joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4888b0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00487130
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x528648], 0
jne 0x4888ed
cmp dword [0x528644], 0
je 0x4888ed
mov eax, dword [0x528644]
mov dword [0x528648], eax
cmp dword [0x528648], 0
je 0x48896a
mov ecx, dword [0x528648]
cmp dword [ecx + 8], 0
je 0x48896a
mov edx, dword [0x528648]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x48896a
mov ecx, dword [0x528648]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x48896a
mov eax, dword [0x528648]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x488939
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x488940
xor eax, eax
jmp 0x488a8d
mov ecx, dword [0x528648]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00473d40
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x488a8d
mov edx, dword [0x528644]
mov dword [0x528648], edx
jmp 0x488986
mov eax, dword [0x528648]
mov ecx, dword [eax + 4]
mov dword [0x528648], ecx
cmp dword [0x528648], 0
je 0x4889c6
cmp dword [0x528648], 0
je 0x4889c4
mov edx, dword [0x528648]
cmp dword [edx + 8], 0
je 0x4889c4
mov eax, dword [0x528648]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x4889c4
mov edx, dword [0x528648]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x4889c4
jmp 0x48891e
jmp 0x488978
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00487210
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x488a8b
mov eax, dword [ebp - 4]
mov dword [0x528648], eax
mov ecx, dword [0x528648]
mov dword [ecx], 0x52727464
mov edx, dword [0x528648]
mov dword [edx + 8], 0
mov eax, dword [0x528648]
mov ecx, dword [0x528644]
mov dword [eax + 4], ecx
mov edx, dword [0x528648]
mov dword [0x528644], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x528648]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x38c
jmp 0x488a57
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 1
jle 0x488a7b
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
jmp 0x488a4e
mov eax, dword [0x528648]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x48891e
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x490f10
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00490c80
Function at 0x4dd7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x4dd9ad
call fcn.004dd806
Function at 0x537c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x537d8c
test eax, eax
je 0x537d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x552ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x537d73
lea edi, [eax + 4]
jmp 0x537cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x537cec
mov dword [ebp - 4], 2
jmp 0x537d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x537d03
mov dword [ebp - 4], 1
jmp 0x537d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x537d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x537d46
mov byte [ecx], 0x3d
jmp 0x537d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x537d5d
mov byte [ecx], 0x3d
