joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a110
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x520628]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x434], 0
push 0x104
lea eax, [ebp - 0x418]
push eax
push str.WINDIR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp + 0xc], 1
jb 0x48a163
cmp dword [ebp + 0xc], 0x1000
jbe 0x48a175
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x48a352
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x434]
push ecx
call fcn.00489e40
test eax, eax
jne 0x48a19b
jmp 0x48a352
cmp dword [ebp - 0x41c], 0
je 0x48a1b0
cmp dword [ebp - 0x41c], 0x104
jb 0x48a1ba
jmp 0x48a352
push str._sysnative_rundll32.exe
push 0x104
lea edx, [ebp - 0x418]
push edx
call fcn.0048a380
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
jge 0x48a1e9
jmp 0x48a352
mov eax, dword [ebp - 0x434]
add eax, 0xc
push eax
push str.rundll32.exe___hs__1
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.0048a3e0
add esp, 0x10
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
jge 0x48a225
jmp 0x48a352
push 0x10
push 0
lea edx, [ebp - 0x430]
push edx
call fcn.00473d40
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x480]
push eax
call fcn.00473d40
add esp, 0xc
mov dword [ebp - 0x480], 0x44
lea ecx, [ebp - 0x430]
push ecx
lea edx, [ebp - 0x480]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x418]
push ecx
call dword [ebp + 0x14]
test eax, eax
je 0x48a352
mov edx, dword [ebp - 0x434]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
push 0x4ed6a4
mov edx, dword [ebp - 0x430]
push edx
call fcn.00489a80
test eax, eax
jne 0x48a2da
push 0xffffffffffffffff
mov eax, dword [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48a352
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x42c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x430]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x484], 0x1f4
lea eax, [ebp - 0x484]
push eax
mov ecx, dword [ebp - 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0x430]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x484], 0
je 0x48a348
jmp 0x48a352
mov dword [ebp - 0x420], 1
lea ecx, [ebp - 0x434]
push ecx
call fcn.0048a0c0
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e186
mov esp, ebp
pop ebp
ret 0x10

Function at 0x490f10
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00490c80
Function at 0x534bfe
Capabilities:
Authenticate hmac
Check for time delay via gettickcount
Check http status code
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Write file on windows

Disassembly:
call fcn.00474d50
mov eax, dword [0x520628]
xor dword [ebp - 8], eax
test si, cx
xor eax, ebp
mov dword [ebp - 0x1c], eax
jmp loc.0043a7db
push ebp
btc ax, ax
btc eax, 0xd2
mov ebp, esp
shrd ax, si, 0x1c
and ax, ax
push 0xfffffffffffffffe
bt eax, 0xcf
bts ax, bx
push 0x5c3794
and al, 0xc2
shl ah, 0x25
movsx eax, si
push 0x4740a0
cmc
sar ah, 0x78
mov eax, dword fs:[0]
stc
test ch, 0x42
push eax
clc
btr eax, 0xc
sub esp, 8
mov eax, 0x1e50
jmp 0x534bfe

Function at 0x536adc
Capabilities:
Link function at runtime on windows
Link many functions at runtime
Parse pe header

Disassembly:
push ebp
btc ebp, 0xfc
xor ax, si
cbw
mov ebp, esp
btr eax, 0x51
sub esp, 0x16c
mov eax, dword [0x520628]
stc
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ax, sp
cwde
movzx eax, cx
push esi
cwde
push edi
cbw
movsx eax, di
cwde
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp loc.0041a4ef

Function at 0x5413f6
Capabilities:
Execute anti-debugging instructions
Get graphical window text
Read .ini file
Resolve function by parsing pe exports

