joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441ff8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x46d9c0]
cmp byte [eax + 0xc], 0
je 0x442165
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44215e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46ebb8], 0
jne 0x44204c
push 0x44216c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x442174
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ebb8], eax
cmp dword [0x46cad8], 0
jne 0x442147
push 0x442184
call sub.kernel32.dll_LoadLibraryA
mov dword [0x46cad8], eax
cmp dword [0x46cad8], 0
je 0x442147
push 0x442190
mov eax, dword [0x46cad8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ebbc], eax
push 0x4421a0
mov eax, dword [0x46cad8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ebc0], eax
push 0x4421b4
mov eax, dword [0x46cad8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ebc4], eax
push 0x4421cc
mov eax, dword [0x46cad8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ebc8], eax
push 0x4421e4
mov eax, dword [0x46cad8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ebcc], eax
push 0x4421f8
mov eax, dword [0x46cad8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ebd0], eax
push 0x442210
mov eax, dword [0x46cad8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ebd4], eax
push 0x442228
mov eax, dword [0x46cad8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ebd8], eax
push 0x442244
mov eax, dword [0x46cad8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ebdc], eax
push 0x442250
mov eax, dword [0x46cad8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ebe0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442165
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x445ec8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040444c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x445f17
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004046b4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44dd64
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44ddb4]
test si, 4
je 0x44dd78
or bl, 1
test si, 8
je 0x44dd82
or bl, 4
test si, 1
je 0x44dd8c
or bl, 8
test si, 2
je 0x44dd96
or bl, 0x10
test si, 0x10
je 0x44dda0
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44ddaf
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44ddb8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44ddf0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44ddd1
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44dde0
or bl, 4
test esi, 0x20000000
je 0x44ddeb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45440c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45441e
add esp, 0xfffffff0
call fcn.00403a44
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042085c
mov eax, dword [0x46d6c8]
mov dword [eax + 4], ebx
mov dword [eax], 0x4547b0
mov eax, dword [0x46d6d4]
mov dword [eax + 4], ebx
mov dword [eax], 0x4547bc
mov eax, ebx
call fcn.004547c8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4167ac]
call fcn.004036b0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4167ac]
call fcn.004036b0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4167ac]
call fcn.004036b0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4167ac]
call fcn.004036b0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4167ac]
call fcn.004036b0
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x450c90
push eax
push 0
push 0
mov eax, dword [0x46d7f0]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x422224]
call fcn.00423938
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x422224]
call fcn.00423938
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x422224]
call fcn.00423938
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00454be8
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x454ac4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x454ac4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x454ac4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45455b
call fcn.00403a9c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4548a8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x454a53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x454a34
mov dl, 1
mov eax, dword [0x416c9c]
call fcn.004036b0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040444c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x454a23
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00442358
test al, al
je 0x454a16
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x454a64
lea eax, [ebp - 0x254]
call fcn.00409184
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x454a16
xor eax, eax
push ebp
push 0x454a0f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x454a9c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4549f8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004046b4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4549f8
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004046b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454a16
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x454919
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041adf8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454a5a
lea eax, [ebp - 0x260]
call fcn.0040444c
ret