jmp 0x537d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x537cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x57c2b1
Capabilities:
Encode data using xor

Disassembly:
cmp ecx, edi
jmp 0x696efc
push ebp
shld bp, cx, 0x59
adc bp, 0x43a7
jmp 0x5829a2
mov ebp, esp
test cx, 0x6750
test bp, cx
cmc
push ebx
push esi
stc
clc
cmc
push edi
clc
bts di, di
adc edi, eax
mov edi, dword [ebp + 8]
stc
cmc
test edi, edi
je 0x5829d0
cmp edi, 0x18
jbe 0x401225
mov edi, 0x18
jmp 0x401225

Function at 0x5e4595
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
ror ax, 0x81
stc
lea esp, [esp - 0x4ac]
neg cx
mov eax, dword [0x520628]
sbb ecx, 0x72e71b7f
inc ch
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov cx, ax
push 0x3fe
push eax
xchg ch, ch
not cl
jmp 0x5f6dc0
lea ecx, [ebp - 0x49e]
jmp 0x8d688f
mov word [ebp - 0x4a0], ax
jmp loc.0042c8da
push ecx
jmp 0x666e6b
Function at 0x643b1a
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jne 0x643b26
sub eax, ecx
push eax
lea edx, [esp + 0x1954]
not ecx
mov cl, dh
push edx
movzx ecx, bp
mov cx, bp
lea ecx, [esp + 0x31c]
jmp 0x7c7ed6
lea ecx, [esp + 0x140]
call fcn.00404e60
lea ecx, [esp + 0x314]
cwd
xchg dh, dl
mov dh, 0xb8
push ecx
movsx edx, bx
cdq
bswap ecx
lea edx, [esp + 0xa8c]
not ch
movsx cx, bh
push edx
lea edx, [esp + 0x1674]
movsx ecx, bx
bswap cx
movzx ecx, cx
lea ecx, [esp + 0x140]
jmp 0x749edf
push 0x6549f861
call fcn.006185a0
dec dl
mov dl, byte [eax]
jmp 0x88cbe2
jb 0x76c8bb
mov ecx, dword [esp + 0x13c]
push ecx
jmp 0x76c8b3
mov byte [esp + 0x1bfc], 0x16
call fcn.00404c50
cmp dword [esp + 0xaa0], ebx
jmp 0x80234c
inc eax
jmp 0x79996b
mov byte [esp + 0x1bf8], 0x15
jmp 0x77d2cf
call fcn.004509e1
add esp, 4
mov byte [esp + 0x1bf0], 6
mov dword [esp + 0x150], esi
cmc
mov dword [esp + 0x14c], edi
stc
jmp 0x41a84b
call fcn.0042b8d0
push 0xffffffffffffffff
mov cl, bh
push edi
mov ch, al
jmp 0x7abeb0
jne 0x7c7f0e
sub eax, edx
push eax
movsx ecx, cx
mov al, al
lea eax, [esp + 0x18dc]
push eax
movsx ecx, si
mov ecx, edi
jmp 0x5e5f0d
test cl, cl
jmp 0x78ee0d
call fcn.004509e1
add esp, 4
stc
cmp dx, bx
mov dword [esp + 0xaa0], esi
stc
clc
mov dword [esp + 0xa9c], edi
mov byte [esp + 0xa8c], 0
test esp, edx
cmp dword [esp + 0x150], ebx
jmp 0x660a73
push eax
lea ecx, [esp + 0x165c]
jmp 0x6c5383
call fcn.00404e60
mov byte [esp + 0x1bf0], 0x14
lea eax, [esp + 0x18d8]
inc edx
cwd
mov dword [esp + 0x150], esi
mov dword [esp + 0x14c], edi
xchg dl, cl
mov byte [esp + 0x13c], 0
xchg dl, cl
mov cl, 0x97
lea edx, [eax + 1]
inc cl
mov cl, byte [eax]
jmp 0x71a588
jb 0x79fc25
mov eax, dword [esp + 0xa8c]
push eax
jmp 0x79fc19
inc eax
clc
test dl, dl
jmp 0x583939

Function at 0x6779a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
movzx edx, cx
pushfd
movsx edx, di
rcl dh, cl
bts dx, ax
push ecx
bt dx, cx
setns dl
mov dx, 0x4fdd
push ebx
rcr bx, cl
rcl dx, 0xeb
push eax
push edi
push ebp
mov edi, esi
btr bx, dx
rdtsc
push esi
rdtsc
mov eax, 0
push eax
bswap di
stc
mov edi, dword [esp + 0x28]
btc ebx, eax
rcl ebp, 0xf7
ror edi, 3
jmp 0x865b84
dec eax
stc
xor ebx, eax
add ebp, eax
push ebp
ret
inc eax
bswap eax
clc
