joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010d10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x100358a0]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
push ebx
push ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
push esi
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x54]
shr eax, 4
mov edx, dword [esi]
mov ebp, dword [esi + 4]
mov ebx, dword [esi + 8]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x54], eax
push edi
mov edi, dword [esi + 0xc]
mov dword [esp + 0x20], edi
test eax, eax
je 0x10010e0f
mov esi, dword [esp + 0x58]
lea eax, [ecx + 8]
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x14], eax
add ecx, 8
mov edi, edi
mov eax, dword [ecx - 8]
mov ebp, dword [ecx - 4]
mov ebx, dword [ecx]
mov edi, dword [ecx + 4]
add ecx, 0x10
push dword [esp + 0x24]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x30], ecx
call dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
add esp, 8
mov eax, dword [esp + 0x38]
xor eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x34]
mov dword [ecx - 8], eax
mov eax, dword [esp + 0x3c]
xor eax, dword [esp + 0x10]
mov dword [ecx - 4], eax
mov eax, dword [esp + 0x40]
xor eax, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, dword [esp + 0x44]
xor eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
add ecx, 0x10
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], edi
dec esi
jne 0x10010d80
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x48]
xor eax, eax
mov dword [esi + 0xc], edi
pop edi
mov dword [esi + 4], ebp
mov dword [esi + 8], ebx
mov dword [esi], edx
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002aa84
add esp, 0x3c
ret
Function at 0x10010e30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x100358a0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
shr ebp, 4
mov ebx, dword [esi + 0xc]
mov ecx, dword [esi]
mov edx, dword [esi + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
push edi
mov edi, dword [esp + 0x40]
test ebp, ebp
je 0x10010ef3
mov ebx, dword [esp + 0x3c]
add edi, 4
add ebx, 4
mov esi, eax
mov eax, dword [ebx - 4]
lea ebx, [ebx + 0x10]
push dword [esp + 0x18]
xor eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [ebx - 0xc]
xor eax, edx
mov dword [esp + 0x30], eax
mov eax, dword [ebx - 0x10]
xor eax, esi
mov dword [esp + 0x2c], eax
mov eax, dword [ebx - 8]
xor eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x28]
push eax
call dword [esp + 0x28]
mov eax, dword [esp + 0x38]
lea edi, [edi + 0x10]
mov ecx, dword [esp + 0x2c]
add esp, 8
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [edi - 0x14], ecx
mov dword [edi - 0xc], edx
mov dword [edi - 0x10], esi
mov dword [edi - 8], eax
mov dword [esp + 0x14], eax
dec ebp
jne 0x10010e84
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop edi
mov dword [esi], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 0xc], ebx
mov dword [esi + 8], edx
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002aa84
add esp, 0x28
ret

Function at 0x100196a0
Capabilities:
Check if file exists

Disassembly:
cmp dword [esp + 4], 0
je 0x10019713
mov eax, dword [esp + 8]
test eax, eax
je 0x10019713
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1001970c
mov cl, byte [eax + 0xa]
cmp cl, 1
jne 0x100196ce
push 0
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x100196df
cmp cl, 2
jne 0x1001970c
push 0
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x10019706
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x100196ff
cmp eax, 0x7e
je 0x100196ff
cmp eax, 3
je 0x100196ff
mov eax, 0x2711
