joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x4090a0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x4090a4]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call fcn.00402ad4
jmp 0x4011d3
mov eax, dword [0x4090a4]
test eax, eax
jne 0x4011c9
mov dword [0x4090a4], 1
mov dword [esp + 4], 0x40c014
mov dword [esp], 0x40c00c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x4011d3
mov dword [0x40901c], 1
mov eax, dword [0x4090a4]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x40c008
mov dword [esp], section..CRT
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x4090a4], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x4090a0
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call fcn.00401fb1
mov dword [esp], 0x4020cc
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x409074], eax
mov dword [esp], section..text
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.00401950
mov eax, dword [0x409004]
mov dword [esp + 4], 0x409008
mov dword [esp], eax
call fcn.004013c8
call fcn.0040178c
mov eax, dword [0x405014]
mov edx, dword [0x40900c]
mov dword [eax], edx
mov ecx, dword [0x40900c]
mov edx, dword [0x409008]
mov eax, dword [0x409004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00403b58
mov dword [0x409014], eax
mov eax, dword [0x409018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x409014]
mov dword [esp], eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x40901c]
test eax, eax
jne 0x4012de
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x409014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40904c], 1
mov dword [0x409050], 1
mov dword [0x409054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x401958
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00402944
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x40252c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40254b
mov eax, 0
jmp 0x40258f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40256e
mov eax, 0
jmp 0x40258f
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40258a
mov eax, 0
jmp 0x40258f
mov eax, 1
leave
ret
Function at 0x402591
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x4025f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4025e8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x4025e8
mov eax, dword [ebp - 4]
jmp 0x402604
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x4025c5
mov eax, 0
leave
ret

Function at 0x4031e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
cmp dword [ecx + 0x20], 0
mov edi, dword [ebp + 8]
jne 0x4031f7
call fcn.004016a8
lea eax, [ecx + 0x18]
mov esi, ecx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [ecx + 0x24]
mov dword [ebp - 0x2c], esi
lea esi, [ebp - 0x2c]
mov ebx, eax
mov word [ebp - 0x1c], 0x104
call fcn.004015f8
mov edx, dword [edi]
mov ecx, 5
mov dword [ebp - 0x30], edx
xor edx, edx
mov dword [edi], edx
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 4], eax
lea eax, [ebp - 0x30]
mov dword [esp], eax
call fcn.00401658
mov eax, dword [ebp - 0x30]
call fcn.004031d4
mov dword [esp], ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov edx, dword [ebp + 8]
mov al, byte [edx + 0x1c]
test al, al
je 0x40328f
mov al, byte [ecx + 0x1c]
test al, al
je 0x40328f
mov ebx, dword [ecx + 8]
cmp ebx, dword [edx + 8]
jne 0x40328d
test ebx, ebx
je 0x40328f
mov dword [esp + 8], ebx
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
mov eax, dword [ecx + 4]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
sete al
jmp 0x40328f
xor eax, eax
add esp, 0x14
pop ebx
pop ebp
ret 4
Function at 0x86de0a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x86de59
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0089afd2
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x86de6a
push ebx
call fcn.0089afcc
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0086dfca
mov dword [ebp - 8], eax
push 0x80000005
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x86de8d
mov eax, 0x37
push eax
push 1
mov ebx, 0x194
call fcn.0089afe4
add esp, 0x10
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x1bc
call fcn.0089afe4
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x86ded1
push ebx
call fcn.0089afcc
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0086dfca
mov dword [ebp - 0x10], eax
push 0x80000005
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x86def4
mov eax, 0x37
push eax
push 1
mov ebx, 0x194
call fcn.0089afe4
add esp, 0x10
mov dword [ebp - 0x14], eax
pushal
pushfd
mov edi, 0
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov dl, byte [edx]
xor dl, 0xf7
mov byte [esi], dl
add esi, 1
add edi, 1
mov edx, dword [ebp - 8]
add edx, edi
cmp edi, eax
jbe 0x86df1a
popfd
popal
push 0x80000301
push 0
push dword [ebp - 0x14]
push 0x80000301
push 0
push dword [ebp - 0x10]
push 2
mov ebx, 0x910
call fcn.0089afe4
add esp, 0x1c
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x86df6f
push ebx
call fcn.0089afcc
add esp, 4
pop eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x86df8d
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0089afd2
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x86df92
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x86dfa3
push ebx
call fcn.0089afcc
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x86dfb3
push ebx
call fcn.0089afcc
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x86dfc3
push ebx
call fcn.0089afcc
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x9e6948
Capabilities:
Execute anti-debugging instructions

Disassembly:
or bx, ax
jnp 0x9e6962
sbb al, bh
mov ah, 0xd5
call fcn.009e6968
and ah, byte [eax + 0x17a05136]
pop ebp
lodsb al, byte [esi]
jmp 0x9e6932
and ecx, 0x3c
lea ebx, [ebp*4]
lea eax, [ecx + 0x7a5e52c1]
xchg bx, ax
jmp 0x9e69ab
sbb al, bh
mov ah, 0xd5
jmp 0x9e694a
mov ebx, dword [edi]
adc al, 0x60
jbe 0x9e69ee
mov ax, word [esp]
lea eax, [ebp - 0xd5bb]
jmp 0x9e69ce
lea eax, [ebp - 0xd5bb]
mov eax, ebp
jmp 0x9e69f4
mov ax, 0xa14d
jmp 0x9e6a09
jmp 0x9e6a4c
mov ax, word [esp]
jmp 0x9e69c8
lea eax, [eax + ecx]
mov dword [eax], ebx
btr eax, ebp
jo 0x9e69d2
mov ax, 0xa14d
jmp 0x9e6a09
add edi, 4
mov ch, byte [esp]
bswap ecx
cmc
jle 0x9e69d8
jg 0x9e6a4c
xor eax, 0xbd4e2bbb
jp 0x9e6a3b
invalid
invalid

Function at 0x9e76b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dx
lea edx, [ebp*4]
jmp 0x9e7be9
bt dx, ax
inc bx
lea ebx, [eax*4]
mov dx, word [esp]
xchg dword [esp], ebx
jmp 0x9e769a
lea edx, [ebp*4]
dec dx
lea ebx, [ebx - 0x23]
neg dx
call fcn.009e78bb

Function at 0x9e7907
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0x9e78e2
lea esp, [esp + 2]
sub dl, 0x2d
mov bl, 0x8e
sub esp, 0x13
jmp 0x9e7929
xchg byte [esp + 7], bh
lea ebx, [eax + ebx]
mov dword [esp + 4], esp
lea esp, [esp + 3]
jmp 0x9e794a
mov ebx, 0x2d565dc0
add esp, 2
jle 0x9e78de
jg 0x9e78c8
mov dword [esp + 4], esp
lea esp, [esp + 3]
jmp 0x9e794a
jno 0x9e78f0
xchg byte [esp + 7], bh
lea ebx, [eax + ebx]
jmp 0x9e7913
setno bl
jmp 0x9e795a
rol dl, 0
neg ebx
jnp 0x9e7934
setno bl
jmp 0x9e7994
mov ebx, ebp
mov bx, 0xfed
lea esp, [esp + 0x10]
add dl, 0x98
jmp 0x9e797e
mov ebx, ebp
mov bx, 0xfed
jmp 0x9e7960

Function at 0x9e7b7f
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt ebx, ecx
mov bl, al
lea edx, [edx + 0xf]
mov ebx, ecx
jmp 0x9e7b8f
mov bl, dl
bt bx, ax
inc bl
xchg dword [esp + 0x34], edx
mov bx, 0x9610
mov dl, dh
jmp 0x9e7bc7
bswap ebx
lea ebx, [esp - 0x3d21]
call fcn.009e7bb1
fcomp qword [esi - 0x34]
stosd dword es:[edi], eax
shr word [esi], 1
mov bl, 0x23
inc esi
mov ch, 0x70
xor al, 0xb4
sub cl, byte [ebp - 0x44]
jge 0x9e7c09
pushal
Function at 0x9e8331
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x9e82cc
lea esp, [esp + 8]
xor cl, 0x1d
lea edx, [edx + ebx]
sub bh, 0x99
jmp 0x9e83bf
mov dl, 0xe7
add cl, 0x71
pushal
jmp 0x9e8390
push word [esp + 0x17]
mov edx, dword [esp + 2]
lea esp, [esp + 2]
jmp 0x9e83fa
mov dx, word [esp + 8]
push dword [esp + 0x12]
jno 0x9e8375
push word [esp + 0x17]
jmp 0x9e83a6
mov edx, dword [esp + 2]
lea esp, [esp + 2]
jmp 0x9e83fa
jp 0x9e8350
mov dl, 0xe7
jmp 0x9e8352
push word [esp + 0x16]
lea esp, [esp + 2]
jmp 0x9e83dd
jmp 0x9e83c5
and ecx, 0x3c
bsf edx, esi
jno 0x9e8415
push esp
mov ebx, dword [esp]
jmp 0x9e841f
lea esp, [esp + 0x24]
inc cl
mov ebx, 0x11625eab
sub esp, 0x1c
je 0x9e83db
push word [esp + 0x16]
lea esp, [esp + 2]
jmp 0x9e83dd
push esp
jmp 0x9e841c
mov ebx, dword [esp]
sub edi, 4
mov dx, di
lea ebx, [edx + 0x68]
jmp 0x9e8792
lea esp, [esp + 2]
jmp 0x9e844b
xchg bh, ch
sub esp, 0x1a
jns 0x9e8461
lea esp, [esp + 2]
jmp 0x9e844b
mov ch, dl
mov dx, 0x8a89
mov dword [edi], ebx
jmp 0x9e8486
jmp 0x9e84ba
mov edx, ecx
mov ebx, dword [ecx + esi]
mov cx, 0xdd8d
neg cx
ja 0x9e8699
mov ch, dl
mov dx, 0x8a89
jmp 0x9e84c0
Function at 0x9e9d53
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf09d42c0
jmp 0x9e92a8
pushal
mov dword [esp + 0x44], edi
lea esp, [esp + 0x44]
pushfd
jmp 0x9e8927
jmp 0x9e930d
xchg cl, bl
mov si, dx
call fcn.009e92aa
sub esp, 0xb8
mov ebp, esp
mov ch, dl
mov cx, bp
jmp 0x9e93d7
lea edx, [eax + edi]
rcl dl, 3
lea eax, [esi*4]
seto al
jmp 0x9e9372
bt bx, ax
mov bl, byte [esp]
btc edx, esi
jmp 0x9e9350
rol edi, 0
jmp 0x9e93b0
dec eax
push edi
or eax, 0xad5ea29a
mov byte [esp], al
xor bl, bh
shl ebx, 0xc
jmp 0x9e93b6
jmp 0x9e9366
or eax, 0xad5ea29a
mov byte [esp], al
xor bl, bh
jmp 0x9e9387
jno 0x9e937b
dec eax
push edi
jmp 0x9e939a
lea esp, [esp + 4]
add edi, 0x23104b3f
xchg dl, ah
mov al, 0x4b
xchg dx, bx
jmp 0x9e9697
lea eax, [ebp*4]
mov ecx, edi
setle ah
mov ah, 0xe3
cmc
jp 0x9e9398
bt bx, ax
mov bl, byte [esp]
btc edx, esi
lea edx, [eax + edi]
rcl dl, 3
jmp 0x9e9356
sub edi, 0x62d15b58
call 0x9e952f
inc dl
bt ax, ax
js 0x9e95dd
mov ah, bl
sub ax, 0x2418
stc
jmp 0x9e95e1
sub ax, 0x2418
stc
jmp 0x9e95e1
mov ah, bl
jmp 0x9e95c7
dec dl
add al, dl
jnp 0x9e9633
mov eax, esp
add ah, bh
jmp 0x9e961d
lea eax, [ecx + ebx]
jmp 0x9e965e
add ah, bh
xor dl, 0x76
mov ax, word [esp]
mov ax, 0x33de
jmp 0x9e9605
mov eax, esp
jmp 0x9e961b
mov ah, ch
jmp 0x9e963f
bswap eax
bts eax, edx
call fcn.009e9672
dec ebx
invalid
not dl
rol eax, 0x13
jns 0x9e9637
mov ah, ch
bswap eax
bts eax, edx
jmp 0x9e9644
neg al
pushfd
mov eax, edx
mov ax, word [esp + 2]
pop ax
lea esp, [esp + 2]
jmp 0x9e9b1b
bt eax, eax
jae 0x9e9584
jb 0x9e9584
jg 0x9e967b
neg al
pushfd
jmp 0x9e96b1
mov eax, edx
mov ax, word [esp + 2]
pop ax
jmp 0x9e9687
push si
adc edx, edi
call fcn.009e9c3e
outsd dx, dword [esi]
adc edx, edi
mov dx, word [esp]
lea esp, [esp + 2]
jmp 0x9e9bc7
inc edi
btr edx, edx
jle 0x9e9ace
push si
call 0x9e9afd
jecxz 0x9e9b0d
xor dword [ebx + 0x44871bec], eax
and al, 0x11
sub esp, 0xc
mov word [esp + 0x1f], bx
pop ds
jmp 0x9e9b65
add cl, dl
mov dx, si
mov dh, 0x2a
lea edx, [ebp + 0xd4]
jmp 0x9e9aef
lea esp, [esp + 3]
xchg dword [esp + 0x24], esi
lea eax, [edi - 0xf7]
lea eax, [esp + 0xc29c]
mov edx, esp
mov al, bl
call fcn.009e9b40
xchg byte [esp], dl
push dword [esp + 0x1c]
ret 0x20
not dh
xchg dh, ah
lea esp, [esp + 2]
jmp 0x9e9c00
mov eax, dword [esp]
jmp 0x9e9cda
ror bl, 0
mov dx, si
bsr eax, ebx
js 0x9e9c20
jns 0x9e9c7a
cmp al, 0xaf
aas
pop edx
test eax, 0xccfd4272
not dh
xchg dh, ah
lea esp, [esp + 2]
jmp 0x9e9c00
lea edx, [ebx*4]
not dh
mov dh, byte [esp]
push cx
bswap eax
lea esp, [esp + 2]
jmp 0x9e9c4b
add bl, 0x2e
inc dh
jns 0x9e9c9e
lea edx, [ecx*4]
jmp 0x9e9ca7
push cx
bswap eax
jmp 0x9e9c30
lea edx, [ebx*4]
not dh
mov dh, byte [esp]
jmp 0x9e9c61
mov eax, dword [esp]
jmp 0x9e9cee
lea edx, [ecx*4]
jmp 0x9e9c88
mov eax, dword [esp]
jmp 0x9e9cee
lea esp, [esp + 0x20]
inc bl
mov edx, ecx
lea eax, [eax + edx]
mov ax, word [esp]
jmp 0x9e9d3c
rcr al, 3
push ax
add esp, 0
jno 0x9e9bb1
jo 0x9e9c16
rol bl, 0
bswap edx
lea edx, [edx*4]
pushal
mov edx, dword [esp + 0xe]
jmp 0x9e9cac
mov ah, ch
mov eax, dword [esp]
neg bl
xchg dx, ax
lea eax, [edx*4]
call 0x9e9d53
test dword [edx + 0x148d2434], ecx
sub byte [ebp + 0x62082484], cl
invalid
Function at 0x9eaae8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push sp
mov byte [esp], bh
lea esp, [esp + 2]
lea eax, [eax + 0x71]
push ax
jmp 0x9eab10
sub esp, 6
mov word [esp + 2], ax
add esp, 2
xchg dword [esp + 4], eax
clc
jmp 0x9eaad2
sub esp, 0xd
mov byte [esp + 6], bh
pop word [esp + 8]
lea esp, [esp + 1]
xchg dword [esp + 0x10], eax
call fcn.009eaafa
add eax, eax
push esi
push edi
jmp 0x9eab33
push ecx
mov esi, edx
mov edi, eax
jmp 0x9eab3e
mov ecx, ebx
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x9eab7b
lea esp, [esp + 4]
jmp 0x9eb8e1
pop ecx
pop edi
mov esi, dword [esp]
jmp 0x9eab65
popfd
jmp 0x9eb3f1

Function at 0x9eaf4c
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg bl
lea edx, [ecx + 5]
neg eax
jg 0x9eaf59
jle 0x9eaf59
mov dword [esp + 0x14], ebx
bswap eax
popal
mov al, 0x12
shl al, cl
jmp 0x9eb0a3
push di
pushfd
lea esp, [esp + 2]
lea esp, [esp + 0xc]
jmp 0x9eaf2b
pushal
jmp 0x9eaf36
bsf ax, di
shl edx, 2
lea eax, [ebp - 0xf9]
jmp 0x9eafc3
neg eax
jbe 0x9eafa1
not eax
mov ah, al
jmp 0x9ea8c1
jnp 0x9eaf5c
bsf ax, di
jmp 0x9eaf60
Function at 0x9ebdb7
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x1e4e6776
jmp 0x9eaf8b
add edx, 0x1cd6c487
jmp 0x9eb06b
jmp 0x9ebd80
jmp 0x9eafaa
call 0x9eaf9a
ja 0x9eaff7
jae 0x9eb008
arpl word [eax + 0x72], bp
add cl, ch
push ebp
push cs
add byte [eax], al
sub al, 0x3f
not eax
mov ah, al
jmp 0x9ea8c1
neg ax
jns 0x9eafea
bswap eax
not al
inc eax
call 0x9eb006
mov dword [esp + 0x24], eax
jmp 0x9ec2bc
inc eax
mov eax, edx
lea eax, [eax - 0x1dafd0a8]
mov edx, dword [eax]
not al
jmp 0x9ea8de
bswap eax
not al
jmp 0x9eafd0
lea esp, [esp + 4]
xchg dword [esp + 0x1c], edi
mov ah, 0x85
lea eax, [edi + edi]
jmp 0x9eb042
sbb al, 0xb4
test dword [ebp + 0x43eb3f04], ecx
mov eax, dword [0x28d9be28]
wait
lds esp, [esi + 0xf]
mov ebx, 0xc80f60d8
jmp 0x9eaff0
mov ax, 0x6286
neg ah
lea edi, [edi + 0x18]
mov ah, 1
bsr eax, ebx
call fcn.009eb025
seto ah
lea eax, [eax + ecx]
sub esp, 7
jb 0x9eb083
mov ax, 0x863d
jmp 0x9eb089
jmp 0x9eb055
lea esp, [esp + 3]
jmp 0x9eb0da
mov ax, 0x863d
jmp 0x9eb06d
lea esp, [esp + 3]
jmp 0x9eb0da
mov dx, word [esp]
mov edx, dword [esp]
mov eax, dword [esp]
mov ax, 0x6b06
lea eax, [esi + esi]
lea edx, [esp + ecx]
jmp 0x9eb1f9
mov esp, ebp
push bp
call fcn.009eb0b2
jl 0x9eb0c0
mov dx, word [esp]
mov edx, dword [esp]
jmp 0x9eb0f2
mov eax, dword [esp]
mov ax, 0x6b06
lea eax, [esi + esi]
jmp 0x9eb0d1
rdtsc
mov al, 0x3b
jmp 0x9eb133
neg edx
jmp 0x9eb119
sub bl, 0x1e
mov dh, byte [esp]
stc
js 0x9eb15a
jns 0x9eb1ca
mov ah, 0x39
test eax, 0x98893bc8
sti
not dh
setae al
dec edx
jno 0x9eb12f
neg edx
rdtsc
mov al, 0x3b
jmp 0x9eb133
mov dl, bl
sub esp, 0x18
lea esp, [esp + 0x18]
neg bl
jmp 0x9eb195
sub bl, 0x68
jmp 0x9eb14a
mov ah, 0x47
cmc
jmp 0x9eb1a1
clc
js 0x9eb17c
mov ah, 0x47
cmc
jmp 0x9eb1a1
ror bl, 0
clc
jmp 0x9eb1d1
sub esp, 0x14
lea edx, [ebx*4]
setnp ah
mov al, 2
mov byte [esp + 0x10], al
jmp 0x9eb23f
mov dl, bl
sub esp, 0x18
jmp 0x9eb15f
jae 0x9eb1ab
sub esp, 0x14
lea edx, [ebx*4]
jmp 0x9eb1e3
setnp ah
mov al, 2
mov byte [esp + 0x10], al
jmp 0x9eb23f
mov dx, word [esp]
setb al
bsr dx, cx
jae 0x9eb177
jb 0x9eb177
mov eax, dword [esp]
push eax
mov dl, byte [esp + 3]
jmp 0x9eb2c5
mov eax, dword [esp]
push eax
mov dl, byte [esp + 3]
jmp 0x9eb2c5
lea esp, [esp + 0x14]
not bl
xor al, 0xcb
ja 0x9eb226
jbe 0x9eb210
stc
mov edx, dword [esi]
mov ax, word [esp]
inc ah
jmp 0x9eb290
sub eax, ebx
mov dword [ebx + ebp], edx
bts eax, ebp
jmp 0x9eb2ac
xchg dh, dl
jmp 0x9eb24b
cmp bx, 0xc02
jmp 0x9eb296
jb 0x9eb25a
sub eax, ebx
jmp 0x9eb25c
add esi, 4
xchg bx, ax
mov bx, word [esp]
mov ebx, dword [esp]
neg eax
jmp 0x9eb2d3
jbe 0x9eb27a
cmp bx, 0xc02
jmp 0x9eb296
and ebx, 0x3c
cmc
je 0x9eb276
xchg dh, dl
stc
jmp 0x9eb24c
je 0x9eb2fc
jne 0x9e950d
jmp 0x9e950d
pop eax
sub eax, 0xe7000892
jmp 0x9ebda7
call 0x9ebdb7
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
arpl word [edi + 0x8f99e08], ax
mov eax, 0x5c35a52b
scasd eax, dword es:[edi]
sbb edx, dword [edi + eax*8 + 0x6e]
jns 0x9ebe22
mov ebx, 0xffb7d3f7
jmp 0x9eaf8d
popal
inc dword [esp + 8]
jmp 0x9ec396
Function at 0x9ec42b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x9ec242
call 0x9eb078
jmp 0x9ec279
mov dword [esp + 0x28], eax
jmp 0x9ec329
call 0x9eb124
jmp 0x9ec3f6
push eax
call fcn.009d7f31
jmp 0x9eb073
pop ecx
sub ecx, 0x10016db8
jmp 0x9ec2b0
mov dword [ecx + 0x10017f55], eax
jmp 0x9ec347
je 0x9ec3b4
jne 0x9eafb9
popal
pushfd
mov byte [esp], ah
lea esp, [esp + 4]
jmp 0x9ec415
movzx ebx, byte [eax]
add ebx, 0xbe2bdbfe
cmp ebx, 0xbe2bdcca
jmp 0x9ec302
cmp ebx, 0x60940094
je 0x9ec418
jne 0x9eb099
push 0
jmp 0x9ec3ee
jmp 0x9ec4c8
pushfd
cmp dword [esp + 4], 0
jmp 0x9ec431
pop eax
sub eax, 0xe9cdb0
jmp 0x9ec41b
popfd
lea esp, [esp + 4]
and al, 4
ret
call 0x9ec42b
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
rcl esi, 1
inc ecx
ret
jne 0x9ec3d8
pushal
jmp 0x9eb11f
inc dword [esp + 8]
popfd
ret 4

Function at 0xa1432c
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ebx
xchg bh, bl
not di
jmp 0xa142ad
xor edx, esi
bsr bp, bx
setbe bh
pushal
jmp 0xa142e8
pop ebx
movzx edx, byte [eax + 8]
movzx esi, byte [eax + 9]
jmp 0xa142f2
push ebx
mov ebx, ecx
add ebx, 4
mov dword [ebx], edx
jmp 0xa142b9
shl edx, 8
jmp 0xa1437d
lea esi, [esi + 8]
mov dword [esi], edx
pop esi
jmp 0xa14365
xor edx, esi
push esi
mov esi, ecx
jmp 0xa14314
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
jmp 0xa1432a
movzx esi, byte [eax + 0xd]
jmp 0xa1439e
movzx edx, byte [eax + 0xc]
jmp 0xa1434f
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
jmp 0xa14344
movzx eax, byte [eax + 0xf]
jmp 0xa143a9
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
jmp 0xa14388
shl edx, 8
xor edx, esi
shl edx, 8
jmp 0xa14449
mov bh, dl
mov dword [esp + 0x1c], edx
popal
jmp 0xa143f6
mov eax, dword [eax*4 + 0x9e02c8]
jmp 0xa14418
shr eax, 0x10
mov esi, 0xff
and eax, esi
jmp 0xa143e0
btr ebp, esi
not bp
stc
xchg ebp, ebx
jmp 0xa14428
lea esp, [esp + 0x44]
xor eax, 0x1000000
mov edi, dword [esp]
mov edi, edx
jmp 0xa14402
shr edi, 8
neg ebp
lea ebp, [edi*4]
jmp 0xa144d1
xor edx, eax
mov dword [ecx + 0xc], edx
pushal
jmp 0xa143b6
pop ebp
and edi, 0xff0000
call fcn.00a14454
lea esp, [esp + 8]
and eax, 0xff000000
jmp 0xa144a8
mov edi, edx
mov bp, ax
call fcn.00a145cf
push ecx
int 0x5d
and al, 0xd7
push ss
fsubr qword [edi]
and dword ss:[eax - 0x5d], esp
xor eax, edi
push dx
lea edi, [esi*4]
add esp, 1
lea esp, [esp + 1]
jmp 0xa14492
and edi, esi
mov edi, dword [edi*4 + 0x9e02c8]
btc ebp, ecx
sub esp, 4
jmp 0xa1446a