joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x411010
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x416120]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
push 0x41234c
push 0x81
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x401c07
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push 0x3ff
push 0x4177f0
push 0x400
push eax
push ebx
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
je 0x401bcf
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, ebx
je 0x401bcf
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
jne 0x401c62
push 0x3ff
push str.Unable_to_Lock_Assembly_for_Decryption
push 0x4177f0
call fcn.004041ad
add esp, 0xc
mov byte [0x417bef], bl
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
lea ecx, [esp + 0x1c]
call fcn.00403370
mov eax, dword [0x4177e8]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x18], ebx
call fcn.004012e0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push esi
push edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 1
call fcn.00403450
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00401940
cmp edi, ebx
jne 0x401cb2
mov eax, dword [esp + 0x1c]
push eax
jmp 0x401d22
push esi
push ebx
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov esi, eax
cmp esi, ebx
je 0x401d1d
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jge 0x401cdd
push str.Unable_to_Access_SafeArray_Data
jmp 0x401d22
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push edx
push edi
push eax
call fcn.004047b0
add esp, 0xc
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00402ca0
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
push 0x4122cc
mov ecx, 0x4177f0
call fcn.00401180
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00402ca0
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x40383e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x416120]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0040377d
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00403fd0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x40388d
cmp dword [ebp - 0x1c], 5
jb 0x4038a5
jmp 0x4038a1
cmp dword [ebp - 0x10], 1
jne 0x4038a5
cmp dword [ebp - 0x1c], 4
ja 0x4038a1
jne 0x4038a5
cmp dword [ebp - 0x18], 0
jbe 0x4038a5
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x412628
call fcn.00403630
test eax, eax
jge 0x4038c6
mov byte [0x417bf4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00404778
add ebp, 0x78
leave
ret

Function at 0x404778
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x416120]
jne 0x404782
repz ret
jmp fcn.00407dbc
Function at 0x409534
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x416a58]
je 0x40954f
inc edi
cmp edi, 0x17
jb 0x409540
cmp edi, 0x17
jae 0x4096cf
push ebp
push 3
call fcn.0040d7d0
cmp eax, 1
pop ecx
je 0x40969b
push 3
call fcn.0040d7d0
test eax, eax
pop ecx
jne 0x409583
cmp dword [0x416140], 1
je 0x40969b
cmp ebx, 0xfc
je 0x4096ce
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4181d8
push ebp
call fcn.0040876c
add esp, 0xc
test eax, eax
je 0x4095b9
push esi
push esi
push esi
push esi
push esi
call fcn.00404d63
add esp, 0x14
push 0x104
mov esi, 0x4181f1
push esi
push 0
mov byte [0x4182f5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4095fd
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040876c
add esp, 0xc
test eax, eax
je 0x4095fd
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00404d63
add esp, 0x14
push esi
call fcn.004058a0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x409642
push esi
call fcn.004058a0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4184ec
push 0x412e3c
sub ecx, eax
push ecx
push eax
call fcn.0040b876
add esp, 0x14
test eax, eax
je 0x409642
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00404d63
add esp, 0x14
jmp 0x409644
xor esi, esi
push 0x412e38
push ebx
push ebp
call fcn.0040b7b8
add esp, 0xc
test eax, eax
je 0x409664
push esi
push esi
push esi
push esi
push esi
call fcn.00404d63
add esp, 0x14
push dword [edi*8 + 0x416a5c]
push ebx
push ebp
call fcn.0040b7b8
add esp, 0xc
test eax, eax
je 0x409686
push esi
push esi
push esi
push esi
push esi
call fcn.00404d63
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0040d613
add esp, 0xc
jmp 0x4096ce
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4096ce
cmp ebp, 0xffffffff
je 0x4096ce
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x416a5c]
push dword [esi]
call fcn.004058a0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x40d613
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040652b
xor ebx, ebx
cmp dword [0x418674], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x40d6e9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40d7c9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x413fec
push edi
call esi
cmp eax, ebx
je 0x40d7c9
push eax
call fcn.004064bd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x418674], eax
call esi
push eax
call fcn.004064bd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x418678], eax
call esi
push eax
call fcn.004064bd
mov dword [0x41867c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004084f9
test eax, eax
pop ecx
pop ecx
je 0x40d6b7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404d63
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x40d6e9
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004064bd
cmp eax, ebx
pop ecx
mov dword [0x418684], eax
je 0x40d6e9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004064bd
pop ecx
mov dword [0x418680], eax
mov eax, dword [0x418680]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x40d76e
cmp dword [0x418684], ecx
je 0x40d76e
push eax
call fcn.00406534
push dword [0x418684]
mov esi, eax
call fcn.00406534
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x40d76e
cmp edi, ebx
je 0x40d76e
call esi
cmp eax, ebx
je 0x40d73b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d73b
test byte [ebp - 0x18], 1
jne 0x40d76e
lea eax, [ebp - 0x10]
push eax
call fcn.00408530
test eax, eax
pop ecx
je 0x40d756
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404d63
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x40d765
or dword [ebp + 0x10], 0x200000
jmp 0x40d7a9
or dword [ebp + 0x10], 0x40000
jmp 0x40d7a9
mov eax, dword [0x418678]
cmp eax, dword [ebp - 8]
je 0x40d7a9
push eax
call fcn.00406534
cmp eax, ebx
pop ecx
je 0x40d7a9
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40d7a9
mov eax, dword [0x41867c]
cmp eax, dword [ebp - 8]
je 0x40d7a9
push eax
call fcn.00406534
cmp eax, ebx
pop ecx
je 0x40d7a9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x418674]
call fcn.00406534
cmp eax, ebx
pop ecx
je 0x40d7c9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d7cb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push esi
push str.cgm2svg
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x401034
push str.cgm2svg
push str.Unable_to_load_library___s_._n
call fcn.004014dd
add eax, 0x40
push eax
call fcn.0040138e
add esp, 0xc
push 1
call fcn.00401302
push str.CGM2SVGmain
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401066
push str.CGM2SVGmain
push str.Unable_to_find_command_entry___s_._n
call fcn.004014dd
add eax, 0x40
push eax
call fcn.0040138e
add esp, 0xc
push 2
call fcn.00401302
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push edi
push ecx
push edx
call eax
add esp, 8
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call fcn.00401302
pop edi
Function at 0x404cdc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004018e0
xor ebx, ebx
cmp dword [0x40d600], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x404db1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x404d1c
xor eax, eax
jmp 0x404e75
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x404d15
push eax
call fcn.0040187d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40d600], eax
call esi
push eax
call fcn.0040187d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40d604], eax
call esi
push eax
call fcn.0040187d
mov dword [0x40d608], eax
lea eax, [ebp - 8]
push eax
call fcn.0040112f
test eax, eax
pop ecx
pop ecx
je 0x404d7f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040213a
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x404db1
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040187d
cmp eax, ebx
pop ecx
mov dword [0x40d610], eax
je 0x404db1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040187d
pop ecx
mov dword [0x40d60c], eax
mov eax, dword [0x40d60c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x404e2a
cmp dword [0x40d610], esi
je 0x404e2a
push eax
call fcn.004018e9
pop ecx
call eax
cmp eax, ebx
je 0x404df7
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x40d610]
call fcn.004018e9
pop ecx
call eax
test eax, eax
je 0x404df7
test byte [ebp - 0x18], 1
jne 0x404e2a
lea eax, [ebp - 0xc]
push eax
call fcn.00401166
test eax, eax
pop ecx
je 0x404e12
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040213a
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x404e21
or dword [ebp + 0x10], 0x200000
jmp 0x404e5b
or dword [ebp + 0x10], 0x40000
jmp 0x404e5b
mov eax, dword [0x40d604]
cmp eax, esi
je 0x404e5b
push eax
call fcn.004018e9
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x404e5b
mov eax, dword [0x40d608]
cmp eax, esi
je 0x404e5b
push dword [ebp - 4]
push eax
call fcn.004018e9
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x40d600]
call fcn.004018e9
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40515a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40cd20]
jne 0x405164
repz ret
jmp fcn.00407e7f
Function at 0x10009ec3
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp loc.101a8438

Function at 0x1001fe00
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.10033d19
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x1001fe6a
push esi
lea edi, [eax + 0x400]
call fcn.10033d42
push edi
call fcn.10033d19
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x1001fe3a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1001fe86
push ecx
push esi
call fcn.100215f0
add esp, 8
mov ebx, eax
push esi
call fcn.10033d42
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10023ba0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x1004014c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x10023bb3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x10023bf4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x100401f4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x10023c26
mov bl, byte [esp + ecx + 0x4c]
jmp 0x10023c2a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x10023c1b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x10023c48
mov bl, byte [esp + ecx + 0x4c]
jmp 0x10023c4c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x10023c3d
xor ecx, ecx
mov eax, 0x1004015c
xor ebx, ebx
mov bl, byte [ecx + 0x10040204]
cmp byte [esp + ebx + 0x14], 0
je 0x10023c77
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x1004021c]
cmp byte [esp + ebx + 0x14], 0
je 0x10023c8e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x10023c5e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x10023be7
lea edx, [esp + 0x84]
push edx
call fcn.10023cd0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x1005ae7d
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x50], 0x10175920
jmp 0x101700e6
mov al, 0x70
mov al, 0x36
or eax, 0xfcd227e8
call fcn.1013d312
xchg edx, eax
mov ah, 0x9e
pop edx
loop 0x101700e1
cld
call dword [edx - 0x1da5614c]
invalid
outsb dx, byte [esi]
jge 0x101700e9
push 0xffffffffffffffe6
pop ebp
fstp qword [eax - 0x2361f6bc]
cmp ecx, dword [ecx]
sahf
mov bh, 0x71
outsb dx, byte [esi]
jno 0x10170171
dec ebp
cmc
sub edi, ecx
xor byte [edi], ah
loopne 0x10170101
leave
jnp 0x10170148
popfd
push edi
pop ebp
aas
int 0xcf
dec ebx
cmp dword [edi + ecx], ebp
push esi
fbstp tbyte [esi + esi]
insb byte es:[edi], dx
cmp eax, 0xe8c627fb
pushal
sub dword [ecx], ebp
pushal
push ds
cmp eax, dword [ecx]
add eax, 0xf2cdf154
pop ecx
mov ch, 0x40
or al, 0xdd
bound ecx, qword [edi]
jb 0x1017011d
xchg ebx, eax
call 0x55d2285b
int 0xc8
add bh, byte [eax + 0x20]
cwde
push edx
or ebx, dword [edx - 0x2bf7ff3c]
ret 0xed0a
add byte [eax], cl
aam 0xc2
or ch, ch
or dh, byte [ebx + 0x46]
lodsb al, byte [esi]
invalid
inc edx
loope 0x1017018b
jmp 0xfa43f684
les esp, [eax + 0x4707bc99]
pop esp
mov bl, 0xfd
dec edi
dec edx
dec ebp
or eax, 0x28e929f8
cmp al, 0x9b
wait
stosw word es:[edi], ax
imul ecx, esp, 0x4b
jne 0x10170156
pushal
pop ebx
push ecx
mov es, word [ebp + 0x61a9f92]
or byte [edx - 0x1e], bh
invalid

Function at 0x1005bf3f
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 8
cmc
bt cx, cx
stc
mov dword [ebp - 0x10], eax
clc
pushal
cmp dword [ebp - 0x10], 0
jmp 0x100b5948

Function at 0x1005c952
Capabilities:
Packed with generic packer

Disassembly:
cmc
add esp, 4
pushal
btr ecx, esp
shld cx, di, 5
rcr dx, 5
or si, 0x6345
xor eax, eax
lea ecx, [esp + 0x73a20f24]
mov esi, dword [ebp + 8]
pushfd
bswap dx
mov al, byte [esi]
setno dl
not ecx
mov edx, dword [ebp + 0xc]
jmp 0x10060bdb
mov esi, esi
mov byte [esp], 0
mov word [esp], di
mov byte [edx], al
lahf
rdtsc
lea esp, [esp + 4]
popal
lea eax, [0xd00ca83]
lea eax, [eax - 0x3607c085]
mov eax, 1
pushal
pushfd
mov byte [esp + 0xc], bh
push 0x52ea6c5
lea esp, [esp + 0x28]
jmp loc.10003abd

Function at 0x1005e5c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0x21
mov byte [esp], ah
lea esp, [esp + 8]
je 0x1017a0df
jmp 0x101050f9
lea esp, [esp + 0x24]
call fcn.1001ea1b
jmp 0x100c3dd8
stc
bt esi, 0x12
pushfd
add esp, 8
jmp 0x1014068a
pushal
pushfd
push dword [esp]
mov dword [esp + 0x24], 6
jmp 0x1007d144
stc
test cx, 0xaf13
mov dword [ebp - 0x10], eax
push 0xfe9889e0
pushfd
cmp dword [ebp - 0x10], 0
jmp 0x101498e6
jmp 0x10197cda
mov word [esp], di
lea esp, [esp + 8]
jne 0x1019dbbc
lea eax, [esi*4 + 0xa962f8a]
mov eax, 0
push 0xf7c40ab9
push edi
lea esp, [esp + 8]
jmp loc.1001d61a

Function at 0x1005e744
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x101a45e0
lea esp, [esp + 4]
je 0x1011765d
call fcn.10173fdb
Function at 0x10060d99
Capabilities:
Packed with generic packer

Disassembly:
test dl, dl
cmp edx, eax
cmp dword [ebp - 0x10], 0
push ebx
lea esp, [esp + 8]
je 0x100e26a5
push 0x4eccc009
clc
cmp bh, ch
mov byte [esp], dl
add esp, 4
pushal
cdq
mov ecx, dword [ebp + 8]
bsf bx, di
aaa
mov edx, dword [ebp + 0xc]
das
mov byte [ecx], 0xe9
lea eax, [ecx - 0x2f23a8ba]
pushal
bts bp, si
sub edx, ecx
and al, 0xaf
pushal
lea eax, [esi - 0x2fba405a]
sub edx, 5
daa
add ecx, 1
movzx di, cl
bswap ebx
mov dword [ecx], edx
jmp 0x1007424c
jmp 0x100fcec9
not si
lea esp, [esp + 0x40]
popal
movzx ax, cl
bswap ax
lea eax, [ecx*4 + 0x3c43e05f]
mov dword [ebp - 8], esp
lahf
lea eax, [ebp - 4]
call fcn.1009e290

Function at 0x1006438f
Capabilities:
Packed with generic packer

Disassembly:
mov esi, dword [esp + 0xc]
lea edi, [ebx - 0x306fbcf1]
not di
not edi
call fcn.10088add

Function at 0x10071165
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0x1017a0df
push edx
mov byte [esp], bl
pushal
call fcn.100dcb9a
Function at 0x10071fa8
Capabilities:
Encode data using xor

Disassembly:
aam 0x6b
push esp
out dx, eax
fsub dword [eax]
cmp ebx, esp
or eax, 0xff60aa66
sbb dword [edx + 0x4f2d2c45], eax
test al, 0xa5
sub dword ss:[edi + 0x47d2a4c3], edi
mov bh, 0x9a
rol dword [ecx], 0xc
out dx, eax
push ss
inc edx
xchg dword [ebx + 0x246924e0], ebx
adc ecx, esi
pop edi
push ds
cmpsd dword [esi], dword es:[edi]
push ebx
xor al, 0x6e
les ebx, [ecx - 0x1f028582]
outsb dx, byte [esi]
inc byte [ebx]
add ecx, dword [ecx + 0x1e]
push ebx
fst dword [ecx + 0x1a]
in al, dx
dec ecx
add al, 0x30
adc byte [edx], al
pop edi
fld xword [ecx - 0x71]
invalid
add bl, byte [edi - 0x25]
imul ecx, dword [edi - 0x2d482499], 0x168574d8
xchg esi, eax
push ds
push 0xa6ac100a
dec esi
loopne 0x10071f45
js 0x10071edc
nop
push es
std
mov ecx, 0x6ef008d9
sti
pop edi
sbb eax, dword [ecx - 0x23]
or eax, 0x4e86c253
mov dword [0xc894af83], eax
stosb byte es:[edi], al
xor byte [ecx - 0x557c5e60], bl
add byte [0x7dcba6ca], cl
scasd eax, dword es:[edi]
inc ebx
into
test dword [edi + 0x229ce168], edi
or dh, byte [edi]
adc al, 0x2a
xchg esi, eax
push ds
pop ds
inc edi
push edi
mov byte [0x746e5699], al
out 0x64, eax
add dword [esi], eax
out dx, al
or byte [eax], dl
in al, dx
lodsd eax, dword [esi]
sbb byte [esi + 0x6e], bh
test dword [edx + edx*4 + 0x20], esp
inc edx
pop eax
mov esp, 0xcdc21788
xchg edx, eax
push cs
sal byte [ebx], 0x1e
sbb al, 0x2a
aas
out dx, eax
sub al, 0xe2
ja 0x10071f24
pop ss
lcall 0x3080, 0xe8604403
or dword [eax], eax
push edx
mov dword [edi], ebx
lea eax, [esp - 0x6f276cc8]
pop eax
mov eax, 0x421750
mov word [esp], 0x70e8
push 0x9c8822db
mov byte [esp], bl
mov dword [esp + 0x3c], 0x100dbffa
call fcn.1009f887
scasb al, byte es:[edi]
loopne 0x10071f98
call 0x88af40b3
xor eax, 0x16376369
dec ebx
shl byte [ecx + 0x32], 1
xchg esp, eax
out dx, eax
dec ebp
inc dword [esi + edi*8 - 0x787881a5]
test byte [edi + 0x4d3ff34d], ah
xor dword [eax + 0x7ac8dae6], esi
insb byte es:[edi], dx
fild qword [ebx - 0x76]
das
mov esp, 0x5d743c7a
or al, 0x9f
xor ebx, edx
jnp 0x10071ffa
dec eax
imul ebp, dword [0x91c5230c], 0x3c787881
ja 0x10071ff4
scasd eax, dword es:[edi]
mov dl, 0x74
cmp dword [ebx], edx
imul ecx
fimul dword [eax + edi]
push ds
dec ebx
or eax, 0x8d27abb5
sbb cl, byte [eax + ebp*2 + 0x50d8b0e]
cmp esi, dword [esi]
test eax, 0x8b0fd90a
mov eax, dword [0x43cd7d94]
mov ebp, 0x8cb56ff3
invalid
Function at 0x1007620b
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
popal
call fcn.1008bed0
pushfd
push eax
mov dword [esp + 4], 0x40bdd451
mov byte [esp], 0x2f
call fcn.10095da8
pushal
mov eax, 0
pushfd
lea esp, [esp + 0x24]
jmp fcn.1000a4a3
jmp 0x100f8226
pushal
pushal
mov dword [esp + 0x3c], 0x80000301
lea ebx, [edi + 0x5dbab407]
mov dword [esp + 0x38], 0
lea esp, [esp + 0x38]
jp 0x101698e1
lea ebx, [eax*2 + 0x208745d8]
mov bl, bh
movsx bx, al
push dword [ebp + 0x10]
pushal
pushal
bswap ebx
jmp 0x100bd7fc
jmp 0x101104e7
lea esp, [esp + 4]
je 0x1006a64e
jmp 0x100a54e0
mov dword [esp + 0x3c], 1
lea ebx, [esi*4 + 0xdf5b3c7]
mov ebx, 0x1bc
pushfd
mov byte [esp], cl
mov byte [esp + 4], ah
push edi
lea esp, [esp + 0x44]
call fcn.1001f730
shr bx, 0xf
add esp, 0x10
ror bx, 1
and bx, bx
rcl ebx, cl
neg bx
mov dword [ebp - 4], eax
push 0x3c252358
rol al, 6
rcr bh, cl
clc
mov eax, dword [ebp - 4]
cmp cx, cx
mov dword [esp], eax
shrd bx, bp, cl
sub bh, 0x68
mov ebx, dword [ebp + 0xc]
stc
mov ebx, dword [ebx]
jmp 0x1016952e
cmp dword [ebp - 0xc], 1
mov byte [esp], ch
mov word [esp], si
jmp 0x101602bf
cld
mov dword [ebx], eax
std
mov byte [esp], 0x96
pushal
lea esp, [esp + 0x24]
pushal
push edx
pop ebx
cld
push edi
mov ecx, dword [ebp + 0x10]
shr di, cl
rcr si, 9
daa
push ebp
mov esi, dword [ebp + 8]
shr edi, cl
jmp 0x101921a2
mov dword [esp + 0x1c], ebx
push 0xb2efd178
mov byte [esp + 8], 0x6e
lea esp, [esp + 0x20]
call fcn.1001ea15
lea ebx, [ebp - 0x17a40177]
add esp, 4
not al
pop eax
jmp 0x101344ba
mov ebx, dword [ebp + 0xc]
pushfd
jmp 0x100b0304
jmp 0x100b2055
stc
test ebx, ebx
pushfd
lea esp, [esp + 4]
je 0x10115a41
pushal
jmp 0x10115a21
movsx ebx, bl
push esp
movsx bx, dl
movsx bx, cl
push dword [ebp + 0x10]
pop dword [esp]
movsx bx, cl
mov bl, 0xd7
movsx bx, bl
push 1
movzx ebx, dl
mov ebx, 0x1bc
call fcn.1015eec3
mov dh, 0x87
pop ebp
sub edi, dword [ebx - 0xf]
outsb dx, byte [esi]
sub eax, 0xea59f632
sub ah, ah
sbb edx, ebp
mov es, edx
invalid
mov edi, dword [ebp + 0xc]
pop ebp
cdq
aad 0x81
sal dh, 1
mov edi, dword [edi]
cdq
add edi, 8
lea ebx, [esp - 0x103b7a8b]
rep movsb byte es:[edi], byte [esi]
not ecx
movsx ebx, bl
lahf
jmp 0x10064912

Function at 0x100873c7
Capabilities:
Packed with generic packer

Disassembly:
xchg ah, dl
not eax
not al
lea esp, [esp + 0xc]
popal
movsx ax, cl
pushfd
not ah
lahf
mov eax, 1
mov byte [esp], dh
push 0x4adb166c
pushal
lea esp, [esp + 0x28]
jmp loc.10003abd

Function at 0x100921fa
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ebx
pushal
lea esp, [esp + 0x34]
pushal
jns 0x10062dc0
pushal
mov ecx, 0x4057f38c
cld
btr cx, 4
sar cl, 3
rdtsc
mov ecx, dword [ebp + 0x10]
bswap ax
mov esi, dword [ebp + 8]
or bx, bp
aad 0x45
sub di, 0x60e8
not di
mov edi, dword [ebp + 0xc]
xadd ax, dx
or ah, 0xb5
aaa
mov edi, dword [edi]
aad 0x2e
rdtsc
add edi, 8
pop edx
movsx ebp, al
setbe dh
rep movsb byte es:[edi], byte [esi]
cdq
movzx ax, cl
lea esp, [esp + 0x1c]
popal
push ecx
mov byte [esp], 0x8b
bswap ax
pushfd
mov eax, 1
mov word [esp + 4], di
mov byte [esp], bh
push 0x65b155da
lea esp, [esp + 0xc]
jmp loc.10015382