joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4955f5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x49570d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49570d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004c2dbb
mov esi, eax
test esi, esi
je 0x49570d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x49570d
mov ecx, esi
call fcn.00495580
cmp edi, eax
jge 0x49570d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x495693
mov dword [esp + 0x34], 1
jmp 0x4956ee
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x49570d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00494b70
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x49be70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x1203000]
xor edx, edx
cmp eax, edx
jne 0x49be96
xor eax, eax
mov byte [eax + 0x1202f00], al
inc eax
cmp eax, 0x100
jl 0x49be7e
mov dword [0x1203000], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x1202f00
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x49bf27
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x49befa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x49bec8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x49bfa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x49bff3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x49bfda
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a2970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cfdee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004a3290
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x11c2704
call fcn.004c10d1
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4a2a03
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004c10d1
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4a29fc
push 0
mov ecx, eax
call fcn.00499aa0
mov dword [esi + 0xc], eax
jmp 0x4a2a05
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4a2a05
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4c375e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c3796
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c17eb
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c17c3
jmp 0x4c37a2
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c4e4f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c4e91
call fcn.004ca90d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c4e91
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c4e88
xor eax, eax
jmp 0x4c4e99
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c4e9f
pop edi
pop esi
pop ebx
ret 4
Function at 0x4cae3d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4cae6b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4cae89
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004cada3
jmp 0x4cae89
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4cae89
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004cada3
test edi, edi
mov eax, edi
jne 0x4cae73
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4073e2
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
lea eax, [ebp - 0x1a0]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.004055fe
test eax, eax
je 0x407457
call fcn.00406dfd
cmp byte [0x4100d4], 0
je 0x407420
push 0x4100d4
call fcn.00405b0f
test eax, eax
pop ecx
jne 0x407457
cmp dword [0x4938f8], 0
je 0x407449
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x4933dc
push eax
mov dword [ebp - 0xc], 0x4073c3
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
call fcn.00404c49
test eax, eax
je 0x407457
call fcn.004072f2
xor eax, eax
leave
ret 0x10

Function at 0x40ad15
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x412ce8
cmp edx, dword [eax]
je 0x40ad37
add eax, 8
inc ecx
cmp eax, 0x412d78
jl 0x40ad28
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x412ce8]
jne 0x40ae65
mov eax, dword [0x493928]
cmp eax, 1
je 0x40ae3f
test eax, eax
jne 0x40ad68
cmp dword [0x412914], 1
je 0x40ae3f
cmp edx, 0xfc
je 0x40ae65
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40ad9f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407750
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00407840
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40ade2
lea eax, [ebp - 0x1a4]
push eax
call fcn.00407840
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40d5b8
push edi
call fcn.0040afc0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407750
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00407760
lea eax, [ebp - 0xa0]
push 0x40d598
push eax
call fcn.00407760
push dword [esi + 0x412cec]
lea eax, [ebp - 0xa0]
push eax
call fcn.00407760
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040c098
add esp, 0x2c
pop edi
jmp 0x40ae65
lea eax, [ebp + 8]
lea esi, [esi + 0x412cec]
push 0
push eax
push dword [esi]
call fcn.00407840
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x66ea30
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0x9388215a
bsr eax, esi
lea eax, [ecx - 0x521b]
push si
jmp 0x66ea08
mov edx, ebp
lea esp, [esp + 2]
mov ebx, edi
add dx, 0x7114
jmp 0x66e9c3
js 0x66e99a
mov edx, 0x9388215a
bsr eax, esi
jmp 0x66e9d3
lea eax, [ecx - 0x521b]
push si
bt ecx, eax
jmp 0x66ea0b
push dword [esp + 6]
jmp 0x66e9b0
lea esp, [esp + 0x24]
sub edi, 0x7a771b77
mov eax, dword [esp]
shl dl, cl
jmp 0x66ea5a
bt ecx, eax
not cl
pushal
push dx
xchg word [esp + 0x1b], ax
jmp 0x66e9f2
not ah
mov ecx, eax
push bp
lea esp, [esp + 2]
jmp 0x66ea78
sub esp, 0x16
jp 0x66e9ec
push dword [esp + 6]
mov edx, ebp
lea esp, [esp + 2]
jmp 0x66e9b6
push bp
lea esp, [esp + 2]
jmp 0x66ea78
jnp 0x66ea17
not ah
mov ecx, eax
jmp 0x66ea44
xchg al, dl
pushal
jmp 0x66ea89
neg edi
rdtsc
not al
not ecx
lea eax, [ebx*4]
