joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413560
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
push ebp
mov ebx, edx
push str._unknown_
push ebx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push 0x1c
lea edx, [esp + 0x14]
push edx
mov dword [eax], 0
push esi
mov dword [ecx], 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41364a
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x4135b7
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4135db
push ebp
push str._unknown_
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
test edi, edi
je 0x41364a
cmp word [edi], 0x5a4d
jne 0x41364a
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x41364a
mov ecx, dword [eax + edi]
add eax, edi
cmp ecx, 0x4550
jne 0x41364a
movzx ebp, word [eax + 6]
movzx ecx, word [eax + 0x14]
sub esi, edi
xor ebx, ebx
test ebp, ebp
lea ecx, [ecx + eax + 0x18]
jbe 0x41364a
lea eax, [ecx + 0x10]
mov ecx, dword [eax]
mov edx, dword [eax - 8]
cmp ecx, edx
mov edi, dword [eax - 4]
ja 0x41361f
mov ecx, edx
cmp esi, edi
jb 0x413629
add ecx, edi
cmp esi, ecx
jbe 0x41363b
inc ebx
add eax, 0x28
cmp ebx, ebp
jb 0x413611
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
inc ebx
sub esi, edi
mov dword [edx], ebx
mov dword [eax], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x413720
Capabilities:
Create thread

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
push 0x43f8e4
mov esi, edx
mov edi, ecx
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x413794
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0xc]
push edx
push ebx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
push eax
push 0x4137b0
push ebx
push ebx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x413794
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x1c]
push 0x43f8e4
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x1c
ret 8
Function at 0x413b50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov esi, ecx
je 0x413b61
mov eax, dword [edi]
mov bl, byte [esp + 0x14]
test bl, 1
je 0x413b6d
or eax, 0xffffffff
test bl, 2
je 0x413b9e
test edx, edx
mov ecx, esi
je 0x413b9e
push ebp
lea esp, [esp]
movzx ebp, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, ebp
mov esi, dword [esi*4 + 0x4384a0]
shr eax, 8
xor eax, esi
inc ecx
dec edx
jne 0x413b80
pop ebp
test bl, 4
je 0x413ba5
not eax
test edi, edi
je 0x413bab
mov dword [edi], eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x41eff0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
mov dword [ecx + 0x18], 0xc3d2e1f0
ret
Function at 0x425e94
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [eax + 0x25c]
test ecx, ecx
jle 0x42437c
push ebx
mov ecx, 0xfffffff8
push esi
mov esi, dword [eax + 0x4c]
mov bl, byte [eax + 0x25b]
mov edx, dword [eax + 0x2c]
mov byte [edx + esi], bl
mov edx, dword [eax + 0x4c]
mov esi, dword [eax + 0x25c]
mov ebx, dword [eax + 0x258]
inc edx
add esi, ecx
mov dword [eax + 0x4c], edx
shl ebx, 8
mov edx, esi
test edx, edx
mov dword [eax + 0x258], ebx
mov dword [eax + 0x25c], esi
jg 0x424341
pop esi
pop ebx
ret
sub esp, 8
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x44]
xor ebx, ebx
cmp eax, ebx
push edi
mov byte [esp + 0xc], dl
jle 0x425edd
mov ecx, dword [esi + 0x264]
mov eax, dword [esi + 0x260]
mov edx, ecx
shr edx, 0x1f
add ecx, ecx
not eax
or edx, ecx
xor edx, eax
mov dword [esi + 0x260], eax
cmp dword [esi + 0x26c], 1
mov dword [esi + 0x264], edx
jle 0x425ed6
mov dword [esi + 0x4c], ebx
mov ecx, esi
call fcn.00429ee0
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x26c]
add edx, ecx
cmp eax, 1
mov dword [esi + 0x2c], edx
jne 0x425f36
mov ecx, 0x42
mov edi, 8
mov eax, esi
mov dword [esi + 0x25c], ebx
mov dword [esi + 0x258], ebx
call fcn.00424380
mov ecx, 0x5a
call fcn.00424380
mov ecx, 0x68
call fcn.00424380
mov al, byte [esi + 0x270]
add al, 0x30
movzx ecx, al
mov eax, esi
call fcn.00424380
cmp dword [esi + 0x44], ebx
jle 0x425fd8
mov ecx, 0x31
mov edi, 8
mov eax, esi
call fcn.00424380
mov ecx, 0x41
call fcn.00424380
mov ecx, 0x59
call fcn.00424380
mov ecx, 0x26
call fcn.00424380
mov ecx, 0x53
call fcn.00424380
mov ecx, 0x59
call fcn.00424380
mov ebx, dword [esi + 0x260]
mov ecx, ebx
shr ecx, 0x18
mov dword [esp + 0x10], ebx
call fcn.00424380
movzx ecx, byte [esp + 0x12]
call fcn.00424380
movzx ecx, bh
call fcn.00424380
mov ecx, ebx
and ecx, 0xff
call fcn.00424380
xor ecx, ecx
mov edi, 1
call fcn.00424380
mov ecx, dword [esi + 0x1c]
mov edi, 0x18
call fcn.00424380
call fcn.00424480
call fcn.00424640
mov al, byte [esp + 0xc]
test al, al
je 0x426065
mov ecx, 0x17
mov edi, 8
mov eax, esi
call fcn.00424380
mov ecx, 0x72
call fcn.00424380
mov ecx, 0x45
call fcn.00424380
mov ecx, 0x38
call fcn.00424380
mov ecx, 0x50
call fcn.00424380
mov ecx, 0x90
call fcn.00424380
mov ebx, dword [esi + 0x264]
mov ecx, ebx
shr ecx, 0x18
mov dword [esp + 0x10], ebx
call fcn.00424380
movzx ecx, byte [esp + 0x12]
call fcn.00424380
movzx ecx, bh
call fcn.00424380
mov ecx, ebx
and ecx, 0xff
call fcn.00424380
pop edi
pop esi
pop ebx
add esp, 8
jmp 0x424330
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x42ccb0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push edi
mov edi, dword [esp + 0xc]
shr edi, 2
test edi, edi
mov eax, 0xeeeeeeee
je 0x42cd0b
mov ecx, dword [esp + 0x10]
push ebx
push esi
nop
lea esp, [esp]
mov esi, ecx
and esi, 0xff
add eax, dword [esi*4 + 0x447f80]
mov ebx, dword [edx]
lea esi, [eax + ecx]
imul eax, eax, 0x21
xor ebx, esi
mov esi, ebx
lea eax, [eax + esi + 3]
mov esi, ecx
not esi
shl esi, 0x15
add esi, 0x11111111
shr ecx, 0xb
mov dword [edx], ebx
add edx, 4
or ecx, esi
dec edi
jne 0x42ccd0
pop esi
pop ebx
pop edi
ret

Function at 0x42cd10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
shr edi, 2
test edi, edi
mov eax, 0xeeeeeeee
je 0x42cd68
mov ecx, dword [esp + 0x14]
push ebx
nop
lea esp, [esp]
mov edx, dword [esi]
mov ebx, ecx
and ebx, 0xff
add eax, dword [ebx*4 + 0x447f80]
lea ebx, [eax + ecx]
imul eax, eax, 0x21
xor ebx, edx
lea eax, [eax + edx + 3]
mov edx, ecx
not edx
shl edx, 0x15
add edx, 0x11111111
shr ecx, 0xb
mov dword [esi], ebx
add esi, 4
or ecx, edx
dec edi
jne 0x42cd30
pop ebx
pop edi
pop esi
ret

Function at 0x42cf60
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x42da70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
je 0x42da7d
mov eax, dword [esi]
push ebx
mov bl, byte [esp + 0x18]
test bl, 1
je 0x42da8a
or eax, 0xffffffff
test bl, 2
je 0x42dabf
mov edx, dword [esp + 0x10]
test edx, edx
mov ecx, dword [esp + 0xc]
je 0x42dabf
push ebp
push edi
lea ecx, [ecx]
movzx ebp, byte [ecx]
mov edi, eax
and edi, 0xff
xor edi, ebp
mov edi, dword [edi*4 + 0x43a528]
shr eax, 8
xor eax, edi
inc ecx
dec edx
jne 0x42daa0
pop edi
pop ebp
test bl, 4
pop ebx
je 0x42dac7
not eax
test esi, esi
je 0x42dacd
mov dword [esi], eax
pop esi
ret
Function at 0x42df30
Capabilities:
Get common file path
Get disk size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x114
push 0x104
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
mov al, byte [esp + 0x1c]
add esp, 0xc
test al, al
je 0x42df5d
cmp byte [esp + 0x11], 0x3a
je 0x42df6d
lea edx, [esp + 0x10]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x27], 0
mov dword [esp + 0x14], 0x200
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov eax, dword [esp]
add esp, 0x114
ret

Function at 0x42e290
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
jne 0x42e2a4
push 0x57
call fcn.0040bae0
xor eax, eax
pop ebp
ret
call fcn.0042e080
test eax, eax
je 0x42e2bb
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
pop ebp
ret
push esi
push edi
xor edi, edi
push edi
push edi
push 2
push edi
push edi
push 0x40000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42e317
mov eax, dword [0x448390]
mov edx, dword [0x448394]
push ebx
push edi
lea ecx, [esp + 0x18]
push ecx
push eax
push edx
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42e304
cmp ebx, dword [esp + 0x14]
jne 0x42e304
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop ebx
jne 0x42e317
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x42e700
Capabilities:
Check if file exists

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
push ebx
push edi
push esi
lea eax, [ebp + 4]
push eax
push ecx
push edx
call fcn.00411500
test eax, eax
jne 0x42e775
push ebx
mov ebx, dword [esp + 0x1c]
push edi
push esi
push ebp
mov ebp, dword [esp + 0x24]
push ebx
push ebp
call fcn.00411500
test eax, eax
jne 0x42e775
test edi, edi
je 0x42e74f
test esi, esi
je 0x42e74f
mov byte [esi], al
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x42e762
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x42e76e
push 0
push ebx
push ebp
call fcn.0042e650
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x42e780
Capabilities:
Check if file exists

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
push edi
push esi
lea eax, [ebx + 4]
push eax
push ebp
push ecx
call fcn.00411730
test eax, eax
jne 0x42e7eb
push edi
push esi
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push ebx
call fcn.00411730
test eax, eax
jne 0x42e7eb
test edi, edi
je 0x42e7c5
test esi, esi
je 0x42e7c5
mov byte [esi], al
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x42e7d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x42e7e4
push 0
push ebp
push ebx
call fcn.0042e650
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x42e800
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
push esi
lea eax, [ebp + 4]
push eax
push edi
push ebx
call fcn.00411870
test eax, eax
jne 0x42e85d
push esi
push ebp
push edi
push ebx
call fcn.00411870
test eax, eax
jne 0x42e85d
test esi, esi
je 0x42e837
mov dword [esi], eax
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x42e84a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x42e856
push 0
push edi
push ebx
call fcn.0042e650
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0xee3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.00ee378f
jae 0xee370e
xor ecx, ecx
call fcn.00ee378f
jae 0xee373d
xor eax, eax
call fcn.00ee378f
jae 0xee374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.00ee378f
adc al, al
jae 0xee372f
jne 0xee3779
stosb byte es:[edi], al
jmp 0xee3711
call fcn.00ee379b
sub ecx, ebx
jne 0xee3756
call fcn.00ee3799
jmp 0xee3775
lodsb al, byte [esi]
shr eax, 1
je 0xee3783
adc ecx, ecx
jmp 0xee3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00ee3799
cmp eax, 0x7d00
jae 0xee3772
cmp ah, 5
jae 0xee3773
cmp eax, 0x7f
ja 0xee3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xee3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0xb70058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00b701a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb7007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb7006a
add dl, dl
jne 0xb70089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb700dc
xor eax, eax
add dl, dl
jne 0xb70096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb7017d
add dl, dl
jne 0xb700a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb700b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb700bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb700c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb700d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb70075
mov eax, 1
add dl, dl
jne 0xb700ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb700f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb700e1
sub eax, ebx
mov ebx, 1
jne 0xb70128
mov ecx, 1
add dl, dl
jne 0xb7010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb70119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb70105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb70075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb7013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb7014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb70136
cmp eax, 0x7d00
jae 0xb7016d
cmp eax, 0x500
jb 0xb70168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb70075
cmp eax, 0x7f
ja 0xb70170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb70075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb7019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb70075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x1003a96d
Capabilities:
Encode data using xor

Disassembly:
pop esi
jb 0x1003a931
xchg ecx, eax
push eax
cmpsd dword [esi], dword es:[edi]
push edi
sbb cl, byte [ebx + 0x2e43a378]
jnp 0x1003a99a
lcall 0x8fec, 0xb3a69331
outsd dx, dword [esi]
in eax, 0xa9
dec edi
ja 0x1003a975
push ebx
xchg dword [ecx + 0x54], esi
xor al, 0xb0
fdivr dword [ebx - 0x52800b93]
and byte [ebp + 0x36], bh
int 0x33
test al, 0x27
push ecx
xchg ecx, eax
test byte [ebx + 0xff8ff01], al
xor dword [edx + eax], 0
add byte [edx], dh
adc ebx, ebx
jns 0x1003a9d1
Function at 0x11233ae1
Capabilities:
Check for software breakpoints

Disassembly:
add edx, eax
pushal
mov word [esp], di
mov word [esp], di
pushfd
lea esp, [esp + 0x28]
jmp 0x112d3bcb
xor al, cl
add edi, 1
stc
pushfd
pushal
mov al, byte [edi]
test bx, di
pushal
cmp cl, bh
stc
test al, al
call fcn.124451e1

Function at 0x112a1fc2
Capabilities:
Check for software breakpoints

Disassembly:
mov byte [esp + 8], 0xb2
inc al
pushfd
cmc
rol al, 3
stc
sub esp, 0xffffffc8
jo 0x12448124
clc
add al, 0xab
test bh, bl
call fcn.1244c904
add bl, dl
getsec
ret
cmc
add al, 0xab
pushfd
test ah, al
xor al, 0x95
stc
push 0x2960169d
bt dx, 0xd
bt ax, 9
not al
bt ax, 3
clc
call fcn.12446d0f

Function at 0x112a262d
Capabilities:
Check for software breakpoints

Disassembly:
pushal
push edx
pushfd
lea esp, [esp + 0x2c]
ja 0x12448160
xor al, dh
sal al, cl
setl al
setne al
sub ebx, edi
ror di, 7
add al, ah
pushfd
dec al
add esp, 4
add ebx, esp
lea edi, [esi + 0x45b4d33d]
sub al, dl
inc di
mov edi, ebx
pushfd
call fcn.112e14f1
lea esp, [esp + 0x14]
ja 0x12448160
inc al
xor al, al
xor al, 0x12
and al, 0xa1
sub ebx, edi
not di
call fcn.1244db94
cmc
bt cx, 0xb
test bl, 0x87
cmc
sub edi, 4
cmp edi, 0xe7ae76b6
push dword [edi]
clc
bt si, sp
pushfd
mov byte [esp], 0x73
cmp edi, ebx
jmp 0x112a25f3

Function at 0x112d38bf
Capabilities:
Check for software breakpoints

Disassembly:
pushfd
mov dword [esp + 0x28], eax
pushfd
pushfd
call fcn.112e73eb
jmp 0x112d3600
jne 0x112e750a
call fcn.112e0517
mov esi, dword [ebp + 0xc]
jmp 0x11233ad5
pushal
adc al, al
mov byte [esp + 0xc], 0xce
pushal
push dword [esp]
mov word [esp], 0xce38
lea esp, [esp + 0x48]
jae 0x12445336
jmp 0x112a2e2b
lea esp, [esp + 4]
jae 0x12445336
pushal
pushal
pushfd
lea esp, [esp + 0x44]
jne 0x112e750a
pushfd
stosb byte es:[edi], al
mov byte [esp], 0xce
lea esp, [esp + 4]
jmp fcn.12448a15
push edx
pushfd
lea esp, [esp + 8]
call fcn.1244996f
jmp 0x12447d25
adc al, al
push 0x8b7d1104
jmp 0x124443e5

Function at 0x112d3a75
Capabilities:
Check for software breakpoints

Disassembly:
mov byte [esp + 4], 0x4a
mov byte [esp], ch
lea esp, [esp + 0x24]
jne 0x112e06b0
pushal
mov byte [esp], ah
jmp 0x1244942f
push dword [edi]
pop dword [esp + 8]
clc
cmp edi, ebx
pushfd
lea esp, [esp + 0xc]
je 0x124452fe
pushfd
push ebp
lea esp, [esp + 8]
ja 0x12448160
bt ax, 6
jmp 0x12447305
pushfd
pushfd
push esi
lea esp, [esp + 0xc]
ja 0x12448160
and al, 0xb6
pushfd
pushal
sub ebx, edi
ror al, cl
lea esp, [esp + 0x24]
add ebx, esp
pushfd
rcr di, 1
mov edi, ebx
pushal
mov al, 0x2e
clc
cmp dl, 0x18
bt sp, 7
call fcn.124442e3
mov al, 0x10
lea esp, [esp + 0x2c]
mov edi, ebx
ror al, 6
add al, 0x24
clc
bt esp, ecx
mov al, 0x2e
pushal
push 0x1064e297
mov word [esp], dx
repne scasb al, byte es:[edi]
jmp 0x112a2049
sub al, dl
stc
sub ebx, edi
not al
add ebx, esp
jmp 0x124460e4

Function at 0x112d3be3
Capabilities:
Check for software breakpoints

Disassembly:
pushal
stosb byte es:[edi], al
pushal
push 0x51973942
pushfd
lea esp, [esp + 0x4c]
jmp fcn.12448a15
Function at 0x112e0f22
Capabilities:
Check for software breakpoints

Disassembly:
neg al
bt bp, bx
jmp 0x1244881a
mov byte [esp], dl
cmp al, byte [edi]
pop eax
movzx ax, cl
bswap ax
pop eax
lea edi, [edi + 1]
movzx ax, cl
lea eax, [esp + 0x3393b730]
jmp 0x124442b8

Function at 0x112e4aff
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x12448149
pushfd
lea esp, [esp + 0x2c]
ja 0x12448160
push ecx
call fcn.112d3f8f

Function at 0x124445a5
Capabilities:
Check for software breakpoints

Disassembly:
pushfd
add edx, eax
mov byte [esp], dh
pushfd
lea esp, [esp + 0x2c]
jmp 0x112d3bcb
pushfd
sub al, 0x30
bt di, cx
cmp al, 9
pushfd
lea esp, [esp + 0xc]
ja 0x112e06b0
stc
imul edx, edx, 0xa
pushfd
pushal
jmp 0x11233195

Function at 0x12444b88
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [esp + 0x24], ebx
mov byte [esp + 0x10], al
push 0x34d9436c
push 0xf55e7b16
lea esp, [esp + 0x2c]
jmp 0x1244a800
mov byte [edi - 1], 0
jmp 0x1244931d
pushal
jmp 0x112e7b65

Function at 0x1244852c
Capabilities:
Check for software breakpoints

Disassembly:
mov byte [edi - 1], 0
push edx
jmp fcn.112e4124

Function at 0x124488b1
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 4]
jne 0x112e750a
call fcn.112d3be3
jmp 0x112a1eec

Function at 0x124490a0
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0x10]
jae 0x12445336
call fcn.124488b1
push 0x5b0f69c1
jmp 0x112e7ea6

Function at 0x1244a048
Capabilities:
Check for software breakpoints

Disassembly:
clc
cmp al, byte [edi]
lahf
lea eax, [eax + 0x9e6c23]
pop eax
bswap ax
lea edi, [edi + 1]
cwde
setl al
jmp 0x1244b790
movzx ax, al
mov eax, dword [esp + 0xc]
pushal
push ecx
lea esp, [esp + 0x34]
ja 0x124467e4
push 0xea4bba11
jmp 0x1244b636

Function at 0x1244c57e
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x24]
je 0x1244d1fe
xadd edx, esi
xadd si, dx
inc si
not si
mov esi, dword [eax + 0x3c]
xor dx, di
neg dl
clc
bsf dx, sp
add esi, eax
sub dl, 0x65
add dx, 0x661d
adc dh, 0xd5
clc
mov edx, dword [esi + 0x78]
cmc
stc
push 0xf48ca5b7
pushfd
test edx, edx
pushfd
lea esp, [esp + 0xc]
je 0x1244d1fe
or al, 0
add byte [edx + 0x66], dl
not ecx
push edx
not cx
add edx, eax
dec cx
mov ecx, dword [esi + 0x7c]
cmp ax, dx
stc
pushfd
mov word [esp + 4], 0xfce4
add ecx, edx
pushfd
mov dword [ebp - 0x10], ecx
test bx, 0x85e6
xor ecx, 0xe5224e7b
dec cl
mov ecx, dword [ebp + 0xc]
cmc
cmp ecx, 0xffff
mov word [esp + 4], di
call fcn.112e4135
outsb dx, byte [esi]
xor eax, 0x7f5dd4d
jecxz 0x1244c5c5
sub eax, 0xa6bc0b8d
bnd ret 0xbef4
Function at 0x1244d42e
Capabilities:
Check for software breakpoints

Disassembly:
test edi, edi
mov dword [esp], ebp
push ebp
pushfd
lea esp, [esp + 0x30]
je 0x1244d1fe
pushfd
clc
call fcn.112e0101
jecxz 0x1244931e
sub dword [ecx - 0x5cf3a8ad], ecx
fisttp word [edi - 0x55]
out dx, al
and al, 0x18
or byte [eax], 0x1e
pushfd
or byte [eax - 0x32], 0xcc
inc esi
jl 0x12449302
lodsb al, byte [esi]
push ss
and byte [edx + 0x2c5e6e8c], bh
push cs
in al, 0x42
js 0x124493b1
push ds
les edx, [edi - 0x52ea6d86]
inc esp
jbe 0x12449391
pushal
insb byte es:[edi], dx
nop
je 0x12449401
sub eax, 0x8e34739f
inc eax
invalid
sti
xor dh, byte [eax + 0x7cc7e365]
sbb byte [ecx + ebp - 0x18], dh
invalid
test dword [edx + 0x60fee972], ebp
pushfd
pushal
mov edi, dword [edi + ecx*4]
jmp 0x12449344

Function at 0x1244d91f
Capabilities:
Check for software breakpoints

Disassembly:
test dl, ah
bt sp, bx
sub al, al
push edi
pushfd
repne scasb al, byte es:[edi]
lea esp, [esp + 0xc]
jbe 0x124491ab
jne 0x1244d1fe
neg si
push 0x30112712
cmp si, 0xd42a
mov ecx, edi
cmp dh, 0x4f
test sp, si
ror si, 6
test cl, dh
sub ecx, ebx
lea esp, [esp + 4]
pushal
push dword [esp]
lea esp, [esp + 0x44]
ja 0x12448160
pushal
sal al, 3
mov byte [esp], ch
sub ebx, edi
call fcn.112e1272
bt dx, si
sub edi, 4
clc
bt sp, 6
test dl, 0x6e
push dword [edi]
bt ecx, 9
pushal
jmp 0x1244a227
jmp 0x112e0f3f
pushfd
pushfd
lea esp, [esp + 8]
jne 0x1244d1fe
xor si, dx
mov ecx, edi
and si, 0x6ec2
shld si, bp, 4
sub ecx, ebx
cmp si, ax
not esi
mov esi, esp
cmp dh, 0x35
cmp ebp, 0xde10bca6
ja 0x112e1838
cmc
sub edi, 4
push eax
push dword [esp]
cmc
push 0x8ba95b9e
push dword [edi]
pop dword [esp + 8]
bt cx, ax
pushal
call fcn.12445e32
cmc
mov ebx, eax
rcl ecx, cl
clc
sal ch, 5
mov edi, eax
mov dword [esp], ebx
bt bp, 2
not cl
mov ecx, 0x104
jmp 0x112d3eb3
cmp edi, ebx
jmp 0x12445b2f
jmp 0x1244a062