joyce8/EMBER2024-capa huggingface dataset:
Function at 0x214102c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x2141036
pushal
call 0x214103c
pop ebp
sub ebp, 0x10
sub ebp, 0x1d4102c
jmp 0x2141052
mov eax, 0x1d4102c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c1
mov edx, 0x8f65b932
xor byte [eax], dl
inc eax
dec ecx
jne 0x2141069
jmp 0x214107c
mov ecx, 0xebbb9ff
xor dh, byte [edx]
xor dh, byte [ebx + 0x3232caf3]
xor dh, byte [ecx]
dec dword [edx + 0x3232323b]
mov byte [edx], bl
xor dh, byte [edx]
xor al, ch
sal byte [ecx], 1
cli
mov ecx, 0x32323eb3
xor dh, byte [ecx]
idiv dword [edi - 0x4431e9aa]
push ss
mov edi, 0xbbce1656
push ss
pop edx
lcall 0x72b6, 0x5a322dfd
xchg byte [ebx], dh
xor ebx, dword [esi]
push ss
pop edx
nop
add dword [ecx], ebx
iretd
Function at 0x452490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x45249f
pop dword [ebp - 0x10]
mov eax, 0x45249f
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x4824c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xc6088ee2
add ecx, 0x39f7b9f0
mov edx, eax
mov esi, 0x4ae800
add esi, dword [ebp - 0x10]
mov ebx, 0x1a8390af
xor dword [ebp - 4], 0x2fa738cc
mov edi, dword [esi]
sub edi, ebx
sub dword [ebp - 4], ecx
mov dword [edx], edi
sub dword [ebp - 8], ecx
add edx, 0xdf05d6fc
sub edx, 0xdf05d6f8
add esi, 0xab7a0eac
add esi, 0x5485f158
loop 0x4524e8
add eax, 0xe348b2f6
sub eax, 0xe3479cdb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x14d6c334
sub ecx, 0x1496c334
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x458822
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [eax*4]
push dword [esp + 1]
xchg edx, eax
call fcn.004587ea
xchg byte [edi], al
xchg edi, eax
add dword [ecx + reloc.KERNEL32.dll_RtlUnwind], edi
mov eax, 0x3784150b
push ds
imul ebp, ebx, 0x20ebf8dc
jmp 0x458800
clc
jmp 0x458847
invalid
jmp 0x458800

Function at 0x47bf20
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
jmp 0x47bf53
mov edi, dword [esp + 0x10]
sub esp, 0xb
sub esp, 0x16
lea esp, [esp + 1]
jmp 0x47bf9b
lea esp, [esp + 8]
jae 0x47be7e
cmc
jmp 0x47bf3d
movzx edi, byte [ebx]
pop ebx
shl edi, cl
lea esp, [esp + 0x20]
jmp 0x47bfb9
push ebx
mov ebx, edi
lea ebx, [eax + ebx]
jmp 0x47bf7f
dec eax
call fcn.0047bfdc
and byte [ebx + 0x6b54623], dh
mov ah, 0x2a
dec ebp
mov esp, 0xa360210c
fiadd dword [ebx - 0x1f6f73f]
add ecx, 8
or esi, edi
push sp
lea esp, [esp + 2]
jmp 0x47bfa3

Function at 0x47bfe8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [edi + edx*4], esi
lea esp, [esp + 0xc]
inc edx
jmp 0x47c09b
lea esp, [esp + 4]
mov edi, dword [esp + 0xc]
sub esp, 0xc
jmp 0x47be83
cmp edx, 0x41
pushal
lea esp, [esp + 0x20]
jb 0x47bf13
jae 0x47be52

Function at 0x52402d
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 2], dh
push dword [esp + 1]
mov dword [esp + 2], esp
jmp 0x52406c

Function at 0x52405b
Capabilities:
Parse pe header

Disassembly:
push dword [esp + 2]
mov byte [esp + 4], al
mov dword [esp + 0xc], edx
call fcn.00524000
pop word [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 8], ebp
pushal
pop dword [esp + 5]
pop dword [esp + 2]
jmp 0x524097
mov dword [esp + 0x12], ecx
mov dword [esp + 0x1c], esi
push ax
mov byte [esp], bl
call 0x5240aa
outsb dx, byte [esi]
push word [esp + 2]
mov byte [esp + 5], al
jmp 0x5240e6
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x5240cf

Function at 0x5240aa
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push dword [esp + 2]
mov byte [esp + 4], al
mov dword [esp + 0xc], edx
call fcn.00524000
pop word [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 8], ebp
pushal
pop dword [esp + 5]
pop dword [esp + 2]
jmp 0x524097
mov dword [esp + 0x12], ecx
mov dword [esp + 0x1c], esi
push ax
mov byte [esp], bl
call 0x5240aa
outsb dx, byte [esi]
push word [esp + 2]
mov byte [esp + 5], al
jmp 0x5240e6
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x5240cf

Function at 0x5240c1
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x520091
call 0x524010
jmp 0x52410f
movzx ebx, word [eax + 0x3c]
jmp 0x5240f9
push dword [esp + 5]
push word [esp + 7]
call fcn.00524095
mov eax, dword [eax + 0x1c]
jmp 0x52413f
add ebx, eax
jmp 0x52411e
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x524129
cmp word [ebx], 0x4550
jmp 0x524191
je 0x524084
sub eax, 0x10000
jmp 0x524113
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x52400b
je 0x51df9c
jne 0x52412f
mov dword [eax - 0x2a], reloc.KERNEL32.dll_RtlUnwind
std
insd dword es:[edi], dx
hlt
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x100023dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x100023eb
pop dword [ebp - 0x34]
mov eax, 0x550c2c61
add eax, 0xbaf3f78a
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x2c2ef0da
sub dword [ebp - 0x44], 0xdddcab8f
mov dword [ebp - 0x40], 0xffd6d395
add dword [ebp - 0x40], 0x325c78b0
mov dword [ebp - 0x3c], 0x68da4976
add dword [ebp - 0x3c], 0xe371fab8
mov dword [ebp - 0x38], 0x80db032e
add dword [ebp - 0x38], 0x7f24fcd2
lea eax, [ebp - 0x44]
push eax
mov eax, 0xe4bba9cc
sub eax, 0xd4bb09c8
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xbaf197c1
sub dword [ebp - 0x44], 0x467f2e6b
mov dword [ebp - 0x40], 0x637738cb
sub dword [ebp - 0x40], 0x220ad756
mov dword [ebp - 0x3c], 0x717f188
sub dword [ebp - 0x3c], 0xa3a8851c
mov dword [ebp - 0x38], 0xa1a81858
sub dword [ebp - 0x38], 0xa1a81858
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x375a7
push 0
call eax
mov ecx, 0x712624d1
sub ecx, 0x7125d9d1
mov edi, eax
mov ebx, 0x85c9d2d0
add ebx, 0x8a372530
add ebx, dword [ebp - 0x34]
mov esi, 0x72a2d060
sub esi, 0xbe1080c7
sub dword [ebp - 0x18], 0x334d4b99
mov edx, dword [ebx]
xor dword [ebp - 0x30], esi
xor edx, esi
sub dword [ebp - 0x30], 0x6bc31315
mov dword [edi], edx
mov dword [ebp - 0x20], 0xd84337ac
add edi, 4
add ebx, 0xf1e6e5c3
sub ebx, 0xf1e6e5bf
loop 0x10002508
add eax, 0x11ed3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xf2ae9a67
add ecx, 0x1d516599
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x4025a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
lea eax, [ebp - 0x124]
mov ecx, eax
lea eax, [ebp - 0x13c]
mov edx, eax
mov eax, 1
call fcn.004043b0
call fcn.004044b0
push eax
test eax, eax
jne 0x402785
mov eax, dword [ebp - 4]
test eax, eax
je 0x402604
jmp 0x40262c
push 0x105
lea eax, [ebp - 0x118]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x118]
lea eax, [ebp - 8]
call fcn.00404c70
jmp 0x402785
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00402a00
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
call fcn.00402a60
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x402659
jmp 0x40265b
jmp 0x402672
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, 0
jl 0x402672
jmp 0x402668
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
je 0x402672
jmp 0x402634
lea edx, [ebp - 0x144]
mov eax, edx
call fcn.004044e0
mov dword [ebp - 0x144], 0
mov ebx, dword [ebp - 0xc]
sub ebx, dword [ebp - 0x10]
mov esi, 1
lea edx, [ebp - 0x148]
mov eax, edx
call fcn.004044e0
mov dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x10]
call fcn.00404cb0
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
mov ecx, ebx
mov edx, esi
call fcn.00404d10
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
call fcn.00404dd0
lea edx, [ebp - 8]
mov eax, edx
call fcn.004044e0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x4026fd
mov eax, dword [eax - 4]
cmp eax, 2
jge 0x402707
jmp 0x402785
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x22
je 0x402712
jmp 0x402785
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x40271f
mov eax, dword [eax - 4]
mov al, byte [edx + eax - 1]
cmp al, 0x22
je 0x402729
jmp 0x402785
lea edx, [ebp - 0x148]
mov eax, edx
call fcn.004044e0
mov dword [ebp - 0x148], 0
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x40274a
mov ecx, dword [ecx - 4]
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00404d10
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
call fcn.00404dd0
lea edx, [ebp - 8]
mov eax, edx
call fcn.004044e0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 8], eax
call fcn.004045b0
lea edx, [ebp - 0x148]
mov eax, edx
call fcn.004044e0
mov dword [ebp - 0x148], 0
lea edx, [ebp - 0x144]
mov eax, edx
call fcn.004044e0
mov dword [ebp - 0x144], 0
pop eax
test eax, eax
je 0x4027cf
mov edx, str._t_nAnsiString
lea eax, [ebp - 8]
call fcn.00404840
call fcn.00404640
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x150]
mov esi, dword [ebp - 0x14c]
leave
ret
Function at 0x402880
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x88]
cmp eax, 2
je 0x4028ac
jmp 0x4028e9
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x94]
cmp eax, 6
jae 0x4028bd
jmp 0x4028c3
mov byte [ebp - 4], 6
jmp 0x4028e7
mov eax, dword [ebp - 0x94]
cmp eax, 5
jae 0x4028d0
jmp 0x4028e7
mov eax, dword [ebp - 0x90]
cmp eax, 1
jae 0x4028dd
jmp 0x4028e3
mov byte [ebp - 4], 5
jmp 0x4028e7
mov byte [ebp - 4], 4
jmp 0x40292b
mov eax, dword [ebp - 0x88]
cmp eax, 1
je 0x4028f6
jmp 0x402927
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x94]
cmp eax, 4
ja 0x402921
jmp 0x402907
mov eax, dword [ebp - 0x94]
cmp eax, 4
je 0x402914
jmp 0x402925
mov eax, dword [ebp - 0x90]
cmp eax, 0xa
jae 0x402921
jmp 0x402925
mov byte [ebp - 4], 2
jmp 0x40292b
mov byte [ebp - 4], 0
mov al, byte [ebp - 4]
leave
ret
Function at 0x41a150
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
push 0x10
call sub.user32.dll_GetKeyState
movsx eax, ax
cmp eax, 0
jl 0x41a16e
jmp 0x41a177
mov eax, dword [ebp - 4]
or eax, 4
mov dword [ebp - 4], eax
push 0x11
call sub.user32.dll_GetKeyState
movsx eax, ax
cmp eax, 0
jl 0x41a188
jmp 0x41a191
mov eax, dword [ebp - 4]
or eax, 8
mov dword [ebp - 4], eax
push 0x12
call sub.user32.dll_GetKeyState
movsx eax, ax
cmp eax, 0
jl 0x41a1a2
jmp 0x41a1ab
mov eax, dword [ebp - 4]
or eax, 0x20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x54a92e
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp 0x54a938
mov byte [edx + 2], cl
jmp 0x589086
cmp edi, 3
jmp 0x588fc0
pushal
call fcn.00588ff6
mov byte [eax], cl
sahf
stc
or byte [edi + 0x5c35a526], bh
scasd eax, dword es:[edi]
imul edx, dword [edi + eax*8 + 0x6e], 0x79
mov ecx, dword [ebp + 8]
mov dl, byte [esp]
jmp 0x588fa1
jb 0x5884ff
stc
call fcn.00588f5f
adc eax, 0x88791e88
cmp al, 0xa5
aam 0x47
out dx, al
lea esp, [esp + 4]
pop esi
cmp edi, 2
jmp 0x588f1f
jns 0x588f2b
mov byte [ebx - 2], bh
fcomp dword [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
ljmp 0x71b9
or eax, ecx
lea esp, [esp + 8]
jmp 0x58855d
mov edx, eax
shr edx, 0x10
call 0x588fcd
popal
out 0x74, al
adc ebp, esi
sub dl, byte [ecx + 0x1dee8b1b]
scasb al, byte es:[edi]
stc
jl 0x588fcc
jne 0x588f40
xor eax, 0xf8b68c9
test dword [edi - 0x6300000b], edx
jne 0x58855d
pushfd
mov dword [esp], esp
push ecx
jmp 0x588f96
leave
push word [esp + 3]
pushfd
jmp 0x589125
mov byte [ecx + 1], dl
jmp 0x588547
mov edx, eax
shr edx, 8
lea esp, [esp + 4]
jmp 0x58900c
cmp dword [ebp + 0xc], 3
pushal
jmp 0x5896e1
jb 0x588547
push ecx
mov dh, cl
dec dx
lea edx, [edi + edi]
jmp 0x589037
jmp 0x5895b8
call 0x58969e
mov bl, byte [ecx]
mov eax, ebp
sbb ebp, dword [esi - 0x70178514]
jp 0x5890c2
invalid
pushfd
jmp 0x5895ee
mov byte [edx + 3], cl
jmp fcn.00589134
lea esp, [esp + 2]
lea esp, [esp + 8]
mov byte [ecx], dl
cmp edi, 2
jmp 0x5890b7
call 0x58960c
inc ecx
invalid
lea esp, [esp + 0xc]
jae 0x5890f8
call fcn.00589604
pop ss
adc byte [esi], 0x71
xor byte [edi], 0xbd
cmp ebx, 0x34
pushal
lea esp, [esp + 0x13]
lea esp, [esp + 1]
jmp 0x5895a2
jae 0x5890ca
mov cx, 0x6735
setg cl
lea ecx, [ebx + 0x41]
jmp 0x58910e
cmp ebx, eax
jmp 0x589622
lea esp, [esp + 4]
jae 0x58914a
lea ecx, [ebx - 4]
jmp 0x58910e
lea esp, [esp + 0x20]
jne 0x5890e2
cmp ebx, 0x1a
jmp 0x5895d3

Function at 0x55b566
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jmp 0x55b570
mov dx, ax
mov dx, word [esp]
lea edx, [eax + 0x996]
sub esp, 0xc
jle 0x55c827
jg 0x55c827
stc
sub esp, 0x14
add esp, 4
push dword [esp + 0x30]
ret 0x34
add eax, 0xdaa9bcb8
jmp fcn.0055c849
call fcn.0055bca2
jmp 0x55c85f
not dh
jmp 0x55b5d8
Function at 0x55baff
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0548fa8
jmp 0x55bc24
push word [esp + 7]
ja 0x55bb2e
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
push ecx
push dword [esp + 2]
jmp 0x55bb4f
jmp 0x55bb7c
mov word [esp + 2], sp
jmp 0x55bb6e
push dword [esp + 2]
mov word [esp + 2], sp
mov word [esp + 2], bx
jmp 0x55bb9d
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
push ecx
jmp 0x55bb65
mov dword [esp + 0xc], esp
call fcn.0055bb87
push ebp
mov word [esp], sp
push dword [esp + 1]
jnp 0x55bc3f
jp 0x55bc00
dec cl
push 0x6c89228b
mov dword [esp + 0x10], ebp
pushfd
mov byte [esp], bl
mov dword [esp + 0x10], esi
jmp 0x55bba6
lea esp, [esp + 0x18]
jmp 0x55bc4f
push dword [esp + 6]
mov dword [esp + 3], ecx
mov dword [esp + 0x18], edi
jmp 0x55bbea
mov bx, dx
jmp 0x55bc55
and cl, 0x21
jae 0x55bc0e
jb 0x55bc6b
mov byte [edx - 0x30], 0xb7
inc edx
test dword [edi + eax - 0x41fe0d69], 0x492eb832
mov eax, 0xff841508
je 0x55bc66
push dword [esp + 6]
push es
mov dword [esp + 3], ecx
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
pushfd
jmp 0x55b59a
mov esi, dword [esp + 0x2c]
btc edi, edx
jg 0x55bc86
rdtsc
jmp 0x55bc88
mov ebp, 0x88691e7e
mov bx, dx
jmp 0x55bc55
rdtsc
call fcn.0055bc70
stosd dword es:[edi], eax
and al, 0xba
invalid

Function at 0x55bb45
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 3]
call fcn.0055baff

Function at 0x55bb87
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], sp
call fcn.0055bbbc
inc ecx
loope 0x55bc05
adc bl, ah
mov al, byte [0x64751ae3]
xchg edi, eax
dec esp
and al, 3

Function at 0x55bca2
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 1
lea esp, [esp + 1]
xchg dword [esp], edi
call fcn.0055b651
sub esp, 0xbc
call fcn.0055c0e4
add al, 0x96
add al, 0x63
sahf
pop ebp
xchg dword [esi], ebp
cmp dword [eax], ebx
jnp 0x55bc55
insb byte es:[edi], dx
and al, 4
mov eax, esi
lea edi, [esp + edi]
push bp
lea esp, [esp + 2]
jmp 0x55bcb1

Function at 0x55c5f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], edi
push esi
pop dx
push word [esp + 1]
mov dl, byte [esp + 3]
lea edi, [edi + 0x3d]
btr eax, edi
mov dh, byte [esp]
rcl ax, 0xf
rdtsc
stc
jmp 0x55c5cd

Function at 0x55c7ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
jae 0x55c7ea
lea esp, [esp + 2]
lea esp, [esp + 4]
popal
jmp 0x55c9ee
jmp 0x55c80e

Function at 0x55c82c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jmp 0x55b570
mov dx, ax
mov dx, word [esp]
lea edx, [eax + 0x996]
sub esp, 0xc
jle 0x55c827
jg 0x55c827
stc
sub esp, 0x14
add esp, 4
push dword [esp + 0x30]
ret 0x34
add eax, 0xdaa9bcb8
jmp fcn.0055c849
call fcn.0055bca2
jmp 0x55c85f
not dh
jmp 0x55b5d8
Function at 0x55f163
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x87f44ab4
lea esp, [esp + 2]
jmp 0x55f118
sub esp, 0x12
jmp 0x55f0e3
pushfd
jmp 0x55f181
lea esp, [esp + 0x10]
add bl, 0xfe
mov dh, 0x3d
xchg edx, eax
mov eax, dword [esp]
jmp 0x55f102
neg bl
mov ax, 0xf87d
btr edx, ecx
jae 0x55f0fd
sub esp, 0x12
mov eax, 0x87f44ab4
lea esp, [esp + 2]
jmp 0x55f118
mov dl, 0x6b
lea esp, [esp + 4]
jmp 0x55f135
jmp 0x55f20b
lea esp, [esp + 4]
neg bl
mov ah, byte [esp]
neg dx
jge 0x55f16b
rdtsc
jmp 0x55f1c8
lea edx, [edi*4]
jmp 0x55f214
jb 0x55f1a7
jae 0x55f1a7
rdtsc
lea edx, [edi*4]
mov edx, ebx
mov al, byte [esp]
lea eax, [ecx*4]
neg al
jmp 0x55f1e7

Function at 0x5873d8
Capabilities:
Encrypt data using aes

Disassembly:
bswap esi
push ebp
mov ebp, ecx
jmp 0x587326
mov ebp, 0x64caccd4
xor edx, esi
inc bl
mov esi, 0x2b500c96
mov edi, 0x95f685e5
jmp 0x5872f6
add ebp, 4
mov dword [ebp], edx
pop ebp
sub esp, 0x18
mov dx, word [esp + 0xe]
add esp, 0xc
jmp 0x587391
shl edx, 8
jmp 0x587311
xor edx, esi
jmp 0x587379
shl edx, 8
rcr ebx, 7
sub esp, 3
lea esp, [esp + 3]
jmp 0x587354
movzx esi, byte [eax + 0xa]
rol bl, cl
mov bx, word [esp]
mov bl, 0xcc
jmp 0x5873b7
lea esp, [esp + 0x10]
movzx edx, byte [eax + 8]
movzx esi, byte [eax + 9]
xchg ebx, ebp
jmp 0x58736a
xor edx, esi
bswap edi
jmp 0x5873cb
shl edx, 8
mov bh, byte [esp]
and bl, bh
lea edi, [0x90377e3a]
mov di, word [esp]
jmp 0x5873a1
movzx esi, byte [eax + 0xb]
lea ebp, [esp + eax]
call 0x5873d8
mov dh, 0xc1
loop 0x5873e3
jmp 0x58746f
shl byte [ebx], 1
jecxz 0x5873e4
and esp, ebx
std
invalid
lea esp, [esp + 4]
movzx edx, byte [eax + 0xc]
pushal
btc edi, eax
lea esp, [esp + 0x20]
jmp 0x5873fe
xor edx, esi
mov bh, al
mov dword [ecx + 8], edx
bsf si, sp
jmp 0x587414

Function at 0x587615
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x58789a
lea edi, [ecx + 0x10]
sub esp, 9
mov byte [esp], ah
call fcn.0058767f
lea esp, [esp + 4]
xor eax, dword [ecx]
lea edi, [edi*4]
mov edi, dword [esp]
lea edi, [ecx + ebp]
jmp 0x58769a
xor eax, edi
sub esp, 1
rol edi, 0x1d
mov byte [esp], bh
lea esp, [esp + 1]
jmp 0x587718

Function at 0x58767f
Capabilities:
Encrypt data using aes

Disassembly:
xor ebx, eax
jmp 0x5876c9
lea esp, [esp + 1]
jmp 0x587669

Function at 0x5879ab
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x5879e2
xchg ebp, eax
pushal
jmp 0x5879f3
lea esp, [esp + 4]
jne 0x549e19
not bp
push 0xa
jmp 0x5879cc
lea esp, [esp + 0x20]
pop eax
bswap edi
mov si, 0x3536
call fcn.00587b78
add byte [eax], al
js 0x587a01
xchg edx, eax

Function at 0x587cb9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
sub esp, 0x12
add esp, 4
lea esp, [esp + 2]
jmp 0x587cbb
jmp 0x587ca3
mov edi, dword [edi*4 + 0x5553b0]
call fcn.00587cfe
ljmp 0xf9c6

Function at 0x587d1d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
jl 0x54a41f
mov eax, dword [ebp - 8]
jmp 0x54a460
lea esp, [esp + 4]
cmp dword [ebp - 4], ebx
pushfd
jmp 0x587c91
Function at 0x587f0e
Capabilities:
Encrypt data using aes

Disassembly:
push ecx
mov ecx, esi
add ecx, 8
jmp 0x587eef
mov edx, dword [ecx]
pop ecx
stc
mov dword [esi + 4], edi
mov di, word [esp]
jmp 0x587f2b
mov edx, 0xb97139ea
jmp 0x587ee3
mov di, sp
mov ebx, dword [ebx*4 + 0x554fb0]
mov edi, edx
call 0x587f15

Function at 0x588068
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov word [esp], si
jmp 0x588072
mov edx, dword [edx*4 + 0x554fb0]
jmp 0x5880a8
mov edx, dword [esi + 0xc]
stc
sub esp, 0x1e
add esp, 0
lea esp, [esp + 2]
jmp 0x5880b8
and edx, ecx
pushal
lea esp, [esp + 0x28]
xor edi, dword [edx*4 + 0x555fb0]
jmp 0x58808c
mov dword [esi + 8], edi
mov edi, ebp
push ebp
jmp 0x588116
lea edi, [edx*4]
pushal
not eax
not ebx
mov dword [esp], edx
jmp 0x588100
popal
jmp 0x58818a
mov ebp, ebx
lea ebp, [ebp*4]
lea ebp, [ebp + 0x554fb0]
mov ebx, dword [ebp]
pop ebp
jmp 0x5880c0
and edi, ecx
jmp 0x588169
lea ecx, [ecx*4]
lea ecx, [ecx + 0x554fb0]
mov edi, dword [ecx]
pop ecx
jmp 0x58812b
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + 0x555bb0]
inc bh
jmp 0x5881a8
mov edi, dword [edi*4 + 0x5553b0]
clc
and ebx, ecx
jmp 0x588153
shr edi, 0x18
push ecx
mov ecx, edi
jmp 0x588141
movzx ebx, byte [esi + 0xe]
call fcn.00588192

Function at 0x5882c6
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
jne 0x54a435
je 0x54a409
lea esp, [esp + 2]
jmp 0x588267

Function at 0x5893b8
Capabilities:
Encode data using base64

Disassembly:
push si
lea esp, [esp + 2]
mov ecx, dword [ebp + 8]
jmp 0x54a839
mov byte [ecx], dl
cmp esi, 0x1a
jmp 0x58948b
push si
lea esp, [esp + 2]
jmp 0x589475
push dx
call fcn.0058946d
mov dword [eax - 0xcaeada], ebx
xor eax, 0xfbeb5d79
mov ds, word [ecx]
js 0x54a8f7
cmp dword [ebp + 0xc], 2
mov dx, 0xad8a
mov dx, word [esp]
jmp 0x5894fc
mov byte [edx + 2], 0x3d
jmp 0x589086
cmp edi, 0x34
push cx
xor al, 0x66
push ecx
lea esp, [esp + 2]
jmp 0x58ae18
cmp esi, eax
call fcn.005894cb
inc ecx
ret
call fcn.00589777
jmp 0x58a05e
mov dword [esp], esp
mov byte [esp + 1], ah
jmp 0x5893e2
cmp ecx, eax
lea esp, [esp + 4]
jae 0x54a886
lea edx, [ecx + edx]
jmp 0x589427
lea edx, [ecx - 4]
jmp 0x54a82a
mov dx, 0xfb89
setae dl
jmp 0x589411
cmp esi, 0x34
push edx
jmp 0x589499
jae 0x54a869
lea ecx, [esi + 0x41]
jmp 0x54a89c
lea esp, [esp + 4]
jae 0x54a913
setne ch
mov ch, byte [esp]
mov ecx, ebx
jmp 0x5894c3
lea ecx, [esi + 0x47]
jmp 0x54a89c
lea ecx, [ecx*4 + 0x2b]
jmp 0x54a89c
mov edx, dword [ebp + 8]
mov byte [edx + 1], cl
jb 0x54a8c9
jae 0x589522
sbb al, byte [esi + 0x4f8e7314]
test al, 0x3b
stosd dword es:[edi], eax
into
cmp eax, 0x8e99e8f
xor ecx, ecx
cmp esi, eax
setne cl
jmp 0x5894f0
clc
cmp edi, 0x1a
jae 0x54a8f5
mov cx, di
jmp 0x589571
lea ecx, [edi + 0x41]
jmp 0x54a929
mov cx, 0xf2b6
lea ecx, [esp - 0x35a9]
jmp 0x58955b
cmp edi, eax
call fcn.00589ddb
jae 0x58906a
mov cx, word [esp]
lea ecx, [edi + 0x47]
jmp 0x54a929

Function at 0x5893ff
Capabilities:
Encode data using base64

Disassembly:
not edx
mov dl, byte [esp + 1]
lea esp, [esp + 4]
lea edx, [ecx + 0x41]
jmp 0x54a82a