joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428100
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453c5a
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x46b664]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
push 0x1c
lea edx, [ebp - 0x58]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4281d2
mov edi, dword [ebp - 0x54]
test edi, edi
je 0x4281d2
mov dword [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
call fcn.0041acb0
add esp, 4
mov byte [ebp - 4], 1
push 0
push eax
or eax, 0xffffffff
mov ecx, ebx
call fcn.00401a90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
push ecx
call fcn.00415780
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edi + 0x3c]
add eax, edi
movzx edx, word [eax + 0x14]
lea edx, [edx + eax + 0x18]
sub esi, edi
xor ecx, ecx
movzx eax, word [eax + 6]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x4281d2
lea eax, [edx + 0x10]
mov edx, dword [eax - 4]
mov edi, dword [eax]
mov ebx, dword [eax - 8]
cmp edi, ebx
ja 0x4281bf
mov edi, ebx
cmp esi, edx
jb 0x4281c9
add edi, edx
cmp esi, edi
jbe 0x4281f0
inc ecx
add eax, 0x28
cmp ecx, dword [ebp - 0x3c]
jb 0x4281b1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00431de5
mov esp, ebp
pop ebp
ret
inc ecx
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
sub esi, edx
mov ecx, dword [ebp - 0x34]
mov dword [ecx], esi
mov eax, 1
jmp 0x4281d4
Function at 0x42a470
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x455c5f
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
push ebx
push esi
push edi
mov eax, dword [0x46b664]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 8]
add eax, 0x68
push eax
call fcn.00415c80
mov dword [ebp - 4], ebx
mov eax, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
call fcn.00419da0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
je 0x42a509
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x42a509
lea eax, [ebp - 0x20]
push eax
push ebx
mov ecx, eax
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
movzx eax, word [ebp + 0x18]
push eax
mov eax, edi
call fcn.00401500
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov byte [ebp - 4], 1
lea esi, [ebp - 0x28]
call fcn.00407db0
mov dword [ebp - 4], ebx
jmp 0x42a5b9
mov eax, dword [ebp + 8]
cmp dword [eax + 0xa8], ebx
je 0x42a5d2
mov ecx, dword [eax + 0xa8]
mov edx, dword [ecx]
push edi
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x42f300
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451d93
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x46b664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, ecx
mov eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [esi]
xor edi, edi
mov dword [ebp - 0x44], ebx
cmp eax, 0xffffffff
je 0x42f35c
cmp eax, edi
je 0x42f35c
cmp dword [esi + 4], edi
jne 0x42f35c
push 4
call fcn.00431fbb
mov dword [esi + 4], eax
add esp, 4
mov dword [eax], 1
mov esi, dword [esi + 4]
mov dword [ebx + 4], esi
cmp esi, edi
je 0x42f368
inc dword [esi]
mov dword [ebp - 4], edi
lea esi, [ebx + 8]
mov dword [esi], 0xffffffff
mov dword [esi + 4], edi
mov byte [ebp - 4], 1
mov eax, dword [ebx]
lea ecx, [ebp - 0x40]
push ecx
push eax
mov dword [ebx + 0x10], edi
mov dword [ebp - 0x40], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebx]
push edi
push eax
push edi
push 2
push edi
push ecx
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edi
mov byte [ebp - 4], 2
lea edi, [ebp - 0x38]
call fcn.00425c60
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x34]
test edi, edi
jne 0x42f3d2
mov eax, dword [ebp - 0x38]
cmp eax, 0xffffffff
je 0x42f3f2
test eax, eax
je 0x42f3f2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42f3f2
dec dword [edi]
jne 0x42f3f2
mov eax, dword [ebp - 0x38]
cmp eax, 0xffffffff
je 0x42f3e9
test eax, eax
je 0x42f3e9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00431dda
add esp, 4
mov eax, dword [esi]
or edi, 0xffffffff
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], edi
cmp eax, edi
je 0x42f409
test eax, eax
jne 0x42f447
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
xor edx, edx
push 0x1b
mov eax, str.CreateFileMapping___failed.
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
call fcn.0040eba0
mov byte [ebp - 4], 1
push 0x462084
lea eax, [ebp - 0x30]
push eax
call fcn.00436362
mov ecx, dword [ebp - 0x3c]
push ecx
push 0
push 0
mov esi, eax
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebx + 0x10], eax
mov dword [ebp - 4], edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00431de5
mov esp, ebp
pop ebp
ret 4
Function at 0x4312c9
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x44f0a8
call fcn.00436bee
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x4313c0
cmp byte [esi + 0x4a], bl
je 0x4313c0
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x431305
xor al, al
jmp 0x4313c2
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00406bd0
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x431363
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x431368
dec eax
je 0x43136c
dec eax
dec eax
je 0x4313bc
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040aec0
mov al, bl
jmp 0x4313c2
mov edx, dword [ebp - 0x2c]
jmp 0x43132e
mov byte [esi + 0x4a], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x431378
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x43139e
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x43138b
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.00432abe
add esp, 0x10
cmp edi, eax
jne 0x431351
cmp byte [esi + 0x4a], 0
je 0x4313bc
test edi, edi
jne 0x431320
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004098a0
jmp 0x431320
mov bl, 1
jmp 0x431353
mov al, 1
call fcn.00436c38
ret

