joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4048ec
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x404ace
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call sub.msvcrt.dll_strlen
mov edi, eax
inc edi
push edi
call sub.msvcrt.dll_malloc
push dword [ebp + 8]
mov dword [esi + 0x10], eax
push eax
call sub.msvcrt.dll_strcpy
mov eax, dword [esi + 0x10]
add esp, 0x10
dec edi
cmp byte [eax + edi], 0x5c
je 0x404b03
test edi, edi
jne 0x404af8
lea ecx, [eax + edi]
cmp byte [ecx], 0x5c
jne 0x404b11
inc ecx
mov dword [esi + 0x14], ecx
jmp 0x404b14
mov dword [esi + 0x14], eax
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 3
push 0
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x404b3f
and dword [esi + 8], 0
xor al, al
jmp 0x404b5e
push dword [ebp + 8]
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
push dword [esi + 8]
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x1c], eax
mov al, 1
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x404bd4
Capabilities:
Set file attributes

Disassembly:
push dword [esp + 4]
push dword [ecx + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x404c3a
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [esp + 4]
push 0
push 0x401250
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
ret 8

Function at 0x404ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
push edi
pushal
pushf
xor eax, eax
mov edx, eax
mov cl, 8
shr edx, 1
jae 0x404cbf
xor edx, 0xedb88320
dec cl
jne 0x404cb5
mov dword [ebp + eax*4 - 0x404], edx
inc eax
test eax, 0xff
jne 0x404cb1
lea esi, [ebp - 0x404]
mov edi, 0xffffffff
xor ecx, ecx
mov ebx, dword [ebp + 8]
xor edx, edx
mov dl, byte [ebx + ecx]
mov eax, edi
xor eax, edx
and eax, 0xff
shl eax, 2
add eax, esi
mov eax, dword [eax]
shr edi, 8
and edi, 0xffffff
xor edi, eax
inc ecx
cmp ecx, dword [ebp + 0xc]
jne 0x404ce4
not edi
mov dword [ebp - 4], edi
popf
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404e00
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.00404e83
jae 0x404e0e
xor ecx, ecx
call fcn.00404e83
jae 0x404e3d
xor eax, eax
call fcn.00404e83
jae 0x404e4d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.00404e83
adc al, al
jae 0x404e2f
jne 0x404e79
stosb byte es:[edi], al
jmp 0x404e11
call fcn.00404e8f
sub ecx, ebx
jne 0x404e56
call fcn.00404e8d
jmp 0x404e75
lodsb al, byte [esi]
shr eax, 1
je 0x404e9f
adc ecx, ecx
jmp 0x404e72
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00404e8d
cmp eax, 0x7d00
jae 0x404e72
cmp ah, 5
jae 0x404e73
cmp eax, 0x7f
ja 0x404e74
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x404e11
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x404eb0
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x401258
call fcn.00405190
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x400000], 0x5a4d
jne 0x404f04
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x404f04
movzx ecx, word [eax + 0x400018]
cmp ecx, 0x10b
je 0x404f1c
cmp ecx, 0x20b
je 0x404f09
mov dword [ebp - 0x1c], ebx
jmp 0x404f33
cmp dword [eax + 0x400084], 0xe
jbe 0x404f04
xor ecx, ecx
cmp dword [eax + 0x4000f8], ebx
jmp 0x404f2d
cmp dword [eax + 0x400074], 0xe
jbe 0x404f04
xor ecx, ecx
cmp dword [eax + 0x4000e8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x448788], edi
mov dword [0x44878c], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x438688]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x438684]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x448790], eax
call fcn.0040518c
cmp dword [section..data], ebx
jne 0x404f90
push fcn.0040518c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0040517a
push 0x401248
push 0x401244
call sub.msvcrt.dll__initterm
mov eax, dword [0x438680]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x43867c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x401240
push 0x401230
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x40501b
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x404ffb
cmp cl, 0x22
jne 0x404fec
cmp byte [eax], 0x22
jne 0x405004
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x40500f
cmp cl, 0x20
jbe 0x405000
test byte [ebp - 0x54], 1
je 0x405026
movzx ecx, word [ebp - 0x50]
jmp 0x405029
cmp byte [eax], 0x20
jbe 0x405004
inc eax
mov dword [ebp - 0x20], eax
jmp 0x40501b
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call fcn.00401dff
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x405047
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x405083
mov eax, esi
jmp 0x405097
call fcn.004051cb
ret
Function at 0x550e8f
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x57daf9
jmp 0x57e24f
lea ecx, [eax - 1]
jmp 0x57db1d
lea esp, [esp + 4]
jle 0x550f0a
jg 0x57dae3
rcl byte [ecx - 0x3f]
mov al, byte [0xd350e753]
dec edx
in eax, 0x14
xchg dword [ebp - 0x7cfbdb9c], ecx
lea esp, [esp + 4]
cmp eax, 1
invalid
jb 0x57db4e
std
dec dword [ecx + reloc.KERNEL32.dll_WideCharToMultiByte]
and al, 0x66
xor edi, 0x998d9754
mov ebx, 0x8b27eb37
cmp al, 0x24
std
invalid
pop edi
pushal
lea esp, [esp + 0x20]
pop esi
jmp 0x57e233