jmp 0x66ea62
lea esp, [esp + 0x20]
inc edi
xchg al, ah
mov dl, 0x5d
btc cx, cx
jmp 0x66eb24
setbe ch
add al, 0x77
mov dh, byte [esp]
mov cx, 0x3e8a
xchg cl, dl
jb 0x66eb80
jae 0x66eb80
inc edi
adc ah, cl
jbe 0x66ead6
ja 0x66eab1

Function at 0x66ff1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf065eaf4
jmp 0x66ff90
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], esi
call 0x66ff1e
sub esp, dword [esi - 1]
je 0x66ff46
add dh, byte [esi + 0x2c]
push si
pop word [esp + 3]
push dword [esp + 5]
jmp 0x66ff83
push dx
jmp 0x66ff10
and al, 2
jmp 0x670210
lea esp, [esp + 2]
mov dword [esp + 0x28], edi
jmp 0x670214
mov ah, 0xc8
jmp 0x66ffd8
shl ecx, 0x1f
setle bh
jmp 0x6701ad
sub esp, 5
jae 0x66ffb8
shl ecx, 0x1f
setle bh
lea esp, [esp + 1]
jmp 0x6701b1
mov di, 0xca45
lea ebp, [esp + 4]
call fcn.00670071
pushfd
jmp 0x67010d
rol esi, 0
sub esp, 0x13
jmp 0x670149
clc
bts cx, sp
push dword [esp + 0xb]
pushal
rdtsc
lea esp, [esp + 3]
jmp 0x670192
push dword [esp + 0xb]
pushal
rdtsc
jmp 0x670125
jge 0x670119
clc
bts cx, sp
jmp 0x670133
bswap eax
jmp 0x6701e2
lea esp, [esp + 0x38]
not esi
mov ah, ch
xchg dx, cx
lea eax, [ecx + ebx]
jmp 0x67017c
lea esp, [esp + 1]
mov esi, dword [esp + 0x30]
bswap ecx
mov eax, dword [esp]
jmp 0x6700e2
rdtsc
mov ax, word [esp + 1]
jmp fcn.006701f9
add esi, dword [ebp]
call fcn.006701bf
jo 0x6701c6
rdtsc
mov ax, word [esp + 1]
jmp fcn.006701f9
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
pushfd
jmp 0x66f961
Function at 0x66ff37
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf065eaf4
jmp 0x66ff90
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], esi
call 0x66ff1e
sub esp, dword [esi - 1]
je 0x66ff46
add dh, byte [esi + 0x2c]
push si
pop word [esp + 3]
push dword [esp + 5]
jmp 0x66ff83
push dx
jmp 0x66ff10
and al, 2
jmp 0x670210
lea esp, [esp + 2]
mov dword [esp + 0x28], edi
jmp 0x670214
mov ah, 0xc8
jmp 0x66ffd8
shl ecx, 0x1f
setle bh
jmp 0x6701ad
sub esp, 5
jae 0x66ffb8
shl ecx, 0x1f
setle bh
lea esp, [esp + 1]
jmp 0x6701b1
mov di, 0xca45
lea ebp, [esp + 4]
call fcn.00670071
pushfd
jmp 0x67010d
rol esi, 0
sub esp, 0x13
jmp 0x670149
clc
bts cx, sp
push dword [esp + 0xb]
pushal
rdtsc
lea esp, [esp + 3]
jmp 0x670192
push dword [esp + 0xb]
pushal
rdtsc
jmp 0x670125
jge 0x670119
clc
bts cx, sp
jmp 0x670133
bswap eax
jmp 0x6701e2
lea esp, [esp + 0x38]
not esi
mov ah, ch
xchg dx, cx
lea eax, [ecx + ebx]
jmp 0x67017c
lea esp, [esp + 1]
mov esi, dword [esp + 0x30]
bswap ecx
mov eax, dword [esp]
jmp 0x6700e2
rdtsc
mov ax, word [esp + 1]
jmp fcn.006701f9
add esi, dword [ebp]
call fcn.006701bf
jo 0x6701c6
rdtsc
mov ax, word [esp + 1]
jmp fcn.006701f9
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
pushfd
jmp 0x66f961

Function at 0x670071
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x670009
