joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10047b88
Capabilities:
Receive data
Receive data on socket

Disassembly:
pop ecx
add ecx, 0x2f
cmp ecx, 0
je 0x10047b9d
jmp ecx
adc dword [0x8b006a61], 0x8b501045
dec ebp
or al, 0x51
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x10047d91
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10047e10
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4

Function at 0x10048860
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x49c
mov eax, dword [0x1005a030]
xor eax, esp
mov dword [esp + 0x498], eax
push ebx
push esi
mov esi, dword [esp + 0x4a8]
push 0x3ff
lea eax, [esp + 0xa5]
push 0
push eax
mov ebx, ecx
mov byte [esp + 0xac], 0
call fcn.1001c970
xor eax, eax
add esp, 0xc
push eax
push 0x80
push 3
push eax
push 3
push closesocket
push esi
mov byte [esp + 0x88], 0
mov dword [esp + 0x89], eax
mov dword [esp + 0x8d], eax
mov dword [esp + 0x91], eax
mov dword [esp + 0x95], eax
mov dword [esp + 0x99], eax
mov dword [esp + 0x9d], eax
mov dword [esp + 0xa1], eax
mov dword [esp + 0xa5], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10048908
mov eax, 0x100548fc
jmp 0x100489f2
push ebp
push edi
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call fcn.10047e10
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [0x10072f18]
push 0
lea edx, [esp + 0x14]
push edx
push 0x400
lea eax, [esp + 0xb4]
push eax
push esi
call edi
test eax, eax
je 0x10048973
cmp dword [0x10072f18], 6
jbe 0x1004895a
push 1
mov dword [0x10072f18], 0
call ebp
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0xac]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
call fcn.10048630
cmp dword [esp + 0x10], 0x400
je 0x10048922
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x9c]
push edx
mov ecx, ebx
call fcn.100486f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [str._02x]
mov cl, byte [0x10053eb8]
mov dword [esp + 0x6c], eax
mov byte [esp + 0x70], cl
xor esi, esi
lea edi, [esp + 0x74]
push 1
call ebp
movzx edx, byte [esp + esi + 0x98]
push edx
lea eax, [esp + 0x70]
push eax
push edi
call fcn.1001aa93
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x10
jl 0x100489b1
xor esi, esi
push 1
call ebp
mov cl, byte [esp + esi + 0x74]
mov byte [esi + 0x10072ef4], cl
inc esi
cmp esi, 0x20
jl 0x100489d7
pop edi
mov eax, 0x10072ef4
pop ebp
mov ecx, dword [esp + 0x4a0]
pop esi
pop ebx
xor ecx, esp
call fcn.1001a63f
add esp, 0x49c
ret 4
Function at 0x100491c0
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
sub esp, 8
push esi
push 0
lea eax, [esp + 0xc]
mov esi, ecx
push eax
mov dword [esi], vtable.CMyHttpPage.0
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test byte [esp + 8], 4
push 0
push 0
mov dword [esp + 0xc], 0x364549
push 0
jne 0x10049205
push 4
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 4], eax
mov eax, esi
pop esi
add esp, 8
ret
push 0
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 4], eax
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x10049260
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ecx
mov eax, dword [0x1005a030]
xor eax, esp
mov dword [esp], eax
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x10
push edi
cmp dword [eax + 0x18], ebx
jb 0x10049285
mov eax, dword [eax + 4]
jmp 0x10049288
add eax, 4
push 0
push 0
push 3
push 0
push 0
push 0x50
push eax
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
test edi, edi
je 0x100492d3
cmp dword [esi + 0x18], ebx
jb 0x100492af
mov eax, dword [esi + 4]
jmp 0x100492b2
lea eax, [esi + 4]
push 0
push 0
push 0
push 0
push 0
push eax
push 0
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x100492e6
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp]
xor ecx, esp
call fcn.1001a63f
pop ecx
ret 8
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
setne bl
call esi
push edi
call esi
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.1001a63f
pop ecx
ret 8
Function at 0x10049520
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
push 0x200000
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edx
xor ebp, ebp
push eax
mov dword [esp + 0x20], ebp
call fcn.10049320
mov edi, eax
cmp edi, ebp
je 0x100495c3
mov ebx, dword [esp + 0x10]
cmp ebx, ebp
jle 0x100495c3
mov eax, dword [esp + 0x20]
cmp dword [eax + 0x18], 0x10
jb 0x10049561
mov eax, dword [eax + 4]
jmp 0x10049564
add eax, 4
push ebp
push 0x80
push 2
push ebp
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10049595
push edi
call fcn.1001b14f
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
push ebp
lea ecx, [esp + 0x20]
push ecx
push ebx
push edi
push esi
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1001b14f
add esp, 4
cmp dword [esp + 0x1c], ebx
jne 0x100495c3
mov ebp, 1
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 0x10

Function at 0x10049600
Capabilities:
Get file version info

Disassembly:
sub esp, 0x134
mov eax, dword [0x1005a030]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x144]
mov ebx, ecx
push 0x34
mov eax, 0x4e4
lea ebp, [ebx + 4]
push 0
push ebp
mov word [ebx + 0x3e], ax
call fcn.1001c970
lea edx, [esp + 0x44]
add esp, 0xc
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10049641
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x3c]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
ja 0x1004966e
xor eax, eax
jmp 0x10049709
push esi
call fcn.1001a634
add esp, 4
push eax
push esi
mov dword [ebx + 0x38], eax
push 0
lea eax, [esp + 0x44]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10049667
lea edx, [esp + 0x14]
push edx
mov edx, dword [ebx + 0x38]
mov ecx, 0x5c
lea eax, [esp + 0x14]
mov word [esp + 0x10], cx
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10049667
mov esi, dword [esp + 0x10]
push edi
mov ecx, 0xd
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, 7
mov esi, 0x100547d0
lea edi, [esp + 0x20]
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebx + 0x38]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2a]
push edx
push eax
call sub.VERSION.dll_VerQueryValueA
pop edi
test eax, eax
je 0x100496fd
cmp dword [esp + 0x14], 4
jb 0x100496fd
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov dword [ebx + 0x3c], edx
xor eax, eax
cmp dword [ebp], 0xfeef04bd
sete al
mov ecx, dword [esp + 0x13c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001a63f
add esp, 0x134
ret 4
Function at 0x10049890
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x220]
sub esp, 0x220
push 0xffffffffffffffff
push 0x10050069
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1005a030]
xor eax, ebp
mov dword [ebp + 0x21c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x228]
mov edi, dword [ebp + 0x22c]
xor ebx, ebx
mov dword [ebp - 0x28], ebx
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x100548fc
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], esi
mov byte [esi + 4], bl
call fcn.10001f30
mov eax, 1
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
cmp edi, ebx
jne 0x1004991e
push 0x104
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x10049929
push edi
lea ecx, [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp]
push eax
mov dword [ebp - 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
je 0x10049a3d
push edi
push 2
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp - 0x1c]
mov esi, eax
push esi
push edi
push ecx
lea edx, [ebp]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [ebp - 0x2c]
push ecx
mov eax, 0x5c
lea edx, [ebp - 0x20]
mov word [ebp - 0x14], ax
push edx
lea eax, [ebp - 0x14]
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 0x20]
mov cx, word [eax + 0xc]
mov si, word [eax + 0xa]
mov di, word [eax + 8]
mov bx, word [eax + 0xe]
push 0x103
lea edx, [ebp + 0x105]
push 0
push edx
mov word [ebp + 0x20e], cx
mov byte [ebp + 0x104], 0
call fcn.1001c970
mov eax, dword [str._d._d._d._d]
mov ecx, dword [0x10054810]
mov edx, dword [0x10054814]
mov dword [ebp + 0x210], eax
movzx eax, word [ebp + 0x20e]
push eax
mov dword [ebp + 0x214], ecx
mov dword [ebp + 0x218], edx
movzx ecx, bx
push ecx
movzx edx, di
push edx
movzx eax, si
push eax
lea ecx, [ebp + 0x210]
push ecx
lea edx, [ebp + 0x104]
push edx
call fcn.1001aa93
lea eax, [ebp + 0x104]
add esp, 0x24
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10049a10
mov ecx, dword [ebp - 0x18]
sub eax, edx
push eax
lea eax, [ebp + 0x104]
push eax
call fcn.10001f30
mov esi, dword [ebp - 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [ebp - 0x18]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x21c]
xor ecx, ebp
call fcn.1001a63f
add ebp, 0x220
mov esp, ebp
pop ebp
ret
Function at 0x1009ee52
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xb86c6bd9
jmp 0x100f5bc7
lea esp, [esp + 8]
call fcn.1001a4e0
setb dl
sar dh, cl
cmp edi, 0x79638e24
sete dl
mov dword [ebp - 8], eax
sbb dx, sp
shl dl, 1
lea edx, [edx*4 + 0x756aa802]
btr dx, 6
mov edx, dword [ebp - 0x24]
cmp dl, dh
push 0x2ec62693
clc
clc
not edx
cmc
cmc
or edx, dword [ebp - 0x28]
pushfd
xor edx, dword [ebp - 4]
pushfd
pushal
pushfd
push dword [esp + 4]
mov dword [ebp - 4], edx
push 0x5849dc35

Function at 0x100a8e0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
test cl, 0x90
test ecx, ecx
pushal
pushfd
push eax
lea esp, [esp + 0x30]
je loc.100c57c7
bswap ax
rdtsc
lahf
pushfd
mov dword [esp], 0
rdtsc
pushal
movsx ax, bl
mov dword [esp + 0x1c], 0
mov al, 0x5c
mov dword [esp + 0x18], 0x104
pop eax
call fcn.101690a1
inc eax
shl dword [edi + esi*2 + 0x17d1daeb], 1
mov al, 0xff
outsd dx, dword [esi]
sbb dword [0xe8186356], ebx
cmc
enter 0xffffffffffffddfd, 0xffffffffffffffec
out 0xf8, al
cmp cl, dh
movsd dword es:[edi], dword [esi]
fxch st(2)
invalid
lea esp, [esp + 0x2c]
jle 0x102230ea
call fcn.10003580
test dl, bh
cmc
test eax, eax
setno al
lea ecx, [esi*8 + 0x4283def1]
setne al
cmc
mov cl, 0x25
cmp bh, 0xb3
cmp cl, 0xab
mov byte [ebp - 0x211], al
pushal
pushal
push edi
lea esp, [esp + 0x44]
call fcn.10003580
btr cx, si
test eax, eax
bswap ecx
lea ecx, [edi*2 - 0x4c647d22]
push 0x56b0e337
push dword [esp]
setne al
bsr cx, dx
shld cx, bp, 2
shr ch, cl
rcr ch, 2
mov byte [ebp - 0x211], al
shl ch, 2
lea ecx, [edi*4 + 0x4796cb80]
shrd cx, si, cl
ror cl, cl
movzx ecx, byte [ebp - 0x211]
clc
mov byte [esp], 0xe0
jmp 0x100a2e65
jmp 0x1014b2a5

Function at 0x100b1243
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x2e], 0x41
cwde
mov byte [ebp - 0x2d], 0x6e
bswap ax
cwde
seto ah
mov byte [ebp - 0x2c], 0x70
lea eax, [ebx + 0x270dfe6]
cwde
pop eax
mov byte [ebp - 0x2b], 0x46
setl ah
lahf
mov byte [ebp - 0x2a], 0x69
lahf
jmp 0x10141efc
cwde
mov byte [ebp - 0x29], 0x6c
movzx ax, cl
mov byte [ebp - 0x28], 0x65
not ax
pop eax
mov byte [ebp - 0x27], 0x4d
bswap ax
lea eax, [esp + 0x48dc0420]
not eax
mov byte [ebp - 0x26], 0x61
lea eax, [edi + 0x42c48b15]
mov byte [esp], 0xcd
lea eax, [esi*2 + 0x6a5eff9e]
mov byte [ebp - 0x25], 0x70
setns al
mov byte [ebp - 0x24], 0x70
mov word [esp], 0xfc31
mov byte [ebp - 0x23], 0x69
pushfd
mov byte [ebp - 0x22], 0x6e
pushfd
mov byte [ebp - 0x21], 0x67
lahf
movzx ax, cl
lahf
mov byte [ebp - 0x20], 0
cwde
not al
pop eax
mov dword [ebp - 0x38], 0
setg ah
mov dword [ebp - 0x14], 0
movzx ax, al
bswap ax
bswap ax
mov dword [ebp - 0x10], 0
push eax
movsx ax, al
pushfd
lea eax, [ebp - 0x44]
mov word [esp], cx
mov word [esp + 4], 0xc8ff
mov word [esp], cx
mov dword [esp + 0x34], eax
call fcn.1023c2f9
jmp 0x101f0ac4
lea esp, [esp + 0x48]
call fcn.10017c70
clc
push 0x5c2aabcf
push dword [esp]
add esp, 0x1c
cmp bh, 0xc0
bt sp, sp
stc
cmc
mov dword [ebp - 0x13c], eax
clc
pushal
push dword [esp]
xor al, 0x24
cmp dword [ebp - 0x13c], 0
push esp
call fcn.101e7d5e
inc esi
jnp 0x101f0aeb
aas
sub byte [edi], ch
wait
add byte [edi], cl
adc ebp, esi
invalid
Function at 0x100b5ee4
Capabilities:
Hash data with crc32

Disassembly:
pushfd
push dword [esp]
mov dword [esp + 0x30], ecx
mov byte [esp], 0x99
call fcn.100d4dbd
mov cl, 0x42
jne 0x100b5f41
cld
adc eax, 0x3aadc81c
xchg ecx, eax
lea eax, [ebx]
mov ecx, dword [ecx - 0x2f]
insb byte es:[edi], dx
adc ah, al
lcall 0xb440, 0xc5921155
mov ebp, 0x97a79422
imul edi, dword [edi], 0x30
and eax, 0x7777cb54
outsd dx, dword [esi]
pop ecx
adc al, 0x90
test eax, 0x33769951
shr dword [bx + si], cl
push dword [esi - 0x6c233a33]
dec ecx
mov esp, 0x33e16c55
test dword [edi - 0x5e12a437], edx
adc eax, dword [ebp + 0x16d830b8]
push ss
jno 0x100b5f5e
invalid
pop ebx
adc ah, byte [edi]
aas
jbe 0x100b5ef0
bound edi, qword [eax]
inc ecx
xor al, 0x85
imul eax
leave
xchg ecx, eax
cmc
pop ss
sar byte gs:[eax], 0xce
pushfd
xchg ecx, eax
sar esp, cl
fmul dword [esi + 0x29]
rol byte [ebp + 0x2aeea8a1], 0x67
mov byte [0x2c7a0576], al
cmp eax, 0x89574390
call dword [esi - 0x263404a9]
jg 0x100b5fcb
dec ebx
dec eax
out 0xe7, al
push edi
movsb byte es:[edi], byte [esi]
into
sbb dh, byte [ebp + 0x71fdcc8e]
retf 0x50a7
mul dword [ebp - 0x63]
push edx
mov bl, byte [edi + 0x7a028d36]
add eax, 0xc66815fe
add al, 0x24
mov ch, 0xe8
add ch, byte [ecx]
adc al, byte [eax]
lea esp, [esp + 8]
je 0x100ba17b
cmc
cmp bl, 0xdc
cmc
cmp dl, 0x85
shr eax, 1
clc
pushal
cmp bh, bh
xor eax, 0xedb88320
pushfd
pushal
push ecx
mov dword [esp], 0x233aa7d5
lea esp, [esp + 0x48]
jmp 0x100ba17f

Function at 0x100cd864
Capabilities:
Encode data using xor

Disassembly:
pushfd
call fcn.1011a3e5
js 0x100cd877
sbb cl, byte [esi - 0x7887ec81]
xor al, 0x62
daa
mov dword [0x688ea86f], eax
invalid
outsd dx, dword [esi]
test al, 0x8e
push 0xee78338c
and eax, 0x654ee92c
invalid

Function at 0x100deac7
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x28], 0x103
movzx ax, dl
pop eax
mov byte [esp + 4], 0xf1
lahf
mov dword [esp + 0x20], 0
lea eax, [eax - 0x39e3cfdb]
pushfd
lea eax, [ebp - 0x117]
push eax
push dword [esp + 8]
lea esp, [esp + 0x2c]
jno 0x100ecbe3
push eax
call fcn.101b6496
sbb eax, 0x5b76512
pop ebx
and ah, bl
sub eax, 0x84e10c27
pop edi
adc al, 0x8a
add byte [esi], ah
rcl dword [ebp - 0x3af92da7]
and byte [0x70be0c78], dl
and dword [eax + ecx + 0x55], esi
sub byte [0x2c0085c7], ch
invalid
push esp
mov dword [esp], eax
pushal
lea esp, [esp + 0x20]
call fcn.1001c970
mov dx, bp
add esp, 0xc
lea ecx, [esi*8 - 0x526a5037]
jmp 0x101ce558
mov ecx, dword [ebp + 8]
not dl
jmp 0x101c96e1
push ecx
setbe dl
lea edx, [ebp - 0x118]
call fcn.10124594
or dword [esi + 0x10], ebx
sub byte [ecx + 0x3b7f310f], 0x88
leave
adc al, 0x82
xor ah, bh
sbb byte [esp + ecx + 0x4c], ah
xlatb
mov esp, 0x26b37f83
sbb ebp, dword [esi - 0x48196d40]
push 0xffffffffffffff9e
adc dl, al
mov byte [0xbbdf05f9], al
fmul qword [edx - 0x5c]
nop
ficom dword [edx - 0x1137e81b]
dec eax
lodsb al, byte [esi]
invalid
movzx cx, cl
push 0x104
lea edx, [edx + 0x5e74617c]
mov ch, 0x54
jmp 0x101385f9
Function at 0x100e6671
Capabilities:
Packed with generic packer

Disassembly:
bsf dx, ax
mov eax, dword [ebp - 0x43c]
rol ch, 3
movsx dx, al
add eax, 2
btc cx, ax
lea ecx, [ebp - 0x7eaaf5a]
shrd cx, bx, 0xb
xchg ch, dl
mov dword [ebp - 0x440], eax
sub esp, 0xfffffffc

Function at 0x100f74b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, byte [eax]
stc
mov byte [ebp - 0x1a1], cl
cmp dh, ch
add dword [ebp - 0x19c], 1
clc
mov dword [esp], ebx
clc
cmp byte [ebp - 0x1a1], 0
pushfd
lea esp, [esp + 0x50]
jne 0x101fb667
rdtsc
test al, 0xc7
rdtsc
sbb dx, si
mov edx, dword [ebp - 0x19c]
cmc
sub edx, dword [ebp - 0x1a0]
seta cl
lahf
movsx ax, bl
push 0x5772ada0
mov dword [ebp - 0x1a8], edx
lahf
not ah
mov eax, dword [ebp - 0x1a8]
pushfd
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.1014ad85
pop ecx
lodsb al, byte [esi]
mov esi, 0x4896a24f
mov edx, 0x8291a0ec
add dword [edx + 0x41], ecx
mov esp, dword [eax + esi + 0x36e30a95]
idiv byte [esi - 0x50]
ret 0x9ccb
Function at 0x100fdd27
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
jne 0x10158002
and cl, al
movzx ecx, word [ebp - 0x424]
push 0xc2b70599
cmp ecx, 0x3f
call fcn.1018b475
cld
mov es, word [eax - 0x20f15eee]
into
stosb byte es:[edi], al
and byte [edx - 0x66], ah
clc
mov ah, 0x49
dec ebx
invalid
jmp 0x1015e835
push 0xce797e6d
lea esp, [esp + 4]
je 0x10169ab6
pushal
pushal
lea esp, [esp + 0x40]
jne 0x100e669f
bt si, si
mov eax, dword [ebp - 0x43c]
or ch, dl
shr ch, 4
dec cl
sub eax, dword [ebp - 0x440]
xchg dx, cx
sar eax, 1
shr ecx, cl
mov dword [ebp - 0x448], eax
rol cx, 7
mov ecx, dword [ebp - 0x448]
or edx, 0xbb576ecf
stc
dec dh
sub ecx, 1
or dl, dh
ror dh, 2
cmp dl, bh
mov dword [ebp - 4], ecx
xor dh, dl
push eax
or dx, dx
movzx edx, word [ebp - 0x428]
stc
stc
bt sp, 0xd
bt ebx, ecx
cmp edx, 0x5c
pushfd
call fcn.101581eb
cwde
pop eax
mov eax, dword [ebp - 0x84]
lea esp, [esp + 0x18]
jo 0x1020b619
push esp
push ecx
mov dword [esp + 4], eax
mov word [esp], ax
mov dword [esp], 0
jmp 0x1018b98e
cmp word [ebp - 0x442], 0
lea esp, [esp + 4]
jge 0x100f1f23
jne 0x100e669f
xadd cl, dh
rcr al, 4
xor cx, dx
jo 0x1021fbbd
mov eax, dword [ebp - 0x43c]
sal dl, 2
sar cx, cl
sub eax, dword [ebp - 0x440]
bts dx, bx
pushfd
btc cx, ax
shl cx, 1
sar eax, 1
or ch, dl
mov dword [ebp - 0x448], eax
rcr dh, 4
test ebx, ebp
mov ecx, dword [ebp - 0x448]
adc dl, 0x76
bswap dx
shld dx, si, cl
pushal
sub ecx, 1
bsr dx, di
or dx, 0x7a82
not dh
mov dword [ebp - 4], ecx
stc
bsr dx, bp
sbb dh, bh
bswap dx
movzx edx, word [ebp - 0x428]
pushfd
clc
cmp bx, sp
bt bp, sp
cmp edx, 0x5c
push 0x2c10265a
lea esp, [esp + 0x2c]
jne 0x10158002
aas
rcr al, cl
movzx eax, word [ebp - 0x426]
pushfd
test dh, 0xa2
stc
cmp eax, 0x5c
jmp 0x100a6640
push edx
push dword [sym.imp.KERNEL32.dll_VirtualAlloc]
pop dword [esp]
pushfd
push edi
push dword [esp + 8]
ret 0xc
push 0x79f3b4db
call fcn.1013c078
push ebp
mov dword [esp], 0x1011ccee
jmp 0x100c1450
push 0x26665a6c
mov dword [esp], eax
call fcn.1020d0ea
mov eax, dword [0x49284f5]
push ds
insb byte es:[edi], dx
inc edi
popfd
mov bh, byte [ebp + 0x34]
push es
jg 0x1020b659
das
xor byte [ebx + 0x603c28af], al
push ebp
inc edi
cmp dword [esi - 0x5f], ecx
arpl word [eax], bx
retf 0xeffb
imul ebx, dword [edx + 0x74], 0x853d58d6
int3
push ecx
ror dl, cl
call fcn.1012bc18
mov eax, dword [ebp - 8]
cmp bh, 0x5d
clc
xor eax, 0xffffffff
push 0xa2d06f07
mov byte [esp], bh
pushal
pushal
lea esp, [esp + 0x44]
jmp loc.1000fe27

Function at 0x10110235
Capabilities:
Packed with generic packer

Disassembly:
pushfd
jmp 0x1011057d
lea esp, [esp + 0x10]
jge 0x10124bc4
pushal
lea esp, [esp + 0x20]
jmp fcn.100c9ce6
Function at 0x10114c5d
Capabilities:
Encode data using xor

Disassembly:
mov dword [edi - 0x338f45de], edx
mov bh, 0xc4
scasd eax, dword es:[edi]
and eax, 0xfea411b7
xchg esp, ebp
push ebx
sub byte [edi - 0x67e2a5f6], cl
xor cl, bl
pushal
or al, byte [edi + edi*2 - 0x16]
test eax, 0x952491d7
clc
xchg dh, bl
fdivr dword [ebx - 0x40354eac]
xor esp, 0xffffffe6
fadd st(6)
xor al, 5
test al, 0xfd
leave
js 0x10114ca7
js 0x10114c62
push esi
push edx
mov ebp, 0xe05113be
hlt
cmp ecx, edx
call 0x100d79fa
xor byte [edx - 0x4175c7dd], 0xb0
add dh, byte [ebx]
bound edx, qword [ebx - 0x28]
jecxz 0x10114c8a
cld
inc dword [eax - 0x75c7dc4e]
mov esi, 0x623302b0
push ebx
xor esp, dword [edx + 0x53]
fsub st(3)
sbb ah, ah
sal byte [ebp - 0x6e], cl
in al, 0xd2
jne 0x10114c08
mov dword [0xd6ecf3d1], eax
xor byte [edx + ecx*4 + 0x7d], bh
clc
lea edx, [esi + esi*4 + 0x61f0de8a]
test eax, 0x544f33dd
dec edi
push esp
mov dword [edx - 0x5b], eax
push edi
pop esp
insd dword es:[edi], dx
test dword [eax + ebp + 0x48], esp
push ebp
dec esi
movsb byte es:[edi], byte [esi]
jns 0x10114c6c
enter 0xffffffffffff95fd, 0x4c
ret 0x703c
dec esp
push ds
scasd eax, dword es:[edi]
test byte [0x8ac79fa6], dh
invalid
Function at 0x1013c3a6
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 0x10], 0xffffffff
jmp 0x10185337
pushfd
mov dword [ebp - 0x14], ecx
jmp 0x1010e9f4
mov byte [esp], 0x9c
pushfd
mov dword [esp + 4], 0xbe9e338a
mov dword [ebp - 0x48], 0
mov byte [esp], 0xfc
mov word [esp], cx
lea esp, [esp + 0x50]
jmp 0x101c4967

Function at 0x10152aa9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 4]
lea eax, [ebp - 0xc0]
jmp 0x1019e9c7
push dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
pop dword [esp + 0xc]
mov byte [esp + 8], 0x7b
push eax
mov byte [esp + 0xc], ah
push dword [esp + 0x10]
ret 0x14
lea esp, [esp + 0x50]
jl 0x10239c95
push ecx
mov dword [esp], eax
pushfd
pushfd
push 0x32a69d1
mov byte [esp + 4], bl
mov dword [esp + 8], 0x101e324e
push 0x21633db6
push edx
jmp 0x1017b387