Function at 0x455388
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x46ebfc]
cmp byte [eax + 0xa5], 0
jne 0x4553f9
cmp dword [0x46ec14], 0
jne 0x4553ba
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x455344
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x46ec14], eax
cmp dword [0x46ec10], 0
jne 0x4553d5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x46ec10], eax
cmp dword [0x46ec18], 0
jne 0x4553f9
push esp
push 0
push 0
push 0x4552e8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x46ec18], eax
pop edx
ret
Function at 0x4554f0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x455507
add esp, 0xfffffff0
call fcn.00403a44
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042085c
mov eax, dword [0x46d7e0]
cmp word [eax + 2], 0
jne 0x45552f
mov eax, dword [0x46d7e0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00456bcc
mov eax, dword [0x46d878]
cmp word [eax + 2], 0
jne 0x455549
mov eax, dword [0x46d878]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00456dc4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4167ac]
call fcn.004036b0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4167ac]
call fcn.004036b0
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x422ca4]
call fcn.0042a348
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4556d0
mov eax, dword [0x46d724]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042a718
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x457334
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46d724]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040b4ac
test eax, eax
je 0x45563e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408acc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040b4d4
test eax, eax
je 0x455652
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004046b4
mov eax, dword [0x46d62c]
cmp byte [eax], 0
jne 0x455686
mov eax, ebx
call fcn.004557f8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00457510
mov eax, ebx
call fcn.00457ec0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4556c6
call fcn.00403a9c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455a6c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46ebfc]
cmp dword [eax + 0x30], 0
je 0x455b16
cmp dword [ebx + 0x94], 0
jne 0x455b10
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4559fc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x455b10
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x455ad6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x455b10
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418e4c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x455ae5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4565f4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x456629
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040453c
jmp 0x456636
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004044a0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4576ec
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45772d
mov eax, esi
call fcn.0043dad8
test al, al
je 0x45772d
mov eax, dword [ebx + 0x84]
call fcn.0043d7d4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45772d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043d7d4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45ae34
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x45ae62
mov eax, ebx
call fcn.0045b8ec
cmp dword [ebx + 0x3c], 0
je 0x45ae5b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x45aed3
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x45aec5
cmp dword [ebx + 8], 0
je 0x45ae84
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x45ae96
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x45aec5
cmp dword [ebx + 8], 0
je 0x45ae77
cmp eax, 3
je 0x45aea9
dec eax
jne 0x45ae77
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45ae77
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x45ae77
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x45aef1
cmp dword [ebx + 0x10], 0xcc
je 0x45aef1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0045aefc
pop ebx
ret
Function at 0x46b06c
Capabilities:
Create process on windows
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048ec
mov eax, dword [ebp - 8]
call fcn.004048ec
mov eax, dword [ebp - 0xc]
call fcn.004048ec
xor eax, eax
push ebp
push 0x46b152
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402fec
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov eax, dword [0x46d864]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
call fcn.004048fc
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
call fcn.004048fc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0xc]
call fcn.004048fc
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x46b137
jmp 0x46b125
mov eax, dword [0x46d864]
mov eax, dword [eax]
call fcn.00456920
mov eax, dword [0x46d864]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x46b137
push 0x64
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x46b109
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b159
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404470
ret
Function at 0x16414a6
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
sbb dl, 0x8c
rcl dl, 2
mov dword [esp + 0x1c], 0
shrd dx, cx, cl
bsf dx, dx
movzx edx, bl
shl dl, cl
mov edx, dword [ebp - 0xac]
call 0x164165c

Function at 0x16414cc
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0x2c]
je 0x164746e
jmp 0x164a10d
not eax
lahf
bswap eax
mov eax, dword [ebp - 0x100]
push edx
mov cl, bh
mov ecx, dword [eax + 0x30]
mov byte [esp], 0xf4
push 0x6becacde
mov dword [esp], edi
pushfd
lea esp, [esp + 0xc]
jmp 0x1649fb1

Function at 0x1641935
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
jmp 0x164290e
lea esp, [esp + 0x10]
jne 0x164d986
cmc
bswap ax
inc ah
mov eax, dword [ebp - 0x44]
call fcn.0164b82f

