joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10047290
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10047440
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1004735d
mov edx, dword [ebp - 4]
cmp edx, dword [0x100635d8]
jb 0x100472da
mov eax, dword [ebp - 4]
cmp eax, dword [0x100635dc]
ja 0x100472da
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100472aa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1001e410
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10047300
jmp 0x1004735d
cmp dword [ebp - 0x14], 0x10000
jne 0x10047343
cmp dword [ebp - 0x18], 0x10000
jb 0x10047343
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10047336
mov eax, dword [ebp - 8]
jmp 0x1004735f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10047358
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10047440
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100472aa
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10047370
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10047470
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10047435
mov edx, dword [ebp - 4]
cmp edx, dword [0x100635d8]
jb 0x100473b5
mov eax, dword [ebp - 4]
cmp eax, dword [0x100635dc]
ja 0x100473b5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10047385
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1001e410
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100473db
jmp 0x10047435
cmp dword [ebp - 0x14], 0x10000
jne 0x1004741e
cmp dword [ebp - 0x18], 0x10000
jb 0x1004741e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10047411
mov eax, dword [ebp - 8]
jmp 0x10047437
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10047430
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10047470
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10047385
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10048840
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100655a8], eax
je 0x10048865
mov eax, 0x10dd
jmp 0x10048a0d
cmp dword [0x100655ac], 0
je 0x10048878
mov eax, dword [0x100655ac]
jmp 0x10048a0d
cmp dword [ebp + 0xc], 0
jne 0x10048888
mov eax, 0x57
jmp 0x10048a0d
cmp dword [ebp + 8], 0
jne 0x10048898
mov eax, 6
jmp 0x10048a0d
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x100488c1
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x100655ac], ecx
mov edx, dword [ebp + 8]
mov dword [0x100655b0], edx
mov eax, dword [ebp - 8]
jmp 0x10048a0d
push 0x18
call fcn.10018720
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1004891a
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x100655ac], ecx
cmp dword [ebp - 4], 0
je 0x10048909
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.10017bc6
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x100655b0], ecx
mov eax, dword [ebp - 8]
jmp 0x10048a0d
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10048820
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10048820
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x1004895a
cmp dword [ebp - 0xc], 0x1e
jbe 0x10048976
mov dword [ebp - 8], 9
cmp dword [0x100655a0], 0
je 0x10048971
jmp 0x100488ea
jmp 0x100488e1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1004899d
mov dword [ebp - 8], 9
cmp dword [0x100655a0], 0
je 0x10048998
jmp 0x100488ea
jmp 0x100488e1
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100489ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100488e1
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x100655b8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x100655b8], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10048a20
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100655a8], eax
je 0x10048a3e
mov eax, 0x10dd
jmp 0x10048b1f
mov eax, dword [0x100655b8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10048abc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10048a9a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10048a9a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.100478f0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10017bc6
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10048a46
mov dword [0x100655b8], 0
call fcn.100481d0
mov ecx, dword [0x100655b4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10048b09
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10017bc6
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10048ad4
mov dword [0x100655b4], 0
mov dword [0x100655a8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10049000
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100655ac], 0
je 0x10049019
mov eax, dword [0x100655ac]
jmp 0x100490b9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1004902b
xor eax, eax
jmp 0x100490b9
push 8
call fcn.10018720
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10049081
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1004906a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10017bc6
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100655ac], eax
mov dword [0x100655b0], 0
mov eax, dword [ebp - 8]
jmp 0x100490b9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1004909b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1004904b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x100655b4]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x100655b4], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x14f4fdb
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
jmp 0x14f5015
xchg byte [esp], dl
ror bl, 0
mov eax, edx
jmp 0x14f4fff
cmc
jae 0x14f5063
inc ah
xchg dx, ax
adc ax, 0x92e7
mov eax, esp
jmp 0x14f5038
je 0x14f4fe2
xchg byte [esp], dl
jmp 0x14f4fe5
adc ax, 0x92e7
mov eax, esp
lea esp, [esp + 0x10]
call 0x14f5042
add esp, dword [esi + 0x35]
out 0x68, eax
rdtsc
inc ax
xchg dword [esp], ecx
neg ax
jmp 0x14f5080
inc ah
xchg dx, ax
jmp 0x14f5032
setge ah
btr eax, ecx
xchg dword [esp], ecx
xchg ah, dh
clc
mov dx, cx
jmp 0x14f5218
mov eax, 0x4fd6a960
mov eax, esp
lea ecx, [ecx - 0x25]
rdtsc
bt eax, ebp
mov al, 0x7f
jmp 0x14f506a
xchg edx, eax
push dword [esp]
ret 4

Function at 0x14f563c
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0
jnp 0x14f4f72
jp 0x14f4f72
xchg dword [esp + 7], ebx
mov ax, word [esp + 9]
bsr ax, bx
jmp 0x14f5670
mov dword [edi], edx
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
mov bx, word [esp]
mov dl, byte [esp]
and ax, sp
jmp 0x14f56e0
jmp 0x14f56c0
bsf ax, dx
jmp 0x14f5856
mov eax, 0x141cd436
setbe bl
inc dl
jmp 0x14f5751
jo 0x14f569d
jno 0x14f56c0
out dx, al
popal
int1
nop
arpl word [eax + 0x5730a230], sp
mov byte [0xf59a6364], al
in al, 0x17
jle 0x14f56ee
ror byte [ebp + 0xbd1c], cl
add byte [eax], al
pushfd
mov eax, edi
jmp 0x14f5738
lea ebp, reloc.iphlpapi.dll_GetAdaptersInfo
mov dx, ax
sub esp, 2
dec bx
jmp 0x14f57d7
mov dx, 0x7e08
xchg dword [esp + 4], ebp
bsf eax, edx
mov ebx, 0xad707d3b
lea ebx, [ebp + ebp]
lea edx, [ecx + ebx]
sub eax, 0x19148d00
jmp 0x14f5722
lea eax, [esi + 0x50]
lea edx, [ecx + esi]
push eax
call fcn.014f57a3
jae 0x14f574a
jnp 0x14f577f
in eax, dx
pop esi
mov ds, word [ecx]
js 0x14f57c2
neg ah
push dword [esp + 4]
ret 8
mov ebp, 0xbc8737c4
invalid
ret
lea ebx, [ecx + esi]
lea esp, [esp + 2]
xchg dword [esp + 4], ebp
ror eax, 0x1b
or dx, cx
mov bh, byte [esp]
jmp 0x14f5767
jge 0x14f56ca
mov eax, 0x141cd436
setbe bl
call 0x14f56f6

Function at 0x14f57a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edi, eax
jmp 0x14f60dc
jmp 0x14f5770
bts bx, si
jne 0x14f5786
je 0x14f5770
ja 0x14f5788
not ax
not dl
stc
jno 0x14f6100
bsr eax, eax
jmp 0x14f655d
jmp 0x14f611c
bsr eax, eax
jmp 0x14f655d
mov ebx, 0xd0077ac3
lea eax, [esi + 0x40]
mov bh, byte [esp]
mov bl, byte [esp]
call fcn.014f6185
xchg dword [esp + 0x30], esi
jmp 0x14f632d
stc
call 0x14f6374
add byte [eax], al
mov eax, 0x3bc8a939
clc
lcall 0xf8db, 0x1aef881a
jg 0x14f6331
mov bh, byte [ecx + 0x42]
sar bh, cl
je 0x14f636d
or eax, 0xd2474ff
lea esp, [esp + 2]
lea esi, reloc.iphlpapi.dll_GetAdaptersInfo
clc
call 0x14f6323
pushal
fsubr qword [edi]
and dword ss:[eax - 0x5d], esp
add esp, 1
lea esp, [esp + 3]
push dword [esp + 0x30]
ret 0x34
dec al
jmp 0x14f6310
mov edx, esi
add bl, 0x8f
jne 0x14f6509
dec al
mov ebx, 0xd0077ac3
jmp 0x14f6315
Function at 0x14f6586
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
dec dl
call fcn.014f65d3
sub dh, byte [ecx + 0x2b34021]
xor byte [ebx], dh
sub al, byte [ebp - 0xc]
push dword [esp + 1]
jno 0x14f6570
jo 0x14f6570
mov eax, 0x25848e9a
mov eax, ecx
jmp 0x14f659b
clc
jne 0x14f65e3
je 0x14f65e3
invalid
add dl, 0x27
dec eax
jmp 0x14f661b
lea eax, [ebx - 0x67]
push sp
lea esp, [esp + 2]
jmp 0x14f6624
jge 0x14f65ed
lea eax, [ebx - 0x67]
push sp
jmp 0x14f666b
sub dl, 0
bsf ax, bp
js 0x14f6655
sub esp, 0xe
xchg byte [esp + 2], al
jmp 0x14f6690
sub esp, 0xe
jmp 0x14f668c
lea esp, [esp + 2]
jmp 0x14f6624
xchg byte [esp + 2], al
call int.014f6671
mov ax, word [esp + 1]
jmp 0x14f66d9
lea esp, [esp + 2]

Function at 0x14f6671
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xd], edx
bts ax, cx
jo 0x14f6695
jno 0x14f66a0
iretd
mov ax, word [esp + 1]
lea esp, [esp + 2]
jmp fcn.014f66dd

Function at 0x14f671e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0
jmp 0x14f6769
pop word [esp]
lea esp, [esp + 2]
jmp 0x14f6753
sub cl, dl
sub esp, 0xc
jle 0x14f6775
add esp, 7
mov dx, word [esp + 2]
jmp 0x14f67c0
ja 0x14f6727
pop word [esp]
lea esp, [esp + 2]
jmp 0x14f6753
add esp, 7
jmp 0x14f677e
mov dx, word [esp + 2]
bswap eax
lea esp, [esp + 1]
jmp 0x14f67a9
dec ebp
not ax
mov dl, 0x2c
shl dl, cl
jl 0x14f67de
lea edx, [edi*4]
jmp 0x14f67e0
bswap eax
lea esp, [esp + 1]
jmp 0x14f67a9
lea edx, [edi*4]
cmp dx, 0x6c5d
jmp 0x14f6ced
jmp 0x14f67c8
cmp dx, 0x6c5d
lea edx, [ebx*4]
push cx
rdtsc
jmp 0x14f68ad
cmc
sub esp, 0x15
lea esp, [esp + 3]
inc eax
sub esp, 0x10
jp 0x14f6848
lea edx, [ebx*4]
push cx
rdtsc
jmp 0x14f68ad

Function at 0x14f6e05
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf14e2454
jmp 0x14f6e6b
mov dword [esp + 0x64], edi
jmp 0x14f6e22
lea esp, [esp + 0x64]
pushfd
jmp 0x14f1452
cpuid
jmp 0x14f6e86
cpuid
mov dl, byte [esp]
mov cx, 0x55b2
call fcn.014f6e70
jmp 0x6ded68c5
inc ecx
js 0x14f6e46
jns 0x14f6e4e
mov dl, byte [esp]
mov cx, 0x55b2
mov esi, dword [esp + 0x2c]
rdtsc
bsf bx, dx
jmp 0x14f6efc
bsr edx, ebx
or bh, 0x5f
jmp 0x14f6ed1
lea edi, [esp]
rdtsc
mov cl, byte [esp]
xchg bx, ax
jmp 0x14f6f1c
mov ebp, esp
clc
jnp 0x14f6f06
mov ax, 0x2553
bsf edx, ebx
jmp fcn.014f70da
jp 0x14f6ead
bsr edx, ebx
or bh, 0x5f
jmp 0x14f6ed1
mov ax, 0x2553
jmp 0x14f70d7
sub esp, 0xc0
jmp 0x14f6ede
bsf edx, ebx
Function at 0x14ff441
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x14ff9d9
jmp 0x14e2eab
jmp 0x14e2eda
mov dword [esp], edi
mov di, 0x748a
mov ax, di
lea edx, [eax - 0xf6]
xchg edx, eax
mov dx, 0xb739
jmp 0x14ff865
xchg dx, ax
mov dx, 0x194a
pushfd
xchg dl, ah
mov ah, byte [esp + 2]
lea eax, [esp + ebp]
jmp 0x14ff815
mov al, 0xd0
rdtsc
pop edx
lea eax, [edx*4]
jmp 0x14ff8b7
pop edi
mov al, ch
mov ax, si
lea edx, [ecx - 0x55]
lea eax, [edi + edi]
rdtsc
jmp 0x14ff84f
setle ah
lea eax, [ebx*4]
xchg al, ah
mov eax, dword [esp]
push edx
lea edx, [ebp*4]
jmp 0x14ff83d
mov ax, 0x3348
not ah
push bp
lea eax, [edi*4]
lea esp, [esp + 2]
pop eax
call fcn.01514dbd
jno 0x14ff929
mov edi, 0xe8de725f
pushfd
pop edi
mov di, 0x855a
mov di, word [esp]
jmp 0x14ff915
pushfd
push word [esp + 1]
mov dword [esp], eax
lea esp, [esp + 2]
mov dword [esp], eax
mov eax, 0xb0ff5af0
jmp 0x14ff888
not edi
mov ah, dl
push ebp
lea edi, reloc.iphlpapi.dll_GetAdaptersInfo
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
call fcn.014ff93f
cmc
mov di, word [esp]
push eax
lea eax, [edx + ebp]
mov eax, 0xaa43f361
mov eax, dword [esp]
mov al, ah
jmp 0x14ff8fe
lea ebp, [ebx*4]
mov bp, 0xfdc9
mov ebp, dword [esp + 4]
jmp 0x14ff999
lea edi, [esi + esi]
mov edi, esi
mov edi, dword [esp]
mov edi, dword [esp + 0xc]
lea esp, [esp + 0x10]
call fcn.01514f4a
and edx, dword [edi - 0x17]
add bl, byte [ebx + 1]
add byte [esi + 0x79], bh
out 0x77, eax
adc ah, cl
pop edi
sbb dword [eax], 0xab18e98e
cmc
in al, 0x17
invalid
mov edi, dword [esp]
bswap edi
mov edi, dword [esp]
xchg edi, eax
mov di, word [esp]
mov eax, dword [esp + 8]
jmp 0x14ff95b
pushfd
push word [esp]
call 0x1515aa1
insb byte es:[edi], dx
or ecx, edi
cmp ch, byte [edx + 0x6eaa5f38]
dec ebx
loop 0x14ffa0c
push es
jmp 0x14ff8e7
in eax, 0xff
invalid
Function at 0x151424d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
jmp 0x15141f2
jmp 0x15142b4
call 0x15142d3
inc edx
jmp 0x1513cb0
movzx ecx, dx
mov bl, ch
shl eax, 0x10
bswap edi
jmp 0x15142ff
movzx eax, word [ebp - 4]
jmp 0x1513c78
sub esp, 0x1e
jmp 0x1514220
jbe 0x1513c15
call fcn.01514208
loop 0x151424e
call [edx - 0x7ff73e97]
push ss
jno 0x1514168
inc ecx
mov ebp, 0x648d1f8c
lea esp, [esp + 8]
lea esp, [esp + 8]
jmp 0x15141d2
mov eax, ebp
jmp 0x1514236
pushal
sub ecx, eax
lea esp, [esp + 0x20]
jmp 0x1513cb0
stc
push dword [esp + 4]
lea esp, [esp + 5]
lea esp, [esp + 1]
jmp 0x1514241
lea eax, [eax - 0x10]
mov ecx, dword [eax]
pop eax
shr eax, 0x10
jmp 0x1514214
lea esp, [esp + 0x1c]
test ecx, ecx
call 0x151424d
fmul dword [ebp + reloc.iphlpapi.dll_GetAdaptersInfo]
xchg edx, ebp
stc
invalid
and al, 4
ja 0x1513c41
jbe 0x1514289
xor eax, 0xb94a2fbf
add bl, byte [0x90610690]
push ecx
lea ebx, [edi + ebp*2]
jbe 0x15142bc
push edx
lea esp, [esp + 1]
jmp 0x15142ec
push bx
push word [esp]
lea esp, [esp + 4]
jne 0x1513c9a
sub esp, 0x15
jmp 0x1514273
sub eax, dword [ebp + 0xc]
jmp 0x15142c3
sub edi, dword [ebp + 0xc]
push esi
lea esp, [esp + 4]
or eax, reloc.iphlpapi.dll_GetAdaptersInfo
jmp 0x151429e
cmp edi, eax
push di
lea esp, [esp + 2]
jbe 0x1513c70
ja 0x1514315
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x1513c75
lea esp, [esp + 0x14]
cmp edi, dword [ebp + 0xc]
jb 0x1513c9a
jae 0x1513c41
mov bh, byte [esp]
lea ebx, [ebp*4]
jmp 0x1514321
push bp
lea esp, [esp + 2]
dec ecx
jmp 0x1513c70
mov edi, dword [esp]
stc
mov ebx, dword [esp]
jmp 0x1514360
add eax, ecx
lea ebx, [eax*4]
jmp 0x151434a

Function at 0x160f084
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg edi
mov edx, esp
pop dword [esp + 0x15]
xchg dl, ch
jmp 0x160f094
lea edi, [eax*4]
pop di
mov dx, 0x115b
mov byte [esp + 0x11], dl
xchg di, bp
jmp 0x160f104
cpuid
bswap ebx
mov word [esp + 0xd], bx
bsr ebx, esp
mov ebx, 0xa48ef4fa
jmp 0x160f0e7
clc
lea edi, reloc.iphlpapi.dll_GetAdaptersInfo
inc ebx
mov bx, 0x8a08
xchg dl, ah
setbe ch
jmp 0x160f0b9
mov dx, word [esp + 0x18]
pop edx
mov eax, dword [esp + 0xc]
mov word [esp + 9], bp
inc ebp
pop dword [esp + 7]
jmp 0x160f15d
mov ebx, 0x369acb8
neg cx
mov dx, si
mov dh, byte [esp + 3]
bsr bx, dx
stc
jmp 0x160f0d4
lea edi, [esi*4]
mov dword [esp], eax
push dword [esp + 5]
stc
jmp 0x160f144
rcl ah, cl
rdtsc
lea edi, [ebx + 4]
mov ebp, dword [esp]
rdtsc
lea esi, reloc.iphlpapi.dll_GetAdaptersInfo
jmp 0x160f11a
lea esi, [esp - 0xcc]
mov al, 0x10
lea esi, reloc.iphlpapi.dll_GetAdaptersInfo
mov dword [esp + 1], ebx
jmp 0x160f1cb
adc dl, 0x1d
xchg byte [esp + 5], ah
cpuid
sub esp, 0x18
add esp, 0x24
lea ebx, [ebp*4]
jmp 0x160f130
cmc
push dword [esp + 3]
xchg bh, cl
stc
lea ebp, [ebp*4]
xchg ch, dl
jmp 0x160f198
inc bp
pop edx
xor di, bx
dec cl
mov eax, edi
neg si
jmp 0x160f1ae
Function at 0x160f45a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x160f4c1
lea eax, [esi + ebp]
mov dword [esp + 0x29], eax
lea ebx, reloc.iphlpapi.dll_GetAdaptersInfo
xchg dx, bp
jmp 0x160f4d8
btc bx, si
mov bp, bx
mov edx, 0x868b278
push dword [esp]
stc
pop word [esp + 0x2a]
jmp 0x160f4ab
mov dword [esp + 0x19], edi
add esp, 0x10
pop ebp
bsr cx, sp
inc si
jmp 0x1610473
xchg word [esp + 0x1c], di
not edi
mov dword [esp + 0x20], edx
xchg di, bp
push dword [esp + 3]
mov dl, byte [esp + 0x27]
jmp 0x160f50e
neg dh
mov dword [esp + 0x2e], edx
xchg dword [esp + 0x2f], esi
inc dh
lea edi, [edi + ebp]
bswap eax
jmp 0x160f54e
push word [esp + 0x2c]
mov dword [esp + 0x15], ebp
xchg ebp, ecx
bswap eax
neg ch
pop word [esp + 9]
jmp 0x160f5cc
bsr ecx, ebp
push word [esp + 9]
mov al, byte [esp + 0x37]
dec ax
mov dword [esp + 0x11], ebx
cpuid
jmp 0x160f62e
sub esp, 0x13
xchg dx, bx
mov esi, 0xb76bc67e
mov esi, 0x94744dfa
mov al, byte [esp + 3]
mov ax, 0xc31b
jmp 0x160f880
lea edi, [eax + edi]
push ax
cmc
not si
push word [esp]
mov al, byte [esp + 0x16]
jmp 0x160f904

Function at 0x1613dbf
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [ebx + edi]
lea edx, [esp + 0xfd]
xchg word [esp + 1], cx
lea esp, [esp + 7]
clc
rcr esi, 0x1f
jmp 0x1613dce
mov word [esp + 3], di
rdtsc
bswap esi
mov bx, 0x204d
jmp 0x1613da2
xchg word [esp + 1], bp
lea ebx, reloc.iphlpapi.dll_GetAdaptersInfo
xchg si, ax
push esp
lea edx, [eax + ecx]
push dword [esp + 5]
jmp 0x1613e15
pop si
push word [esp + 1]
xchg dh, ch
bsr edx, eax
mov word [esp + 7], ax
mov word [esp + 9], di
jmp 0x1613dff
Function at 0x1614355
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
call fcn.016132f9
mov dword [esp], ebp
push esi
pushal
push word [esp + 0x1a]
push dword [esp + 0x15]
jmp 0x1614357
jmp 0x161433f
lea esp, [esp + 2]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x16143b8
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x16132f4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x1614398

Function at 0x1614370
Capabilities:
Packed with generic packer

Disassembly:
pop word [esp]
mov word [esp], di
lea esp, [esp + 2]
push esp
call fcn.01614355
Function at 0x402f0f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408010]
jne 0x404450
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x409368], eax
mov dword [0x409364], ecx
mov dword [0x409360], edx
mov dword [0x40935c], ebx
mov dword [0x409358], esi
mov dword [0x409354], edi
mov word [0x409380], ss
mov word [0x409374], cs
mov word [0x409350], ds
mov word [0x40934c], es
mov word [0x409348], fs
mov word [0x409344], gs
pushfd
pop dword [0x409378]
mov eax, dword [ebp]
mov dword [0x40936c], eax
mov eax, dword [ebp + 4]
mov dword [0x409370], eax
lea eax, [ebp + 8]
mov dword [0x40937c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4092b8], 0x10001
mov eax, dword [0x409370]
mov dword [0x40926c], eax
mov dword [0x409260], 0xc0000409
mov dword [0x409264], 1
mov eax, dword [0x408010]
mov dword [ebp - 0x328], eax
mov eax, dword [0x408014]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x4092b0], eax
push 1
call fcn.00406093
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x401d80
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x4092b0], 0
jne 0x40453c
push 1
call fcn.00406093
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x403c8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x403c9b
pop dword [ebp - 0x34]
mov eax, 0x403c9b
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xf4688435
add dword [ebp - 0x44], 0x59e9c116
mov dword [ebp - 0x40], 0x548e588d
sub dword [ebp - 0x40], 0x225b0c48
mov dword [ebp - 0x3c], 0x54c517ba
sub dword [ebp - 0x3c], 0x878d38c
mov dword [ebp - 0x38], 0x51937231
sub dword [ebp - 0x38], 0x51937231
lea eax, [ebp - 0x44]
push eax
mov eax, 0xdcd5e29f
sub eax, 0xdc95d283
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x2540a9f3
add dword [ebp - 0x44], 0x4f31bf63
mov dword [ebp - 0x40], 0xd5310cd4
add dword [ebp - 0x40], 0x6c3b54a1
mov dword [ebp - 0x3c], 0x75995763
sub dword [ebp - 0x3c], 0x1229eaf7
mov dword [ebp - 0x38], 0xe4283de
add dword [ebp - 0x38], 0xf1bd7c22
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x9c61c8ff
sub eax, 0x9c21b8db
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3832b
push 0
call eax
mov ecx, 0xd1ce9bd2
sub ecx, 0xd1ce52b8
mov edi, eax
mov edx, 0xffdf244d
add edx, 0x6413b3
add edx, dword [ebp - 0x34]
mov esi, 0x5fb79ed
add esi, 0xab274e46
xor dword [ebp - 0x14], 0xbca152e1
mov ebx, dword [edx]
xor dword [ebp - 0x20], ecx
sub ebx, esi
xor dword [ebp - 0x28], ebx
mov dword [edi], ebx
sub dword [ebp - 0x10], eax
add edi, 0x90520b90
add edi, 0x6fadf474
add edx, 0xd53729ad
sub edx, 0xd53729a9
loop 0x403db8
add eax, 0x76912d62
sub eax, 0x76901627
mov ebx, eax
add eax, 0x4d74795
sub eax, 0x4d74790
mov ecx, 0x264bbe6b
add ecx, 0xd9f44195
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x401003
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040105a