Function at 0x57dc83
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [edx*4]
jmp 0x57dcc1
stc
not bx
sub esp, 2
lea esp, [esp + 2]
jmp 0x57dcab

Function at 0x57dec6
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov byte [esp + 2], dh
pop word [esp]
lea esp, [esp + 2]
popal
pushal
jmp 0x57ddd7
jmp 0x57dd9b
mov edi, dword [edi*4 + reloc.KERNEL32.dll_WideCharToMultiByte]
jmp 0x57de4d
shr edi, 0x18
sub esp, 0x1c
jmp 0x57ddbd
lea esp, [esp + 0x44]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_WideCharToMultiByte]
call 0x57de32
xchg ebp, eax
mov bx, 0xd02b
pop bx
mov byte [esp], dh
jmp 0x57dea8
and edi, ecx
mov edi, dword [edi*4 + reloc.KERNEL32.dll_WideCharToMultiByte]
and ebx, ecx
jmp 0x57de21
lea esp, [esp + 2]
movzx ebx, byte [esi + 6]
call fcn.0057de8b
movzx ebx, byte [esi + 9]
push esp
and edx, ecx
jmp 0x57df2f
and edx, ecx
call 0x57dec6
and dword [edx - 0x73], edx
and al, 0xc
xor edi, dword [edx*4 + reloc.KERNEL32.dll_WideCharToMultiByte]
jmp 0x57df11
setb dh
xor dl, ch
mov edx, dword [esi + 8]
sub esp, 0x1c
jmp 0x57f7e2
mov edx, dword [edx*4 + reloc.KERNEL32.dll_WideCharToMultiByte]
stc
stc
jmp 0x57debe
cmc
push esp
sub esp, 0xe
mov edi, dword [esp]
neg di
mov edi, edx
shr edi, 0x18
jmp 0x57e6cb
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_WideCharToMultiByte]
bswap edi
not di
jmp 0x57ea96

Function at 0x57e0a6
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, edx
jmp 0x57e0d2
inc di
lea esp, [esp + 3]
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_WideCharToMultiByte]
bsr di, cx
push esp
jmp 0x57e069
add esp, 1
jmp 0x57e080