Function at 0x164193a
Capabilities:
Check for software breakpoints
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x10]
jne 0x164ab71
and cl, dl
mov eax, dword [ebp - 0x104]
test ah, 0x55
shld cx, bx, 4
cmp dl, 0xcc
mov ecx, dword [eax + 0x30]
stc
pushfd
pushfd
xor edx, edx
rol dl, 6
btr dx, 2
mov dx, word [ecx + 6]
jmp 0x1648cae
Function at 0x1641c3f
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.01645daf
mov eax, dword [ebp - 0x104]
lea ecx, [edi*8 - 0x7cfe2c2a]
shld cx, bx, cl
adc ch, 0x89
mov ecx, dword [eax + 0x30]
bt edi, eax
cmp bp, sp
xor edx, edx
bts dx, si
mov dx, word [ecx]
cmc
test bl, 0xc4
cmp edx, 0x4b
push 0x772d59eb
pushal
lea esp, [esp + 0x28]
jne 0x164ab71
aam 0xc2
neg al
bswap ecx
setno al
mov eax, dword [ebp - 0x104]
shld cx, bx, cl
add cl, ch
adc ch, ch
mov ecx, dword [eax + 0x30]
bt di, 0xb
pushfd
xor edx, edx
shl dx, 1
mov dx, word [ecx + 2]
mov byte [esp], ch
cmc
bt bx, 0xb
cmp edx, 0x65
lea esp, [esp + 4]
jle 0x1643767
pushfd
lea esp, [esp + 4]
je 0x16448d1
xadd cl, al
xadd cl, ah
shl ah, cl
mov eax, dword [ebp - 0x104]
rcr cx, cl
ror ch, 1
seta ch
ror cl, cl
mov ecx, dword [eax + 0x30]
stc
cmp cl, 0x9e
cmp sp, 0xf7ce
call fcn.0164aee9
not bl
mov bl, byte [eax + 2]
push ebx
cmp bl, 0x64
mov byte [esp], 0x1e
jmp 0x16471d1
call fcn.01646a18
jmp 0x164af14
btc eax, ebx
adc ax, 0x4387
ror ax, 0xa
bsf ax, bp
mov eax, dword [ebp - 0x104]
adc ch, dl
shr ch, 1
mov ch, 0x60
not cl
mov ecx, dword [eax + 0x30]
cmp sp, 0x511c
cmc
pushfd
jmp 0x164d1f8
ror bl, 7
rcr bl, cl
mov bl, byte [eax + 1]
push 0xe3a66d92
stc
cmp bl, 0x74
pushal
lea esp, [esp + 0x24]
je 0x1642fec
bt bx, cx
cmp bl, 0x54
pushfd
jmp 0x16495fc
lea esp, [esp + 0x20]
je 0x1645832
clc
pushfd
bt ebp, 0x1a
stc
cmp bl, 0x4c
pushfd
lea esp, [esp + 8]
jne 0x1641534
stc
sar bl, cl
xor bl, 0x9c
ror bl, cl
mov bl, byte [eax + 1]
bt sp, 0xf
call fcn.01642fcb
cmc
sub edx, edx
rcr dh, cl
not dh
movsx dx, cl
mov dx, word [ecx + 0xa]
jmp 0x1648296
jmp 0x164d120
push dword [esp]
push eax
lea esp, [esp + 0xc]
jne 0x1641534
bt bx, 0xa
or bl, 0xc6
bt edi, 7
mov bl, byte [eax + 4]
pushal
cmc
stc
cmp bl, 0x6c
jmp 0x1645813
cmp edx, 0x4c
pushal
jmp 0x16488ac
call fcn.01644fb9
mov ecx, dword [eax + 0x30]
push dword [esp]
pushfd
clc
sub edx, edx
bsr dx, bx
adc dh, 0x19
bt dx, dx
mov dx, word [ecx + 2]
cmc
push edx
push dword [esp + 4]
pushal
cmp edx, 0x74
pushfd
lea esp, [esp + 0x3c]
je 0x164d515
shr cl, cl
stc
aad 0xb9
btr ecx, 0xb
mov eax, dword [ebp - 0x100]
bts cx, 6
movzx cx, al
mov ecx, dword [eax + 0x30]
cmp dh, 0xa2
sub edx, edx
sar dh, 6
mov dx, word [ecx + 2]
pushfd
bt di, cx
push 0x63217502
call fcn.01648d10
pushfd
test eax, eax
mov word [esp], di
lea esp, [esp + 4]
je 0x16411ea
call fcn.0164184b
lea esp, [esp + 4]
jne 0x1641534
adc bl, 0x76
shl bl, cl
sub bl, dh
sub bl, 0xa5
mov bl, byte [eax + 2]
push ebx
stc
pushfd
cmp bl, 0x64
push edi
call fcn.0164ce98
push edi
mov word [esp], 0x21c3
lea esp, [esp + 4]
je 0x1646e92
cmp dl, ah
cmp bl, 0x4e
pushal
pushfd
push dword [esp + 4]
pushfd
lea esp, [esp + 0x2c]
jne 0x1641534
jmp 0x164548b
mov byte [esp], dl
lea esp, [esp + 4]
je 0x164d147
cmp ch, bl
bt di, 3
cmp bl, 0x44
push 0xbfdb460d
pushfd
lea esp, [esp + 8]
jne 0x1641534
rol bl, cl
rcl bl, 4
and bl, 0x4b
cmc
mov bl, byte [eax + 3]
push edx
pushal
test ebp, eax
cmp bl, 0x6c
pushal
lea esp, [esp + 0x44]
je 0x1647ad5
stc
pushfd
cmp bl, 0x4c
jmp 0x1647ac7
xor edx, edx
not dl
bswap dx
adc dl, 0xed
mov dx, word [ecx + 4]
call fcn.01646222
Function at 0x16421e4
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x164af4f
push esi
sub edx, edx
xor dh, 0x82
shld dx, bp, cl
xor dl, ch
mov dx, word [ecx]
sub esp, 0xfffffff4
jne 0x164c891
call fcn.016476d8
pushfd
test bh, dl
pushfd
xor edx, edx
sub dx, di
neg dx
call fcn.0164da15
pushal
mov dword [esp + 4], ebp
lea esp, [esp + 0x20]
je 0x1643ba2
cmp cl, dh
rcl ah, 1
sub ch, 0x8d
das
mov eax, dword [ebp - 0x104]
rcl cl, cl
and ch, 0x24
neg ch
rcr ecx, cl
mov ecx, dword [eax + 0x30]
jmp 0x164a50a
clc
cmp edx, 0x6b
pushal
lea esp, [esp + 0x20]
je 0x16411b6
je 0x1643ba2
call fcn.01641c3f

Function at 0x1642332
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x2c]
jne 0x16495c6
clc
dec dx
push 4
neg edx
push 0x3000
and dh, 0xe6
shld dx, dx, cl
bsf dx, cx
bts edx, esp
mov edx, dword [ebp - 0xc]
stc
test ax, cx
cmc
pushfd
shl edx, 1
pushfd
call fcn.0164c748

Function at 0x1642d65
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dword [edx + ecx + 0x10], 0
mov dword [esp + 4], 0x3b359502
mov word [esp], 0x241a
lea esp, [esp + 0xc]
jp 0x164818e
call fcn.0164af40

Function at 0x1642dd1
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
lea esp, [esp + 0x50]
je 0x164560d
lea eax, [eax + 0x713f3d27]
movzx eax, bl
dec al
adc al, al
mov eax, dword [ebp - 0x100]
shl ecx, 0xb
shld cx, bx, 6
bts ecx, esp
mov ecx, dword [eax + 0x30]
cmp dh, dl
xor edx, edx
shrd dx, sp, cl
add dl, ch
mov dx, word [ecx + 0xe]
pushfd
pushal
call fcn.0164b80e

Function at 0x1642fcb
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
cmp bl, 0x74
pushfd
lea esp, [esp + 0x28]
je 0x1642fec
test dx, si
push ebx
cmp bl, 0x54
pushfd
lea esp, [esp + 8]
jne 0x1641534

Function at 0x1643257
Capabilities:
Encode data using base64

Disassembly:
xchg edx, eax
mov eax, dword [ebp - 0x38]
ror dl, cl
imul eax, eax, 0x14
bts edx, esi
movzx dx, al
bsf cx, si
mov ecx, dword [ebp - 0x40]
pushal
btc dx, ax
shld dx, dx, 1
mov edx, dword [ecx + eax + 0xc]
aad 0x96
add cl, 0x3d
add edx, dword [ebp - 0xbc]
rol al, cl
btc cx, si
ror cx, cl
mov dword [ebp - 0x44], edx
not ecx
btc ax, ax
mov eax, dword [ebp - 0x38]
jmp 0x1640fa7

Function at 0x1643ad6
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
pushfd
cmp dword [ebp - 0x114], 0
pushfd
lea esp, [esp + 0xc]
je 0x16428b6
push eax
stc
cmp dword [ebp - 0x118], 0
push dword [esp]
push 0xf5b6b0d3
call fcn.0164135a

Function at 0x1643ca3
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x16472d9
push dword [esp + 4]
lea esp, [esp + 0x30]
jne 0x1648777
cwde
mov eax, dword [ebp - 0x100]
bt cx, 7
bsr cx, ax
cmp bl, al
mov ecx, dword [eax + 0x30]
push edi
sub edx, edx
shl dh, 4
adc dh, 0x55
ror dl, cl
stc
mov dx, word [ecx + 0x10]
mov word [esp], si
bt bp, 0xb
cmp edx, 0x6c
jmp 0x1645cb8