joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10095bcd
Capabilities:
Packed with generic packer

Disassembly:
stc
sub esp, 0xfffffff0
cmp dword [ebp - 4], esp
jmp 0x100df2e3
jmp 0x1008fed8

Function at 0x1009af70
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov eax, 0
pushal
pushfd
lea esp, [esp + 0x28]
jmp loc.10003869
jmp 0x1015de48
bswap ecx
pushfd
lea esp, [esp + 0x40]
popal
setp al
lea eax, [ebx - 0x7f880bf5]
call fcn.100d4618
push esi
in eax, dx
salc
hlt
mov esi, dword [ebp + 8]
movzx dx, cl
mov eax, dword [esi]
pushal
pushal
pop edx
mov edx, dword [ebp + 0xc]
bswap cx
movsx bx, bl
jmp 0x10108ec8
pushfd
mov dword [esp], 6
push 0x74cdbd24
lea esp, [esp + 4]
call fcn.1001ea1b
cmc
pushfd
mov dword [esp], 0x9e260256
pushal
add esp, 0x28
cmp eax, 0x4491b886
pushal
mov word [esp + 4], bp
cmp cl, 0xb1
mov dword [ebp - 0xc], eax
clc
bt ebx, 0xd
cmp dword [ebp - 0xc], 1
push dword [esp]
push 0xe1d33ecf
lea esp, [esp + 0x28]
je 0x1007d8a8
jmp 0x100ff3e3
pushal
xchg dx, si
jmp 0x100d1b74
mov dword [edx], eax
jmp 0x100cee29
nop
cmp bp, 0x9a42
add esp, 0x30
cmp dword [ebp - 4], esp
pushal
pushfd
lea esp, [esp + 0x24]
je 0x100eb693
jmp 0x100eb670

Function at 0x100b6103
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10140373
push 0x7c9fbdd3
mov dword [esp], 6
pushfd
mov byte [esp], 0x26
lea esp, [esp + 4]
call fcn.1001ea1b
bt si, bp
stc
call fcn.1017a0dc
pushfd
push 0xda81c4d6
pushal
mov byte [esp], ch
mov dword [esp + 0x24], 0xaef244fa
call fcn.10190e90
push 0x9cf62178
pushfd
mov dword [esp + 4], 0x40efdc61
mov word [esp], bp
mov dword [esp], 0xe0e0a220
pushfd
lea esp, [esp + 4]
jmp fcn.1000510b
mov byte [esp], ch
lea esp, [esp + 4]
je 0x1017a0df
jmp 0x100d544f

Function at 0x100c1d25
Capabilities:
Access peb ldr_data

Disassembly:
movzx si, cl
mov edi, dword [edi]
bts ebx, 0x15
bsr edx, ecx
mov dword [esp + 0x20], edi
bswap dx
rol si, cl
test bh, 0x2a
xor eax, eax
rcr bx, 3
push dword [esp + 4]
shl dx, 0xe
add bl, ch
or ecx, 0xffffffff
neg si
repne scasb al, byte es:[edi]
setp ah
setb bh
aam 0xb
daa
mov edi, dword [esp + 0x24]
bts esi, esp
pop eax
shl si, cl
inc esi
mov esi, ecx
pop eax
movzx bx, dl
xadd al, ch
rcl ah, 2
not esi
add al, 0xae
jmp 0x10126661
movzx cx, cl
btr ax, dx
mov eax, dword fs:[0x30]
shr dh, 2
sbb cl, 0x52
adc dh, 0x6a
inc bh
mov eax, dword [eax + 0xc]
ror dh, 1
and dh, bl
xchg ch, bh
pushal
mov edx, dword [eax + 0xc]
clc
lea eax, [eax + 0x10]
push 0x74420a66
pop ebx
push dword [eax]
pop dword [esp + 0x3c]
dec cl
sub eax, eax
lea esp, [esp + 0x3c]
cmc
bt bx, 7
pushfd
mov dword [esp], edx
inc cx
pushfd
mov ecx, dword [edx + 0x30]
add esp, 4
shr dh, 3
movzx ebx, byte [eax + edi]
call fcn.1018580b

Function at 0x100cb132
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], cl
mov dword [esp + 4], edx
mov dword [esp + 4], 6
mov byte [esp], 0xa1
jmp loc.10015558

Function at 0x100e2b43
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
je 0x100eeb62
push 0xba5fffbf
call fcn.100968b0
Function at 0x100e3bf5
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
rdtsc
bt bp, 2
movsx cx, al
bswap ecx
imul eax, eax, 0x343fd
movsx cx, cl
add eax, 0x269ec3
cmp bh, al
not si
xadd di, si
shr eax, 0x10
dec bh
or bh, cl
and eax, 0x7fff
shr esi, 8
mov ecx, dword [ebp + 0xc]
lea edi, [esi - 0x59cdafb5]
shld di, cx, 2
neg bh
sub ecx, dword [ebp + 8]
movsx si, cl
inc ecx
bt cx, bx
and esi, 0xbf1b638c
jmp 0x10128847
sbb bh, bh
xor edx, edx
or di, 0x9014
pushfd
add si, cx
div ecx
not eax
xadd ah, bl
bsr ax, si
push 0xf6bf13b7
add edx, dword [ebp + 8]
sbb ah, cl
shrd ax, dx, cl
pop eax
mov dword [ebp - 4], edx
pop ecx
push dword [esp + 8]
popfd
lea eax, [eax*8 + 0x4a81f650]
cwde
rdtsc
lea eax, [esp + 0x458d1532]
lea esp, [esp + 0xc]
popal
pushfd
pop eax
mov eax, dword [ebp - 4]
pushal
mov byte [esp + 8], 0xb1
lea esp, [esp + 0x20]
jmp loc.10012978

Function at 0x100e5ce7
Capabilities:
Packed with generic packer

Disassembly:
mov ax, word [esi]
push 0xdadb0a6
mov byte [esp], 0x3e
bswap si
not dh
mov edx, dword [ebp + 0xc]
movsx cx, bl
mov word [edx], ax
lahf
movsx cx, cl
pop eax
popal
movsx ax, cl
lahf
bswap ax
mov eax, 1
pushfd
lea esp, [esp + 4]
jmp loc.10007494
cmc
sub esp, 0xfffffffc
pushal
test bh, 0x6b
neg dh
cmp ax, ax
sub eax, eax
cbw
jmp 0x1014d331
lahf
mov esi, dword [ebp + 8]
jmp 0x100dcd2b

Function at 0x100e6ace
Capabilities:
Packed with generic packer

Disassembly:
pushfd
add esp, 8
pushal
rcl si, cl
inc di
sar esi, 0x13
add esi, 0xb2e36471
sub eax, eax
cbw
lahf
mov esi, dword [ebp + 8]
lea ecx, [ecx*2 + 0x36695517]
pushal
cbw
pop edx
mov ax, word [esi]
pushfd
pushal
mov edx, dword [ebp + 0xc]
sete cl
mov word [edx], ax
pop ecx
lea esp, [esp + 0x3c]
popal
pushfd
pushal
push ebp
movsx eax, al
mov eax, 1
pushfd
push ecx
pushfd
push eax
lea esp, [esp + 0x38]
jmp loc.10007494

Function at 0x100e8bc9
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea esp, [esp + 0x2c]
mov dword [ebp - 8], esp
pushal
jmp 0x100ed48a

Function at 0x100eaf3e
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
jne 0x10181dca
push 0xc9e01f00
mov eax, 0
pushfd
mov dword [esp], 0xeb5ac2bc
mov byte [esp], ch
lea esp, [esp + 8]
jmp loc.100101bc
stc
clc
stc
mov dword [ebp - 0x10], eax
push ebp
jmp 0x1016a237
cmc
cmc
cmp dword [ebp - 0x10], 0
jmp 0x10066f2b

Function at 0x100fdadb
Capabilities:
Packed with generic packer

Disassembly:
salc
xchg byte [edx + 0x30], al
inc esp
push dword [esp + 0x10]
lea esp, [esp + 0x2c]
je 0x101a7326
call fcn.101690f2
jns 0x100fdad6
cdq
lcall 0xaad3, 0x42b31874
sub ebp, dword [edi - 0x6e31e395]
dec esp
dec ebp
add al, 5
aam 0xd5
pushfd
popfd
js 0x100fdb81
push eax
push ecx
aaa
fstp xword [ecx - 0x2cd6d7a3]
ja 0x100fdb5d
dec ebx
push edi
pushfd
daa
enter 0x4e38, 0xffffffffffffffa7
pop ss
ljmp 0x1c3b
xor al, 0x5c
jne 0x100fdb80
push ecx
add eax, 0xfa4c25b9
sahf
retf 0xd622
cmpsd dword [esi], dword es:[edi]
ficom word [ebx - 0x6d]
sahf
dec eax
jmp 0x665ab488
Function at 0x100ff8de
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x1010dc93
lea esp, [esp + 4]
jne 0x1011155e
movsx ax, dl
ja 0x10128b43
mov dword [ebp - 0xc], esp
push 0xa7142ea6
pushfd
lea eax, [ebp - 8]
pushfd
pushal
mov dword [esp + 0x28], eax
push esp
mov dword [esp + 0x28], 0x40
pushfd
push dword [ebp - 4]
pop dword [esp + 0x28]
jmp 0x1007042c
call 0x101a07f3
push dword [ebp - 4]
pop dword [esp + 0x24]
jmp 0x1010105a
push edi
push 0xc8467983
movsx eax, dl
lea esp, [esp + 8]
mov dword [ebp - 0xc], esp
movsx ax, dl
lea eax, [ebp - 8]
pushfd
mov byte [esp], 0xf4
push 0x83874537
mov dword [esp + 4], eax
mov byte [esp], 0x70
push ebp
pushal
mov dword [esp + 0x24], 0x40
push 0x9f062517
jmp 0x10147a50
mov byte [esp], al
jmp 0x10113f75

Function at 0x101157e6
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
popal
movsx ax, dl
lahf
mov eax, 1
pushfd
mov byte [esp], 0x45
pushfd
lea esp, [esp + 8]
jmp fcn.1000a4a3
push ebx
lea esi, [edx + 0x26f24a77]
setb ah
cld
aad 0xf4
shrd di, ax, cl
cdq
mov ecx, dword [ebp + 0x10]
cmp al, dh
mov esi, dword [ebp + 8]
cmp bl, 0xda
mov edi, dword [ebp + 0xc]
adc ax, 0x84bf
daa
mov byte [esp], 0xa4
mov edi, dword [edi]
bts dx, 8
sub ah, 0xa9
rol al, 4
rol bp, 7
add edi, 8
movzx ebp, bl
movsx ebx, cl
rep movsb byte es:[edi], byte [esi]
lahf
movzx dx, dl
setle ah
jmp 0x1007f1af
cld
mov dword [ebx], eax
jmp 0x101a98df
lea esp, [esp + 4]
pushal
jmp 0x100dfc6f
Function at 0x10119133
Capabilities:
Encode data using xor

Disassembly:
fisub word [ebx]
inc ebp
out 0x1c, al
mov ebp, 0x344bac0b
je 0x10119058
jmp 0xdeb2e6d2
imul byte [esi + 0x27]
sub al, 0x2c
arpl word [0x42fd033e], bx
les edi, [eax - 0x29]
insb byte es:[edi], dx
mov byte [0xf92a8d9f], al
pop esi
jo 0x1011913c
ljmp 0x3bf9:0x4690f01b
cmp edx, dword [esi + edi*4 + 0x19b54367]
xchg ecx, eax
jb 0x101190af
int1
call 0xc49e662d
invalid
mov ah, 0x8f
mov bh, 0x92
mov bl, 1
scasb al, byte es:[edi]
imul eax, dword [esp + esi*8], 0x46
scasd eax, dword es:[edi]
pushfd
in al, 0xe4
invalid
xchg esp, eax
jne 0x10119093
pop edi
xchg ecx, eax
sub ebp, dword [esi - 0x7b]
jne 0x101190cc
pushal
jmp 0x10152100
mov edi, eax
call fcn.10074211
loope 0x101190db
xlatb
mov al, 0xf5
jmp ecx
movsb byte es:[edi], byte [esi]
bnd jae 0x10119136
outsb dx, byte [esi]
adc eax, 0x40406419
ja 0x1011910d
inc ecx
fcomp qword [ebp + 0x1b52eadd]
loopne 0x101191b7
and si, word [ebx + 0x5f064e4a]
and esi, dword [ebx + 0x5f064e4a]
cmpsd dword [esi], dword es:[edi]
outsd dx, dword [esi]
and dword [ebx - 0x5909650], 0x3f7feb48
lds ecx, [ebp + 4]
xor eax, 0x9bcdf0b
salc
sub al, 0xce
add al, 0x35
or ebx, edi
mov esp, 0xce2cd609
and ebp, dword [ecx]
cmp bh, al
ja 0x10119150
pop esi
in eax, dx
push ebp
jmp 0x101191d9
inc ebx
xor al, 0xb
insd dword es:[edi], dx
sar byte [edx + 0x39], 1
cmp byte [ebx - 0xe], ch
sub eax, 0x23b73f35
jbe 0x10119165
xor eax, 0x7623b73f
popfd
arpl word [ecx], ax
lodsd eax, dword [esi]
push esp
fbstp tbyte [edi + 0x3c]
pop eax
out dx, eax
lcall 0x9d8b, 0xb74e4903
sbb al, 0x11
enter 0xffffffffffffe57f, 0xffffffffffffff9b
adc eax, ecx
jg 0x101191c2
wait
ret 0x5377
push dword [esp + 8]
mov dword [esp + 0x1c], 0xca806b7f
mov byte [esp + 4], dh
lea esp, [esp + 0x1c]
jmp fcn.1000d710
jmp 0x101a65ad
mov dword [esp + 0x1c], 0xf0ee18d3
jmp 0x1014a50c

Function at 0x1011b568
Capabilities:
Packed with generic packer

Disassembly:
test bp, bp
stc
nop
mov byte [esp + 4], 0xd1
test dl, dh
bt ax, 0xf
stc
nop
mov dword [esp], 0xb18e03e9
test dh, bh
add esp, 0x10
cmp dword [ebp - 8], esp
pushfd
lea esp, [esp + 4]
je 0x100f67df
pushfd
call fcn.100c9ec9
dec esp
daa
aam 0x82
jo 0x1011b5ab
rcr eax, 0x55
push cs
or byte [edi], al
cvttps2pi mm7, qword [eax]
xchg ebp, ebx
cli
pop es
rol byte [edi + edi*8 + 2], cl
invalid
invalid
Function at 0x1011ed96
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x100da5aa
cwde
mov eax, 0
pushal
push ebx
pushfd
pushfd
lea esp, [esp + 0x2c]
jmp loc.10009591
lea esp, [esp + 8]
je 0x100bab39
pushal
sub esp, 0xffffffe0
pushal
push edx
cmp eax, eax
dec al
sub ebx, ebx
xchg esi, eax
movzx cx, bl
xchg cl, dl
xchg dword [ebp + 8], ebx
mov dl, byte [esp]
mov edx, dword [ebp + 0xc]
jmp 0x101158a8
pushfd
movzx si, bl
push esp
mov eax, dword [ebx]
pushfd
xchg edi, ecx
lea ecx, [esi*2 - 0x196f7c51]
mov dword [edx], eax
inc di
lahf
jmp 0x1017d9e6
mov dword [ebp - 0xc], eax
cmp si, bp
clc
bt si, bx
push dword [esp]
cmp dword [ebp - 0xc], 1
mov word [esp + 4], bx
jmp 0x1010ac8d
mov eax, dword [ebx + 4]
push esp
pushfd
xchg cx, si
mov dword [edx + 4], eax
pushfd
lea ebx, [ebp - 0xadaf74]
inc dword [ebp + 8]
mov word [esp + 0xc], 0x71f5
xchg dx, si
lea esp, [esp + 0x1c]
popal
pushal
movsx ax, dl
bswap eax
pushfd
mov eax, 1
pushal
mov byte [esp], 0x98
lea esp, [esp + 0x44]
jmp loc.10009591
Function at 0x1011ee52
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec esp
inc dword [edx]
invalid
pop esp
in al, 0xc6
and byte [eax + 0x57208e79], cl
mov fs, word [eax]
push edi
jno 0x1006d819
push edi
mov eax, 0x1534d96d
mov bh, 0x76
test dword [ecx + 2], ebx
inc esi
mov bl, 0x34
mov edx, 0x3272af7a
fbld tbyte [edx]
jecxz 0x1006d8e4
sbb al, 0x32
jne 0x1006d856
retf 0x3784
aaa
pop ss
lodsb al, byte [esi]
mov byte [0x3c128dc1], al
jnp 0x1006d85c
fdiv qword [edx + 0x1d]
xor dword [edx - 0x77], esi
cmp byte [eax + 0x3483f3a8], cl
dec cx
sar byte [ebx + ebx + 0x33], cl
push esp
add dword [eax + 0x66], esp
pushal
mov word [esp + 4], di
mov dword [esp + 0x24], eax
pushfd
mov dword [esp + 0x24], 0x40
pushal
push dword [esp]
mov word [esp], 0x8ca0
lea esp, [esp + 0x48]
jbe 0x1017bd66
xchg byte [ebp - 0x1c], bh
adc byte [eax], al
push dword [ebp + 0xc]
pushal
call fcn.100f1e02
aaa
loope 0x1006d87f
enter 0xffffffffffffd39d, 0xfffffffffffffff7
adc eax, 0x94e4233f
loop 0x1006d96e
mov ebp, 0x14431b3b
lcall 0x2fa0, 0x401245ce
invalid
and byte [ebx + edi*4], ah
ret 0xf7f3
pushfd
pushfd
mov dword [esp], 0x65af0d1b
mov dword [esp + 0x44], 0x37ac38c8
push esp
push dword [esp]
push esi
lea esp, [esp + 0x50]
jmp fcn.1000a2d7
pushfd
lea esp, [esp + 0xc]
jne 0x1019dbbc
jp 0x10132385
lahf
cwde
pushal
lea esp, [esp + 0x20]
mov dword [ebp - 8], esp
movzx ax, dl
lahf
pushal
pop eax
lea eax, [ebp - 4]
push 0x1dafa3d5
pushfd
push edx
jmp 0x1006d8c8
movsx ax, dl
setl ah
movzx eax, dl
cwde
mov dword [ebp - 8], esp
not eax
cwde
movzx eax, bl
lea eax, [ebp - 4]
pushfd
push ecx
jmp 0x1015a229
mov dword [esp + 4], eax
pushal
mov dword [esp + 0x20], 0x40
mov byte [esp + 4], 0x75
mov word [esp], di
pushfd
pushal
push dword [ebp + 0xc]
pop dword [esp + 0x40]
call fcn.101739bb
mov dword [esp + 0x40], 0x18200a5e
jmp 0x100c145b
pushal
push 0x3b68c6a8
push dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop dword [esp + 0x40]
push dword [esp + 4]
pushfd
pushfd
push dword [esp + 0x4c]
ret 0x50
push 0x9f0a0bf6
pushal
push 0x774c7f48
push dword [ebp + 0xc]
pop dword [esp + 0x24]
jmp 0x1018ad77
push dword [ebp + 8]
pop dword [esp + 0x20]
push dword [esp + 4]
mov dword [esp + 0x20], 0x101a25f8
jmp 0x1017480a

Function at 0x10125a50
Capabilities:
Execute anti-debugging instructions

Disassembly:
nop
push ebp
pop ecx
and ebp, dword [eax]
xchg edx, eax
push ecx
cmpsb byte [esi], byte es:[edi]
inc edi
xchg ebp, eax
and esi, dword [ebx - 0x5f]
pop esp
jno 0x1005b3c1
ret
push esp
lea eax, [ebp - 4]
pushfd
mov byte [esp + 4], 0x5b
mov byte [esp + 4], 0x53
mov dword [esp + 4], eax
push 0xf60ed84b
push 0x7421e554
call int.100f5c31
pushal
push 0x68865d59
push 0xc20191da
call fcn.100997c7
in eax, 0x52
pop ebp
xchg byte [eax + 0x68], ch
ficom dword [ecx - 0x6173dff]
jecxz 0x1005b3d0
add ch, ah
push edx
test eax, 0xc0fe6e57
cmp byte [ebp - 0x638548b6], 0xbb
inc esi
xchg edi, eax
push 0xffffffffffffff8f
cmp dl, byte [edi - 0x56]
jae 0x1005b388
invalid
lea esp, [esp + 0x28]
jne 0x1019dbbc
lea eax, [ebp - 0x7c150248]
mov dword [ebp - 8], esp
jmp 0x1005b39c
Function at 0x1012a18c
Capabilities:
Packed with generic packer

Disassembly:
movsx ax, al
lea eax, [edi + 0x7d4c3de6]
lahf
mov eax, 0
pushfd
mov word [esp], 0x2c73
pushal
lea esp, [esp + 0x24]
jmp loc.100089d4
movsx si, al
lea ecx, [esi + 0x33068272]
lea edx, [esi - 0x5f9e4249]
mov esi, dword [ebp + 8]
movzx dx, al
mov al, byte [esi]
pushal
mov edx, dword [ebp + 0xc]
pop ecx
mov byte [edx], al
rdtsc
lea esp, [esp + 0x1c]
popal
pushal
movsx eax, cl
movsx eax, dl
push 0xb45f67a3
mov eax, 1
mov dword [esp + 8], 0xad990d77
lea esp, [esp + 0x24]
jmp loc.100089d4
mov byte [esp + 0xc], ch
lea esp, [esp + 0x10]
je 0x1005db26
stc
pushal
shld esi, esp, cl
lea esi, [ecx*4 + 0x7e5fc66]
sal si, cl
not si
sub eax, eax
jmp 0x10085736

Function at 0x1012ce10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov dword [esp + 4], 6
pushal
lea esp, [esp + 0x24]
call fcn.1001ea1b
test ebx, esi
add esp, 4
push eax
mov dword [ebp - 0xc], eax
push dword [esp]
test al, ch
bt ax, 0xa
mov byte [esp], dl
cmp dword [ebp - 0xc], 1
jmp 0x10183e13
lea esp, [esp + 8]
je 0x101632bc
pushal
mov byte [esp + 4], ch
pushfd
lea esp, [esp + 0x24]
pushal
bsf cx, ax
mov si, 0x376d
xor eax, eax
cbw
mov esi, dword [ebp + 8]
pushal
call fcn.101419a3
sub ch, 0xb3
push edi
xor ebp, edx
out dx, eax
xchg esi, eax
mov dword [0x2c4fc165], eax
mov esi, 0xd12d6301
and dword [edi], 0x16
pop ss
in eax, dx
xchg ecx, eax
pop edi
add esi, dword [esi + 0x5aa3a2b7]
pop ebx
adc eax, 0x507574b9
push ecx
jns 0x10183e23
invalid
Function at 0x10131107
Capabilities:
Packed with generic packer

Disassembly:
ror bl, 5
xor eax, dword [edx]
xchg dx, di
mov edx, dword [ebp + 8]
rcl bp, 0xe
mov word [esp + 8], ax
mov edi, edx
rcr bh, cl
pop ebp
bswap bp
add edx, 4
not bl
or bh, 0x61
push ebx
and ebp, ebp
mov dword [edx], eax
xadd edx, ebx
inc al
sal ax, 5
mov eax, dword [edi]
bts dx, dx
mov edx, esi
sal ebx, 9
movsx si, cl
xor ebx, edx
mov esi, dword [0x31c3840]
sbb ebx, edx
shl edx, 0x10
or edi, ecx
xor bp, 0xe43a
pushal
setbe bh
or edx, ecx
jmp 0x10070331
mov ecx, eax
movzx di, cl
xadd bx, bp
shr ecx, 0x10
setbe bl
pop edi
sub bp, 0x7f5
movsx bx, dl
mov ecx, dword [esi + ecx*4 + 0x24]
xchg ebx, esi
bsf ebp, esi
lea edi, [edi*8 - 0x581ff418]
and eax, 0xffff
xchg bx, bp
xchg bp, bx
mov dword [ecx + eax*4 + 0x2114], edx
jmp 0x10160ef6
shrd esi, ebx, 0x14
movzx ecx, word [edx + edx + 0x2d08bf0]
bts bx, dx
shld ebx, edx, 0x1e
xor bl, bh
neg dx
lea edx, [ebp + 0xc]
mov word [esp], bx
clc
rol di, 0xa
shrd si, si, 7
mov dword [0x31c38a0], eax
not bh
shld ebx, edx, 0xc
inc si
lea edi, [ebp*4 - 0x1d70d155]
and eax, 0xff
xchg si, di
xor cx, word [eax + eax + 0x2d08df0]
lea eax, [edx - 0x6481e5bf]
stc
pushfd
movzx eax, cx
clc
push ebp
bswap esi
movzx ecx, word [edx + 2]
lea esp, [esp + 0x30]
jno 0x1018d227
imul cx, word [edx]
xadd di, si
sar esi, cl
rcr bh, 5
bt eax, 8
xor cx, ax
inc si
pushal
clc
sar si, cl
movzx esi, cx
shl di, cl
rcl ch, cl
mov ecx, eax
cmp sp, 0xfecd
sbb bx, sp
movsx bx, dl
shl eax, 0x10
lea edi, [ebx - 0x577e53c4]
or eax, ecx
jmp 0x1005be52
push dword [esp + 0x10]
call fcn.1018c32a
mov dword [esp], 0x4f785feb
pushfd
pushfd
pushfd
lea esp, [esp + 0xc]
jmp loc.10006dfe
jmp 0x101a6390
bt si, 2
btr si, 0xa
bt si, 0xf
imul cx, word [edx]
ror di, 0xa
clc
jmp fcn.10077cb0

Function at 0x10140dbc
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dword [ebp - 0x10], 0
push 0xc2e22330
push dword [esp]
mov byte [esp + 8], al
push dword [esp + 4]
lea esp, [esp + 0x38]
jne 0x1019dbbc
not ah
push edi
mov eax, 0
mov word [esp], si
lea esp, [esp + 4]

Function at 0x10149167
Capabilities:
Encrypt data using rc4 prga
Execute anti-debugging instructions

Disassembly:
stc
pushfd
cmp ch, 0xcf
add esp, 8
add esp, 8
bt bx, ax
mov dword [ebp - 0x10], eax
call fcn.10116479
bt sp, 2
cmc
nop
bt esi, 0xc
pushal
nop
mov byte [esp], dh
cmp si, bp
nop
test di, dx
cmc
cmp ch, 0x48
nop
pushal
stc
pushfd
jmp 0x1016e593
add esp, 0x44
cmp dword [ebp - 8], esp
push ecx
mov word [esp], 0x1358
lea esp, [esp + 4]
je 0x100614d2
pushal
mov dword [esp + 0x1c], 6
pushfd
lea esp, [esp + 0x20]
call fcn.1001ea1b
jmp 0x100614ca

Function at 0x10149176
Capabilities:
Encrypt data using rc4 prga
Execute anti-debugging instructions

Disassembly:
stc
pushfd
cmp ch, 0xcf
add esp, 8
add esp, 8
bt bx, ax
mov dword [ebp - 0x10], eax
call fcn.10116479
bt sp, 2
cmc
nop
bt esi, 0xc
pushal
nop
mov byte [esp], dh
cmp si, bp
nop
test di, dx
cmc
cmp ch, 0x48
nop
pushal
stc
pushfd
jmp 0x1016e593
add esp, 0x44
cmp dword [ebp - 8], esp
push ecx
mov word [esp], 0x1358
lea esp, [esp + 4]
je 0x100614d2
pushal
mov dword [esp + 0x1c], 6
pushfd
lea esp, [esp + 0x20]
call fcn.1001ea1b
jmp 0x100614ca
Function at 0x1014b516
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
pushfd
mov dword [ebp - 0x28], eax
pushal
push 0xf7af5c8f
mov byte [esp + 4], 7
lea esp, [esp + 0x2c]
mov dword [ebp - 0x2c], esp
pushfd
mov dword [esp], str.VirtualAlloc
push ebp
pushfd
push dword [ebp - 0x28]
pop dword [esp + 4]
mov byte [esp], al
jmp 0x100efe16
nop
bt dx, 1
nop
stc
mov byte [esp + 0xc], 0xac
cmc
add esp, 0x30
cmp dword [ebp - 0x24], esp
jmp 0x100e1c32
lea esp, [esp + 0x40]
call fcn.1001ea1b
clc
add esp, 4
jno 0x1005ed6f
push ebx
mov dword [ebp - 0x28], eax
mov dword [esp], ecx
jmp 0x100d03b2
test bx, sp
push 0x8d83c69e
bt bp, 2
nop
pushfd
cmp bl, 0x88
pushal
nop
pushfd
push dword [esp]
jmp 0x10080300
pushfd
lea esp, [esp + 8]
mov dword [ebp - 0x2c], esp
call fcn.100ed35d
pushfd
lea esp, [esp + 4]
je 0x1016a6ce
jmp 0x100e4947
push edi
mov dword [esp], 6
pushal
pushal
jmp 0x1017d1b5
movzx di, bl
push ebx
mov edi, dword [ebp + 8]
pop edx
lea edx, [ebx - 0x32a7615a]
bswap dx
rep stosb byte es:[edi], al
rdtsc
push 0xb9f73178
xchg cl, bl
lea esp, [esp + 4]
popal
push ebp
pushfd
mov eax, 1
pushfd
push dword [esp + 4]
lea esp, [esp + 0x10]
jmp loc.1001d61a
pushfd
mov dword [esp + 4], 0x1019cf02
pushal
pushal
push dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop dword [esp + 0x40]
pushfd
push dword [esp + 0x44]
ret 0x48
jmp 0x1017c28c
pushfd
lea esp, [esp + 0x48]
jne 0x1019dbbc
seta ah
mov eax, 0
push 0xc6933c8a
push ebx
pushal
push dword [esp + 8]
lea esp, [esp + 0x2c]
jmp loc.1001d61a
jmp 0x1009bdd8
clc
pushfd
lea esp, [esp + 4]
pushal
push 0xf7e79952
xor eax, eax
setno dh
not cx
pushfd
mov ecx, dword [ebp + 0xc]
lea esp, [esp + 8]
jl 0x100eaf60
push 0x18393bb2
mov edi, dword [ebp + 8]
setl dl
movzx dx, cl
rep stosb byte es:[edi], al
rdtsc
pushfd
sets ah
not al
lea esp, [esp + 8]
popal
not al
lea eax, [edi*4 + 0xa88bc5a]
call fcn.100c8129
jmp 0x100b0723

Function at 0x101501cc
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [ebp - 4]
jle 0x101595f8
push eax
pushfd
pushal
push 0x6b37abe0
push dword [ebp - 4]
pop dword [esp + 0x24]
call fcn.100b7f2c
or ax, 0x4fae
pop eax
sub edx, 5
xor al, 0xc0
bsr ax, di
jmp 0x1018a81f
mov dword [esp + 0x10], 0xc0bd0c40
lea esp, [esp + 0x14]
je 0x100e26a5
stc
pushal
sbb ch, al
aas
mov ecx, dword [ebp + 8]
btr ax, 6
pushal
mov byte [esp], cl
mov edx, dword [ebp + 0xc]
setl al
shr al, 1
rol bh, cl
lea ebx, [0x9c00b7e4]
mov byte [ecx], 0xe9
ror bl, 4
not al
sub edx, ecx
sub ah, 0x21
jmp 0x100dee94
pushfd
mov dword [esp], eax
push ebx
pushfd
push dword [ebp - 4]
pop dword [esp + 4]
pushfd
push dword [esp]
mov dword [esp + 8], 5
pushal
jmp 0x10194634
add ecx, 1
xchg si, ax
mov dword [ecx], edx
cwde
bswap ecx
pushal
xchg ecx, eax
lea esp, [esp + 0x3c]
popal
lahf
mov dword [ebp - 8], esp
bswap eax
jmp 0x10073ff6
push dword [ebp + 8]
pop dword [esp + 0x24]
mov word [esp], sp
pushal
mov dword [esp + 0x40], 0x100cc399
call fcn.101179da
Function at 0x1015163f
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x24], eax
mov byte [esp], 0x48
push 0x77835bd2
push dword [esp + 0x28]
ret 0x2c
push 0x96e801ad
lea esp, [esp + 0xc]
jne 0x10181dca
mov ah, 0xa1
cwde
call fcn.100a5751
pushfd
jmp 0x10185c38
jmp 0x1014e9a8

Function at 0x101588a4
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, dword [esp + 0x28]
movzx di, bl
jmp 0x10107fde

Function at 0x101631a1
Capabilities:
Packed with generic packer

Disassembly:
cmc
mov dword [ebp - 0x10], eax
pushal
clc
bt di, 0xf
cmp dword [ebp - 0x10], 0
pushal
call fcn.1014b516
jns 0x100ebe6c
mov ecx, 0xc107793f
push 0x183f7190
mov cl, 0xc8
aas
rcl dword [ebp + 0x50d1d678]
and eax, 0x96bcd936
scasb al, byte es:[edi]
nop
enter 0x7271, 0xffffffffffffffdc
stosd dword es:[edi], eax
invalid
pop ebx
or dword [edx - 0x57], 0xffffffda
push ecx
adc dword [ebp - 0x1c], ebx
mov cl, 0xcb
add dword [edx], 0x78d69db1
adc edi, dword [ebx]
inc esp
or cl, byte [ebp + 0x4b58f6c1]
mov esp, 0x7e43784b
pushfd
add byte [eax - 0x2b], 0x3a
fst qword [edx + 0x73b3a207]
lcall 0x32a3, 0xc8b7df75
retf
pushfd
mov dword [esp + 0x28], 6
pushfd
lea esp, [esp + 0x2c]
call fcn.1001ea1b
cmc
bt di, 0xc
add esp, 4
cmp al, dl
jmp 0x100ebdff