [esp + 0x13], bl
jmp 0x6411c3

Function at 0x67e6d8
Capabilities:
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
mov edx, dword [ebp - 0x10c]
lea edi, [ebx + edx]
test cl, 6
sar edi, 1
mov eax, dword [eax + edi*4]
and dl, 0x35
sal dl, 0x20
clc
add eax, ecx
add dl, cl
lea esp, [esp]
and dl, bl
mov dl, byte [eax]
cmp dl, byte [esi]
jmp 0x404236
cmp word [ecx], ax
jmp 0x6874e5
lea eax, [eax + ecx]
mov dword [ebp - 0x10c], 0
cmp dx, bp
mov dword [ebp - 0x118], eax
clc
test di, 0x8503
test ebx, ebx
jmp 0x5c5acd
jae 0x6352ad
mov esi, dword [ecx + edx + 0x1c]
lea eax, [esi + eax*4]
test dh, bl
test bl, 0xe
cmp bl, 0xa0
mov eax, dword [eax + ecx]
test ebx, edi
jmp 0x6352a5
jmp 0x568d38
je 0x6370ee
lea ebx, [eax - 1]
add ax, si
seto ah
mov eax, dword [ecx + edx + 0x20]
jmp 0x543bb1
jae 0x6352ad
mov eax, dword [ecx + edx + 0x1c]
jmp 0x630c1c
cmp eax, edx
jmp 0x411594
or edi, 0xffffffff
mov dword [ebp - 0x11c], eax
cmp eax, esp
mov dword [ebp - 0x110], edi
stc
cmp esi, 0xffff
ja 0x651c83
sub esi, dword [ecx + edx + 0x10]
rol ah, cl
mov eax, esi
cmp ecx, ebp
cmp ecx, 0xeb8d6f21
cmp eax, dword [ecx + edx + 0x14]
jmp 0x568d23
jl 0x6370ee
jmp 0x5402a4
push ebp
jmp 0x67e6d8
mov eax, dword [ecx + 0x3c]
stc
cmp edi, edi
cmc
lea eax, [eax + ecx]
cmp cl, al
cmp dword [eax], 0x4550
jne 0x6874eb
mov edx, dword [eax + 0x78]
mov dword [ebp - 0x114], edx
stc
test bp, 0xa584
test edx, edx
jmp 0x600006
je 0x6874eb
mov eax, dword [eax + 0x7c]
push ebx
push edi
cmp edx, eax
cmc
jmp 0x5c4fb1
call fcn.0046e186
mov esp, ebp
pop ebp
jmp 0x53863a
lea eax, [eax + edi*4]
jmp 0x5698ce
test eax, eax
jne 0x5bd734
pop edi
shld si, bx, 0x18
neg ebx
pop ebx
ror cl, cl
btr esi, 7
xor eax, eax
mov esi, eax
inc ch
pop esi
add cx, si
bts ecx, esp
shld ecx, esp, 0x95
mov ecx, dword [ebp - 4]
test eax, esp
xor ecx, ebp
jmp 0x62eed2
cmp edi, dword [ecx + edx + 0x14]
jmp 0x58759e
pop ebp
jmp 0x459899
mov eax, dword [ecx + edx + 0x18]
test eax, eax
jmp 0x5873bb
mov ebp, esp
sub ah, 0x1f
lea esp, [esp - 0x120]
mov eax, dword [0x520628]
shld ecx, esi, 0x96
xor eax, ebp
cmp si, 0x5e0a
rol ch, 0x8e
xadd cl, ch
mov dword [ebp - 4], eax
cmp ecx, 0x2e8f75ae
mov ecx, dword [ebp + 8]
push esi
inc si
mov esi, dword [ebp + 0xc]
cmp bh, bl
stc
mov dword [ebp - 0x120], esi
test dx, 0xb022
test ecx, ecx
je 0x6874eb
test esi, esi
je 0x6874eb
mov eax, 0x5a4d
jmp 0x540fcd
je 0x5cb1b9
sub eax, eax
sal si, 0x24
sar si, 0x11
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e186
mov esp, ebp
jmp 0x64d57d
Function at 0x401ec0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407070
call sym._EnterCriticalSection_4
mov ebx, dword [0x407068]
sub esp, 4
test ebx, ebx
je 0x401f0b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401f04
test esi, esi
je 0x401f04
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ee0
mov dword [esp], 0x407070
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4020f0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402140
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402218
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40217e
cmp eax, 4
jne 0x4021a0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40218e
cmp edx, 4
je 0x40218e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004020f0
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x24b86773
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4a5a577e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219