joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x7ed8552f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x649f1256
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x101253d8
Capabilities:
Packed with generic packer

Disassembly:
pop ecx
push 0xffffffffffffffff
not ecx
pushfd
mov ecx, dword [eax + 0x20]
lea esp, [esp + 4]
jo 0x101335ad
pushal
mov byte [esp + 0xc], 0xed
mov dword [esp + 0x1c], ecx
and al, 0x1c
mov byte [esp], cl
lea esp, [esp + 0x1c]
call fcn.1005c280
cmp ecx, esp
bsr dx, cx
pushal
rcr al, cl
mov edx, dword [ebp - 0x14]
mov al, byte [esp + 4]
mov eax, dword [ebp - 0x18]
rol cx, 0xc
call fcn.10140ffd
pop edx
mov edi, 0x4650919e
or edx, ebx
cmpsd dword [esi], dword es:[edi]
dec esp
jnp 0x101253f3
mov eax, dword [0xd7788893]
inc esp
pushal
xor cl, cl
ror byte [edx - 0x76e476f8], 0xba
std
enter 0xfffffffffffff3fd, 0x5b
popal
aaa
scasd eax, dword es:[edi]
inc esp
js 0x1012544b
inc edi
fldenv [esi - 0x7c6d6880]
outsb dx, byte [esi]
cmp al, 0x2e
xchg edx, eax
sub dword [esi + 0x3c], 0x2e
hlt
jmp 0x10139149
push ecx
pushal
push 0xbe927838
lea esp, [esp + 0x24]
call fcn.1005c280
clc
mov edx, dword [ebp - 0x14]
not ax
lahf
mov eax, dword [ebp - 0x18]
test ah, 0x4c
movsx cx, cl
mov ch, 0xf1
shld cx, sp, cl
mov dword [ebp - 4], 0xffffffff
not ch
add esp, 8
shr ch, cl
cmp bx, dx
add ecx, esp
and cx, 0x1a41
mov dword [edx + 4], eax
bt si, 8
jmp 0x10177e55
dec ecx
shrd cx, dx, cl
sub eax, eax
pushal
jmp 0x10182e91
call fcn.1016a341
mov byte [esp + 4], 0x7a
pushfd
push dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop dword [esp + 0xc]
pushfd
pushal
push dword [esp + 4]
mov byte [esp + 0xc], dl
push dword [esp + 0x34]
ret 0x38

Function at 0x10126e31
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x2c]
jmp 0x1014d91b
jmp 0x101728d6
pushal
pushfd
pushfd
mov esi, esi
call fcn.1001e1d9

Function at 0x101273ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
xchg dword [esp + 0x24], ecx
seto cl
mov byte [esp + 4], 0x53
mov ecx, dword [ebp + 0xc]
pushfd
mov word [esp], 0x67ed
xchg dword [esp + 0x24], edx
bswap dx
not dl
lea edx, [ebp - 0x4f6dc130]
movsx edx, bl
mov edx, dword [ebp + 8]
call fcn.101865d1
inc eax
stosd dword es:[edi], eax
jnp 0x1012743f
jle 0x10127447
je 0x10127471
sub dl, dh
xchg esi, eax
adc cl, cl
lea edx, [ebp - 0x6720599]
pop edx
cld
pop ds
sub edx, dword [edx + 0x43598b94]
daa
loop 0x1012749e
fldcw word [ebp + edx*8 - 0x26]
aad 0xda
cmp eax, 0x6cfc6acb
lahf
inc esp
mov ecx, 0x466ca0d7
xor esp, dword [edi]
sub byte [0x66ec0015], bl
not cx
pushfd
mov ecx, dword [ebp - 0xc]
mov byte [esp], dh
mov dword fs:[0], ecx
call fcn.1013715c
out 0x66, al
sar esi, cl
bsf si, bp
rcl si, cl
mov esi, eax
jmp 0x10179dd8
fcom dword [eax - 0x52]
push dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop dword [esp + 8]
mov word [esp + 4], 0x5997
push dword [esp + 8]
ret 0xc
test esi, ebx
test cx, di
mov ch, ch
bt dx, 1
pushal
test ecx, ecx
test ch, bl
pushfd
cmp ch, 0xd2
cmp esi, 0xffffffff
pushal
jmp 0x10155b2c

Function at 0x10129bb4
Capabilities:
Packed with generic packer

Disassembly:
call fcn.10176ea8
test eax, eax
pushal
push ebx
lea esp, [esp + 0x24]
je 0x101370cd
stc
mov byte [0x101160fd], 0x68
pushfd
mov word [esp], 0x864b
bt esi, edx
test ecx, ecx
call fcn.1013709c
Function at 0x10129d79
Capabilities:
Access peb ldr_data

Disassembly:
mov byte [esp + 0xc], bl
pushfd
mov byte [esp], al
mov dword [esp + 0x24], 0x101160f8
pushal
mov dword [esp + 0x40], edx
pushfd
mov dword [esp + 0x40], esi
pushfd
call fcn.1007b4d2

Function at 0x1012b732
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x30]
call fcn.100a3670
movsx si, cl
mov ebx, ebx
bts di, 0xc
pop edi
bswap bx
or si, dx
shr bx, cl
bsr si, bp
pop esi
rol bh, 3
test eax, eax
movzx ebx, cl
push 0x9ba007a
call fcn.101686f0

Function at 0x1012f7ec
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x3c], edx
push eax
mov dword [esp + 0x3c], esi
push dword [esp + 0x10]
lea esp, [esp + 0x40]
call fcn.100a2790
push eax
clc
test si, 0x4916
add esp, 0x14
jmp 0x10129bb9

Function at 0x1012fa7c
Capabilities:
Encode data using xor

Disassembly:
mov esi, eax
push 0xe390ace1
push 0xbce2de04
mov word [esp], 0x5823
mov esp, ebp
movzx bp, dl
mov bp, 0x8b13
call fcn.10075c80
test dword [edi + 8], esp
xor dword [ebx - 0x4005baa9], ecx
xchg ebp, eax
outsd dx, dword [esi]
push ebx
bound ebx, qword [ebp + 8]
mov ch, 9
test al, 0x1b
scasd eax, dword es:[edi]
loop 0x1012fae6
pop esi
push ebx
out dx, eax
pop eax
push esi
imul edx, dword [edi - 0x19a7b4ef], 0xffffffc0
xchg edi, eax
adc dword [ebx + 0x58], ecx
out 0xc0, al
outsd dx, dword [esi]
pop ebp
xor al, 0xc8
xor eax, 0xd25dec33
rcl cl, 1
push es
jb 0x1012fab7
fisub dword [ecx - 0x7a5e7897]
xchg edx, eax
int1
jg 0x1012fa67
push es
mov byte [ebx], bl
insb byte es:[edi], dx
mov byte [0x9a7038d2], al
push es
cdq
and al, byte [esi - 0x7a]
wait
loope 0x1012faac
dec ecx
inc ebx
or eax, dword [eax + 0x26253736]
invalid

Function at 0x101313c5
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov dword [esp + 4], esi
pushfd
pushfd
lea esp, [esp + 0xc]
jno 0x1014686c
push ebx
lea ebx, [eax*2 + 0x5bee9b68]
setae bh
pop ebx
push 0x20918801
pushal
pushal
lea esp, [esp + 0x44]
jmp loc.10070403
push ebx
jmp 0x10178244
jmp 0x10131c4d
call fcn.101821dc

Function at 0x101324ca
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], 0x1c86b031
push dword [esp + 4]
mov dword [esp + 0x38], edi
jmp 0x1017cc52
call fcn.10132e83
mov dword [esp + 0x1c], 0x10172f88
call fcn.101632b5
inc eax
pop ss
adc al, ch
test eax, 0x400001be
inc ebx
cwde
jne 0x10147464
sbb esi, dword [esi - 0x594e19cf]
popal
and ebp, ebp
mov edx, 0x64fac094
mov word [ebx + 0x71fea28c], cs
ja 0x10147405
lahf
iretd
fild qword [edx + 0x7c7c9785]
insd dword es:[edi], dx
invalid
pushfd
pushal
pushfd
pushfd
mov dword [esp + 0x28], ebx
jmp 0x10177039
test eax, eax
pushal
lea esp, [esp + 0x20]
jne 0x101241a1
bswap eax
lea eax, [edi*8 + 0x331f5f00]
pushfd
mov eax, dword [ebp - 0xc]
mov byte [esp], 0x79
push 0xf1cf908b
jmp 0x1013bf14
mov byte [esp + 0x18], al
lea esp, [esp + 0x28]
call fcn.100a2e40
test cx, 0x426d
stc
jmp 0x1016017a
lea esp, [esp + 0x38]
jae 0x1014d37e
pushal
mov dword [esp + 0x1c], ebx
pushal
lea esp, [esp + 0x3c]
call fcn.100a2e40
call fcn.1014d564
mov dword [esp + 0x20], eax
jmp 0x101473ff
Function at 0x101366d4
Capabilities:
Packed with generic packer

Disassembly:
btr esi, 0xe
mov esi, edi
call fcn.101309af
lea esp, [esp + 0xc]
call fcn.10013090
cmp bp, 0x2d4e
pushal
test eax, eax
call fcn.1016dccc
xor edx, ebp
dec edx
and ch, ch
mov ebp, 0x750f6d93
inc edx
add al, 0xd6
ja 0x101366c9
cdq
popal
xchg dh, ah
xchg edi, eax
aam 0xf4
and al, 0xbd
invalid

Function at 0x101432e6
Capabilities:
Packed with generic packer

Disassembly:
push ecx
call fcn.101817e2
test eax, 0x3b91
pop edx
mov ch, ch
lea esp, [esp + 0x20]
jp 0x101620cf
lea edx, [ebp - 0x110]
pushal
call fcn.10147581
not dx
movzx dx, cl
lea edx, [ebp - 0x110]
jmp 0x101429d5

Function at 0x101436c3
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp]
cwde
lahf
lea eax, [ebp - 0x24]
setg ch
setg ch
pop ecx
lea ecx, [ebp - 0xc]
pushfd
mov dword [esp + 0x2c], eax
call fcn.10130c1d
movsd dword es:[edi], dword [esi]
xchg ebp, eax
xor al, 0
aam 0
add byte [ebp + 0x346795], ah
test byte [ebx + 0xb729eda], 0x5d
sub dword [ebx], eax
or bl, ch
push ds
xor dword [eax + esi*8 + 7], eax
in eax, dx
and byte [esp], bl
std
fadd st(7), st(0)
xor al, byte [ebx]
push eax
out dx, eax
push esp
xchg ecx, eax
in eax, dx
push esp
loop 0x101237ba
fmul st(0), st(0)
leave
daa
invalid
bsf cx, sp
setle cl
mov byte [ebp - 0x12], 0x6d
sal cx, 5
pushal
lea ecx, [ecx + 0x313a53e2]
mov byte [ebp - 0x11], 0x6f
movzx ecx, bl
add cl, ah
pushfd
rol ch, cl
mov byte [ebp - 0x10], dl
adc cl, dh
ror ch, cl
btc cx, dx
mov byte [ebp - 0xf], 0x79
adc cl, 0xf0
shr cl, cl
rcr ecx, cl
shl cx, 0xb
mov byte [ebp - 0xe], 0
not cl
add cx, bp
test dl, 0x32
shr ecx, 1
test eax, 0x483c
jmp 0x101237a1

Function at 0x10143f84
Capabilities:
Access peb ldr_data

Disassembly:
push eax
lea esp, [esp + 0x30]
call fcn.1005c280
daa
clc
rdtsc
mov edx, dword [ebp - 0x10]
daa
inc eax
mov eax, dword [ebp - 0x14]
or cl, bh
mov dword [ebp - 4], 0xffffffff
bts ecx, ecx
rcl cl, cl
add esp, 8
rol cl, 6
shr cl, cl
stc
mov ch, dl
mov dword [edx + 4], eax
inc ch
rcr cl, cl
dec cl
sub eax, eax
movsx cx, bl
mov ch, ch
setb ch
mov ecx, dword [ebp - 0xc]
pushfd
pushal
mov dword fs:[0], ecx
mov byte [esp], 0xc0
push 0xe900c80a
push dword [esp + 0xc]
mov esp, ebp
lea ebp, [eax + 0x532379ed]
movzx ebp, al
mov ebp, 0xaffcfbd6
call fcn.101785af

Function at 0x10144d30
Capabilities:
Execute anti-debugging instructions

Disassembly:
setb al
push 0x20
not ax
mov ax, ax
pushal
pop eax
lea eax, [ebp - 0x44]
pushal
jmp 0x1017e489
lea esp, [esp + 0x34]
je 0x10169181
shrd ax, sp, cl
pushal
inc ax
test dl, dl
xchg dx, ax
push dword [esp + 4]
rdtsc
mov ecx, dword [0x10106e54]
movsx dx, bl
push dword [esp + 4]
movzx ax, bl
rdtsc
lea edx, [ebp - 0x64]
lea esp, [esp + 0x28]
js 0x10130ae0
push 0x20
cwde
lea eax, [ebp - 0x44]
pushal
push dword [esp + 8]
jmp loc.1007650b
pushfd
pushfd
push dword [sym.imp.GDI32.dll_DeleteObject]
pop dword [esp + 0xc]
mov byte [esp], bh
mov byte [esp + 8], cl
push dword [esp + 8]
mov dword [esp], edi
push dword [esp + 0x10]
ret 0x14
pushfd
mov dword [esp + 0x3c], edx
push 0x8f854b8e
call fcn.1014d83c
mov dword [esp + 4], eax
pushfd
push 0xb158eddd
mov dword [esp + 8], 0x1015ede7
jmp 0x1016d576
Function at 0x10146c35
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [esp], 1
jmp 0x101415f2
pushal
pushfd
mov byte [esp + 0x10], 0x93
mov dword [esp + 0x20], esi
push edx
pushal
jmp fcn.1016db92
push ebp
mov dword [esp + 0x1c], 0x101322bd
call fcn.1016633c
movzx edi, cl
mov bl, 0x6c
seto ch
mov byte [ebp - 0xc], 0x68
rcr ch, cl
mov byte [ebp - 0xb], 0x73
stc
lea edi, [ecx + 0x6ad61af4]
mov byte [ebp - 0xa], 0x74
sub ch, dl
pushfd
bswap cx
rcl edi, 2
mov byte [ebp - 9], 0x79
xor ch, 0x2c
mov byte [ebp - 8], bl
xchg cx, di
sar ch, 6
clc
mov byte [ebp - 7], 0x65
cmc
xchg cx, di
bts cx, bp
shl cl, cl
mov byte [ebp - 6], 0x5f
or di, 0x4ae0
mov byte [ebp - 5], 0x66
test bp, 0x5f1d
mov byte [ebp - 4], bl
ror di, 7
mov byte [ebp - 3], 0x61
pushal
mov word [esp], 0x413f
mov byte [ebp - 2], 0x67
mov cl, 0x24
mov byte [ebp - 1], 0
add cx, 0x61ba
shrd di, cx, cl
test eax, 0x139a
setns ch
setge cl
setae cl
mov edi, dword [sym.imp.USER32.dll_GetPropA]
bswap cx
push eax
pushfd
lea ecx, [ebp - 0xc]
pushfd
mov dword [esp + 0x30], ecx
lea esp, [esp + 0x30]
jb 0x101805a4
pushal
mov word [esp + 8], 0x3516
mov byte [esp + 0xc], dl
mov dword [esp + 0x1c], esi
jmp 0x10125d1f
jmp 0x10133a5e

Function at 0x10147cac
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dh, cl
mov byte [ebp - 0x14], 1
push 0x27c64c8c
movzx cx, dl
pop ecx
not dx
mov dword [ebp - 0x13], ebx
setb ch
push dword [esp + 4]
mov dword [esp + 0x24], eax
movsx ax, bl
rdtsc
mov eax, dword [esp + 0x24]
xchg dl, al
cwde
push dword [esp + 8]
mov edx, dword [ebp + 0xc]
lahf
pop eax
jmp 0x10151254
mov dword [ebp - 0xf], edx
jmp 0x10155844
mov dword [esp + 0x24], edx
lahf
mov byte [esp + 0xc], 0x95
rdtsc
lea esp, [esp + 0x24]
jns 0x10187453
pop edx
movsx eax, bl
mov eax, dword [ebp + 0x10]
movzx dx, bl
setg dh
setp cl
jmp 0x10132ecc
xchg ch, al
lea eax, [esi*8 - 0x2b3a01da]
mov cx, 0xeeac
cwde
pop edx
cdq
setle dl
push ecx
mov dx, ax
mov eax, dword [ebp + 0x10]
pushfd
call fcn.1013bbc6

Function at 0x1014a672
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushfd
jmp 0x10143c33
jmp 0x1015a4d6
lea esp, [esp + 0x24]
call fcn.10013090
test bp, 0x9839
test eax, eax
pushal
push 0x240c68ed
lea esp, [esp + 0x24]
jne 0x101378f6
not cx
pushal
call fcn.1016bd21
mov dword [esp + 4], esi
call fcn.1014e795

Function at 0x1014e12f
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp sp, 0xcf7a
clc
test ah, ah
stc
cmp esi, 0xffffffff
mov word [esp], di
lea esp, [esp + 4]
je 0x1017443f
shrd bx, cx, cl
or di, 0x43c5
bsr di, ax
nop
das
btr di, 0xa
push 0xc62c1dc8
mov dword [ebp - 4], 0
inc al
cmp dh, 0x5d
pushal
pop edi
test ch, ch
movzx bx, bl
shl di, cl
bts di, 8
btc ax, dx
mov byte [ebp - 0x204], 2
lahf
test dl, dl
or di, 0x5369
ror bl, 5
mov edi, dword [ebp + 8]
sbb bx, 0x5d4f
not bl
dec bl
mov dword [ebp - 0x203], edi
btc ebx, edi
mov ecx, ecx
jmp 0x10132247
pushal
mov byte [esp + 8], 0xb
rdtsc
rdtsc
mov ecx, dword [ebp + 0x18]
call fcn.1018411d
Function at 0x1014e8dc
Capabilities:
Packed with generic packer

Disassembly:
btr di, 3
mov edi, eax
push edi
push 0x90789906
mov byte [esp], 0x85
test ecx, ecx
mov byte [esp], dh
mov bl, bl
clc
mov byte [esp], 0xfb
cmp ah, bl
cmp bh, ah
cmp edi, 0xffffffff
call fcn.10156995

Function at 0x1014f4f2
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
test ecx, ecx
pushfd
cmp cl, 0xdb
jmp 0x1015624b
test eax, eax
mov word [esp], 0x1b03
mov byte [esp], 0xfe
lea esp, [esp + 4]
je 0x101370cd
cmp di, 0xb690
mov byte [0x101160fd], 0x68
jmp 0x10135c7d
add esi, 5
push ebx
mov dword [0x101160fe], esi
test ch, 0xf8
test cl, cl
jmp 0x10182f0a
clc
pushal
mov dword [0x10116118], 1
bt dx, sp
cmp dx, 0x54da
mov eax, eax
bsf ax, si
bts ax, 0xc
stc
ror ax, cl
mov eax, dword [0x10116118]
cmp cx, 0xdba6
cmc
cmp ch, bl
test eax, eax
push ebx
call fcn.101796eb
pushal
push dword [esp + 4]
mov dword [esp + 0x20], eax
push ebp
mov dword [esp + 0x20], 0x101693c4
pushal
mov dword [esp], 0x8ffdb063
call fcn.1017df8e
cmp edx, esi
dec ecx
arpl word [eax - 0x72177003], si
jne 0x10156a02
add byte [ecx], bh
dec ecx
xor al, 0xf8
salc
jne 0x101569d2
xchg esi, eax
pop edx
dec ecx
or eax, 0xd8de0dad
inc ecx
test al, 0x18
lea ebp, [ecx + 0x1c04e2a8]
aam 0x98
fldcw word [edx]
push esi
jge 0x101569f8
sub dl, byte [esi + 0x7d]
xlatb
insd dword es:[edi], dx
salc
js 0x10156a9d
or dl, byte [edi]
lodsb al, byte [esi]
push ss
xor al, 0xfc
inc esi
lodsd eax, dword [esi]
mov esp, 0x7ca3b7ab
mov edi, 0x9850c6c2
pop edx
movsd dword es:[edi], dword [esi]
mov word [edi], fs
in eax, 0xd0
mov edi, 0xfcdeb14b
mov gs, word [edi - 0x6ffdcfd3]
rcl bl, 0x10
imul esp, esi, 0xce7160e8
lds esi, [esi]
mov dl, 0x20
sbb byte [ebx + 0x41], bl
in al, 0x10
inc esp
xor byte [edx + 0x13], dl
mov dh, 0xe8
popfd
add eax, 0xb3bbfd16
sal dword [eax + 0x69], cl
xor ecx, dword [esi]
sub eax, 0x6a511e1b
stosd dword es:[edi], eax
push 0xffffffffffffffab
int 0x1a
call 0xdb72f196
fisttp dword [esi - 0x71]
cwde
pop ebp
jns 0x10156a6f
jge 0x10156a1d
xchg esi, eax
xchg esi, eax
inc esp
sub dl, ah
call 0xceb93a5e
xor eax, dword [eax + 0xa]
shl dword [ecx - 0x683a99c3], cl
js 0x10156aae
jo 0x10156adc
jmp 0x10156af0
invalid
xchg esp, eax
mov bl, 0x70
int3
mov word [eax + 0x15810673], gs
stosd dword es:[edi], eax
int 0x1b
and al, 0x5a
mov ch, 0xab
scasd eax, dword es:[edi]
fisttp dword [esi - 0x70]
sbb eax, 0x60760d77
jbe 0x10156b52
fldl2t
inc ebx
sal esi, 1
out 0xe1, eax
mov eax, dword [0x46455f6f]
invalid
lodsb al, byte [esi]
pop ebx
ljmp 0x164a
stc
mov byte [0x10116102], 0xc3
test si, dx
jmp 0x101569a9
test ch, ah
jmp 0x1015c07c

Function at 0x1015056a
Capabilities:
Packed with generic packer

Disassembly:
not dx
pop edx
push edi
call fcn.1016dd3d
xchg dword [esp + 8], edx
mov byte [esp + 4], dh
pushfd
lea esp, [esp + 0xc]
jb 0x1014e599
movsx dx, al
pop edx
jmp loc.10060c06

Function at 0x10152f67
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x38], edi
mov word [esp], 0xfaa4
mov dword [esp + 0x34], 0x1007f375
pushfd
pushfd
call fcn.1016305c
pushal
jmp 0x1016af89
mov dword [esp + 0x3c], edx
jmp 0x1012a3dd
Function at 0x101534c9
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1013eafc
pop eax
mov cl, 0x57
stosb byte es:[edi], al
jl 0x10153544
salc
cmp dword [esi], eax
shr byte [ebx - 0x6758dc7d], 1
mov dl, 0xb3
push ds
xchg byte [eax], bh
nop
das
rcr dword [edx - 0x3f2869da], cl
inc esp
nop
cmp ecx, ecx
fmul dword [esi - 0x5e]
daa
sub bh, byte [edi]
sub ebx, dword [edx + 0x2b]
call 0xe23da482
aad 0xd9
in eax, 0xdf
add bl, byte [ecx]
out 0x27, eax
inc edx
mov dword [0xfdf98906], eax
mov ah, ch
push ecx
dec ecx
popal
dec esp
push 0x1ba3ec9
insd dword es:[edi], dx
loop 0x101534d8
mov ss, word [esi - 0x1e2257bc]
ljmp 0x3358
bound ebx, qword [edx + 0x4b]
inc eax
xor byte [edi], al
sub esi, eax
add al, 0xae
cmpsd dword [esi], dword es:[edi]
cmp cl, byte [ebx - 0x17dbcda7]
mov ebx, 0x8db668f
mov ah, 0x2e
inc esp
fdivr qword [edx]
cmp byte [ebx + eax], dl
adc cl, cl
sahf
out dx, eax
xor bh, byte [ecx + 0x981a5b8]
mov ch, 0xa1
movsb byte es:[edi], byte [esi]
arpl word fs:[ebx + 0x4d], bx
inc ecx
xor edi, esi
sub byte [ecx], dl
or ebp, ecx
test al, 0xc1

Function at 0x10156856
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x2c]
jne 0x1017bf48
pushal
cwde
movsx ax, al
mov eax, dword [ebp + 8]
call fcn.1016ffa0

Function at 0x1015b7cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0x101710a1
btr si, sp
sar cl, cl
push 0x63e84d70
xchg cx, si
lea esi, [ebp - 0x64]
adc cx, 0x113b
inc cl
jmp 0x1018282a
mov ebx, ebx
pushfd
lea ecx, [edi + 0x6130ee23]
mov ecx, dword [0x10106e50]
test dh, bh
clc
call fcn.1012b2e9

Function at 0x1015c243
Capabilities:
Packed with generic packer

Disassembly:
setns al
mov eax, dword [ebp + 8]
pop ecx
push 0xffffffffffffffff
push 0xb7a63a8b
movsx cx, cl
pushfd
lea ecx, [eax - 0x23e54056]
mov ecx, dword [eax + 0x20]
jmp 0x1015c6bb
push esp
mov dword [esp + 8], ecx
pushal
pushfd
lea esp, [esp + 0x2c]
call fcn.1005c280
daa
mov edx, dword [ebp - 0x14]
adc cl, ch
aaa
shl ax, 0xf
rcl cl, cl
mov eax, dword [ebp - 0x18]
shr cl, cl
mov dword [ebp - 4], 0xffffffff
rcl cl, cl
btr cx, 0xc
add esp, 8
bts cx, 0xe
setae ch
mov dword [edx + 4], eax
and cl, 0x31
mov ch, ch
neg cx
dec ch
sub eax, eax
bswap cx
push edx
call fcn.1016d37d
Function at 0x1015d321
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x23], eax
ror cl, 4
sal dl, cl
jmp 0x1016e240
push dword [esp]
mov word [esp], di
mov dword [esp + 4], ecx
mov word [esp], ax
pushfd
mov ecx, dword [esp + 8]
pushal
push 0x42c1da20
push 0x290f0b6a
lea esp, [esp + 0x34]
call fcn.100288f0
movsx bx, dl
xor bh, 0x28
aaa
nop
lea edx, [esi - 0x1fd0613f]
mov ebx, dword [ebp + 8]
aas
xchg dx, cx
bts edx, esi
inc dl
mov byte [ebp - 0x2c], 2
xchg dx, cx
mov dword [ebp - 0x2b], ebx
shr cx, 4
neg al
aad 0xe7
btc ax, 4
push ebx
rdtsc
btr bx, 8
rcr bl, cl
pop ebx
rcl cl, 6
mov edx, dword [ebp + 0xc]
and cl, 0xee
mov dword [ebp - 0x27], edx
sar ah, 1
test ebx, ebx
btc ax, sp
aam 0xde
rcl al, cl
mov eax, dword [ebp + 0x10]
shl dl, 4
test ch, 0x60
jmp 0x101599a2
movsx dx, dl
test ah, ah
push ebx
cwde
bsf dx, sp
mov ecx, dword [ebp + 0x14]
clc
or al, 0xe1
sete al
mov dword [ebp - 0x1f], ecx
movzx eax, bl
ror al, 4
test ecx, ecx
rdtsc
mov edx, dword [ebp + 0x18]
rcr cl, cl
aam 0x28
sbb ch, dh
mov dword [ebp - 0x1b], edx
sbb ch, 0x1d
aaa
aas
sub ecx, 0x8b0fc88d
mov esi, esi
xor ch, ah
call fcn.10139511

Function at 0x10166886
Capabilities:
Encode data using xor

Disassembly:
call fcn.1016e37c
adc ecx, esi
stosb byte es:[edi], al
jb 0x101668ef
jmp 0x101668d0
cmpsb byte [esi], byte es:[edi]
cdq
add esp, dword [edx + 0x6829c5b8]
sub eax, dword [edi + 0x11]
or edx, 0x36
cmp eax, 0xddbe6135
div byte [eax + esi*4]
sbb dword [ebx - 0x637f5f6e], edx
pop esi
mov al, byte [0xed1edcd6]
mov al, 0x19
xchg ebx, eax
xchg edx, eax
mov al, byte [0xa05e9c80]
salc
fcomp qword [esi]
in eax, dx
mov al, 0xac
outsb dx, byte [esi]
xor eax, 0xb0a07457
mov dword [ecx - 0x1213b996], ecx
loopne 0x101668e5
aam 0x33
cmp cl, al
stosd dword es:[edi], eax
xchg ebx, eax
xchg ebx, eax
test dword [ebx + 0x7423b7b], eax
add ah, dh
pop ebp
cld
lds ecx, fs:[ebx]
mov eax, dword [0x1b4bc57d]
sbb ch, bl
push 0x705ff97
cld
cmp bh, byte [ecx + 0x29]
sbb dword [edx], ebx

Function at 0x1016781b
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x34], edi
call fcn.101871cd
lea ecx, [ebp - 4]
movsx dx, cl
mov dword [esp + 0x30], 0
lea edx, [ebx - 0x3949ed3b]
mov dword [esp + 0x2c], ecx
pushfd
push 0xe0e3e739
lea edx, [ebp - 0x14]
push dword [esp]
push dword [esp]
pushfd
mov byte [esp + 4], 0x2b
mov dword [esp + 0x3c], 0xd
mov word [esp], 0x247f
mov dword [esp + 0x38], edx
jmp 0x101370be
pushfd
jmp 0x101542e2

Function at 0x10169ed2
Capabilities:
Packed with generic packer

Disassembly:
call fcn.10078827
mov dword [esp + 4], 0x79fc1ae1
lea esp, [esp + 0x28]
jmp 0x1012475a

Function at 0x1016b688
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], 0x1b
lea esp, [esp + 0x34]
jne 0x1016b95b
not si
add esi, 0x29023ece
or eax, 0xffffffff
lea esi, [ecx - 0x60ce55fd]
lea esi, [eax*8 + 0x7a4daec]
pop esi
pushfd
push dword [esp]
mov esp, ebp
call fcn.101524e0