joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d9e4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x47d9ec
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4b028c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b032a
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4b02ee
cmp byte [ebx + 0x11], 0
jne 0x4b02ee
cmp byte [ebx + 0x24], 0
jne 0x4b02ee
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b030f
lea edx, [ebp - 4]
mov eax, dword [0x4e7104]
call fcn.0040ed74
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x48aed4]
call fcn.00423f58
call fcn.004090d4
jmp 0x4b030f
lea edx, [ebp - 8]
mov eax, dword [0x4e7104]
call fcn.0040ed74
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x48aed4]
call fcn.00423f58
call fcn.004090d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0331
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409ab8
ret

Function at 0x4b0b44
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b0b92
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b010c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0bab
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b0bb4
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b010c
dec esi
jne 0x4b0bd6
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4d8f04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ecx, dword [0x4e71f8]
mov ecx, dword [ecx]
mov dword [ebp - 4], ecx
mov ecx, dword [0x4e71f8]
mov dword [ecx], 0x5567743
xor ecx, ecx
push ebp
push 0x4d8f62
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov esi, eax
mov ebx, edx
dec ebx
test ebx, ebx
jl 0x4d8f4a
inc ebx
mov eax, 0xfe
call fcn.004070a8
inc eax
xor byte [esi], al
inc esi
dec ebx
jne 0x4d8f39
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8f69
mov eax, dword [0x4e71f8]
mov edx, dword [ebp - 4]
mov dword [eax], edx
ret

Function at 0x4d8f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [0x4e71f8]
mov ecx, dword [ecx]
mov dword [ebp - 8], ecx
mov ecx, dword [0x4e71f8]
mov dword [ecx], 0x5567743
xor ecx, ecx
push ebp
push 0x4d8fda
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edi, eax
mov esi, edx
mov ebx, dword [ebp - 4]
dec ebx
test ebx, ebx
jl 0x4d8fc2
inc ebx
mov eax, 0xfe
call fcn.004070a8
inc eax
xor al, byte [edi]
mov byte [esi], al
inc esi
inc edi
dec ebx
jne 0x4d8fae
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8fe1
mov eax, dword [0x4e71f8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
ret

Function at 0x4d9064
Capabilities:
Hash data with crc32

Disassembly:
push esi
cmp byte [0x4e6eb4], 0
jne 0x4d90a3
xor esi, esi
mov ecx, 0x4edde4
mov eax, esi
mov edx, 8
test al, 1
je 0x4d9089
shr eax, 1
xor eax, 0xedb88320
jmp 0x4d908b
shr eax, 1
dec edx
jne 0x4d907c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4d9075
mov byte [0x4e6eb4], 1
pop esi
ret

