joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4028aa
Capabilities:
Create process on windows
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
push esi
push edi
push 0x1400
call sub.MSVCRT.dll_malloc
mov ebx, eax
mov ecx, 0x500
xor eax, eax
mov edi, ebx
and word [ebx], 0
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xfeff
push eax
push ebx
call sub.MSVCRT.dll_wcscat
mov esi, 0x409804
push esi
push ebx
call sub.MSVCRT.dll_wcscat
push 0x19
call fcn.00401e00
push eax
push ebx
call sub.MSVCRT.dll_wcscat
push esi
push ebx
call sub.MSVCRT.dll_wcscat
push esi
push ebx
call sub.MSVCRT.dll_wcscat
add esp, 0x30
push 0x415240
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
push ebx
call sub.MSVCRT.dll_wcscat
push esi
push ebx
call sub.MSVCRT.dll_wcscat
mov eax, dword [0x416b94]
mov ecx, 0x1ff
mov dword [ebp - 0x808], eax
xor eax, eax
lea edi, [ebp - 0x804]
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x808]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x808]
push str.translate_
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x808]
push 0x4133e8
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x808]
push str..txt
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x18
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
lea eax, [ebp - 0x808]
push esi
push 0x80
push 4
push esi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4029e0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 4]
push esi
shl eax, 1
push ecx
push eax
push ebx
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
push esi
lea eax, [ebp - 0x808]
push esi
push eax
push 0x4097d4
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
call sub.MSVCRT.dll_free
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402a03
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp + 0x10]
push 0x419
push dword [ebp + 0xc]
call esi
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0x41d
push dword [ebp + 0xc]
call esi
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret
Function at 0x403f8e
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 8], 0x204
push esi
mov esi, ecx
jne 0x403fa2
call fcn.004042bf
jmp 0x404017
push dword [esi + 0x1018]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x404009
push ebx
push edi
push 5
push dword [esi + 0x1018]
call dword [sym.imp.USER32.dll_ShowWindow]
xor edi, edi
push 3
mov ebx, dword [sym.imp.USER32.dll_SetWindowPos]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0x1018]
call ebx
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0x1018]
call ebx
push 3
push edi
push edi
push edi
push edi
push edi
push dword [esi + 0x1018]
call ebx
push dword [esi + 0x1018]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop ebx
jmp 0x404017
push 0
push dword [esi + 0x1018]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 8

Function at 0x404095
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x404161
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x24
call esi
push 0x24
mov dword [ebp + 8], eax
call esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov edi, eax
call sub.MSVCRT.dll_clock
mov esi, eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp - 8]
mov eax, esi
sub eax, dword [0x409828]
cmp eax, edi
mov edi, dword [ebp - 4]
jge 0x404148
mov eax, edi
sub eax, dword [0x409820]
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jge 0x404148
mov eax, ecx
sub eax, dword [0x409824]
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [ebp + 8]
jge 0x404148
inc dword [0x416ee0]
cmp dword [0x416ee0], 2
jne 0x404128
push str.TRIPEL___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 4]
xor eax, eax
cmp dword [0x416ee0], 2
mov dword [0x409828], esi
mov dword [0x409824], ecx
mov dword [0x409820], edi
sete al
jmp 0x404163
and dword [0x416ee0], 0
mov dword [0x409828], esi
mov dword [0x409824], ecx
mov dword [0x409820], edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404168
Capabilities:
Log keystrokes via polling
Print debug messages

Disassembly:
push ecx
mov eax, dword [0x416c98]
push ebx
cmp eax, dword [0x40982c]
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
je 0x4041cb
xor ebx, ebx
push ebx
push ebx
push 0x416
push dword [edi + 0x101c]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x416c98], ebx
jne 0x4041a1
push 0x3b
jmp 0x4041a3
push 0x3c
call fcn.00401f05
pop ecx
push ebx
push ebx
push 0x1069
push eax
push dword [edi + 0x101c]
call fcn.00401e0c
mov eax, dword [0x416c98]
add esp, 0x14
mov dword [0x40982c], eax
jmp 0x4041cd
xor ebx, ebx
cmp dword [0x40981c], ebx
mov esi, 0x8000
je 0x404205
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test esi, eax
je 0x404205
push dword [0x409830]
call fcn.00404095
test eax, eax
pop ecx
je 0x4041fd
mov ecx, edi
call fcn.004042bf
mov dword [0x409830], ebx
jmp 0x40420f
mov dword [0x409830], 1
cmp dword [0x409818], ebx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebp, str.L___n
je 0x404265
push 0x59
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test esi, eax
je 0x404265
cmp dword [0x416ee4], 0
jne 0x40426c
push 0x11
call edi
test esi, eax
je 0x40426c
push 0x12
call edi
test esi, eax
je 0x40426c
mov ecx, dword [esp + 0x10]
call fcn.004042bf
push ebp
call ebx
mov dword [0x416ee4], 1
jmp 0x40426c
and dword [0x416ee4], 0
cmp dword [0x409814], 0
je 0x4042b2
push 0x5a
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test esi, eax
je 0x4042b2
cmp dword [0x416ee8], 0
jne 0x4042b9
push 0x11
call edi
test esi, eax
je 0x4042b9
push 0x12
call edi
test esi, eax
je 0x4042b9
mov ecx, dword [esp + 0x10]
call fcn.004042bf
push ebp
call ebx
mov dword [0x416ee8], 1
jmp 0x4042b9
and dword [0x416ee8], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40442e
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
push dword [esi + 0x810]
mov dword [esi], 0x406288
push 7
push 2
push dword [esi + 0x81c]
call fcn.004044c8
mov esi, dword [esi + 8]
test esi, esi
je 0x404463
push 0x444
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
ret

Function at 0x404465
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
push dword [esi + 0x810]
push 7
push 2
push dword [esi + 0x81c]
call fcn.004044c8
mov eax, dword [esi + 8]
test eax, eax
je 0x404498
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi + 8], 0
pop esi
ret
Function at 0x404555
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
xor edi, edi
mov ebx, str.Shell_TrayWnd
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x404592
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
cmp eax, edi
je 0x404592
push dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x404656
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x24
push eax
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x4045f8
mov eax, dword [ebp - 0x18]
sub eax, edi
je 0x4045dc
dec eax
je 0x4045bd
dec eax
je 0x4045dc
dec eax
jne 0x404656
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax], edx
mov dword [eax + 8], ecx
jmp 0x404656
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
jmp 0x4045d7
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x404635
mov esi, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 8]
mov ecx, eax
sub ecx, dword [esi]
cmp ecx, 0x96
jle 0x404623
add eax, 0xffffff6a
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov ecx, eax
sub ecx, dword [esi + 4]
cmp ecx, 0x1e
jle 0x404656
add eax, 0xffffffe2
jmp 0x404653
mov esi, dword [ebp + 8]
push edi
push esi
push edi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esi + 8]
sub eax, 0x96
mov dword [esi], eax
mov eax, dword [esi + 0xc]
sub eax, 0x1e
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40468d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 0xc], 0
je 0x4046cc
call fcn.0040465b
test eax, eax
je 0x4046cc
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
call fcn.00404555
pop ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret 8
Function at 0x404779
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0x10]
mov esi, ecx
mov dword [esi + 0x810], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x80c], eax
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, esi
call fcn.004046f7
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4047b2
mov dword [esi + 0x814], eax
cmp dword [ebp + 0x18], 0
je 0x4047e4
mov eax, dword [esi + 8]
test eax, eax
je 0x4047cb
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x4047ec
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
push 1
pop eax
pop esi
pop ebp
ret 0x14
Function at 0x404d3d
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x98]
mov dword [esi], 0x4062b8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov esi, dword [esi + 0xf4]
test esi, esi
je 0x404d69
push 0x444
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x416f60]
pop esi
test eax, eax
je 0x404d75
call eax
jmp fcn.0040563d