Function at 0x43196c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x46d5c4], 0
push esi
push edi
jne 0x4318e2
call fcn.0043184e
test eax, eax
je 0x431927
mov eax, dword [0x46d5c4]
cmp eax, 1
jne 0x431903
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x431927
jmp 0x431969
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x431969
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x43192b
xor eax, eax
jmp 0x431969
mov eax, dword [esi]
push dword [0x46d5c4]
call edi
mov edi, eax
test edi, edi
je 0x43194d
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x431969
lea edi, [esi + 0xff0]
push esi
push dword [0x46d5c4]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x431953
mov eax, esi
pop edi
pop esi
ret
jmp 0x4318ce

Function at 0x431de5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46b664]
jne 0x431def
repz ret
jmp fcn.00439ef4
Function at 0x445d7c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46b664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0043a793
and dword [ebp - 0x14], 0
cmp dword [0x46e510], 0
mov dword [ebp - 0x18], eax
jne 0x445e2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x445ed7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x445ed7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x45b624
push ebx
mov dword [0x46e510], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46e514], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46e518], eax
call edi
push eax
call esi
mov dword [0x46e520], eax
test eax, eax
je 0x445e2f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46e51c], eax
mov eax, dword [0x46e51c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x445e88
cmp dword [0x46e520], ecx
je 0x445e88
push eax
call esi
push dword [0x46e520]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x445e88
test ebx, ebx
je 0x445e88
call edi
test eax, eax
je 0x445e7f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x445e7f
test byte [ebp - 8], 1
jne 0x445e88
or dword [ebp + 0x10], 0x200000
jmp 0x445ebb
mov eax, dword [0x46e514]
cmp eax, dword [ebp - 0x18]
je 0x445ebb
push eax
call esi
test eax, eax
je 0x445ebb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x445ebb
mov eax, dword [0x46e518]
cmp eax, dword [ebp - 0x18]
je 0x445ebb
push eax
call esi
test eax, eax
je 0x445ebb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46e510]
call esi
test eax, eax
je 0x445ed7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x445ed9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431de5
leave
ret

Function at 0x44adbb
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x44adfc
push ebx
movzx edx, byte [ecx]
dec eax
inc ecx
movzx ebx, byte [ecx]
shl ebx, 8
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
test eax, eax
jg 0x44add5
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x44ae1a
dec esi
je 0x44ae11
dec esi
jne 0x44ae1f
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x47134b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x60b910
push eax
xchg byte [edi], al
add byte [eax], al
add byte [ebx - 0x7a9939], cl
cmp ch, ch
cmp eax, ecx
jmp 0x6562ed
invalid
add al, 0
jbe 0x6562f7
mov eax, ecx
cwd
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x44]
mov dx, 0x3089
mov ecx, eax
bsf dx, si
mov edx, ecx
clc
stc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
movsx ecx, si
bsr ecx, eax
dec cx
mov ecx, edx
rcl dx, 0x16
cdq
sbb dx, 0x7639
mov edx, dword [esp + 0x1c]
test esi, ecx
and ecx, 3
cmc
test si, si
sub edx, eax
jmp 0x4b58a1