Function at 0x57e15f
Capabilities:
Encrypt data using aes

Disassembly:
clc
sub esp, 0
push eax
mov eax, edx
jmp 0x57e165
and edx, ecx
cmc
cmc
jmp 0x57e143
lea eax, [eax*4]
lea eax, reloc.KERNEL32.dll_WideCharToMultiByte
mov edx, dword [eax]
pop eax
stc
jmp 0x57e1ca
sub esp, 6
add esp, 1
lea esp, [esp + 1]
and ebx, ecx
call fcn.0057e1b2
push esp
pop word [esp]
mov word [esp], sp
lea esp, [esp + 2]
jmp 0x57e20d
dec dword [ebp - 4]
call fcn.0057e362
mov dword [esi + 0xc], edi
call fcn.0057e334
push edx
aam 0x4a
sub eax, 0x41c46fdc
sal dword [eax + reloc.KERNEL32.dll_WideCharToMultiByte], 1
Function at 0x57e1b2
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0xe
lea esp, [esp + 5]
lea esp, [esp + 1]
jmp 0x57e1fd
push dword [esp]
jmp 0x57e195
and edx, ecx
push esp
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_WideCharToMultiByte]
jmp 0x57e1db

Function at 0x57e334
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esp], ecx
lea esp, [esp + 4]
jne 0x550eed
je 0x550f0a

Function at 0x57eb0f
Capabilities:
Encode data using xor

Disassembly:
call fcn.0057ea7c
lea esp, [esp + 0xc]
mov bl, byte [ecx + 1]
sub esp, 0x1e
pop dword [esp + 8]
jmp 0x57ede9
call 0x57ec1d
lea esp, [esp + 4]
mov dl, byte [ecx + 2]
sub esp, 2
sub esp, 0x1a
jmp 0x57ec04
pushal
push word [esp + 0xf]
pop dword [esp + 8]
lea esp, [esp + 2]
jmp 0x57eab2
jmp 0x57eb27
pushal
lea esp, [esp + 0x20]
cmp bl, 0x2b
jmp 0x57ebf6
jmp 0x57e8e8
mov dword [esp], ecx
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x57ea13
lea esp, [esp + 4]
cmp al, 0x61
call fcn.0057e9c8
sub esp, 0x1e
lea esp, [esp + 0x13]
lea esp, [esp + 3]
jmp 0x57ea60
lea esp, [esp + 8]
jne 0x57e2bb
je 0x551196
test eax, 0x3d826bc8
or al, 0x8d
and al, 8
lea esp, [esp + 8]
cmp al, 0x2f
push edx
push dword [esp]
jmp 0x57ea4a
inc ebx
clc
invalid
lea esp, [esp + 0x1c]
cmp bl, 0x61
pushal
jmp 0x57eb3e
lea esp, [esp + 0x18]
cmp bl, 0x5a
call fcn.0057eac9
pushal
lea esp, [esp + 7]
lea esp, [esp + 1]
lea esp, [esp + 0x1c]
jbe 0x57e2ef
ja 0x57e347
and esp, dword [edx + reloc.KERNEL32.dll_WideCharToMultiByte]
arpl word [edx - 0x24141b0b], bx
lea esp, [esp + 4]
jb 0x57e428
call 0x57eb51
adc ebx, dword [ebx + reloc.KERNEL32.dll_WideCharToMultiByte]
jle 0x57eaa8
popfd
sub byte [esi - 0x80], bh
cmp bl, 0x30
call 0x57e34c
dec esp
sti
xor al, ch
sbb eax, 0x4cfffff8
leave
pop ecx
cmp bl, cl
ja 0x57eb24
push 0xfffffffffffffff8
lahf
push 0xffffffffffffffae
or esp, dword [edx + reloc.KERNEL32.dll_WideCharToMultiByte]
and byte [edi], cl
cmp bh, 0xf7
invalid
lea esp, [esp + 0x20]
jb 0x57e347
cmc
cmp bl, 0x7a
call 0x57eb0f
lea esp, [esp + 1]
mov word [esp], dx
lea esp, [esp + 3]
jmp 0x57ebc6
jb 0x57e31a
stc
sub esp, 0x16
push dword [esp + 0xa]
pop word [esp + 5]
jmp 0x57eae0
lea esp, [esp + 7]
pushal
push word [esp + 0x14]
lea esp, [esp + 3]
lea esp, [esp + 0x38]
jmp 0x57eb6d
lea esp, [esp + 4]
jbe 0x57e2ef
ja 0x57e428
adc bl, byte [ecx + 0x279b6809]
js 0x57ec1d
mov dl, 0xad
mov esp, 0x39fb808f
cmp bl, 0x39
push esp
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x57ebaa
je 0x57e2ef
cmp bl, 0x2f
call 0x57ebd5
lea esp, [esp + 0x1c]
cmp dl, 0x41
push esp
call fcn.0057ed4a
or dword [esi + reloc.KERNEL32.dll_WideCharToMultiByte], eax
mov bh, 0x9e
jmp 0x891a9726
mov byte [esp + 1], bh
jmp 0x57e2f4
pop dword [esp + 0xe]
lea esp, [esp + 2]
lea esp, [esp + 0x24]
cmp bl, 0x41
pushal
jmp 0x57eb96
lea esp, [esp + 2]
lea esp, [esp + 0x18]
mov byte [ebp - 1], bl
sub esp, 0x18
sub esp, 0x12
jmp 0x57ec50
Function at 0x57f193
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
call 0x57f23f
lea esp, [esp + 8]
jmp 0x57f6bd
push 0x3e
jmp 0x57e54f
mov dword [esp], esi
lea esp, [esp + 1]
lea esp, [esp + 3]
jne 0x57e4b0
jmp 0x57f693

