joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426870
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x502f80]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x4268ae
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x4268ae
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x4268b0
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x426970
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x502f80]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x426d00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x502f80]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x431770
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x431790
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x431790
mov eax, dword [eax + 0x44]
test eax, eax
je 0x431790
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x443a20
Capabilities:
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov dword [edi + 4], 0
call fcn.00445b40
push 0x54
push edi
mov dword [esp + 0x14], eax
call fcn.00445b10
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x443a67
push edi
call fcn.00445b50
mov ecx, dword [edi]
push edi
mov dword [ecx + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], esi
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 8
mov dword [esi], fcn.004436b0
mov dword [esi + 4], fcn.00443540
mov dword [esi + 8], fcn.00443610
mov dword [esi + 0xc], fcn.00443490
mov dword [esi + 0x10], 0x443d80
mov dword [esi + 0x14], 0x443d10
mov dword [esi + 0x18], 0x443b70
mov dword [esi + 0x1c], 0x443340
mov dword [esi + 0x20], 0x4431f0
mov dword [esi + 0x24], 0x443920
mov dword [esi + 0x28], 0x443df0
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x443b4a
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], 0x78
push ecx
lea ecx, [esp + 0xc]
push ecx
push str._ld_c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x443b4a
mov al, byte [esp + 0x10]
cmp al, 0x6d
je 0x443b39
cmp al, 0x4d
mov eax, dword [esp + 8]
jne 0x443b41
imul eax, dword [esp + 8], 0x3e8
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ecx
ret
Function at 0x459f67
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x508180], 0
push ebx
push esi
mov esi, 0x508188
jne 0x459f93
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x5081a0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x508180], 1
push dword [0x5081a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x45a030
push 0x14
push 8
push dword [0x5063e0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x45a05a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x508184]
test eax, eax
je 0x459fd5
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x508184], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x45a05f
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x5081a0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x5063e0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x45a05a
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x45a549
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0x5063e0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x5082e0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x5082e4], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.0045d17c
mov dword [esi + 0x58], 0x45b15c
mov eax, esi
mov dword [esi + 0x5c], 0x45b1a8
mov dword [esi + 0x10], fcn.0045acfd
mov dword [esi + 0x30], 0x45abef
mov dword [esi + 0x64], 0x45b232
mov dword [esi + 0x60], 0x45b1ea
mov dword [esi + 0x34], 0x45a89f
mov dword [esi + 0x24], 0x45a876
mov dword [esi + 0x28], 0x45a84b
mov dword [esi + 0x2c], 0x45a79d
mov dword [esi + 0x44], 0x45af62
pop esi
ret 4
Function at 0x460446
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x4604fc
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x4604dc
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x4604b7
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x4604f1
add edi, dword [esp + 0x14]
jmp 0x4604f5
add edi, dword [esp + 0x24]
test edx, edx
jne 0x460495
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x460807
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x4608e1
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x4608b7
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x46087f
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x4608ce
add edi, ecx
jmp 0x4608d2
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x460855
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x460f01
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x460fb6
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x460f97
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x460f72
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x460fac
add edx, dword [esp + 0x14]
jmp 0x460fb0
add edx, dword [esp + 0x24]
test esi, esi
jne 0x460f50
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x5ec822
Capabilities:
Parse pe header

Disassembly:
jmp 0x61d94a
lea esp, [esp + 4]
jmp fcn.0061d6c4

Function at 0x5ec849
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x61d093
lea esp, [esp + 4]
jmp fcn.0061d072

Function at 0x5ef574
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x5ef5ac
jmp 0x5ef590
lea esp, [esp + 4]
jmp 0x5ef557
jmp 0x5ef5c8
jmp 0x5ef5e4
push ebx
jmp 0x5ef600
jmp 0x5ef61c
push ebp
jmp 0x5ef638
jmp 0x5ef654
push esi
jmp 0x5ef670
jmp 0x622214
push edi
movzx edx, byte [eax]
jmp 0x622249
shl edx, 8
movzx esi, byte [eax + 1]
xor edx, esi
movzx esi, byte [eax + 2]
jmp 0x6222a5
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
jmp 0x6223fe
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
jmp 0x6224a7
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x5f8ef4]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x5f8ef4]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
jmp 0x622303
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0x5f8ef4]
xor eax, 0x1000000
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x5f8ef4]
jmp 0x62232b
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
jmp 0x622384
mov dword [ecx + 0x1c], edx
call fcn.0060f0c5
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x5f8ef4]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x5f8ef4]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0x5f8ef4]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x5f8ef4]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x5fa71c
jmp 0x6225c1
jne 0x6224af
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5f0877
Capabilities:
Encode data using base64