Function at 0x4d90a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
add ecx, edx
mov edx, ecx
cmp edx, ebx
je 0x4d90d7
mov ecx, 0xff
and ecx, eax
movzx esi, byte [ebx]
xor cx, si
movzx ecx, cx
mov ecx, dword [ecx*4 + 0x4edde4]
shr eax, 8
xor ecx, eax
mov eax, ecx
inc ebx
cmp edx, ebx
jne 0x4d90b4
pop esi
pop ebx
ret
Function at 0x9ae000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
adc dh, bh
dec esi
imul edx, ecx
push ebp
test bh, cl
imul ebx, eax
test al, cl
jno 0x9ae01a
sbb ebp, 0x4f87ca86
mov edi, esi
cmp ecx, 0xc645
jb 0x9ae028
imul esi, ebp, 0xbadbcc7e
cmp ecx, edx
test al, dl
and eax, 0x46347a2d
movzx edi, al
push edi
push edi
dec ah
test bh, ch
imul edx, esi, 0x8ef4a64d
mov ch, 0x4b
lea esi, [0xb19bda24]
inc edx
push 0x9b82cf
mov edi, ecx
call 0x9ae056
and ebp, 0
inc ebp
inc edi
lea edi, [0xf96f724d]
test dl, ch
inc esi
imul edx, ecx
inc ebx
movzx edi, bl
cmp ebp, 0x114
jb 0x9ae059
pop edx
cmp eax, 0xe67b
jno 0x9ae089
imul edi, esi
mov bl, 0x10
xor cl, 0x6a
sub edi, 0xfc773401
test ch, bl
mov ebx, 0xc4e6581d
dec edi
imul ebp, esi, 0xb03abd74
imul ecx, eax
dec ebp
xchg edi, ecx
cmp eax, 0x4ca8
jno 0x9ae0b6
test edi, edi
and ecx, 0xbc5898a8
mov cl, bl
sub eax, eax
inc edi
imul ecx, eax, 0xc63b20f8
adc edi, edi
or eax, edx
mov cl, 0xd0
movzx edi, bl
mov cl, dl
push eax
movzx ebp, al
pop ebx
movzx ecx, dl
adc ch, 7
movsx ecx, ah
imul edi, edx
mov esi, ebx
imul edi, eax
lea edi, [0xecdd317]
test ecx, esi
imul ebx, ebx
test ebx, ecx
lea edi, [0xc9016e60]
dec eax
add edi, eax
inc edi
movsx edi, cx
lea esi, [0x4270a17f]
mov esi, esi
jmp 0x9ae110
xchg eax, ecx
xchg eax, eax
mov ecx, edi
adc edi, ebp
mov ecx, ebp
mov ebx, 4
test esi, ebx
jae 0x9ae12a
imul esi, ecx
mov al, ah
and ecx, ebp
imul ebx, ebx, 0x245
mov al, ah
test ah, cl
xadd edx, ebx
mov edi, ebx
imul ebp, edx, 0xdf798e54
add edx, 0x70c
je 0x9ae14e
dec esi
adc ah, 0x94
movsx edi, bp
mov ecx, 0x44d23ebf
xor eax, eax
test dl, bl
mov esi, 0x263527a4
adc ch, dl
test esi, 0x2d3bf2e4
imul esi, ebp, 0xffbb5459
push 0x76dafb
cmp esi, 0x5de8ab33
imul ebp, ebx, 0x127f4edc
push edx
test ecx, 0xf1d3cad8
mov edi, ebx
and ebp, 0x250802f9
test dh, 0xe3
test ebp, esi
xchg ch, bl
sub eax, 0xcfbe
test edi, ebp
js 0x9ae1a8
lea ebp, [0xa5e14454]
lea ebx, [0x73325605]
sub eax, 0xb84
lea esi, [0xd7e89904]
mov ecx, 0x8cc8d6f4
ret
Function at 0x4417b4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x8c], 0
je 0x4417e9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004039f8
jmp 0x4417f3
mov eax, esi
mov edx, dword [ebx + 0x74]
call fcn.004039ac
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x4423c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call 0x50ec6952
call fcn.00442129
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004420de
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x442407
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00442119
shr byte [ebx - 0x31], 0xcb
lea eax, [ebp - 0x40]
push eax
call fcn.00442129
push eax
push esi
push dword [ebp + 8]
call fcn.004420de
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00442119
movsb byte es:[edi], byte [esi]
xchg ebp, eax
xchg edx, eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00442129
push eax
push esi
push dword [ebp + 8]
call fcn.004420de
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00442129
push eax
push esi
push dword [ebp + 8]
call fcn.004420de
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x4425b4
Function at 0x442560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x4425b4
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00442129
push eax
push esi
push dword [ebp + 8]
call fcn.004420de
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00442119
in eax, dx
cmp dword [ecx - 0x52], esp
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00442119
cdq
mov ecx, 0x858da04e
jl 0x442604
invalid
invalid
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44d004]
jne 0x40100a
repz ret
jmp fcn.00401368