Disassembly:
push 0xff9f5ee0
call fcn.00617abf
call fcn.00446d10
push 0x30000
jmp 0x661ca6
push esi
jmp 0x6e0427
push ecx
mov eax, 0x9713064
lahf
lea edx, [esp + 0xc10]
movzx ecx, cx
push edx
mov ch, ah
bswap ax
lea eax, [esp + 0xb14]
movsx cx, dl
cwd
cdq
push eax
movsx cx, al
lea ecx, [esp + 0x950]
cmovo edx, ebp
push ecx
push 0x17
setle dh
cwd
bswap dx
lea edx, [esp + 0x2e0]
jmp 0x64ae09
jbe 0x56a23a
mov ecx, dword [esp + 0x14]
jmp 0x58a89c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
jmp 0x6d6559
push 0x4d
jmp 0x647671
push edi
push esi
call fcn.005e3467
lea esp, [esp + 0x18]
cmp cx, si
stc
cmp eax, ebx
jmp 0x5df822
call fcn.005f7fa2
add esp, 0x1c
jmp 0x56a23a
jmp 0x5ef0aa
Function at 0x544e83
Capabilities:
Execute anti-debugging instructions
Query or enumerate registry value

Disassembly:
push ebp
and al, ch
not ax
ror cl, 0x2a
mov ebp, esp
not cx
and al, cl
rcl cx, 0x35
lea esp, [esp - 0x4ac]
neg ah
test bp, di
mov eax, dword [0x520628]
bt cx, 0xe9
xor eax, ebp
bt ecx, 0xa
mov dword [ebp - 4], eax
shld ecx, esi, 0xff
shl cl, 0xc0
or cx, 0x16f1
sub eax, eax
push 0x3fe
not cx
mov ecx, 0x7cc6893
setae ch
push eax
not cx
mov cl, bh
lea ecx, [ebp - 0x49e]
jmp 0x59ba86
push ecx
mov word [ebp - 0x4a0], ax
call fcn.00473d40
mov edx, 0x5c
bt ax, dx
mov word [ebp - 0xa0], dx
mov eax, 0x53
bts ecx, ebx
sbb dx, 0x3d72
mov word [ebp - 0x9e], ax
sub ch, 0x9b
mov ecx, 0x4f
lahf
shl ax, 0xcf
cbw
mov word [ebp - 0x9c], cx
mov edx, 0x46
or eax, esp
xor ch, al
cmc
mov word [ebp - 0x9a], dx
cmp edi, eax
sbb dl, 0x89
mov eax, 0x54
ror cx, cl
mov word [ebp - 0x98], ax
add ch, al
ror dx, cl
mov ecx, 0x57
test bl, dh
and al, 0x6f
bsf ax, ax
mov word [ebp - 0x96], cx
xchg dx, dx
cmove eax, esi
bt dx, dx
mov edx, 0x41
xor cx, 0x7132
btr ecx, 0x23
mov word [ebp - 0x94], dx
rcl ch, cl
rcr cx, cl
mov eax, 0x52
adc edx, ecx
mov word [ebp - 0x92], ax
ror ax, cl
mov ecx, 0x45
adc al, 0xd8
mov word [ebp - 0x90], cx
and dx, bp
and cl, 0xe2
mov edx, 0x5c
movsx ecx, ax
lahf
mov word [ebp - 0x8e], dx
cbw
sub edx, edx
mov eax, 0x4d
mov word [ebp - 0x8c], ax
mov cx, sp
mov ecx, 0x69
mov eax, ebp
or dx, bx
shrd dx, ax, 9
mov word [ebp - 0x8a], cx
rol ch, cl
cmovns ax, dx
cwd
mov edx, 0x63
jmp 0x664287
mov word [ebp - 0x88], dx
jmp 0x6cd264
mov eax, 0x72
sal dh, cl
mov word [ebp - 0x86], ax
or ah, 3
mov ecx, 0x6f
cmc
mov eax, ecx
mov word [ebp - 0x84], cx
mov edx, 0x73
ror cx, cl
mov word [ebp - 0x82], dx
mov word [ebp - 0x80], ax
sal ax, cl
setno ch
mov ecx, 0x66
mov word [ebp - 0x7e], cx
dec eax
btr ax, 0x77
mov edx, 0x74
mov word [ebp - 0x7c], dx
add dh, dl
mov eax, 0x5c
mov word [ebp - 0x7a], ax
setge ah
sar dx, 0x52
mov ecx, 0x57
btc edx, 0x43
mov ax, sp
bts eax, esp
mov word [ebp - 0x78], cx
test ax, 0x338e
jmp loc.0041ae82
Function at 0x54d827
Capabilities:
Execute anti-debugging instructions
Get graphical window text
Read .ini file
Resolve function by parsing pe exports