Disassembly:
jmp 0x5f0893
lea esp, [esp + 4]
jmp 0x5f0a53
jmp 0x5f08cb
jmp 0x5f08e7
push ebp
jmp 0x5f0903
jmp 0x5f091f
mov ebp, esp
jmp 0x5f093b
jmp 0x5f0957
movzx eax, byte [ecx]
jmp 0x5f0973
jmp 0x5f098f
shl eax, 0x10
jmp 0x5f09ab
jmp 0x5f09c7
cmp dword [ebp + 0xc], 2
or al, 2
jmp 0x5f09ff
jmp 0x62322c
jmp 0x5f0a1b
jb 0x5f09e3
jae 0x5f0a37
push ecx
add dword [ebx + 0x4e2bbb36], esi
mov ebp, 0x53c33d5d
lds esp, ss:[edx]
mov ebp, 0x27c7342d
mov ebp, 0x27c7342d
stosd dword es:[edi], eax
xor esp, dword [ebx + 0x327b7e9]
add byte [eax], bl
jg 0x5f09c9
jmp 0x6231f3
push 0x1b
popfd
or eax, 0xf54ba754
jo 0x5f0a2f
xor dword [eax - 0x67], 0x93f466ec
outsb dx, byte [esi]
mov word [ebx - 0x1a817], fs
invalid
jmp 0x5f08af
movzx edx, byte [ecx + 1]
jmp 0x623222
shl edx, 8
or eax, edx
jmp 0x5f09e3
cmp dword [ebp + 0xc], 3
jmp 0x6233a5
mov ebx, dword [ebp + 0xc]
jmp 0x6232ed
cmp ecx, 0x34
jae 0x623370
lea edx, [ecx + 0x47]
jmp 0x623315
cmp dword [ebp + 0xc], 3
jne 0x62325c
and eax, edx
mov ebx, eax
jmp 0x6232ed
push 0x3e
pop eax
cmp ecx, 0x1a
jae 0x623264
lea edx, [ecx + 0x41]
jmp 0x623315
mov ecx, dword [ebp + 8]
mov byte [ecx], dl
cmp esi, 0x1a
jmp 0x6233eb
mov edi, dword [ebp + 0xc]
jmp 0x6232b5
cmp ecx, eax
jae 0x6233d8
lea edx, [ecx - 4]
jmp 0x623315
jne 0x62361f
movzx ecx, byte [ecx + 2]
or eax, ecx
jmp 0x62361f
cmp esi, 0x34
jae 0x62353a
jb 0x6234f2
div dword [ecx - 0x1f]
xor byte [ebx - 0x61], 0x43
invalid
xor edx, edx
cmp ecx, eax
setne dl
lea edx, [edx*4 + 0x2b]
jmp 0x623315
jae 0x6233b6
lea ecx, [esi + 0x41]
jmp 0x62344c
cmp dword [ebp + 0xc], 2
mov edx, dword [ebp + 8]
jmp 0x623519
xor ecx, ecx
cmp esi, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x62344c
lea ecx, [esi + 0x47]
jmp 0x62344c
mov byte [edx + 2], 0x3d
jmp 0x6236ab
mov byte [edx + 1], cl
jb 0x6234fb
cmp edi, 0x1a
jmp 0x623555
cmp esi, eax
jae 0x623493
lea ecx, [esi - 4]
jmp 0x62344c
jae 0x623574
lea ecx, [edi + 0x41]
jmp 0x6235ba
cmp edi, 0x34
jae 0x6235ea
lea ecx, [edi + 0x47]
jmp 0x6235ba
mov byte [edx + 2], cl
jmp 0x6236ab
cmp edi, eax
jae 0x623658
lea ecx, [edi - 4]
jmp 0x6235ba
push ebx
push esi
push edi
mov ecx, eax
push 0x3f
mov esi, eax
shr ecx, 0x12
pop edx
shr esi, 0xc
and ecx, edx
and esi, edx
cmp dword [ebp + 0xc], 2
jb 0x623356
mov edi, eax
shr edi, 6
and edi, edx
jmp 0x6232b5
xor ecx, ecx
cmp edi, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x6235ba
cmp dword [ebp + 0xc], 3
jne 0x6236f3
cmp ebx, 0x1a
jmp 0x62377d
cmp ebx, 0x34
jae 0x623b76
jb 0x623b2b
push cs
sahf
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
add eax, eax
push edi
invalid
mov byte [edx + 3], 0x3d
jmp 0x623790
mov byte [edx + 3], cl
jmp 0x623790
jae 0x6236cf
lea ecx, [ebx + 0x41]
jmp 0x62372b
pop edi
pop esi
pop ebx
pop ebp
ret
xor ecx, ecx
cmp ebx, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x62372b
lea ecx, [ebx + 0x47]
jmp 0x62372b
cmp ebx, eax
jae 0x623854
lea ecx, [ebx - 4]
jmp 0x62372b
Function at 0x5f2945
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x5f2961
lea esp, [esp + 4]
jmp fcn.0062316b

Function at 0x60b0d4
Capabilities:
Encode data using xor

Disassembly:
inc dword [ebp - 0x2fa49767]
and byte [eax], al
push 0x20d05b
call fcn.00602d77
cmp al, 0xa2
xor byte [edi - 0x5e], dl
or ebp, ebx
je 0x60b0b5
lea edi, [ebx + ecx*8 + 0x29]
sahf
cmp byte [ecx - 0x54972aa5], 0xcc
and byte [eax], al
call fcn.00602d77
cmpsb byte [esi], byte es:[edi]
cmp ch, byte [eax - 0x296cc531]
dec ecx
fnstcw word [eax - 0x268601b5]
dec ecx
sub bl, bl
pop esi
xchg esp, eax
invalid

Function at 0x61050f
Capabilities:
Enumerate pe sections

Disassembly:
call fcn.005ec822
jmp 0x5ec844

Function at 0x611436
Capabilities:
Encode data using base64

Disassembly:
call 0x5f0699
jmp 0x5f0872
Function at 0x624855
Capabilities:
Resolve function by parsing pe exports

Disassembly:
loope 0x624854
stc
mov eax, dword [edi]
xchg edi, eax
add ebp, ebp
dec ebp
invalid
in al, dx
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 8]
jmp 0x624895
mov eax, dword [ecx + 0x3c]
and dword [ebp - 0xc], 0
add eax, ecx
mov edx, 0x10b
cmp word [eax + 0x18], dx
je 0x62517a
jne 0x624f9f
cmp eax, 0xb14227b7
push esi
jecxz 0x62492a
cld
wait
jbe 0x624842
inc esi
aam 0x4a
sub eax, 0x20b34dc
pop esi
jmp 0x624c95
cmp dword [ebp - 4], ebx
je 0x624a83
push ebp
add dword [eax], eax
add byte [edi], cl
test dword [esi + 0x39000001], esp
mov bl, 0x23
inc esi
mov ch, 0x5b
jne 0x624ada
cmp dword [ebx + 0x5bb54623], esi
mov eax, 0x35c6a333
xchg esp, eax
popal
stc
imul ecx, dword [eax], 0x4ae08fb
xor esi, esi
test ebx, ebx
jmp 0x6249f6
and dword [ebp - 4], 0
add eax, ecx
push ebx
mov ebx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x1c]
add edi, ecx
add eax, ecx
dec ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
js 0x624948
mov eax, dword [ebp - 4]
add eax, ebx
cdq
sub eax, edx
mov edi, eax
mov eax, dword [ebp - 0x10]
sar edi, 1
mov edx, dword [eax + edi*4]
add edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
call fcn.006114ab
test eax, eax
jne 0x624925
mov eax, dword [ebp - 8]
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + eax*4]
add eax, dword [ebp + 8]
jmp 0x624b06
xor eax, eax
jmp 0x624902
test eax, eax
jne 0x624b25
jmp 0x624a83
jl 0x624b25
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + esi*4]
add edx, dword [ebp + 8]
jmp 0x624b9d
pop edi
pop ebx
jmp 0x624902
test eax, eax
jne 0x624a1e
jmp 0x624aa3
mov edi, dword [ebp - 8]
jmp 0x624948
cmp dword [ebp - 4], ebx
jle 0x624988
jmp 0x624a83
test eax, eax
jle 0x624b42
lea ebx, [edi - 1]
jmp 0x624aa3
mov dword [ebp - 0xc], eax
cmp eax, esi
jb 0x624a4d
mov ecx, dword [ebp - 0x18]
add ecx, esi
cmp eax, ecx
jb 0x6249e8
jmp 0x624a4d
mov eax, dword [ebp - 0xc]
jmp 0x624a1e
inc edi
mov dword [ebp - 4], edi
jmp 0x624aa3
movzx eax, word [edi + esi*2]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + eax*4]
jmp 0x624bb8
mov eax, dword [ebp + 0xc]
call fcn.0061148e
test eax, eax
je 0x624b79
inc esi
cmp esi, ebx
jle 0x6249fc
jmp 0x624b25
add eax, dword [ebp + 8]
jmp 0x624c1b
mov dword [ebp - 0xc], eax
jmp 0x624b25
leave
ret 8
xor eax, eax
jmp 0x624c95
push esi
mov esi, dword [eax + 0x78]
add esi, ecx
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x18], eax
je 0x6249d8
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x624967
jmp 0x6249d8
Function at 0x680f90
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push es
inc eax
out 0x27, al
add al, ch
sbb esp, eax
invalid
call 0x67f02e
pop eax
sub eax, 0x67f02e
cmp dword [eax + 0x5e8d11], 0
je 0x67f3f9
lea esp, [esp + 8]
popal
jmp 0x67ef8f
inc dword [eax + 0x5e8d11]
push 0xa269b518
add dword [esp], 0x5df438ed
push 0
push 0
push 0xbaf7a6af
add dword [esp], 0x45660bff
call fcn.005f62ae
jmp 0x680ec4
call 0x67f42a
jmp 0x680f47
push eax
jmp 0x67f029
call 0x680ec9
jmp 0x680f08
add dword [esp], 0xca3
jmp 0x680fbe
mov eax, dword [eax + 8]
push eax
jmp 0x67f425
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x681008
call 0x680f90
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x63694c20
outsb dx, byte gs:[esi]
jae 0x680fef
jb 0x680fa2
inc esp
insd dword es:[edi], dx
outsd dx, dword [esi]
and byte [esi + 0x31], dh
cmp byte cs:[esi], ch
xor byte [esi], ch
xor byte [eax], al
lea esp, [esp + 4]
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x680f3c
call fcn.005f4064
call fcn.005f567f
popal
jmp 0x67ef8f
movzx ebx, word [eax + 0x3c]
add ebx, eax
cmp word [ebx], 0x4550
jmp 0x68101c
sub al, 0x9b
adc byte [esi - 0x2048ef1f], al
push ebp
lds ebp, [edi + ebx*2 + 0xe981196]
imul ebx, dword [eax - 0x7cda748a], 0x7478b41a
fld dword [ecx + 0x10000e8]
add cl, ch
invalid
je 0x680fe3
sub eax, 0x10000
jmp 0x680f4b
je 0x67f8b8
jmp 0x68100a
Function at 0x401111
Capabilities:
Read file via mapping

Disassembly:
push esi
push edi
push dword [esp + 0xc]
xor edi, edi
push edi
push 2
mov esi, ecx
call dword [0x440198]
cmp eax, edi
mov dword [esi], eax
jne 0x401141
push dword [esp + 0xc]
push 0x2000
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [0x44019c]
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, edi
jne 0x40114b
xor al, al
jmp 0x40116a
push edi
push edi
push edi
push 6
push eax
call dword [0x4401a0]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x401168
push dword [esi]
call dword [0x4401a4]
jmp 0x401147
mov al, 1
pop edi
pop esi
ret 4

Function at 0x41f0fe
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [esi]
add esi, edi
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, ecx
mov edx, dword [edx*4 + 0x101315e8]
xor edx, dword [ebx*4 + 0x101319e8]
mov ebx, eax
and eax, ecx
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x101311e8]
xor edx, dword [eax*4 + 0x10131de8]
xor edx, dword [esi]
add esi, edi
mov eax, edx
shr eax, 0x10
and eax, ecx
mov eax, dword [eax*4 + 0x101315e8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x101319e8]
mov ebx, edx
and edx, ecx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x101311e8]
xor eax, dword [edx*4 + 0x10131de8]
xor eax, dword [esi]
add esi, edi
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, ecx
mov edx, dword [edx*4 + 0x101315e8]
xor edx, dword [ebx*4 + 0x101319e8]
mov ebx, eax
and eax, ecx
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x101311e8]
xor edx, dword [eax*4 + 0x10131de8]
xor edx, dword [esi]
add esi, edi
mov eax, edx
shr eax, 0x10
and eax, ecx
mov eax, dword [eax*4 + 0x101315e8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x101319e8]
and edx, ecx
xor eax, dword [edx*4 + 0x10131de8]
dec dword [ebp - 4]
jne 0x41ef7b
cmp dword [ebp + 8], edi
jb 0x41f159
mov edx, dword [ebp + 8]
shr edx, 2
mov dword [ebp - 4], edx
xor eax, dword [esi]
sub dword [ebp + 8], edi
mov edx, eax
shr edx, 0x10
and edx, ecx
mov edx, dword [edx*4 + 0x101315e8]
movzx ebx, ah
xor edx, dword [ebx*4 + 0x101319e8]
mov ebx, eax
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x101311e8]
and eax, ecx
xor edx, dword [eax*4 + 0x10131de8]
add esi, edi
dec dword [ebp - 4]
mov eax, edx
jne 0x41f11e
invalid
cmp dword [ebp + 8], 0
je 0x41f176
movzx edx, byte [esi]
xor edx, eax
and edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101311e8]
inc esi
dec dword [ebp + 8]
jne 0x41f15f
pop edi
pop esi
not eax
pop ebx
leave
ret

Function at 0x41f31c
Capabilities:
Hash data with md5

Disassembly:
push esi
xor ecx, ecx
push 0x40
lea esi, [eax + 0x58]
push ecx
push esi
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
call 0x493baa
add esp, 0xc
mov byte [esi], 0x80
pop esi
ret