Function at 0x57f26a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add eax, 4
jmp fcn.0057e4e7
lea esp, [esp + 4]
movzx eax, al
jmp 0x57f254

Function at 0x65f2b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], eax
cmc
sub esp, 0xe
mov bx, cx
jmp 0x65f2c5
xchg word [esp + 6], ax
mov bx, bp
xchg bx, ax
pop dword [esp + 8]
jmp 0x65f306
dec ax
neg eax
rdtsc
mov dh, byte [esp + 9]
mov bx, cx
setae dh
jmp 0x65f36c
mov edx, 0x73cdf474
lea eax, [esp + ebx]
not dh
xchg dh, al
xchg dword [esp + 3], eax
mov dl, dh
jmp 0x65f2e8
not dx
shr dh, 7
xchg dh, al
add esp, 9
lea esp, [esp + 3]
bsr ax, bp
jmp 0x65f34b
pop bx
bsr ax, cx
push dword [esp + 6]
sub esp, 4
lea ebx, [ebx + ebx]
mov byte [esp + 6], bh
jmp 0x65f31a
xchg dh, dl
pop edx
sub esp, 0x12
mov dx, word [esp + 0x10]
xchg word [esp + 0xc], bx
push esp
jmp 0x65f384
bsf ax, ax
mov byte [esp + 5], bh
shl dx, cl
rdtsc
pop word [esp + 1]
xchg byte [esp + 3], al
jmp 0x65f335
mov ah, byte [esp + 0x11]
mov dword [esp + 5], ebp
mov dl, 0x34
push word [esp + 0x11]
cmc
bswap edx
jmp 0x65f3fa
aaa
push ds
mov ax, word [esp + 0xe]
inc ax
ror ah, 1
pop word [esp + 1]
call fcn.0065f3bd
jb 0x65f3d3
aad 0xff
invalid
jns 0x65f404
jmp 0x65f45c
mov edx, eax
mov al, ah
inc edx
mov edx, 0x657b8d58
clc
mov eax, 0x9c1214f6
jmp 0x65f3d5
jo 0x65f3e4
loopne 0x65f46f
enter 0xfffffffffffff766, 0xffffffffffffffd8
je 0x65f495
push es
inc esp
and al, 4

Function at 0x65f9ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x60]
xchg ebx, edx
pushal
sbb ax, 0xf43c
lea edx, [esp + esi]
jmp 0x65fa2b
mov eax, 0x82f810ec
xchg dword [esp + 7], ebx
mov dh, byte [esp + 0xf]
stc
jmp 0x65fa13
mov dx, word [esp + 0x1a]
mov word [esp + 2], bx
bswap ebx
clc
push dword [esp + 8]
jmp 0x65f9c6
mov dword [esp + 0x13], eax
lea edx, reloc.KERNEL32.dll_WideCharToMultiByte
rcl bx, cl
jmp 0x65f9d7
Function at 0x65fe93
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dh, dl
neg dh
stc
inc ebx
mov dx, bx
bsr ax, cx
jmp 0x65fe63
bswap edx
add esp, 0x2d
bsf dx, ax
mov al, ah
pop bx
mov bl, bh
jmp 0x65fe19
pop ebx
xchg byte [esp + 1], al
setae ah
lea esp, [esp + 5]
mov dl, dh
jmp 0x65fee6
push word [esp + 5]
btr eax, esp
rcl eax, 0xb
mov bx, 0xd35b
setae dh
jmp 0x65fe4d
lea ebx, [esi*4]
btc edx, edi
xchg dword [esp + 0x12], eax
lea eax, [edx + edx]
jmp 0x65fe3c
mov ax, word [esp + 0x2c]
jmp 0x65fe7b
add al, dh
mov al, 0x86
mov al, ah
lea edx, [edx + edi]
bswap ebx
mov dx, bx
jmp 0x65fecc
lea eax, [edx*4]
sub bx, 0xa148
btc edx, edx
mov edx, dword [esp]
lea esp, [esp]
or bx, 0xa176
jmp 0x65fe9a
lea ebx, [ebp*4]
mov bl, 0x50
lea eax, [ecx*4]
lea esp, [esp]
jmp 0x65ff3f
mov byte [esp + 1], ah
mov byte [esp + 1], dh
push word [esp + 2]
btr ebx, edi
mov ax, 0x52f3
add esp, 4
jmp 0x65feb0
rdtsc
xor bx, 0x5274
xchg byte [esp], al
lea ebx, [esi - 0x95]
lea esp, [esp]
inc dl
jmp 0x65ff9f
mov al, ah
xchg edx, ebx
lea eax, [ecx + ebx]
not dx
lea esp, [esp]
mov dh, byte [esp]
jmp 0x65feff
mov edx, dword [esp]
mov bl, bh
mov ax, word [esp]
shr eax, 0x19
dec dx
mov edx, dword [esp]
jmp 0x65ff1c
mov ebx, dword [esp]
bswap edx
clc
mov byte [esp], dh
inc bl
stc
jmp 0x65ffd0
bswap edx
not dh
lea edx, [ecx + 0x3b]
add al, dh
bswap edx
lea ebx, reloc.KERNEL32.dll_WideCharToMultiByte
jmp 0x65ff52
lea eax, [edi*4]
lea ebx, [eax*4]
xchg dx, ax
jmp 0x65ff68
mov dx, bp
rdtsc
cld
mov eax, 0xa785b124
mov eax, dword [esp]
xchg byte [esp], bl
jmp 0x65ff87
mov bx, 0x99ff
call fcn.0065ffe4
ror byte [ebx - 0x25], 0xbe
dec ebp
mov byte [0x562ec66], al
hlt
setae dh
rdtsc
mov dh, byte [esp]
ror edx, 3
lea esp, [esp]
mov bx, 0xf9cb
jmp 0x65ffb2
Function at 0x660002
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
xchg word [esp + 2], ax
lea esp, [esp + 3]
add esp, 1
call fcn.006600ca
pushfd
pop eax
mov byte [esp + 1], ah
call 0x660002
aam 0xff
je 0x660029
add al, 0x8b
lds ecx, [edi]
mov bl, 0xd0
mov word [esp + 2], sp
jmp 0x660069
ret
mov byte [esp + 0x19], ch
push word [esp + 0x1b]
add esp, 0x1c
xchg byte [esp + 2], bl
push esp
jmp 0x6600a8
clc
add esp, 2
pop dx
sub esp, 0x1e
clc
stc
jmp 0x660039
xchg word [esp + 5], bx
push word [esp + 2]
pop word [esp + 5]
pop word [esp + 4]
xchg bh, dh
pop ebx
jmp 0x660050
xchg dword [esp], eax
pop ax
and dh, bh
mov eax, 0x5541c24e
neg dx
setg bh
jmp 0x660355
rdtsc
mov ax, word [esp + 4]
push edx
push word [esp + 2]
push word [esp + 0xa]
add esp, 5
jmp 0x660082
rol bx, cl
cld
lea eax, [ecx + 0x3b]
cmc
mov dh, 0x1a
call fcn.00660271
mov esp, 0x36dbbc2e
aam 0xbf
xchg byte [ecx], dh
xor byte [ebx], dh
sub ah, byte [esi - 0x2d]
shl dword [esi - 0x48], cl
int1
fisttp word [edx - 0x7235f02a]
sahf
adc edi, edi
invalid
rcl bx, cl
mov ax, 0xdff1
mov dl, dh
bswap edx
lea ebx, [esi - 0xed]
mov ah, byte [esp + 4]
jmp 0x6600d4
cmc
rcl ebx, 0x1f
and dh, bh
bswap edx
rdtsc
sub esp, 4
jmp 0x6600ef
lea esp, [esp + 0xb]
mov bh, byte [esp + 1]
rcl eax, 0x13
mov byte [esp + 1], ch
mov edx, dword [esp]
xchg bx, ax
jmp 0x66010d
mov dx, word [esp + 6]
rcr ax, cl
push esp
xchg word [esp + 2], dx
bt ebx, esp
xchg word [esp + 1], dx
jmp 0x6602ac