pop esi
ret
mov eax, 0x2718
pop esi
ret
mov dword [esi], eax
xor eax, eax
pop esi
ret
mov eax, 0x2721
pop esi
ret
mov eax, 0x2721
ret
Function at 0x402062
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4020a1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4020a1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4020a1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4020a1
cmp dword [ecx + 0x74], 0xe
jbe 0x4020a1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4080b6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416618
push 0x416610
push str.FlsAlloc
push 0x1f
call fcn.00407f75
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4080ea
push dword [ebp + 8]
mov ecx, esi
call dword [0x415138]
call esi
jmp 0x4080f0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408134
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416628
push 0x416620
push str.FlsGetValue
push 0x21
call fcn.00407f75
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40816b
push dword [ebp + 8]
mov ecx, esi
call dword [0x415138]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408173
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416630
push 0x416628
push str.FlsSetValue
push 0x22
call fcn.00407f75
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4081ad
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x415138]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40b6f8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b795
push ebx
push esi
call fcn.0040b6c1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b655
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b742
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b794
push edi
push eax
call fcn.00408865
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b762
call fcn.00407e08
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b793
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b655
add esp, 0x20
test eax, eax
jne 0x40b781
push edi
call fcn.00407e08
jmp 0x40b789
push ebx
call fcn.00407e08
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x413860
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41388d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41388d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x402bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4ecf70]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, 0x65
mov cl, 0x74
mov byte [ebp - 0xf], al
mov byte [ebp - 0xc], al
mov byte [ebp - 0x23], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x17], al
lea eax, [ebp - 0x24]
mov byte [ebp - 0x22], cl
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x18], cl
mov dl, 0x6e
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x21], 0x4e
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x76
mov byte [ebp - 0x1b], 0x53
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x49
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0
push ebx
call 0x74150c
push eax
push edx
call 0x6cd434
test eax, eax
je 0x402c92
xor ecx, ecx
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
call eax
mov eax, dword [ebp - 0x48]
cmp ax, 6
je 0x402c7f
cmp ax, 9
jne 0x402c92
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ed59
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0043ed59
mov esp, ebp
pop ebp
ret

Function at 0x459970
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x459985
xor eax, eax
jmp 0x4599fa
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x4599b2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x4599f5
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x4599f3
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x4599ef
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x4599f3
xor eax, eax
jmp 0x4599fa
jmp 0x4599a9
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x45a450
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00458cd0
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x4f4fc0], 0
jne 0x45a48d
cmp dword [0x4f4fbc], 0
je 0x45a48d
mov eax, dword [0x4f4fbc]
mov dword [0x4f4fc0], eax
cmp dword [0x4f4fc0], 0
je 0x45a50a
mov ecx, dword [0x4f4fc0]
cmp dword [ecx + 8], 0
je 0x45a50a
mov edx, dword [0x4f4fc0]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x45a50a
mov ecx, dword [0x4f4fc0]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x45a50a
mov eax, dword [0x4f4fc0]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x45a4d9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x45a4e0
xor eax, eax
jmp 0x45a62d
mov ecx, dword [0x4f4fc0]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00443bb0
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x45a62d
mov edx, dword [0x4f4fbc]
mov dword [0x4f4fc0], edx
jmp 0x45a526
mov eax, dword [0x4f4fc0]
mov ecx, dword [eax + 4]
mov dword [0x4f4fc0], ecx
cmp dword [0x4f4fc0], 0
je 0x45a566
cmp dword [0x4f4fc0], 0
je 0x45a564
mov edx, dword [0x4f4fc0]
cmp dword [edx + 8], 0
je 0x45a564
mov eax, dword [0x4f4fc0]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x45a564
mov edx, dword [0x4f4fc0]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x45a564
jmp 0x45a4be
jmp 0x45a518
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00458db0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45a62b
mov eax, dword [ebp - 4]
mov dword [0x4f4fc0], eax
mov ecx, dword [0x4f4fc0]
mov dword [ecx], 0x52727464
mov edx, dword [0x4f4fc0]
mov dword [edx + 8], 0
mov eax, dword [0x4f4fc0]
mov ecx, dword [0x4f4fbc]
mov dword [eax + 4], ecx
mov edx, dword [0x4f4fc0]
mov dword [0x4f4fbc], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x4f4fc0]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x38c
jmp 0x45a5f7
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 1
jle 0x45a61b
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
jmp 0x45a5ee
mov eax, dword [0x4f4fc0]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x45a4be
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x45fce0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045fa50
Function at 0x499e40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x499e59
mov esi, edi
mov edi, eax
jmp 0x499e5b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x499e6b
mov eax, ebx
jmp 0x499e75
push eax
push ebx
call fcn.00462060
add esp, 8
test eax, eax
jne 0x499e7d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x499e99
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x499e84
cmp eax, dword [esi + 4]
jge 0x499eb0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x499ea0
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x499ed1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x499ece
dec eax
test eax, eax
jg 0x499ec0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x502c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x502d8c
test eax, eax
je 0x502d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x51dff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x502d73
lea edi, [eax + 4]
jmp 0x502cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x502cec
mov dword [ebp - 4], 2
jmp 0x502d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x502d03
mov dword [ebp - 4], 1
jmp 0x502d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x502d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x502d46
mov byte [ecx], 0x3d
jmp 0x502d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x502d5d
mov byte [ecx], 0x3d
jmp 0x502d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x502cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ec4f0
Capabilities:
Parse pe header

Disassembly:
push ebx
jmp 0x62ea3b
mov byte [ebp - 0x26], 0x72
jmp loc.004035ce
push ebp
rol ax, 0x56
mov ebp, esp
sub esp, 0x16c
movsx eax, sp
add ax, di
mov eax, dword [0x4ecf70]
test ah, al
cmp bl, bh
cmp cl, 0xf4
xor eax, ebp
jmp 0x885a4b
mov byte [ebp - 0x17], 0x74
jmp 0x8469b8
mov byte [ebp - 0x15], 0x6c
jmp 0x76e50c
push esi
jmp 0x7b7f3b
mov byte [ebp - 0x12], 0x64
jmp 0x7cf7d5
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0x2e
jmp 0x72ef5d
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0
call edi
lea ecx, [ebp - 0x28]
movsx esi, bp
mov bl, 0xcc
mov bl, 0x65
cmovp si, di
mov esi, ecx
push ecx
not esi
movsx esi, cx
mov esi, eax
mov byte [ebp - 0x28], 0x6b
jmp 0x7b1005
mov byte [ebp - 0x27], bl
jmp 0x5b919d
push edi
call fcn.005af1dc
lea eax, [ebp - 0x18]
jmp 0x853c62
mov byte [ebp - 0x11], 0x6c
jmp 0x7a0c5c
mov byte [ebp - 0x16], 0x64
jmp 0x605d18
push eax
mov byte [ebp - 0x18], 0x6e
jmp 0x5fe2e2
mov dword [ebp - 4], eax
jmp 0x507500
Function at 0x6b9ae0
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
push eax
jmp loc.0040cd9b
mov byte [ebp - 0xaa], 0x52
mov byte [ebp - 0xa9], 0x4f
test esi, 0x2ae0755e
cmp edi, 0x43d533e7
mov byte [ebp - 0xa8], 0x4d
mov byte [ebp - 0xa7], 0x20
stc
mov byte [ebp - 0xa6], 0x57
jmp 0x7ed7c2
mov byte [ebp - 0x9a], 0x72
jmp 0x7f228d
mov byte [ebp - 0x9e], 0x73
mov byte [ebp - 0x9d], 0x6b
test cx, bp
mov byte [ebp - 0x9c], 0x50
test eax, eax
cmp bx, 0x74c1
mov byte [ebp - 0x9b], 0x61
jmp 0x645cb5
push 0x286f513b
call fcn.00866a3a
mov byte [ebp - 0xb1], 0x49
stc
cmc
mov byte [ebp - 0xb0], 0x6e
cmc
test edx, eax
jmp 0x704746
mov byte [ebp - 0xaf], 0x64
test dh, 0x5c
mov byte [ebp - 0xae], 0x65
cmp bp, 0x791a
stc
mov byte [ebp - 0xad], 0x78
cmp bh, 0x50
cmp esp, eax
mov byte [ebp - 0xac], 0x20
cmp ebx, ecx
test sp, 0x1f69
mov byte [ebp - 0xab], 0x46
jmp 0x5b5760
lea ecx, [ebp - 0x364]
mov word [ebp - 0x198], dx
push ecx
movsx edx, ax
mov edx, ecx
movzx dx, cl
lea edx, [ebp - 0xbc]
mov word [ebp - 0x196], ax
push edx
lea eax, [ebp - 0x86c]
jmp 0x55e636
mov byte [ebp - 0xa5], bl
stc
cmc
mov byte [ebp - 0xa4], 0x6e
cmp si, di
clc
mov byte [ebp - 0xa3], 0x33
mov byte [ebp - 0xa2], 0x32
cmp edi, 0x21fd1a20
test bp, si
mov byte [ebp - 0xa1], 0x5f
mov byte [ebp - 0xa0], 0x44
test al, 0xfd
stc
cmc
mov byte [ebp - 0x9f], bl
jmp 0x653290
mov byte [ebp - 0x99], 0x74
mov byte [ebp - 0x98], bl
mov byte [ebp - 0x97], 0x74
stc
mov byte [ebp - 0x96], bl
stc
mov byte [ebp - 0x95], 0x6f
test dh, 0x16
clc
test ebx, ebx
mov byte [ebp - 0x94], 0x6e
mov byte [ebp - 0x93], 0x20
mov byte [ebp - 0x92], 0x57
test eax, 0x4c0927b9
stc
mov byte [ebp - 0x91], 0x48
cmp esi, 0x5024765f
cmp edi, edx
mov byte [ebp - 0x90], 0x45
jmp 0x7f9cb3
mov byte [ebp - 0x8f], 0x52
mov byte [ebp - 0x8e], 0x45
cmc
mov byte [ebp - 0x8d], 0x20
cmp sp, 0x4fb1
clc
cmc
mov byte [ebp - 0x8c], 0x53
mov byte [ebp - 0x8b], 0x74
cmc
mov byte [ebp - 0x8a], 0x61
stc
mov byte [ebp - 0x89], 0x72
mov byte [ebp - 0x88], 0x74
cmp bp, ax
mov byte [ebp - 0x87], bl
test ch, ah
mov byte [ebp - 0x86], 0x6e
test esp, 0x51f31530
mov byte [ebp - 0x85], 0x67
mov byte [ebp - 0x84], 0x4f
test esi, 0x564d63ee
cmp bp, 0x6935
mov byte [ebp - 0x81], 0x73
mov byte [ebp - 0x80], 0x65
stc
mov byte [ebp - 0x7f], 0x74
mov byte [ebp - 0x7e], 0x3d
mov byte [ebp - 0x7d], 0x25
cmc
stc
mov byte [ebp - 0x7c], 0x73
cmp ecx, ebx
test edx, 0x26664579
stc
mov byte [ebp - 0x7b], 0
test esp, 0x4d865b1d
mov word [ebp - 0x1a0], cx
adc ch, cl
or ecx, esp
mov word [ebp - 0x19e], dx
mov dh, ah
rcl dx, cl
rcr dh, 0xe5
mov word [ebp - 0x19c], ax
add cx, di
mov ecx, 0x65
mov word [ebp - 0x19a], cx
mov edx, 0x78
xor eax, eax
jmp 0x747aa5
Function at 0x75af9d
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov cl, byte [eax]
jmp 0x75afa7
cmp dword [esp + 0x18], ebx
jmp 0x5ce466
mov esi, dword [esp + 0x24]
jmp 0x4fdee4
push edx
jmp 0x570e22
inc eax
cmp cl, bl
jmp 0x770165
call esi
mov edi, eax
cmova eax, edi
mov eax, dword [esp + 0x30]
push 0xffffffffffffffec
jmp 0x74cf8d
push eax
call fcn.00732363
test eax, eax
jmp 0x66b17b
je 0x6306dd
lea ecx, [esp + 0x35c]
movsx edx, dx
mov edx, 0xc4e26cd
cwd
push ecx
jmp 0x845fb9
jne 0x6ff5da
lea eax, [esp + 0x934]
movsx edx, dx
cwd
lea edx, [eax + 1]
xchg cl, cl
push eax
call fcn.00440a1f
add esp, 8
jmp loc.00414f4f
cmp dword [esp + 0x18], ebx
jne 0x780ba1
mov edx, dword [esp + 0x30]
jmp 0x6661a8
call fcn.00885ac7
push 0xfffffffffffffff4
jmp 0x537299
je 0x4fdee4
lea ecx, [esp + 0x18]
jmp 0x85ad8a
jl fcn.006d50d8
mov edi, dword [esp + 0x18]
jmp loc.0041b4c5
call esi
mov esi, eax
sub ax, bp
lea eax, [esp + 0xab4]
stc
test al, 0xec
cmp byte [esp + 0x2f], bl
jmp 0x76008f
push edx
jmp 0x5ef8a1
je 0x7fdfc7
cmp eax, 0x44a08111
jmp 0x7fdfc1
call fcn.0040eba0
test al, al
je 0x723ec9
inc dword [esp + 0x48]
stc
cmp dword [esp + 0x48], 2
jmp 0x68d783
je 0x50bf71
mov esi, dword [esp + 0x24]
cmp esi, 0x50101
jne 0x4fdee4
mov eax, dword [esp + 0x30]
push 5
jmp 0x590d60
push edx
jmp 0x81ac7c
lea edx, [esp + 0x35c]
jmp 0x6debf6
push eax
jmp 0x79ab0c
push 0xd347b363
call fcn.007fda0a
inc eax
cmp cl, bl
jmp 0x838da5
jne 0x7468ff
lea edx, [esp + 0x2dc]
jmp 0x79806c
jne 0x780bae
sub eax, edx
jmp loc.00401715
lea eax, [esp + 0x934]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
jmp 0x56cab4
push 0xfffffffffffffff0
jmp 0x7ed956
push edx
push eax
call fcn.00440a1f
lea esp, [esp + 8]
cmp sp, 0xcf2
cmp ecx, esp
test eax, eax
jmp 0x5d238a
call esi
mov ecx, dword [esp + 0x30]
jmp 0x78926f
push ecx
jmp 0x823486
jne 0x6306d3
lea eax, [esp + 0x18]
push eax
xchg ecx, edi
cmovge di, ax
lea ecx, [esp + 0x188]
movsx edi, di
bswap edi
push ecx
movsx edi, ax
not di
lea edi, [esp + 0x14c]
jmp 0x8122bd
call fcn.0040eaf0
mov edx, dword [esp + 0x15c]
xchg edi, eax
movsx eax, sp
cbw
mov eax, dword [esp + 0x144]
lea esi, [esp + 0x11c]
not di
movsx edi, di
lea edi, [esp + 0x184]
mov dword [esp + 0x120], edx
mov dword [esp + 0x11c], eax
jmp 0x723eb7
call fcn.00440a1f
add esp, 8
cmp ecx, edi
test ebx, edi
test eax, eax
jne 0x6306d3
cmp dword [esp + 0x1c], 0x3e8
jmp 0x83539c
mov dword [esp + 0x24], eax
jmp 0x6d91ab
jne 0x6306d3
mov eax, dword [esp + 0x74]
cmc
test dl, 0x8d
cmp eax, 0x44808111
jmp 0x6fde6a
jne 0x4128a7
sub eax, edx
jmp 0x72458b
lea edx, [esp + 0xab8]
jmp 0x73843f
push ecx
lea edx, [esp + 0x190]
mov edi, 0x4f52654e
movsx edi, ax
push edx
xchg edi, edi
lea edi, [esp + 0x14c]
call fcn.0040eaf0
mov eax, dword [esp + 0x15c]
xchg esi, ecx
mov ecx, dword [esp + 0x144]
mov edi, 0x10531b65
xchg si, di
not si
lea esi, [esp + 0xe4]
jmp loc.0041df19
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x1d6c760b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x285d700b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219