Function at 0x47581f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
jmp 0x545a90
push ebp
mov ebp, esp
shl ax, 0x61
rcr eax, 0x73
sub esp, 0x28
push esi
cbw
jmp 0x51f52e
pop ecx
push ecx
lea eax, [ebp + 8]
jmp 0x473b39
push eax
lea eax, [ebp - 0xc]
jmp 0x607ce3
mov dword [eax + 0x10], 0x100a2c80
jmp 0x605b2f
mov dword [eax + 0x14], 0x100ae5b0
jmp 0x6294de
mov edx, dword [esp + 0xc]
mov si, 0x7946
not esi
pop esi
mov dword [eax + 8], 0x100a2c00
mov dword [eax + 0xc], 0x100a2c10
jmp 0x5fcc19
mov dword [eax + 0x18], 0x100b9090
jmp 0x49eefa

Function at 0x47b29b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
stc
add esp, 0xfffffff4
jmp 0x609412
or al, 0xf9
cmp ecx, eax
ja 0x60d963
imul ecx, esi
cwde
mov ah, 0xbb
movsx eax, cx
mov eax, dword [esp + 8]
jmp 0x4bdec7
sub eax, eax
movsx esi, bx
mov si, 0x1c3
pop esi
jmp 0x4b34ec
Function at 0x4ba99b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
push ecx
mov eax, 0x124254
mov ecx, 0x256
pop ecx
pop eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xd07701ff
xor esi, eax
xor esi, 0x4a409c8c
popal
nop dword [eax]
pushal
mov ecx, 0x4a4cef1c
xor ecx, 0xb0ee77f2
mov eax, 0x883fa0ac
xor eax, 0x82f95559
mov edx, 0x26491991
xor edx, 0x87128dd1
mov ebx, 0x3c02473c
xor ebx, 0xb54c1974
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x51bf99f5
xor esi, eax
xor esi, 0xcb096c2d
popal
nop dword [eax]
pushal
mov ecx, 0x7fee09d8
xor ecx, 0x34d2a606
mov eax, 0x95b7956e
xor eax, 0x4a9c2fef
mov edx, 0xc3e60227
xor edx, 0x605985d2
mov ebx, 0x153e220a
xor ebx, 0x8e87f28b
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x436c8ebe
xor esi, eax
xor esi, 0xa4517e2b
popal
nop dword [eax]
pushal
mov ecx, 0x59361bc3
xor ecx, 0xd27fedfb
mov eax, 0x6ef36e7c
xor eax, 0x5f72d4b4
mov edx, 0xa8fe5e1f
xor edx, 0x457e193f
mov ebx, 0xbec7e9bf
xor ebx, 0x73ac85f8
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x28912078
xor esi, eax
xor esi, 0x8969da23
popal
nop dword [eax]
pushal
mov ecx, 0x3e4e7a39
xor ecx, 0xb7984aba
mov eax, 0x541805da
xor eax, 0xcd61d65a
mov edx, 0x82467293
xor edx, 0x372b103d
mov ebx, 0x9803c6be
xor ebx, 0x4ce862f6
mul byte [edx - 0x18]
dec esp
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xc6323699
xor esi, eax
xor esi, 0x62b1ee89
popal
nop dword [eax]
pushal
mov ecx, 0x17968c37
xor ecx, 0x90e05e67
mov eax, 0x4a1dbfff
xor eax, 0xe6914238
mov edx, 0x6bb795a2
xor edx, 0xe50d9f0b
mov ebx, 0x81812143
xor ebx, 0x3665bbc3
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xafaf8dfc
xor esi, eax
xor esi, 0x4c23119c
popal
nop dword [eax]
pushal
mov ecx, 0xc56ce3d5
xor ecx, 0x7a517e55
mov eax, 0x2f4254e8
xor eax, 0x901b09f6
mov edx, 0x44ffa7a1
xor edx, 0xbe4979d9
mov ebx, 0x5abcfa59
xor ebx, 0xd406cc92
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x88f7a31a
xor esi, eax
xor esi, 0x3ddc4333
popal
nop dword [eax]
pushal
mov ecx, 0x9eb4f9b8
xor ecx, 0x53999433
mov eax, 0x87e306b
xor eax, 0xa4f1b415
mov edx, 0x1e3b864e
xor edx, 0xd32c59b6
mov ebx, 0x6f9fdbef

Function at 0x4c0445
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc esp
cmp byte [ecx], al
xor dword [ebp - 9], 0xa20f9090