Function at 0x40425b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403568
and dword [ebp - 0x14], 0
cmp dword [0x44f940], 0
mov dword [ebp - 0x18], eax
jne 0x40430e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4043b6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4043b6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44f940], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44f944], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44f948], eax
call edi
push eax
call esi
mov dword [0x44f950], eax
test eax, eax
je 0x40430e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44f94c], eax
mov eax, dword [0x44f94c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404367
cmp dword [0x44f950], ecx
je 0x404367
push eax
call esi
push dword [0x44f950]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404367
test ebx, ebx
je 0x404367
call edi
test eax, eax
je 0x40435e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40435e
test byte [ebp - 8], 1
jne 0x404367
or dword [ebp + 0x10], 0x200000
jmp 0x40439a
mov eax, dword [0x44f944]
cmp eax, dword [ebp - 0x18]
je 0x40439a
push eax
call esi
test eax, eax
je 0x40439a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40439a
mov eax, dword [0x44f948]
cmp eax, dword [ebp - 0x18]
je 0x40439a
push eax
call esi
test eax, eax
je 0x40439a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44f940]
call esi
test eax, eax
je 0x4043b6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4043b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x448bc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
mov edx, dword [0x1f21de4]
mov eax, dword [0x1f21b08]
xor ecx, ecx
mov word [0x1f21e00], cx
lea ecx, [ebp - 8]
push ecx
push 0x40
push edx
push eax
mov dword [0x1f21dec], 0x6e0072
mov dword [0x1f21df0], 0x6c0065
mov dword [0x1f21df4], 0x320033
mov dword [0x1f21df8], 0x64002e
mov dword [0x1f21dfc], 0x6c006c
mov dword [0x1f21de8], 0x65006b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x448df0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x44ddc0]
sub esp, 0x10
push ebx
mov ebx, dword [0x1f21b08]
push edi
mov edi, dword [0x1f21de4]
push eax
call fcn.00448d10
add esp, 4
cmp dword [0x1f21de4], 0x2f
jne 0x448e4d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.00448d60
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xaff516
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], esp
call 0xaff4f8
mov dword [esp + 0x1c], esi
call 0xaff531
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ebx
pushfd
jmp 0xaff50e

Function at 0xaff52c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0af0a18
jmp 0xaff733
call 0xaff516
pop word [esp]
lea esp, [esp + 2]
jmp 0xaff577
pushfd
jmp 0xaff51f
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0xaff561
call fcn.00aff5b1
mov dx, word [esp]
sub esp, 0xc
je 0xaff6ce
jne 0xaff6ce

Function at 0xaff531
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0af0a18
jmp 0xaff733
call 0xaff516
pop word [esp]
lea esp, [esp + 2]
jmp 0xaff577
pushfd
jmp 0xaff51f
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0xaff561
call fcn.00aff5b1
mov dx, word [esp]
sub esp, 0xc
je 0xaff6ce
jne 0xaff6ce

Function at 0xb02a7a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 2], eax
lea edx, [ecx*4]
xchg word [esp + 4], dx
shl al, 1
jmp 0xb02aa3
seto ah
pushfd
lea eax, [esi*4]
lea eax, [eax + 0xb4]
jmp 0xb02a60
sub cl, bl
xchg dl, al
lea edx, [edx + edi]
mov ax, word [esp]
jmp 0xb02adb
jp 0xb02a8d
jnp 0xb02a8d
fist dword [esi - 0x3c]
mov dword [reloc.KERNEL32.DLL_WriteFile], eax
pop ebx
int 0xe
out dx, al
stc
fdivr dword [ebx]
adc cl, byte [ebp + 0x85148d]
add byte [eax], al
add al, ch
mov ch, 0xff
invalid
bsr dx, sp
jb 0xb02ac5
jae 0xb02ac5

Function at 0xb02d61
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
jmp 0xb02cee
lea eax, [ebx + esi]
setg al
sub al, dh
jae 0xb02cc4
lea esp, [esp + 3]
jmp 0xb02d2e
lea esp, [esp + 1]
add dl, 0xa8
btc ax, bx
jmp 0xb02d18
cmc
mov ax, bp
lea eax, [ebx*4]
mov al, cl
jmp 0xb02d34
jmp 0xb02cda
je 0xb02cff
cmc
mov ax, bp
jmp 0xb02d4a
lea esp, [esp + 1]
jmp 0xb02cf2
sub bl, dl
mov eax, edi
lea edx, [esp + eax]
xchg dh, ah
lea eax, [eax + esi]
jmp 0xb02d55
lea eax, [ebx*4]
mov al, cl
jmp 0xb02d34
inc edi
not dx
xchg dx, ax
call 0xb02d61
insd dword es:[edi], dx
cmc
jnp 0xb02db9
mov dx, ax
lea edx, [eax + ebx]
pushal
xchg dword [esp + 0xb], edx
mov ax, 0x5d6d
jmp 0xb02d91
xchg dword [esp + 0xb], edx
mov ax, 0x5d6d
mov dh, byte [esp + 0x13]
jmp 0xb02dd1
mov dx, ax
lea edx, [eax + ebx]
pushal
jmp 0xb02d89
jmp 0xb02d9f
lea esp, [esp + 0x20]
sub cl, 0x38
mov eax, 0x9a23e0f1
mov eax, ebp
jmp 0xb02e0f
rol cl, 0
mov eax, dword [esp]
lea eax, [ebp*4]
mov dh, byte [esp]
mov edx, 0x3f210f9a
jmp 0xb02dbb
lea eax, [ecx + edi]
btc dx, si
jns 0xb02df9
mov dx, 0x4857
jmp 0xb02e23
btc eax, esi
jmp 0xb02e64
Function at 0xb03a33
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr ax, si
jle 0xb03a00
sbb cl, bl
jmp 0xb029f3

Function at 0xb3d2ae
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 4]
cmp ecx, 0xe
jmp 0xb3d2dc

Function at 0xbe6d80
Capabilities:
Execute anti-debugging instructions

Disassembly:
setb dh
btc edx, esi
mov eax, dword [esp + 3]
jmp 0xbe6d59

Function at 0xbe6e68
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edi, eax
sub edx, 0xc03c9536
mov edx, ecx
cmp dh, al
jmp 0xbe6e9d
mov byte [esp + 0xc], ch
xchg edx, eax
std
rdtsc
pop word [esp + 0x2d]
adc al, 0x42
jmp 0xbe6e87

Function at 0xbe70c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xbe71bb
lea edi, [eax + ecx]
mov al, byte [esp + 3]
xchg word [esp + 1], di
add esp, 4
clc
jmp 0xbe716f
mov di, sp
rdtsc
rdtsc
mov edi, dword [esp]
adc dx, 0x93d6
mov dword [esp], esp
jmp 0xbe70f6
xchg byte [esp], dh
mov byte [esp], ah
call fcn.00be7158
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
cmc
add esp, 0
mov dh, 0x4b
std
xchg ah, dh
std
jmp 0xbe7120
mov dx, word [esp]
mov dh, 0x14
mov al, ch
add esp, 0
xchg byte [esp], dh
bswap edi
jmp 0xbe7136
xor dh, 0x7b
stc
mov dx, word [esp + 2]
sub dh, 0x78
xchg edx, eax
mov ax, 0x623f
jmp 0xbe710c

Function at 0xbe7462
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, 0xc4
pop di
setp ah
push word [esp + 1]
mov edi, 0x2ae4089
jmp 0xbe7486
std
mov byte [esp + 4], bh
mov ah, byte [esp]
setae ah
dec edi
jmp 0xbe744a
neg edx
push word [esp + 2]
cld
mov byte [esp + 4], cl
bswap edx
jmp 0xbe7536
neg ax
xchg word [esp], di
bsf di, sp
pushfd
push dword [esp + 1]
not edi
jmp 0xbe7470
push word [esp + 0xd]
xchg dword [esp + 2], edi
lea esp, [esp + 7]
xchg word [esp + 0xa], di
neg ax
lea edx, [edi*4]
jmp 0xbe750c
pushfd
mov al, byte [esp + 0xb]
pop edx
sub esp, 0x15
bts dx, ax
pop word [esp + 0x16]
jmp 0xbe74ba
xchg dword [esp + 0x2f], edi
stc
pop word [esp + 0xa]
rdtsc
xchg dword [esp + 0x13], eax
jmp 0xbe751f
bsr di, di
clc
sub esp, 0x16
push dword [esp + 0x23]
sub esp, 2
push di
jmp 0xbe74f6
bsr ax, ax
add esp, 0x20
mov word [esp + 1], sp
lea edx, [eax + 0x6c]
jmp 0xbe7571
xchg dword [esp + 0xa], edi
lea edx, reloc.KERNEL32.DLL_WriteFile
std
xchg dh, al
cmc
lea edi, reloc.KERNEL32.DLL_WriteFile
jmp 0xbe74e2
push word [esp + 6]
mov al, 0xdc
mov edx, 0x908b6467
lea edi, [ebp*4]
push bp
mov edx, 0x5b0c267e
jmp 0xbe75a5
add esp, 8
xchg byte [esp + 0xf], al
mov dx, word [esp + 2]
xchg word [esp], dx
not ah
pop eax
jmp 0xbe754d
xchg dx, di
mov ah, dl
xchg word [esp], di
mov dword [esp + 2], eax
mov dh, dl
push dword [esp + 8]
jmp 0xbe75d1
xchg word [esp + 7], ax
dec dh
rdtsc
mov di, 0xeff4
bt edi, esi
xchg byte [esp + 4], ah
jmp 0xbe7586
pop dword [esp + 3]
call fcn.00be75bb
lea eax, [edi + edi]
mov byte [esp + 3], bh
shl dl, 3
rcr ax, cl
not edx
jmp 0xbe7621
neg dl
cmp ax, 0x3a9d
xchg byte [esp], al
mov dh, 0x54
neg dh
bsr dx, sp
call fcn.00be765c
dec cl
push 0x8d5d228b
lea esp, [esp + 0x41]
Function at 0xbe763d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 2], al
lea edi, [ecx + esi]
pop word [esp + 1]
jmp 0xbe72a0
mov word [esp + 3], bx
cld
rdtsc
mov byte [esp + 1], dl
pop ax
add esp, 3
jmp 0xbe7261
rdtsc
xchg edi, edx
lea edx, [ebx + edi]
mov dh, byte [esp + 3]
xchg dword [esp], edi
bswap eax
jmp 0xbe72ed
mov edi, 0x8f328227
pushfd
pop dword [esp]
mov edi, dword [esp + 2]
lea edx, [esi*4]
clc
jmp 0xbe728a
mov dh, 0xf0
bswap edi
rol dh, 2
btc eax, ecx
mov dh, 0x67
mov ah, 0x3b
jmp 0xbe7277
mov ah, 0xcf
mov eax, ebp
stc
xchg dl, ah
neg dh
mov edx, ebx
jmp 0xbe7301
neg ax
pop di
lea eax, [edx*4]
add dl, dl
xchg dx, ax
push edi
jmp 0xbe72d7
lea edx, [eax + ecx]
rdtsc
mov ax, 0xdc2
push dword [esp + 4]
bswap edi
clc
jmp 0xbe7337
lea edi, [ebx - 0xb8]
not di
bts eax, edi
lea eax, [edx + edi]
inc ax
sub esp, 0xb
jmp 0xbe72c7
lea esp, [esp + 2]
rcr ah, 2
call fcn.00be737e
mov edx, ebx
rdtsc
neg dx
mov dx, bx
cld
not edi
jmp 0xbe7321
rdtsc
cmc
mov ax, 0xd24e
mov edi, eax
mov ah, 0x29
not ah
jmp 0xbe7359
bswap edx
mov eax, 0x32bfa1dd
setge ah
lea edi, reloc.KERNEL32.DLL_WriteFile
setg ah
mov dh, bh
jmp 0xbe73b3
lea esp, [esp + 0x41]
jmp 0xbe74a0

Function at 0xbe7751
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, cl
neg dx
lea edx, [ecx + ebx]
mov byte [esp + 1], bh
mov byte [esp], bh
xchg word [esp + 3], di
jmp 0xbe7722

Function at 0xbe84a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jmp 0xbe84ec
push word [esp + 2]
pop word [esp]
lea esp, [esp + 2]
jmp 0xbe848d
call 0xb9ce09
jmp 0xbebb7a
add eax, 0xaf4f78
jmp 0xbebade
pop eax
sub eax, 0xbebb04
mov ebx, eax
jmp 0xbebabe
add ebx, 0x743390
mov dword [ebx], eax
popal
jmp 0xbe6198
call 0xbebb04
jmp 0xbebad4
call 0xbebb7f
add dword [esp], reloc.KERNEL32.DLL_WriteFile
call fcn.00af520c
jmp 0xbebaff

Function at 0xbecc84
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0xbecc91
pop word [esp]
mov word [esp], di
mov byte [esp], ah
jmp 0xbecc6e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xbeccd5
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xbeccbf