joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457570
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea edx, [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jle 0x457598
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
dec esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
jmp 0x4575a0
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test esi, esi
jle 0x4575b9
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
jmp 0x4575c1
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test esi, esi
jle 0x4575da
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
jmp 0x4575e2
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
test esi, esi
jle 0x4575fb
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x457603
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, edx
mov dword [ebp - 4], 0
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
mov eax, esi
mov dword [ebp - 0x3c], edx
cdq
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call fcn.00457644

Function at 0x4576d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4bb118]
sub esp, 0x5fc
mov edx, dword [0x4bb11c]
push ebx
push esi
push edi
test eax, eax
jne 0x457aa9
test edx, edx
jne 0x457aa9
mov al, 0x4d
mov word [ebp - 0x26], 0x4d
movsx dx, al
push 0xc
mov eax, edx
mov ecx, edx
xor eax, 0x23
xor ecx, 0x29
mov word [ebp - 0x24], ax
mov eax, edx
xor eax, 0x39
mov word [ebp - 0x20], cx
mov word [ebp - 0x22], ax
mov eax, edx
xor eax, 0x21
mov word [ebp - 0x18], cx
mov word [ebp - 0x1e], ax
xor edx, 0x63
mov word [ebp - 0x1c], ax
mov word [ebp - 0x16], ax
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x1a], dx
mov word [ebp - 0x12], ax
call fcn.0046f96e
mov ecx, dword [0x4baf24]
mov ebx, eax
add esp, 4
mov dword [ebp - 0x3c], ebx
mov edx, 0x14
mov dword [ebx], 0
mov byte [ebx + 8], 1
mov dword [ebx + 4], 0x14
call fcn.00428eb0
mov dword [ebx], eax
test eax, eax
je 0x45778a
push dword [ebx + 4]
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.004714a0
add esp, 0xc
mov eax, dword [ebx]
xorps xmm0, xmm0
mov dword [ebp - 0x34], eax
movlpd qword [ebp - 0x48], xmm0
push 0x33
call 0x45779e
add dword [esp], 5
retf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457ad0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494bac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c8
push ebx
push esi
push edi
call fcn.004576d0
mov ecx, eax
mov eax, edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
test ecx, ecx
jne 0x457b0c
test eax, eax
je 0x458046
lea edx, [ebp - 0xc8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
push 0x33
call fcn.00457b22
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
xor edx, edx
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x470724
Capabilities:
Parse pe header

Disassembly:
push 0
push edx
call fcn.00a29fd3
test eax, eax
je 0x470764
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x470764
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x470764
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x470764
cmp dword [ecx + 0x74], 0xe
jbe 0x470764
cmp dword [ecx + 0xe8], 0
je 0x470764
mov al, 1
ret
xor al, al
ret
Function at 0x4c2c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4c2d8c
test eax, eax
je 0x4c2d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x4ddff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x4c2d73
lea edi, [eax + 4]
jmp 0x4c2cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x4c2cec
mov dword [ebp - 4], 2
jmp 0x4c2d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x4c2d03
mov dword [ebp - 4], 1
jmp 0x4c2d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x4c2d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x4c2d46
mov byte [ecx], 0x3d
jmp 0x4c2d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x4c2d5d
mov byte [ecx], 0x3d
jmp 0x4c2d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x4c2cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c2d06
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4c2d8c
test eax, eax
je 0x4c2d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x4ddff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x4c2d73
lea edi, [eax + 4]
jmp 0x4c2cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x4c2cec
mov dword [ebp - 4], 2
jmp 0x4c2d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x4c2d03
mov dword [ebp - 4], 1
jmp 0x4c2d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x4c2d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x4c2d46
mov byte [ecx], 0x3d
jmp 0x4c2d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x4c2d5d
mov byte [ecx], 0x3d
jmp 0x4c2d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x4c2cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5879f9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x94423a87
call fcn.0051eb88
Function at 0x5fe0f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
shl ah, cl
clc
push 0xffffffffffffffff
push 0x492251
bsf eax, ebx
shld eax, ebx, 0x11
mov eax, dword fs:[0]
sub dl, 0x90
push eax
and eax, ebp
cmp bx, di
or dl, dl
sub esp, 0x18
sub eax, 0x3e1103a3
test di, bp
mov eax, dword [0x4b802c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor dl, 0
push esi
sal dl, cl
sal dl, 0xd
push edi
inc edi
sal dl, cl
push eax
btc ax, sp
xchg dl, al
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
ror dl, 0x9f
mov dl, 0x3e
mov dword [ebp - 0x20], 0x5f51723e
mov dword [ebp - 0x1c], 0x5c57725a
stc
xor eax, eax
test edi, edx
mov dword [ebp - 0x18], 0x474c5f4c
mov word [ebp - 0x14], 0x7f
test edx, ecx
cmp bx, si
nop dword [eax + eax]
clc
cmc
test esi, 0x4df4787d
xor byte [ebp + eax - 0x1f], dl
jmp 0x9e82ab
mov byte [ebp - 0x13], 0
jmp 0x9cb5fd
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 0
setne cl
mov edx, 0xd
xchg ecx, ecx
cmovae ecx, esi
mov ecx, dword [0x4baf24]
mov dword [esi], 0
jmp 0x70b2df
mov byte [esi + 8], 1
jmp 0x9ee912
xor byte [ebp + eax - 0x1f], cl
jmp 0xae670e
mov byte [ebp - 0x13], 0
jmp 0xb05444
jae 0x8db780
mov cl, byte [ebp - 0x20]
jmp 0x71dd55
push 0xc
jmp 0x757cac
cmp eax, 0xc
jae 0x8678f8
mov dl, byte [ebp - 0x20]
jmp 0x5fe187
push 0xc
jmp 0x64e8bd
push ecx
jmp 0x9beef0
je 0x97fee1
push dword [esi + 4]
lea ecx, [ebp - 0x1f]
jmp 0x8fbe4c
call fcn.004714a0
lea esp, [esp + 0xc]
rcl cl, 0x35
xchg cl, cl
mov dword [ebp - 4], 0xffffffff
sub cl, 0xae
mov cl, 0x5b
mov dword [edi + 0x30], esi
sub eax, eax
test dx, 0x7ecc
cmp edx, edx
cmp bh, 0x4b
mov dword [ebp - 0x20], 0x3a34175b
test dx, 0xb4d
cmp ax, di
mov dword [ebp - 0x1c], 0x3932173f
mov dword [ebp - 0x18], 0x22293a29
cmp ebx, 0x6d2a75bd
mov word [ebp - 0x14], 0xc
test al, dl
nop dword [eax]
cmc
jmp 0x71dd55
push eax
jmp 0x97fed3
call fcn.0046f96e
mov esi, eax
shrd cx, ax, 0x9c
and cx, 0x52f5
sub edx, 0x11ef27f7
add esp, 4
add al, 0x99
xchg dh, cl
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
movzx edx, ax
mov edx, 0xd
mov ecx, dword [0x4baf24]
mov dword [esi], 0
jmp 0xa925a1
inc eax
cmc
jmp 0x87dbd8
mov dword [esi + 4], 0xd
call 0xae6e3f
mov dword [esi], eax
test di, 0x2540
test eax, eax
jmp 0x96f51f
mov byte [esi + 8], 1
mov dword [esi + 4], 0xd
jmp 0x426e2d
inc eax
cmp eax, 0xc
jmp 0x842d3e
call fcn.0046f96e
mov esi, eax
xor cl, dl
add esp, 4
jmp 0x6f58c5
Function at 0x7b4c4e
Capabilities:
Parse pe header

Disassembly:
jmp 0x8a4857
lea esp, [esp - 0x330]
cmc
clc
xor eax, eax
jmp 0xb34d13
mov dword [esi], 0xc00000ef
jmp 0xa0badb
push ebx
mov ebx, esp
cbw
sbb ah, 0x36
sub esp, 8
xadd eax, eax
add eax, 0x5ab6c34
and esp, 0xfffffff8
sub eax, 0x7f2a56ef
lea esp, [esp + 4]
shr ax, cl
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
lahf
push 0xffffffffffffffff
ror eax, 0x39
shl ax, cl
push 0x492d31
shld ax, bp, 0x70
shl al, cl
rol ah, cl
mov eax, dword fs:[0]
push eax
test bh, 0xea
stc
mov dword fs:[0], esp
push ebx
cmp ebp, 0xa6d0b88
stc
jmp 0x5a0777
xorps xmm0, xmm0
mov dword [ebp - 0xa0], eax
sub si, 0x437d
movsx esi, cx
push edi
mov dword [ebp - 0x20], ecx
sbb si, 0x399c
xchg si, si
movlpd qword [ebp - 0xc0], xmm0
mov dword [ebp - 0xa8], 0
btr esi, 0x27
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
rol si, 0xfb
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], 0xf
neg esi
clc
not esi
mov byte [ebp - 0xa0], al
mov si, sp
mov dword [ebp - 0x88], eax
xadd esi, esi
xchg si, si
mov esi, ecx
mov dword [ebp - 4], eax
sbb ax, bx
not esi
mov eax, dword [ebx + 0xc]
mov esi, dword [eax + 4]
test ax, di
mov eax, dword [eax]
or eax, esi
jne 0x968d32
mov esi, dword [ebx + 8]
jmp 0x5e26c6
sub edi, edi
jmp loc.0041b524
push esi
jmp 0x87c61b
mov byte [esi + 0x48], al
jmp 0x55f3c4
mov dword [ebp - 0xb8], 0
jmp 0x9d815c

Function at 0x7b7ad7
Capabilities:
Parse pe header

Disassembly:
push 0
jmp 0x8aa3ae
call fcn.00471a20
mov eax, dword [ebx + 8]
jmp 0x87f539
call fcn.00470990
push esi
push edi
lahf
push 0x30
xchg di, di
movzx ax, ch
lea eax, [ebp - 0xc0]
mov dword [ebp - 0x14], 0
jmp 0xb9b11f
push ebx
shl al, cl
mov ebx, esp
sbb ah, 0x55
rol al, cl
lea esp, [esp - 8]
neg eax
lahf
and esp, 0xfffffff0
sbb ah, 0x19
add esp, 4
movsx eax, di
setbe ah
not al
push ebp
not ebp
movzx ebp, ax
mov ebp, dword [ebx + 4]
setp ah
mov dword [esp + 4], ebp
mov al, ah
movsx ebp, sp
mov ebp, esp
cbw
xchg al, al
push 0xffffffffffffffff
push 0x494357
mov eax, dword fs:[0]
jmp 0x9d6112
xorps xmm0, xmm0
lea esp, [esp + 0xc]
add esi, ebx
shl cl, cl
movlpd qword [ebp - 0x20], xmm0
rol ecx, 0xee
mov dword [eax], 0
sub ecx, edi
or cx, 0xf96
mov dword [eax + 4], 0
xor ecx, ebp
xchg esi, esi
mov dword [eax + 8], 0
mov si, 0x73a9
sbb ecx, esi
shl ah, 0x85
mov eax, dword [ebp - 0x1c]
bts ecx, edx
mov ecx, 0x10000
rcr si, 0x24
bt si, 0x27
xor esi, 0x31064d61
mov esi, dword [ebp - 0x20]
xor edx, edx
jmp loc.004462a5
push eax
jmp 0xb5d198
push eax
nop
mov dword fs:[0], esp
movzx eax, sp
mov eax, 0x10f8
jmp 0xaf7928
push ebx
jmp 0x738beb
mov dword [ebp - 0x24], edi
jmp 0x6e3571
mov edi, ecx
jmp 0x6b08c9
Function at 0x840030
Capabilities:
Parse pe header

Disassembly:
pop esi
jmp 0x5f65c1
mov esp, ebp
not ebp
jmp 0x79e099
jne 0x913ae5
cmp dword [esp + 0x58], 0x4550
jmp 0xab22ac
push 0
jmp 0x96483c
call fcn.00471a20
push 0xf8
movzx ax, bl
lea eax, [esp + 0x68]
jmp 0x655d0d
je 0x913ae5
mov eax, dword [ecx + 0x4c]
lea edi, [esp + 8]
jmp 0x895a11
mov edx, dword [ebp + 0xc]
jmp 0x8f287c
pop ebp
jmp 0x7c0add
ret 8
mov eax, dword [eax + 0xc]
call eax
test eax, eax
jmp 0x6129a1
xorps xmm0, xmm0
mov dword [esp + 8], eax
sub ax, 0x4c6
add eax, 0x73dc2e23
shld eax, edx, 0x43
mov eax, dword [esp + 0x54]
xchg edx, edx
cdq
mov esi, eax
mov cl, bl
movlpd qword [esp + 0x10], xmm0
cmovge ecx, edx
bt ecx, 0xa8
add esi, edi
movzx ecx, cx
xchg cx, cx
mov ecx, esi
jmp 0x89c3e1
lea edi, [esp + 0x20]
mov ch, 0x25
movsx ecx, si
cmovb ecx, ecx
mov ecx, dword [eax + 8]
lahf
push edi
mov edi, dword [ebp + 8]
push edx
jmp 0x95c8ac
push ebp
inc ebp
mov ebp, esp
and esp, 0xfffffff8
test ebx, 0xe122813
sub esp, 0x148
bswap ax
push esi
lahf
movzx esi, sp
cmovne eax, esp
push edi
movsx esi, bp
setl al
push 0x40
lea eax, [esp + 0x1c]
bswap si
mov esi, esp
mov esi, ecx
push 0
jmp 0x8b829e
push edi
push 0x40
jmp 0x825a28
adc edx, dword [ebp + 0xc]
or ecx, edx
jmp 0x98e11e
push eax
jmp 0x6ab84a
xorps xmm0, xmm0
or eax, edx
movzx cx, ch
bswap cx
mov ecx, dword [esi + 4]
jmp 0xa0c70d
pop edi
test cx, sp
sub al, al
pop esi
jmp 0x9c63e4
call fcn.00471a20
mov eax, dword [ebp + 8]
inc dl
rcr dx, 0x86
add esp, 0x18
jmp 0x6dd127
mov eax, dword [ecx]
jmp 0xa1b1c7
push eax
jmp 0x92b7b1
je 0x913ae5
mov eax, dword [esp + 8]
cmova edi, ebx
movzx edi, dx
xchg edi, edi
lea edi, [esp + 0x10]
jmp 0x99fbe1
push edi
movzx ecx, si
push 0xf8
lea edi, [esp + 0x60]
mov eax, dword [eax + 0x4c]
movsx ecx, bx
setl cl
push edi
push edx
mov cl, 0xea
sets ch
push esi
mov ecx, dword [eax + 8]
mov eax, dword [ecx]
jmp 0x7d4b87
mov esp, ebp
jmp 0x9f01e1
pop ebp
ret 8
movlpd qword [esp + 8], xmm0
jmp 0x6ba9c3
push edi
jmp 0xaf2a69
jne 0x913ae5
mov eax, 0x5a4d
test cx, di
cmp word [esp + 0x18], ax
jne 0x913ae5
mov eax, dword [esi + 4]
jmp 0x806f58
jne 0x913ae5
mov al, 1
pop edi
jmp 0x52d307
call eax
test eax, eax
jmp 0xa5a722
mov eax, dword [eax + 0xc]
jmp 0xacd484
Function at 0x9d5334
Capabilities:
Parse pe header

Disassembly:
push eax
not ah
cbw
mov dword fs:[0], esp
not ax
mov eax, 0x1158
jmp 0x6730c8
call fcn.00471a20
mov eax, dword [ebx + 8]
jmp 0x7f716c
mov dword [ebp - 0x18], 0
jmp 0x58a84b
mov dword [ebp - 0x20], ecx
push 0
jmp 0xadb74c
push ebx
jmp 0x8a8004
mov eax, dword [eax + 0x18]
jmp 0x9acb21
xorps xmm0, xmm0
lea esp, [esp + 0xc]
cmova di, si
stc
movlpd qword [ebp - 0xb0], xmm0
mov dword [eax], 0
mov dword [eax + 4], 0
inc edi
ror ecx, 0x6a
mov dword [eax + 8], 0
mov dword [ebp - 4], 0
clc
xor ecx, 0x1e4449e
bt si, si
mov ecx, 0x10000
and al, 0x15
mov esi, dword [ebp - 0xac]
bts eax, ebx
sub edx, edx
cbw
mov edi, dword [ebp - 0xb0]
cmovbe ax, sp
mov dword [ebp - 0x18], 1
lahf
movzx eax, dx
cwde
mov eax, dword [ebp - 0x20]
jmp 0x89f897
mov eax, dword [eax]
jmp 0x785ef7
call fcn.00470990
push esi
mov ax, si
push edi
lahf
jmp 0x99529e
push 0x4943b9
jmp 0x5228b0
push 0x30
cbw
mov al, 0xdb
lea eax, [ebp - 0xe0]
jmp 0x666a45
mov dword [ebp - 0x1c], eax
movsx eax, si
lea eax, [ebp - 0xe0]
jmp 0xa0ff99
push ebx
shr bx, cl
mov ebx, esp
mov ax, 0x4d91
sub esp, 8
shld ax, bx, 0x35
and esp, 0xfffffff0
add esp, 4
nop
push ebp
mov ebp, dword [ebx + 4]
setb al
cwde
cbw
mov dword [esp + 4], ebp
mov al, 0x92
cwde
mov ebp, esp
movsx eax, sp
mov al, al
cbw
push 0xffffffffffffffff
mov eax, dword fs:[0]
jmp 0x95e018
push eax
mov eax, dword [ebp - 0x1c]
jmp 0xb505c0
push eax
jmp 0x6100c3
push edx
jmp loc.004206e6
Function at 0xa28257
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esp, ebp
pop ebp
jmp 0x994867
sub eax, eax
jmp 0x639880
mov dword [esi + 4], 0
jmp 0x9ee05e
mov eax, dword [eax + 0x4c]
xchg cl, cl
push dword [esi]
not ecx
mov ch, 0x3f
mov ecx, esp
mov ecx, dword [eax + 8]
movzx eax, si
mov eax, dword [ecx]
mov eax, dword [eax + 4]
jmp 0x9bcb3d
mov dword [esi], 0
jmp 0x5ad4fa
ret 4
mov dword [esp + 0x3c], eax
jmp loc.00409d34
cmp byte [esi + 0x11], 0
je 0xa81806
call fcn.0086e962
mov ecx, dword [esi + 0x14]
sbb dx, sp
rcr dx, cl
adc dx, 0x55fe
mov edx, eax
stc
xor eax, eax
jmp 0x9cb243
ret 4
call eax
test eax, eax
jmp 0xb40b19
mov dword [esp + 0xc], 0
jmp 0x92d1f6
mov dword [esi + 8], 0
jmp 0xb5626b
jne 0x9583a5
mov eax, 0xc00000a0
mov si, cx
movsx esi, cx
not esi
pop esi
jmp 0xa9f681
push ebp
mov ebp, esp
shld dx, ax, 0xe0
sbb eax, 0x600d1494
and esp, 0xfffffff0
bt dx, dx
rdtsc
test si, 0x3b0e
sub esp, 0x3c
cbw
rdtsc
push esi
movzx esi, si
btr eax, 0xcd
adc dl, ah
mov esi, ecx
shl al, 0x4b
mov eax, dword [esi]
and edx, 0x52030cf3
btc dx, bx
mov edx, dword [esi + 4]
cmc
stc
cmp edi, edi
or eax, edx
jmp 0xa06869
mov eax, dword [esi + 0x14]
movzx cx, dl
movzx ecx, di
push 0x8000
mov cl, 0x33
push 0
cmovs cx, ax
push edx
jmp 0x6f4dd3
mov esp, ebp
pop ebp
jmp 0x906b3d
jns 0x85f143
mov eax, dword fs:[0x18]
cmovnp si, sp
mov eax, dword [eax + 0xbf4]
pop esi
jmp 0x4c4a2e
mov dword [esi + 0xc], 0
pop esi
jmp loc.00426d39
Function at 0xb50621
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ecx + 0x10], 0
jmp 0x856d1f
mov dword [ebp - 0x10], ecx
jmp 0x85aeaf
mov dword [esi + 0xf4], 0
lea ecx, [eax + 8]
mov dword [ecx], 0
movzx edi, dx
jmp 0x9ba045
mov dword [ebp - 0x34], esi
jmp 0xab50c3
mov dword fs:[0], esp
cmp bx, 0x5eb9
cmc
sub esp, 0xcc
jmp 0x8f1903
call fcn.00471a20
add esp, 0x10
movzx cx, dl
mov ecx, esi
jmp 0xacda59
mov dword [ecx + 0x14], 7
jmp 0x89a4ff
call fcn.0046f96e
mov esi, eax
jmp 0x5a72ac
mov dword [edi], 0
jmp loc.00405420
mov dword [ebp - 4], 0
jmp 0x78a94d
push ebx
push esi
jmp 0xa15f14
lea edi, [eax + 0x20]
jmp 0x4c436d
push 0
push esi
jmp 0x8ea3a0
push edi
push 0x180
jmp 0x510b7b
push 0x180
jmp 0x9c93f8
call fcn.00439590
mov dword [esi + 0xf0], 0
cbw
lea eax, [esi + 0xf8]
jmp 0x547e62
push ebp
sar bp, 0x3d
mov ebp, esp
push 0xffffffffffffffff
bts ax, si
btc ax, cx
sub ax, sp
push 0x492530
sub al, al
mov eax, dword fs:[0]
cmp sp, ax
push eax
jmp 0x72db30
Function at 0x10001f75
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
inc ebp
mov dword [0xa445c624], eax
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.10001bcb
push eax
push esi
push dword [ebp + 8]
call fcn.10001b80
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10001bcb
push eax
push esi
push dword [ebp + 8]
call fcn.10001b80
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10001bbb
sub bh, byte [edx - 0x62775397]
jl 0x10002040
invalid
invalid

Function at 0x10001f89
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
inc ebp
mov dword [0xa445c624], eax
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.10001bcb
push eax
push esi
push dword [ebp + 8]
call fcn.10001b80
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10001bcb
push eax
push esi
push dword [ebp + 8]
call fcn.10001b80
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10001bbb
sub bh, byte [edx - 0x62775397]
jl 0x10002040
invalid
invalid