Disassembly:
lea eax, [esp + 0x944]
inc cl
sete dh
xchg dl, cl
lea edx, [eax + 1]
dec cl
setno cl
inc cl
lea esp, [esp]
mov cl, byte [eax]
jmp loc.00574785
lea edx, [esp + 0x6d8]
not al
cbw
push edx
lea eax, [esp + 0xb14]
jmp 0x6cb740
push 0xff9f5ee0
call fcn.00617abf
push 0xff969a60
call fcn.00617abf
inc eax
clc
jmp 0x638201
inc eax
cmp cl, bl
jmp 0x639ecf
push eax
call fcn.0046ea50
add esp, 8
stc
jmp 0x5f3da7
je 0x403371
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0xb10]
jmp 0x5e311d
call fcn.005f7fa2
add esp, 0x1c
jmp loc.00430dd3
lea ecx, [esp + 0xb14]
not eax
cwde
push ecx
movzx eax, sp
setbe al
lea edx, [esp + 0x950]
mov ah, 0x4a
bswap ax
push edx
push ebx
cmovbe ax, dx
mov al, 0x34
lea eax, [esp + 0x2e0]
push 0x4d
jmp 0x692d13
lea eax, [esp + 0x944]
dec dx
lea edx, [eax + 1]
not cl
mov cl, byte [eax]
jmp 0x5597ab
jne 0x6e10bf
sub eax, edx
je 0x5ac7f8
lea ecx, [esp + 0x63c]
push ecx
jmp 0x64ce11
mov ecx, dword [esp + 0x14]
push ecx
jmp 0x53b328
je 0x5bb38f
push 0x104
cwde
cbw
xchg ah, ah
lea eax, [esp + 0x6d8]
jmp loc.0042eca3
push ecx
jmp 0x69f885
test eax, eax
je 0x403371
mov edi, dword [esp + 0x14]
call fcn.00562c39
mov esi, eax
cmp esi, ebx
jmp 0x684514
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
cmovnp cx, sp
push edx
lea eax, [esp + 0x6d8]
push eax
not dh
jmp 0x59a301
cmp cl, bl
jmp 0x5b804b
jne 0x5ac807
sub eax, edx
jmp 0x577131
lea edx, [esp + 0xb10]
push edx
call fcn.00471869
lea esp, [esp + 8]
test bl, 0x70
test eax, eax
jne 0x5ac7f8
mov edi, dword [esp + 0x14]
jmp 0x6723ff
call fcn.00562c39
mov esi, eax
cmc
stc
cmp esi, ebx
jmp 0x5e0bb2
je 0x6375dc
push 0x104
mov cx, 0x5f4f
bswap ecx
lea ecx, [esp + 0x6d8]
jmp 0x69e147
push esi
jmp 0x6bb191
push eax
jmp 0x58c23f
push ecx
push ebx
jmp 0x6888d8
call fcn.00471869
add esp, 8
test eax, eax
jmp 0x6e8c8a
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
jmp 0x6375d6
push eax
lea ecx, [esp + 0x950]
mov edx, esp
push ecx
jmp loc.00416f66
mov cl, byte [eax]
jmp 0x54d83b
jne 0x403371
lea edx, [esp + 0x40c]
push edx
movzx ax, bh
lea eax, [esp + 0x948]
jmp 0x5615b4
Function at 0x59c225
Capabilities:
Authenticate hmac

Disassembly:
mov byte [ebp - 0x1f], 0x6c
jmp 0x6f4873
mov byte [ebp - 0x1a], 0x6c
jmp 0x6e336d
mov byte [ebp - 0x1c], 0x2e
jmp 0x5d885e
mov byte [ebp - 0x20], 0x65
jmp 0x53f6a8
mov byte [ebp - 0x29], 0x6f
jmp loc.0044a1c5
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x74
jmp 0x5983f9
push ebp
movsx ebp, bp
not ah
mov ebp, esp
shr al, cl
push 0xffffffffffffffff
sar ah, cl
rcr ax, 9
push 0x4e4288
and ax, 0x16ef
mov eax, dword fs:[0]
cmc
stc
push eax
jmp 0x653cb6
mov byte [ebp - 0x31], 0x65
jmp 0x6aa4f2
mov byte [ebp - 0x38], 0x47
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x74
jmp 0x647198
mov byte [ebp - 0x1b], 0x64
jmp 0x53fe45
mov byte [ebp - 0x32], 0x74
jmp 0x59efa0
mov byte [ebp - 0x2f], 0x44
jmp 0x6d5f20
mov byte [ebp - 0x24], 0x6b
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x72
jmp 0x6a5a15
mov byte [ebp - 0x1d], 0x32
jmp 0x5574a1
mov byte [ebp - 0x2c], 0x65
jmp 0x59c1fd
mov byte [ebp - 0x35], 0x53
jmp 0x693171
sub esp, 0x8e0
rcl ah, 0x26
bswap eax
cmp bx, 0x2fb1
mov eax, dword [0x520628]
xor eax, ebp
cmp ecx, 0xf095fc8
clc
cmp edx, ebp
mov dword [ebp - 0x14], eax
cmp di, bx
push ebx
movsx ebx, bp
shrd ebx, edi, 0xfa
shr bl, cl
push esi
push edi
not bx
movsx ebx, bp
movzx ebx, bx
push eax
setno bl
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cwde
cmp bp, bx
mov eax, dword [ebp + 8]
sub ebx, ebp
mov dword [ebp - 0x888], eax
rcl al, cl
adc ah, 0x13
lea eax, [ebp - 0x38]
mov dword [ebp - 0x898], ecx
shl cx, 0x5c
ror cl, 0xda
push eax
bsf ecx, ecx
rcl cl, 0x58
lea ecx, [ebp - 0x24]
xor esi, esi
movsx ebx, cx
cmovne ebx, esp
mov bh, bl
mov ebx, 0x69
jmp 0x682b36
mov dword [ebp - 0x890], edx
mov dword [ebp - 0x874], esi
jmp 0x61a231
push ecx
jmp 0x660528
mov byte [ebp - 0x34], 0x79
jmp 0x6b3738
mov byte [ebp - 0x18], 0
jmp 0x5accec
mov byte [ebp - 0x21], 0x6e
jmp 0x5821d9
mov byte [ebp - 0x30], 0x6d
jmp 0x5f0242
mov byte [ebp - 0x33], 0x73
jmp 0x5d8a23
mov byte [ebp - 0x2e], bl
mov byte [ebp - 0x2d], 0x72
jmp 0x63dbc8
mov byte [ebp - 0x19], 0x6c
jmp 0x6937a4
mov byte [ebp - 0x1e], 0x33
jmp 0x61d24e

Function at 0x61570d
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Get common file path
Move file
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov bp, 0x52e
jmp 0x677c10
push esi
push edi
push eax
shld ax, sp, 0xe3
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x52bfc0]
test dh, 0xe6
xor ebx, ebx
jmp loc.00419b1c
push eax
lahf
cwde
mov eax, 0x1054
call fcn.00474d50
mov eax, dword [0x520628]
xor eax, ebp
mov dword [ebp - 0x10], eax
jmp 0x6c96e0
mov ebp, esp
push 0xffffffffffffffff
movzx eax, si
movsx eax, sp
push 0x4e5b32
xchg al, al
mov eax, dword fs:[0]
jmp 0x61570d
push ebx
jmp 0x5be600
Function at 0x61e535
Capabilities:
Set environment variable

Disassembly:
mov byte [ebp - 0x1e], 0x43
mov byte [ebp - 0x1d], 0x4f
jmp 0x6544ca
mov byte [ebp - 0x1b], 0x50
jmp 0x6d1fa5
mov byte [ebp - 0x16], cl
jmp loc.00431727
mov byte [ebp - 0x19], 0x54
jmp 0x608bcd
mov byte [ebp - 0x17], 0x4c
jmp 0x5758be
push ebp
mov ebp, esp
xor ax, si
cbw
push 0xffffffffffffffff
push 0x4e54f8
xor al, 0xc6
movzx eax, sp
mov eax, dword fs:[0]
rcl cl, 0x8d
push eax
mov cl, 0x1b
bsr eax, esp
lea esp, [esp - 0x30]
mov eax, dword [0x520628]
cmp bx, 0x359d
rol cl, cl
xor eax, ebp
mov cl, al
mov cl, 0xca
not cl
mov dword [ebp - 0x10], eax
setno cl
push esi
push eax
bswap ax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov al, 0x5f
not esi
mov byte [ebp - 0x20], al
setg cl
mov byte [ebp - 0x1f], al
xchg si, si
mov byte [ebp - 0x18], al
mov cl, 0x41
setnp al
xchg esi, eax
lea eax, [ebp - 0x20]
cmova esi, edi
push eax
bswap si
lea esi, [ebp - 0x3c]
jmp 0x55d9fc
mov byte [ebp - 0x1c], 0x4d
jmp 0x56ddba
mov byte [ebp - 0x1a], cl
jmp 0x595eec

Function at 0x621389
Capabilities:
Query environment variable

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
cmp ebx, edi
jmp 0x5b0cd9
push eax
lea eax, [ebp - 0xc]
clc
mov dword fs:[0], eax
test ebp, ecx
sal eax, cl
mov eax, dword [ebp + 8]
test bl, 0xf0
cmp ebp, esp
xor edi, edi
push edi
jmp 0x5ec51f
push edx
call fcn.004509e1
add esp, 4
sub ebx, esp
shl bl, cl
call fcn.004509e1
add esp, 4
push 0xffffffffffffffff
push ebx
mov ecx, ebx
lea ecx, [ebp - 0x2c]
push ecx
mov dword [esi + 0x18], 0xf
mov ecx, ecx
movsx ecx, sp
mov dword [esi + 0x14], ebx
mov ecx, esi
mov byte [esi + 4], 0
jmp 0x5c834e
call fcn.004509ec
add esp, 4
not di
mov edi, eax
cbw
mov eax, dword [ebp - 0x30]
jmp 0x6e28fc
mov dword [ebp - 4], ebx
jmp 0x589c5d
jne 0x5ec5e4
push edi
bswap cx
mov ch, 0x9f
xchg ch, ch
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], edi
movzx cx, bl
push 0x50f493
xchg ch, ch
mov ecx, esi
mov byte [esi + 4], 0
jmp loc.0041e88c
call fcn.00404c50
cmp dword [ebp - 0x14], 0x10
jmp 0x5ff5c7
push edi
jmp 0x6aba5a
push edi
jmp 0x6c7df0
push ebx
jmp 0x5a1662
call fcn.00404e60
push edi
jmp 0x5abb29
mov dword [ebp - 0x34], edi
jmp 0x533b9b
jb fcn.0057e409
mov edx, dword [ebp - 0x28]
jmp 0x57e3fc
mov cl, byte [eax]
jmp 0x6dfd7f
jne 0x61ae3a
sub eax, edx
cmovno ecx, ebx
xchg cx, cx
push eax
push edi
setne ch
lea ecx, [ebp - 0x2c]
jmp 0x5fa71d
push ebp
dec ax
mov ebp, esp
push 0xffffffffffffffff
setno al
sub eax, edi
push 0x4e53e8
mov eax, dword fs:[0]
cmc
cmp si, 0x5715
push eax
cwde
shl al, cl
bt eax, ebx
sub esp, 0x28
cbw
mov eax, dword [0x520628]
xor eax, ebp
cmp esi, 0x361811fd
test ch, cl
mov dword [ebp - 0x10], eax
cmp dl, 0xa9
clc
cmp ebx, esp
push ebx
stc
test sp, si
push edi
jmp 0x56ddf2
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ebx, ebx
mov eax, ebp
cbw
mov eax, edi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
inc edx
dec dh
mov byte [ebp - 0x28], bl
movzx edx, ax
lea edx, [eax + 1]
setnp cl
lea esp, [esp]
jmp 0x61ae3a
push eax
jmp 0x6a5cbf
push eax
mov dword [ebp - 0x30], eax
jmp 0x5ff1ca
inc eax
test cl, 0xe7
test cl, cl
jmp 0x61df99
push ebx
jmp 0x5d7e29
Function at 0x638235
Capabilities:
Hash data with crc32

Disassembly:
push 0xff9f5ee0
call fcn.00617abf
push ebx
jmp loc.0041c8f0

Function at 0x6501fc
Capabilities:
Send data
Send data on socket

Disassembly:
lea eax, [esi + edx]
jmp 0x67a190
je 0x6e77c6
cmp dword [edi], 0xffffffff
jmp 0x65bc59
call fcn.006d573e
add esp, 4
cmp sp, sp
clc
cmp ah, 0x55
sub esi, esi
cmc
test ebx, ebx
jle 0x6e77c5
jmp 0x6a6bd5
push ebp
mov bp, 0x90b
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [0x52a8cc]
test edx, ebx
test eax, 0x76456d76
test edi, edi
jmp 0x5762a7
je 0x6e77c6
cmp byte [edi + 0x1400c], 0
je 0x6e77c6
push esi
mov esi, dword [ebp + 8]
btr ax, 0x2b
movsx eax, bp
lea eax, [ebx - 2]
cmp si, bx
cmc
test edx, 0x392664ff
push eax
cmp ebp, ebp
clc
add esi, 2
jmp 0x63528e
push eax
jmp loc.0044011a
mov edx, dword [ebp + 8]
push 0
xadd ah, cl
add eax, 0x1770311f
mov ecx, ebx
ror ax, 0x85
neg al
sub ecx, esi
not ah
cwde
push ecx
mov ecx, dword [edi]
jmp 0x536910
pop esi
pop edi
pop ebx
mov ebp, edx
pop ebp
jmp loc.00403c68

Function at 0x653cb6
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x1f], 0x6c
jmp 0x6f4873
mov byte [ebp - 0x1a], 0x6c
jmp 0x6e336d
mov byte [ebp - 0x1c], 0x2e
jmp 0x5d885e
mov byte [ebp - 0x20], 0x65
jmp 0x53f6a8
mov byte [ebp - 0x29], 0x6f
jmp loc.0044a1c5
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x74
jmp 0x5983f9
push ebp
movsx ebp, bp
not ah
mov ebp, esp
shr al, cl
push 0xffffffffffffffff
sar ah, cl
rcr ax, 9
push 0x4e4288
and ax, 0x16ef
mov eax, dword fs:[0]
cmc
stc
push eax
jmp 0x653cb6
mov byte [ebp - 0x31], 0x65
jmp 0x6aa4f2
mov byte [ebp - 0x38], 0x47
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x74
jmp 0x647198
mov byte [ebp - 0x1b], 0x64
jmp 0x53fe45
mov byte [ebp - 0x32], 0x74
jmp 0x59efa0
mov byte [ebp - 0x2f], 0x44
jmp 0x6d5f20
mov byte [ebp - 0x24], 0x6b
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x72
jmp 0x6a5a15
mov byte [ebp - 0x1d], 0x32
jmp 0x5574a1
mov byte [ebp - 0x2c], 0x65
jmp 0x59c1fd
mov byte [ebp - 0x35], 0x53
jmp 0x693171
sub esp, 0x8e0
rcl ah, 0x26
bswap eax
cmp bx, 0x2fb1
mov eax, dword [0x520628]
xor eax, ebp
cmp ecx, 0xf095fc8
clc
cmp edx, ebp
mov dword [ebp - 0x14], eax
cmp di, bx
push ebx
movsx ebx, bp
shrd ebx, edi, 0xfa
shr bl, cl
push esi
push edi
not bx
movsx ebx, bp
movzx ebx, bx
push eax
setno bl
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cwde
cmp bp, bx
mov eax, dword [ebp + 8]
sub ebx, ebp
mov dword [ebp - 0x888], eax
rcl al, cl
adc ah, 0x13
lea eax, [ebp - 0x38]
mov dword [ebp - 0x898], ecx
shl cx, 0x5c
ror cl, 0xda
push eax
bsf ecx, ecx
rcl cl, 0x58
lea ecx, [ebp - 0x24]
xor esi, esi
movsx ebx, cx
cmovne ebx, esp
mov bh, bl
mov ebx, 0x69
jmp 0x682b36
mov dword [ebp - 0x890], edx
mov dword [ebp - 0x874], esi
jmp 0x61a231
push ecx
jmp 0x660528
mov byte [ebp - 0x34], 0x79
jmp 0x6b3738
mov byte [ebp - 0x18], 0
jmp 0x5accec
mov byte [ebp - 0x21], 0x6e
jmp 0x5821d9
mov byte [ebp - 0x30], 0x6d
jmp 0x5f0242
mov byte [ebp - 0x33], 0x73
jmp 0x5d8a23
mov byte [ebp - 0x2e], bl
mov byte [ebp - 0x2d], 0x72
jmp 0x63dbc8
mov byte [ebp - 0x19], 0x6c
jmp 0x6937a4
mov byte [ebp - 0x1e], 0x33
jmp 0x61d24e
Function at 0x65a0e5
Capabilities:
Execute anti-debugging instructions
Reference processor manufacturer constants

Disassembly:
je 0x653d40
xor eax, eax
mov dword [ebp - 0x2c], eax
test cl, 0xf
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
adc ax, sp
mov eax, 0x40000000
btr ecx, 0x2e
movzx bx, ah
cpuid
test esp, ecx
mov dword [esi], eax
mov dword [esi + 4], ebx
test sp, 0x3b09
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmc
cmp dword [ebp - 0x2c], 0x7263694d
jmp 0x5cf3a2
mov byte [ebp - 0x30], 0x6b
jmp 0x6e14fa
push ecx
jmp 0x558563
jne 0x5bb399
mov eax, 0x40000003
shr bx, 0x89
cpuid
jmp 0x676db3
mov al, 1
btr si, di
pop edi
sar bl, cl
shrd cx, si, 0xf2
or ecx, 0x7592516c
pop esi
shrd ebx, ecx, 0xd3
pop ebx
btc cx, sp
mov ecx, dword [ebp - 4]
xor ecx, ebp
jmp loc.0041d6b8
jne 0x5bb399
cmp dword [ebp - 0x28], 0x666f736f
jmp 0x605656
je 0x5bb399
sub al, al
rcr esi, 0x6a
shr cx, 0x5d
pop edi
pop esi
ror ebx, 0xf1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
jmp loc.00403094
jne 0x5bb399
cmp dword [ebp - 0x24], 0x76482074
jmp 0x5afb8f
mov dword [esi + 8], ecx
test ecx, 0x281777ee
cmp bx, 0x3554
cmc
mov dword [esi + 0xc], edx
cmc
test byte [ebp - 0x2c], 1
jmp 0x5d08fb
lea ecx, [ebp - 0x30]
mov bh, cl
mov ebx, 0x65
jmp 0x59fc8e
push ebp
btc edx, ebp
add ecx, 0x58165a3b
mov ebp, esp
lea esp, [esp - 0x94]
mov eax, dword [0x520628]
xor eax, ebp
mov dword [ebp - 4], eax
neg dh
cwd
push ebx
sub dx, 0x3606
mov eax, 1
sal ch, cl
shld ecx, ebx, 0x3a
cpuid
cmp bx, di
push esi
lea esi, [ebp - 0x30]
mov dword [esi], eax
cmovp ax, bx
sar al, 0x37
and eax, edx
mov dword [esi + 4], ebx
movsx eax, cx
shr ax, 0xe4
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
btc ax, bx
mov eax, dword [ebp - 0x28]
cmp esi, esp
jmp 0x6cdb4b
mov byte [ebp - 0x2c], bl
mov byte [ebp - 0x2b], 0x6c
jmp loc.00430f11
mov dword [ebp - 0x2c], 0
test si, 0x3a50
cmc
mov dword [esi], eax
mov dword [esi + 4], ebx
test ecx, edi
cmp dl, 0xf5
jmp 0x6295d6
sar eax, 0x1f
push edi
test al, 1
jmp 0x53e1fb
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x6e
jmp 0x66a8a7

Function at 0x6720fc
Capabilities:
Terminate process

Disassembly:
push eax
bswap esi
movzx esi, bx
push 0x1f
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x542289
call esi
push eax
jmp loc.0042943a
push ebp
mov ebp, esp
shr ah, cl
push 0xfffffffffffffffe
shr ax, 0x7e
push 0x5fff0c
sar ah, 0x60
push 0x4740a0
test bx, sp
mov eax, dword fs:[0]
stc
cmc
push eax
ror al, 0xa8
btr eax, esi
movsx ax, dl
lea esp, [esp - 0xc]
push ebx
sbb eax, edi
push esi
rcr esi, 0x62
push edi
shr eax, 0x2e
shld ax, cx, 0xc2
rol al, cl
mov eax, dword [0x520628]
ror esi, 0xd7
stc
btc si, 0x86
xor dword [ebp - 8], eax
xor eax, ebp
neg esi
push eax
lea eax, [ebp - 0x10]
btc si, ax
mov dword fs:[0], eax
bt si, cx
bswap eax
mov dword [ebp - 0x18], esp
btr eax, esp
btc si, 0xcd
sbb ax, 0x5f38
sub edi, edi
mov ah, 0xa1
mov dword [ebp - 0x1c], edi
push edi
sete al
cbw
push 4
lahf
cbw
lea eax, [ebp - 0x1c]
jmp 0x53545b
Function at 0x6747bb
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + 0x3c]
cmp di, 0x3283
cmp ebp, esp
add eax, ecx
cmp edx, esp
cmp di, 0x7222
jmp 0x55c28d
je 0x5a8e32
test esi, esi
jmp 0x6350c8
je 0x4113c4
xor eax, eax
cmovnp esi, ebp
pop esi
dec ecx
test eax, 0x657765e8
bt ecx, eax
mov ecx, dword [ebp - 4]
clc
test edx, ebx
xor ecx, ebp
call fcn.0046e186
mov esp, ebp
pop ebp
jmp 0x5d36a7
ret
je 0x5a8e32
mov eax, 0x5a4d
test bx, 0x68f9
cmp word [ecx], ax
jmp 0x5a8e2c
push ebp
rcr al, cl
mov ebp, esp
ror ch, cl
sub esp, 0x120
bsf eax, edi
mov eax, dword [0x520628]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push esi
bts esi, ebx
mov esi, dword [ebp + 0xc]
cmc
mov dword [ebp - 0x120], esi
test ecx, ecx
jmp 0x563ce8

Function at 0x682cb0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Parse pe header

Disassembly:
mov dword [ebp - 0x2cc], eax
jmp loc.004207cb
push esi
jmp 0x659d0e
mov dword [ebp - 0x10], eax
jmp 0x675089
push edi
jmp 0x694e72
push ebx
jmp 0x61c9b4
push ebp
sub eax, edi
mov ebp, esp
and ah, 0xa6
shr ah, cl
push 0xffffffffffffffff
push 0x4e456b
cmc
stc
mov eax, dword fs:[0]
push eax
bswap ax
sub eax, esp
btc ax, sp
sub esp, 0x2c4
sar ax, cl
stc
mov eax, dword [0x520628]
cmp bp, cx
xor eax, ebp
jmp 0x6318ff
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ax, cx
cwde
mov eax, dword [ebp + 8]
jmp 0x5986d6

Function at 0x689f65
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov byte [esp + 0x1a30], 0x3c
jmp 0x6f9214
push 0xa60cd5a9
call fcn.006e1139
call fcn.004509e1
add esp, 4
movsx eax, ax
lahf
movzx ax, ch
mov ebx, esi
mov dword [esp + 0x858], 0xf
mov dword [esp + 0x854], edi
mov byte [esp + 0x844], 0
mov eax, edi
movzx eax, di
mov esi, 0xf
lea eax, [esp + 0x1a2c]
not ch
push eax
setae ch
movsx ecx, ax
lea ecx, [esp + 0x8b4]
jmp 0x5b322c
mov byte [esp + 0x1a31], 0x42
mov byte [esp + 0x1a32], 0x54
jmp loc.0042dd47

Function at 0x69aa31
Capabilities:
Create thread

Disassembly:
mov ecx, dword [ebp - 4]
bts edi, esi
xor ecx, ebp
movzx edi, cx
not di
mov di, 0x6f46
pop edi
call fcn.0046e186
mov esp, ebp
pop ebp
ret
push ebp
xor ebp, 0x1c374dc5
mov ebp, esp
rcr eax, 0xc4
cmp dx, si
sub esp, 0x38
mov eax, dword [0x520628]
cmp ebp, ebx
cmp dx, 0x44c5
xor eax, ebp
mov dword [ebp - 4], eax
cmc
push edi
or di, 0x5663
not di
mov edi, ecx
cmp bx, 0x18fb
test ecx, 0x98c737b
test edi, edi
je 0x62e4b7
push ebx
jmp loc.00428675