joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d2c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
push esi
push 0x103
lea eax, [ebp - 0x127]
mov word [ebp - 0x1c], 0x4f53
push 0
push eax
mov dword [ebp - 0x17], 0x5c455241
mov byte [ebp - 0x13], 0
mov word [ebp - 0x19], 0x5754
mov byte [ebp - 0x1a], 0x46
mov dword [ebp - 7], 0x732573
mov byte [ebp - 8], 0x25
mov byte [ebp - 0x128], 0
call fcn.1000bef0
add esp, 0xc
mov eax, 0x18
call fcn.1000bd60
mov esi, esp
test esi, esi
je 0x1002d340
push 0
push 0
push 0x18
push esi
push 0xffffffffffffffff
push str.RSpeedupTab
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x1002d342
xor eax, eax
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x128]
push 0x104
push eax
call fcn.10002bd4
add esp, 0x18
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x128]
push eax
sub esp, 8
call fcn.1002cbe0
mov esi, dword [ebp + 8]
add esp, 0xc
test eax, eax
jne 0x1002d444
push 0x103
lea eax, [ebp - 0x32f]
mov byte [ebp - 0x330], 0
push 0
push eax
call fcn.1000bef0
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x24]
add esp, 0xc
mov dword [ebp - 0xe], 0x736c61
lea edx, [ebp - 0x10]
mov word [ebp - 0x10], 0x7668
push eax
lea eax, [ebp - 0x330]
push eax
sub esp, 8
call fcn.1002cdb0
add esp, 0x10
test eax, eax
jne 0x1002d43c
cmp dword [ebp - 0x24], eax
jbe 0x1002d43c
push 0x103
push eax
mov byte [ebp - 0x22c], al
lea eax, [ebp - 0x22b]
push eax
call fcn.1000bef0
push esi
lea eax, [ebp + 8]
mov word [ebp + 8], 0x6425
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x22c]
mov byte [ebp + 0xa], 0
push 0x104
push eax
call fcn.10002bd4
add esp, 0x20
lea edx, [ebp - 0x22c]
lea ecx, [ebp - 0x330]
call fcn.1002c7d0
test eax, eax
je 0x1002d43c
mov ecx, dword [ebp - 0x20]
call fcn.1002cb80
mov eax, 1
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x20]
call fcn.1002cb80
push esi
call dword [0x1005f970]
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1002d490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
push esi
push 0x103
lea eax, [ebp - 0x127]
mov dword [ebp - 0x1a], 0x41575446
push 0
push eax
mov word [ebp - 0x1c], 0x4f53
mov dword [ebp - 0x16], 0x5c4552
mov word [ebp - 8], 0x7325
mov word [ebp - 5], 0x73
mov byte [ebp - 6], 0x25
mov byte [ebp - 0x128], 0
call fcn.1000bef0
add esp, 0xc
mov eax, 0x18
call fcn.1000bd60
mov esi, esp
test esi, esi
je 0x1002d50e
push 0
push 0
push 0x18
push esi
push 0xffffffffffffffff
push str.RSpeedupTab
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x1002d510
xor eax, eax
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x128]
push 0x104
push eax
call fcn.10002bd4
add esp, 0x18
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x128]
push eax
sub esp, 8
call fcn.1002cbe0
mov esi, dword [ebp + 8]
add esp, 0xc
test eax, eax
jne 0x1002d60f
push 0x103
lea eax, [ebp - 0x32f]
mov byte [ebp - 0x330], 0
push 0
push eax
call fcn.1000bef0
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x24]
add esp, 0xc
mov dword [ebp - 0xe], 0x736c61
lea edx, [ebp - 0x10]
mov word [ebp - 0x10], 0x7668
push eax
lea eax, [ebp - 0x330]
push eax
sub esp, 8
call fcn.1002cdb0
add esp, 0x10
test eax, eax
jne 0x1002d607
cmp dword [ebp - 0x24], eax
jbe 0x1002d607
push 0x103
push eax
mov byte [ebp - 0x22c], al
lea eax, [ebp - 0x22b]
push eax
call fcn.1000bef0
push esi
lea eax, [ebp + 8]
mov word [ebp + 8], 0x6425
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x22c]
mov byte [ebp + 0xa], 0
push 0x104
