joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10136c00
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
xor ebx, ebx
inc edx
mov edi, dword [esi]
cmp dword [edi + 0x254], ebx
je 0x10136c60
cmp dword [edi + 0x264], ebx
je 0x10136c59
cmp byte [0x107d44f4], 0
push edi
push dword [edi + 0x250]
je 0x10136c48
call dword [sym.imp.kernel32.dll_FindNextFileW]
jmp 0x10136c4e
call dword [sym.imp.kernel32.dll_FindNextFileA]
mov ecx, dword [esi]
xor edx, edx
inc edx
mov dword [ecx + 0x264], eax
mov eax, dword [esi]
jmp 0x10136d40
mov eax, dword [edi + 0x25c]
test eax, eax
je 0x10136dcf
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
pop ecx
pop ecx
mov ecx, dword [esi]
cmp dword [ecx + 0x260], ebx
je 0x10136cae
lea eax, [ebp - 0x234]
push eax
call fcn.1010ce65
mov eax, dword [esi]
push dword [eax + 0x260]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
mov ecx, dword [esi]
add esp, 0xc
test byte [ecx + 0x268], 1
push 0x10
pop eax
lea edx, [eax + 0x70]
cmove eax, edx
mov dword [ecx], eax
cmp byte [0x107d44f4], 0
je 0x10136cda
push dword [esi]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
jmp 0x10136cfc
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.1010ce65
push dword [esi]
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov ecx, dword [esi]
mov dword [ecx + 0x250], eax
xor eax, eax
mov ecx, dword [esi]
cmp dword [ecx + 0x250], 0xffffffff
setne al
mov dword [ecx + 0x264], eax
mov eax, dword [esi]
cmp dword [eax + 0x264], ebx
jne 0x10136d2a
mov dword [eax + 0x250], ebx
mov eax, dword [esi]
xor edx, edx
inc edx
mov dword [eax + 0x254], edx
mov eax, dword [esi]
cmp dword [eax + 0x264], ebx
jne 0x10136d40
mov dword [esi + 4], edx
mov ecx, eax
cmp dword [eax + 0x264], ebx
je 0x10136d67
cmp byte [0x107d44f4], 0
jne 0x10136d67
push dword [eax + 0x258]
add eax, 0x2c
push eax
call fcn.1010ce65
mov ecx, dword [esi]
xor edx, edx
inc edx
mov eax, dword [ecx]
mov dword [ecx + 0x26c], eax
mov edi, dword [esi]
mov ebx, dword [edi + 0x26c]
shr ebx, 4
and ebx, edx
je 0x10136d9c
push esi
xor ebx, ebx
call fcn.1010ce65
xor edx, edx
inc edx
cmp word [eax], 0x2e
je 0x10136d98
test byte [edi + 0x268], 3
jne 0x10136da6
mov ebx, edx
jmp 0x10136da6
test byte [edi + 0x268], 1
cmovne ebx, edx
mov eax, dword [edi + 0x264]
test eax, eax
je 0x10136dca
push 0
test ebx, ebx
pop ebx
jne 0x10136c20
test byte [edi + 0x26c], 2
jne 0x10136c20
test eax, eax
setne al
jmp 0x10136dd1
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10147db0
leave
ret 4
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408e54
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x538357e2
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
nop
mov dword [eax - 0x3ed66f70], edx
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x27c62851
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4027a5
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], ecx
push edi
push 3
pop ecx
xor edx, edx
mov ebx, dword [ebp + 8]
lea eax, [esi + 2]
div ecx
mov ecx, eax
shl ecx, 2
mov dword [ebx], ecx
call fcn.00404108
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x40288d
xor ecx, ecx
test esi, esi
je 0x402869
mov ebx, edi
mov edi, dword [ebp - 4]
cmp ecx, esi
jae 0x4027f2
movzx edx, byte [ecx + edi]
inc ecx
jmp 0x4027f4
xor edx, edx
cmp ecx, esi
jae 0x402802
movzx eax, byte [ecx + edi]
inc ecx
mov dword [ebp - 4], eax
jmp 0x402806
and dword [ebp - 4], 0
cmp ecx, esi
jae 0x402811
movzx eax, byte [ecx + edi]
inc ecx
jmp 0x402813
xor eax, eax
shl edx, 8
add edx, dword [ebp - 4]
shl edx, 8
add edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
mov al, byte [eax + 0x407100]
mov byte [ebx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + 0x407100]
mov byte [ebx + 1], al
mov eax, edx
shr eax, 6
and edx, 0x3f
and eax, 0x3f
mov al, byte [eax + 0x407100]
mov byte [ebx + 2], al
mov al, byte [edx + 0x407100]
mov byte [ebx + 3], al
add ebx, 4
cmp ecx, esi
jb 0x4027eb
mov edi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
push 3
xor edx, edx
mov eax, esi
pop ecx
div ecx
mov ecx, dword [edx*4 + 0x407140]
test ecx, ecx
jle 0x40288b
mov eax, dword [ebx]
dec eax
add eax, edi
mov byte [eax], 0x3d
dec eax
sub ecx, 1
jne 0x402882
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404478
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, 0x2014b50
call fcn.004043c3
mov dx, word [edi]
lea esi, [ebx + 4]
mov ecx, esi
call fcn.004043dc
mov dx, word [edi + 2]
push 2
pop eax
add esi, eax
mov ecx, esi
call fcn.004043dc
mov dx, word [edi + 4]
add esi, eax
mov ecx, esi
call fcn.004043dc
mov dx, word [edi + 6]
add esi, eax
mov ecx, esi
call fcn.004043dc
mov dx, word [edi + 8]
add esi, eax
mov ecx, esi
call fcn.004043dc
mov dx, word [edi + 0xa]
add esi, eax
mov ecx, esi
call fcn.004043dc
mov edx, dword [edi + 0xc]
add esi, eax
mov ecx, esi
call fcn.004043c3
mov edx, dword [edi + 0x10]
lea ecx, [esi + 4]
call fcn.004043c3
mov edx, dword [edi + 0x14]
lea ecx, [esi + 8]
call fcn.004043c3
mov dx, word [edi + 0x18]
add esi, 0xc
mov ecx, esi
call fcn.004043dc
mov dx, word [edi + 0x1a]
push 2
pop eax
add esi, eax
mov ecx, esi
call fcn.004043dc
mov dx, word [edi + 0x1c]
add esi, eax
mov ecx, esi
call fcn.004043dc
mov dx, word [edi + 0x1e]
add esi, eax
mov ecx, esi
call fcn.004043dc
mov dx, word [edi + 0x20]
add esi, eax
mov ecx, esi
call fcn.004043dc
mov edx, dword [edi + 0x24]
add esi, eax
mov ecx, esi
call fcn.004043c3
mov edx, dword [edi + 0x28]
lea ecx, [esi + 4]
call fcn.004043c3
movzx eax, word [edi + 0x18]
add esi, 8
test ax, ax
je 0x404578
mov edx, dword [edi + 0x2c]
mov ecx, esi
push eax
call fcn.0040414b
movzx eax, word [edi + 0x18]
add esp, 4
add esi, eax
movzx eax, word [edi + 0x1a]
test ax, ax
je 0x404595
mov edx, dword [edi + 0x30]
mov ecx, esi
push eax
call fcn.0040414b
movzx eax, word [edi + 0x1a]
add esp, 4
add esi, eax
movzx eax, word [edi + 0x1c]
test ax, ax
je 0x4045b2
mov edx, dword [edi + 0x34]
mov ecx, esi
push eax
call fcn.0040414b
movzx ecx, word [edi + 0x1c]
add esp, 4
add esi, ecx
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4045ba
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, 0x4034b50
call fcn.004043c3
mov dx, word [edi]
lea esi, [ebx + 4]
mov ecx, esi
call fcn.004043dc
mov dx, word [edi + 2]
push 2
pop eax
add esi, eax
mov ecx, esi
call fcn.004043dc
mov dx, word [edi + 4]
add esi, eax
mov ecx, esi
call fcn.004043dc
mov dx, word [edi + 6]
add esi, eax
mov ecx, esi
call fcn.004043dc
mov dx, word [edi + 8]
add esi, eax
mov ecx, esi
call fcn.004043dc
mov edx, dword [edi + 0xc]
add esi, eax
mov ecx, esi
call fcn.004043c3
mov edx, dword [edi + 0x10]
lea ecx, [esi + 4]
call fcn.004043c3
mov edx, dword [edi + 0x14]
lea ecx, [esi + 8]
call fcn.004043c3
mov dx, word [edi + 0x18]
lea ecx, [esi + 0xc]
call fcn.004043dc
mov dx, word [edi + 0x1a]
lea ecx, [esi + 0xe]
call fcn.004043dc
movzx eax, word [edi + 0x18]
add esi, 0x10
test ax, ax
je 0x404669
mov edx, dword [edi + 0x1c]
mov ecx, esi
push eax
call fcn.0040414b
movzx eax, word [edi + 0x18]
add esp, 4
add esi, eax
movzx eax, word [edi + 0x1a]
test ax, ax
je 0x404686
mov edx, dword [edi + 0x20]
mov ecx, esi
push eax
call fcn.0040414b
movzx ecx, word [edi + 0x1a]
add esp, 4
add esi, ecx
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x404760
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [0x4080c4], edi
jne 0x4047a7
push ebx
push esi
mov esi, edi
push 8
mov ecx, esi
pop ebx
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub ebx, 1
jne 0x40477d
mov dword [esi*4 + 0x4080c0], ecx
inc esi
cmp esi, 0x100
jl 0x404778
mov eax, dword [ebp - 4]
pop esi
pop ebx
or ecx, 0xffffffff
test edx, edx
je 0x4047c9
movzx eax, byte [edi + eax]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4080c0]
inc edi
mov eax, dword [ebp - 4]
cmp edi, edx
jb 0x4047ae
not ecx
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4052d4
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], edx
push edi
mov byte [ebp - 1], 0
call dword [0x40706c]
mov esi, eax
test esi, esi
jne 0x405306
push edi
call dword [0x407074]
mov esi, eax
test esi, esi
jne 0x405306
xor al, al
jmp 0x4053e0
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4053dd
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4053dd
mov ecx, 0x2000
test word [eax + 0x16], cx
je 0x4053dd
mov edi, dword [eax + 0x78]
test edi, edi
je 0x4053dd
cmp dword [eax + 0x7c], 0
je 0x4053dd
mov eax, dword [edi + esi + 0x1c]
mov ecx, dword [edi + esi + 0x24]
add eax, esi
mov dword [ebp - 0x1c], eax
add ecx, esi
mov eax, dword [edi + esi + 0x20]
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ecx
add eax, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x20], eax
cmp dword [edi + esi + 0x18], ebx
jbe 0x4053dc
mov eax, dword [eax + ebx*4]
mov edx, dword [ebp - 0xc]
add eax, esi
mov dword [ebp - 0x10], eax
xor bl, bl
movzx ecx, bl
mov dword [ebp - 0x14], ecx
cmp dword [edx + ecx*4], 0
je 0x4053cc
mov ecx, eax
call fcn.00404225
mov ecx, dword [ebp - 0x10]
mov edx, eax
call fcn.00404760
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
cmp eax, dword [edx + ecx*4]
je 0x4053b1
mov eax, dword [ebp - 0x10]
inc bl
cmp bl, 0xff
jb 0x40537d
jmp 0x4053cc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
movzx eax, word [ecx + eax*2]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + eax*4]
movzx eax, bl
add ecx, esi
inc byte [ebp - 1]
mov dword [edx + eax*4], ecx
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, dword [edi + esi + 0x18]
jb 0x405370
pop ebx
mov al, byte [ebp - 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405f6d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ec
mov dword [ebp - 0x4c], 0xa0f5fc93
mov dword [ebp - 0x48], 0x5e568bb
mov dword [ebp - 0x44], 0x74cff91f
mov dword [ebp - 0x40], 0xa7733acd
mov dword [ebp - 0x3c], 0x59d852ad
mov dword [ebp - 0x38], 0xa5c6d777
mov dword [ebp - 0x34], 0x377545a2
mov dword [ebp - 0x30], 0x8e3398bc
mov dword [ebp - 0x2c], 0xed514704
and dword [ebp - 0x28], 0
mov byte [ebp - 0x24], 0x77
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x22], 0x32
mov byte [ebp - 0x21], 0x5f
mov byte [ebp - 0x20], 0x33
mov byte [ebp - 0x1f], 0x32
mov byte [ebp - 0x1e], 0x2e
mov byte [ebp - 0x1d], 0x64
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x24]
call fcn.004052d4
movzx eax, al
cmp eax, 9
je 0x405fff
xor al, al
jmp 0x40613e
mov byte [ebp - 1], 0
mov byte [ebp - 0x18], 0x31
mov byte [ebp - 0x17], 0x34
mov byte [ebp - 0x16], 0x36