Function at 0x4c1a44
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [0x7762fa81], al
inc ecx
xchg esi, eax
jmp 0x616dd3
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
jmp 0x5edda8
call fcn.005fc150
add esp, 0xc
xchg ch, ch
setge ch
lea ecx, [esp + 0x14]
jmp 0x4a6bc2
push esp
and al, 0x18
jmp 0x644679
add byte [eax], al
add byte [ebx - 0x3e36d407], cl
jmp 0x616dbb
mov dword [esp + 0x20], 0
jmp 0x5e8c25
push ecx
push edx
jmp 0x6369ce
Function at 0x4c9f3e
Capabilities:
Execute anti-debugging instructions

Disassembly:
and edi, dword [ecx + 0x36342202]
push ebp
mov ebp, esp
test di, 0x4f82
cmc
sub esp, 0xc
cmp dword [ebp + 8], 0
jmp 0x53ea29
je 0x536b38
mov eax, dword [ebp + 0x10]
cmp eax, 1
jmp 0x60787f
sub eax, eax
jmp 0x68df82
je 0x536b38
cmp dword [ebp + 0x14], 0
jmp 0x4e9b38
mov edi, edx
or ecx, 0xffffffff
sub eax, eax
cmc
repne scasb al, byte es:[edi]
not esi
dec esi
not ecx
dec ecx
mov esi, eax
mov esi, ecx
je 0x4c3129
cmp byte [edx], 0x2d
je 0x4c3129
push esi
jmp 0x4ac53e
or al, 0x38
fsub dword [ebx + eax + 0x55]
adc al, 0xfd
in al, 0xd6
mul dword [edi]
xor byte [ebx + ebp*8], 0xd8
mov dh, 0x55
inc dword [edi - 0x23]
or dl, 0x95
mov ebx, 0x427ae291
int3
jp 0x68df48
fidivr dword [eax]
jmp 0x1493268a
Function at 0x4cc2e7
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc dword [eax], ebp
push ebp
jp 0x4cc351
cmp ecx, edi
sub edx, 0xffffffe5
jmp 0x62499a
cld
call dword [eax - 0x6f6f6f70]
nop
nop
nop
jmp 0x662874
add byte [edi - 0x3642f037], 0x8b
into
shr edi, cl
shr ch, 0x40
mov ecx, dword [ebp + 8]
cmp esp, ebp
test bl, 0x7a
or dword [ecx], edi
movsx ecx, cx
lea eax, [eax + edx*4 + 0x44]
bswap ecx
xchg dl, ch
movzx edx, si
mov edx, 0x80000000
mov ch, 6
mov dword [esi + 4], edx
jmp 0x676f0e
cmp edx, eax
jmp 0x66782c
neg dx
mov dword [ebp + 8], eax
btr edx, 0xc2
stc
bts dx, bp
cdq
idiv edi
bts edi, edx
xlatb
pop edi
stc
test edx, edx
jmp 0x4d68c9
shl dword [esi - 0x48], 0xb6
inc ebp
mov eax, dword [ebx + 0x2c]
clc
mov dword [esp + 0x1c], ecx
jmp 0x4dc2f3
mov dword [ebp - 4], esi
jmp 0x655910
cmp word [ebp + 0x10], 0x1d
jmp 0x63328f
jne 0x63b714
mov eax, ecx
stc
cmp ebx, 0x174f58a5
mov ecx, 0x190
btc edx, 0xb9
sbb dx, 0x46ad
cdq
clc
cmp dh, 0xf8
idiv ecx
jmp 0x4a7007
jne 0x50ecf5
cmp di, 2
jne 0x50ecf5
mov eax, esi
jmp 0x4eb7c6
inc edx
bswap ecx
setg cl
push 0xffffffffffffffff
movsx ecx, bx
push edx
mov ecx, 0x87200ee
lea ecx, [esp + 0x16c]
jmp 0x4d16f1
sti
stc
cmc
cmp cx, 0x62fc
test edx, edx
jmp 0x652aa2
jmp 0x661362
add byte [esi], ch

