joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015cd28
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap cx
movsx ecx, dl
shr cl, cl
movzx ecx, byte [ebp - 0x211]
jmp 0x101c8370
je loc.100c57c7
not ah
mov ah, 0x1c
push 0
rdtsc
sete ah
push 0
rdtsc
rdtsc
pushal
lahf
mov dword [esp + 0x1c], 0x104
pop edx
lea edx, [edi + 0x237e6054]
bswap eax
movsx ax, cl
lea edx, [ebp - 0x7b8]
bswap ax
mov dword [esp + 0x14], edx
pop eax
not ax
pop eax
lahf
mov dword [esp + 8], 0xffffffff
movsx ax, al
setbe ah
lea eax, [ebp - 0x210]
pushal
lea esp, [esp + 0x28]
jno 0x101d7e07
push eax
call fcn.100eb823
test eax, 0x95c1901d
add al, 0xd9
ljmp 0x6b2
push 0x3aac13e5
lea esp, [esp + 0x30]
jne 0x100a8e3a
not dh
jmp loc.10015bb2
jmp 0x10102688
clc
jmp 0x1022fa43
call fcn.1010d329
cmp ebp, ebp
push ds
push edx
retf
test ecx, ecx
jmp 0x100de267

Function at 0x1015d3c1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [ebp - 0x24]
push ebp
jmp 0x101ce56e
mov dword [edx + eax*4], ecx
mov word [esp], bp
mov byte [esp], cl
mov byte [esp + 8], bl
lea esp, [esp + 0x50]
jmp int.1007742f

Function at 0x1016f30f
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 1
push 0xab66a7aa
mov dword [esp], 0x1022c55e
jmp 0x1016f308
inc esi
mov al, byte [0x41637d2a]
mov dh, byte [edi + 0xd]
scasb al, byte es:[edi]
add cl, dl
pop ebp
aas
mov dh, 0x13
les edx, [eax + 0x55]
push eax
push ebp
dec esp
add dword [esi - 0x3d712ae6], edi
xor cl, byte [eax]
jge 0x1016f295
fsub st(7), st(0)
out dx, al
xchg ebx, eax
sub ch, al
adc al, 0x67
push ds
dec byte [eax - 0x151a38ea]
imul edx, dword [edx - 0x7f], 0x1722060d
lahf
sub byte [ebp - 0x3f], ah
mov fs, word [esi]
jge 0x1016f2b9
ror dword [esi + 0x3efb7d26], 0x55
push ebp
and eax, dword [esi - 0x35]
aaa
add al, 0x7c
lcall 0x56f6, 0x9dfedfe5
pop eax
aam 0x41
mov esp, dword [ebp + 0x5f]
xchg dword [ebx - 0x58], ebx
jecxz 0x1016f292
jb 0x1016f281
ret 0x875a
pushfd
pushfd
call fcn.100d70d8
push eax
not ax
mov dword [esp + 0x38], 0
push eax
lea eax, [ebp - 0x426]
mov byte [esp], 0xc
pushfd
pushfd
push dword [esp + 0xc]
mov dword [esp + 0x44], eax
call fcn.10207194
xor byte [ebx - 0x29], ah
mov dh, 0xd4
mov eax, dword [0xcd180d88]
inc ebx
js 0x1016f2cd
jmp 0x619751c3

Function at 0x1017e063
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x101f31a2
pushfd
mov dword [esp + 0x40], ecx
call fcn.10115f59

Function at 0x1017e8a3
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [ebp - 0x70]
pushfd
call fcn.101e14e8
xchg dword [ebx + 0x2c], ebx
aas
jae 0x1017e8d6
sbb byte [esi - 0x19fdff0f], al
mov eax, 0xada83502
push ds
pop ss
pop ss
dec esp
mov byte [0xe1c68104], al
and byte [ebx + 0x261180af], bl
stc
imul edi, dword [edx - 0x76e479b0], 0xffffff99
rol eax, 1
push ebx
shr byte [esi], 0x53
std
scasd eax, dword es:[edi]
inc edx
sar edx, 0xec
imul ecx, dword [ebx - 0x68], 0x38bde7af
insb byte es:[edi], dx
xor eax, 0x288f3251
movsd dword es:[edi], dword [esi]
invalid
Function at 0x10183994
Capabilities:
Packed with generic packer

