joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015b8d1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x1015b9f2
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x1015b9d6
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x1015b928
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x1015b906
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x1018e490
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101aee90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.1014c890
mov eax, dword [0x10408c60]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.10156670
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.1018ef60
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x1018e537
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x1018e52e
cmp al, 0xff
je 0x1018e52e
dec al
mov byte [ecx], al
jmp 0x1018e537
push ecx
call fcn.10198f44
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x1018e568
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x1018e55f
cmp al, 0xff
je 0x1018e55f
dec al
mov byte [ecx], al
jmp 0x1018e568
push ecx
call fcn.10198f44
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x10496c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10496d1c
test eax, eax
je 0x10496d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x104b1fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x10496d03
lea edi, [eax + 4]
jmp 0x10496c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x10496c7c
mov dword [ebp - 4], 2
jmp 0x10496c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10496c93
mov dword [ebp - 4], 1
jmp 0x10496c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x10496d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x10496cd6
mov byte [ecx], 0x3d
jmp 0x10496ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x10496ced
mov byte [ecx], 0x3d
jmp 0x10496cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10496c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10731e57
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x10017cd4
push ebp
neg ebp
cmc
mov ebp, esp
cmc
clc
sub esp, 0x14
jmp 0x107e1ee7
nop
cmp ecx, edx
nop
stc
test bp, 0x28e4
cmc
nop
cmc
pushal
bt ecx, 0x7d
mov eax, 1
xor dx, sp
cbw
shl edi, 0xc4
mov eax, 2
bsr bx, cx
sub bp, bp
lahf
mov eax, 4
test esi, ebp
shl ax, cl
mov eax, 2
mov eax, 5
mov eax, 4
cmovbe eax, esi
movsx edi, ax
test di, 0x3889
mov eax, 2
mov edx, esp
mov eax, 5
lahf
or bx, 0x3edb
mov eax, 6
popal
xor ax, si
clc
ror ax, cl
push edx
sub ax, 0x450a
btr edx, esi
mov edx, 1
sar al, cl
mov edx, 2
and eax, 0x35996f1a
ror dl, cl
not ah
mov edx, 4
mov dl, 0x32
mov edx, 2
mov edx, 5
btc dx, dx
btr edx, 0xdc
mov edx, 4
mov edx, 2
and ax, bp
bt edx, 0x3a
btr ax, sp
mov edx, 5
mov edx, 5
and dx, cx
pop edx
shl ax, 0xcc
movzx eax, di
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
rcr ah, cl
cmp ebx, esp
push ebx
btr bx, 0xb8
shl bl, cl
sal bl, 0xd8
push ecx
movsx eax, bx
push edx
mov dx, 0x4be6
rcl ax, cl
sbb al, dl
mov eax, reloc.OLEAUT32.dll_SysStringLen
sal dh, 0x71
mov cx, si
cpuid
sub eax, edi
shr ecx, 0x10
not eax
cbw
and dl, dh
mov dword [ebp - 4], ecx
rol ecx, cl
pop edx
pop ecx
sar ah, cl
bswap ax
pop ebx
nop
bswap eax
sbb ax, di
push ebx
shl bl, cl
adc eax, 0x4e0e7cd8
push ecx
sar ch, 0xb
jmp 0x109433d3
je 0x10782df4
push ebx
call fcn.100c1df3
lea esp, [esp + 4]
xadd ebx, ebx
dec bx
mov ebx, dword [ebp - 0x10]
test cx, bp
test ebx, ebx
jmp 0x10c0ff93
mov dword [ebp - 4], 0
jmp 0x10a2d496
jmp 0x10cb0fac
call fcn.10009b40
add esp, 8
bt ebx, ebp
bsf ebx, edx
mov dword [ebp - 0x14], eax
clc
mov ebx, dword [ebp - 0xc]
cmp cx, 0x77d
test ebx, ebx
jmp 0x10782dde
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
or bh, 0xfc
add bl, dl
test cx, 0x5808
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
setae bh
mov dword [ebp - 8], edx
cwd
pop edx
mov cl, 0x23
pop ecx
not bl
movsx bx, ch
pop ebx
not bl
push 0x80000301
push 0
cmovb bx, cx
mov bx, sp
push dword [ebp - 4]
bswap ebx
push 1
movzx bx, dl
cmovp ebx, ecx
movzx ebx, cx
mov ebx, 0x100c3a30
jmp 0x10bb8803
push dword [ebp - 0x10]
not ecx
push dword [ebp - 0xc]
mov ecx, 2
jmp 0x1091ca11
nop
nop
nop
nop
nop
cmp bh, 0xe8
nop
nop
jmp 0x10b53824
mov dword [ebp - 8], 0
jmp 0x108adaf3
call fcn.100c1df3
add esp, 4
jmp 0x10c418f1
nop
cmp eax, ebx
stc
jmp 0x1074ade8
call fcn.100c1de7
add esp, 0x10
mov dword [ebp - 0xc], eax
not bh
mov bh, ch
movsx bx, bh
push 0x80000301
push 0
push dword [ebp - 8]
push 1
cmovae bx, dx
mov ebx, 0x100c3a30
call fcn.100c1de7
add esp, 0x10
xchg cl, cl
bswap ecx
mov dword [ebp - 0x10], eax
jmp 0x109ec8d9
je 0x10c418f1
push ebx
jmp 0x10a53698
mov eax, dword [ebp - 0x14]
jmp 0x1068cdfb
nop
jmp 0x109f9e45
Function at 0x1074cb2c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
test bl, 0x70
mov ebp, esp
clc
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x10d3df3e
nop
test esp, 0x2ec47ab4
cmp dx, di
nop
cmp esi, 0x205b31b3
test esi, edx
nop
clc
stc
nop
test eax, edx
cmp cl, 0x99
nop
test eax, edx
stc
cmp bx, dx
nop
test ax, 0x45aa
nop
nop
cmc
clc
nop
cmp edx, ebp
nop
cmp edi, ebp
cmp ah, 0xe0
jmp 0x10a2dc4f
mov dword [ebp - 4], eax
movzx eax, dx
mov eax, dword [ebp - 4]
jmp 0x10d4a959
nop
test ebx, 0x1db52aef
nop
pushal
bt cx, ax
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
xor cx, 0x445d
shld ebx, edi, 0xf3
sar cl, cl
mov eax, 5
dec bh
or ebp, 0x6135183f
mov eax, 4
sal ebx, cl
bsf bp, di
add ebp, 0x6fc478f7
mov eax, 2
mov eax, 5
mov al, 0xce
sbb dh, dh
mov eax, 6
cmovl edi, esi
not cl
sal esi, 0x36
popal
sal ah, 0xc1
push edx
bsf ax, bp
setbe dl
mov edx, 1
or dx, cx
bsr eax, ecx
cwde
mov edx, 2
bswap eax
shrd edx, ebx, 0xf1
mov dx, 0x79b
mov edx, 4
cmp edi, esp
mov edx, 2
sar al, 0x92
mov edx, 5
btc dx, bp
rcr ah, 0xf5
mov edx, 4
sub dx, 0xb0a
mov edx, 2
sub dx, sp
and dh, bh
mov edx, 5
xor ax, si
sbb dl, 0xd
cwde
mov edx, 5
pop edx
rol eax, 0x15
bts ax, ax
cmp eax, 0x38cc4529
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
stc
add eax, 0x100
jmp 0x10906c71
jmp 0x1083dba0
jmp loc.100180b6

Function at 0x107d6d75
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 4], 0
jmp 0x106e17a9
jmp 0x10712c7b
nop
cmc
nop
nop
test ebx, edi
clc
jmp 0x10a0221f
push ebp
sal ebp, 0x6c
mov ebp, esp
sub esp, 8
jmp 0x105327f9
nop
test esp, 0x390f25de
cmp cl, 0xdd
nop
cmp eax, 0x7f932188
nop
test si, 0x50e3
stc
nop
nop
nop
test bp, 0x645b
nop
clc
test dx, di
cmp esi, ebp
nop
cmp si, bp
test sp, sp
clc
nop
stc
jmp 0x10cd7577
jmp loc.10017b58
mov ebx, 0x100c2df0
call fcn.100c1de7
add esp, 0x10
jmp 0x10a348d1
pushal
adc ax, sp
xadd di, ax
sub edx, ebx
mov eax, 1
movsx edx, bp
mov eax, 2
mov eax, 4
test si, 0x5572
movsx eax, bx
clc
mov eax, 2
lahf
mov eax, 5
ror dl, cl
bt ax, 0x8d
add ebx, edi
mov eax, 4
xadd ecx, ebp
sar di, 0xc2
mov eax, 2
dec edx
mov eax, 5
btc eax, eax
sbb dh, 0x9b
mov eax, 6
sar cx, 0xa1
popal
push edx
rcl dh, cl
sbb ebx, 0x10e1203c
mov edx, 1
bsf ebx, edi
mov edx, 2
bts bx, si
rol dx, cl
dec eax
mov edx, 4
btr ax, di
bsf ebx, ecx
mov edx, 2
sbb bl, ah
mov edx, 5
xor eax, 0x12542348
mov edx, 4
rcr eax, cl
mov edx, 2
mov edx, 5
bsf dx, cx
mov edx, 5
btr ax, cx
pop edx
cmovl bx, di
push edx
rdtsc
rol bh, cl
and bx, ax
bsr bx, bx
xor eax, eax
cmovle ebx, ebx
mov al, dh
mov bl, al
movzx edx, si
mov dword [ebp - 4], eax
bswap ebx
pop edx
xchg ebx, ebx
setae bh
movzx ebx, di
push 0x80000301
jmp 0x10ce2299
push 0
seto bl
push dword [ebp - 4]
cmovnp bx, cx
movsx bx, cl
movsx ebx, sp
push 1
cmovle bx, di
jmp 0x10a5768e

Function at 0x10b224bb
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov dword [ebp - 8], 0
jmp 0x10a56242
mov dword [ebp - 0x10], 0
jmp loc.1001b77e
mov dword [ebp - 0xc], 0
jmp 0x108a27e6
push ebp
rcr ebp, 0xa2
mov ebp, esp
cmc
jmp 0x10cf08b2
sub esp, 0x24
mov dword [ebp - 4], 0
jmp 0x107d14f3
Function at 0x10b4e91c
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0x10b8d2dc
nop
jmp 0x10c57957
jmp 0x10b957d1
nop
nop
nop
jmp 0x109cbef3
nop
test ebx, 0x406648e3
nop
nop
cmp dl, 0x8d
clc
test eax, ebx
nop
clc
nop
test si, dx
nop
cmp cx, 0x2b19
clc
nop
cmp bp, 0x57e7
test ebp, ebp
nop
test sp, 0xa35
test sp, si
clc
nop
nop
cmp sp, 0x3626
nop
pushal
sub dl, 0x61
mov eax, 1
mov eax, 2
or cl, 0xd6
mov eax, 4
cmp esp, ebx
shld ecx, ebp, 0x57
sbb ecx, 0x9104642
mov eax, 2
mov eax, 5
rcr ebp, 0xd6
sar eax, cl
mov eax, 4
cmc
mov eax, 2
or al, al
cmp di, 0x7ccc
bt eax, 0x57
mov eax, 5
rcr dl, 0xf9
btc edi, ebx
mov eax, 6
or esi, 0x7b7c525d
cwd
btr di, 0xde
popal
push edx
bsr dx, ax
jmp 0x109f919d
nop
nop
nop
jmp 0x10823464
jne 0x109f9212
pop esi
movzx edx, cx
not ch
pop ecx
mov dl, 0x6c
pop edx
jmp 0x108bfcdc
nop
jmp 0x105c9b06
mov edx, 1
mov edx, 2
btc edx, ebp
sub eax, edx
mov edx, 4
bt eax, 0xf5
cbw
test ax, di
mov edx, 2
add dh, 0xef
mov edx, 5
add ax, bx
bswap eax
mov edx, 4
add eax, ecx
rol dx, 0x78
mov edx, 2
cwd
add ah, ah
mov edx, 5
cbw
mov edx, 5
xor al, 0x43
ror dh, 0xcc
pop edx
sbb ax, 0x64d2
push edx
shrd edx, edx, 0xca
rol eax, cl
cmovge eax, ebx
push ecx
sal eax, cl
bsr edx, edx
cwde
push esi
xor esi, esi
sub eax, ebp
mov eax, dword [ebp + 8]
setnp cl
lea ecx, ds:[esi*4]
sal dl, 0x58
mov edx, eax
mov ecx, dword [eax + ecx]
sub dh, 0xfd
xor ecx, 0x7eedacbc
xchg dh, dh
adc dl, dl
xor ecx, 0x2bff7f2
cmovg edx, ebp
xor ecx, 0x1793d363
bt edx, 0xdc
shld dx, bp, 0xcd
xor ecx, 0x11ed6b05
xadd dx, dx
add edx, ecx
xor ecx, 0x18cfbbb2
xor ecx, 0x232f28d3
xor ecx, 0x4be5b122
neg dh
bswap edx
bts edx, ecx
xor ecx, 0x10aecf2d
ror edx, 0xd1
xor ecx, 0x5761acb0
xor ecx, 0x5cf6056a
shr dl, cl
sbb dh, 0xea
xor ecx, 0x33216ae2
movzx edx, bx
shr dh, 0x5e
xor ecx, 0x25b1fdc6
rcl dh, cl
xor ecx, 0x29d4cf84
bswap edx
xor ecx, 0x67cbf9f6
movsx dx, ah
movsx edx, si
xor ecx, 0x6989b5f0
movzx dx, cl
add dl, dh
xor ecx, 0x3460d332
bswap edx
xor ecx, 0x73e170f6
xadd dx, dx
xor ecx, 0x702841da
movsx edx, ax
xor dh, dl
shrd edx, ecx, 0x9e
xor ecx, 0x48e4e407
sub dx, di
xor ecx, 0x1dce0039
xor ecx, 0x429bc8dd
movzx edx, dx
sbb edx, esp
xor ecx, 0x21161c04
test al, 0xd6
shr edx, 0xe0
xor ecx, 0x672dc54b
xor ecx, 0x21cbe57
bt dx, cx
sal dh, 0xe9
or dx, bp
xor ecx, 0x6b7cbc7
ror dx, 0xea
xor ecx, 0x50d75d3c
rol dl, cl
mov edx, 0x7f3c7783
xor ecx, 0x66019e6c
xor ecx, 0x70840464
sar dx, cl
sub dx, 0xd58
sar edx, 0x70
xor ecx, 0x680e715f
sal dx, cl
shld dx, di, 0x7e
nop
setnp dl
nop
sar dl, cl
nop
nop
nop
jmp 0x10a0e5e7
nop
shld edx, edx, 0x46
lea edx, ds:[esi*4]
cmc
mov dword [eax + edx], ecx
cmc
add esi, 1
stc
cmp esi, dword [ebp + 0xc]
jmp 0x1091597f
push ebp
bswap ebp
mov ebp, esp
jmp 0x10704389
nop
jmp 0x10620941
nop
jmp 0x10b688b9
nop
cmp ch, 0xe2
jmp 0x1083e74a
nop
jmp 0x10006759
Function at 0x10b58d67
Capabilities:
Packed with generic packer

Disassembly:
push edx
cwd
setae dh
mov edx, 1
mov edx, 2
mov dh, al
movzx edx, bx
mov edx, 4
mov edx, 2
mov edx, 5
movzx dx, dl
xchg edx, edx
mov dh, dl
mov edx, 4
cwd
movsx edx, sp
mov edx, 2
movzx edx, si
bswap edx
setp dl
mov edx, 5
not dh
mov edx, esp
jmp loc.100c21c5
jmp 0x109571eb
nop
jmp 0x10c15483
nop
jmp 0x10b1bb10
mov eax, 6
popal
jmp 0x104922a9
nop
jmp 0x1096d6f8
nop
jmp 0x1074a4ad
nop
jmp 0x10bca20d
nop
jmp 0x10b9b0d4
nop
jmp 0x10c1a7df
nop
jmp 0x10a20aac
push ebp
mov ebp, esp
jmp 0x105f73bc
pushal
mov eax, 1
cwde
mov eax, 2
not bp
mov eax, 4
cwd
mov eax, 2
rdtsc
mov ebp, ecx
mov eax, 5
cbw
mov bh, 0x98
mov eax, 4
mov edi, ebp
mov eax, 2
mov eax, 5
jmp 0x107c13d6
nop
jmp 0x10726e81
nop
jmp 0x10b5dec1
nop
jmp 0x10ae8f29
nop
jmp 0x1081604d

Function at 0x10cc4034
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
bswap edi
push eax
rdtsc
mov dl, bl
push ebx
rdtsc
push ecx
setae dl
not esi
movsx eax, ax
push ebp
rdtsc
pushfd
or ax, cx
btc bp, dx
sub edi, 0x2ce0129c
mov edx, 0
rcr ebp, 0xbf
movzx esi, sp
push edx
xor di, di
bswap edi
mov ebp, dword [esp + 0x28]
setl al
rol ax, 0xa1
xor ebp, 0x6db44bde
neg ebp
movzx edi, si
ror eax, 0x58
add ebp, 0x426f2a0f
bswap ebp
neg ebp
and si, 0x11d8
bsf edi, esp
not ebp
add di, 0x74c4
and ebx, 0x5ff730c8
adc esi, 0x6efd0dbf
add ebp, edx
bts edi, eax
neg bx
stc
mov edi, esp
movzx eax, bp
clc
not bx
lea esp, [esp - 0xc0]
rcl ebx, 0xcf
mov ebx, ebp
add esi, 0x26487ed8
mov eax, 0
xor esi, esi
sub ebx, eax
lea esi, [0x104efe54]
shld eax, edi, 0xed
or ax, 0x2546
nop
mov eax, dword [ebp]
test esp, 0x13014660
test bp, dx
add ebp, 4
cmp bp, sp
test sp, 0x4308
xor eax, ebx
jmp 0x107a5dfb
jmp esi
inc eax
neg eax
jmp 0x108261a5
dec eax
stc
test edx, esp
cmc
neg eax
bswap eax
cmp si, si
sub eax, 0x3f0620d1
xor ebx, eax
clc
add esi, eax
jmp 0x1065cb83
push esi
push edx
mov edx, ebx
jmp 0x104efdb3

Function at 0x10ce93d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp]
jmp loc.1000cc81
pushfd
push ebx
bts ebx, ebx
push ebp
jmp 0x10c2e0ac
push esi
btr ebx, 0xf5
clc
rcl esi, 0xe
push ecx
btc bp, 0x97
push eax
rdtsc
push edi
rdtsc
mov eax, 0
bt ecx, 0x92
btc bx, 0xe6
push eax
ror dl, 0xe1
bts cx, dx
mov ebp, dword [esp + 0x28]
bswap edi
mov dx, di
rol ebp, 1
not ebp
and edi, 0x52cd23e3
bt bx, sp
sub ebp, 0x6f1b459e
mov dl, al
not ebp
cmovp si, dx
dec ebp
rcl cx, 0x3b
btc esi, 0x76
shr dx, cl
lea ebp, [ebp + eax]
movzx ecx, di
mov edi, esp
lea esp, [esp - 0xc0]
mov ebx, ebp
mov ecx, 0
test esp, esp
sub ebx, ecx
stc
lea esi, [0x10c2e124]
or dh, 0x39
and dh, cl
lea ebp, [ebp - 4]
rcr dx, 2
jmp 0x106f5b17
push edx
xchg dl, dh
jmp 0x10820fb5
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x6d4b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x676015
lea edi, [esi - 0x275015]
push edi
jmp 0x6d4b8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6d4b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6d4b80
mov eax, 1
add ebx, ebx
jne 0x6d4ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6d4bb4
jne 0x6d4bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6d4bd3
dec eax
add ebx, ebx
jne 0x6d4bc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6d4b98
add ebx, ebx
jne 0x6d4bcf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6d4c25
xor ecx, ecx
sub eax, 3
jb 0x6d4beb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6d4c5a
sar eax, 1
mov ebp, eax
jmp 0x6d4bf6
add ebx, ebx
jne 0x6d4bf6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6d4bc4
inc ecx
add ebx, ebx
jne 0x6d4c04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6d4bc4
add ebx, ebx
jne 0x6d4c11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6d4c06
jne 0x6d4c22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6d4c06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6d4c44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6d4c36
jmp 0x6d4b86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6d4c44
add edi, ecx
jmp 0x6d4b86
pop esi
mov edi, esi
mov ecx, 0xc09e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6d4c62
cmp byte [edi], 0x12
jne 0x6d4c62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6d4c67
lea edi, [esi + 0x2d2000]
mov eax, dword [edi]
or eax, eax
je 0x6d4cdf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2d49c0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2d49fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6d4c94
mov ecx, edi
jns 0x6d4cc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2d4a04]
or eax, eax
je 0x6d4cd9
mov dword [ebx], eax
add ebx, 4
jmp 0x6d4cb1
call dword [esi + 0x2d4a00]
mov ebp, dword [esi + 0x2d4a08]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6d4d13
sub esp, 0xffffff80
jmp 0x40582c
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x2d63700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02d6378f
jae 0x2d6370e
xor ecx, ecx
call fcn.02d6378f
jae 0x2d6373d
xor eax, eax
call fcn.02d6378f
jae 0x2d6374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02d6378f
adc al, al
jae 0x2d6372f
jne 0x2d63779
stosb byte es:[edi], al
jmp 0x2d63711
call fcn.02d6379b
sub ecx, ebx
jne 0x2d63756
call fcn.02d63799
jmp 0x2d63775
lodsb al, byte [esi]
shr eax, 1
je 0x2d63783
adc ecx, ecx
jmp 0x2d63772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02d63799
cmp eax, 0x7d00
jae 0x2d63772
cmp ah, 5
jae 0x2d63773
cmp eax, 0x7f
ja 0x2d63774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2d63711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x2d83700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02d8378f
jae 0x2d8370e
xor ecx, ecx
call fcn.02d8378f
jae 0x2d8373d
xor eax, eax
call fcn.02d8378f
jae 0x2d8374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02d8378f
adc al, al
jae 0x2d8372f
jne 0x2d83779
stosb byte es:[edi], al
jmp 0x2d83711
call fcn.02d8379b
sub ecx, ebx
jne 0x2d83756
call fcn.02d83799
jmp 0x2d83775
lodsb al, byte [esi]
shr eax, 1
je 0x2d83783
adc ecx, ecx
jmp 0x2d83772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02d83799
cmp eax, 0x7d00
jae 0x2d83772
cmp ah, 5
jae 0x2d83773
cmp eax, 0x7f
ja 0x2d83774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2d83711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x4097ac
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409860
jmp 0x409855
cmp dword [esi + 0x10], 0x1000
jne 0x409841
test byte [esi + 0x15], 1
jne 0x409841
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409800
cmp eax, 2
je 0x409800
cmp eax, 0x10
je 0x409800
cmp eax, 0x20
jne 0x409815
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409815
mov bl, 1
xor ebp, ebp
jmp 0x409826
mov eax, dword [esi]
add eax, ebp
call fcn.004097a4
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409819
test bl, bl
je 0x409841
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409860
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4097d8
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x43b63e
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop ebx
add esi, 0xc07418df
add esi, esi
add esi, 0xaf720c46
call fcn.0043b67f
mov esi, esi
dec edi
inc edi
xor dword [edx], ebx
sub esi, edi
or esi, esi
inc edx
push 0x4092b548
pop edi
inc esi
sub edi, 0x83365653
cmp edx, ecx
jne fcn.0043b63e
mov edi, 0xf535675
ret