joyce8/EMBER2024-capa huggingface dataset:
Function at 0x548eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
xor eax, eax
push esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 8], al
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
push edi
mov al, 0x6f
mov byte [ebp - 0x20], al
xor eax, eax
push 0x7f
push eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], ax
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc0], al
lea eax, [ebp - 0xbf]
push eax
mov dword [ebp - 0x38], 0x2a2f2a
mov dword [ebp - 0xc], 0x54534f50
mov dword [ebp - 0x2c], 0x646e6957
mov dword [ebp - 0x28], 0x2073776f
mov dword [ebp - 0x24], 0x6c707845
mov dword [ebp - 0x1f], 0x726572
call fcn.0054be60
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 0x7d8]
add esp, 0xc
cmp dword [esi + 0x954], 0
jne 0x548f61
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x2c]
push edx
push esi
call fcn.0054a980
add esp, 0x18
mov dword [esi + 0x954], eax
test eax, eax
je 0x549070
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x548f89
lea esp, [esp]
cmp dword [eax], 0xa0d0a0d
je 0x548f80
inc eax
cmp byte [eax], 0
jne 0x548f70
jmp 0x548f89
mov dword [eax], 0
add eax, 4
push ebx
mov dword [ebp + 8], eax
push 0x2f
lea eax, [edi + 0x4f3cb0]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.0054bde0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x954]
push 1
push 0
push 3
push 0
push 0
push 0x50
push eax
push ecx
lea edx, [ebp - 0x38]
push esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0
call fcn.0054a9f0
mov ebx, eax
add esp, 0x30
test ebx, ebx
je 0x54906f
push 1
push 0
lea edx, [ebp - 0x40]
push edx
push 0
push 0
lea eax, [edi + 0x4f3c70]
push eax
lea ecx, [ebp - 0xc]
push ecx
push ebx
push esi
call fcn.0054aa70
add esp, 0x24
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x549012
push ebx
push esi
call fcn.0054abd0
add esp, 8
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
call fcn.0054c0b0
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.0054c0b0
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc0]
push edx
push eax
push esi
call fcn.0054aaf0
add esp, 0x18
test eax, eax
jle 0x54905b
cmp dword [ebp + 0x1c], 0
je 0x54905b
mov dword [edi + 0x2050], 1
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.0054abd0
push ebx
push esi
call fcn.0054abd0
add esp, 0x10
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x54a980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x10]
push ecx
push edx
lea esi, [eax + 0x958]
push esi
push eax
mov dword [ebp - 0x10], 0x65746e49
mov dword [ebp - 0xc], 0x74656e72
mov dword [ebp - 8], 0x6e65704f
mov word [ebp - 4], 0x41
call fcn.0054b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x54a9de
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x54a9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x95c]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x6e6e6f43
mov dword [ebp - 8], 0x41746365
mov byte [ebp - 4], 0
call fcn.0054b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x54aa5f
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x54aa70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x960]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0054b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x54aadf
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x54aaf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x964]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0054b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x54ab53
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x54ab60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x968]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.0054b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x54abbf
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x54abd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x96c]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.0054b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x54ac26
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x54b410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x54b476
cmp dword [esi + 0x18], 0
je 0x54b491
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0054cd20
add esp, 8
test eax, eax
jne 0x54b46e
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x54b450
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x54b491
mov eax, dword [esi + 0x18]
test eax, eax
je 0x54b491
cmp eax, ecx
je 0x54b46e
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x54b484
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x54b4a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x54b4f8
cmp dword [esi + 0x18], 0
je 0x54b4f8
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0054cd20
add esp, 8
test eax, eax
jne 0x54b500
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x54b4e0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x54b510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x54b568
cmp dword [esi + 0x18], 0
je 0x54b568
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0054cd20
add esp, 8
test eax, eax
jne 0x54b570
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x54b550
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x54b620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x54b664
cmp dword [eax + 0x18], 0
je 0x54b664
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x54b657
mov esp, ebp
pop ebp
ret

Function at 0x54b670
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0054be60
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x54b6fb
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0054c480
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.00544df0
add esp, 0x10
test eax, eax
jne 0x54b703
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x54b6d0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x54bb40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x54bb4e
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x54bb4a
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x54bb4a
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x54bb90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x54bbb4
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x54bbb4
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x54bbbc
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.0054bf90
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.0054be10
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.0054bde0
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x54bc4e
mov dword [ebp + 0xc], edx
jmp 0x54bbf9
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x54bc10
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x54bc26
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x54bc33
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.0054bde0
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x54bbf7
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54bc60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x54bc80
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x54bc80
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x54bc84
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x54bd00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x54bd20
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x54bd20
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x54bd24
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x54bd20
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x54ca00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x54cc3c
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0054be60
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x54cbcc
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x54cbc2
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.0053abf0
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x54cbed
inc eax
cmp byte [esi + eax], 0
jne 0x54cbe6
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0054bde0
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x54cc0a
inc edi
cmp byte [edi + ebx], 0
jne 0x54cc03
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x54cc1a
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x54cc12
test esi, esi
je 0x54cc2f
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0054be30
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6bca60
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf06aded0
jmp 0x6bca76
pushal
mov dword [esp + 0x28], esi
pushal
jmp 0x6bca48
mov dword [esp + 1], ecx
pushal
mov dword [esp + 0x28], esi
pushal
mov dword [esp + 0x44], edi
jmp 0x6bca6c
mov dword [esp + 0x44], edi
jmp 0x6bca6c
push dword [esp + 1]
jle 0x6bca34
mov dword [esp + 1], ecx
jmp 0x6bca1e
lea esp, [esp + 0x44]
pushfd
jmp 0x6bc9b9
mov bx, 0xd2b7
push si
or ah, 0xfb
jmp 0x6bcaa9
je 0x6bcacf
lea esp, [esp + 2]
jmp 0x6bcad3
jl 0x6bca93
neg ch
mov esi, dword [esp]
jmp 0x6bcb0e
lea esp, [esp + 2]
mov edi, dword [esp + 0x2c]
xor bx, 0x8d90
jmp 0x6bcab1
push cx
lea esp, [esp + 2]
jmp 0x6bcaf4

Function at 0x6bcb16
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0x6bcb51
mov ebx, edi
mov dh, byte [esp]
mov cx, 0xcf15
rcr ax, cl
jns 0x6bcb3b
js 0x6bcc4c
push es
lcall 0xff64, 0x5f9a6f08
outsd dx, dword [esi]
or bh, cl
mov dh, 0x52
mov cx, ax
mov cx, si
mov eax, 0xcfc1e340
jmp 0x6bcbc6

Function at 0x6bd357
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edi - 0x40]
mov dx, ax
mov dx, 0xca3d
rdtsc
call fcn.006bd171
call 0x6bd1d3
ror byte [esi - 0x24], 1
mov ebx, 0xe342e556
jae 0x6bd1d3
in eax, 0x22
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x2d]
dec edx
rol cl, 0
mov edx, 0xc9ab60b6
adc ax, cx
jl 0x6bd1ae
jge 0x6bd1ae
xchg ah, dl
call fcn.006bd200
sti
cmc
pushfd
outsd dx, dword [esi]
test al, 0xb
xchg esi, eax
add al, 0x63
sahf
das
xchg dword [esi], ebp
cmp dword [eax], ebx
lea esp, [esp + 8]
neg cl
ror edx, cl
jmp 0x6bd27a
js 0x6bd290
lea eax, [edx*4]
sub ax, sp
jmp 0x6bd2bb
lea eax, [edx*4]
sub ax, sp
lea edx, reloc.PSAPI.DLL_GetMappedFileNameW
or dl, bh
jmp 0x6bd2c9
lea edx, reloc.PSAPI.DLL_GetMappedFileNameW
or dl, bh
jmp 0x6bd2c9
dec cl
lea edx, [ebx + 0x98]
not edx
btr ax, sp
jno 0x6bd33d
mov edx, 0x4d79731a
jmp 0x6bd33f
xchg dword [esp + 4], edi
rdtsc
mov dx, bx
bsr eax, edx
inc edx
rdtsc
jmp 0x6bd19a
mov edx, 0x4d79731a
jmp 0x6bd33f
jmp 0x6bd327
mov edx, ecx
neg ax
jp 0x6bd3b0
lea eax, [edi*4]
mov ax, sp
jmp 0x6bd36a
push edi
lea edx, [ebx*4]
bts eax, edi
mov dx, 0xb6ca
neg edx
jmp 0x6bd313
mov eax, dword [esp]
jmp 0x6bd386
mov ax, sp
mov eax, dword [esp]
neg ah
jmp 0x6bd3cf
shr ax, 9
shl edx, 2
push dx
bsf eax, esp
mov eax, ecx
lea esp, [esp + 2]
jmp 0x6bd927
lea eax, [edi*4]
jmp 0x6bd380
push dx
bsf eax, esp
mov eax, ecx
jmp 0x6bd39c
jo 0x6bd38e
shr ax, 9
shl edx, 2
jmp 0x6bd3b9
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
jmp 0x6bc9e1
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
pushfd
jmp 0x6bd475
neg ax
jnp 0x6bd4b8
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
pushfd
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
jmp 0x6bc9e1
Function at 0x6ed314
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
popal
mov dl, byte [esp]
mov edx, dword [esp]
jmp 0x6ed38a
push dword [esp + 1]
jmp 0x6ed2fe
shr ecx, 0x12
mov dx, word [esp]

Function at 0x701221
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop word [esp]
pushfd
lea esp, [esp + 2]
shl edx, 8
push esi
jmp 0x701239
jmp 0x7011fe
shl edx, 8
jmp 0x70125c
or edx, ebx
mov bx, bp
neg bl
movzx ebx, byte [eax - 1]
jmp 0x701223
movzx ebx, byte [eax - 2]
jmp 0x70126b
or edx, ebx
lea ebx, [ecx - 0xf5]
clc
bsf bx, cx
jmp 0x701246
shl edx, 8
pushal
lea esp, [esp + 0x18]
or edx, ebx
jmp 0x70129b
push eax
mov eax, ecx
lea eax, [eax*4]
jmp 0x70142f
push dword [esp + 3]
lea esp, [esp + 8]
lea eax, [ebp + 0x34]
jmp 0x7012c2
cmp ecx, 0xe
jb 0x701006
lea ecx, [esi + 8]
pushfd
jmp 0x7012d8
lea esp, [esp + 0x14]
inc ecx
add eax, 4
jmp 0x7012f5
lea eax, [eax + ebp]
add eax, 0x34
mov dword [eax], edx
pop eax
jmp 0x70133f

Function at 0x7b4e57
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0x10], bh
jmp 0x7b4ee4
pop edx
xchg dx, bp
cpuid
mov dl, byte [esp + 1]
mov si, 0xd678
jmp 0x7b4ec5
pop word [esp + 4]
rdtsc
mov ecx, ebx
mov byte [esp + 3], bh
mov esi, ebx
add esp, 2
jmp 0x7b4e9b
xchg bp, cx
mov ax, cx
xchg word [esp], si
mov cx, sp
bswap esi
push word [esp + 1]
jmp 0x7b4f0e
push edx
lea esp, [esp + 0x17]
rcr cl, 6
btc bx, cx
xchg byte [esp + 7], bl
bswap eax
jmp 0x7b4eb1
or dh, 0xa8
bsr si, sp
rdtsc
mov cx, word [esp]
mov ebp, dword [esp]
jmp 0x7b4f39
mov edi, dword [esp + 1]
not al
pop word [esp]
mov eax, dword [esp]
xchg byte [esp], dh
bsf esi, ebx
jmp 0x7b4ef8
mov dh, ah
mov cx, 0xe490
adc si, 0xdfa5
mov di, 0x4f16
jmp 0x7b4f64
sub esp, 0xf
pop word [esp + 1]
dec cl
pop ebx
lea esp, [esp + 3]
mov byte [esp + 4], dh
jmp 0x7b4f23
xchg dword [esp + 7], edx
call fcn.007b4f91
cmp al, byte [eax]
add byte [eax], al
arpl word [0x11f5], ax
jg 0x7b4f53
push 0xd
cld
pop ebx
popal
push dword [esp + 4]
xchg cl, bl
mov ebp, dword [esp + 4]
and ecx, 0xaab50f23
xchg si, di
cpuid
jmp 0x7b4f4e

Function at 0x7b5122
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
neg bp
mov bx, 0x2ca7
mov dx, 0x3c7d
jmp 0x7b5d14
mov esi, edx
add esp, 0
xchg word [esp + 2], cx
clc
xchg di, dx
mov si, 0x8de8
jmp 0x7b51a4
mov bp, word [esp + 0xc]
btc ax, bx
bswap ecx
rcr ecx, 0
setg cl
mov ebp, 0xc516ddab
jmp 0x7b5169
mov word [esp + 3], dx
ror ebx, cl
xchg dword [esp + 0xe], ebp
mov ebx, 0x9296e15c
lea edi, reloc.PSAPI.DLL_GetMappedFileNameW
inc esi
xchg dx, cx
push word [esp + 7]
push dword [esp + 1]
jmp 0x7b518c
mov dword [esp + 8], esp
mov bx, si
xchg byte [esp + 0x10], dh
mov edi, dword [esp + 6]
setle ch
lea edi, [esi + esi]
jmp 0x7b51c3
mov byte [esp + 0x12], cl
bsr edi, edi
bsf ax, sp
lea esp, [esp + 0xa]
pop dx
mov bh, 0x78
jmp 0x7b521b
lea esp, [esp]
rdtsc
mov ebp, 0xec291788
bts ebp, edx
sub esp, 0x1d
mov dword [esp + 0x18], ebp
jmp 0x7b5373
mov al, 0x63
not ecx
xchg cl, ch
bsf ecx, ecx
neg di
bsf dx, ax
jmp 0x7b540c
lea eax, [ecx + ebp]
mov ch, byte [esp]
lea esp, [esp]
mov bx, 0x845b
not ch
xchg ecx, eax
jmp 0x7b5556
Function at 0x7b54bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bx, si
jmp 0x7b54c5
cmc
mov edi, dword [esp + 1]
pushfd
pop word [esp]
rdtsc
btr edx, ebx
jmp 0x7b54f1

Function at 0x7b5a40
Capabilities:
Access peb ldr_data

Disassembly:
push dword [esp + 2]
mov dword [esp + 1], ebx
mov dword [esp + 4], ebp
push ebp
mov dword [esp + 4], esi
jmp 0x7b5a2a