joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492a20
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4f2248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [0x4f448c]
push 0
lea ecx, [esp + 0x20]
call fcn.004ea66c
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00492380
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.004ea59a
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.004e6e5e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.004e6e5e
push 1
push 0
push 0
mov ecx, esi
call fcn.004e6e06
push 1
push 0
push 1
mov ecx, esi
call fcn.004e6e06
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004ea6de
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x492ba0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4f2268
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.004ea66c
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00492380
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.004ea59a
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x4f448c]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x492c64
cmp dword [esp + 0x40], 1
jne 0x492c62
cmp ecx, eax
jge 0x492c64
mov eax, ecx
cmp eax, 0xc8
jge 0x492c70
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00492a20
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x4f4490]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004ea6de
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x493460
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4f2313
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004e527c
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4f40cc]
push eax
mov ecx, edi
call fcn.004ea914
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004ebe30
test eax, eax
je 0x49357c
mov ecx, dword [esp + 0x3c]
call fcn.004ea941
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4f446c]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x493540
push edi
mov ecx, esi
call fcn.004e7fae
mov ecx, esi
call fcn.00493720
cmp dword [esp + 0x38], 1
jne 0x493575
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004e80e9
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x495760
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x495793
push esi
call fcn.004a39e0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x49578c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x495819
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x495802
mov eax, dword [esi + 8]
test eax, eax
je 0x4957b7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4957fe
cmp eax, 2
je 0x495802
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4957aa
cmp eax, 3
je 0x4957dd
cmp eax, 1
jne 0x4957aa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4957aa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4957aa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00495840
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x495828
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00495840
add esp, 4
pop esi
ret
Function at 0x4b9ce0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0xa12c04]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4b9cf3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4b9d34
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0xa12cac]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4b9d66
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4b9d6a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4b9d5b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4b9d88
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4b9d8c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4b9d7d
xor ecx, ecx
mov eax, 0xa12c14
xor ebx, ebx
mov bl, byte [ecx + 0xa12cbc]
cmp byte [esp + ebx + 0x14], 0
je 0x4b9db7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0xa12cd4]
cmp byte [esp + ebx + 0x14], 0
je 0x4b9dce
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4b9d9e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4b9d27
lea edx, [esp + 0x84]
push edx
call fcn.004b9e10
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4be900
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xa4d6ec]
xor edx, edx
cmp eax, edx
jne 0x4be926
xor eax, eax
mov byte [eax + 0xa4d5ec], al
inc eax
cmp eax, 0x100
jl 0x4be90e
mov dword [0xa4d6ec], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xa4d5ec
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4be9b7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4be98a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4be958
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4be9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4bea13
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4be9fa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c53b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f2d5e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004c5cd0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x9f3014
call fcn.004e39e4
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4c5443
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004e39e4
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4c543c
push 0
mov ecx, eax
call fcn.004bc530
mov dword [esi + 0xc], eax
jmp 0x4c5445
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4c5445
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0xa66ca0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
adc dx, bp
sar bh, 0x10
mov ebp, esp
cmp bp, 0x16e0
add cx, si
nop
add eax, edx
bt dx, dx
nop
nop
mov ecx, 0x59ed175e
seta cl
inc dh
nop
nop
test esi, ecx
add dh, 0xc9
nop
cbw
sal bl, 0
rol cx, 0x87
nop
btr bx, ax
nop
rcl ebx, 0xb9
test edi, 0x2352419c
nop
nop
nop
movsx bx, dh
bsf dx, dx
nop
nop
cmovb cx, cx
nop
sar bh, cl
or dx, 0x6568
movzx ebx, si
nop
rcr ebx, 0x54
xadd ax, cx
nop
sal bl, cl
sar eax, 0xe2
add ax, cx
nop
dec dx
cbw
nop
shrd edx, edi, 0xbf
push esi
btc edx, 0xed
cmova edx, eax
xor esi, esi
nop
or ecx, 0x63357ab6
mov eax, 0x80000006
bsf cx, sp
btc ebx, esi
stc
cpuid
shr ecx, 0x10
xor edx, edx
not bl
rcr bl, 0x3f
add esi, ecx
xor cx, sp
movsx ecx, di
nop
not ch
nop
bts dx, bx
mov eax, 0x80000005
rcr ch, 0xc2
cpuid
shrd ax, di, 0xb5
movzx eax, sp
rcr bx, cl
shr edx, 0x18
neg bx
setne bl
shr ecx, 0x18
ror bl, 0x2f
lea edx, [edx + ecx]
bsf ax, bx
lea esi, [esi + edx]
rol bh, cl
nop
test edi, 0x23c03e03
mov eax, 1
clc
ror cx, 0x7f
sub edx, edx
sbb dl, 0x4e
rcl dl, cl
cmp di, bp
cpuid
rol ch, cl
lea esi, [esi + edx]
dec dx
add ecx, ebp
xor esi, eax
test cl, 0x11
rdtsc
lea esi, [esi + edx]
bt edx, 0x60
xor esi, 0x8e3e3da
mov eax, 0x80000006
sal cx, 0x53
sar edx, 0xb1
cpuid
shr dl, cl
dec ax
add bx, 0x3661
shr ecx, 0x10
add esi, ecx
rdtsc
nop
cbw
cmovne dx, dx
nop
ror dl, cl
mov eax, 0x80000005
cpuid
shr edx, 0x18
cmovge ebx, eax
shr ecx, 0x18
add edx, ecx
lea esi, [esi + edx]
bsr cx, bx
not bl
nop
ror eax, cl
or ah, 0xeb
mov eax, 1
and ecx, ecx
xchg cl, bl
xor edx, edx
stc
cpuid
cmp edi, 0x22521560
lea esi, [esi + edx]
xor esi, eax
rdtsc
add esi, edx
xor esi, 0xa972fa8d
setbe al
mov eax, esi
cmovne esi, ecx
pop esi
jmp 0xac3e20
mov esp, ebp
pop ebp
jmp loc.004d1ae3

Function at 0xa698b0
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
jmp 0xbfb03b
nop
jmp 0xc94e0c
nop
jmp 0xc922d0
push 0xd4950672
call fcn.00c2f784
nop
jmp 0xb05142
nop
jmp 0xa9c0c9
nop
jmp 0xc2651b
nop
nop
jmp 0xc55f3d
nop
nop
jmp 0x4031e7
Function at 0xa6bc10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0xa6bd1c
test eax, eax
je 0xa6bd1c
push esi
push edi
mov ecx, 0x10
mov esi, 0xa86fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0xa6bd03
lea edi, [eax + 4]
jmp 0xa6bc67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0xa6bc7c
mov dword [ebp - 4], 2
jmp 0xa6bc9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0xa6bc93
mov dword [ebp - 4], 1
jmp 0xa6bc9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0xa6bd13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0xa6bcd6
mov byte [ecx], 0x3d
jmp 0xa6bce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0xa6bced
mov byte [ecx], 0x3d
jmp 0xa6bcf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0xa6bc64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xaa68c0
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0xc7487d
push ebp
mov ebp, esp
cmc
clc
lea esp, [esp - 8]
cmp di, 0x3549
mov dword [ebp - 4], 0
jmp 0xb6bb14
nop
jmp 0xc709cc
mov eax, 1
setns ah
mov ecx, 2
xchg ecx, ecx
mov eax, 4
mov ecx, 2
nop
pop eax
movzx ecx, bx
pop ecx
jmp 0xc70d28
call fcn.00416910
cmp dword [ebp - 4], 0xfffffff5
jmp loc.0043a6cf
nop
cmc
nop
nop
cmp edx, 0x5fe342b7
cmp cx, ax
test al, 0x35
nop
cmp di, 0x575f
cmp sp, si
nop
nop
nop
nop
cmp di, 0x4fc7
test al, 0x79
test di, sp
nop
nop
nop
nop
nop
stc
cmp ebx, edi
nop
test ax, 0x4658
cmp ch, ch
clc
nop
stc
cmp esp, ebx
nop
jmp 0xc6b31a
call fcn.00409d73
push 0x80000301
bswap bx
cmovns ebx, edx
sets bl
push 0
push 0x10
cmovne ebx, eax
push 0x80000004
push 0
mov bl, 0x3b
push 0x50e2be
cmovle ebx, eax
push 4
setns bl
mov ebx, 0x44d350
call fcn.00cb9e3c
add esp, 0x34
jmp 0xc7abf6
mov edx, 5
shrd ax, si, 0x5a
bsr dx, si
btr ax, 0x81
mov edx, 5
and ax, sp
cbw
rcr ax, cl
pop edx
sub eax, esi
mov dword [ebp - 4], 0
mov eax, dword fs:[0x108]
stc
mov dword [ebp - 4], eax
test edi, 0x423fa8
cmc
cmp bp, bx
cmp dword [ebp - 4], 0
je 0xcbd74f
mov ebx, 6
jmp 0xb9862c
nop
jmp 0x428299
nop
nop
pushal
ror bh, cl
mov eax, 1
rcr edi, 0xb9
add di, 0x16f1
mov eax, 2
mov eax, 4
cwd
mov eax, 2
cbw
mov eax, 5
bts di, si
mov ecx, ebp
movzx ebp, cx
mov eax, 4
bts esi, ebx
stc
mov eax, 2
or dx, cx
mov eax, 5
shl edx, 0x15
xadd ebx, esi
mov eax, 6
shl cx, cl
popal
dec eax
sal al, 0x99
movsx eax, sp
push edx
cmc
stc
mov edx, 1
mov edx, 2
dec al
adc dx, dx
mov edx, 4
bsf edx, esp
mov ah, 0xdc
mov edx, 2
sbb al, 0x7d
adc dx, 0x51e3
mov edx, 5
sal ah, cl
mov edx, 4
sub eax, esp
shl edx, cl
mov edx, 2
jmp 0xb9eb61
nop
jmp 0xa70560
nop
jmp 0xaa7222
nop
jmp 0xba3a20
push 0
call fcn.0044a4c8
add esp, 4
jmp 0xb494dd
push ecx
not ch
push eax
jmp 0xb10db0

Function at 0xab5032
Capabilities:
Packed with generic packer

Disassembly:
push ebp
rol ebp, 0x4e
sal ebp, 0x90
xchg ebp, ebp
mov ebp, esp
test bp, 0x78b5
test ebp, esi
sub esp, 0x20
jmp 0xafea9e
nop
jmp 0x40b527
mov dword [ebp - 4], 0
jmp 0xccb366
nop
jmp 0xc70ba0
nop
jmp 0xaf0062
mov dword [ebp - 8], 0
jmp 0xc4fad7

Function at 0xac10e8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov bp, sp
mov ebp, esp
test esp, 0x520b67ac
jmp loc.00438c50

Function at 0xacb6dd
Capabilities:
Authenticate hmac
Check for software breakpoints
Check http status code
Check os version
Encode data using base64
Encode data using xor
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get process heap flags
Parse pe header

Disassembly:
push ebp
mov ebp, esp
bts ax, di
cwde
sub esp, 0x38
cwde
not al
setge ah
mov dword [ebp - 4], 0
movsx eax, dx
xchg ah, ah
push 1
bswap ax
mov eax, 0x50f0d3
jmp loc.0043566d
Function at 0xae0974
Capabilities:
Packed with generic packer

Disassembly:
nop
nop
jmp 0xc52635
nop
jmp 0xc8a757
je 0xb98ece
mov eax, 1
jmp 0xc8e964
nop
nop
jmp 0xb78cde
push ebp
mov ebp, esp
cmc
jmp 0xb622b6
nop
jmp 0xa69c36
nop
jmp 0xb8ae81
pushal
mov bx, 0x34e8
lahf
mov eax, 1
not ax
xchg di, si
movzx ebp, si
mov eax, 2
movzx ecx, cx
cdq
mov ebp, 0x6ec464da
mov eax, 4
mov eax, 2
cwd
cwde
movzx ebp, sp
mov eax, 5
cwde
not ebp
mov eax, 4
mov eax, 2
mov eax, 5
movsx ebp, sp
lahf
mov eax, 6
setg ah
cwd
movsx ecx, di
popal
mov eax, edi
mov eax, 0x5ce920e4
lahf
push edx
not al
mov edx, 1
cbw
rdtsc
mov edx, 2
mov dx, di
mov edx, 4
mov edx, 2
xchg dl, al
movzx dx, al
mov edx, 5
cbw
mov edx, 4
not eax
mov edx, 2
mov edx, 5
mov edx, 5
cmovg ax, si
pop edx
movsx eax, di
cbw
mov eax, str.C:_tsz
jmp 0xc8ed1e
call fcn.0041eda8
mov dword [ebp - 8], eax
btc ebx, edi
rcl bl, cl
mov ebx, dword [ebp - 4]
cmc
test ebx, ebx
je 0xb0ebdf
push ebx
call fcn.00c01c6e
add esp, 4
cmp dword [ebp - 8], 0
jmp 0xa73330
sub esp, 8
jmp 0xc61ce3
nop
jmp 0xb0032e
nop
jmp 0xc7db59
jmp 0x41eda4
mov eax, 0
jmp 0xb90783
push eax
jmp 0xb0ebbd
nop
jmp 0xc6c036
nop
jmp 0xa67832
nop
nop
jmp 0xc942cd
nop
nop
jmp 0xae7e40
nop
jmp 0xb0e571
jmp 0x41eda4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
jmp 0xc2fca2
nop
jmp 0xcadd04
nop
jmp 0xaceff0

Function at 0xaf7788
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
nop
jmp 0x408952
push ebp
mov ebp, esp
jmp 0xbc52ca
sub esp, 0x38
jmp 0xa65f10

Function at 0xb0eb86
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 0x1c], 0
push 8
jmp 0xaa56ff
lodsd eax, dword [esi]
jmp 0xc6530e
call fcn.00a687a2
add esp, 4
mov di, di
mov dword [ebp - 0x20], eax
mov edi, eax
mov esi, 0x50d7c9
mov ax, si
bswap ax
lodsd eax, dword [esi]
jmp 0xaf1666
call fcn.00a687a2
add esp, 4
mov di, 0x28cf
mov dword [ebp - 0x10], eax
not di
mov edi, eax
mov esi, 0x50d7c9
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
jmp 0xccc49c
mov dword [ebp - 0xc], 0
jmp 0xae571f
mov dword [ebp - 8], 0
push 8
jmp 0xac08a0
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
jmp loc.0044c7a2
push ebp
movsx ebp, bp
mov ebp, esp
test bx, si
test cl, 0x93
sub esp, 0x44
jmp 0xc39bd8
stosd dword es:[edi], eax
jmp 0xa733cf
mov dword [ebp - 0x14], 0
push 8
jmp 0xc87c75
mov dword [ebp - 4], 0
jmp 0xadd749
stosd dword es:[edi], eax
cmovns ax, di
setb ah
movzx ax, bh
lodsd eax, dword [esi]
jmp 0xbba339
call fcn.00a687a2
add esp, 4
mov dword [ebp - 0x18], eax
mov edi, eax
cbw
mov esi, 0x50d7c9
jmp 0xa99835
stosd dword es:[edi], eax
jmp 0xc01c99

Function at 0xb35721
Capabilities:
Packed with generic packer

Disassembly:
nop
nop
jmp 0xbf4345
nop
nop
nop
jmp 0xba2f94
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
jmp 0xa6dbed
nop
jmp 0xa68f08
nop
nop
jmp 0xc3c70c
nop
jmp 0x403377
Function at 0xb36eab
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 4
adc cx, sp
bt di, ax
mov eax, 2
mov eax, 5
not bx
bts ax, ax
mov eax, 6
popal
sar ax, cl
cmovl eax, edx
push edx
btr dx, dx
or edx, 0x54e4117
mov edx, 1
mov edx, 2
mov edx, 4
test esp, 0x344d4f57
mov edx, 2
mov edx, 5
cbw
shl eax, cl
mov edx, 4
mov edx, 2
ror ax, 0x11
rcl dl, 0xfe
mov edx, 5
mov edx, 5
rol dh, 0xcf
xchg ah, dl
pop edx
mov dword [ebp - 4], 0
or eax, 0x347924ab
mov dword [ebp - 8], 0
cmp bx, 0x1a0c
xor ax, 0x197d
push ebx
stc
bt ax, dx
mov bh, 0x88
push ecx
push edx
inc al
mov eax, 0x80000006
cpuid
cwde
shr ecx, 0x10
mov dword [ebp - 4], ecx
jmp loc.0043f600
push ebp
mov ebp, esp
cmc
cmp cl, 0xf4
stc
lea esp, [esp - 0x14]
cmc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp eax, 0x32e14ec9
cmc
nop
cmc
nop
stc
nop
test ebp, ebx
nop
jmp 0xb6a53c
nop
jmp 0xccb16f
nop
cmp edi, 0x13812c92
nop
nop
stc
cmp bx, ax
test ebp, ebp
nop
nop
test di, bx
cmp si, ax
cmc
nop
cmp sp, dx
clc
stc
nop
nop
test bp, bx
nop
stc
test edi, 0x5b363d4e
pushal
mov eax, 1
rcl eax, 0x57
mov eax, 2
rcl esi, 0x4c
mov eax, 4
btr cx, ax
mov eax, 2
btr esi, ebp
test cx, sp
mov eax, 5
jmp 0xb116dc
nop
test esi, 0x7f6b2d39
nop
cmp ax, bp
cmp edx, 0xe79223a
nop
cmp ebp, 0x16fd3c3d
cmc
nop
jmp 0xbb9d31

Function at 0xb4305d
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
nop
nop
stc
nop
nop
stc
test bp, 0x11af
nop
test esi, esp
nop
cmc
nop
cmc
cmp bp, 0x3d00
cmp esp, edi
nop
nop
nop
nop
test esi, ebx
cmp sp, bx
nop
clc
test si, 0xa8a
nop
test edi, ecx
cmp al, 0xc9
cmp ebp, ebp
nop
nop
cmp dh, bh
nop
nop
nop
pushal
rcl bx, 0xd7
bts bp, bx
mov eax, 1
cwde
mov eax, 2
test cx, sp
and ebp, 0x592c4adc
bts ecx, edx
mov eax, 4
add eax, ecx
test dl, dl
mov eax, 2
stc
mov eax, 5
cwd
mov eax, 4
rcr esi, 0xcf
rol bp, 0x62
sbb ebx, 0x45a0420
mov eax, 2
mov eax, 5
sar ebx, cl
mov eax, 6
movzx ebx, bp
popal
clc
push edx
mov edx, 0x10f60add
mov edx, 1
mov edx, 2
cmp si, si
or edx, ebx
mov edx, 4
and dl, 0x28
rcl dx, cl
mov edx, 2
rcl dh, cl
cmp edi, 0x6a441c11
mov edx, 5
sbb dl, 8
rcl dl, cl
shrd dx, sp, 9
mov edx, 4
mov edx, 2
adc edx, ebp
mov edx, 5
bsr edx, edi
bts dx, bp
bswap dx
mov edx, 5
sar edx, cl
pop edx
cmc
push eax
test esi, esi
cmp ecx, ebx
push ecx
btc ecx, ebp
seta cl
xor eax, eax
mov ecx, dword [ebp + 0x10]
mov al, byte [ecx + ebp + 7]
cmovae ecx, ebp
bswap cx
mov dword [ebp - 4], eax
movzx ax, dl
setno ah
pop ecx
movzx eax, si
pop eax
movzx ax, al
jmp 0xc2a4e2
mov eax, dword [ebp - 4]
jmp loc.00419d18