Function at 0x404e43
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
fld dword [ebp + 0x10]
push esi
mov esi, ecx
push edi
fst dword [esi + 0xe8]
fcomp dword [0x4062c0]
fnstsw ax
sahf
ja 0x404e6b
mov dword [esi + 0xe8], 0x40000000
fld dword [0x4062bc]
fcom dword [esi + 0xe8]
fnstsw ax
sahf
ja 0x404e84
fstp dword [esi + 0xe8]
jmp 0x404e86
fstp st(0)
mov eax, dword [ebp + 8]
xor edi, edi
cmp dword [esi + 0xb4], edi
mov dword [esi + 0xd4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xd8], eax
jne 0x404fa2
mov eax, dword [ebp + 0x14]
push ebx
push 0x7f89
mov dword [esi + 0xb8], eax
mov ebx, dword [0x4135e8]
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esi + 0x84], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x30]
mov ebx, str.TheAeroClock_Clock
push eax
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 0x404d7a
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
call dword [sym.imp.USER32.dll_RegisterClassExW]
push edi
mov dword [0x416f4c], esi
mov dword [0x418184], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
push eax
push 0x4049ce
push 0xe
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push edi
mov dword [0x416f50], eax
push dword [0x4135e8]
mov eax, 0x400
push edi
push edi
push eax
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x24]
neg eax
push dword [esi + 0x20]
sbb eax, eax
and eax, 0x20
push 0x80000000
push 0x416ef0
or eax, 0x80080
push ebx
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 0xb4], eax
mov dword [0x416f48], eax
lea eax, [ebp + 0x10]
push eax
push edi
push esi
push 0x404faa
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push 0x14
push 0x457
mov dword [esi + 0xf4], eax
push dword [esi + 0xb4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esi + 0xb4]
pop ebx
jmp 0x404fa4
xor eax, eax
pop edi
pop esi
leave
ret 0x10
Function at 0x4057f2
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [ebp + 0x10]
cmp dword [ebp + 0x10], eax
push esi
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
setne al
and dword [ebp + 0x10], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x405846
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret

Function at 0x405850
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [ebp + 0xc]
cmp dword [ebp + 0xc], eax
push esi
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
setne al
and dword [ebp + 0xc], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x405892
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret

Function at 0x4058b3
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc1c
push esi
xor esi, esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x41c]
push 0x208
push ecx
push eax
call fcn.0040589c
mov eax, dword [0x416b94]
mov ecx, 0x81
mov dword [ebp - 0x214], eax
xor eax, eax
lea edi, [ebp - 0x210]
push 0x40a0f0
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x214]
push str.___bg
push eax
call sub.MSVCRT.dll_wcscat
mov eax, dword [0x416b94]
add esp, 0x24
mov dword [ebp - 0xc1c], eax
mov ecx, 0x1ff
xor eax, eax
cmp dword [ebp + 0xc], esi
lea edi, [ebp - 0xc18]
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
setne al
lea ecx, [ebp - 4]
add eax, 0x80000001
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push 1
lea eax, [ebp - 0xc]
pop edi
mov dword [ebp - 0xc], 0x400
push eax
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4059d2
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
test eax, eax
pop ecx
je 0x4059ce
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, edi
jmp 0x4059d4
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x421490
Capabilities:
Encode data using xor

Disassembly:
cmp ebx, 9
add eax, 0x846b0cbb
jno 0x417a63
fimul dword [edi - 0x16250b54]
pop edx
cmp byte [ebp - 8], dl
cmp eax, edi
aad 0x89
or al, 0xc1
fstp st(2)
salc
in al, dx
adc esp, ebp
pop es
xchg esp, eax
and bh, dh
or eax, 0x2edc58a4
wait
push cs
invalid
bswap ebp
rcr byte [ecx + 0x17], 1
adc byte [esi], dl
inc ebp
cld
std
jno 0x417adb
pop ss
ret 0xc81e
mov al, byte [edi]
ror byte [0x1ba80e03], cl
or byte [esi - 0x3e], ch
loop 0x417ae5
loope 0x417ae9
call 0xeb6bec1e
xor al, byte [eax + edx + 0x1f]
stc
adc ecx, ecx
dec ecx
das
and cl, byte [ebx - 0x74a403bb]
in eax, 0xc2
retf
dec dword [0xd8cdbece]
adc ch, ch
in eax, dx
sub ebp, dword [ecx]
add eax, 0x531f29d5
sub dword [0x531f29d5], eax
pop ds
push ebx
cmp al, 0xf6
loopne 0x417a7d
ret
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
mov dword [edi + 0x17084], 0x581ce3b2
push edi
or ebp, 0xffffffff
jmp 0x4214ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4214c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4214b0
mov eax, 1
add ebx, ebx
jne 0x4214d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4214c8
jne 0x4214e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4214c8
xor ecx, ecx
sub eax, 3
jb 0x4214f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42156a
mov ebp, eax
add ebx, ebx
jne 0x421503
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x421510
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x421534
inc ecx
add ebx, ebx
jne 0x421520
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x421515
jne 0x421531
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421515
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x421554
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x421545
jmp 0x4214b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x421554
add edi, ecx
jmp 0x4214b6
pop esi
mov edi, esi
mov ecx, 0xe34
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x421572
cmp byte [edi], 7
jne 0x421572
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x421577
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x4215e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2158c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x21654]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4215a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21658]
or eax, eax
je 0x4215e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4215c1
call dword [esi + 0x2165c]
popal
jmp 0x417a10
Function at 0x658350
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
call fcn.00658052
sub esp, 0x1a
mov eax, dword [esp + 0x15]
xchg dword [esp + 0x14], edx
mov ax, sp
xchg byte [esp + 0x10], al
jmp 0x65842b
lea eax, [edx + edx]
mov word [esp], sp
mov dl, dh
call 0x658350
sub byte [ebp + 0x7cbf4c25], dh
and al, 0x57
mov esi, 0x8d4b2889
add al, 0x12
lea eax, [edx + edx]
mov word [esp], sp
mov dl, dh
lea esp, [esp + 2]
ror cl, 0
bts eax, edx
jmp 0x65846e
lea edx, reloc.KERNEL32.dll_lstrcatA
xchg word [esp + 1], ax
pop ax
neg edx
jle 0x6583a0
jg 0x658386
lea ebx, [ebx - 0x25]
rcl edx, 7
mov dh, bh
push esp
add esp, 1
bswap eax
jmp 0x658413
mov edx, 0xfe9f26a8
mov ax, word [esp]
push dword [esp + 0x1c]
ret 0x20
lea esp, [esp + 3]
xchg dword [esp + 0x1c], ebx
neg edx
bswap eax
lea edx, [esi + 0xb5]
jmp 0x6583fd
lea esp, [esp + 2]
xchg dword [esp + 0x18], ebx
mov dx, sp
xor dl, ch
shr edx, 0x13
call fcn.006583fa
rol dword [eax + reloc.KERNEL32.dll_lstrcatA], 0x52
mov edx, dword [esp + 3]
jmp 0x6583c6
rdtsc
rdtsc
xchg dh, dl
jmp 0x658498
xchg edx, eax
call fcn.00658504
inc edx
invalid
je 0x658487
lea eax, [ecx - 0xbb]
mov edx, 0x4034fe7e
jmp 0x658450
lea eax, [ecx - 0xbb]
mov edx, 0x4034fe7e
rdtsc
rdtsc
xchg dh, dl
push edx
jmp 0x658458

Function at 0x658549
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, eax
push ecx
wait
pop ss
xchg edx, esp
adc esi, ebx
add ecx, dword [eax + reloc.KERNEL32.dll_lstrcatA]
movsd dword es:[edi], dword [esi]
aam 0x8d
and al, 8
rdtsc
lea esp, [esp + 3]
lea esp, [esp + 4]
not cl
not ax
call 0x65856a
jnp 0x658534
push 0xd
cld
cmp dword [ecx - 0x60], esp
jecxz 0x658562
jne 0x6584d4
mov al, ah
jmp 0x65852a
invalid
setle dh
xchg dword [esp], eax
mov dh, 0x82
mov dh, byte [esp + 3]
setg ah
add esp, 1
jmp 0x6585dc
out 0x74, al
adc ebp, esi
push eax
xchg edi, eax
dec cl
jmp 0x65854d
not eax
mov ax, word [esp + 1]
lea esp, [esp + 3]
inc cl
rcl ax, cl
jne 0x6585a5
je 0x6588d8
ljmp 0x228b:0x59ea1f78
neg ax
mov dh, ch
xchg dh, al
jmp 0x65873f
lea esp, [esp + 3]
jmp 0x658577
je 0x65856c
not eax
mov ax, word [esp + 1]
jmp 0x6585c3
bsf dx, ax
call fcn.00658616
mov dx, word [esp]
jmp 0x658637
pushal
mov dword [esp + 0x1c], ecx
bsr dx, cx
jp 0x658708
mov dx, word [esp]
bsf dx, ax
jmp 0x65863b
neg ax
mov dh, ch
xchg dh, al
jmp 0x6585ac

Function at 0x66ef6b
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
pop ebx
call fcn.0066ef54
Function at 0x67e5ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, byte [esp]
jmp 0x67e282
lea eax, [esp + 0xc]
push edx
lea esp, [esp + 4]
call fcn.0064b7bc
jmp 0x67e25a
movzx eax, byte [ecx]
mov edx, ebp
neg dx
mov byte [esi + 0x58], al
jmp 0x67e293
rdtsc
mov edi, ebp
stc
setg cl
jmp 0x67e2fb
jb 0x67dcc8
mov al, ah
not eax
mov cx, word [esp]
lea ecx, [esi + 8]
jmp 0x67e272
lea esp, [esp + 4]
movzx eax, byte [esi + 0xb]
mov cl, byte [esp]
xchg cx, di
bswap edx
jmp 0x67e308
movzx edx, byte [esi + 0xa]
mov byte [esi + 0x5a], dl
push esp
jmp 0x67e2bc
movzx ecx, byte [esi + 9]
mov byte [esi + 0x59], cl
mov di, 0xe20d
jmp 0x67e2de
mov byte [esi + 0x5b], al
rcl cl, 3
mov al, 0xae
mov cl, 0xd2
jmp 0x67e40a
cmp ecx, 0xe
push esp
mov word [esp], bx
pop word [esp]
lea esp, [esp + 2]
jmp 0x67e2a9
xchg dh, ch
mov byte [esi + 0x5e], al
inc edi
rdtsc
lea eax, reloc.KERNEL32.dll_lstrcatA
jmp 0x67e366
pushal
lea esp, [esp + 0x20]
movzx eax, byte [esi + 0xe]
mov dl, dh
mov di, dx
jmp 0x67e33a
movzx ecx, byte [esi + 0xf]
sub esp, 4
lea edi, [ebx + ebp]
lea esp, [esp + 4]
jmp 0x67e3d6
lea esp, [esp + 0x10]
movzx edx, byte [esi + 0xd]
mov byte [esi + 0x5d], dl
mov eax, edi
jmp 0x67e356
mov byte [esi + 0x60], dl
dec di
mov cl, byte [esp]
add ecx, ebp
jmp 0x67e3f1
mov byte [esi + 0x61], al
pushal
lea esp, [esp + 0x20]
movzx ecx, byte [esi + 0x12]
jmp 0x67e43e
bts edi, ebx
neg cl
jmp 0x67e396
mov byte [esi + 0x5f], cl
lea edx, [ebx*4]
movzx edx, byte [esi + 0x10]
lea edi, [ebx*4]
mov ax, word [esp]
jmp 0x67e3bd
movzx eax, byte [esi + 0x11]
mov cx, word [esp]
mov dl, dh
jmp 0x67e3a2
movzx ecx, byte [esi + 0xc]
mov byte [esi + 0x5c], cl
mov edi, ebp
sub esp, 0x10
jmp 0x67e387
mov byte [esi + 0x62], cl
mov edi, dword [esp]
movzx edx, byte [esi + 0x13]
jmp 0x67e4ad
xchg edx, edi
lea edi, [edx + ebx]
rcr ax, cl
mov edi, ebp
jmp 0x67e41b
mov dword [esp + ecx*4 + 0x10], edx
add ecx, 2
add eax, 8
jmp 0x67e325
movzx ecx, byte [esi + 0x15]
lea eax, [esp + eax]
btc edi, edi
bts edi, edi
mov di, cx
jmp 0x67e54b
xchg dh, ch
mov edi, dword [esp]
mov byte [esi + 0x64], al
cmc
rcl edi, 5
jmp 0x67e46a
mov byte [esi + 0x63], dl
lea edx, [eax - 0xc1]
mov edi, eax
movzx eax, byte [esi + 0x14]
mov dx, di
jmp 0x67e492
movzx eax, byte [esi + 0x17]
pop edi
call fcn.0067e4c1
movzx edx, byte [esi + 0x16]
mov byte [esi + 0x66], dl
mov eax, 0xeb397572
mov al, ah
mov eax, 0xab3ffd7a
jmp 0x67e4e6
mov byte [esi + 0x65], cl
mov di, sp
neg ax
inc dh
jmp 0x67e520
or edx, edi
push edx
lea esp, [esp + 0xc]
jmp 0x67e45b