joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61a500
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x6cf238
push 0x64
call fcn.00618788
mov esi, eax
add esp, 8
test esi, esi
je 0x61a660
push 0x63
lea ecx, [esi + 1]
push 0
push ecx
call fcn.00645e00
lea eax, [esi + 4]
mov byte [esi], 1
push 2
push eax
call fcn.006170b1
lea eax, [esi + 0x34]
push eax
call fcn.0061725a
xorps xmm0, xmm0
mov dword [0x7cc2a0], esi
add esp, 0x18
movq qword [esi + 0x5c], xmm0
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp + 8]
je 0x61a57e
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x61a573
cmp byte [eax], 0
je 0x61a573
push eax
push esi
call fcn.0061ac10
jmp 0x61a57b
push 0
push esi
call fcn.0061ab90
add esp, 8
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x7a6bb0
mov dword [0x7cc09c], eax
call fcn.006170d2
add esp, 4
test eax, eax
jne 0x61a66f
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x61a5b5
movups xmm0, xmmword [eax]
movups xmmword [0x7c7c54], xmm0
movq xmm0, qword [eax + 0x10]
jmp 0x61a5bf
xorps xmm0, xmm0
movups xmmword [0x7c7c54], xmm0
movq qword [0x7c7c64], xmm0
xorps xmm0, xmm0
push 0x7a6bb0
movups xmmword [0x7c7c6c], xmm0
movq qword [0x7c7c7c], xmm0
call fcn.006170f7
add esp, 4
cmp dword [0x7c7c50], 0
jne 0x61a66a
push esi
call fcn.0061dce0
mov dword [0x7c7c50], eax
mov dword [eax + 8], 0x618f80
mov eax, dword [0x7c7c50]
mov dword [eax + 0xc], 0x618f90
mov al, 1
mov esi, dword [0x7cc2a0]
xchg byte [esi], al
push 4
call fcn.00617a38
add esp, 8
test eax, eax
je 0x61a629
mov dword [eax], esi
jmp 0x61a62b
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x618fe0
push 0
push 0
call fcn.00659935
mov ecx, eax
add esp, 0x18
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x61a67a
cmp dword [esi + 0x60], 0
jne 0x61a675
mov eax, dword [ebp - 4]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x7cc2a0], 0
pop esi
mov esp, ebp
pop ebp
ret
push eax
call fcn.00615efb
call fcn.00659d41
push 6
mov dword [ebp - 4], 0
call fcn.00615f28
int3
Function at 0x61ac10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x75868c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x84]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov edi, dword [ebp + 0xc]
push 0x20
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
lea eax, [ebp - 0xa90]
push eax
push 0x20019
push 0
push str.SoftwareValveSteam
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x61ac84
push str.Error_opening_Steam_key_n
jmp 0x61ad44
lea eax, [ebp - 0xa94]
mov dword [ebp - 0xa94], 0x208
push eax
lea eax, [ebp - 0x28c]
push eax
push 0
push 0
push str.SteamExe
push dword [ebp - 0xa90]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa90]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x61ad3f
mov ecx, dword [ebp - 0xa94]
cmp ecx, 1
jb 0x61ad3f
shr ecx, 1
mov eax, esi
je 0x61acf8
lea edx, [esi + 0x5c]
nop word [eax + eax]
cmp word [ebp + eax*2 - 0x28c], 0x2f
jne 0x61acf3
mov word [ebp + eax*2 - 0x28c], dx
inc eax
cmp eax, ecx
jb 0x61ace0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28c]
push eax
push str.__s__steam:__rungameid__s
lea eax, [ebp - 0xa8c]
push 0x800
push eax
call fcn.0061ab20
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0061a840
add esp, 0x1c
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00617a25
mov esp, ebp
pop ebp
ret
push str.Error_reading_SteamExe_key_n
push 2
call fcn.0064f14f
add esp, 4
push eax
call fcn.0048eb60
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
call fcn.00617a25
mov esp, ebp
pop ebp
ret
Function at 0x61ade0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x75868c]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x6d3678]
push ebx
push esi
push edi
push 0
push 0
mov dword [ebp - 0xc], eax
mov esi, ecx
mov ax, word [0x6d367c]
push 3
movups xmmword [ebp - 0x34], xmm0
push 0
movups xmm0, xmmword [0x6d3660]
mov word [ebp - 8], ax
mov eax, 0x30
push 0
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x34]
movups xmmword [ebp - 0x24], xmm0
push 0xc0000000
movq xmm0, qword [0x6d3670]
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x61aeb0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x61ae79
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x61aec6
inc ax
mov word [ebp - 0xa], ax
jmp 0x61ae8f
cmp eax, 0xe7
jne 0x61aec6
push 0x2710
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
je 0x61aec6
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x61ae60
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00617a25
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00617a25
mov esp, ebp
pop ebp
ret
Function at 0x624830
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x703164
push 2
call fcn.0064f14f
add esp, 4
push eax
call fcn.0048eb60
add esp, 0xc
push 2
call fcn.0065c654
int3
Function at 0x628090
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x6281c1
test al, 3
jne 0x6281c1
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x62817c
cmp edi, 8
jb 0x628145
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x6280f4
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x628180
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x628162
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x628184
xor edi, edi
jmp 0x628184
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x628198
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x628280
cmp ecx, 0x20
jb 0x62825a
mov esi, ecx
xorps xmm3, xmm3
and esi, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x1c], esi
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x6281f5
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x628280
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
nop dword [eax]
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x628270
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x6697ea
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0066949b

Function at 0x6697f5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00669625

Function at 0x671dd5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00671928
Function at 0x67ba90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b0732
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x75868c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.0056b490
mov dword [edi], vtable.CSkyObject.0
mov dword [ebp - 4], 0
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea esi, [edi + 0x134]
mov byte [ebp - 4], 3
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00617a38
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1bc], 0
mov dword [edi + 0x1c0], 0
mov dword [edi + 0x1c4], 0
mov dword [edi + 0x1c8], 0x3f800000
mov dword [edi + 0x1cc], 0x3f800000
mov dword [edi + 0x1d0], 0x3f800000
mov dword [edi + 0x1d8], 0
mov dword [edi + 0x1e8], 0
mov dword [edi + 0x1ec], 0xf
mov byte [edi + 0x1d8], 0
lea ecx, [edi + 0x1f4]
mov byte [ebp - 4], 6
call fcn.00572420
mov dword [edi + 0x174], 0
mov dword [edi + 0x170], 0
mov dword [edi + 0x16c], 0
mov dword [edi + 0x168], 0
mov dword [edi + 0x160], 0
mov dword [edi + 0x15c], 0
mov dword [edi + 0x158], 0
mov dword [edi + 0x154], 0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x148], 0
mov dword [edi + 0x144], 0
mov dword [edi + 0x140], 0
mov dword [edi + 0x178], 0x3f800000
mov dword [edi + 0x164], 0x3f800000
mov dword [edi + 0x150], 0x3f800000
mov dword [edi + 0x13c], 0x3f800000
mov dword [edi + 0x1b4], 0
mov dword [edi + 0x1b0], 0
mov dword [edi + 0x1ac], 0
mov dword [edi + 0x1a8], 0
mov dword [edi + 0x1a0], 0
mov dword [edi + 0x19c], 0
mov dword [edi + 0x198], 0
mov dword [edi + 0x194], 0
mov dword [edi + 0x18c], 0
mov dword [edi + 0x188], 0
mov dword [edi + 0x184], 0
mov dword [edi + 0x180], 0
mov dword [edi + 0x1b8], 0x3f800000
mov dword [edi + 0x1a4], 0x3f800000
mov dword [edi + 0x190], 0x3f800000
mov dword [edi + 0x17c], 0x3f800000
mov byte [ebp - 4], 7
mov dword [edi + 0xf8], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf0], 0
mov dword [edi + 0xec], 0
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe0], 0
mov dword [edi + 0xdc], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xd0], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xfc], 0x3f800000
mov dword [edi + 0xe8], 0x3f800000
mov dword [edi + 0xd4], 0x3f800000
mov dword [edi + 0xc0], 0x3f800000
mov ecx, dword [0x7e0fec]
call fcn.005563f0
mov dword [edi + 0x130], eax
mov eax, edi
mov dword [edi + 0x128], 0
mov dword [edi + 0x12c], 0
mov word [edi + 0x1f0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x8031f5
Capabilities:
Get socket status

Disassembly:
xor edx, 0xde10d397
push 0x841c16ad
mov eax, 0x2b318fb1
inc edx
push eax
neg edx
lea ecx, [eax*8 - 0x2d584e7f]
call fcn.0082906b
xor ebx, ecx
dec eax
add edi, ecx
mov dx, word [ebp]
inc eax
jg 0x80160f
mov cl, byte [ebp + eax*4 + 2]
sal eax, 0x12
jae 0x84877c
or eax, eax
lea ebp, [ebp + eax*2 + 2]
shr dx, cl
jmp 0x93b261
sar eax, 0xf3
movsx ecx, al
mov word [ebp + eax*2], dx
shl eax, 0x15
adc eax, edi
jmp eax

Function at 0x80dad4
Capabilities:
Encode data using base64

Disassembly:
rol edx, 0xf6
lea eax, [edx*4 + 0x5c22c083]
lea ecx, [esp + ecx + 0x14]
movzx dx, byte [ecx + eax - 0x5d756183]
lea edi, [edi + eax - 0x5d756185]
mov word [edi + eax - 0x5d756183], dx
pop edx
pop edx
pop ecx
pop ecx
pop eax
jae fcn.004e444f
cmova eax, edx
mov dword [edx + edi - 0x5f85f17e], ecx
pop edx
pop ecx
jae fcn.0060cb4f
pop eax
bswap edx
mov ecx, dword [edi]
sar ax, 0x2b
adc edi, 4
bswap edx
xor ecx, ebx
bswap edx
bswap ecx
ror al, 0x27
and edx, eax
jbe 0x4ce335
not ecx
push edx
jbe 0x906458
ror ecx, 1
xor edx, eax
adc eax, eax
sar word [esp + edx*2 - 0x20000010], 0x63
neg ecx
xor ebx, ecx
bswap edx
add esi, ecx
jmp 0x976330
or cx, cx
bswap eax
lea ecx, [edx*4 + 0x1011d3ae]
shr dl, 0x25
not eax
ror eax, 3
lea edx, [ecx*8 - 0x34e81046]
bswap edx
not eax
pop edx
sal edx, 0xad
xor ebx, eax
call fcn.008f0780
mov dword [esp + edx - 0x8000010], esi
ret

Function at 0x82459c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
xadd ah, ah
push 0x851b8a
ror eax, 0x1d
bsr eax, eax
xadd ax, ax
mov eax, dword fs:[0]
clc
push eax
push esi
clc
jmp 0x8443a1
push edi
clc
btr di, 0xb5
movsx edi, dx
mov eax, dword [0x75868c]
cmc
xor eax, ebp
movzx edi, sp
mov edi, 0xfd2b898d
movsx edi, di
push eax
movsx edi, si
not al
lea eax, [ebp - 0xc]
xchg di, di
mov edi, eax
mov dword fs:[0], eax
movzx edi, ax
mov edi, ecx
jmp 0x8c610f
mov dword [edi], 0x7056cc
call fcn.008e9a7a
lea ecx, [edi + 0x48]
jmp 0x8efc8a
push esi
jmp loc.004e1248
mov dword [edi + 0x38], vtable.CDynamicPool_struct_CPythonTextTail::STextTail_.0
jmp 0x8f816b
call fcn.0088c480
mov eax, dword [edi + 0x30]
movsx esi, sp
bswap esi
movzx ecx, dx
lea esi, [edi + 0x30]
not ch
mov ecx, esi
jmp 0x8f2f99
push dword [eax + 4]
jmp 0x8ee924
call fcn.0088c480
lea ecx, [edi + 0x3c]
jmp 0x8f1ca7

Function at 0x8412fc
Capabilities:
Delete file

Disassembly:
push ebp
sbb ax, 0xe53e
mov ebp, esp
movsx eax, bp
push 0xffffffffffffffff
rcr ah, 0xb3
push 0x8bdeee
mov eax, dword fs:[0]
stc
push eax
rcr al, 0x88
bt ax, si
seto ah
sub esp, 0x38
dec ax
xor eax, 0x4704ad95
or al, al
mov eax, dword [0x75868c]
cmp ax, 0x918b
xor eax, ebp
jmp 0x8d35b3
push ebx
movzx ebx, ax
cmovae bx, dx
movsx bx, dl
push esi
not bh
push edi
mov bx, sp
push eax
cbw
lea eax, [ebp - 0xc]
jmp 0x95340e
mov dword [ebp - 0x10], eax
jmp 0x8cf4d7
mov dword fs:[0], eax
jmp loc.0053c4ed
Function at 0x858b0d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.008938f2
push dword [ebx + 0x14]
mov ecx, edi
jmp 0x884222
mov byte [edi + 0x1e4], al
jmp 0x9076c8
jne 0x808b32
cmp dword [ebx + 0x10], 0x69
jmp 0x9467b8
call fcn.008f993a
test eax, eax
jmp 0x49963a
push ebp
mov ebp, esp
cmc
shr al, 0xa0
cmove ax, di
push 0xffffffffffffffff
cmp sp, 0x3ead
xor ax, bp
push 0x9063a0
sal ax, cl
rcl eax, cl
mov eax, dword fs:[0]
cmp cl, 0x24
cmc
push eax
shld ax, sp, 0x8a
rcr al, 0xa5
sub esp, 0x38
mov eax, dword [0x75868c]
xor eax, ebp
jmp 0x87b3ee
push eax
jmp 0x808b2d
je 0x84dd8e
cmp eax, 0x851b
je 0x84dd8e
cmp eax, 0x8520
jmp 0x89a84c
push ebx
movsx ebx, bx
movzx ebx, sp
cmove ebx, ebp
push esi
push edi
cmovns bx, cx
not di
push eax
mov eax, esi
lea eax, [ebp - 0xc]
mov di, dx
mov dword fs:[0], eax
jmp 0x958b68
jne 0x8c0427
push 6
jmp 0x8bc4ac
mov byte [esi + 0x63d], 1
call fcn.008b846d
push 7
jmp 0x88b5ac
call fcn.008938f2
test al, al
jmp 0x89a06c
mov dword [ebp - 0x14], eax
jmp 0x864fff
mov byte [esi + 0x63d], 0
jmp 0x8998e1
call fcn.008e7f7d
cmp byte [ebx + 0x74], 0
jmp 0x8f6021
jmp 0x88dcf4
call fcn.008b846d
push 3
mov ecx, edi
jmp 0x8f56a0
call fcn.00483970
mov eax, dword [ebx + 0x18]
lea esi, [edi + 0x24c]
cmp eax, 0xe0127d02
cmc
cmp eax, 0x88b6
jmp 0x86cb36
je 0x84dd8e
cmp eax, 0x84fd
jmp 0x8b4b36
push dword [ebx + 0x18]
jmp 0x874dc8
jne 0x8f56a5
jmp 0x84c789
je 0x84dd8e
cmp eax, 0x8522
jmp 0x84dd88
je 0x84dd8e
cmp eax, 0x8501
je 0x84dd8e
cmp eax, 0x8505
jmp 0x9067e1
mov byte [esi + 0x63d], 1
jmp 0x88dced
cmp eax, 0x88b7
jmp 0x94f4be
call fcn.008b846d
push dword [ebx + 0x18]
mov ecx, edi
jmp 0x893cd0
call fcn.008938f2
mov eax, dword [ebx + 0x18]
cmp eax, 0x84f4
jmp 0x91e69b
je 0x8f602e
mov ecx, edi
call fcn.00860969
mov ecx, edi
jmp 0x853c49
je 0x84dd8e
cmp eax, 0x8510
jmp 0x96f2ef
movzx eax, byte [ebx]
jmp 0x90a9c6
push eax
jmp 0x8ef80d
je 0x84dd8e
cmp eax, 0x84f9
jmp 0x894604
jb 0x808b32
inc eax
bswap ecx
movzx cx, cl
mov ecx, edi
jmp 0x859be7
jne 0x87f7eb
push 6
jmp 0x87447f
mov edi, ecx
setg bh
mov ebx, dword [ebp + 8]
mov al, 0x33
mov al, bl
mov al, byte [ebx + 0x75]
jmp 0x84c175
je 0x84dd8e
cmp eax, 0x8519
jmp 0x85e885

Function at 0x85b2ea
Capabilities:
Authenticate hmac

Disassembly:
push ebp
clc
adc al, bh
mov ebp, esp
sub al, 0x8a
push 0xffffffffffffffff
sar eax, 0x8e
bts ax, dx
stc
push 0x84b42a
mov eax, dword fs:[0]
push eax
lea esp, [esp - 0x28]
mov eax, dword [0x75868c]
cmp di, 0xf538
xor eax, ebp
mov dword [ebp - 0x14], eax
jmp loc.005c8add
Function at 0x85e819
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0x93571a
mov ecx, dword [ebp - 8]
inc edi
shl dl, cl
xor dl, 0xbd
rdtsc
add ebx, 0x18
btr dx, 2
rdtsc
inc dx
mov dword [ebp - 4], ebx
and dl, al
btc dx, 0x1f
mov eax, dword [ecx + 0x36c]
dec edx
mov edx, dword [ecx + 0x368]
sub eax, edx
sar eax, 3
cmp di, di
test esi, esi
imul eax, eax, 0xaaaaaaab
test ebx, 0x5123de3c
cmp edi, eax
jmp 0x8631b0
pop edi
sets bl
pop esi
movsx bx, ah
cmovnp ebx, edx
pop ebx
mov esp, ebp
cmovae ebp, ecx
pop ebp
jmp 0x69d2bd
mov esp, ebp
xchg bp, bp
pop ebp
jmp 0x4e2990
push ebp
rcr bp, 0xbb
cmovo dx, cx
and ax, 0x1837
mov ebp, esp
lea esp, [esp - 8]
mov dx, bp
mov eax, dword [ecx + 0x36c]
mov edx, dword [ecx + 0x368]
sub eax, edx
sar eax, 3
stc
push ebx
cmp cl, 0x8e
imul eax, eax, 0xaaaaaaab
cmp si, si
push esi
cmc
test di, 0x2eb2
cmp eax, ebp
push edi
jmp 0x8bba5c
jb 0x8bba77
pop edi
bts si, ax
pop esi
xor al, al
not bl
pop ebx
jmp 0x8536f5
push esi
jmp 0x8a7780
jne 0x8bba84
sub eax, ebx
mov ebx, dword [ebp - 4]
btc ecx, 0x9a
bsr cx, cx
test eax, ecx
cmp eax, dword [ebx + edx + 0x10]
lea ecx, [ebx + edx]
jmp 0x899f67
ja 0x802fce
cmp dword [ecx + 0x14], 0x10
jmp 0x8a78c8
test cl, cl
jmp 0x88cc9a
call fcn.006452c0
lea esp, [esp + 8]
clc
cmp eax, esi
jmp 0x802fc8
jb 0x8b62c1
mov ecx, dword [ecx]
jmp 0x8b62c1
push ecx
jmp 0x8670a3
xor edi, edi
mov dword [ebp - 8], ecx
cmc
test eax, eax
je 0x8631b6
mov esi, dword [ebp + 8]
bswap bx
mov dword [ebp - 4], edi
mov bx, sp
nop
mov eax, esi
cmove bx, dx
not cl
lea ebx, [eax + 1]
xchg cl, cl
mov cl, byte [eax]
jmp 0x8eb770
inc eax
jmp 0x89a1dc
mov eax, dword [ebp + 0xc]
mov esi, ecx
bswap esi
mov dword [eax], edi
bswap bx
movzx edi, ax
mov al, 1
jmp 0x852068

Function at 0x85ff94
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], 0x7415c974
call fcn.004b61bc
Function at 0x87d6fa
Capabilities:
Read file on windows

Disassembly:
call esi
cmp eax, 0x80
jmp 0x92e669
call dword [sym.imp.DevIL.dll_ilOriginFunc]
mov edi, dword [ebp + 8]
jmp 0x8c4d36
call dword [sym.imp.DevIL.dll_ilEnable]
push 0x602
jmp 0x8542a4
push 0xde4
jmp 0x87accd
push eax
jmp 0x890a57
jne 0x86a055
mov eax, dword [ebp + 0xc]
pop edi
btr ebx, esi
setns bh
rcr ebx, cl
pop ebx
jmp 0x8c5577
push esi
bswap si
mov esi, dword [sym.imp.DevIL.dll_ilGetInteger]
jmp 0x857c57
call dword [sym.imp.DevIL.dll_ilGenImages]
push dword [ebp - 4]
call dword [sym.imp.DevIL.dll_ilBindImage]
push 0x600
jmp 0x854ffa
push eax
push 1
jmp 0x8cbae3
call esi
cmp eax, 0x40
jmp 0x8beb86
push ebp
setns ah
mov ebp, esp
bswap eax
mov al, al
movsx ax, bh
push ecx
cwde
push ebx
sets al
push edi
lea eax, [ebp - 4]
mov bx, di
mov ebx, ecx
jmp 0x85b320
push 1
jmp 0x86e7f3
call fcn.006534e2
mov esi, eax
cmp eax, edx
clc
stc
add esp, 8
stc
test cx, di
test esi, esi
jmp loc.00499b23
je 0x8df5d3
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
cmp esp, esi
mov dword [eax], 3
test edx, 0xa70c0700
cmc
cmp ecx, ecx
sub al, al
jmp 0x9078c3
push edi
push 0
jmp 0x8c8940
mov dword [eax], 2
cmp edi, ebx
cmp esp, 0xe0b7c41e
sub al, al
jmp 0x8cd85e
push edi
jmp 0x8921a2
call dword [sym.imp.DevIL.dll_ilLoad]
test al, al
jmp 0x866861
lea eax, [ebp - 4]
jmp 0x8791f1
call dword [sym.imp.DevIL.dll_ilDeleteImages]
call dword [sym.imp.DevIL.dll_ilShutDown]
push 0x6ef518
jmp 0x8c7501
mov esp, ebp
pop ebp
jmp loc.004d93ef
push 0xde5
jmp 0x813adf
mov esp, ebp
jmp 0x933cd5
je 0x8c9671
mov eax, dword [ebp + 0xc]
or di, 0xa330
pop esi
sar ebx, 0xac
pop edi
bt ebx, eax
pop ebx
mov dword [eax], 4
test eax, edi
stc
sub al, al
mov esp, ebp
pop ebp
jmp loc.005c585a
pop ebp
ret 8
Function at 0x880d13
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, ebp
clc
mov ebp, esp
bt dx, ax
inc ah
shr ah, cl
push 0xffffffffffffffff
shld ax, bx, 0x19
xchg edx, eax
push 0x6a1dc0
rcr dl, cl
not dx
mov eax, dword fs:[0]
push eax
test di, dx
add al, 0x1f
push esi
push edi
mov eax, dword [0x75868c]
sar edx, cl
btr edi, 0xc
xor eax, ebp
cmovnp dx, si
movzx esi, di
push eax
cwde
lea eax, [ebp - 0xc]
movzx edi, ax
cwd
not edi
mov dword fs:[0], eax
rdtsc
mov dl, 0xbe
mov edi, ecx
not ch
xchg edx, eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
movzx cx, cl
jmp 0x961857

Function at 0x8b0014
Capabilities:
Resolve dns

Disassembly:
jne 0x8be079
sub al, al
pop esi
bswap bp
mov bp, dx
pop ebp
jmp loc.005aea6e
pop esi
pop ebp
jmp loc.0069f745
mov eax, dword [eax]
mov eax, dword [eax]
not bp
cmove ebp, edx
jmp 0x961e95
push ebp
movsx ebp, bp
mov ebp, esp
jmp 0x8b987e
call sub.WS2_32.dll_gethostbyname
test eax, eax
jmp 0x8a5216
push esi
push dword [ebp + 8]
bswap esi
cmova esi, eax
mov esi, ecx
jmp 0x8b5003
mov eax, dword [eax + 0xc]
not ebp
jmp 0x8ab706
mov al, 1
xchg esi, esi
mov esi, 0x4d38b688
jmp 0x8a5fec
mov dword [esi + 4], eax
mov esi, edx
not bp
jmp 0x8c26c2