Function at 0x4cd0b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
jb 0x4a1867
add ebx, dword [eax + 0x62f6f381]
call 0x1f5979be
add byte [eax], 0
add byte [eax], al
push ecx
push esp
adc al, 0
push 0
push 0
call eax
mov esi, eax
test sp, cx
test esi, esi
je 0x61250c
push 0x10175cc0
mov ch, 0xc4
movsx ecx, dx
mov ecx, edx
mov ecx, 0x101918fc
jmp 0x50a916
jmp 0x4f4dea
dec ebp
add edx, 0x1f
dec ebx
cmc
stc
sub esp, 0xffffffb3
sub ebx, 0x33
dec esi
test dl, 0x3f
sub esi, 0xd
dec ebp
jmp 0x660948
call fcn.00677f83
test eax, eax
jmp 0x63100c
fimul dword [ecx + 0xcc2ffec]
add byte [edi + 0x50], dl
jmp 0x4de5c7
push esp
push edi
jmp 0x4a1806
mov esi, 0xc7bc0fc0

Function at 0x4d1db1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
jmp 0x60bbc0
mov eax, dword [esp + 0x14]
not ecx
movsx ecx, di
push 0x1c
mov cl, ah
not ch
push 1
movsx ecx, bp
mov ecx, dword [eax + 0x28]
jmp 0x4cc4ac
push ecx
jmp 0x625c27
add al, ch
out dx, eax
in eax, dx
inc dword [ebx - 0xa07f73c]
cmp si, 0x133b
test eax, eax
jmp 0x4dc06a
cmp eax, esp
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x28]
rcr bx, 0x22
sub ebx, ebx
mov ebx, dword [edi]
stc
mov dword [edi + 4], ecx
mov cx, dx
rcr ch, 0x87
bts cx, cx
mov ecx, ebp
cmp di, ax
stc
push eax
cmc
sub ecx, ebx
jmp 0x6295ea
mov ebx, dword [edi + 8]
test esi, 0x48df06e1
cmp cl, dh
add ebx, ecx
jmp 0x4a37ab
Function at 0x4db351
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov esi, dword [eax + 0x16b4]
jmp 0x66106e
push 0xffffffffffffffff
push 0x100df1a8
sub dx, bp
neg dl
btc edx, 0
mov eax, dword fs:[0]
mov edx, esp
xadd dh, dh
push eax
sub dh, dh
mov dword fs:[0], esp
cbw
btc ax, si
sub esp, 0x54
mov dx, 0x2a99
cmovae eax, esp
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
jmp 0x61e13a
add byte [eax], al
setb dh
mov edx, dword [esp + 0x20]
jmp 0x538835
loop 0x4e9345
add al, 0
cmp ebx, 7
jmp 0x655a45
mov byte [esi + edi], cl
mov esi, 0x67133686
cmovns ecx, edx
xchg si, si
mov ecx, dword [eax + 0x14]
mov esi, 0x1fb27948
jmp 0x471a5a
mov dword [eax + 0x14], esi
jmp 0x4f4d9e
mov ecx, dword [eax + 0x16b4]
cmp ecx, 0xe
jle 0x6533e4
add edx, 0xfffffffd
clc
mov esi, edx
mov bl, 0x67
shl esi, cl
add ecx, esp
rcl bl, 0xb3
mov ecx, dword [eax + 8]
add bl, 0xce
and bl, 0x5e
or word [eax + 0x16b0], si
stc
mov esi, dword [eax + 0x14]
mov bl, byte [eax + 0x16b0]
mov byte [ecx + esi], bl
mov esi, dword [eax + 0x14]
btr edi, ecx
mov edi, dword [eax + 8]
sub ecx, ecx
not cl
mov cl, byte [eax + 0x16b1]
inc esi
jmp 0x4fc24c
jmp 0x5056fd
dec edx
test esp, 0x46122e53
and edx, ebx
test cx, 0x39dd
cmp edx, ecx
jmp 0x4e934f
inc esp
and al, 0x34
stc
sub ch, 0x36
sal dl, 0x35
mov edx, 1
btr bx, 0xb6
mov ecx, esi
setns bl
xchg ebx, ebx
test di, 0x74c9
sub eax, esi
rcr bh, cl
bsf bx, cx
btc bx, 0xc8
mov ebx, edi
test edx, eax
cmc
shl edx, cl
mov ecx, eax
sar ebx, cl
movzx ecx, bp
mov ecx, dword [esi*4 + 0x10164f00]
jmp 0x61bc22
lea edx, [ecx + 7]
sal cl, cl
bsf ecx, ecx
shr edx, 3
neg cx
lea ecx, [edx + ebx - 1]
test esi, 0x7add6cec
mov dword [esp + 0x24], ecx
mov dl, byte [ecx]
shrd ecx, edx, 0xa9
xchg cx, cx
mov ecx, dword [ebp + 0x7c]
stc
mov byte [esp + 0x2c], dl
xor dx, cx
sar dx, cl
ror edx, 0xeb
mov edx, 0xff
test esi, 0x2c5206e7
cmc
test ecx, 0x10000
mov cl, 0x69
bswap ecx
mov ecx, esi
jmp fcn.004962db
retf 0x4c8d
lds eax, [edx + 0x4689ffe6]
xor bh, bh
xlatb
push 6
mov dword [esi + 0x34], eax
call edi
mov edi, dword [0x100e15c4]
jmp fcn.004d2187
clc
cld
cmpsb byte [esi], byte es:[edi]
dec edi
adc eax, 0xec699eba
mov dh, 0x7b
cmc
psubd mm1, qword [ebp + 0x7b273cd4]

Function at 0x4e1131
Capabilities:
Execute anti-debugging instructions

Disassembly:
not byte [eax - 0x7c36cc70]
rol dword [ecx], 0x81
stc
adc eax, dword [ecx + 0x77]
push ebp
mov eax, 0x53100e13
jmp 0x632b6e
aad 0x66
mov ebp, ebp
mov dword [esp + 0x2c], edi
movsx ebp, dx
mov ebp, 0x3e851218
lea ebp, [edi + 0x20]
jmp 0x4bcabb

Function at 0x4e24f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
shrd si, di, 0x47
mov esi, dword [ecx + 4]
test bl, 0xc0
cmp esi, ebx
test esi, esi
push edi
jmp 0x61244a
cmp edi, 0xffffffff
lea eax, [eax - 2]
stc
test bp, dx
neg eax
jmp 0x4b9ae7
Function at 0x4e4ddb
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ds
rol dword [ebx + 7], 0x61
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xa3b748b1
xor esi, eax
xor esi, 0x589be1c0
popal
nop dword [eax]
pushal
mov ecx, 0xd807f6a
xor ecx, 0x6e49f563
mov eax, 0x232e8fe3
xor eax, 0x6cba194e
mov edx, 0x21aaee6e
xor edx, 0xbe1e6eee
mov ebx, 0x37684121
xor ebx, 0xec4cdb9b
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x4d2593cd
xor esi, eax
xor esi, 0x20a3177
popal
nop dword [eax]
pushal
mov ecx, 0xb6fb0698
xor ecx, 0x3044d718
mov eax, 0xccb85798
xor eax, 0x460229d1
mov edx, 0xfae6c77b
xor edx, 0x5bbf7fb4
mov ebx, 0x10a41a2a
xor ebx, 0xc9eed38b
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x4338a735
xor esi, eax
xor esi, 0x1b46f1b5
popal
nop dword [eax]
pushal
mov ecx, 0x9490c3ee
xor ecx, 0x49755e6e
mov eax, 0xe5e8e0a7
mov edx, dword [esp + 0xc]
jmp 0x51791c
mov ecx, dword [esp + 4]
test edx, edx
jmp 0x6034b5
dec eax
test bh, bh
cmc
test eax, eax
jmp 0x4c29ed
add byte [edi], cl
lea edx, [eax + eax]
add byte [eax], al
mov dword [esp + 0x20], ebp
cmp ebp, esi
mov dword [esp + 0x1c], eax
rcl ah, 0x78
xor ax, 0x1de7
cmovns eax, edi
mov eax, dword [esp + 0x38]
clc
add ebx, 4
jmp 0x602b07
loope 0x60344a
ljmp 0x2b2c:0xe3c166ff

Function at 0x4e8ba5
Capabilities:
Execute anti-debugging instructions

Disassembly:
add dword [eax], eax
add byte [ebx + 0x35013106], bh
add byte [ebx], dh
shr cl, 0x5e
sub al, 6
add byte [edx - 0x17], dl
or eax, 0x900018d7
nop
nop
nop
nop
nop
nop
jmp 0x4e8ba5
push esi
mov esi, ecx
jmp 0x63bbcf
add eax, dword [eax]
add cl, ch
inc eax
out 0xff, al
push edi
jmp 0x496727