Disassembly:
inc edx
ficom dword [eax + 0x6b539e68]
add al, bl
lodsd eax, dword [esi]
sub dword [eax + 0xa], 0xe85c8490
xchg ecx, eax
xchg ch, dh
call [edi - 0x5c]
popal
push 0x5c925df3
call fcn.10004743
and ebp, dword [esi + 0x60]
sahf
jle 0x100aa39b
invalid
xchg dword [ecx - 0x3b16fff4], ecx
rcl byte [eax], 0
push ebx
mov dword [esp + 0x24], eax
call fcn.101b55a3
pushfd
lea esp, [esp + 0x24]
call fcn.1001b767
call fcn.1008ddfb
nop
loop 0x100aa38a
inc edi
cmp ch, byte [edx]
sahf
or eax, 0x1da7cb84
add cl, byte [edx]
mov bl, 0x20
stosb byte es:[edi], al
jg 0x100aa453
invalid
and eax, 0x38c449e6
movsd dword es:[edi], dword fs:[esi]
pop esi
mov al, byte [ebx]
inc eax
jns 0x100aa439
leave
inc ebx
ljmp 0xd8b
test al, 0xcc
mov ecx, dword gs:[0x31cbc365]
test dword [edi - 0x474cc7f8], eax
mov ebx, 0x490a84fd
sar byte [eax], cl
jno 0x100aa4c7
test edi, esp
dec esi
nop
mov ch, 0xc7
or edi, edi
in eax, dx
pop esp
arpl word [edi + 0x41], cx
cmp bl, ch
cmp byte [ecx + ebp*8 - 0x1edb3ae3], al
inc eax
aas
xor dword [esi], esi
and eax, 0xd64d64ea
cmp esi, dword [ecx]
jnp 0x100aa4ab
iretd
popal
mov dl, 0xf1
je 0x100aa428
push edx
push 0xf7655b43
mov edi, ebp
pushal
outsd dx, dword [esi]
pushfd
dec edx
ret
pop ebx
test dword gs:[ebx - 0x63909f03], 0x8e18c34a
sti
add eax, edx
inc ebx
cmp byte [edi + 0x4d], ah
sbb al, 0x1d
mov byte [0xf6832829], al
sub bl, byte [ebx + 0x673302ad]
xor eax, 0x47d63e2b
wait
lodsd eax, dword [esi]
add dh, byte [ebx]
xor eax, 0x47d63e2b
inc ebx
inc edx
dec ebx
pop esi
jae 0x100aa4a3
mov edx, 0xd0db781a
iretd
mov dword [esp], 0x5bd5b1b2
mov dword [esp], edx
pushal
jmp 0x100aa3c5

Function at 0x101878ce
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push eax
movzx edx, word [ebp - 0x1bc]
lea eax, [edi*4 + 0x68008e2]
push eax
jmp 0x101a15fd
mov word [ebp - 0x1bc], dx
not dx
mov byte [esp], 0xe9
push 0xc827037b
mov ax, word [ebp - 0x162]
mov dl, byte [esp]
mov word [ebp - 0x1ba], ax
mov al, bl
cdq
jmp 0x102250ed
push 0xc0c979e0
mov dword [esp + 0xc], edx
cwde
movsx ax, bl
pushal
movzx dx, cl
mov eax, dword [ebp - 0x1b8]
movzx dx, cl
jmp 0x100d573e
movzx dx, dl
lea ecx, [ebp - 0x5c0]
lahf
mov dword [ebp - 0x1b8], ecx
cdq
movsx dx, bl
movsx ax, cl
movzx dx, cl
mov dword [esp + 4], 0
setno dl
jmp 0x1016a3c2

Function at 0x10199a1c
Capabilities:
Encode data using xor

Disassembly:
invalid
call fcn.101cbf38
sbb al, 0xf0
jg 0x101999d8
out 0x59, eax
or esi, eax
dec dword [ebx + 0x3febfff0]
mov bh, 0x73
sub ebx, dword [esi + 0x4a]
rol dl, 0xbb
sub byte [edx + 0x2e330438], 0x20
pushal
fsubr qword [esi + 1]
xor esp, dword [edx - 0x1ff6226c]
inc eax
invalid
Function at 0x101a977d
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x30]
call fcn.1001c970
neg dl
bswap edx
add esp, 0xc
btc dx, 4
bsf dx, ax
pushfd
mov edx, dword [ebp - 0x10]
call fcn.10099404
jae 0x55bb5c6b
jge 0x100ef4c5
dec eax
sub al, 0
imul ebx, dword [esi - 0x51], 0xcd47ac88
push ecx
dec edx
pop esp
scasd eax, dword es:[edi]
mov byte [edi + eax*2 + 0x5c4a51cd], ch
push 0xef9d
rcl byte [esi - 0x6e607428], 0x23
mov dh, 0x86
push esp
mov dl, 0x8a
inc esp
test eax, 0x8fad31f6
add al, 0x4f
inc eax
push ebp
xchg esp, eax
inc eax
xor esp, dword [edx]
cmp al, 0x43
lahf
ja 0x100ef481
outsb dx, byte [esi]
and bl, 0xea
sbb ebp, esp
retf
ljmp 0xc1d1:0xcccbe519
cmp al, 0xf9
stc
xchg edx, eax
cli
or ah, byte [edi - 0x590f52dd]
sub ebx, ebx
leave
cmp bl, al
mov dl, 0xae
mov esp, 0x1fafa02e
mov dword [0x7f03dbe2], eax
stc
xchg esp, eax
jnp 0x100ef47c
cld
add ebx, dword fs:[ebx - 0x17470798]
not byte [ebp - 0x24]
cmp al, 0xaa
push esi
jne 0x100ef4c6
jns 0x100ef4b0
adc al, byte [edx + 1]
jl 0x100ef566
mov al, 0x69
sbb dword [ecx], esi
inc edi
jne 0x100ef52d
add dl, bh
das
and al, 0x16
push 0x5c7d105a
call fcn.1000488f
cdq
xchg cl, ch
jmp 0x10209706
add esp, 0x10
push edx
mov esi, dword [esp]
les edx, [eax]
cmp cl, ah
fst qword [edx + 0x21d54863]
or byte [edx], ah
and al, 0xf9
outsd dx, dword [esi]
jns 0x100ef57c
push esi
stosb byte es:[edi], al
mov edx, 0x34de01b7
pop edx
stc
mov esi, 0x19e62299
lodsd eax, dword [esi]
and cl, dh
in al, 0xb8
xchg dword [edi + 0xa], edx
mov ah, 0xad
out 0x12, al
je 0x100ef59c
rol dword [edx + ecx], 1
jne 0x100ef587
mov dh, 0xe
jb 0x100ef51b
sbb byte [0xc8dd614e], ah
xor eax, 0xf49cab84
adc cl, bl
invalid
invalid
invalid
sub dl, byte [ecx + 0x1e0a115f]
loopne 0x100ef605
outsd dx, dword [esi]
inc esp
scasb al, byte es:[edi]
xlatb
retf
aaa
dec ebx
imul edi, dword [eax - 5], 0xffffffb4
iretd
js 0x100ef599
sti
mov ah, 0xcf
sub eax, dword [ebp - 0x71ecd9]
jae 0x100ef5ab
pop ebx
add eax, 0xb44c16e0
pop ebx
push ss
dec esp
mov ah, 0x5b
pop ecx
mov bl, 0x36
enter 0x305e, 0xfffffffffffffffe
call 0x5cb71761
fbstp tbyte [ecx]
ret
rol byte [ecx], 1
xor al, 0x5a
insd dword es:[edi], dx
push ds
xor ah, byte [edx + 0xff748d4]
add byte [eax + 0x40], 0xfa
and al, 0x4e
mov dl, 0x38
fisub dword [esi + eax*8 - 0x79]
mov ebx, 0xfecee9a4
cwde
int1
or dh, byte [ebx + 0x777b960d]
aad 0x38
pop ebp
jle 0x100ef58d
sti
mov ebp, 0x616e953b
in eax, dx
dec edi
mov eax, 0xca7da88d
cwde
add dh, bl
dec ecx
push ebx
sbb al, 0x7c
jp 0x100ef59d
fnsave dword [edi - 0x22]
shl byte [ebx - 0x3c], 0xb3
add eax, 0xc8d62e9b
jo 0x100ef5d9
mov esi, 0x55fb39b5
call 0x52dc1329
invalid
mov byte [esp + 0xc], dh
push dword [esp]
jmp 0x100ef452
movzx cx, al
mov byte [ebp - 0x17c], 0
push 0xb088ec21
movsx cx, dl
mov dword [esp + 0x18], 0xff
movsx cx, dl
mov dword [esp + 0x14], 0
pop ecx
not cx
seta ch
not ch
lea ecx, [ebp - 0x17b]
mov word [esp], bx
pushal
mov dword [esp + 0x2c], ecx
jmp 0x101343e0
Function at 0x101ced65
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x34a16b93
int3
lea esp, [esp + 0xc]
call fcn.100074c0
movzx edx, cl
call fcn.100eeba0
out 0x5b, eax
dec edx
mov dh, 0x43
lcall 0x5cdd, 0x9e0f4d56
xor al, 0xb9
cmpsd dword [esi], dword es:[edi]
sub eax, 0xccbd99c7
xor al, 0x30
mov eax, dword [0x8eba0955]
pop edi
jae 0x101c29ee
clc
call 0x207d5a8c
lea esi, [esi]
wait
enter 0xffffffffffff9905, 0x7a
jbe 0x101c29ce
scasd eax, dword es:[edi]
xor al, byte [esi + 0x7fd334d1]
lds ecx, [edi]
mov ah, 0x64
mov edi, 0xe41b3e8a
cwde
arpl word es:[eax], dx
hlt
pushfd
jmp 0x101c29db

Function at 0x101dfff8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
setge dh
mov edx, dword [ebp - 0x24]
push eax
mov dword [edx + eax*4], ecx
push dword [esp + 0x10]
lea esp, [esp + 0x3c]
jmp int.1007742f
invalid
invalid

Function at 0x101f9512
Capabilities:
Packed with generic packer

Disassembly:
pushal
fsubr dword [esi + 6]
pop esp
test al, 0x9f
pop ss
invalid
clc
add esp, 0xc
pushal
cmp dword [ebp - 0x78], 0
push ebp
pushal
lea esp, [esp + 0x44]
je 0x1017964a
movzx ax, dl
call fcn.1009b626
xor al, byte [edi - 0x55]
cmp byte [eax + ebp*4 - 0x36], al
sbb byte [ebx], dh
movsb byte es:[edi], byte [esi]
test dword es:[0xd9f6a70], edx
bound esp, qword [ebx + 0x45]
pop ss
xchg edi, eax
daa
mov ebx, 0x3a6793fa
push cs
jge 0x1013512a
in al, 0xf5
imul ebx, dword [ebx - 0x496e6534], 0x31a416b
xchg dword [edi - 0x593bc7c5], esp
dec ebx
mov al, byte ds:[0x1514304e]
or bl, byte [ecx - 0x4c]
cdq
and al, bl
adc eax, 0xe719c6b3
jb 0x101350ce
int3
lea esp, [esp + 0x50]
call fcn.1001af50
test cx, dx
test al, 0x75
jmp 0x101350db

Function at 0x101fae56
Capabilities:
Packed with generic packer

Disassembly:
push 0xacd69b41
mov dword [ebp - 0x48], 0
mov byte [esp], 0xe4
pushfd
mov byte [esp], dh
mov byte [esp], 0xe9
lea esp, [esp + 0x30]
jmp 0x101c4967

Function at 0x10207194
Capabilities:
Packed with generic packer

Disassembly:
lea ecx, [ebp - 0x428]
pushfd
mov dword [esp], ecx
call fcn.1016e78d
add eax, 0xad3c6997
popal
jne 0x101a3ef8
clc
or ebx, dword [edx - 0x30a42ff5]
invalid
push ebp
cmp byte [eax + 0x66286f6e], bl
ret 0x2b34
mov word [esp + 8], cx
push dword [esp]
lea esp, [esp + 0x4c]
call fcn.1001c970
bswap cx
or ecx, 0xaac67ff4
pushal
not ch
add esp, 0x2c
push edx
not cx
mov dword [esp], 0x104
lea ecx, [ecx - 0x54ef325a]
bswap ecx
jmp 0x101a3e9a
Function at 0x10207d6a
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
pop esp
xor bl, byte [ebp + ebp*4 + 0x596f11c6]
or eax, 0xb5cec198
scasd eax, dword es:[edi]
sbb al, 5
ret 0x64fd
pushfd
cmp dl, dl
jbe 0x10207d2e
nop
fiadd word [ebx + 0x33]
add edx, esp
invalid
pushfd
lea esp, [esp + 8]
jne 0x101b128a
push 0x6b29463
rdtsc
setbe al
pushfd
mov edx, dword [ebp - 0x78]
pushal
mov dword [esp + 0x24], edx
push ebx
mov eax, dword [ebp - 0x74]
movsx cx, cl
setb ch
mov dword [esp + 0x24], eax
pushfd
call fcn.10220786
mov ecx, 0x42107e2c
adc eax, 0x566a4ce4
push 0x2c6758b7
bound esp, qword [ebp + 0xa]
push edi
pop esi
pop eax
sub al, 0x62
or dl, byte gs:[edi + 0x5e]
out dx, al
lodsd eax, dword [esi]
loope 0x10207d49
wait
das
outsb dx, byte [esi]
leave
pop edx
push cs
and ebp, esi
inc esi
jp 0x10207da9
cli
stc
insd dword es:[edi], dx
mul dword [ebx]
xor al, 0x1a
add eax, 0x54a74f5f
fsubr qword [ecx]
push 0x1e
mov al, byte [0x5f394218]
sbb al, 0x55
pushal
or byte [ebx - 0x29c1b016], al
xlatb
invalid
Function at 0x1020cab4
Capabilities:
Packed with generic packer

Disassembly:
setp ah
mov dword [esp + 0x1c], 0x8000
movzx ax, dl
setb ah
sets al
mov dword [esp + 0x18], 0
pop eax
cwde
not ah
mov eax, dword [ebp - 0x78]
mov byte [esp], 0x86
mov word [esp + 4], sp
mov byte [esp + 4], bh
mov dword [esp + 0x10], eax
mov byte [esp + 4], ch
mov word [esp + 0xc], 0xa157
mov dword [esp + 0xc], 0x10179639
jmp 0x101434d0
mov byte [esp + 8], 0xd
push dword [sym.imp.KERNEL32.dll_VirtualFree]
pop dword [esp + 8]
pushfd
push 0x87ef2501
pushal
mov byte [esp + 8], ah
push dword [esp + 0x30]
ret 0x34
movsx cx, al
mov ecx, dword [ebp - 0x74]
pushal
mov dword [esp + 0x1c], ecx
call fcn.10007026
pop ss
push es
out 0xc3, eax
pslld mm0, qword [ecx]
in eax, dx
popal
pop ecx
arpl bx, cx
mov ss, word [ebx + 0x55]
mov dh, 0xa6
xchg esp, eax
add al, 0xa7
rcl dword [esi - 0x4e41850f]
add eax, 0xcd9908b7
sal dword [ebx + 0x370c1886], 0x22
cmp byte [edx + 0xe], cl
bound ebp, qword [eax]
mov esi, 0x6f33892b
push 0xffffffffffffffe1
sub ah, byte [ebp + 0x11a0a39e]
movsd dword es:[edi], dword [esi]
in al, 0x22
fidivr word [ecx]
jnp 0x10179705
xor dword [edi - 0x7b0a7af1], 0x84d7555f
cmp byte [esp + ebp*4 + 0x34e5f13c], ch
cli
sbb al, 0xbe
sub eax, 0xa39f5b20
test dword [0xa31834aa], ebx
push ss
xor byte [ebx + 0x1e6b08ec], dh
retf 0x6f43
push ebx
test al, 0x40
cwde
or al, 0x79
outsb dx, byte [esi]
adc byte [esi], 0x30
and ecx, ebp
adc al, 0xe
inc eax
jo 0x101796ee
cdq
inc ebx
in al, 0xc6
and eax, 0xbc0daa3f
jg 0x101796de
enter 0x3a36, 0x4b
aas
nop
aas
and edx, dword [eax - 0x6627538d]
arpl word [ecx + ebx*2 - 0x261817dc], sp
lodsb al, byte [esi]
pop eax
mov edx, 0xb7bec3c2
inc eax
pop ds
imul ebp, dword [0x3be94716], 0xe98daffe
aad 0x8a
mov bl, dl
and esp, dword ds:[edx + eax*2 + 0x2bcfa624]
mov esi, 0x728b1718
mov dword [0xeafab1ac], eax
pop esp
and dh, byte [edi - 0x2f]
pop ebp
xchg edi, eax
outsb dx, byte [esi]
bound edx, qword es:[esi]
mov bh, 0x1c
test edx, edi
jae 0x101796d3
movsb byte es:[edi], byte [esi]
inc edx
and al, 0xa6
iretd
push es
dec ecx
add bh, dl
xchg bh, dl
sub eax, 0x24d81123
or dword [ecx + 0x5a762d4b], ebp
dec ebx
sub eax, 0xd4135a76
adc edx, esp
inc ecx
jge 0x1017971e
sbb eax, 0x7c98cbc9
fst dword [edx - 0x3601c0bd]
add esi, ecx
fidiv dword [esi - 0x591569bf]
push ss
push ds
sti
xor edi, edi
sti
pop ebp
jl 0x1017974b
mov dh, 0x75
test eax, 0xfbb441eb
adc ecx, edx
inc ecx
pop esi
in al, dx
cmp al, byte [ebx]
out dx, al
push edx
mov ebx, 0x51d67def
mov bl, 0xeb
invalid
lea esp, [esp + 4]
je 0x1017964a
lea eax, [ecx - 0x76a1f973]
pushal
jmp 0x1011c3c5

Function at 0x1020cf5c
Capabilities:
Hash data with crc32

Disassembly:
cmp di, 0x7fd6
bt si, 0xe
pushal
shr eax, 1
lea esp, [esp + 0x20]
xor eax, 0xedb88320
pushal
push ecx
pushal
pushal
lea esp, [esp + 0x44]
je 0x1010d7ea
test ch, 0xcc
shr eax, 1
pushal
jmp 0x10134e9e
Function at 0x1020d0ea
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushfd
mov dword [esp + 8], 0
pushal
mov dword [esp + 0x24], 0x100ef193
mov byte [esp], ah
push dword [esp]
push edi
call fcn.1009bf56
ja 0x1020d135
or al, 0x2e
adc dword [edi - 0x12], ebx
ljmp 0x7cc
push ds
outsb dx, byte [esi]
insb byte es:[edi], dx
cdq
aam 0x60
adc dh, byte [ebp + esi*8 - 0x6b]
lcall 0x26d2, 0xf60856
jo 0x1020d1c3
xchg ebp, eax
and esi, 0x8c283caa
out 0x88, eax
push edi
int3
and byte [eax + 0x5e], 0xd5
inc esp
mov edx, dword [ebp - 0x33]
add ah, ah
push eax
lahf
pop ss
pop ds
mov word [esi], ss
jno 0x1020d1dd
dec edi
rep movsb byte es:[edi], byte [esi]
jno 0x1020d1fc
int3
cmp edi, 0xffffffcb
wait
cmc
adc al, byte [ecx]
scasd eax, dword es:[edi]
mov al, byte [0xe74ef2a7]
jecxz 0x1020d214
xchg ebp, eax
into
call dword [ebx - 0x39d3f26c]
cmpsb byte [esi], byte es:[edi]
out dx, al
and dword [eax + 0x3b], esp
mov ds, ebp
xor al, 0xaf
scasd eax, dword es:[edi]
movsb byte es:[edi], byte [esi]
wait
enter 0x41d4, 0x25
ficom dword es:[edx + 0x7a]
push 0x6e
mov dh, 0x47
sub al, 0xe9
and al, 0xb7
push es
fnsave dword [ebp + 0x6b5862aa]
bound ebx, qword [eax + 0x6b]
popal
mov ecx, 0x12fdc4d1
invalid

Function at 0x1021abd8
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call fcn.1022ae5f
lahf
invalid
jmp 0x101f31ac
clc
cmc
add ecx, 0x458
jmp 0x10153b50
movsx cx, cl
lea ecx, [ebp - 0x64]
mov byte [esp + 8], ah
mov dword [esp + 0x34], ecx
lea esp, [esp + 0x34]
je 0x100d0261
pushal
pushfd
lea esp, [esp + 0x24]
call fcn.1000aa60
pushfd
bt cx, cx
add esp, 0x10
jmp 0x101f2722
mov ebp, 0x90ec904b
push esi
dec esp
mov eax, dword [0x7ce60e36]
xor cl, byte [edx - 0x21]
push 0x1436e4b5
push 0x1436e4b5
lea ecx, [ebp - 0x64]
mov word [esp], 0x2cd4
call fcn.100d5ddb
jno 0x101f277b
xchg edx, eax
jge 0x101f2784
aad 0x69
popal
pop edi
ja 0x101f2767
jmp 0x101f2743
je 0x101f2712
mov dword [eax + 0x5b870e23], esp
into
add dh, byte [ebx + 0x47]
sbb ecx, dword [ebp + 0x794592ff]
sub bl, dh
rcr byte [edi], 1
fst qword [ebx + 0x6ae68ff2]
cli
adc esp, dword [eax + 0x43]
mov eax, 0xeab675e2
and esp, esp
sub dword [0x40350744], esi
invalid
ljmp 0x744:0x3529e423
out dx, al
xchg esi, eax
or dh, byte [ebx - 0x61082ced]
sal edi, cl
sahf
add eax, 0x6100d684
xor edi, esp
pop eax
test dh, dl
add byte [ecx + 0x31], ah
out 0x58, eax
sub eax, 0x37a5e540
sub byte [ebp + 0x2b], bl
adc eax, dword [edx + 0x6e]
dec eax
dec edx
je 0x101f2780
jl 0x101f27a6
mov edi, eax
insb byte es:[edi], dx
stosb byte es:[edi], al
xlatb
insb byte es:[edi], dx
jbe 0x101f2812
push ebx
xchg ecx, eax
into
fldz
xchg esi, eax
retf 0x14f2
mov dword [edx], esp
invalid
lea esp, [esp + 0x24]
call fcn.10007990
jmp 0x10236507
mov ecx, dword [ebp - 0x148]
push ebp
jmp 0x101b3195
push eax
setle cl
push 0xaa9eede5
bswap cx
bswap cx
lea ecx, [ebp - 0x80]
pushal
lea esp, [esp + 0x24]
call fcn.10007430
sets dl
mov edx, 0x6dfb52cc
mov byte [ebp - 4], 3
movzx edx, bl
pushal
movzx ax, dl
lea edx, [ebp - 0x9c]
setbe cl
movsx cx, dl
movzx ax, dl
pushal
mov dword [esp + 0x3c], edx
cwde
lea eax, [ebp - 0x80]
not ecx
mov dword [esp + 0x38], eax
setg ch
jmp 0x101ccb91
Function at 0x10220786
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [ebp - 0xa8]
mov dword [esp], 0xb8e3c5b2
jmp fcn.1000df5d

Function at 0x10233207
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x9051cdc1
movzx ax, al
xchg ah, ch
lahf
push edx
jmp 0x10218579
xchg ebp, eax
add eax, 0xd5000f8a
daa
xchg edx, eax
sub al, byte [edx]
push edi
invalid
mov eax, dword [ebp - 0x78]
lea ecx, [eax + 0x45287496]
call fcn.101c7c1d
add dl, dh
pop es
sbb cl, byte [esi]
loopne 0x102185ff
xchg byte [ecx], bl
or byte [ecx + 0x38], cl
cli
daa
add edx, ebx
or ebp, dword [ebp - 0x12f5b780]
enter 0x24bb, 0xffffffffffffff99
cmp dword [ecx + esi*4], esp
mov esp, 0x796a1b31
out dx, al
push esp
jecxz 0x10218564
xchg ecx, eax
fisttp qword [esi + 3]
push ecx
inc eax
lds ebx, [edi + edx*4]
packuswb mm5, qword [edi - 0x4bab2bf0]
leave
imul ebp, dword [ecx - 0x69], 0xffffffc8
mov bl, bl
test eax, 0x7e646b41
push dword [ebx + edi + 0x57]
mov cl, 0xbf
invalid
shr dword [eax], 0x34
mul byte [ecx - 0x822f163]
invalid
xchg ch, ah
mov dword [esp + 8], edx
setnp ah
push 0x14baaec5
push ebp
pushal
lea eax, [ebp - 0x210]
pushfd
mov dword [esp + 0x30], eax
mov ch, byte [esp]
call fcn.100becf4
lea esp, [esp + 0x34]
call fcn.1001c970
rol dl, cl
shld dx, di, cl
and dx, ax
xchg dl, cl
add esp, 0xc
lahf
rdtsc
push 0
rdtsc
mov edx, dword [ebp - 0x84]
pushfd
not ah
lea esp, [esp + 4]
jns 0x100f24ac
lahf
push edx
movzx ax, cl
bswap ecx
push 0x6ac50cc7
mov eax, dword [ebp - 0x78]
bswap cx
pushfd
mov dword [esp + 4], eax
bswap cx
call fcn.101db68a
hlt
Function at 0x10236dd8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 4]
jne 0x10158002
sar dl, 4
clc
test bl, dl
movzx dx, cl
movzx edx, word [ebp - 0x422]
test dl, 0xe
bt ebx, edx
push 0x41fdd63e
pushal
cmp edx, 0x5c
pushal
lea esp, [esp + 0x44]
jne 0x10158002
shr ah, cl
aas
cmp bh, dl
mov eax, dword [ebp - 4]
sal cl, cl
not cl
movzx ecx, word [ebp + eax*2 - 0x428]
call fcn.10150ac7
xchg edi, eax
stosd dword es:[edi], eax
pop ebp
push cs
add ebp, edx
out 0x4b, al
fadd dword [ecx]
loop 0x10185e76
in al, dx
add eax, edi
jbe 0x10185e25
movsd dword es:[edi], dword [esi]
nop
jnp 0x10185ef5
out dx, al
int1
rol dword [esi - 0x483d3962], 1
test eax, 0x560491fd
or ah, bl
cmpsb byte [esi], byte es:[edi]
mov edx, dword [ecx + 0x3fd5e1a6]
jno 0x10185e28
pop dx
mov eax, dword [0x64daff07]
push ebx
pop eax
clc
adc byte [ebx + 0x21], ah
dec edx
imul esi, ecx, 0xffffffcb
ror byte [edx + ebx*8 + 0x5b], cl
nop
xor bh, byte fs:[eax]
popfd
xor esp, dword [ebx]
mov cl, 0xc0
inc esi
dec esp
mov eax, 0x71c713c7
mov dword [0x2cbab726], eax
in al, 0x3e
mov bl, 0x73
xchg ebp, eax
xchg esp, eax
les eax, [edi + edx*2 + 0xd]
xchg edx, eax
xor eax, 0x577e960
mov ch, 4
and dl, byte [ebx]
cmpsb byte [esi], byte es:[edi]
lcall 0xb036, 0x4d40b5ef
mov edi, 0x68fd0cb9
or eax, 0x45c13198
retf
jp 0x10185f07
sbb dword [esi - 0x48], eax
test dword [edi + 0x65], 0x98524adb
bound edx, qword [edi]
or eax, dword [esi + esi*4 - 0x74]
rcl dword [eax - 0x391626d0], cl
or byte [edx - 0x1a], bl
and dword [ebx - 0x21be22db], ecx
leave
scasb al, byte es:[edi]
or byte [edi + ecx*8 + 0x4b7fa0a4], dl
mov byte cs:[edi + ecx], dl
call 0x7972cf1d
mov eax, dword [0xf7e079d]
out 0x59, eax
add bh, byte [esi + 0x2c3ac977]
sbb eax, 0xcbd09889
popfd
or al, 3
ficom dword [esi + 0x7711f2e]
sub byte [ecx], ah
jb 0x10185f47
les ecx, [edi - 0x63f375d4]
cmp dword [edx + edx + 0x5e363f59], 0xa
outsb dx, byte [esi]
mov ebp, 0x48d67e23
xor dword [ecx], ebp
inc ebp
ljmp 0x1b94
cmp eax, 0x5c
push dword [esp]
mov dword [esp], ebp
push 0xcddbf409
lea esp, [esp + 0xc]
jne 0x10158002
setno ch
movzx ecx, word [ebp - 0x424]
cmp ah, 0x8b
bt bp, bx
cmp ecx, 0x3f
pushfd
jmp 0x10185e1b
Function at 0x402d68
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4083a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x244
push edi
xor esi, esi
lea eax, [ebp - 0x248]
push esi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x402db7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00402eb8
leave
ret
push 0x406ac4
lea eax, [ebp - 0x248]
push 0x122
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, esi
je 0x402da7
push 0x406ab0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
jne 0x402dff
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x402da9
push esi
push esi
push 1
push esi
call eax
mov esi, eax
neg esi
sbb esi, esi
neg esi
jmp 0x402df4

Function at 0x402eb8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4083a8]
jne 0x402ec2
repz ret
jmp fcn.0040340c

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..retplne
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x331e0ca1
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..reloc
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x576b1edc
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219