sub esp, 0x1a
lea esp, [esp + 2]
sub esp, 0xa0
jmp 0x670045
bswap ecx
jmp 0x670029
bswap ecx
mov ebx, esi
mov dl, ch
mov cl, byte [esp]
mov dx, word [esp]
mov dx, 0x1ba5
jmp 0x670054
mov edi, esp
mov edx, esi
mov ebx, dword [esp]
bsr dx, di
jge 0x670027
jl 0x670011
bts eax, edi
jo 0x67009a
cmp eax, 0x41acc167
or dh, 0xd6
jmp 0x67007c
sub cx, dx
jne 0x670002
je 0x66ffec
add esi, 0x53e3e998
lea ecx, [ebx*4]
xchg ah, dl
lea edx, [eax*4]
xchg edx, ecx
jmp 0x6700ba
cmp eax, 0x41acc167
or dh, 0xd6
jmp 0x67007c
pushfd
mov word [esp], bx
jmp 0x670166
lea ecx, [edx*4]
bswap edx
dec esi
mov dx, ax
mov dx, 0xbeb
jmp 0x6700a4
clc
lea edx, [edx + esi]
mov edx, edi
jmp 0x6700ef
jmp 0x670105
lea esp, [esp + 4]
neg esi
mov edx, dword [esp]
dec dx
jb 0x670131
clc
lea edx, [edx + esi]
mov edx, edi
pushfd
jmp 0x67010d
Function at 0x6718fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
dec al
jmp 0x67191b
bswap edx
mov dx, word [esp]
lea edx, [esi*4]
lea edx, [ebx - 0xc65d]
stc
jnp 0x67388e
jp 0x672bf3
bsr edx, edi
mov dx, word [esp]
setl dl
jmp 0x671985
sub esp, 0
mov edx, dword [esp]
mov dx, 0xa7ed
jmp 0x67193b
inc esi
mov al, byte [esp]
mov edx, dword [esp]
mov edx, edi
mov dx, bp
mov eax, edx
jmp 0x671a2a
add edx, 0x517cfe32
jmp 0x671d76
sub bl, al
mov eax, 0x4d548425
rdtsc
mov dx, 0x70ae
jmp 0x67195d
neg dx
jmp 0x6719d1
add edx, 0xb96cb4f5
jmp 0x671d99
mov byte [esp + 0xf], bl
pop dx
bt edx, eax
jmp 0x671994
mov edx, dword [esp]
mov byte [esp + 0xf], bl
pop dx
bt edx, eax
neg dx
lea esp, [esp + 1]
lea esp, [esp + 0x18]
add cl, 0xbd
lea edx, [ebx + 0xf9]
jmp 0x6719fe
mov edx, esi
xor eax, 0x7b956906
jb 0x671a0b
mov ax, sp
call fcn.00671c01
mov dl, 0x31
mov eax, dword [0xb08433c0]
mov bl, 0xaa
xchg dl, ah
mov ah, 0xa9
mov dx, bp
neg cl
mov al, 0xba
jmp 0x6719e4
mov ax, sp
sete dh
bsr dx, dx
rdtsc
jmp 0x671a9d
mov edx, 0xbcb6f885
sub esp, 0x1b
jns 0x6719c2
mov edx, dword [esp]
jmp 0x6719aa
jmp 0x671951
not cl
xchg dh, ah
mov al, 0x34
xchg ah, dl
mov edx, 0xad46b5ee
jmp 0x671b3b
lea esp, [esp + 4]
dec cl
not dl
dec dl
jnp 0x671afe
xchg dl, ah
inc edx
jmp 0x671b97
pushfd
jmp 0x671abd
lea esp, [esp + 2]
jmp 0x671b81
call 0x671b14
les eax, [eax - 0x2a]
mov cl, 0x40
jp 0x671b08
insd dword es:[edi], dx
hlt
lea eax, [ecx + ebp]
lea eax, [ebx + ebp]
inc dl
jne 0x671ad3
pushfd
jmp 0x671abd
lea esp, [esp + 4]
dec cl
mov ah, ch
mov eax, dword [esp]
jmp 0x671ba5
sub esp, 6
mov dl, 0x56
xchg byte [esp + 4], dh
jmp 0x671ae8
mov edx, ecx
rcl ax, 3
js 0x671bea
dec ax
mov eax, dword [esp]
inc eax
call 0x671c1a
sub byte [ebx - 0x1e], cl
mov eax, dword [esp]
inc eax
jmp 0x671c30
dec ax
jmp 0x671bd4
dec dword [edx + 0x6672b0e0]
mov eax, 0xee8f622
add dword [eax], eax
add byte [ebx + 0x2ddebb2b], ah
pushfd
into
pop ecx
mov eax, 0xe802e2c1
jp 0x671c36
shl edx, 2
call 0x671cb2
add byte [eax], al