Function at 0x66015b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebx*4]
lea esp, [esp + 4]
mov dl, 0xc
not ax
mov dh, 0x8a
jmp 0x660161
xchg dh, dl
pop dword [esp + 0xf]
mov eax, dword [esp + 0xc]
shr dx, cl
mov eax, ebx
mov bx, word [esp + 3]
jmp 0x66011c
mov byte [esp + 0x15], bh
jmp 0x660137
mov word [esp + 2], sp
mov ax, 0xa5ef
xchg byte [esp + 0xc], dh
sub esp, 6
rdtsc
pop word [esp + 0xa]
jmp 0x6601e0
rdtsc
inc dh
call fcn.006601c9

Function at 0x66030b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
push word [esp + 0xe]
pop ax
lea esp, [esp + 7]
jmp 0x66033e

Function at 0x66084f
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call 0x660017
jmp 0x6607e6
push eax
jmp 0x660012
pop eax
xor ax, ax
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x6607e0
mov dword [esp + 0xa4], edi
lea esp, [esp + 0xa4]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x660804
lea esp, [esp + 3]
mov dword [esp], eax
mov dword [esp], ecx
mov byte [esp + 3], bh
lea esp, [esp + 3]
jmp 0x660825
Function at 0x660907
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x65c059
call fcn.0065c05e
movzx ebx, word [eax + 0x3c]
jmp 0x66080e
cmp word [eax], 0x5a4d
jmp 0x660863
add ebx, eax
jmp 0x660880
je 0x66005d
sub eax, 0x10000
jmp 0x6607ea
cmp word [ebx], 0x4550
je 0x65bbe4
jne 0x660869
adc dword [eax + reloc.KERNEL32.dll_WideCharToMultiByte], eax
test eax, 0x47b4ad3d
invalid
push word [esp + 1]
call fcn.0066084f
jae 0x66088b
jp 0x6608c6
in al, dx
inc ebp
xchg dword [ecx], edx
and eax, 0x9207a713
add byte [edi - 0x6e], ah
cmp ecx, dword [ebx + reloc.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [reloc.KERNEL32.dll_WideCharToMultiByte]
mov byte [ecx], ah
mov edi, 0x2fdcb525
fsubr qword [edi]
lcall 0xd95e, 0xa3c456cf
pop ebx
retf
mov dword [esp + 0x15], ebp
lea esp, [esp + 3]
mov dword [esp + 0xa4], esi
push esp
jmp 0x66089b

Function at 0x406004
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x422a1c], esi
push edi
jne 0x40603e
mov ecx, 0x422a18
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x40601a
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422e18
jl 0x406015
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x406073
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a18]
xor eax, esi
inc ecx
dec edx
jne 0x406056
pop edi
pop esi
not eax
ret 0xc
Function at 0x40a324
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x597eb8
call fcn.0051a22c
mov word [ebp - 0x14], 8
mov edx, 0x58ca5d
mov eax, dword [ebp + 8]
call fcn.0051a3a8
inc dword [ebp - 8]
mov edx, 0x58ca5c
mov eax, dword [ebp + 8]
add eax, 4
call fcn.0051a3a8
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 8
call fcn.00402270
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0xc
call fcn.00402270
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0x10
call fcn.00402270
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0x14
call fcn.00402270
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0x1c
call fcn.00402270
inc dword [ebp - 8]
mov edx, dword [ebp + 8]
mov byte [edx + 0x28], 0
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x29], 0
mov eax, dword [ebp + 8]
mov byte [eax + 0x2a], 0
mov eax, dword [ebp + 8]
add eax, 0x30
call fcn.00424214
mov eax, dword [ebp + 8]
add eax, 0x38
call fcn.00424214
mov eax, dword [ebp + 8]
add eax, 0x40
call fcn.00402270
inc dword [ebp - 8]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x426abc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov eax, 0x59858c
call fcn.0051a22c
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
call fcn.0051a3e0
inc dword [ebp - 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp + 8]
add ecx, 8
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
call fcn.0051a3e0
inc dword [ebp - 8]
mov edx, dword [ebp - 0x28]
add edx, 4
mov eax, dword [ebp - 0x2c]
add eax, 4
call fcn.0051a3e0
inc dword [ebp - 8]
mov edx, dword [ebp - 0x28]
add edx, 8
mov eax, dword [ebp - 0x2c]
add eax, 8
call fcn.0051a3e0
inc dword [ebp - 8]
mov edx, dword [ebp - 0x28]
add edx, 0xc
mov eax, dword [ebp - 0x2c]
add eax, 0xc
call fcn.0051a3e0
inc dword [ebp - 8]
mov edx, dword [ebp - 0x28]
add edx, 0x10
mov eax, dword [ebp - 0x2c]
add eax, 0x10
call fcn.0051a3e0
inc dword [ebp - 8]
mov edx, dword [ebp - 0x28]
add edx, 0x14
mov eax, dword [ebp - 0x2c]
add eax, 0x14
call fcn.0051a3e0
inc dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x18]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0x28]
add edx, 0x1c
mov eax, dword [ebp - 0x2c]
add eax, 0x1c
call fcn.0051a3e0
inc dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x20]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x20], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x24]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x24], eax
mov ecx, dword [ebp - 0x28]
mov al, byte [ecx + 0x28]
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0x28], al
mov ecx, dword [ebp - 0x28]
mov al, byte [ecx + 0x29]
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0x29], al
mov ecx, dword [ebp - 0x28]
mov al, byte [ecx + 0x2a]
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0x2a], al
mov edx, dword [ebp - 0x28]
add edx, 0x30
mov eax, dword [ebp - 0x2c]
add eax, 0x30
call fcn.00427920
mov edx, dword [ebp - 0x28]
add edx, 0x38
mov eax, dword [ebp - 0x2c]
add eax, 0x38
call fcn.00427920
mov edx, dword [ebp - 0x28]
add edx, 0x40
mov eax, dword [ebp - 0x2c]
add eax, 0x40
call fcn.0051a3e0
inc dword [ebp - 8]
inc dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret