joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10c1500
Capabilities:
Manipulate boot configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x464
mov dword [ebp - 0x444], ecx
mov eax, dword [ebp - 0x444]
cmp dword [eax + 0x28], 0
je 0x10c1525
or eax, 0xffffffff
jmp 0x10c175f
call fcn.010905a0
mov dword [ebp - 4], eax
mov word [ebp - 0x440], 0
push 0xfe
push 0
lea ecx, [ebp - 0x43e]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x80
lea edx, [ebp - 0x440]
push edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x32c], eax
mov ecx, dword [ebp - 0x444]
cmp dword [ecx + 0x2c], 0
je 0x10c15e6
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x2c]
mov dword [ebp - 0x448], eax
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x44c], ecx
mov edx, dword [ebp - 0x44c]
mov dword [ebp - 0x450], edx
mov eax, dword [ebp - 0x448]
mov cx, word [eax]
mov word [ebp - 0x452], cx
mov edx, dword [ebp - 0x44c]
mov ax, word [ebp - 0x452]
mov word [edx], ax
mov ecx, dword [ebp - 0x448]
add ecx, 2
mov dword [ebp - 0x448], ecx
mov edx, dword [ebp - 0x44c]
add edx, 2
mov dword [ebp - 0x44c], edx
cmp word [ebp - 0x452], 0
jne 0x10c159e
cmp dword [ebp - 0x32c], 0
jne 0x10c15f7
or eax, 0xffffffff
jmp 0x10c175f
mov word [ebp - 0x120], 0
push 0xfe
push 0
lea eax, [ebp - 0x11e]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x458], ecx
lea edx, [ebp - 0x120]
mov dword [ebp - 0x45c], edx
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x460], eax
mov ecx, dword [ebp - 0x458]
mov dx, word [ecx]
mov word [ebp - 0x462], dx
mov eax, dword [ebp - 0x45c]
mov cx, word [ebp - 0x462]
mov word [eax], cx
mov edx, dword [ebp - 0x458]
add edx, 2
mov dword [ebp - 0x458], edx
mov eax, dword [ebp - 0x45c]
add eax, 2
mov dword [ebp - 0x45c], eax
cmp word [ebp - 0x462], 0
jne 0x10c163a
mov word [ebp - 0x328], 0
push 0x1fe
push 0
lea ecx, [ebp - 0x326]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x120]
push edx
push 0x1005718
lea eax, [ebp - 0x328]
push eax
call sub.ntdll.dll_swprintf
add esp, 0xc
lea ecx, [ebp - 0x328]
push ecx
lea edx, [ebp - 0x334]
push edx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0x40
lea eax, [ebp - 0x334]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x338], 1
cmp dword [ebp + 8], 0
je 0x10c1716
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x128], 0
push 0
push 0
push 0x60
mov ecx, dword [ebp - 0x338]
push ecx
push 1
push 0x80
push 0
lea edx, [ebp - 0x340]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0xc0100000
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.ntdll.dll_ZwCreateFile]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x128]
mov esp, ebp
pop ebp
ret 4
Function at 0x1112210
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x64]
test ecx, ecx
je 0x1112263
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x68]
push eax
call dword [sym.imp.ntdll.dll_NtReadFile]
mov dword [ebp - 0x10], eax
jmp 0x111234d
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x84]
xor eax, eax
sub edx, 1
sbb eax, 0
not edx
not eax
and edx, dword [ebp + 0xc]
and eax, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x84]
mov eax, dword [ebp + 0x14]
lea ecx, [eax + edx - 1]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x84]
sub eax, 1
not eax
and ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x84]
lea eax, [ecx + edx - 1]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x84]
sub edx, 1
not edx
and eax, edx
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call fcn.0108d180
push eax
call sub.ntdll.dll_RtlAllocateHeap
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x11122fb
mov dword [ebp - 0x10], 0xc000009a
jmp 0x111234d
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x68]
push eax
call dword [sym.imp.ntdll.dll_NtReadFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x111232d
jmp 0x111234d
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 4]
add edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x1112364
mov edx, dword [ebp - 0x14]
push edx
push 0
call fcn.0108d180
push eax
call sub.ntdll.dll_RtlFreeHeap
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1112380
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x64]
test ecx, ecx
je 0x11123d3
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x68]
push eax
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov dword [ebp - 0x10], eax
jmp 0x1112503
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x84]
xor eax, eax
sub edx, 1
sbb eax, 0
not edx
not eax
and edx, dword [ebp + 0xc]
and eax, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x84]
mov eax, dword [ebp + 0x14]
lea ecx, [eax + edx - 1]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x84]
sub eax, 1
not eax
and ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x84]
lea eax, [ecx + edx - 1]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x84]
sub edx, 1
not edx
and eax, edx
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call fcn.0108d180
push eax
call sub.ntdll.dll_RtlAllocateHeap
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1112471
mov dword [ebp - 0x10], 0xc000009a
jmp 0x1112503
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x14]
jne 0x1112489
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0xc]
jne 0x1112489
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
je 0x11124bb
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x68]
push eax
call dword [sym.imp.ntdll.dll_NtReadFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x11124bb
jmp 0x1112503
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 4]
add eax, dword [ebp - 0x14]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x68]
push ecx
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0
je 0x111251a
mov edx, dword [ebp - 0x14]
push edx
push 0
call fcn.0108d180
push eax
call sub.ntdll.dll_RtlFreeHeap
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1116460
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.01116100
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x1116489
mov edx, dword [ebp - 0x10]
push edx
call sub.ntdll.dll_RtlNtStatusToDosError
jmp 0x11164cd
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_ZwDeleteValueKey]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
and ecx, 1
je 0x11164ba
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntdll.dll_ZwClose]
cmp dword [ebp - 0x10], 0
jge 0x11164cb
mov eax, dword [ebp - 0x10]
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
jmp 0x11164cd
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x11171b0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.01116100
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x11171dc
mov edx, dword [ebp - 0x10]
push edx
call sub.ntdll.dll_RtlNtStatusToDosError
jmp 0x111727d
cmp dword [ebp + 0xc], 0
je 0x11171f2
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0x1117201
push 0x1001464
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x14], 1
je 0x1117219
cmp dword [ebp + 0x14], 7
je 0x1117219
cmp dword [ebp + 0x14], 2
jne 0x1117239
cmp dword [ebp + 0x1c], 0
je 0x1117239
mov ecx, dword [ebp + 0x1c]
shr ecx, 1
mov edx, dword [ebp + 0x18]
movzx eax, word [edx + ecx*2 - 2]
test eax, eax
je 0x1117239
mov ecx, dword [ebp + 0x1c]
add ecx, 2
mov dword [ebp + 0x1c], ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
and ecx, 1
je 0x111726a
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntdll.dll_ZwClose]
cmp dword [ebp - 0x10], 0
jge 0x111727b
mov eax, dword [ebp - 0x10]
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
jmp 0x111727d
xor eax, eax
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1141d60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11826db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x14], ecx
xor eax, eax
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0xd]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x20
call fcn.01099550
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov dword [edx + 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x18], edx
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x1c], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x10], 0xc
xor eax, eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x30
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x40], 0
mov ecx, dword [ebp - 0x14]
call fcn.01142090
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x117b5a0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11833a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x14], ecx
xor eax, eax
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0xd]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.01180c00
mov dword [ebp - 4], 0
xor edx, edx
mov byte [ebp - 0xe], dl
lea eax, [ebp - 0xe]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.01099550
mov byte [ebp - 4], 1
xor ecx, ecx
mov byte [ebp - 0xf], cl
lea edx, [ebp - 0xf]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c
call fcn.01099550
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x2c], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x14]
mov word [edx + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x40c65178
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0xeb6213a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x73391148
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x48a575c9
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x128ae17
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0128ac65
mov ecx, edi
lea eax, [eax + 0xf0]
mov al, 0x8e
jmp 0x128ae53
xor dl, 0xe9
mov cx, word [esp]
rcl ecx, cl
jns 0x128aed2
shl ch, 6
mov cx, word [esp]
jmp 0x128aed4
jmp 0x128af13
mov cl, ch
btc cx, dx
mov cx, sp
call fcn.0128b57b
pop ebx
leave
pop ecx
cmp bl, cl
or bh, bl
push 0xfffffffffffffff8
lahf
push 0xffffffffffffffac
pop ds
invalid
shl ch, 6
mov cx, word [esp]
mov cl, ch
btc cx, dx
mov cx, sp
mov ecx, 0x13c76c33
jmp 0x128af4d
inc dl
xchg al, ah
cmp cx, 0x5a49
js 0x128af73
jns 0x128afb3
cmpsb byte [esi], byte es:[edi]
xor dword [ecx - reloc.iphlpapi.dll_GetAdaptersInfo], esp
mov bl, 0xaa
mov al, dl
rcr eax, 0x15
bsr ecx, ecx
mov ecx, edx
push dword [esp]
ret 4
mov cl, 0x32
or ah, bh
xor dl, 0x85
sub esp, 0x18
jmp 0x128afb9
inc cx
xchg word [esp + 8], ax
jmp 0x128b133
mov cl, 0x32
or ah, bh
jmp 0x128af77
jae 0x128af9d
inc cx
xchg word [esp + 8], ax
jmp 0x128b133
and edx, 0x3c

Function at 0x128b097
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [edx + esi], ecx
jmp 0x128afe9
Function at 0x12ae631
Capabilities:
Encode data using base64

Disassembly:
jmp 0x12ae67c
jmp 0x12ae692
lea esp, [esp + 4]
jb 0x1278fa9
cmp bl, 0x5a
jbe 0x1278fde
ja 0x1278fa9

Function at 0x12c057e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [eax], 0
inc eax
jmp 0x12bd349
push di
mov byte [esp], bh
lea esp, [esp + 2]
push ebx
jmp 0x12bf4d0
jmp 0x12bd32a
btc edx, esp
xchg ebx, edx
not bh
jmp 0x12c05de
pop word [esp]
lea esp, [esp + 2]
jmp 0x12bd3ac
jmp 0x12bd394
push ebp
jmp 0x12bd3f1
lea esp, [esp + 8]
sub esp, 0x84
jmp 0x12bd444
lea ebp, [esp - 0x78]
pushfd
push dword [esp]
jmp 0x12bd3db
push esi
jmp 0x12bd46d
pushal
mov dword [esp + 4], eax
popal
jmp 0x12bd414
push esi
mov si, 0x68ff
lea esi, [edi*4]
mov esi, dword [esp]
bswap esi
jmp 0x12bd42a
pushal
rdtsc
mov dword [esp + 4], ebp
call fcn.012bd457
popal
lea esi, [esi + 0x74]
push edi
mov edi, 0x6ccc3b87
jmp 0x12be49e
lea eax, [ebp - 0xc]
jmp 0x12bd349
lea edi, reloc.iphlpapi.dll_GetAdaptersInfo
mov dword [esi], edi
pop edi
pop esi
mov ah, dh
jmp 0x12bd488
dec dword [ebp + 0x74]
push edi
sub esp, 0xc
mov byte [esp + 8], al
jmp 0x12bf4f0
mov ebx, ebp
lea ebx, [ebx + 0x74]
mov ecx, dword [ebx]
pop ebx
jmp 0x12bf4ba
mov eax, dword [esp]
mov cx, di
jmp 0x12bf504
lea esp, [esp + 0x10]
test ecx, ecx
jne 0x12bd324
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
jmp 0x12bf4da
mov eax, dword [esi]
mov cx, word [esp]
sub esp, 0x10
jmp 0x12c0929
lea esp, [esp + 8]
mov byte [ebp - 0xc], 0x80
call 0x12c0534
sub eax, ecx
mov cl, 0x17
mov cl, byte [esp]
jmp 0x12c05d4
call fcn.01296301
setns dl
mov cx, word [esp]
neg dh
jmp 0x12c05af
mov eax, dword [esp]
sub esp, 0x17
add esp, 0x11
lea esp, [esp + 2]
cmp ecx, eax
jmp 0x12c0571
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
pop ecx
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
xor ecx, ecx
jmp 0x12c0626
lea esp, [esp + 4]
lea ecx, [ebp - 0xc]
push ecx
jmp 0x12c0587
movzx edx, byte [eax + 1]
push esi
mov esi, eax
jmp 0x12c0600
push ebx
jmp 0x12bd37e
movzx ebx, byte [esi]
pop esi
shl edx, 8
or edx, ebx
jmp 0x12c060f
movzx ebx, byte [eax - 1]
jmp 0x12c0632
mov edx, dword [esp]
lea eax, [esi + 0x1a]
bswap edx
neg edx
jmp 0x12c05fa
shl edx, 8
or edx, ebx
lea ebx, reloc.iphlpapi.dll_GetAdaptersInfo
pushfd
jmp 0x12c0667
push si
call fcn.012c0677
dec esp
das
xchg esp, eax
jbe 0x12c064d
xor al, 0x12
cmpsb byte [esi], byte es:[edi]
cmp dl, byte [esi - 0x554c25c1]
adc ah, byte [esi - 0x25c069c6]
mov bl, 0xaa
lds esi, [esi - 0x48]
enter 0x6aab, 0x38
mov ax, 0xabc8
push 0x38
mov eax, esp
neg ax
jmp 0x12c059e
movzx ebx, byte [eax - 2]
sub esp, 0x1a
lea esp, [esp + 2]
shl edx, 8
jmp 0x12c0640
mov dword [ebp + 0x70], ecx
mov ecx, eax
mov al, 0x36
bsf eax, ecx
inc eax
jmp 0x12c0657
shr eax, 3
lea esp, [esp + 0x10]
and eax, 0x3f
cmc
jmp 0x12c0691
mov ecx, dword [esi + 4]
mov dword [ebp + 0x6c], eax
stc
jmp 0x12c08df
Function at 0x1586713
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg bx
cpuid
rdtsc
cpuid
mov esi, 0xa72d85f1
pushfd
jmp 0x158672b
jmp 0x15866fd
bswap ebx
inc bp
xchg cx, bp
not ebp
cpuid
xchg edi, ebp
jmp 0x15867b9
sub esp, 5
push cx
xchg byte [esp + 8], bl
mov dword [esp + 5], ebx
mov dh, 0x45
bts si, si
jmp 0x1586715
not dh
cld
rdtsc
sub esp, 0x1d
lea esp, [esp + 8]
btr ecx, edi
jmp 0x1586797
setae cl
mov ch, 0xa7
not cx
mov bp, 0x4f31
mov si, ax
xchg ecx, ebp
jmp 0x158676e
rdtsc
xchg bl, cl
xchg edi, eax
pop edx
sub esp, 0xf
mov ch, byte [esp + 0x1c]
jmp 0x15867ff
pop ecx
inc bx
pop dword [esp + 3]
mov al, 0x2b
add esp, 7
lea ebp, [edi - 0x4d]
jmp 0x1586784
add esp, 0
neg bx
inc eax
rdtsc
and cx, si
lea ebp, [ecx + ebp]
jmp 0x158686e
lea esp, [esp + 0x14]
neg si
xchg ebp, edx
rdtsc
rdtsc
mov eax, dword [esp]
jmp 0x15867ca
lea esp, [esp + 0xe]
mov dword [esp + 6], esp
bswap ebx
rdtsc
xchg cl, dh
mov bx, word [esp + 0x11]
jmp 0x15867e0
not cl
mov ah, 7
rcl dx, cl
ror ebx, 3
mov ebx, 0xd3f9c52d
call fcn.01586842
pushfd
cpuid
xchg dword [esp], esi
pop ax
mov bh, 0x9b
jmp 0x15868c8
lea esi, [esi*4]
pop dx
sete bl
mov eax, 0xec2ceab0
mov ecx, 0x7d04fdc5
lea esi, [esp + edx]
jmp 0x1587989
mov ah, 0xf9
xchg si, ax
call fcn.0158757a
imul ebp, ebx, 0x7b
push ds
in eax, dx
add eax, 0xe5820c83
adc al, 0xf6
pop ss
cdq
or dword [eax - 0x65], ebp
jb 0x1587a1c
cli
push 0x4b19fa0f
fisttp word [edi + 0x2a]
fld dword [0xc1a630a3]
xor cl, bl
mov edi, 0x37c4bd2d
xchg edx, eax
scasd eax, dword es:[edi]
lodsb al, byte ds:[esi]
retf
dec edx
into
pop esp
cmp edx, esi
cmp al, bl
arpl bx, si
xchg esi, eax
mov ch, byte gs:[esi]
movsb byte es:[edi], byte [esi]
cmp bl, byte [ebp - 0x54]
dec esi
pop eax
rol dword [ecx + 0x20], 1
sal dword [esi - 0x26], cl
push edx
shl byte [edi - 0x28a779ae], 0x47
and dl, cl
xor dh, al
dec eax
fidivr word [ecx - 0x1a9759b8]
jne 0x1587a66
out dx, eax
setp byte [esi]
test bl, ah
push ds
cmc
or byte [ebx + 0x688d7e1b], cl
mov esi, 0x34c5a22c
salc
xor al, 0xd6
test al, 0x39
test eax, 0x8ad03bc8
sbb cl, byte [eax - 0x1742e511]
jg 0x1587a5c
mov bh, ch
sbb bh, byte [ebp - 0x75108018]
jns 0x1587ae6
mov bh, byte [ecx + 0x76]
invalid
invalid
or byte [edx - 0x1e], bh
jo 0x1587aaf
loop 0x1587aef
mov eax, 0x21d2b727
test al, 0xc6
pop eax
into
test eax, 0xb535df58
and eax, 0x2569bf4c
cmpsb byte [esi], byte es:[edi]
xor al, 0x53
push ebx
scasb al, byte es:[edi]
dec eax
push ebp
fisttp dword [ebx + 0x2e]
fnstsw word [edx]
mov ebp, 0x44b5d23c
cmpsb byte [esi], byte es:[edi]
lea ecx, [ecx]
cdq
clc
or esp, eax
sub eax, 0xaa5f38aa
dec edx
dec ebp
iretd
not byte [ecx - 0x62ea76a0]
popfd
or eax, 0x6547a754
out dx, al
jl 0x1587afb
not byte [ecx + 0x75]
add edx, dword [ebx + reloc.iphlpapi.dll_GetAdaptersInfo]
les ebx, [edx + 0x3d]
xchg ebx, eax
test byte [0x5ac44dd7], 0x3d
add eax, 0x5ac44dd7
cmp eax, 0x71fd23cc
loope 0x1587a72
int3
jno 0x1587ad2
xor byte [ebx - 0x61], 0xfd
jae 0x1587a93
std
jb 0x1587ad7
xchg dword [edx - 0x70], esi
std
ja 0x1587ae4
xor byte [ecx - 0x6c], 0xe5
push 0x8b6899fe
adc eax, 0x8f7c1585
outsd dx, dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte ss:[esi]
ret