wait
shr eax, cl
jbe 0x671d1c
ja 0x671dbc
xchg dword [ebp + 1], esi
add byte [eax], al
div dword [eax - 0x1a]
xor dword [eax - 0x3a], 0x84fd6deb
ja 0x671c19
sti
jle 0x671c42
mov eax, dword [esi - 0x3ea930c7]
mov eax, dword [esp]
lea eax, [edi + ebp]
sub esp, 0x12
lea esp, [esp + 2]
push dword [esp + 0x14]
ret 0x18
mov al, dl
not eax
mov ah, 0x13
jmp 0x671970
jg 0x671d53
mov ax, 0x6cb4
jmp 0x671d57
mov ax, 0x6cb4
mov edx, dword [edx - 0x5115fb69]
bts eax, ecx
jmp 0x671d7a
inc ax
jmp 0x671d3d
jb 0x671d90
mov ax, word [esp]
jmp 0x671999
mov ax, word [esp]
jmp 0x671999
ror ah, 2
jmp 0x671ddd
mov eax, ebx
bsr ax, cx
bt ax, dx
jmp 0x671de7
mov al, dl
not eax
mov ah, 0x13
jmp 0x671970
bt ax, dx
jmp 0x671de7
jno 0x671da2
mov eax, ebx
bsr ax, cx
jmp 0x671dc7
mov esp, edi
neg eax
jg 0x671f95
mov eax, ecx
pushal
jmp 0x671ed8
bsr dx, si
ror al, 0
and dh, 0x34
jg 0x671a5c
sub esp, 0
mov edx, dword [esp]
mov dx, 0xa7ed
bsr edx, edi
mov dx, word [esp]
jmp 0x671942
pushal
push edx
ret
mov eax, ecx
jmp 0x671ed7
jmp 0x671e05
add al, 0x53
not dx
mov edx, esp
shl edx, cl
jbe 0x672177
bsr dx, si
jmp 0x671e09
jmp 0x672bf3
Function at 0x673527
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x9cf101b8
jmp 0x672ec9
setg dl
dec dx
jae 0x67309e
mov dl, cl
jmp 0x672fe5
rol al, 0
jmp 0x672c0b
jne 0x672c46
bswap edx
mov edx, 0x66c150d1
jmp 0x672ded
bswap edx
mov edx, 0x66c150d1
sub esp, 0xd
mov dx, bp
push word [esp + 0xb]
lea esp, [esp + 3]
jmp 0x672d93
jmp 0x672cca
shr eax, cl
bsf edx, esp
btc dx, bp
lea edx, [ecx*4]
jmp 0x672c9d
xor al, 0x17
jmp 0x672d05
lea edx, [ebx*4]
xchg edx, eax
bswap edx
mov ax, word [esp]
jmp 0x672cac
not cl
mov eax, dword [esp]
mov ah, 0x4d
mov dx, bp
mov eax, dword [esp]
jmp 0x672c87
bswap edx
dec cl
push bx
call fcn.00672cde
rcl dword [edx - 0x40], cl
cmpsd dword [esi], dword es:[edi]
push edx
out 0x57, eax
xlatb
inc edi
and dl, cl
push 0xb9de48cf
dec eax
invalid
lea esp, [esp + 3]
lea edx, [ebp*4]
lea eax, [edx*4]
jmp 0x672c63
xor al, 0x17
dec edi
mov edx, dword [esp]
sub esp, 0x1b
jae 0x672c61
lea esp, [esp + 3]
lea edx, [ebp*4]
lea eax, [edx*4]
shr eax, cl
bsf edx, esp
jmp 0x672c68
sub bl, al
mov ah, 0xe6
bsf dx, dx
jge 0x672d03
jl 0x672c83
btc edx, edx
jmp 0x672dcc
mov ax, si
mov ax, di
lea eax, [ebx*4]
sub esp, 0x15
lea esp, [esp + 1]
jmp 0x672dfd
sub esp, 0xd
mov dx, bp
push word [esp + 0xb]
jmp 0x672c58
rol cl, 0
mov dh, 0x27
setp dl
mov dh, 0x6e
jmp 0x672f37
lea eax, [esi*4]
jmp 0x672e55
push sp
jmp 0x672e33
pushal
mov eax, 0xf9a0938d
lea eax, [ebx*4]
jmp 0x672e85
lea eax, [esi*4]
shl edx, 2
jle 0x672e2b
push sp
pushal
mov eax, 0xf9a0938d
lea eax, [ebx*4]
lea esp, [esp + 2]
jmp 0x671a1c
lea esp, [esp + 2]
jmp 0x671a1c
mov edx, dword [edx + 0x63762207]
call fcn.00672ea9
dec esp
invalid
mov ax, di
jmp 0x672e8e
bts eax, esp
jae 0x672ea4
mov ax, di
jmp 0x672e8e
mov edx, ecx
lea eax, [ebp + 0x9d]
neg eax
jp 0x672e4e
jnp 0x672e22
mov dl, 0x19
jmp 0x6730a2
mov dl, cl
mov dl, 0x19
lea esp, [esp + 8]
sub al, 0x2f
mov dx, word [esp]
bts edx, eax
jmp 0x672c30
btr dx, bp
jp 0x672c2b
jnp 0x672c2b
Function at 0x6ad264
Capabilities:
Encrypt data using aes

Disassembly:
lea ebp, [edx + edi]
jmp 0x6ad2a5
lea edi, [edi + 0xb]
movzx esi, byte [edi]
pop edi
jmp 0x6ad2c2
xor edx, esi
push edi
mov edi, eax
jmp 0x6ad28f
movzx edx, byte [eax + 0xc]
jmp 0x6ad2eb
shl edx, 8
xor edx, esi
mov dword [ecx + 8], edx
jmp 0x6ad2ac
movzx esi, byte [eax + 0xd]
shl edx, 8
xor edx, esi
jmp 0x6ad518
mov eax, dword [eax*4 + 0x669724]
jmp 0x6ad41b
mov esi, 0x5223ad82
lea esi, [esi - 0x5223ac83]
and eax, esi
jmp 0x6ad31b
pushal
pop es
adc al, 0x72
mul dword [edi + 2]
int1
sbb ch, byte [edx - 0x7b]
xor al, 0x27
dec esi
invalid
lea esp, [esp + 2]
lea esp, [esp + 4]
and edi, 0xff0000
call fcn.006ad356
add esi, 4
mov ebx, dword [esi]
pop esi
call 0x6ad391
cmp byte [ebp - 0x8fee965], bh
push ss
add edi, esi
call fcn.006ad3bd
sbb dword [edi + 0x4d996a0f], ebx
jno 0x6ad393
add ax, si
inc ebp
insd dword es:[edi], dx
jl 0x6ad361
mov bh, 0xbf
mov edi, dword [edi*4 + 0x669724]
mov bx, 0x1c6f
mov bh, ah
mov edi, 0x24bd3c8b
xchg edi, eax
add byte [esi - 0x45], ah
outsd dx, dword [esi]
sbb al, 0x8a
cld
sub esp, 6
jmp 0x6ad372
or bh, bl
shr edi, 8
bsf ebx, ecx
and edi, esi
jmp 0x6ad3a9
lea esp, [esp + 0x40]
xor eax, 0x1000000
mov di, 0xf350
mov edi, edx
jmp 0x6ad3e1
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
jmp 0x6ad331
xor edx, esi
shl edx, 8
xor edx, eax
jmp 0x6ad44f
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
jmp 0x6ad4d3
Function at 0x6ad3bd
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, edi
jmp 0x6ad655
lea ebp, [eax*4]
jmp 0x6ad3ca
lea esp, [esp + 8]
and eax, 0xff000000
jmp 0x6ad403
mov edi, edx
lea ebp, [edi*4]
mov bp, word [esp]
jmp 0x6ad42c
xor eax, edi
mov ebp, dword [esp]
neg edi
bt bp, si
jmp 0x6ad3ed
bsr bp, ax
shr edi, 0x18
mov ebp, 0x824b5579
push ebp
jmp 0x6ad472
lea ebp, [ebp*4]
lea ebp, [ebp + 0x669724]
jmp 0x6ad492
pushal
xchg dh, cl
mov dword [esp + 8], edi
popal
jmp 0x6ad45c
mov ebp, 0x859cffc8
xchg edi, ebp
lea ebp, [ebx + edi]
jmp 0x6ad4b4
movzx edi, byte [ebp]
pop ebp
push ebp
shl ebp, cl
xor eax, edi
jmp 0x6ad47c
lea esp, [esp + 2]
jmp 0x6ad4f5
mov edi, edx
and edi, esi
sub esp, 0x1a
mov byte [esp + 0xe], dl
jmp 0x6ad49e
mov ebp, 0x6af3a7dc
jmp 0x6ad751
mov edi, dword [edi*4 + 0x669724]
not bp
cmp ebp, 0xc3ecc798
lea ebp, [edx + ebp]
jmp 0x6ad4df
dec di
mov di, sp
lea edi, [esi*4]
mov di, word [esp]
lea edi, [ecx + 0x10]
call fcn.006ad53b
mov ecx, edx
mov edi, dword [esp]
shr ecx, 8
mov edi, edx
jmp 0x6ad63a
and ecx, esi
mov ecx, dword [ecx*4 + 0x669724]
jmp 0x6ad678
mov edx, dword [eax + 0xc]
mov ecx, ebx
stc
mov edi, 0x5147b308
jmp 0x6ad62a
and edi, esi
jmp 0x6ad6a9
shr edi, 0x10
push si
pushfd
lea esp, [esp + 2]
jmp 0x6ad662
lea esp, [esp + 4]
and edi, 0xff000000
push bx
lea esp, [esp + 2]
jmp 0x6ad6d3
mov edi, dword [edi*4 + 0x669724]
lea esp, [esp + 4]
and ecx, 0xff0000
push esi
jmp 0x6ad684
xor ecx, edi
mov edi, edx
call fcn.006ad6bd
mov dword [esp], ebx
jmp 0x6ad737
xor eax, edi
mov edi, 0x18adecf9
lea esp, [esp + 0x1c]
xor eax, dword [ecx]
jmp 0x6ad612
lea esp, [esp + 1]
jmp 0x6ad8fa
shr edi, 0x18
movzx edi, byte [edi*4 + 0x669724]
cmc
sub esp, 9
jmp 0x6ad721
add ebp, 0x950d5724
push esp
lea esp, [esp + 4]
and edi, ebp
jmp 0x6ad70f
mov dx, bx
mov edx, dword [eax + 4]
jmp 0x6ad788
xor ecx, dword [eax]
mov dx, 0xf594
add ebx, 4
mov dword [edi], ecx
jmp 0x6ad760
xor edx, ecx
bswap ecx
mov dword [eax + 0x14], edx
mov cx, 0xf389
jmp 0x6ad7ed
mov ebx, eax
add ebx, 8
mov ecx, dword [ebx]
pop ebx
clc
jmp 0x6ad7d5
lea edi, [0x11bceb30]
lea edi, [eax + 0x10]
bswap edx
bt dx, di
jmp 0x6ad77b
mov dword [eax + 0x18], ecx
mov dl, ah
jmp 0x6ad814
pushal
xor ecx, edx
add dx, 0x13ec
jmp 0x6ad7bf
push dx
clc
lea esp, [esp + 2]
push ebx
jmp 0x6ad795
mov dword [eax + 0x1c], edx
pushfd
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x6ad81c
mov edx, dword [eax + 0xc]
xor edx, ecx
cmc
jmp 0x6ad7f7
lea esp, [esp + 0x20]
cmp ebx, 0x66af4c
jne 0x6ad07a
jmp 0x6ad8a7
mov edi, dword [esp]
mov ebp, dword [esp]
setb bl
pushal
xchg byte [esp + 0x18], bh
jmp 0x6ad878
xor ecx, edx
lea esp, [esp + 0x10]
xor ecx, dword [ebx]
rcr edi, 0x18
jmp 0x6ad7ae
lea esp, [esp + 0x24]
pop esi
push 0xa
pop eax
not bp
mov di, 0x476c
jmp 0x6ad82e
xor ecx, edi
and edx, ebp
mov edi, esp
mov di, word [esp]
jmp 0x6ad847

Function at 0x6ad53b
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
pushfd
lea esp, [esp + 2]
jmp 0x6ad5e6
jmp 0x6ad525
bt ax, bx
mov eax, dword [ecx + 8]
call fcn.006ad53d
xor ebx, eax
mov dword [edi], eax
rol ah, 4
bswap eax
jmp 0x6ad553
Function at 0x6ad53d
Capabilities:
Encrypt data using aes

Disassembly:
xor eax, ebx
jmp 0x6ad57e
shl eax, cl
mov bx, dx
mov dword [esp], ecx
pushal
lea esp, [esp + 0x20]
popal
jmp 0x6ad59d
push edi
pushal
mov edi, dword [esp]
xchg dl, bl
jmp 0x6ad55f
mov ebx, 0xa78bae1c
jmp 0x6ad5c3
add edi, 0x14
mov dword [edi], ebx
pop edi
sete bh
mov ebx, 0xde8b8e05
jmp 0x6ad587
mov dword [ecx + 0x1c], edx
mov al, 5
jmp 0x6ad5cd
mov dword [ecx + 0x18], eax
xor edx, eax
xor bx, ax
jmp 0x6ad5ad
mov ebx, 0x66af28
jmp 0x6ad5f4
lea esp, [esp + 8]
jmp 0x6ad07a

Function at 0x6ad6bd
Capabilities:
Encrypt data using aes

Disassembly:
and edx, esi
jmp 0x6ad6f2
mov edx, dword [edx*4 + 0x669724]
call 0x6ad6dc
aad 0x55
lds ebp, [edi + ebx*2 + 0x54c645bb]
xor ecx, esi
sub esi, edi
fisubr word [ecx]
dec eax
jmp 0x6ad743