test sp, 0x10c5
neg eax
jmp 0x6d378c
dec edi
add ebx, 0x2fb233ca
neg edi
cmove si, cx
mov dx, 0x56c6
mov bp, dx
bswap edi
xchg esi, esi
dec edi
clc
ror edi, 1
neg bx
bswap edi
lea edi, [edi - 0x67152af9]
xor bp, 0x6f86
add edi, eax
shl ebp, 0xb0
bsr bx, bx
mov esi, esp
xor dh, 0x1c
lahf
sar ebp, 0xe7
sub esp, 0xc0
sar bl, cl
jmp 0x895bdd
mov ebx, edi
mov edx, 0
or eax, 0x2671614a
btr ebp, 0xb0
btc ax, 0xec
sub ebx, edx
and bp, bx
sub eax, edi
lea ebp, [0x895bf9]
rcr ah, 0xdb
sub edi, 4
ror al, cl
btr ax, 0xe9
sub eax, esi
mov eax, dword [edi]
cmp di, 0x4e17
xor eax, ebx
jmp 0x85c08c
Function at 0x74036e
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
push 0x6549f861
call fcn.006185a0
push ecx
setl ch
lea ecx, [esp + 0xd78]
jmp 0x86aed2
call fcn.00404b50
lea edx, [esp + 0xdac]
jmp loc.0041dc29
mov byte [esp + 0x1bf4], 0xb3
jmp 0x77b3ac

Function at 0x7435e8
Capabilities:
Authenticate hmac
Check http status code
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jmp 0x5fdc10
add esp, 4
mov eax, dword [esp + 0x14]
inc eax
stc
cmp eax, ebx
jmp 0x7c58ed
cmp dword [esp + 0x14], 3
jmp 0x83b912
jmp dword [ecx*4 + 0x815348]
push 0xb54f91c3
call fcn.005ff12d
jmp 0x7dcf07
jl 0x6eae99
lea ecx, [esp + 0x17d8]
jmp loc.004141cf
mov dword [esp + 0x14], eax
jmp 0x766cd1
mov dword [ecx + 0x30], eax
jmp 0x58d349
push eax
call fcn.0046e7f3
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + 0x84]
jmp 0x7ce42f
ja 0x5fdc13
mov ecx, dword [esp + 0x14]
jmp 0x70cede
Function at 0x76d4ae
Capabilities:
Read file on windows

Disassembly:
cmp ebx, 0x14
jl 0x5b01ca
push 0x50
mov edx, 0x1bdc16da
cdq
push edi
not dx
lea edx, [esp + 0x28]
mov ecx, edi
lea ecx, [esp + 0x40]
jmp 0x5ed75c
jmp 0x5b01ca
movzx eax, byte [edx]
movzx ecx, byte [edx - 1]
cmove si, sp
shrd esi, ecx, 0x88
movzx esi, byte [edx + 1]
shl eax, 8
jmp 0x80347e
push ecx
jmp 0x7755ff
call fcn.0086d920
lea esp, [esp + 8]
jmp 0x882671
sar eax, 0x18
cmc
cmp si, 0x1835
mov byte [edx + 1], cl
add cl, 0x38
mov byte [edx + 2], al
adc cl, 0x98
cmc
xor eax, eax
sbb cl, 0x1a
not cl
mov cl, byte [eax + edx - 5]
xor byte [eax + edx - 1], cl
jmp 0x8bf803
mov byte [edx - 1], al
sar ecx, 8
test dx, 0x365a
cmp dl, 0xdc
mov byte [edx], cl
bsf ecx, edi
or ch, dh
mov ecx, eax
sar ecx, 0x10
jmp 0x61e598
call fcn.004714ed
mov eax, dword [esp + 0x20]
jmp 0x793480
xor eax, dword [ecx]
mov cl, 0x2d
mov cl, bl
clc
jmp 0x8a6689
call fcn.00491f20
add esp, 4
movzx edx, ax
mov dh, 0xb0
push edi
lea edx, [esp + 0xd4]
push ebx
push edx
jmp 0x7e9e0b
push 0xf5f519c3
call fcn.005ff12d
push ebx
jmp 0x74a5b2
call fcn.00491dd0
push ebx
call fcn.004509e1
add esp, 0xc
push 0x50
jmp 0x843267
push eax
call fcn.0046f56f
lea ecx, [esp + 0xe4]
test esp, edx
add esp, 0x14
jmp 0x79df0b
push ecx
jmp 0x7684ec
mov byte [esp + eax + 0xbc], 0
jmp 0x823fc7
je 0x82ae3b
push edi
jmp 0x82ae2d
mov dword [esp + 0x1c], esi
jmp 0x43be3f
call fcn.00491cf0
add esp, 0xc
lea eax, [esp + 0xd0]
seto cl
push eax
mov ch, al
lea ecx, [esp + 0xc0]
jmp 0x5d4444
or ecx, eax
sal eax, 0xc2
shrd ax, si, 0x9c
movzx eax, byte [edx + 2]
shl eax, 8
cmp sp, 0x421c
or eax, esi
jmp 0x87295d
inc eax
cmp eax, 0x14
jl 0x843278
mov ecx, dword [esp + 0x1c]
cbw
mov eax, edi
sar si, 0x51
sub ecx, edi
mov esi, 4
shr dl, 0xd1
xchg dl, dl
mov dl, byte [ecx + eax]
cmc
test dx, sp
xor byte [eax], dl
jmp 0x87b215
call fcn.004509e1
lea esp, [esp + 4]
cwde
xor ax, 0x6339
xor esi, esi
lahf
or ax, bp
push 0x206
lea eax, [esp + 0x186]
test ebx, esp
sub edx, edx
push esi
test ebx, 0x45f20eb6
xor ebx, ebx
push eax
mov dword [esp + 0x4c], ebx
jmp 0x8cabcc
call fcn.004509ec
lea esp, [esp + 4]
mov edi, eax
xor eax, eax
cmovb dx, si
movzx edx, byte [esp + eax + 0xbc]
mov dword [edi + eax*4], edx
jmp 0x7b5bc4
shl eax, 0x10
or eax, ecx
add cx, di
movzx ecx, cx
mov ecx, dword [esp + 0x1c]
jmp 0x74b506
inc eax
clc
sub esi, 1
jne 0x823fe9
lea ebx, [esi + 1]
mov dx, dx
bswap dx
lea edx, [edi + 5]
jmp 0x59cf01
test edi, edi
jmp 0x7c262c
rol eax, cl
or cx, sp
mov ecx, eax
clc
jmp 0x695ca3
inc eax
stc
cmp sp, 0x43b3
cmp eax, 4
jl 0x61e5b5
inc ebx
test bh, cl
cmp ebp, eax
cmp ebp, 0x7d691eff
lea edx, [edx + 4]
jmp 0x539baa
mov dword [esp + 0x24], esi
jmp 0x7d8fc9

Function at 0x793351
Capabilities:
Check http status code
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
push 0xf5f519c3
call fcn.005ff12d
mov byte [esp + 0x1b2c], 0x4f
jmp 0x79d63e
mov byte [esp + 0x1b2d], 0x52
jmp loc.0041973a
Function at 0x7c7151
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
push edi
jmp 0x5f6358
push eax
cmova eax, ecx
lea eax, [ebp - 0xc]
jmp 0x792159
xor eax, ebp
jmp 0x791293
push ebx
jmp 0x7f608e
mov dword [ebp - 0x10], eax
jmp 0x777d07
mov dword fs:[0], eax
cwde
movsx ax, dh
mov eax, dword [ebp + 8]
jmp 0x792bf9
mov dword [ebp - 0x2cc], eax
jmp loc.00432c72
push eax
lea esp, [esp - 0x2c4]
mov eax, dword [0x520628]
jmp 0x64116f
push esi
jmp 0x5c36bd
push ebp
adc ah, ch
mov ebp, esp
push 0xffffffffffffffff
push 0x4e456b
cmc
mov eax, dword fs:[0]
jmp 0x7c7151

Function at 0x7c8ce7
Capabilities:
Encode data using xor

Disassembly:
popal
xchg esp, eax
invalid
push 0x6549f861
call fcn.006185a0
inc edi
sti
ficomp dword [esi - 0x43]
and byte [edi + 8], ah
mov eax, dword [0xee6d3310]
pop esi
in al, dx
mov cl, 0x64
das
pop esi
inc ecx
push esp
jbe 0x7c8cc8
pop esi
enter 0xffffffffffffc0a7, 0x17
mov eax, dword [0x258ad536]
mov eax, dword [0xae2a63c6]
pop esi
xor eax, 0x5efeedf8
mov eax, 0xa10c37b3
sbb byte [ebp - 0x2c5e3ad0], ah
invalid

Function at 0x7d404c
Capabilities:
Check for software breakpoints
Execute anti-debugging instructions
Read file on windows

Disassembly:
mov byte [esp + 0x7a], 0x6e
jmp 0x85b5cd
mov byte [esp + 0x89], 0x65
jmp 0x71e0c1
mov byte [esp + 0x84], 0x43
jmp 0x818258
mov byte [esp + 0x79], 0x69
jmp 0x532df2
mov byte [esp + 0x86], 0x65
jmp 0x6d87ff
mov byte [esp + 0x87], 0x61
jmp 0x8111cd
mov byte [esp + 0x8a], 0
push edx
mov byte [esp + 0x80], 0x20
jmp loc.00411299
mov byte [esp + 0x83], 0x20
jmp 0x622038
mov byte [esp + 0x7d], 0x6f
jmp 0x829a50
push 0x6549f861
call fcn.006185a0
mov byte [esp + 0x78], bl
jmp 0x659be0
mov byte [esp + 0x88], 0x74
jmp 0x57f193
mov byte [esp + 0x85], 0x72
jmp 0x69eddc
mov byte [esp + 0x7e], 0x72
mov byte [esp + 0x7f], 0x20
jmp 0x885be2
mov byte [esp + 0x7b], 0x67
jmp 0x73194f
mov byte [esp + 0x80], 0x4e
mov byte [esp + 0x81], 0x6f
mov byte [esp + 0x82], 0x74
jmp 0x7204ef
Function at 0x82ad94
Capabilities:
Execute anti-debugging instructions

Disassembly:
jb 0x8d2a14
mov eax, dword [eax + 4]
jmp 0x74a66d
mov byte [esp + 0x1a82], 0x52
jmp 0x5e6cd4
mov byte [esp + 0x1a84], 0x45
jmp 0x8a2201
call fcn.0046e7f3
mov edx, dword [esp + 0x14]
jmp 0x8205d2
je 0x88506d
sub eax, 1
je 0x625c9d
sub eax, 1
jmp 0x83dc7a
mov byte [esp + 0x1a83], 0x56
jmp 0x59ac9e
mov byte [esp + 0x1a79], 0x43
jmp 0x882f1a
add eax, 4
push eax
jmp 0x7f1624
push eax
jmp 0x7dd74f
mov edi, 1
mov si, ax
jmp 0x7ffc31
push eax
jmp 0x5cf925
call fcn.00441780
cmp dword [eax + 0x18], 0x10
jb 0x5f94b1
mov eax, dword [eax + 4]
jmp 0x440395
call fcn.00441730
lea edx, [esp + 0x1a74]
jmp 0x761a56
mov byte [esp + 0x1a7d], 0x45
jmp 0x755948
mov dword [ecx + 0xd24], eax
jmp 0x42f588
mov byte [esp + 0x1a81], 0x45
jmp 0x57fd72
mov byte [esp + 0x1a80], 0x53
jmp 0x72d725
jmp 0x6464e3
mov byte [esp + 0x1a7e], 0x4c
mov byte [esp + 0x1a7f], 0x5f
jmp 0x7412fe
push edx
jmp 0x8cb242
mov ecx, dword [edx + 0x84]
jmp 0x87fafb
call fcn.00441780
cmp dword [eax + 0x18], 0x10
jmp 0x57ea1f
mov byte [esp + 0x1a78], 0x3c
jmp 0x5e882a
mov byte [esp + 0x1a88], 0x54
jmp 0x8a61d8
mov byte [esp + 0x1a87], 0x42
jmp 0x79c963
mov dword [esp + 0x18], eax
cmp dh, 0x44
clc
test ebx, ebx
jmp 0x8276e5
call fcn.0046e7f3
mov edx, dword [esp + 0x14]
sbb ecx, esi
btr ecx, 0xc
mov ecx, dword [edx + 0x84]
test ebp, 0x6b634db8
mov dword [ecx + 0xd1c], eax
xor ax, sp
inc eax
add esp, 4
nop
mov eax, dword [esp + 0x18]
jmp 0x8690a6
call fcn.0046e7f3
mov edx, dword [esp + 0x14]
movzx cx, dh
movsx ecx, sp
jmp 0x763889
call fcn.00441780
cmp dword [eax + 0x18], 0x10
jb 0x844524
mov eax, dword [eax + 4]
jmp 0x41e6c2
lea esi, [esp + 0x56c]
jmp 0x64a5f6
mov ecx, dword [edx + 0x84]
jmp 0x6e425b
jle 0x874619
sub eax, 0
jmp 0x5e3219
push 0x6549f861
call fcn.006185a0
call fcn.00404d40
mov ecx, dword [esp + 0x57c]
cwd
sal dx, 0xc5
sub dx, 0x5464
sub ecx, dword [esp + 0x578]
shld ax, ax, 0x72
bt edx, esp
xor al, 0xfe
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
bswap bx
movsx bx, bl
or bh, 0xa6
mov ebx, edx
test esi, 0x2b641506
shr ebx, 0x1f
test dx, 0x74a5
add ebx, edx
test bx, bx
xor eax, eax
jmp 0x7d70db
mov byte [esp + 0x1a7b], 0x4e
mov byte [esp + 0x1a7c], 0x43
jmp 0x6dbcd9
jne 0x7dd779
lea edi, [eax + 2]
lea esi, [esp + 0x56c]
jmp 0x774f76
add eax, 4
jmp 0x613959
inc eax
cmp eax, ebx
jmp 0x87460f
mov dword [esp + 0x18], eax
jl 0x8276eb
lea esi, [esp + 0x56c]
jmp 0x68d67e
mov dword [ecx + 0xd20], eax
jmp 0x7dd774
mov byte [esp + 0x1a7a], 0x41
jmp 0x83d11f
xor edi, edi
lea esi, [esp + 0x56c]
jmp 0x7f4ec0
mov byte [esp + 0x1a85], 0x52
mov byte [esp + 0x1a86], 0x5f
jmp 0x7af699
mov byte [esp + 0x1a89], 0x4e
jmp 0x42257e
lea ecx, [esp + 0x10c0]
jmp 0x79bc44
add eax, 4
jmp 0x6464e3
Function at 0x8428ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x228], eax
jmp loc.0042a4de
push edx
jmp 0x58dd14
push ebp
movsx ax, bh
mov ebp, esp
lea esp, [esp - 0x244]
bts ax, bp
mov eax, dword [0x520628]
rol edx, cl
ror dl, 0xaa
xor eax, ebp
clc
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
xor dl, 0x43
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
sub ecx, ecx
push 0x206
push ecx
movzx dx, dl
lea edx, [ebp - 0x222]
jmp 0x7b0f4e
Function at 0x86d920
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
push edi
jmp 0x5f6358
push eax
cmova eax, ecx
lea eax, [ebp - 0xc]
jmp 0x792159
xor eax, ebp
jmp 0x791293
push ebx
jmp 0x7f608e
mov dword [ebp - 0x10], eax
jmp 0x777d07
mov dword fs:[0], eax
cwde
movsx ax, dh
mov eax, dword [ebp + 8]
jmp 0x792bf9
mov dword [ebp - 0x2cc], eax
jmp loc.00432c72
push eax
lea esp, [esp - 0x2c4]
mov eax, dword [0x520628]
jmp 0x64116f
push esi
jmp 0x5c36bd
push ebp
adc ah, ch
mov ebp, esp
push 0xffffffffffffffff
push 0x4e456b
cmc
mov eax, dword fs:[0]
jmp 0x7c7151

Function at 0x8abeaa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0xd6], al
mov al, 0x73
mov byte [ebp - 0x20], 0x6e
jmp 0x6fc6a8
mov byte [ebp - 0x1d], al
jmp 0x741844
mov byte [ebp - 0x1a], 0x64
jmp 0x7bf57d
mov byte [ebp - 0x19], al
mov byte [ebp - 0x18], al
jmp 0x540a8c
mov byte [ebp - 0x1f], dl
jmp 0x72cca7
mov byte [ebp - 0x1e], 0x64
jmp 0x89e9ee
mov byte [ebp - 0x1c], al
jmp 0x6959d6
mov dword [ebp - 4], eax
push ebx
mov bl, 0xa
mov dl, bl
mov al, 0x6c
mov dl, 0x74
mov bl, 0x6f
push esi
jmp 0x7c992f
mov byte [ebp - 0x17], 0
jmp loc.004027bc
push edi
not edi
bswap di
mov edi, ecx
mov cl, 0x69
jmp 0x5b398e
mov byte [ebp - 0x1b], 0x2e
jmp 0x609d76
push ebp
bsr ebp, ebx
btc ax, 0xf9
add dl, 0x4c
mov ebp, esp
sal dl, 0x6c
shrd ax, dx, 0x80
lea esp, [esp - 0x160]
cmp edx, 0x2c123fd1
rol ax, 0x7e
mov eax, dword [0x520628]
xor eax, ebp
jmp 0x7ad82e
Function at 0x40e20a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 4]
push edi
mov edi, ecx
test esi, esi
jns 0x40e238
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
and eax, 0xfffffffe
and esi, 0x7fffffff
push eax
add esi, edx
push esi
call fcn.0040e2b9
add esp, 0xc
jmp 0x40e2b5
push ebx
mov ecx, 0x7fffffff
and esi, ecx
add esi, edx
lea eax, [ebp + 8]
mov ebx, dword [esi]
and dword [ebp + 8], 0
push eax
push 4
push dword [esi + 4]
and ebx, ecx
add ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40e2b4
mov eax, dword [ebp + 0x10]
push 0xffffffffffffffff
mov ecx, dword [eax + 0x1c]
push 0
sub ecx, edi
test byte [ebp + 0xc], 0x40
pop eax
setne al
lea eax, [eax*2 - 1]
push eax
mov eax, dword [0x4f8d84]
imul eax, dword [esi]
push eax
mov eax, dword [0x4f8d8c]
imul eax, dword [esi]
push eax
mov eax, dword [0x4f8d80]
mov edx, dword [esi + 4]
xor eax, ecx
push eax
mov ecx, ebx
call fcn.0040e838
add esp, 0x14
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x40e7e8
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
mov ebx, dword [ecx + 0x3c]
add ebx, ecx
push ebp
movzx eax, word [ebx + 0x14]
lea ebp, [ebx + 0x18]
add ebp, eax
push esi
xor eax, eax
xor esi, esi
push edi
mov dword [esp + 0x10], edx
cmp ax, word [ebx + 6]
jae 0x40e828
mov edi, ebp
push edi
push edx
call fcn.0041e466
pop ecx
pop ecx
test eax, eax
je 0x40e830
movzx eax, word [ebx + 6]
mov edx, dword [esp + 0x10]
inc esi
add edi, 0x28
cmp esi, eax
jb 0x40e80b
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
imul esi, esi, 0x28
lea eax, [esi + ebp]
jmp 0x40e82a
Function at 0x40e8c9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x429f89
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
mov esi, ecx
push edi
mov ebx, edx
test esi, esi
je 0x40e991
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi + 0x7c], 0
je 0x40e991
mov eax, dword [edi + 0x78]
add eax, esi
mov dword [esp + 0x18], eax
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
add ecx, esi
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 0x24]
add ecx, esi
add edx, esi
cmp byte [ebx], 0xff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], edx
je 0x40e94c
push ebx
call fcn.0041dd00
push eax
push ebx
call fcn.00412128
mov edx, dword [esp + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
add esp, 0xc
jmp 0x40e956
mov ecx, dword [ebx + 1]
xor ecx, dword [ebp + 0xc]
mov dword [esp + 0x10], ecx
xor ebx, ebx
cmp dword [eax + 0x18], ebx
jbe 0x40e991
mov eax, dword [edx + ebx*4]
test eax, eax
je 0x40e987
add eax, esi
push eax
mov dword [esp + 0x20], eax
call fcn.0041dd00
push eax
push dword [esp + 0x24]
call fcn.00412128
add esp, 0xc
cmp dword [esp + 0x10], eax
je 0x40e9a5
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ebx
cmp ebx, dword [eax + 0x18]
jb 0x40e95d
xor eax, eax
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
movzx eax, word [eax + ebx*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, dword [edi + 0x78]
jb 0x40eaa1
mov eax, dword [edi + 0x7c]
add eax, dword [edi + 0x78]
cmp ecx, eax
jae 0x40eaa1
lea eax, [ecx + esi]
push eax
lea ecx, [esp + 0x2c]
call fcn.00402134
xor ebx, ebx
mov dword [esp + 0x64], ebx
push 1
push ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x18], 0x2e
call fcn.004022a5
mov esi, eax
cmp esi, 0xffffffff
je 0x40ea8e
push esi
push ebx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x34]
call fcn.004111c1
mov byte [esp + 0x64], 1
cmp dword [eax + 0x14], 0x10
jb 0x40ea1c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov byte [esp + 0x64], bl
lea ecx, [esp + 0x40]
call fcn.00402161
test edi, edi
je 0x40ea8e
push 0xffffffffffffffff
lea ecx, [esi + 1]
push ecx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x34]
call fcn.004111c1
mov byte [esp + 0x64], 2
cmp dword [eax + 0x14], 0x10
jb 0x40ea57
mov eax, dword [eax]
push ebx
push dword [ebp + 0xc]
mov edx, eax
push dword [ebp + 8]
mov ecx, edi
call fcn.0040e8c9
add esp, 0xc
mov esi, eax
mov byte [esp + 0x64], bl
lea ecx, [esp + 0x40]
call fcn.00402161
or dword [esp + 0x64], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.00402161
mov eax, esi
jmp 0x40e993
or dword [esp + 0x64], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.00402161
jmp 0x40e991
lea eax, [ecx + esi]
jmp 0x40e993