mov byte [ebp - 0x15], 0x2e
mov byte [ebp - 0x14], 0x37
mov byte [ebp - 0x13], 0x30
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x31
mov byte [ebp - 0x10], 0x36
mov byte [ebp - 0xf], 0x39
mov byte [ebp - 0xe], 0x2e
mov byte [ebp - 0xd], 0x31
mov byte [ebp - 0xc], 0x36
mov byte [ebp - 0xb], 0x34
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x1ec]
push eax
push 0x202
push 4
pop eax
imul eax, eax, 0
call dword [ebp + eax - 0x4c]
test eax, eax
jne 0x40613b
push 2
pop eax
mov word [ebp - 0x5c], ax
mov cx, 0x8b3
call fcn.00405f61
mov word [ebp - 0x5a], ax
push 0
push 1
movsx eax, word [ebp - 0x5c]
push eax
push 4
pop eax
shl eax, 0
call dword [ebp + eax - 0x4c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x406131
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x18]
call fcn.00405ecf
push 0xf
xor edx, edx
lea ecx, [ebp - 0x18]
call fcn.00404176
pop ecx
movzx eax, byte [ebp - 1]
test eax, eax
jne 0x406124
push 0x10
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 8]
push 4
pop eax
shl eax, 1
call dword [ebp + eax - 0x4c]
cmp eax, 0xffffffff
je 0x406117
push 0
movzx eax, word [0x408508]
push eax
push dword [0x40850c]
push dword [ebp - 8]
push 4
pop eax
imul eax, eax, 3
call dword [ebp + eax - 0x4c]
cmp eax, 0xffffffff
je 0x406117
push 0
mov eax, dword [ebp + 0xc]
inc eax
push eax
push dword [ebp + 8]
push dword [ebp - 8]
push 4
pop eax
imul eax, eax, 3
call dword [ebp + eax - 0x4c]
cmp eax, 0xffffffff
je 0x406117
mov ecx, dword [0x40850c]
call fcn.00404136
mov byte [ebp - 1], 1
jmp 0x406124
push 0x3e8
call dword [0x407020]
jmp 0x4060a9
push dword [ebp - 8]
push 4
pop eax
imul eax, eax, 5
call dword [ebp + eax - 0x4c]
push 4
pop eax
imul eax, eax, 7
call dword [ebp + eax - 0x4c]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x4d091e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4e2f2b
call fcn.004ad9a4
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004ca4df
mov eax, dword [0x51dbd4]
lea ebx, [esi + 0x24]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], 0x4eb8fc
mov ecx, 0x524e90
mov byte [ebp - 4], 1
push dword [eax + 0xc]
push dword [ebp + 8]
call fcn.004d0757
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.004c4a83
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
call fcn.004a5d52
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.004c4a33
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.004c48fa
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x4d092a
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4e2f2b
call fcn.004ad9a4
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004ca4df
mov eax, dword [0x51dbd4]
lea ebx, [esi + 0x24]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], 0x4eb8fc
mov ecx, 0x524e90
mov byte [ebp - 4], 1
push dword [eax + 0xc]
push dword [ebp + 8]
call fcn.004d0757
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.004c4a83
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
call fcn.004a5d52
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.004c4a33
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.004c48fa
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x1306180
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, word [esp + 1]
mov ecx, ebp
mov dx, 0x1b87
xchg edx, eax
jmp 0x1306182
jmp 0x130616a
lea ebx, [ecx*4]
mov edx, dword [esp]
xchg bx, dx
cmc
ja 0x13061bd
jbe 0x13066b2
pop esp
retf 0x3f58
mov ax, word [esp]
mov eax, dword [esp]
jmp 0x1306679
bswap edx
dec bx
sub esp, 0x10
jmp 0x13065e5
mov eax, esp
jmp 0x1306604
bswap edx
dec bx
sub esp, 0x10
mov eax, esp
lea esp, [esp + 0x10]
dec ebp
mov ax, 0xc7e5
btr ebx, esi
jmp 0x130662c
mov edx, dword [esp]
neg edx
mov bx, si
jmp 0x1306657
js 0x130664a
rdtsc
sub esp, 0
jmp 0x1306612
rdtsc
sub esp, 0
mov edx, dword [esp]
neg edx
mov bx, si
lea edx, [ebx + ebx]
jmp 0x1306660
clc
jb 0x130668f
jae 0x130668f
cdq
add al, 0x9a
std
or al, 0xbd
adc dword [ecx + reloc.kernel32.dll_GetProcAddress], esi
xor byte [edx + 0x74b24720], dh
xor ebp, dword [edx]
ror ebp, 0
lea ebx, reloc.kernel32.dll_GetProcAddress
clc
jne 0x13065fb
je 0x13065d8
neg ebp
mov ebx, dword [esp]
not bh
jmp 0x130669c
lea ebx, reloc.kernel32.dll_GetProcAddress
xchg ah, dl
call fcn.013066d2
cwde
sbb dword [ecx - 0x755e418], ecx
invalid
mov ax, word [esp]
mov eax, dword [esp]
jmp 0x1306679
Function at 0x13a2393
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 0xf], cx
jmp 0x13a23be
mov bh, 0x88
mov word [esp + 0xf], sp
mov ecx, ebp
mov eax, 0x54b77f46
jmp 0x13a23e0

Function at 0x13a24f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xe], bx
mov word [esp + 0x13], bp
std
jmp 0x13a2545
lea esi, [ebx*4]
xchg byte [esp + 0x21], bh
mov di, word [esp + 5]
mov si, word [esp + 0x1e]
jmp 0x13a24dc
mov byte [esp + 0x11], ah
add esp, 0x10
xchg dword [esp + 4], ecx
pushfd
mov edx, eax
jmp 0x13a2599
lea ebx, reloc.kernel32.dll_GetProcAddress
push dword [esp]
mov esi, dword [esp + 0x19]
neg ax
lea ecx, [eax + esi]
jmp 0x13a252f
sub esp, 0
not bl
shl ecx, cl
push dword [esp + 0x13]
xchg ebx, edi
push word [esp + 0x15]
jmp 0x13a25af
lea ebp, reloc.kernel32.dll_GetProcAddress
neg ax
mov si, bx
cpuid
rdtsc
lea esp, [esp + 6]
jmp 0x13a257c
xor bx, 0x75b2
add esp, 0xa
mov ebx, 0x4202711b
setne al
xchg dword [esp + 0xc], esi
mov byte [esp + 0x12], bh
jmp 0x13a269b
mov al, byte [esp + 0x18]
mov word [esp + 0x13], cx
xchg word [esp + 0xa], bx
jmp 0x13a2651
setl bl
cld
rdtsc
mov byte [esp + 3], al
sub esp, 0x15
pop edi
jmp 0x13a25e9
lea esp, [esp + 0xc]
bsr ebp, esi
shr cx, 0xa
pop dword [esp + 3]
mov dh, 0xeb
mov esi, dword [esp + 3]
jmp 0x13a25ff
xchg si, di
mov eax, edx
shl si, 7
and eax, ebp
mov al, ch
setno dh
jmp 0x13a267f
lea ecx, reloc.kernel32.dll_GetProcAddress
mov cx, di
xchg dword [esp + 0x10], eax
sub esp, 0x16
mov di, 0xcccd
neg esi
jmp 0x13a263b
xchg al, ah
lea ebp, reloc.kernel32.dll_GetProcAddress
cld
push dword [esp + 0x10]
pop si
mov ah, 0x52
call fcn.013a2669
cmp dword [edx], 0x15
test byte [edi], dh
push ds
xchg bx, bp
dec ecx
not edi
mov ax, 0x813a
bsr eax, esi
mov edi, 0xd812d826
jmp 0x13a2624

Function at 0x13a285a
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg cx
mov cl, 0xbf
mov byte [esp + 1], ch
rdtsc
bt ax, bp
jmp 0x13a2867
pop edi
mov dh, 0xcb
mov word [esp + 5], ax
cmc
sbb al, 0x44
jmp 0x13a2844
mov ebx, 0xbc862605
mov word [esp + 2], sp
lea esp, [esp + 8]
xchg ecx, eax
dec bh
mov ch, 0x48
jmp 0x13a2899
mov di, word [esp]
bsr ax, bx
bts edx, ebx

Function at 0x13a4761
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.013a4043
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x13a46ea
mov dword [esp + 0x70], edi
lea esp, [esp + 0x70]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x13a46a4
push eax
jmp 0x13a403e
mov dword [esp], esp
pushal
pop word [esp + 0x16]
lea esp, [esp + 2]
jmp 0x13a46c1
Function at 0x10003370
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x10003390
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret