joyce8/EMBER2024-capa huggingface dataset:
Function at 0x882164
Capabilities:
Packed with generic packer

Disassembly:
inc esp
and al, 4
pop edi
inc esp
and al, 0x1c
ljmp 0x2d02
mov dword [esp], edx
push 0xc4c89bd8
mov byte [esp], ah
mov dword [esi + 0x24], ebx
call fcn.00736dc4
pop esp
in al, dx
add esp, dword [edi + 0x2f]
sbb esi, dword [ebx - 0x1f]
xor byte [esi - 0x8003477], bh
xor al, 0x94
ror al, cl
movaps xmm2, xmm7
adc dl, byte [edx + ebp - 0x5a46941f]
jbe 0x7157a4
add dword [eax], ebp
clc
lea esi, [ebx + ecx*4 - 0x22]
and dl, byte [ecx + 0x5f]
jg 0x715868
invalid
inc ebx
push 0xffffffffffffff92
pop ebp
div dword [eax - 0x3bb98f5e]
and bh, byte [ecx]
push ebp
std
lds edi, [esi - 0x50]
call 0x1aeeaa28
insb byte es:[edi], dx
mov edi, dword [ebx - 0x55aa930e]
mov ebp, dword [edx - 0x23]
cmp dword [eax + 0x28], edi
mov al, 0x8b
xchg dword [esi + eax*2 - 0x6c], edx
call fcn.0092fc2c
jmp 0x8b2bd2
movsx dx, bl
mov dh, al
pushfd
mov edx, dword [esi + 0x20]
jmp 0x7157bb
lea esp, [esp + 8]
jb 0x914cd9
inc dh
sub ebx, ebx
xchg di, dx
bswap dx
xchg dx, di
not di
pop edi
mov dx, di
mov dl, 0x28
jp 0x846054
lea edx, [ebp*2 + 0x7dcb56f7]
mov edx, dword [esi + 0x20]
pushfd
mov byte [esp], ah
pushal
mov byte [esp + 8], 0xfb
mov dword [esp + 0x20], edx
pushal
mov byte [esp + 4], ch
mov dword [esi + 0x24], ebx
lea esp, [esp + 0x40]
jg 0x81bcaf
pushal
pushal
mov dword [esi + 0x28], ebx
pushfd
lea esp, [esp + 0x44]
call fcn.005f2751
not ax
mov dword [esi + 0x20], ebx
push 0x6172b1f1
call fcn.0076c094
pushal
pushfd
pushfd
mov dword [esi + 0x28], ebx
call fcn.0073dee3
xchg esi, eax
pop edi
push ebp
add esi, dword [0x53aacf73]
push ebx
ror byte [eax], 0x32
clc
test byte [edi + ebx - 0x3f35d527], 0x91
sub dword [ecx + 0x50c9e6e], eax
dec ecx
sbb edx, ecx
sub dh, byte [eax]
out dx, al
pop ebx
dec esp
and cl, bl
or eax, ebp
out 0x7d, al
sbb edx, dword [eax]
dec ebp
push ss
out dx, eax
bound di, dword [eax]
rol byte [0xfa376f61], cl
popal
outsd dx, dword [esi]
aaa
cli
loop 0x8b2c8e
fstp dword [eax]
xchg dword [eax + 0x64ca60e0], ebx
jne 0x8b2be6
lcall 0x1949, 0x769eee
or ebp, 0xffffffe6
test byte [ebp + 0x59fe1a73], al
inc esp
mov word fs:[ebx - 0x1923031], ds
jl 0x8b2c69
inc ebx
xchg ebx, eax
inc ebx
test esi, edx
salc
sub al, 0xea
pushfd
into
push esp
pop esi
sbb al, 0x4e
dec esp
cdq
cmpsb byte [esi], byte es:[edi]
inc ecx
js 0x8b2c96
adc byte [ebx - 0x3784ecd0], cl
add bh, bl
popal
cdq
push eax
movsb byte es:[edi], byte [esi]
mov esi, 0xed8f54f2
lodsd eax, dword [esi]
retf
sti
pop edx
mov dword [0x85c5839c], eax
stosd dword es:[edi], eax
adc eax, 0xc06fea56
lcall 0xb246, 0x72c47d1e
add si, word [ebx]
jmp 0x8b2c12
jl 0x8b2cfa
and ecx, dword [edx]
sub eax, 0xa4bd2deb
movsb byte es:[edi], byte [esi]
fstp dword [edi - 0x6fa716f1]
add dl, byte [eax + 0x3654d79e]
cmp dword [ebp + 0x45], esp
or al, 0x2b
jg 0x8b2cad
retf
jns 0x8b2c3c
sti
lahf
lahf
invalid
push ss
dec edi
stosd dword es:[edi], eax
xor esp, dword [edi + 0x6363735f]
sal byte [ebx], cl
stosb byte es:[edi], al
rcl dword [ecx - 0x34ffbd0d]
jmp 0x5c5af8ca
Function at 0x885520
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov word [esp], cx
mov dword [esp + 0x40], 0xf31389d9
mov byte [esp + 4], cl
push edi
lea esp, [esp + 0x44]
jmp loc.0041c27f
pushal
mov dword [esp + 0x40], 0xb5335807
jmp 0x749dee

Function at 0x887bd8
Capabilities:
Packed with generic packer

Disassembly:
js 0x83d38e
pushfd
mov dword [esp], 0x5ff0e8
call fcn.0072a3b7
mov dword [esp + 0x20], 0xbc8c1f94
pushal
lea esp, [esp + 0x40]
jmp loc.0041c27f
pushfd
mov dword [esp], 0x5ff0e8
pushal
pushal
mov dword [esp + 4], edi
push edx
mov dword [esp + 0x40], edi
jmp 0x862287
mov edi, eax
not ah
rdtsc
cwde
mov eax, dword [ecx]
bswap dx
mov edx, dword [eax + 0xc]
lea esp, [esp + 0x24]
jns 0x8126aa
pushal
push esp
mov dword [esp + 0x20], 0x5ff0e8
pushfd
mov dword [esp + 0x20], edi
mov byte [esp + 8], 0x76
push dword [esp]
call fcn.00613e22
pushal
pushfd
mov dword [esp + 0x20], 0x8c6f57ef
pushal
mov dword [esp + 0x3c], 0x4103139a
mov byte [esp + 8], 0x64
lea esp, [esp + 0x3c]
jmp fcn.00426edd
mov byte [esp + 4], ah
pushfd
call fcn.00827d36
pop ds
stc
ljmp 0x72c2
mov byte [esp], al
inc edx
call fcn.0076b8af
pushfd
pushal
jmp 0x83ff44

Function at 0x894550
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jle 0x8b2bb6
push 0xf95633e7
mov dword [esp], edi
push esi
pushal
lea esp, [esp + 0x24]
jmp 0x8f1f93
clc
mov dword [ebp - 8], esi
cmc
clc
mov dword [ebp - 4], ebx
cmc
mov word [esp + 4], 0x20cd
clc
cmc
test edx, edx
jmp 0x875353
Function at 0x8a8f5c
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x44], ecx
pushfd
lea esp, [esp + 0x48]
call fcn.005f2751
bt di, cx
cmp bx, 0x55e
pushfd
pushal
add esp, 0x2c
pushal
test al, bh
stc
test byte [ebp + 8], 1
pushal
mov byte [esp], ah
mov word [esp + 4], 0x3d09
mov dword [esi], 0x5fefec
mov word [esp + 8], bx
mov byte [esp + 0x10], al
push dword [esp]
lea esp, [esp + 0x44]
je 0x7f9cab
pushal
jmp 0x7f9c90
pushfd
mov byte [esp], bl
mov dword [esp + 0x20], esi
push edx
lea esp, [esp + 0x24]
call fcn.005f249f
pushal
sbb al, 0x37
btr eax, edx
add esp, 0x24
pushal
mov eax, esi
call fcn.00911819
invalid
jmp 0x7378af

Function at 0x8b2b99
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x4c]
jl 0x8f1f81
xchg si, cx
push 0x20418f25
mov byte [esp], bh
mov edi, dword [esp + 4]
lea esp, [esp + 8]
lea ecx, [edx - 0x7b6e69c0]
xor ax, sp
xadd ah, cl
bsr eax, edx
mov ecx, dword [ebp + 8]

Function at 0x8de3e9
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
jne 0x7474ed
jmp 0x8eedc8
pushfd
rol eax, 0x11
add ch, 0x6e
add cl, 0xb4
rol cl, cl
ror cx, cl
not eax
or ch, 0x31
mov ecx, eax
cmc
pushfd
pushfd
shr ecx, 8
bt di, di
pushfd
push eax
cmp byte [eax], cl
pushal
lea esp, [esp + 0x34]
je 0x808ca7
pushfd
push 0xda96bdf0
lea esp, [esp + 8]
jmp 0x91a97f
test bl, dh
cmp cl, 0x60
not ecx
clc
stc
test ecx, ecx
pushfd
mov byte [esp + 4], ch
push dword [esp]
jmp 0x624ade
pop ecx
fnsave dword [edx + 0x245489ff]
and al, 0xc6
add al, 0x24
xor dh, al
add al, 0x24
out 0xc7, eax
inc esp
and al, 0x20
sbb eax, 0x9c008bd4
call fcn.0092fc1e
pop ebx
mov ch, 0x1e
jl 0x8eed97
cmp byte [ebx - 0xa], dh
inc ebp
insd dword es:[edi], dx
lds esi, [esi + eax*4]
add al, 0xe7
cmp esi, esp
outsb dx, byte [esi]
int1
inc ebx
in al, dx
sti
loop 0x8eee3f
dec ebp
popal
nop
mov bh, 9
aad 0xd6
sbb byte [0xf321b24f], ah
call 0xeac4b521
js 0x8eee37
mov edx, 0x9cd6db29
push edx
nop
dec esi
add dword [ebx], edi
or al, 0xc
mov byte [0xfe21ff38], al
dec esi
fnstsw word [edi + 0x34]
out 0xc8, eax
insd dword es:[edi], dx
mov esp, 0xa3d34d52
test byte [esi - 0x2b85469b], bh
push ebx
cmovno esi, ebx
sti
inc edx
push edx
sub al, 0x45
inc esp
lcall 0x2866, 0x7c864808
ror dl, 0x99
clc
add dword [ebx], edi
jmp 0x8eee4d
cmp ebp, ebx
adc eax, 0x4dc40976
push edi
idiv byte [esi + ebp*4 - 0x6e9139ea]
loop 0x8eeea7
scasb al, byte es:[edi]
push ss
invalid
retf
fnstenv [edi - 0x1a]
jbe 0x8eedd7
jns 0x8eee35
mov eax, ebp
mov edi, 0x1fcacc95
in al, dx
inc edx
cmc
in eax, 0x21
mov edi, 0xf056ae2e
rcr ecx, 0x30
test dword [ebx], 0x7d042efc
int 0xa4
mov ds, edi
push 0xf9569d2
jmp 0x8eee40
and edx, ebp
push 0xffffffffffffffd4
cmp al, 0xab
cmp eax, 0xb2b87409
xor byte [esi + eax*8 + 0x7f], dh
fdiv qword [esi + esi*4 - 0x453f8db8]
xchg edx, eax
add dword [ebx], edi
sbb eax, 0xa1a0023b
bound esp, qword [edx - 0x53cb04af]
inc edi
loope 0x8eef4d
adc dh, byte [ebp + esi - 0x7c]
int 0x7d
xlatb
invalid
invalid

Function at 0x8f6891
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x643357e7
call fcn.00837a13
push esi
cmpsd dword [esi], dword es:[edi]
invalid
Function at 0x908f92
Capabilities:
Packed with generic packer

Disassembly:
test bl, bh
test ax, 0x791c
clc
add esp, 4
cmc
stc
clc
test dl, 0xed
test edi, edi
pushfd
call fcn.0076ce8f
les ebp, [ebp + 0x65]
ja 0x61f741
adc dword [ebx + 0x79c0ae85], eax
push ebx
sub eax, 0xcab394ce
pop es
nop
call fcn.0087db92
rol dword [ebx + 0x2cda62e5], cl
loop 0x61f759
popal
test eax, 0x446cb0d8
xchg esp, eax
psrld mm5, qword [eax - 0x71]
mov word [esp + 4], dx
push ebx
lea esp, [esp + 0xc]
call fcn.005f2751
jge 0x61f6f5
add esp, 4

Function at 0x90cd09
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 8], 0x3ccdfd28
pushfd
push ebp
push dword [esp]
pushal
lea esp, [esp + 0x34]
jmp loc.0041c27f

Function at 0x9255c6
Capabilities:
Packed with generic packer

Disassembly:
invalid
lea esp, [esp + 8]
je 0x42717b
pushal
inc ecx
call fcn.0092ed03
mov edi, 0x3c2d8628
jae 0x9255df
mov al, 0x48
cmp al, al
push ss
invalid

Function at 0x92c17a
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x24], 0x9806b59b
push esp
pushfd
lea esp, [esp + 0x2c]
jmp loc.0041d910
or al, ch
mov eax, 0x9cffe0fe
pushfd
mov dword [esp + 8], 0xf24757e3
pushal
jmp 0x807530
wait
jmp 0x92c179
dec dword [eax - 0x3317dbe4]
wait
invalid
mov byte [esp], bl
call fcn.00925d4e
scasd eax, dword es:[edi]
jg 0x92c1ac
mov dword [ecx - 0x4cfc8cc4], ebx
pop ebp
sub eax, 0x7eb921a5
xchg esi, eax
jno 0x92c177
mov al, bl
push ss
xor eax, 0xc053c9f1
iretd
invalid
inc eax
inc edx
xchg ebx, eax
or eax, 0x1d3b3a64
sub esp, ebx
pushal
cwde
imul ebx, ebp, 0x7a
rol byte [eax + 0x600ea679], cl
pop esi
fimul word [ecx + 0x45]
popfd
sbb byte [ebx + 0x7c35d653], ah
nop
jl 0x92c15d
out dx, eax
pop esi
xor dword [eax + 0x52dd156], edx
or byte [eax + 0x6d892777], al
lahf
pop eax
in eax, dx
loop 0x92c1ad
mov dword [ecx - 0x75], esp
movsb byte es:[edi], byte [esi]
xchg byte [edi], ah
dec esi
into
test byte [ecx + 0x8c3d03], bl
push edx
wait
mov al, 0x92
sub eax, 0x56a89d5b
jle 0x92c19e
movd dword [edx + ebx - 0x3f], mm0
push ebx
rep stosb byte es:[edi], al
jl 0x92c21d
in al, 0x8d
aas
push ebx
jecxz 0x92c1cb
popfd
jmp 0x9c3d92c5
fcom dword [ecx]
rcr dword [ecx + 0x514d7555], 1
imul esp, dword [esi], 0x733c9a8a
add al, 0x63
mov edx, 0xcb21b6e8
and al, 0xac
das
int1
int 0x9c
stosb byte es:[edi], al
or ebp, ecx
movsd dword es:[edi], dword [esi]
test al, 0x31
retf
Function at 0x9970a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.009a9480
add esp, 0xc
xor eax, 0x4271
xor eax, 0x4271
ror edi, 0
js 0x9970c8
ror ecx, 0x13
ror ecx, 0xd
jo 0x9970d9
xchg esp, esp
mov eax, eax
jno 0x9970d9
mov ebx, 0x66b1ceaf
mov cl, 0x66
mov al, 0x75
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 7], 0x4a
mov byte [ebp - 8], 0x6e
mov byte [ebp - 5], 0x67
mov byte [ebp - 0xa], al
mov byte [ebp - 3], 0
mov byte [ebp - 0xe], al
mov byte [ebp - 4], 0x70
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 9], cl
mov byte [ebp - 6], 0x6f
rol edi, 0xd
rol edi, 0x13
jbe 0x997120
je 0x99711b
jg 0x99711d
ja 0x997120
call 0x8b95c6ae
dec ebp
cmc
mov dl, byte [ebp - 4]
mov cl, byte [ebp - 0xb]
mov al, byte [ebp - 0xf]
mov bl, byte [ebp - 0xd]
dec dl
dec cl
mov byte [ebp - 4], dl
mov dl, byte [ebp - 9]
dec al
mov byte [ebp - 0xb], cl
mov cl, byte [ebp - 0xc]
dec bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0xa]
dec dl
mov byte [ebp - 0xd], bl
mov bl, byte [ebp - 6]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 8]
dec cl
dec al
mov byte [ebp - 0xc], cl
mov cl, byte [ebp - 0x10]
dec bl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 7]
dec dl
mov byte [ebp - 6], bl
mov bl, byte [ebp - 5]
mov byte [ebp - 8], dl
mov dl, byte [ebp - 0xe]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0x10], cl
mov byte [ebp - 7], al
mov byte [ebp - 5], bl
mov byte [ebp - 0xe], dl
push ecx
add ecx, 0x7581
ror ecx, 0x10
pop ecx
nop
jle 0x9971a1
jg 0x997198
jmp 0x99719a
mov edx, edx
jnp 0x99719e
jg 0x9971a1
mov eax, 0x1c5aae8
add byte [ebp - 0x7c7bf040], al
add byte [eax], al
add byte [edi + 0x4f], al
call fcn.009b3750
test eax, eax
je 0x997231
inc edi
dec edi
jns 0x9971c7
jns 0x9971b4
lea edi, [edi + 0x4719]
lea edi, [edi - 0x4719]
jnp 0x9971c2
jae 0x9971c4
js 0x9971c7
mov esi, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.009b6060
push 0xe
lea edx, [ebp - 0x10]
push 0
push edx
mov ebx, eax
call fcn.009a9480
add esp, 0xc
xchg edi, edx
xchg edi, edx
jge 0x9971f3
xchg esp, esp
jle 0x9971ed
jg 0x9971ef
jl 0x9971f3
mov edx, 0x74db856c
cmp cl, byte [ebp + 0x74332424]
and al, 0xc
test ebx, ebx
je 0x997231
lea esp, [esp]
xor esi, dword [esp + 0xc]
xor esi, dword [esp + 0xc]
jle 0x997213
pushf
stc
jle 0x997209
popf
lea esp, [esp]
jb 0x997210
jg 0x997213
add eax, 0xc007e853
add byte [eax], al
push ebx
call fcn.009a3220
add esp, 4
test dword [esp + 0x10], ebx
jg 0x99722b
jmp 0x997224
jp 0x997226
jbe 0x997228
jle 0x99722b
add eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x9a0750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.009a9480
add esp, 0xc
ror ecx, 0x1e
ror ecx, 2
jp 0x9a077c
jnp 0x9a0773
jb 0x9a0775
jg 0x9a0777
jp 0x9a0779
jnp 0x9a077c
mov ecx, 0x45c666b0
invalid
mov al, 0x66
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xd], 0x4d
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x6d
mov byte [ebp - 8], 0x55
mov byte [ebp - 7], 0x6a
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], al
mov byte [ebp - 4], 0
jo 0x9a07b2
add edx, 0
ja 0x9a07c6
pushf
neg eax
neg eax
popf
ja 0x9a07c1
xchg esi, esi
jbe 0x9a07c6
mov esp, 0x8af0458a
pop ebp
cmc
mov al, byte [ebp - 0x10]
mov bl, byte [ebp - 0xb]
mov dl, byte [ebp - 6]
mov cl, byte [ebp - 0xf]
dec al
dec bl
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0xa]
dec dl
mov byte [ebp - 0xb], bl
mov bl, byte [ebp - 5]
dec cl
mov byte [ebp - 6], dl
mov dl, byte [ebp - 0xe]
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 9]
dec al
dec bl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xd]
dec dl
mov byte [ebp - 5], bl
mov bl, byte [ebp - 8]
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xc]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 7]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0xd], al
mov byte [ebp - 8], bl
mov byte [ebp - 0xc], dl
mov byte [ebp - 7], cl
call fcn.009b3750
mov ecx, eax
test ecx, ecx
je 0x9a08ab
not eax
not eax
test dword [esp + 4], ebx
jp 0x9a083b
je 0x9a0854
pushf
or edi, edi
ror esp, 0
xor eax, dword [esp]
xor eax, dword [esp]
shr edi, 0
popf
mov esp, esp
jne 0x9a0854
mov ecx, 0x52f0558d
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.009b6060
mov ebx, eax
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.009a9480
add esp, 0xc
test ebx, ebx
je 0x9a08ab
jp 0x9a0876
add esi, 0
push ecx
pop ecx
je 0x9a088e
pushf
xchg ecx, ecx
xor esp, 0
popf
je 0x9a0888
nop
xchg esp, esp
jne 0x9a088e
mov ecx, 0x298ce853
add byte [eax], al
push ebx
call fcn.009a3220
add esp, 4
mov edi, edi
std
cld
jb 0x9a08a5
ja 0x9a089f
xchg esp, esp
jae 0x9a08a5
mov esp, 0x84d8bc9
mov ecx, dword [ebp + 8]
push ecx
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x9a17d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.009a9480
add esp, 0xc
and edx, edx
test dword [esp], ecx
stc
jno 0x9a180a
pushf
dec esi
inc esi
rol esi, 5
ror esi, 5
rol ebx, 0x1b
rol ebx, 5
jl 0x9a1803
popf
jmp 0x9a1807
jo 0x9a180a
mov esi, 0x66b06db1
mov cl, 0x6d
mov al, 0x66
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x54
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 4], cl
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x49
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 7], 0x62
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 6], 0x6f
shr ecx, 0
jns 0x9a1884
pushf
xor esi, 0x3706
xor esi, 0x3706
jge 0x9a1869
rol edi, 0x1a
ror edi, 0x1a
popf
lea edi, [edi]
jg 0x9a1875
lea ebx, [ebx + 0x3dc9]
lea ebx, [ebx - 0x3dc9]
js 0x9a1884
xor eax, 0x8aec5d8a
push ebp
int1
mov bl, byte [ebp - 0x14]
mov dl, byte [ebp - 0xf]
mov cl, byte [ebp - 0xa]
mov al, byte [ebp - 5]
dec bl
dec dl
mov byte [ebp - 0x14], bl
mov bl, byte [ebp - 0x13]
dec cl
mov byte [ebp - 0xf], dl
mov dl, byte [ebp - 0xe]
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 9]
mov byte [ebp - 5], al
mov al, byte [ebp - 4]
dec bl
dec dl
mov byte [ebp - 0x13], bl
mov bl, byte [ebp - 0x12]
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xd]
dec al
Function at 0x9a3220
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
add edx, 0x56ed
sub edx, 0x56ed
jp 0x9a3234
jae 0x9a3246
pushf
rol edx, 0
jb 0x9a323d
jne 0x9a323f
popf
mov eax, eax
jb 0x9a3246
mov esp, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call fcn.0099c540
add esp, 4
cmp eax, 2
jne 0x9a32aa
jne 0x9a3259
js 0x9a325b
jns 0x9a3262
jb 0x9a325f
js 0x9a3262
call 0x99a10ace
add byte [ebx + 0x99028c], ah
push 0x9906d8
mov dword [0x99028c], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test esp, 0x280a
xchg ebx, eax
xchg ebx, eax
jns 0x9a327c
sub edi, 0
jb 0x9a32a0
pushf
stc
rol esp, 0
lea ebx, [ebx + 0xf70]
sub ebx, 0xf70
popf
lea edi, [edi]
xchg ecx, esi
xchg ecx, esi
jb 0x9a329d
jae 0x9a32a0
lcall 0x5f00, 0x1b8
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
xor edi, dword [esp]
xor edi, dword [esp]
stc
js 0x9a32b3
xor eax, 0x7695
xor eax, 0x7695
jo 0x9a32c8
jo 0x9a32c1
jae 0x9a32c3
mov esi, esi
jno 0x9a32c8
add eax, 0xc0335e5f
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x9a3670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.009a9480
add esp, 0xc
neg ebx
neg ebx
jno 0x9a3699
jl 0x9a3691
lea esp, [esp]
jns 0x9a3696
jo 0x9a3699
lcall 0x50ec, 0x45c666b0
mov al, 0x66
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], al
mov byte [ebp - 0xa], al
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x42
mov byte [ebp - 0x12], al
mov byte [ebp - 0xd], 0x77
mov byte [ebp - 8], 0
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x64
xor edi, eax
xor edi, eax
nop
cld
jmp 0x9a36d4
je 0x9a36e2
js 0x9a36d8
xchg edx, ebx
xchg edx, ebx
mov esp, esp
jne 0x9a36e2
mov ecx, 0xec458aa7
mov al, byte [ebp - 0x14]
mov bl, byte [ebp - 0xf]
mov dl, byte [ebp - 0xa]
mov cl, byte [ebp - 0x13]
dec al
dec bl
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0xe]
dec dl
mov byte [ebp - 0xf], bl
mov bl, byte [ebp - 9]
dec cl
mov byte [ebp - 0xa], dl
mov dl, byte [ebp - 0x12]
mov byte [ebp - 0x13], cl
mov cl, byte [ebp - 0xd]
dec al
dec bl
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0x11]
dec dl
mov byte [ebp - 9], bl
mov bl, byte [ebp - 0xc]
dec cl
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 0x10]
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0xb]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0x11], al
mov byte [ebp - 0xc], bl
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xb], cl
ja 0x9a3744
jns 0x9a3769
pushf
rol eax, 0
cmp esp, 0x4a35
inc eax
dec eax
popf
jbe 0x9a3757
lea esp, [esp]
lea edi, [edi + 0x313e]
lea edi, [edi - 0x313e]
js 0x9a3769
sub eax, 0xff97b2e8
dec dword [ebx + 0x75f685f0]
or dword [edi + 0x5e], ebx
call fcn.0099cf20
mov esi, eax
test esi, esi
jne 0x9a377d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
stc
jge 0x9a3780
cld
jbe 0x9a379e
pushf
xchg ebx, edx
xchg ebx, edx
lea edi, [edi]
xchg edi, edi
call fcn.009a3792
Function at 0x9a7b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
nop
nop
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.009a9480
add esp, 0xc
lea edx, [edx + 0x5f58]
lea edx, [edx - 0x5f58]
jae 0x9a7b95
mov esp, esp
jnp 0x9a7ba3
jne 0x9a7b9b
jae 0x9a7b9d
jl 0x9a7b9f
jp 0x9a7ba3
mov esi, 0xb173b04b
jb 0x9a7b6e
mov al, 0x73
mov cl, 0x72
mov byte [ebp - 2], 0
inc ebp
inc byte [eax]
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], al
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xa], al
mov byte [ebp - 5], cl
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], al
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x46
mov byte [ebp - 3], 0x74
call fcn.009b3750
test eax, eax
jne 0x9a7bee
pop esi
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.009b6060
push 0xf
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.009a9480
add esp, 0xc
test esi, esi
jne 0x9a7c17
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push ebx
push edi
sub ebx, 0
nop
xor edi, dword [esp + 8]
xor edi, dword [esp + 8]
jb 0x9a7c2f
jp 0x9a7c29
jmp 0x9a7c2b
jae 0x9a7c2f
mov esp, 0xebe8565f
mov ch, 0xff
inc dword [ebx - 0x337cfb3c]
add al, ch
add byte [eax], al
add byte [eax], al
push esi
call fcn.009a3220
add esp, 4
or esp, 0
call 0x9a7c40
lea esp, [esp + 4]
jmp 0x9a7c46
rol eax, 0xb
ror eax, 0xb
jne 0x9a7c53
js 0x9a7c50
je 0x9a7c53
mov edx, 0x8b0c458b
dec ebp
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x9a82a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x9909f8]
push esi
push edi
push eax
push 0x990c9d
mov byte [0x990c9c], 0x45
call fcn.009a9e10
mov edx, dword [0x9909f8]
mov al, 0x2d
mov byte [0x990ca2], al
mov byte [0x990ca3], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x990ca1], cl
mov byte [0x990ca4], cl
mov esi, 0x990ca5
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x980a69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x9a82ef
mov byte [esi], 0
pop edi
mov eax, 0x990c9c
pop esi
ret
Function at 0x9ad0d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.009a9480
add esp, 0xc
jae 0x9ad0ea
nop
xchg edx, edx
or edi, 0
jp 0x9ad0fc
xchg edx, ecx
xchg edx, ecx
jnp 0x9ad0f8
jnp 0x9ad0fc
mov ecx, 0xb073b157
mov byte gs:[ebp - 3], 0
mov cl, 0x73
mov al, 0x65
mov byte [ebp - 3], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], cl
mov byte [ebp - 6], al
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], cl
mov byte [ebp - 5], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], 0x74
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], al
mov byte [ebp - 7], 0x4e
jl 0x9ad136
je 0x9ad148
pushf
xor edi, 0
popf
jge 0x9ad141
jge 0x9ad143
jle 0x9ad145
jne 0x9ad148
jmp 0x100d534
call fcn.009b3750
test eax, eax
jne 0x9ad159
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
jmp 0x9ad15b
jno 0x9ad170
pushf
std
cld
call 0x9ad166
add esp, 4
popf
mov edi, edi
jo 0x9ad170
xor eax, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.009b6060
push 0xe
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.009a9480
add esp, 0xc
test esi, esi
jne 0x9ad19a
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
rol ecx, 0
jno 0x9ad1aa
pushf
nop
popf
jp 0x9ad1a6
nop
jo 0x9ad1aa
mov ebx, 0x6070e856
invalid
push esi
call fcn.009a3220
add esp, 4
cmp ebx, dword [esp + 8]
jo 0x9ad1b9
jp 0x9ad1c6
lea esp, [esp]
jg 0x9ad1c0
jg 0x9ad1c2
jnp 0x9ad1c6
add eax, 0xc458b7f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x9af630
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x9901c4
call fcn.009ac690
add esp, 0xc
mov byte [0x9901c4], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret