joyce8/EMBER2024-capa huggingface dataset:
Function at 0x135a50b
Capabilities:
Encode data using base64

Disassembly:
jmp 0x135a90d
mov eax, 0x403
jmp 0x135abfb
mov bl, byte [ecx + 2]
sub esp, 0xf
jmp 0x13256a1
lea esp, [esp + 3]
jmp 0x135ab3e
call fcn.0135a9cd
or eax, 0x4b88d3c0
or esi, dword [esi]
push ds
scasb al, byte es:[di]
out 0xd7, eax
aaa
push ecx
rcl byte [ebx - 0x36]
cmp bl, 0x61
jmp 0x135aa3f
mov cl, byte [ecx + 3]
push esi
stc
jmp 0x1325704
pushal
lea esp, [esp + 0x24]
cmp cl, 0x41
jmp 0x135ab21
call fcn.0135aab4
lea esp, [esp + 8]
cmp bl, 0x2b
jmp 0x135aaec
call 0x135aa63
xor dword [eax + reloc.kernel32.dll_GetProcAddress], esp
dec ecx
fisttp qword [ebp + 0x14]
out 0x21, eax
lodsb al, byte [esi]
mov edi, 0xe9303186
pop edx
push es
add byte [eax], al
jmp 0x135ab4f
jmp 0x135ab65
call fcn.0135ab8c
int3
cmp al, 0x2b
call 0x135a54b
rol byte [ebx + 0x424648d], 0xe9
xchg ecx, eax
push es
add byte [eax], al
and edi, dword [eax + reloc.kernel32.dll_GetProcAddress]
setne byte [0x84289f6c]
aaa
push ds
jmp 0x135ac3a
pushal
call 0x135abc2
mov ebx, 0x2cddba24
wait
iretd
push bx
jmp 0x135ac23
cmp al, 0x39
push ebx
pop word [esp]
call fcn.0135ac49
and dword [edi + reloc.kernel32.dll_GetProcAddress], esp
pop edx
mov ch, 0xa4
xlatb
call fcn.0135acd8
add esp, 3
lea esp, [esp + 1]
cmp dl, 0x41
jmp 0x135a956
lea esp, [esp + 0x10]
cmp dl, 0x5a
jmp 0x135aa1d
jb 0x13256b7
pushfd
sub esp, 0x17
lea esp, [esp + 0xb]
jmp 0x135a940
jbe 0x1325695
ja 0x13256b7
cmp bl, 0x7a
jmp 0x135aa79
jb 0x135a4f0
cmc
jmp 0x135aa29
jbe 0x13256f9
ja 0x13256cd
lea esp, [esp + 4]
cmp bl, 0x30
jmp 0x135aa85
jbe 0x13256f9
ja 0x135a4f0
jb 0x135a4d4
cmp bl, 0x39
call 0x135ab0f
xor eax, 0xb04126b0
add eax, 0x443dad25
mov bh, 1
cmp al, 0xf
xchg esi, eax
add eax, eax
jb 0x13256cd
pushfd
lea esp, [esp + 4]
cmp bl, 0x5a
jmp 0x135aa57
lea esp, [esp + 4]
cmp bl, 0x2f
jmp 0x135ab15
je 0x13256f9
sub esp, 3
push word [esp + 2]
lea esp, [esp + 1]
jmp 0x135aad6
jne 0x132564e
je 0x13256f9
jb 0x135a506
sub esp, 0x1a
add esp, 0x16
jmp 0x135abaf
lea esp, [esp + 0xc]
cmp bl, 0x41
push eax
lea esp, [esp + 4]
jmp 0x135aaa4
lea esp, [esp + 4]
jbe 0x135a542
ja 0x135a52c
cmp dword cs:[eax], ebx
jnp 0x135abb6
int 0x80
stc
popal
cmp cl, 0x61
jb 0x135a52c
cmp cl, 0x7a
call 0x135a50b
jb 0x135a582
push esi
push dword [esp]
cmc
jmp 0x135ab99
lea esp, [esp + 8]
cmp cl, 0x39
jmp 0x135abd9
lea esp, [esp + 4]
cmp cl, 0x5a
jbe 0x135a542
ja 0x135a506
lea esp, [esp + 0x24]
cmp cl, 0x2b
jmp 0x135ac7e
jbe 0x135a542
ja 0x135a582
jne 0x135a56c
call 0x135abfd
fisttp word [edi - 0x21]
mov edx, 0x9d629349
in al, dx
inc esi
pop ebx
ret
je 0x135a542
jne 0x132564e
lea esp, [esp + 2]
jmp 0x135ac5f
cmp al, 0x2f
jne 0x135a5da
push 0x3f
jmp 0x135a598
pop eax
jmp 0x135a5c4
push bx
lea esp, [esp + 2]
je 0x135a542
cmp cl, 0x2f
jmp 0x135ac17
Function at 0x135a54b
Capabilities:
Encode data using base64

Disassembly:
jmp 0x135a90d
mov eax, 0x403
jmp 0x135abfb
mov bl, byte [ecx + 2]
sub esp, 0xf
jmp 0x13256a1
lea esp, [esp + 3]
jmp 0x135ab3e
call fcn.0135a9cd
or eax, 0x4b88d3c0
or esi, dword [esi]
push ds
scasb al, byte es:[di]
out 0xd7, eax
aaa
push ecx
rcl byte [ebx - 0x36]
cmp bl, 0x61
jmp 0x135aa3f
mov cl, byte [ecx + 3]
push esi
stc
jmp 0x1325704
pushal
lea esp, [esp + 0x24]
cmp cl, 0x41
jmp 0x135ab21
call fcn.0135aab4
lea esp, [esp + 8]
cmp bl, 0x2b
jmp 0x135aaec
call 0x135aa63
xor dword [eax + reloc.kernel32.dll_GetProcAddress], esp
dec ecx
fisttp qword [ebp + 0x14]
out 0x21, eax
lodsb al, byte [esi]
mov edi, 0xe9303186
pop edx
push es
add byte [eax], al
jmp 0x135ab4f
jmp 0x135ab65
call fcn.0135ab8c
int3
cmp al, 0x2b
call 0x135a54b
rol byte [ebx + 0x424648d], 0xe9
xchg ecx, eax
push es
add byte [eax], al
and edi, dword [eax + reloc.kernel32.dll_GetProcAddress]
setne byte [0x84289f6c]
aaa
push ds
jmp 0x135ac3a
pushal
call 0x135abc2
mov ebx, 0x2cddba24
wait
iretd
push bx
jmp 0x135ac23
cmp al, 0x39
push ebx
pop word [esp]
call fcn.0135ac49
and dword [edi + reloc.kernel32.dll_GetProcAddress], esp
pop edx
mov ch, 0xa4
xlatb
call fcn.0135acd8
add esp, 3
lea esp, [esp + 1]
cmp dl, 0x41
jmp 0x135a956
lea esp, [esp + 0x10]
cmp dl, 0x5a
jmp 0x135aa1d
jb 0x13256b7
pushfd
sub esp, 0x17
lea esp, [esp + 0xb]
jmp 0x135a940
jbe 0x1325695
ja 0x13256b7
cmp bl, 0x7a
jmp 0x135aa79
jb 0x135a4f0
cmc
jmp 0x135aa29
jbe 0x13256f9
ja 0x13256cd
lea esp, [esp + 4]
cmp bl, 0x30
jmp 0x135aa85
jbe 0x13256f9
ja 0x135a4f0
jb 0x135a4d4
cmp bl, 0x39
call 0x135ab0f
xor eax, 0xb04126b0
add eax, 0x443dad25
mov bh, 1
cmp al, 0xf
xchg esi, eax
add eax, eax
jb 0x13256cd
pushfd
lea esp, [esp + 4]
cmp bl, 0x5a
jmp 0x135aa57
lea esp, [esp + 4]
cmp bl, 0x2f
jmp 0x135ab15
je 0x13256f9
sub esp, 3
push word [esp + 2]
lea esp, [esp + 1]
jmp 0x135aad6
jne 0x132564e
je 0x13256f9
jb 0x135a506
sub esp, 0x1a
add esp, 0x16
jmp 0x135abaf
lea esp, [esp + 0xc]
cmp bl, 0x41
push eax
lea esp, [esp + 4]
jmp 0x135aaa4
lea esp, [esp + 4]
jbe 0x135a542
ja 0x135a52c
cmp dword cs:[eax], ebx
jnp 0x135abb6
int 0x80
stc
popal
cmp cl, 0x61
jb 0x135a52c
cmp cl, 0x7a
call 0x135a50b
jb 0x135a582
push esi
push dword [esp]
cmc
jmp 0x135ab99
lea esp, [esp + 8]
cmp cl, 0x39
jmp 0x135abd9
lea esp, [esp + 4]
cmp cl, 0x5a
jbe 0x135a542
ja 0x135a506
lea esp, [esp + 0x24]
cmp cl, 0x2b
jmp 0x135ac7e
jbe 0x135a542
ja 0x135a582
jne 0x135a56c
call 0x135abfd
fisttp word [edi - 0x21]
mov edx, 0x9d629349
in al, dx
inc esi
pop ebx
ret
je 0x135a542
jne 0x132564e
lea esp, [esp + 2]
jmp 0x135ac5f
cmp al, 0x2f
jne 0x135a5da
push 0x3f
jmp 0x135a598
pop eax
jmp 0x135a5c4
push bx
lea esp, [esp + 2]
je 0x135a542
cmp cl, 0x2f
jmp 0x135ac17
Function at 0x135a5f5
Capabilities:
Encode data using base64

Disassembly:
pushal
push dword [esp + 6]
jmp 0x135ad19
call fcn.0135ad14
lea esp, [esp + 8]
movzx eax, al
ja 0x135a66e
sub eax, 0x41
jmp 0x135a5c4
jmp 0x135ad66
jmp 0x135ad8b
push ax
lea esp, [esp + 2]
movzx esi, dl
jmp 0x135ad6c
call fcn.0135acfe
enter 0xffffffffffffd747, 0xffffffffffffffb2
inc ecx
invalid
cmp dl, 0x5a
jmp 0x135adc5
pushal
lea esp, [esp + 0x20]
jmp 0x135a6a5
cmp bl, 0x2b
jmp 0x135ada3
sub esi, 0x47
jmp 0x135a69a
push esp
call 0x135adee
invalid
call fcn.0135a715
add eax, 0x9b680999
sub esp, dword [ebp - 6]
push 0x5b4dfa0f
mov dl, 0xad
mov esp, 0x794e88f
add byte [eax], al
mov word [esp], si
lea esp, [esp + 2]
shl eax, 6
xchg bh, bl
mov bx, word [esp]
jmp 0x135af61
pop edx
jmp 0x135a765
lea esp, [esp + 0x24]
push esi
jmp 0x135ae7b
pop esi
jmp 0x135a69a
cmp dl, 0x39
call 0x135ad75
call 0x55a1206
ja 0x135a684
jbe 0x135ae1e
or esp, dword [edx + reloc.kernel32.dll_GetProcAddress]
cmp dl, 0x2f
jne 0x135a652
push 0x3f
jmp 0x135a626
sub esi, 0x41
jmp 0x135a69a
jne 0x135a6d7
push 0x3e
jmp 0x135a96f
ja 0x135a6c1
clc
pushal
lea esp, [esp + 0x20]
jmp 0x135ad9b
add esi, 4
jmp 0x135a69a
cmp dl, 0x2b
jne 0x135a63c
push 0x3e
jmp 0x135a626
bsr si, si
jmp 0x135afa7
or eax, esi
mov bh, 0x58
shl eax, 6
mov esi, 0xd7f7870a
jmp 0x135af4b
lea edx, [edi + ebp]
sbb bx, si
mov dh, bh
jmp 0x135afb2
or eax, edx
xchg ebx, esi
shl eax, 6
inc dl
jmp 0x135af91
or eax, ecx
mov ecx, dword [esp + 0xc]
sub esp, 0x18
jmp 0x135c086
not esi
rcr bh, cl
jmp 0x135aff3
seto bh
mov edx, eax
xchg bl, bh
shr edx, 8
jmp 0x135afd1
pop esi
mov byte [ecx + 2], al
not bl
lea ebx, [ecx + ecx]
jmp 0x135b002
mov byte [ecx + 1], dl
mov al, ch
lea eax, [esi*4]
jmp 0x135bd47
lea esp, [esp + 0x18]
mov byte [ecx], dl
mov dl, byte [esp]
mov dx, 0xc696
mov bh, 1
jmp 0x135afe7
pop ebx
ret
mov bx, 0x8b48
xor eax, eax
mov ebx, 0x839e0f47
mov bx, word [esp]
jmp 0x135b359
mov edx, eax
shr edx, 0x10
bswap esi
not si
mov bh, dh
jmp 0x135b018

Function at 0x135a85e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jmp 0x135a868
cmp al, 0x2b
push ecx
pop word [esp]
lea esp, [esp + 2]
jmp 0x135a8dd
cmp al, 0x61
push si
mov word [esp], bp
mov byte [esp], bh
lea esp, [esp + 2]
jmp 0x135a885
pop word [esp]
lea esp, [esp + 2]
jmp 0x135a848
cmp al, 0x30
jb 0x1325664
pushfd
sub esp, 0x12
jmp 0x135a8af
mov ebp, 0xfe24b28
sbb byte [esi + 0x3cfffcad], 0x7a
jb 0x1325629
cmp al, 0x7a
jbe 0x13255f0
ja 0x1325629
lea esp, [esp + 4]
jmp 0x135a8f3
lea esp, [esp + 2]
lea esp, [esp + 0x14]
cmp al, 0x39
call 0x135a899
jecxz 0x135a937
out 0x82, eax
jno 0x135a881
sti
push 0xac6899fe
add eax, 0x59cea7b4
pop ecx
jbe 0x13255f0
ja 0x1325664
pop edi
jecxz 0x135a989
invalid
push esp
xor ecx, esi
js 0x135a933
fisubr word [ecx]
dec eax
jmp 0x135a8ce
and al, 0x17
Function at 0x135a9cd
Capabilities:
Encode data using base64

Disassembly:
jmp 0x135a985
call 0x135aa06
sub ah, 0xdc
inc esi
cmpsd dword [esi], dword es:[edi]
xchg edi, eax
jg 0x1325739
scasd eax, dword es:[edi]
in eax, dx
sbb ebx, ebp
insd dword es:[edi], dx
mov ecx, 0x8ad2fb98
dec ecx
add edx, dword [esi - 7]
sahf
and dword ss:[eax + 0x32], esp
pushal
pop word [esp + 0x17]
mov word [esp + 0x17], bx
lea esp, [esp + 2]
jmp 0x135a9b1
jb 0x132567f
stc
cmp dl, 0x7a
jbe 0x1325695
ja 0x132567f
lea esp, [esp + 0x1c]
cmp dl, 0x30
jmp 0x135a9ec
lea esp, [esp + 4]
cmp dl, 0x61
jmp 0x135a99b
jb 0x13256e3
cmp dl, 0x39
call fcn.0135a9d6
jbe 0x1325695
ja 0x13256e3
pushfd
lea esp, [esp + 8]
cmp dl, 0x2b
push bp
jmp 0x135acee
lea esp, [esp + 0x20]
jne 0x132564e
je 0x1325695
add eax, 4
jmp 0x135a5c4
lea esp, [esp + 2]
je 0x1325695
cmp dl, 0x2f
pushal
jmp 0x135acc0

Function at 0x135aa06
Capabilities:
Encode data using base64

Disassembly:
jmp 0x135a985
call 0x135aa06
sub ah, 0xdc
inc esi
cmpsd dword [esi], dword es:[edi]
xchg edi, eax
jg 0x1325739
scasd eax, dword es:[edi]
in eax, dx
sbb ebx, ebp
insd dword es:[edi], dx
mov ecx, 0x8ad2fb98
dec ecx
add edx, dword [esi - 7]
sahf
and dword ss:[eax + 0x32], esp
pushal
pop word [esp + 0x17]
mov word [esp + 0x17], bx
lea esp, [esp + 2]
jmp 0x135a9b1
jb 0x132567f
stc
cmp dl, 0x7a
jbe 0x1325695
ja 0x132567f
lea esp, [esp + 0x1c]
cmp dl, 0x30
jmp 0x135a9ec
lea esp, [esp + 4]
cmp dl, 0x61
jmp 0x135a99b
jb 0x13256e3
cmp dl, 0x39
call fcn.0135a9d6
jbe 0x1325695
ja 0x13256e3
pushfd
lea esp, [esp + 8]
cmp dl, 0x2b
push bp
jmp 0x135acee
lea esp, [esp + 0x20]
jne 0x132564e
je 0x1325695
add eax, 4
jmp 0x135a5c4
lea esp, [esp + 2]
je 0x1325695
cmp dl, 0x2f
pushal
jmp 0x135acc0

Function at 0x135ab8c
Capabilities:
Encode data using base64

Disassembly:
pop word [esp]
lea esp, [esp + 2]
cmp cl, 0x30
jmp 0x135ab76
Function at 0x135abc2
Capabilities:
Encode data using base64

Disassembly:
jmp 0x135a90d
mov eax, 0x403
jmp 0x135abfb
mov bl, byte [ecx + 2]
sub esp, 0xf
jmp 0x13256a1
lea esp, [esp + 3]
jmp 0x135ab3e
call fcn.0135a9cd
or eax, 0x4b88d3c0
or esi, dword [esi]
push ds
scasb al, byte es:[di]
out 0xd7, eax
aaa
push ecx
rcl byte [ebx - 0x36]
cmp bl, 0x61
jmp 0x135aa3f
mov cl, byte [ecx + 3]
push esi
stc
jmp 0x1325704
pushal
lea esp, [esp + 0x24]
cmp cl, 0x41
jmp 0x135ab21
call fcn.0135aab4
lea esp, [esp + 8]
cmp bl, 0x2b
jmp 0x135aaec
call 0x135aa63
xor dword [eax + reloc.kernel32.dll_GetProcAddress], esp
dec ecx
fisttp qword [ebp + 0x14]
out 0x21, eax
lodsb al, byte [esi]
mov edi, 0xe9303186
pop edx
push es
add byte [eax], al
jmp 0x135ab4f
jmp 0x135ab65
call fcn.0135ab8c
int3
cmp al, 0x2b
call 0x135a54b
rol byte [ebx + 0x424648d], 0xe9
xchg ecx, eax
push es
add byte [eax], al
and edi, dword [eax + reloc.kernel32.dll_GetProcAddress]
setne byte [0x84289f6c]
aaa
push ds
jmp 0x135ac3a
pushal
call 0x135abc2
mov ebx, 0x2cddba24
wait
iretd
push bx
jmp 0x135ac23
cmp al, 0x39
push ebx
pop word [esp]
call fcn.0135ac49
and dword [edi + reloc.kernel32.dll_GetProcAddress], esp
pop edx
mov ch, 0xa4
xlatb
call fcn.0135acd8
add esp, 3
lea esp, [esp + 1]
cmp dl, 0x41
jmp 0x135a956
lea esp, [esp + 0x10]
cmp dl, 0x5a
jmp 0x135aa1d
jb 0x13256b7
pushfd
sub esp, 0x17
lea esp, [esp + 0xb]
jmp 0x135a940
jbe 0x1325695
ja 0x13256b7
cmp bl, 0x7a
jmp 0x135aa79
jb 0x135a4f0
cmc
jmp 0x135aa29
jbe 0x13256f9
ja 0x13256cd
lea esp, [esp + 4]
cmp bl, 0x30
jmp 0x135aa85
jbe 0x13256f9
ja 0x135a4f0
jb 0x135a4d4
cmp bl, 0x39
call 0x135ab0f
xor eax, 0xb04126b0
add eax, 0x443dad25
mov bh, 1
cmp al, 0xf
xchg esi, eax
add eax, eax
jb 0x13256cd
pushfd
lea esp, [esp + 4]
cmp bl, 0x5a
jmp 0x135aa57
lea esp, [esp + 4]
cmp bl, 0x2f
jmp 0x135ab15
je 0x13256f9
sub esp, 3
push word [esp + 2]
lea esp, [esp + 1]
jmp 0x135aad6
jne 0x132564e
je 0x13256f9
jb 0x135a506
sub esp, 0x1a
add esp, 0x16
jmp 0x135abaf
lea esp, [esp + 0xc]
cmp bl, 0x41
push eax
lea esp, [esp + 4]
jmp 0x135aaa4
lea esp, [esp + 4]
jbe 0x135a542
ja 0x135a52c
cmp dword cs:[eax], ebx
jnp 0x135abb6
int 0x80
stc
popal
cmp cl, 0x61
jb 0x135a52c
cmp cl, 0x7a
call 0x135a50b
jb 0x135a582
push esi
push dword [esp]
cmc
jmp 0x135ab99
lea esp, [esp + 8]
cmp cl, 0x39
jmp 0x135abd9
lea esp, [esp + 4]
cmp cl, 0x5a
jbe 0x135a542
ja 0x135a506
lea esp, [esp + 0x24]
cmp cl, 0x2b
jmp 0x135ac7e
jbe 0x135a542
ja 0x135a582
jne 0x135a56c
call 0x135abfd
fisttp word [edi - 0x21]
mov edx, 0x9d629349
in al, dx
inc esi
pop ebx
ret
je 0x135a542
jne 0x132564e
lea esp, [esp + 2]
jmp 0x135ac5f
cmp al, 0x2f
jne 0x135a5da
push 0x3f
jmp 0x135a598
pop eax
jmp 0x135a5c4
push bx
lea esp, [esp + 2]
je 0x135a542
cmp cl, 0x2f
jmp 0x135ac17

Function at 0x135ac49
Capabilities:
Encode data using base64

Disassembly:
jmp 0x135ac65
lea esp, [esp + 2]
jmp 0x135aca5
movzx eax, al
jmp 0x135acd0
lea esp, [esp + 4]
ja 0x135a5f0
clc
jmp 0x135ac8f

Function at 0x135acd8
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
cmp al, 0x5a
call fcn.0135a5f5
mov ecx, dword [eax]
sahf
stc
or ch, cl
and eax, 0x796ec754
Function at 0x135acfe
Capabilities:
Encode data using base64

Disassembly:
jmp 0x135ad2f
pushal
lea esp, [esp + 0x24]
sub eax, 0x47
jmp 0x135a5c4

Function at 0x135ad75
Capabilities:
Encode data using base64

Disassembly:
pushal
push dword [esp + 6]
jmp 0x135ad19
call fcn.0135ad14
lea esp, [esp + 8]
movzx eax, al
ja 0x135a66e
sub eax, 0x41
jmp 0x135a5c4
jmp 0x135ad66
jmp 0x135ad8b
push ax
lea esp, [esp + 2]
movzx esi, dl
jmp 0x135ad6c
call fcn.0135acfe
enter 0xffffffffffffd747, 0xffffffffffffffb2
inc ecx
invalid
cmp dl, 0x5a
jmp 0x135adc5
pushal
lea esp, [esp + 0x20]
jmp 0x135a6a5
cmp bl, 0x2b
jmp 0x135ada3
sub esi, 0x47
jmp 0x135a69a
push esp
call 0x135adee
invalid
call fcn.0135a715
add eax, 0x9b680999
sub esp, dword [ebp - 6]
push 0x5b4dfa0f
mov dl, 0xad
mov esp, 0x794e88f
add byte [eax], al
mov word [esp], si
lea esp, [esp + 2]
shl eax, 6
xchg bh, bl
mov bx, word [esp]
jmp 0x135af61
pop edx
jmp 0x135a765
lea esp, [esp + 0x24]
push esi
jmp 0x135ae7b
pop esi
jmp 0x135a69a
cmp dl, 0x39
call 0x135ad75
call 0x55a1206
ja 0x135a684
jbe 0x135ae1e
or esp, dword [edx + reloc.kernel32.dll_GetProcAddress]
cmp dl, 0x2f
jne 0x135a652
push 0x3f
jmp 0x135a626
sub esi, 0x41
jmp 0x135a69a
jne 0x135a6d7
push 0x3e
jmp 0x135a96f
ja 0x135a6c1
clc
pushal
lea esp, [esp + 0x20]
jmp 0x135ad9b
add esi, 4
jmp 0x135a69a
cmp dl, 0x2b
jne 0x135a63c
push 0x3e
jmp 0x135a626
bsr si, si
jmp 0x135afa7
or eax, esi
mov bh, 0x58
shl eax, 6
mov esi, 0xd7f7870a
jmp 0x135af4b
lea edx, [edi + ebp]
sbb bx, si
mov dh, bh
jmp 0x135afb2
or eax, edx
xchg ebx, esi
shl eax, 6
inc dl
jmp 0x135af91
or eax, ecx
mov ecx, dword [esp + 0xc]
sub esp, 0x18
jmp 0x135c086
not esi
rcr bh, cl
jmp 0x135aff3
seto bh
mov edx, eax
xchg bl, bh
shr edx, 8
jmp 0x135afd1
pop esi
mov byte [ecx + 2], al
not bl
lea ebx, [ecx + ecx]
jmp 0x135b002
mov byte [ecx + 1], dl
mov al, ch
lea eax, [esi*4]
jmp 0x135bd47
lea esp, [esp + 0x18]
mov byte [ecx], dl
mov dl, byte [esp]
mov dx, 0xc696
mov bh, 1
jmp 0x135afe7
pop ebx
ret
mov bx, 0x8b48
xor eax, eax
mov ebx, 0x839e0f47
mov bx, word [esp]
jmp 0x135b359
mov edx, eax
shr edx, 0x10
bswap esi
not si
mov bh, dh
jmp 0x135b018
Function at 0x13d3200
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ebx
xchg word [esp + 1], di
jmp 0x13d338d
clc
sub esp, 0x1a
dec eax
bsf cx, dx
xchg word [esp + 4], bx
bswap eax
jmp 0x13d3376
sub esp, 0x14
pop dx
mov dl, byte [esp + 0x22]
lea esp, [esp + 0x22]
xchg dword [esp + 4], ebp
lea esp, [esp + 0xd]
jmp 0x13d3333
mov dword [esp + 0xf], edx
dec ch
mov al, 0xa9
mov cl, dl
mov si, word [esp + 0x15]
jmp 0x13d33e8
mov ecx, 0xf42f3a0b
push dword [esp + 5]
and cl, 7
pushfd
clc
jmp 0x13d3360
lea ebx, reloc.kernel32.dll_GetProcAddress
mov bl, cl
lea esp, [esp + 1]
mov ax, 0x212d
bswap ebp
sub esp, 0x1b
jmp 0x13d3349
rdtsc
xchg ah, dh
pop cx
inc esi
mov eax, 0x6581146b
neg dx
jmp 0x13d33ce
mov ch, 4
lea esi, [esp + ebx]
mov dword [esp + 0x10], ebx
lea edx, [esp + edx]
xchg edx, edi
add esp, 0x15
jmp 0x13d33a5
std
pop cx
mov dword [esp], esi
add esp, 4
sub esp, 0xf
cmc
jmp 0x13d3511
mov byte [esp + 8], bl
xchg ah, dl
setp al
xchg dx, ax
not eax
mov edx, dword [esp + 0x10]
jmp 0x13d33bb
stc
push dword [esp + 7]
cpuid
not bx
pop cx
pop dword [esp + 6]
jmp 0x13d3453
mov word [esp + 0x10], sp
mov ax, 0xab34
xchg bp, ax
bsr dx, di
pop word [esp + 7]
mov ax, bp
jmp 0x13d33fc
pop bp
lea ecx, [eax + esi]
mov dl, 0x82
mov di, cx
push dword [esp + 0x18]
sub esp, 4
jmp 0x13d3412
bsf esi, eax
xchg al, bh
lea esi, [ebx + edi]
mov dword [esp + 0x16], esi
setg dl
mov esi, ecx
jmp 0x13d34c5
mov ecx, esp
mov cx, bp
rdtsc
popal
xchg dword [esp], ebx
mov edi, 0xccfe012a
jmp 0x13d349a
mov ax, 0xc8ab
mov ebx, 0x86fb4d28
pop word [esp + 0x13]
xchg bh, al
push dword [esp + 3]
mov edi, 0x20e4892b
jmp 0x13d3440
rdtsc
pop edi
not ah
mov ebp, ecx
pushal
mov ebx, dword [esp + 0xb]
jmp 0x13d34ac
xchg esi, eax
popal
mov ah, byte [esp + 2]
push si
push dword [esp + 6]
neg ch
jmp 0x13d34f5
mov bl, 0x1b
sub esp, 0x1e
lea esp, [esp + 0xc]
shr si, 0xe
lea edx, [esi*4]
pop dword [esp + 6]
jmp 0x13d3466
sub esp, 2
xchg ch, ah
xchg dx, bp
mov word [esp], cx
jmp 0x13d3591
mov dword [esp + 4], esi
mov eax, 0xbf2bf83a
push word [esp + 0xa]
add esp, 0xe
mov ebp, dword [esp]
jmp 0x13d34df
pushfd
bsr dx, bx
lea ebp, [ecx*4]
lea edx, [ebx + edi]
mov edi, dword [esp]
cmc
jmp 0x13d347f
push word [esp]
sub esp, 0xd
push dword [esp]
xchg edi, ebx
lea esp, [esp + 0x12]
jmp 0x13d3569
sub esp, 1
xchg byte [esp + 1], dh
xchg ecx, esi
xchg bx, dx
bswap esi
pop word [esp]
jmp 0x13d3529
neg bh
mov al, 0x54
mov word [esp], cx
rdtsc
neg ecx
call fcn.013d35bb
pop ebp
lodsb al, byte [esi]
mov edi, 0x87663186
sbb al, 0x24
xchg word [esp], bx
add bx, cx
lea edi, [edx + esi]
mov dl, 0xa1
mov ebp, 0xc00d60aa
btr edx, ecx
jmp 0x13d3553
mov edx, 0x6127299e
mov cl, bh
lea ebp, [eax + ecx]
mov cl, byte [esp]
neg di
cpuid
jmp 0x13d353f

Function at 0x13d3bef
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, dx
rdtsc
xchg word [esp + 4], ax
mov bl, cl
push dword [esp + 0xa]
call fcn.013d3aab
sete cl
rdtsc
add esp, 0x17
xchg dword [esp + 8], edx
add esp, 2
jmp 0x13d3b66
Function at 0x13d441b
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.013d4073
jmp 0x13d4443
pushal
mov byte [esp + 2], cl
push dword [esp + 0x14]
pop word [esp + 0x17]
lea esp, [esp + 2]
mov dword [esp + 0x50], esi
jmp 0x13d457c
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x13d406e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x13d449f
push ebx
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x4c], edi
lea esp, [esp + 0x4c]
jmp 0x13d454f

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x479910
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x47997e
cmp si, 0x69
ja 0x47997e
add esi, 0xffd0
cmp si, 0x11
je 0x47994e
push 0x11
call edi
test ax, ax
jge 0x47994e
or esi, 0x2000
cmp si, 0x10
je 0x479963
push 0x10
call edi
test ax, ax
jge 0x479963
or esi, 0x4000
cmp si, 0x12
je 0x479978
push 0x12
call edi
test ax, ax
jge 0x479978
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x47998b
mov esi, 0xbd
jmp 0x47993f
cmp si, 0x6e
jne 0x479998
mov esi, 0xbe
jmp 0x47993f
cmp si, 0x6f
jne 0x479939
mov esi, 0xbf
jmp 0x47993f

Function at 0x47aec0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x501721
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14c
push ebp
mov ebp, dword [esp + 0x160]
push esi
push edi
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.004f3acb
mov esi, dword [esp + 0x16c]
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.004f391f
mov eax, dword [esp + 0x170]
lea ecx, [esp + 0xc]
push eax
call fcn.004f48d7
lea ecx, [esp + 0xc]
push str..
lea edx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x16c], 0
call fcn.004f4ab2
mov eax, dword [eax]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.004f4869
test edi, edi
je 0x47b00e
mov edx, dword [0xfba448]
mov dword [esp + 0x10], edx
cmp edi, 0xffffffff
mov byte [esp + 0x160], 1
je 0x47affd
cmp byte [esp + 0x44], 0x2e
je 0x47afe2
lea eax, [esp + 0xc]
push 0xfa66cc
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.004f4ab2
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x164], 2
call fcn.004f4956
lea ecx, [esp + 0x14]
mov byte [esp + 0x160], 1
call fcn.004f4869
lea edx, [esp + 0x44]
lea ecx, [esp + 0x10]
push edx
call fcn.004f4bf9
test byte [esp + 0x18], 0x10
mov eax, dword [esi + 8]
je 0x47afc8
push 1
jmp 0x47afca
push 0
push eax
mov ecx, esi
call fcn.004f3dbd
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, ebp
call fcn.004f3c40
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x47af6e
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x10]
mov byte [esp + 0x160], 0
call fcn.004f4869
lea ecx, [esp + 0xc]
mov dword [esp + 0x160], 0xffffffff
call fcn.004f4869
mov ecx, dword [esp + 0x158]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x158
ret
Function at 0x4f6c36
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4f6c6e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004f4cc4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004f4c9c
jmp 0x4f6c7a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4f8328
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4f836a
call fcn.004fdda9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4f836a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4f8361
xor eax, eax
jmp 0x4f8372
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004f8378
pop edi
pop esi
pop ebx
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx