joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a110
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1004d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x1005b8d8]
lea eax, [ebp - 0xc]
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1002a27b
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1002a27b
mov eax, dword [0x1005b8d8]
test eax, eax
je 0x1002a15d
inc dword [eax + 0xb0]
push edi
push 0x38
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x1002a17e
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x1002a180
xor edi, edi
or dword [esi + 0xc], 6
mov dword [esi + 0x70], edi
mov dword [esi + 0x68], str.imgui_impl_win32
mov esi, dword [0x1005b8d8]
mov dword [edi], ebx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x20], 9
test esi, esi
je 0x1002a1be
mov esi, dword [esi + 0x70]
jmp 0x1002a1c0
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1002a1e3
mov dword [esi], eax
mov eax, dword [0x1005b8d8]
xor esi, esi
mov dword [ebp - 0x30], str.xinput1_4.dll
mov dword [ebp - 0x2c], str.xinput1_3.dll
mov dword [ebp - 0x28], str.xinput9_1_0.dll
mov eax, dword [eax + 0x47ec]
mov dword [ebp - 0x24], str.xinput1_2.dll
mov dword [ebp - 0x20], str.xinput1_1.dll
mov eax, dword [eax]
mov dword [eax + 0x24], ebx
mov byte [edi + 0x29], 1
nop dword [eax]
push dword [ebp + esi*4 - 0x30]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x1002a249
inc esi
cmp esi, 5
jl 0x1002a220
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004085b
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x2c], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x30], eax
call esi
mov dword [edi + 0x34], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004085b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.1004085b
mov esp, ebp
pop ebp
ret
Function at 0x10039860
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1004d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0xffffffff
je 0x10039973
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1003996c
mov ebx, 1
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x1003992f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1003992f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1003992f
mov edx, dword [esi]
test edx, edx
jne 0x100398f8
push 0x200
push edx
push dword [0x1005b8e4]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10039954
lea edi, [esi + 8]
jmp 0x10039922
mov eax, dword [esi + 4]
lea edi, [esi + 8]
cmp dword [edi], eax
jb 0x10039922
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x1005b8e4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10039986
mov dword [esi], edx
mov ecx, dword [edi]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [edi]
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100398b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1003996c
mov eax, dword [esi]
xor ebx, ebx
test eax, eax
je 0x1003996c
push eax
push ebx
push dword [0x1005b8e4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004085b
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x24]
jmp 0x10039954

Function at 0x10039990
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10039860
test eax, eax
jne 0x100399c1
mov eax, 9
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [edi], 0
je 0x10039a12
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x10039a0a
push ebx
nop
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10039a03
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.100396f0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x100399d0
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10039a20
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0
je 0x10039a6c
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x10039a5b
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10039a54
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x10039a31
pop edi
push dword [ebx]
push 0
push dword [0x1005b8e4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret

Function at 0x10039a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1004d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x1005b990]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10039ad1
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004085b
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10039af2
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10039b13
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10039b13
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10039b0d
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10039b13
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.1004085b
mov esp, ebp
pop ebp
ret
Function at 0x10039b70
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x1005b998]
sub esp, 0x10
push ebx
push esi
xor esi, esi
mov ebx, ecx
test edx, edx
je 0x10039ba4
mov eax, dword [0x1005b990]
add eax, 0x14
nop
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x10039bac
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10039b90
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp esi, 0xffffffff
je 0x10039c62
test ebx, ebx
lea ecx, [ebp - 0x10]
setne al
or edx, 0xffffffff
push eax
call fcn.10039990
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x10039c62
mov ecx, dword [0x1005b998]
push edi
cmp esi, ecx
jae 0x10039c1a
imul edi, esi, 0x2c
mov eax, dword [0x1005b990]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x10039c0f
mov edx, ebx
mov ecx, esi
call fcn.10039a70
mov dword [ebp - 4], eax
test eax, eax
jne 0x10039c1a
mov ecx, dword [0x1005b998]
jmp 0x10039c12
mov eax, dword [ebp - 4]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10039be4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10039c61
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x10039c4f
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10039c49
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10039c28
push ebx
push 0
push dword [0x1005b8e4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1003a4b3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [ebp + 8]
push 0x1003a3d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1003a4b3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
Function at 0x403d17
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movzx eax, word [edi + 6]
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.00403b02
loopne 0x403dad
xchg dword [ecx], ebp
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x403d5c
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x403d56
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x403d47
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00403b02
stosb byte es:[edi], al
and eax, 0x458d49e7
test al, 0x50
push eax
call fcn.00403b12
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00403ac7
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x403df0
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00403b02
sbb ah, byte [ebx + 0x458d7e30]
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x405ca6
Capabilities:
Access peb ldr_data

Disassembly:
and al, 0x54
call fcn.00403b02
jns 0x405c44
out 0x9b, al
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x405cc6
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00403b02
frstor dword [ebp - 0x774192e]
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00403b02
and esi, dword [edx - 0x15]
lodsb al, byte [esi]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x405cef
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x405cef
call fcn.00403b02
xchg byte [edi + 0x22], bh
pop edx
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00403b02
cmp al, byte [eax]
Function at 0x405d2c
Capabilities:
Set file attributes

Disassembly:
push eax
push esi
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
call fcn.00404302
push dword [esi + ebp - 0xa]
inc esp
and al, 0x10
add dword [esi + 0x74], edx
or bh, bh
adc eax, sym.imp.KERNEL32.dll_RemoveDirectoryW
jmp 0x405d55
test eax, eax
je 0x405d5e
xor eax, eax
inc eax
jmp 0x405d6f
test byte [esp + 0x10], 4
jne 0x405d6d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8

Function at 0x405d74
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.0040603f
test bl, 8
mov dword [ebp - 8], eax
je 0x405db3
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x4702e8], eax
jmp 0x405f30
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405dcd
test eax, eax
je 0x405ede
test bl, 2
je 0x405ede
mov esi, 0x456750
push edi
push esi
call fcn.00406668
cmp dword [ebp + 8], 0
je 0x405dec
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405df2
push edi
call fcn.00405f83
cmp word [edi], 0
jne 0x405e02
cmp word [0x456750], 0x5c
jne 0x405e0d
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405ed3
cmp word [ebp - 0x22c], 0x2e
jne 0x405e57
cmp word [ebp - 0x22a], 0
je 0x405eb6
cmp word [ebp - 0x22a], 0x2e
jne 0x405e57
cmp word [ebp - 0x228], 0
je 0x405eb6
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406668
test byte [ebp - 0x258], 0x10
je 0x405e82
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405eb6
push dword [ebp + 0xc]
push edi
call fcn.00405d74
jmp 0x405eb6
push dword [ebp - 4]
push edi
call fcn.00405d2c
test eax, eax
jne 0x405eae
cmp dword [ebp - 4], eax
je 0x405ea6
push edi
push 0xfffffffffffffff1
call fcn.004056ca
push 0
push edi
call fcn.00406428
jmp 0x405eb6
inc dword [0x4702e8]
jmp 0x405eb6
push edi
push 0xfffffffffffffff2
call fcn.004056ca
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405e2f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405ede
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405f30
cmp dword [ebp - 8], esi
jne 0x405ef2
inc dword [0x4702e8]
jmp 0x405f30
push edi
call fcn.0040699e
test eax, eax
je 0x405f30
push edi
call fcn.00405f37
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405d2c
test eax, eax
jne 0x405f28
cmp dword [ebp - 4], esi
je 0x405eea
push edi
push 0xfffffffffffffff1
call fcn.004056ca
push esi
push edi
call fcn.00406428
jmp 0x405f30
push edi
push 0xffffffffffffffe5
call fcn.004056ca
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x7f91f0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x7f9352
cmp edi, esi
je 0x7f9352
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x7f9342
add edi, 4
jmp 0x7f92a3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x7f92b8
mov dword [ebp - 4], 2
jmp 0x7f92d9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x7f92cf
mov dword [ebp - 4], 1
jmp 0x7f92d9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x7f9352
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x7f9310
mov byte [ecx + 2], 0x3d
jmp 0x7f931d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x7f932c
mov byte [ecx], 0x3d
jmp 0x7f9332
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x7f92a0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x8c0cd4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x30], 0x545205d0
or dword [esp + 0x2c], 0x52114fdd
and dword [esp + 0x2c], 0x2a294908
sub byte [esp + 0x30], 0x4e
mov dword [esp + 0x30], 0x1a89150a
mov dword [esp + 0x48], edi
sub di, di
or dword [esp + 0x18], edi
jne 0x97564f
sub dword [esp + 0x48], 0x5834d4c
cmp di, 0x15c
mov dword [esp + 0x30], 0x48f1500
setae byte [esp + 0x48]
test byte [esp + 0x38], 0x43
lea esp, [esp + 0x1c]
ret 4
Function at 0x8c0d0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00b2d565
sub edi, 1
rdtsc
movzx ecx, byte [edi]
sub edx, ebp
xor cl, bl
mov dh, dl
btr edx, 0xcb
bts eax, ebp
rol cl, 1
add cl, 9
neg cl
rdtsc
not edx
jmp 0xb277f9
jne 0xb9238f
mov eax, dword [ebp]
jmp 0x99cca7
xor ecx, ebx
cmp edx, esi
neg ecx
add ecx, 0x87d3177
ror ecx, 1
test esi, 0x28ae19ba
neg ecx
xor ebx, ecx
cmp sp, si
stc
cmp esi, 0x62c32dfd
add ebp, ecx
jmp 0xaf8845
call eax
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov esi, ebp
shld ebp, ecx, 0x4f
shl ch, cl
pop ebx
pop ebp
and cx, dx
pop edi
sub edi, 4
mov ecx, dword [edi]
jmp 0x97734d
jmp ebp
rol cl, 1
xor bl, cl
adc dx, di
rol dx, cl
btc edx, 0x16
push edi
shld eax, esp, 0x1a
adc dx, 0xcb6
push ebp
xchg bp, dx
bswap ax
push ebx
mov bp, bx
mov ebp, esi
rcl dx, 0xbf
mov ebx, ecx
mov edx, ebx
neg ah
inc ah
movsx ax, dl
shl edx, 2
rol ax, 0xac
test dh, ch
sal ax, cl
mov eax, ebp
cmc
cmp sp, dx
add eax, edx
cmc
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0xb92389
je 0x95a642
mov eax, dword [ebp + ebx*4]
push eax
cmp edx, edi
test sp, cx
clc
sub ebx, 1
jmp 0x95a63c

Function at 0x8f4f6a
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esi + 4]
add esi, 8
cmc
jmp 0xb6ac96
sub word [esp + 0xc], 0x54d7
and dword [esp + 0xc], 0xf251207
test dword [esp + 0xc], 0x3114426e
mov byte [esp + 0xc], 0x37
setge byte [esp + 0xc]
xor word [esp + 0xc], 0x487a
or word [esp + 0xc], 0x7d9
je 0x869693
neg dword [esp + 0xc]
neg dword [esp + 0xc]
jne 0xb4606f
mov ecx, dword [esi]
jmp 0x802c4a
or byte [esp + 0xc], 0x40
neg dword [esp + 0xc]
jl 0x8b38c3

Function at 0x916cc1
Capabilities:
Encode data using xor

Disassembly:
sub ebx, dword [esp + 0x1c]
neg byte [esp + 0x1c]
not ebx
or bx, word [esp + 0x1e]
and ebx, 0x3b313a75
cmp dword [esp + 0xc], 0x211d0168
not word [esp + 0xc]
movsx ebx, word [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x1c], 0x713b68
not dword [esp + 0x1c]
call fcn.009d9c3f
test eax, 0x944ba653
and eax, 0x170f8a47
daa
inc esi
cmp dl, 0xe9
invalid
sub ebx, ebx
not dword [esp + 0x1c]
mov ebx, dword [esp + 0xc]
test dword [esp + 0x1c], 0x586a1cea
movsx ebx, bl
mov ebx, dword [esp + 0xc]
jns 0x801fe0
pop ebx
mov dh, 0x77
mov esi, 0xa8adeea
in eax, dx
push esp
inc esp
outsb dx, byte [esi]
jmp 0x79dc4412

Function at 0x97698c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x1aa0049a
jle 0xa9ee59
dec ebp
arpl sp, sp
clc
dec ecx
add edi, esp
jmp fcn.009b2fb3
mov esi, dword [esp + 0x24]
seto byte [esp + 0x10]
lea ebp, [ebp + edi + 0x798608ba]
and edi, 0xaa645dc
mov ebx, edi
lea ecx, [edx*4 + 0x2c1b7885]
not edi
lea ebx, [edx + ecx*8 + 0x12bc21a1]
jle 0x87bbe6
neg ebx
add dword [esp + 4], 0x20bc89
add cl, byte [esp + 0x13]
test cx, dx
lea ebp, [edx + ebp + 0x5f720b96]
cmovns ecx, dword [esp + 0x14]
xor edx, dword [esp + 0x18]
or dword [esp + 0x14], 0x198d5d9b
neg byte [esp + 0x14]
setae dl
seto bl
mov ebx, edi
jo 0x8b8391
mov ecx, dword [esp + 0x2c]
seto dl
call fcn.008deee5
Function at 0xa87161
Capabilities:
Execute anti-debugging instructions

Disassembly:
and dword [esp + 0x20], 0x41771f08
not byte [esp + 0x20]
test edi, edi
call fcn.00b0d795
push ebp
ret
not ebx
mov cx, word [esp + 0x20]
movzx edi, word [esp + 0x20]
mov ebx, dword [esp + 0x2c]
bswap ecx
jo fcn.00af2b14
jne 0xa0d923

Function at 0xa923b7
Capabilities:
Encode data using xor

Disassembly:
rol edx, 3
not edx
ror edx, 3
clc
inc ecx
test bh, 0x5f
neg edx
xor edx, 0x10433b16
dec ecx
test ebp, 0x2020070d
inc cx
cmp ebx, 0x81f84db4
ret 0x78c
not di
and edi, dword [esp + 0x14]
xor edi, dword [esp + 0x14]
cmp dword [esp + 0x14], 0x23d3472c
not edi
jg fcn.00a923b7
neg byte [esp + 0x14]
movzx edi, word [esp + 0x14]
bswap edi
call fcn.009fd012
inc ecx
inc ch
inc ecx
rol ch, 1
inc cx
sub edx, esi
cmp ax, 0x148d
dec eax
arpl di, dx
inc ecx
xor dh, ch
inc ecx
sub dl, cl
inc ecx
test cl, 0xe0
stc
dec ecx
sub edi, 2
shl edx, cl
mov dl, 6
ror dl, 0xb9
inc bp
mov dword [edi], ebp
sar edx, cl
dec eax
sub ebp, 4
rcr dh, cl
cdq
sar dx, cl
mov edx, dword [ebp]
xor edx, esi
jmp 0x7f83e1