joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007b23e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1007b276
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.100792e5
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.100792bd
jmp 0x1007b282
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x1007c92f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x1007c971
call fcn.100822d0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x1007c971
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1007c968
xor eax, eax
jmp 0x1007c979
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1007c97f
pop edi
pop esi
pop ebx
ret 4
Function at 0x1002803d
Capabilities:
Parse pe header

Disassembly:
jmp 0x100281a9
jmp 0x10028059
pushal
jmp 0x10028075
not cl
jmp 0x10028091
popal
jmp 0x100280ad
push bp
jmp 0x100280c9
mov word [esp], si
jmp 0x100280e5
lea esp, [esp + 1]
jmp 0x10028101
lea esp, [esp]
jmp 0x1002811d
pushal
jmp 0x10028139
mov byte [esp + 0x1e], dl
jmp 0x10028155
lea esp, [esp + 1]
jmp 0x10028171
lea esp, [esp + 0x20]
jmp 0x1002818d
lea esp, [esp + 4]
jmp 0x10027c85
jmp 0x100281c5
pushal
jmp 0x100281e1
push esp
jmp 0x100281fd
lea esp, [esp + 4]
jmp 0x10028219
popal
jmp 0x10028235
push eax
jmp 0x10028251
push word [esp + 1]
jmp 0x1002826d
pushal
jmp 0x10028289
pop dword [esp + 8]
jmp 0x100282a5
pop word [esp + 0xa]
jmp 0x100282c1
pop word [esp + 0x11]
jmp 0x100282dd
mov word [esp + 9], bx
jmp 0x100282f9
lea esp, [esp + 9]
jmp 0x10028315
pop dword [esp + 5]
jmp 0x10028331
push ebx
jmp 0x1002834d
lea esp, [esp + 1]
jmp 0x100e0860
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100e08a9
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
bswap ebp
mov bp, word [esp]
pushal
pop ebp
pop dword [esp + 3]
bswap ebp
bswap bp
pop bp
mov word [esp + 0x12], si
lea esp, [esp + 2]
mov ebp, dword [esp + 0x14]
push ebx
mov dword [esp], ebx
mov byte [esp + 1], ah
push dword [esp]
lea esp, [esp + 3]
lea esp, [esp + 4]
lea esp, [esp + 1]
lea esp, [esp + 0x18]
ret
lea esp, [esp + 0x14]
pushal
mov dword [esp], edi
popal
push edi
pop word [esp]
mov byte [esp], bl
lea esp, [esp + 1]
push edi
lea esp, [esp + 1]
mov dword [esp], ebp
push di
pushfd
mov dword [esp], ebx
mov byte [esp], al
pushfd
push si
push edx
pushal
lea esp, [esp + 0x30]
mov ebp, esp
push edx
mov edx, ebp
lea edx, [edx + 8]
mov ecx, dword [edx]
pop edx
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x100e07e6
stc
sub esp, 2
push word [esp]
sub esp, 0x16
pop word [esp + 2]
add esp, 2
mov byte [esp + 8], al
sub esp, 0x18
lea esp, [esp + 2]
xor eax, eax
pushal
lea esp, [esp + 0x4c]
mov ebp, dword [esp]
mov bp, word [esp]
mov bp, 0x20
mov ebp, dword [esp]
lea ebp, [edx + 0x43d62f86]
mov ebp, dword [esp]
push di
lea esp, [esp + 2]
lea esp, [esp + 4]
ret
Function at 0x1002838d
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x100e0936
mov dword [esp], edi
push dx
jmp 0x100e0a0d
mov byte [esp], dh
push word [esp + 1]
jmp 0x100e08f8
pushal
not dh
popal
push ebx
pop word [esp]
jmp 0x100e0917
mov dword [esp], ebx
lea esp, [esp + 4]
mov edi, edi
push dx
jmp 0x100e0a50
pushal
mov edx, esp
xchg di, si
popal
pushfd
push word [esp + 2]
mov word [esp + 2], bx
mov dword [esp], edi
lea esp, [esp + 2]
mov word [esp + 1], bp
jmp 0x100e09af
push word [esp + 5]
pop word [esp + 1]
lea esp, [esp + 3]
lea esp, [esp + 1]
mov word [esp], di
push word [esp + 1]
lea esp, [esp + 1]
lea esp, [esp + 3]
lea esp, [esp + 4]
jmp 0x100e09d4
lea esp, [esp]
jmp 0x100e0c88
inc edx
add eax, 0x28
jmp 0x100e0b14
pop edi
pop esi
jmp 0x100e0b9a
pushfd
push dword [esp + 6]
lea esp, [esp + 0x28]
jmp 0x100e0b82
pop word [esp + 1]
lea esp, [esp + 2]
cmp edx, esi
push ecx
jmp 0x100e0aca
sub esp, 0x1c
push dword [esp + 0xf]
jmp 0x100e0aed
jbe 0x100e0c29
push eax
mov eax, ebp
lea eax, [eax + 0xc]
mov edi, dword [eax]
pop eax
mov ecx, dword [eax + 0xc]
stc
clc
sub esp, 0
cmc
sub esp, 3
lea esp, [esp + 3]
cmp edi, ecx
push ebx
push sp
mov dword [esp], eax
push ebp
lea esp, [esp + 2]
lea esp, [esp + 8]
jb 0x100e0a8f
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x100e0aad
jmp 0x100e0a8f
jb 0x100e0b43
jmp 0x100e0c29
pop ebx
pop ebp
ret
sub esp, 8
push word [esp + 1]
lea esp, [esp + 2]
xor eax, eax
lea esp, [esp + 8]
jmp 0x100e0aad
push word [esp + 1]
push word [esp + 3]
push dword [esp + 5]
mov dword [esp + 3], edx
mov word [esp + 2], sp
mov byte [esp + 7], ch
lea esp, [esp + 2]
mov dword [esp + 4], ebp
pushfd
mov byte [esp + 1], bl
lea esp, [esp]
mov dword [esp], edi
mov byte [esp + 2], bh
mov byte [esp + 1], bl
push dword [esp + 3]
lea esp, [esp + 0xc]
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
clc
pushfd
cmc
pop word [esp]
lea esp, [esp]
lea esp, [esp + 2]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
sub esp, 5
mov word [esp + 1], bp
lea esp, [esp + 1]
xor edx, edx
pushal
lea esp, [esp + 0xf]
pop dword [esp]
pop dword [esp]
lea esp, [esp + 1]
lea esp, [esp + 0xc]
push sp
push dx
mov dword [esp], edi
lea esp, [esp + 1]
mov word [esp], di
push edx
lea esp, [esp + 6]
lea esp, [esp + 1]
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jmp 0x100e0b34

Function at 0x10045c4f
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jmp 0x100208c8
mov eax, 1
invalid
mov word [esp + 0xb], di
push word [esp + 0xd]
jmp 0x10045d44
mov byte [esp + 6], dh
push dword [esp + 1]
mov byte [esp + 2], dl
push dword [esp + 3]
jmp 0x10045c00
pushal
lea esi, [ecx + esi]
lea edx, [0x659423df]
popal
pushfd
push word [esp]
push word [esp + 5]
mov dword [esp + 2], ebp
jmp 0x10045c25
pop dword [esp + 7]
pop word [esp + 8]
lea esp, [esp + 0xc]
pushal
mov ebx, 0x1a5232ab
mov al, 0x80
popal
push dx
mov byte [esp], dl
pushal
mov word [esp + 0xf], sp
lea esp, [esp + 0x15]
lea esp, [esp + 1]
lea esp, [esp + 0xc]
jmp 0x100208bd

Function at 0x1004756b
Capabilities:
Parse pe header

Disassembly:
call fcn.10027f7d
jmp 0x10028038
Function at 0x10067cee
Capabilities:
Check for peb beingdebugged flag

Disassembly:
call fcn.100209eb
jmp 0x10020b0d
pushal
jmp 0x10020b29
mov edx, dword [esp]
jmp 0x10020b45
popal
jmp 0x10067737
push word [esp + 3]
push dword [esp + 1]
mov byte [esp + 6], bl
lea esp, [esp + 8]
lea esp, [esp + 1]
push dx
lea esp, [esp + 3]
jmp 0x10020aec
pushal
lea esi, [edi + 0x450a1381]
popal
pushal
push di
push dword [esp + 1]
push dword [esp + 0x18]
push ax
mov dword [esp + 0xc], edi
pushfd
pushfd
mov byte [esp + 0x1e], cl
lea esp, [esp + 0x34]
pushal
xchg dh, ah
popal
pushfd
mov dword [esp], edx
jmp 0x10045cbc
push eax
pop word [esp]
push ebx
lea esp, [esp + 5]
lea esp, [esp]
jmp 0x10067d3d
pushal
mov dx, cx
popal
pushfd
mov word [esp + 1], sp
pop word [esp]
push di
pop word [esp]
mov word [esp], bp
push bx
mov byte [esp], bh
push word [esp + 3]
lea esp, [esp + 2]
lea esp, [esp + 4]
push ebp
mov ebp, esp
push esi
pop word [esp]
mov word [esp], bx
mov byte [esp], dl
mov byte [esp], bh
mov byte [esp], al
lea esp, [esp]
lea esp, [esp + 2]
push ecx
push ebx
mov eax, dword fs:[0x30]
mov bl, byte [eax + 2]
mov byte [ebp - 1], bl
jmp 0x10067da5
rdtsc
jmp 0x10067d81
mov byte [esp], ah
push ebp
mov word [esp], cx
lea esp, [esp + 1]
push word [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 4]
lea esp, [esp + 4]
jmp 0x10067cc3
mov byte [ebp - 1], al
jmp 0x10067da5
mov eax, dword fs:[0x30]
jmp 0x10067def
cmp byte [ebp - 1], 0
je 0x10067d20
call fcn.100356e7
mov cl, byte [ebp - 1]
call int.100392ad
mov byte [eax + 0x38], cl
jmp 0x10067d88
mov bl, byte [ebp - 1]
mov byte [eax + 2], bl
pop ebx
leave
ret
Function at 0x412760
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x420]
lea edi, [esi + 0x420]
test eax, eax
jne 0x412792
lea eax, [esi + 0x424]
push eax
push edi
push 0x880ed0
push 0
call fcn.009a2465
jl 0x4127da
call fcn.0041b960
add esp, 0x10
mov edx, dword [esp + 0xc]
mov ecx, dword [edi]
pop edi
mov dword [edx], ecx
mov ecx, dword [esp + 0xc]
mov eax, dword [esi + 0x424]
pop esi
mov dword [ecx], eax
ret 8
Function at 0x41bde0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x897838]
xor edx, edx
cmp eax, edx
jne 0x41be06
xor eax, eax
mov byte [eax + 0x897738], al
inc eax
cmp eax, 0x100
jl 0x41bdee
mov dword [0x897838], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x897738
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41be97
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41be6a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41be38
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41bf10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41bf63
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41bf4a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4229a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x422b38
cmp ebp, ebx
jle 0x422b38
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x4229fe
dec eax
or eax, 0xfffffff8
inc eax
je 0x422a05
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, 0x80000001
jns 0x422a14
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x422a1b
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.004590d4
add esp, 4
cmp eax, ebx
je 0x422a3c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.004590d4
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x422b2e
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x422b15
mov al, byte [edx]
cmp al, 0xc0
jbe 0x422b01
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x422af6
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x422b04
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x422b04
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x422aa0
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x422a91
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x430a70
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x466418
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x430aa9
inc eax
mov dword [esi + 0x10], eax
jmp 0x430bbc
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x430abd
mov eax, 0xffffffc7
jmp 0x430bbe
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x430ace
cmp dword [esi + 8], eax
jne 0x430abd
cmp dword [esi + 8], eax
jne 0x430ae7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x430ae7
mov eax, 0xffffffc7
jmp 0x430bbe
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x430afb
push eax
mov ecx, ebx
call fcn.004302a0
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00404c80
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x430b2c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00404ca0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0042fa10
test eax, eax
mov dword [esp + 0x38], eax
je 0x430b5f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x86dff8
call fcn.00404e80
mov eax, dword [esp + 0x38]
jmp 0x430bbe
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.004308d0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x430ba3
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.004308f0
mov esi, eax
test esi, esi
jne 0x430bd3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.004308d0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x430b75
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x86dff8
call fcn.00404e80
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x86dff8
call fcn.00404e80
mov eax, esi
jmp 0x430bbe
Function at 0x7a084d
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, 0xfaf6b455
jmp 0x7a0828
mov dl, 0x1c
mov ebx, edi
jmp 0x7a07ca
neg cx
jae 0x7a07f1
sub esp, 0x14
mov dx, word [esp + 0xe]
mov dx, 0xed0f
jmp 0x7a05f8
mov bx, word [esp]
bsf dx, si
jbe 0x7a07c0
mov dl, 0x1c
jmp 0x7a07c2
sub esp, 0x14
mov dx, word [esp + 0xe]
jmp 0x7a07ff
mov dx, 0xed0f
jmp 0x7a05f8
lea esp, [esp + 2]
sub esp, 0xc0
mov esi, esp
lea edx, [esp + edx]
jmp 0x7a07e3
mov edx, 0x8edb75a6
mov cx, dx
rdtsc
bsr ax, bp
jmp 0x7a086e
rdtsc
pop word [esp]
mov byte [esp], bh
jmp 0x7a0817
jo fcn.007a0891
jno fcn.007a0891

Function at 0x7a0858
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr eax, edx
jmp 0x7a0a10
rdtsc
stc
inc dh
bswap edx
mov dl, byte [esp]
inc edx
jmp 0x7a0922
lea edx, [ebx + edi]
jmp 0x7a08a6
add cl, bl
mov ax, 0x51eb
add edx, ebp
jo 0x7a08bf
lea edx, [ebx + edi]
not dx
jmp 0x7a08a9
mov edx, 0x724b72be
mov eax, dword [esp]
pushal
lea eax, [edx + edi]
lea esp, [esp + 0x20]
jmp 0x7a08d6
inc dh
bswap edx
mov dl, byte [esp]
jmp 0x7a087c
jne 0x7a0872
rdtsc
stc
jmp 0x7a09e5

Function at 0x7a0a3c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [edx + edx]
lea eax, [edx*4]
not al
mov al, 0x1a
sub esp, 6
jae 0x7a0a5e
bts eax, edi
lea esp, [esp + 2]
jmp 0x7a0a60
lea esp, [esp + 4]
ror dl, 0
jmp 0x7a0a1b
bts eax, edi
lea esp, [esp + 2]
jmp 0x7a0a60
jmp 0x7a0a45
lea esp, [esp + 4]
xor dl, 0x7b
mov ax, 0x5739
cmc
ja 0x7a0a8c
jbe 0x7a0a8c
mov al, 0xc6
xchg byte [esp], al
setg ah
mov al, ah
mov al, 0x6a
jmp 0x7a0b46
lea esp, [esp + 4]
not dl
lea eax, [edi*4]
rol ax, cl
jb 0x7a0b75
stc
bswap eax
mov ax, word [esp]
bswap eax
jmp 0x7a0bde
jmp 0x7a0c55
jo 0x7a0bb9
sub esp, 0x18
push word [esp + 0x1d]
jmp 0x7a0c21
sub esp, 0x18
push word [esp + 0x1d]
lea esp, [esp + 2]
dec edi
bswap edx
mov dh, 0xf2
ror ah, 1
jmp 0x7a0be7
bswap eax
add bl, dl
bswap edx
sub esp, 0x10
jmp 0x7a0ba0
jne 0x7a0c09
lea edx, [edi + ebp]
pushal
jmp 0x7a0bf3
mov ax, cx
mov dh, byte [esp + 0xb]
mov eax, dword [esp + 0x13]
jmp 0x7a0c18
lea edx, [edi + ebp]
pushal
mov ax, cx
mov dh, byte [esp + 0xb]
mov eax, dword [esp + 0x13]
mov dh, 0xf8
jmp 0x7a0c3d
lea esp, [esp + 2]
jmp 0x7a0bc5
pop dword [esp + 0x10]
bsr ax, cx
setle dh
mov dx, 0x1a85
jmp 0x7a1a47
rdtsc
rcl eax, 0xb
jle 0x7a0c27
pop dword [esp + 0x10]
jmp 0x7a0c61
stc
bswap eax
mov ax, word [esp]
jmp 0x7a0bdc
bsr ax, cx
setle dh
mov dx, 0x1a85
rdtsc
jmp 0x7a1a49
mov dl, 0x94
bswap eax
rdtsc
mov edx, 0xfffe016c
mov eax, 0xfe953f0
jmp 0x7a0c8b
lea edx, [esi + edi]
not ax
lea edx, [eax + 0xe9]
jmp 0x7a0caa
lea edx, [esp + eax]
jmp 0x7a0d02
inc cl
lea eax, [ebx + edi]
sub esp, 0
jo 0x7a0f5d
lea edx, [esp + eax]
lea edx, [esi + edi]
not ax
lea edx, [eax + 0xe9]
mov dl, 0x94
jmp 0x7a0cac
rdtsc
lea esp, [esp + 5]
lea esp, [esp + 3]
lea esp, [esp + 0x14]
jmp 0x7a0fae
Function at 0x8c83e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, sp
mov dl, byte [esp]
jmp 0x8c833f
lea esi, [esp + 8]
mov ecx, 0x6ae84d06
bswap edi
jmp 0x8c8367
inc dl
jb 0x8c837f
jae 0x8c837f
jmp 0x8c83a6

Function at 0x8c862a
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ax
jg 0x8c8648
xchg byte [esp], al
push dword [esp + 2]
add esp, 3
lea esp, [esp + 1]
jmp 0x8c869b
jmp 0x8c860b
xchg byte [esp], al
push dword [esp + 2]
jmp 0x8c8655
add esp, 3
lea esp, [esp + 1]
jmp 0x8c869b
push esp
mov al, ah
cmc
jmp 0x8c86bd
cmc
xchg dword [esp], eax
xchg al, ah
jmp 0x8c86c2
lea esp, [esp + 4]
neg dl
lea eax, [ecx + 0x93]
bsr ax, bp
jmp 0x8c86e9
xchg dword [esp], eax
xchg al, ah
stc
bsf ax, ax
jmp 0x8c870d
not al
btc eax, esp
mov ax, 0x403d
jmp 0x8c872c
jnp 0x8c8678
push esp
mov al, ah
jmp 0x8c8682
mov ax, 0x403d
jmp 0x8c872c
btr edx, esp
sub esp, 0
dec ax
jmp 0x8c87a7
jp 0x8c86cd
not al
btc eax, esp
jmp 0x8c86f0
btr edx, esp
sub esp, 0
dec ax
jmp 0x8c87a7
lea esp, [esp + 4]
add bl, dl
shl ax, cl
ja 0x8c86f6
jbe 0x8c8716
sbb byte [ecx + 0x27936001], dl
lcall 0x13a5, 0x12e78012
rdtsc
jmp 0x8c8757
inc ebp
neg dh
jae 0x8c877e
rdtsc
mov eax, 0x8c469e2
push esp
mov dl, byte [esp]
mov eax, edx
jmp 0x8c8768

Function at 0x8c9181
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ecx
xchg dh, al
neg ah
lea eax, [edx*4]
rdtsc
mov dh, byte [esp]
jmp 0x8c9c0d
mov dh, ch
mov edx, 0xd740f632
xchg dx, ax
mov dh, 0x88
mov ax, bx
jmp 0x8c9166
lea ecx, [ecx + 0x8e]
inc al
mov ax, 0x914f
Function at 0x8e7b5c
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 3]
jmp 0x8e7699
lea esp, [esp + 2]
lea esp, [esp + 8]
movzx esi, byte [eax + 0xd]
lea edi, [esi - 0x1d]
mov bl, byte [esp]
jmp 0x8e7bc7
movzx esi, byte [eax + 0xe]
call fcn.008e786e
push esi
mov esi, ecx
lea esi, [esi*4]
jmp 0x8e7a6e
lea esi, [esi + 0x8c52d0]
mov ecx, dword [esi]
pop esi
shr edi, 0x10
call 0x8e7a80
pop ecx
lea esp, [esp + 3]
jmp 0x8e7abb
and edi, esi
push esp
jmp 0x8e7b4d
lea esp, [esp]
lea esp, [esp + 1]
jmp 0x8e7aa5
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
jmp 0x8e7a42
mov edi, dword [edi*4 + 0x8c52d0]
sub esp, 0x12
call fcn.008e7b1e
shr edi, 0x18
jmp 0x8e7b9b
pushal
mov word [esp + 0x10], sp
add esp, 9
lea esp, [esp + 3]
lea esp, [esp + 0x18]
jmp 0x8e7ee6
and edx, ebp
mov edi, dword [esp]
neg di
bswap edi
jmp 0x8e7d10
mov dword [ecx + 8], edx
setno dh
push esp
lea esp, [esp + 4]
jmp 0x8e7ad4
lea esp, [esp + 2]
jmp 0x8e7c49
mov ecx, dword [eax + 8]
push edx
mov byte [esp + 2], ch
pop word [esp]
sub esp, 0xc
jmp 0x8e7bd7
mov cx, word [esp]
lea ecx, [eax*4]
lea ecx, [esi + 0xad]
jmp 0x8e7bee
stc
lea esp, [esp + 2]
xor edx, ecx
mov dword [eax + 0x14], edx
jmp 0x8e7c05
mov dword [edi], ecx
mov edx, dword [esp]
mov edx, dword [eax + 4]
sub esp, 0x1e
jmp 0x8e7c1c
xor ecx, edx
lea edx, [ebx + ebp]
mov edx, 0xe0e63a66
mov dword [eax + 0x18], ecx
jmp 0x8e7cd7
xor ecx, dword [eax]
lea edx, [ebp + 0xaf]
add ebx, 4
jmp 0x8e7c3c
lea edi, [eax*4]
dec dx
mov edx, dword [esp]
lea edi, [eax + 0x10]
lea edx, [ebp - 0x37]
jmp 0x8e7c6d
xor edx, ecx
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x48]
cmp ebx, 0x8c6af8
call fcn.008e7c9f
mov ebx, 0x2cddba24
sahf
rcl dword [eax - 0x2d]
dec edx
in eax, 0x14
mov edx, dword [eax + 0xc]
pushal
mov byte [esp + 0x17], bh
cmc
jmp 0x8e7cb7
xor ecx, edx
xchg edx, edi
lea edi, [esi*4]
xor ecx, dword [ebx]
jmp 0x8e7c8b
movzx edi, byte [edi*4 + 0x8c52d0]
cmc
xor ecx, edi
lea edi, [edx*4]
jmp 0x8e7bb1

Function at 0x8e7c9f
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x8e7cf8
jne 0x8ba94e
not si
mov ebp, ebx
mov esi, dword [esp]
bswap edi
jmp 0x8e7ce2
push 0xa
not ah
mov si, word [esp]
mov edi, 0x8b3d6b26
xchg bh, al
jmp 0x8e7e38
mov byte [esp + 1], dh
pop word [esp]
lea esp, [esp + 1]
lea esp, [esp + 1]
jmp 0x8e7ca1
pop eax
mov si, 0xc657
mov bl, bh
lea esi, [ebx*4]
jmp 0x8e7da0

Function at 0x8e8200
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x8e8220

Function at 0x8e83a2
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [ebp - 8]
jmp 0x8baffe
push dword [esp + 0x12]
lea esp, [esp + 2]
lea esp, [esp + 0x24]
jl 0x8bafe2
mov eax, 0x5396c74e
jmp 0x8e815a
lea esp, [esp + 0x18]
cmp dword [ebp - 4], ebx
pushal
pop word [esp + 5]
push dword [esp + 0x12]
jmp 0x8e8254
lea esp, [esp + 4]
sub edx, 0x10
sub esp, 0x18
stc
jmp 0x8e82e5