push eax
call fcn.10002bd4
add esp, 0x20
lea edx, [ebp - 0x22c]
lea ecx, [ebp - 0x330]
call fcn.1002c7d0
test eax, eax
je 0x1002d607
mov ecx, dword [ebp - 0x20]
call fcn.1002cb80
mov eax, esi
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x20]
call fcn.1002cb80
push esi
call dword [0x1005f990]
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1002d660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
push esi
push 0x103
lea eax, [ebp - 0x127]
mov dword [ebp - 0x1b], 0x5754464f
push 0
push eax
mov dword [ebp - 0x17], 0x5c455241
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x13], 0
mov word [ebp - 8], 0x7325
mov word [ebp - 5], 0x73
mov byte [ebp - 6], 0x25
mov byte [ebp - 0x128], 0
call fcn.1000bef0
add esp, 0xc
mov eax, 0x18
call fcn.1000bd60
mov esi, esp
test esi, esi
je 0x1002d6e0
push 0
push 0
push 0x18
push esi
push 0xffffffffffffffff
push str.RSpeedupTab
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x1002d6e2
xor eax, eax
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x128]
push 0x104
push eax
call fcn.10002bd4
add esp, 0x18
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x128]
push eax
sub esp, 8
call fcn.1002cbe0
mov esi, dword [ebp + 8]
add esp, 0xc
test eax, eax
jne 0x1002d7eb
push 0x103
lea eax, [ebp - 0x32f]
mov byte [ebp - 0x330], 0
push 0
push eax
call fcn.1000bef0
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x24]
add esp, 0xc
mov word [ebp - 0xd], 0x736c
lea edx, [ebp - 0x10]
mov word [ebp - 0x10], 0x7668
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xe], 0x61
push eax
lea eax, [ebp - 0x330]
push eax
sub esp, 8
call fcn.1002cdb0
add esp, 0x10
test eax, eax
jne 0x1002d7e3
cmp dword [ebp - 0x24], eax
jbe 0x1002d7e3
push 0x103
push eax
mov byte [ebp - 0x22c], al
lea eax, [ebp - 0x22b]
push eax
call fcn.1000bef0
push esi
lea eax, [ebp + 8]
mov word [ebp + 8], 0x6425
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x22c]
mov byte [ebp + 0xa], 0
push 0x104
push eax
call fcn.10002bd4
add esp, 0x20
lea edx, [ebp - 0x22c]
lea ecx, [ebp - 0x330]
call fcn.1002c7d0
test eax, eax
je 0x1002d7e3
mov ecx, dword [ebp - 0x20]
call fcn.1002cb80
mov eax, 1
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x20]
call fcn.1002cb80
push esi
call dword [0x1005f950]
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1002d830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
push esi
push 0x103
lea eax, [ebp - 0x127]
mov word [ebp - 0x1a], 0x5446
push 0
push eax
mov word [ebp - 0x14], 0x5c
mov word [ebp - 0x17], 0x5241
mov word [ebp - 0x1c], 0x4f53
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0x18], 0x57
mov dword [ebp - 8], 0x73257325
mov byte [ebp - 4], 0
mov byte [ebp - 0x128], 0
call fcn.1000bef0
add esp, 0xc
mov eax, 0x18
call fcn.1000bd60
mov esi, esp
test esi, esi
je 0x1002d8b5
push 0
push 0
push 0x18
push esi
push 0xffffffffffffffff
push str.RSpeedupTab
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x1002d8b7
xor eax, eax
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x128]
push 0x104
push eax
call fcn.10002bd4
add esp, 0x18
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x128]
push eax
sub esp, 8
call fcn.1002cbe0
mov esi, dword [ebp + 8]
add esp, 0xc
test eax, eax
jne 0x1002d9b9
push 0x103
lea eax, [ebp - 0x32f]
mov byte [ebp - 0x330], 0
push 0
push eax
call fcn.1000bef0
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x24]
add esp, 0xc
mov dword [ebp - 0xe], 0x736c61
lea edx, [ebp - 0x10]
mov word [ebp - 0x10], 0x7668
push eax
lea eax, [ebp - 0x330]
push eax
sub esp, 8
call fcn.1002cdb0
add esp, 0x10
test eax, eax
jne 0x1002d9b1
cmp dword [ebp - 0x24], eax
jbe 0x1002d9b1
push 0x103
push eax
mov byte [ebp - 0x22c], al
lea eax, [ebp - 0x22b]
push eax
call fcn.1000bef0
push esi
lea eax, [ebp + 8]
mov word [ebp + 8], 0x6425
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x22c]
mov byte [ebp + 0xa], 0
push 0x104
push eax
call fcn.10002bd4
add esp, 0x20
lea edx, [ebp - 0x22c]
lea ecx, [ebp - 0x330]
call fcn.1002c7d0
test eax, eax
je 0x1002d9b1
mov ecx, dword [ebp - 0x20]
call fcn.1002cb80
mov eax, 1
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, dword [ebp - 0x20]
call fcn.1002cb80
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [0x1005f958]
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x1002da40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.1002cfa0
test eax, eax
je 0x1002da83
lea ecx, [ebp - 0x14]
mov word [ebp - 0xf], 0x6957
push ecx
push eax
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 0xd], 0x776f646e
mov dword [ebp - 7], 0x706f54
mov byte [ebp - 0x10], 0x67
mov word [ebp - 9], 0x6f54
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1002dac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.1002cfa0
test eax, eax
je 0x1002db01
lea ecx, [ebp - 0x10]
mov dword [ebp - 5], 0x776f646e
push ecx
push eax
mov dword [ebp - 0xb], 0x65766974
mov dword [ebp - 0x10], 0x41746553
mov word [ebp - 7], 0x6957
mov byte [ebp - 1], 0
mov byte [ebp - 0xc], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1002db40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.1002cfa0
test eax, eax
je 0x1002db8f
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x11], 0x65726f46
push ecx
push eax
mov dword [ebp - 5], 0x776f646e
mov dword [ebp - 0xa], 0x57646e75
mov word [ebp - 0x14], 0x6553
mov word [ebp - 0xd], 0x7267
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xb], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1002dbd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.1002cfa0
test eax, eax
je 0x1002dc0e
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xf], 0x69577465
push ecx
push eax
mov dword [ebp - 8], 0x736f5077
mov word [ebp - 0xb], 0x646e
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 4], 0
mov byte [ebp - 9], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1002e1c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [0x1005f934], 0
jne 0x1002e1e7
call fcn.1002cb10
mov edx, 0x100
mov ecx, 0x1005f9a0
call fcn.1002c5d0
mov dword [0x1005f934], 1
jmp fcn.1002c570

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
mov ecx, 0x6be11555
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
mov eax, section..text
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x7ba132e3
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x42e003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x46e236c7
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x518d33ff
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100374a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x100374cb
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [ebp - 8]
push eax
mov eax, esi
call sym.ScCore.dll_public_virtual:_int___thiscall_ScCore::LiveObject::put_int__class_ScCore::Variant_const___class_ScCore::Error__
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
je 0x100374f9
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x100374f2
mov eax, esi
mov dword [ebp - 4], eax
jmp 0x100374f5
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1003750b
lea ecx, [ebp - 8]
push ecx
push 0x10037470
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xae91df
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, reloc.MSVCRT.dll_strncpy
mov dx, 0xe761
bts dx, cx
add ax, 0x64e5
call fcn.00ae9113
or edx, 0x12c8fb53
jge 0xae9169
inc al
jmp 0xae91ad
inc al
jmp 0xae91ad
bsr eax, esi
cmc
xchg dword [esp], ebp
mov ah, cl
xchg al, bh
lea ebx, [edi + 0xc5]
jmp 0xae9129
rdtsc
jmp 0xae91be
mov dx, word [esp]
mov dx, ax
jmp 0xae91c5
sub edi, 0x542fbb3e
clc
jl 0xae9193
rdtsc
jmp 0xae9197
mov dx, word [esp]
mov dx, ax
ror edi, 0
rdtsc
jmp 0xae91fc
mov ah, ch
mov ax, cx
jmp 0xae9180
mov dx, 0x188b
seto dh
jmp 0xae9224
bsr eax, ecx
jb 0xae91e6
mov dx, 0x188b
seto dh
bt bx, bx
not ebx
mov ah, 0x81
jmp 0xae92d8
bt bx, bx
not ebx
mov ah, 0x81
jmp 0xae92d8
add edi, dword [esi]
mov al, byte [esp]
lea ebx, [ebx + esi]
lea ebx, [ebx + ebp]
jmp fcn.00ae924d
inc edi
mov bh, 8
mov ah, al
mov ebx, dword [esp]
jmp 0xae926c
Function at 0xae953d
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ebx, byte [edi]
jmp 0xae9256
mov dx, word [esp]
xchg dx, ax
not edx
ror dx, 2
jmp 0xae927d
jbe 0xae9293
push edx
sub esp, 0
jmp 0xae92b8
push edx
sub esp, 0
mov dx, 0x2a7e
push dword [esp]
not dl
bsf eax, ebp
jmp 0xae92f8
mov dx, 0x2a7e
push dword [esp]
not dl
jmp 0xae92a0
add bl, cl
xchg dx, ax
bt eax, esp
jmp 0xae9b60
bt eax, ebx
je 0xae92e2
jne 0xae92e2
lea edx, [ebx*4]
mov al, bl
lea edx, [edi + 0xf4]
jmp 0xae9722
inc al
lea edx, reloc.MSVCRT.dll_strncpy
call 0xae9342
scasd eax, dword es:[edi]
bswap edx
mov dx, ax
mov word [esp + 1], ax
jmp 0xae94f4
xchg dh, dl
cmp edx, 0xf71fa36a
jmp 0xae9334
shl edx, 0xc
neg dl
xchg dh, dl
jmp 0xae9394
shl edx, 0xc
neg dl
xchg dh, dl
not dx
call fcn.00ae936d
or dword [esi - 9], esp
shr bl, cl
cmc
not dx
jmp 0xae938e
lea esp, [esp + 0xc]
jmp 0xae93d4
setne dl
rol al, 0
jbe 0xae9384
ja 0xae9364
add dx, si
jmp 0xae9410
xor al, 0xa1
bswap edx
bsf dx, bp
jp 0xae93be
add dx, si
bsr dx, dx
jmp 0xae9414
not edx
push ecx
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0xae93b4
mov dl, bh
rol dx, cl
jo 0xae9434
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0xae941e
bsr dx, dx
ror al, 0
lea edx, [ecx + edi]
not edx
jmp 0xae93f8
neg dl
bswap edx
jmp 0xae943e
lea edx, reloc.MSVCRT.dll_strncpy
neg dl
bswap edx
add cl, al
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0xae9462
mov dh, byte [esp]
jmp 0xae949a
xchg al, dh
bsf ax, cx
jnp 0xae9448
mov dh, byte [esp]
jmp 0xae944b
jmp 0xae93ed
xchg edx, eax
lea edx, [edi + edi]
mov edx, 0x26c02827
stc
xchg al, dh
rdtsc
jmp 0xae94a5
inc edi
inc edx
jo 0xae9484
xchg edx, eax
jmp 0xae94bb
xchg al, dh
jmp 0xae9490
mov dl, 0x7b
clc
jb 0xae94dc
jae 0xae94dc
inc ecx
fimul dword [eax + 0x2f]
fisubr dword [ebx - 0x5f]
aas
scasd eax, dword es:[edi]
retf 0x8139
lea edx, [edi + edi]
mov edx, 0x26c02827
stc
jmp 0xae94a1
sub dx, 0xc7c3
jo 0xae95d2
lea edx, [ebx + ebx]
xchg dx, ax
jmp 0xae952b
neg bl
xchg ah, al
jmp 0xae94c6
bswap edx
xchg byte [esp + 1], dl
ror al, 0
clc
jb 0xae947f
not edx
push ecx
lea edx, reloc.MSVCRT.dll_strncpy
setne dl
jmp 0xae93b7
btc edx, esi
jge 0xae9532
mov dl, byte [esp]
jmp 0xae9535
mov edx, dword [esp]
mov edx, eax
jmp 0xae955a
mov dl, byte [esp]
inc bl
call 0xae953d
mov al, 0xeb
cmp dl, bl
ljmp 0xc2a7
mov edx, dword [esp]
mov edx, eax
not bl
mov eax, 0x93734ff1
jmp 0xae9515
lea edx, [ebx + ebx]
xchg dx, ax
jmp 0xae9555
clc
jp 0xae935a
xchg dh, dl
cmp edx, 0xf71fa36a
jmp 0xae9334
jnp 0xae92ff
lea edx, [ebx*4]
jmp 0xae9306

Function at 0xaed1bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
pop dword [esp + 0x15]
mov dword [esp + 0x48], edx
call fcn.00aed1a3

Function at 0xaed1cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xaed20d
lea esp, [esp + 2]
mov dword [esp + 0x48], esp
jmp 0xaed1f7
push word [esp + 1]
jne 0xaed1cf
lea esp, [esp + 2]
mov dword [esp + 0x48], esp
pushfd
mov dword [esp + 0x48], ebp
pushfd
jmp 0xaed252
Function at 0xaed437
Capabilities:
Execute anti-debugging instructions

Disassembly:
ja 0xaed3dd
mov byte [esp + 5], dl
lea esp, [esp + 1]
jmp 0xaed404
mov byte [esp + 5], dl
lea esp, [esp + 1]
mov bl, byte [esp]
mov bh, al
bswap edx
mov dl, 0x5a
jmp 0xaed40d
mov bl, byte [esp]
mov bh, al
bswap edx
jmp 0xaed3ec
mov ebx, 0xea1f5744
mov dx, word [esp]
jmp 0xaed42e
ror edi, 0
call 0xaed437
aaa
mov ax, 0xcd6d
xchg edx, eax
mov ebx, ebp
bts eax, esi
jmp 0xaed49d
mov ecx, edi
mov dh, al
sub esp, 0xd
jmp 0xaed3c7
xchg ebx, edx
rdtsc
not ebx
rdtsc
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0xaed481
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0xaed4eb
mov dh, byte [esp]
ror edi, 0
stc
jo 0xaed4bf
jno 0xaed4a9
inc ecx
enter 0x395e, 0xffffffffffffffc8
or eax, 0x9cf565e9
outsd dx, dword [esi]
scasd eax, dword es:[edi]
adc al, 0x87
cmp dword cs:[eax], ebx
jb 0xaed4dc
mov eax, 0xb5c30ba0
xchg dword [esp], eax
jmp 0xaed478
mov eax, 0x2a258c63
rcr dl, 4
or eax, 0xf747b63
jmp 0xaed50b
mov eax, 0x2a258c63
rcr dl, 4
or eax, 0xf747b63
rdtsc
jmp 0xaed4f5
mov eax, 0xb5c30ba0
xchg dword [esp], eax
sub esp, 0x1e
lea esp, [esp + 2]
lea esp, [esp + 0x20]
inc edi
jmp 0xaed462
ror edi, 0
bsr dx, di
js 0xaed50f
not bh
jmp 0xaed511
rdtsc
jmp 0xaed4f5
not bh
call fcn.00aed53d
mov ebx, dword [esp]
lea eax, [ebx + edi]
sub bx, 0x89cd
jmp 0xaed55f
ror dl, 1
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0xaed98b
jle 0xaed53f
ror dl, 1
lea esp, [esp + 2]
jmp 0xaed9ae
jmp 0xaed9ca
xor edi, 0x4096fc15
mov ebx, 0xc3caa4c8
dec eax
jno 0xaed975
jo 0xaed975
invalid
lea esp, [esp + 2]
jmp 0xaed98b
add edi, dword [esi]
mov dx, 0x5328
mov eax, ebx
lea ebx, [esp - 0x68]
lea ebx, [ebp - 0x56]
jmp 0xaed9b4

Function at 0xaf5542
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jmp 0xadbdb2
mov eax, 1
invalid
lea ebp, [edx*4]
mov ebp, dword [esp + 0xc]
lea esp, [esp + 0x10]
jmp 0xadbda7
mov dword [esp], esi
mov ebp, dword [esp + 1]
jmp 0xaf552c

Function at 0xb25b8c
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
mov dword [esi], ebp
pop ebp
pop esi
call fcn.00b25b63
mov dword [eax + 8], reloc.MSVCRT.dll_strncpy
jmp 0xb25bf2
mov dword [eax + 0xc], reloc.MSVCRT.dll_strncpy
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0xb39a72
Capabilities:
Encode data using xor

Disassembly:
mov bx, word [esp + 3]
mov ebx, 0x3000
lea esp, [esp + 4]
push ebx
call fcn.00b38c68
neg bx
push 4
bt bx, dx
mov ebx, 0xf99da70
push esp
jmp 0xb38c7e
add ecx, dword [ebp - 4]
mov eax, dword [0xae6c40]
lea ebx, [ebx + ebp]
mov eax, dword [eax + 0x24]
jmp 0xb38cb3
mov ecx, dword [esi]
pop esi
mov ebx, dword [esp]
xchg bx, ax
lea eax, [ecx + edi]
jmp 0xb38da9
mov eax, esi
mov ax, 0x54c
push esi
mov esi, edi
jmp 0xb39020
lea esp, [esp + 2]
lea esp, [esp + 4]
test edi, edi
je 0xb38a12
jne 0xb3918b
add esi, eax
push si
mov word [esp], bx
jmp 0xb392c3
Function at 0xbdc21d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 6]
sub eax, 0x8c2c0ef9
sbb dl, cl
cmc
jmp 0xbdc21f
jmp 0xbdc207
mov ebp, 0x68beb4ca
pop word [esp + 0xd]
lea ebp, [edx*4]
jmp 0xbdc24d

Function at 0xbdc641
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
rdtsc
pop edx
std
mov edx, 0xe08ac41a
neg ebp
jmp 0xbdc511
mov word [esp + 0x2b], bx
bswap edx
std
pop edx
mov byte [esp + 0x1f], ah
mov bp, 0xf22f
jmp 0xbdc489
lea esp, [esp]
cld
mov bp, sp
mov byte [esp + 0x27], cl
stc
xchg dword [esp + 0x1f], eax
jmp 0xbdc49f
bswap eax
mov edx, 0x7021472b
mov eax, ecx
mov ebp, 0x373f48c8
jmp 0xbdc58c
xchg word [esp + 0x14], bp
lea edx, [ebx + edi]
mov bp, word [esp + 0x31]
xchg word [esp + 0x21], bp
mov dh, 0x37
inc ebp
jmp 0xbdc4d9
sub esp, 5
mov bp, word [esp + 0x24]
push dword [esp + 0x1c]
sub esp, 0xd
bsr eax, ecx
push word [esp + 0x31]
jmp 0xbdc4ef
add esp, 2
setb dh
cmc
add dl, 0xdb
mov al, byte [esp]
rdtsc
jmp 0xbdc569
cmc
mov al, bh
pushfd
push word [esp + 3]
pop dx
mov dword [esp], esp
jmp 0xbdc52a
mov eax, edi
and dl, al
xchg dx, ax
lea ebp, [esi + edi]
mov ah, bh
bsr ebp, ecx
jmp 0xbdc540
clc
lea edx, [ebp*4]
lea eax, [esi*4]
mov byte [esp], bl
rdtsc
lea eax, [esi + ebp]
jmp 0xbdc5dc
mov eax, 0x13a24d8c
sub esp, 0x1e
lea esp, [esp + 0x5d]
stc
cmc
mov ebp, ebx
jmp 0xbdc559
mov dx, word [esp]
cmp dx, bp
xchg byte [esp], dl
shl ah, 2
setns dl
bsf ebp, ecx
call fcn.00bdc5b4
lea ebp, [ecx + ebx]
jmp 0xbdc4c7

Function at 0xbdc940
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, word [esp + 3]
bswap edx
mov ecx, dword [esp + 2]
jmp 0xbdc963
Function at 0x4123a3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040ae14
and dword [ebp - 4], 0
cmp dword [0x422444], 0
mov ebx, eax
jne 0x412454
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x412505
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x412505
push eax
call fcn.0040ada2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x422444], eax
call esi
push eax
call fcn.0040ada2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x422448], eax
call esi
push eax
call fcn.0040ada2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42244c], eax
call esi
push eax
call fcn.0040ada2
pop ecx
mov dword [0x422454], eax
test eax, eax
je 0x412454
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040ada2
pop ecx
mov dword [0x422450], eax
mov eax, dword [0x422450]
cmp eax, ebx
je 0x4124ac
cmp dword [0x422454], ebx
je 0x4124ac
push eax
call fcn.0040ae1d
push dword [0x422454]
mov esi, eax
call fcn.0040ae1d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4124ac
test edi, edi
je 0x4124ac
call esi
test eax, eax
je 0x4124a3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4124a3
test byte [ebp - 0xc], 1
jne 0x4124ac
or dword [ebp + 0x10], 0x200000
jmp 0x4124e5
mov eax, dword [0x422448]
cmp eax, ebx
je 0x4124e5
push eax
call fcn.0040ae1d
pop ecx
test eax, eax
je 0x4124e5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4124e5
mov eax, dword [0x42244c]
cmp eax, ebx
je 0x4124e5
push eax
call fcn.0040ae1d
pop ecx
test eax, eax
je 0x4124e5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x422444]
call fcn.0040ae1d
pop ecx
test eax, eax
je 0x412505
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x412507
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x121e6258
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0xd443abc
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
jmp 0x401219