joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41765c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4318d0
cmp edx, dword [eax]
je 0x41767e
add eax, 8
inc ecx
cmp eax, 0x431960
jl 0x41766f
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4318d0]
jne 0x4177ac
mov eax, dword [0x433d70]
cmp eax, 1
je 0x417786
test eax, eax
jne 0x4176af
cmp dword [0x42ece4], 1
je 0x417786
cmp edx, 0xfc
je 0x4177ac
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4176e6
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040e3b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040dc60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x417729
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040dc60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4286ac
push edi
call fcn.0040e9c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040e3b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040e3c0
lea eax, [ebp - 0xa0]
push 0x42868c
push eax
call fcn.0040e3c0
push dword [esi + 0x4318d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040e3c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00418dbf
add esp, 0x2c
pop edi
jmp 0x4177ac
lea eax, [ebp + 8]
lea esi, [esi + 0x4318d4]
push 0
push eax
push dword [esi]
call fcn.0040dc60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x41df01
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41df43
call fcn.00422596
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41df43
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41df3a
xor eax, eax
jmp 0x41df4b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041df51
pop edi
pop esi
pop ebx
ret 4

Function at 0x422f39
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x422f67
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x422f85
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00422e9f
jmp 0x422f85
mov eax, dword [esi + 0x14]
test eax, eax
je 0x422f85
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00422e9f
test edi, edi
mov eax, edi
jne 0x422f6f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x43253a
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 8]
jb 0x43bc84
aaa
clc
movzx eax, byte [ebp - 2]
or dl, ah
shr eax, 5
pushfd
push ebx
movzx dx, bl
imul eax, eax, 0x300
pushfd
btc dx, si
sbb dx, 0x3403
lea eax, [ebx + eax*4 + 0x94d8]
shrd dx, di, cl
sar dh, 1
mov dword [esp + 8], ecx
rol dh, 7
ror dl, 2
sal dx, 1
jmp 0x436e1e

Function at 0x43c099
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0x10]
jne 0x43de49
and si, 0x76dc
dec ch
mov ecx, edi
or si, bx
sub ecx, ebx
clc
bswap si
mov esi, esp
stc
cmc
sub edi, 4
cmc
pushfd
stc
mov byte [esp], bh
push dword [edi]
pop dword [esp]
pushfd
clc
pushal
cmp edi, ebx
pushal
lea esp, [esp + 0x44]
ja 0x43b716
test bh, 0xdd
call fcn.0043454b
xor eax, 0x61bd40fc
int3
Function at 0x45aa40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4e8
mov eax, dword [0x4211d0]
xor eax, esp
mov dword [esp + 0x4e4], eax
push esi
mov esi, ecx
mov dword [esp + 0x5c], 0x54535953
lea ecx, [esp + 0x4c]
mov word [esp + 0x60], 0x4d45
push edi
mov byte [esp + 0x66], 0
lea edx, [ecx + 1]
mov dword [esp + 0x50], 0x52525543
mov dword [esp + 0x54], 0x5f544e45
mov dword [esp + 0x58], 0x52455355
mov word [esp + 0x5c], 0x5c
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45aa98
sub ecx, edx
mov edx, esi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x45aaa6
sub edx, edi
lea eax, [edx + 1]
add eax, ecx
push eax
call fcn.0045c170
lea edx, [esp + 0x54]
mov dword [esp + 0x14], eax
mov edi, eax
add esp, 4
mov eax, edx
sub edi, eax
nop dword [eax + eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [edi + edx - 1], cl
test cl, cl
jne 0x45aad0
mov edx, esi
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x45aae0
mov edi, dword [esp + 0x10]
sub esi, edx
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45aaf0
mov ecx, esi
lea eax, [esp + 0xe9]
mov dword [esp + 0x1c], esi
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
push 0x3ff
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0045ea20
push 0x7f
lea eax, [esp + 0x79]
mov byte [esp + 0xf8], 0
push 0
push eax
mov dword [esp + 0x3c], 0x400
call fcn.0045ea20
add esp, 0x18
mov byte [esp + 0x68], 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], 0x80
xor edi, edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x2c], 0
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0xf8]
push eax
lea eax, [esp + 0x74]
push eax
push edi
call dword [0x41701c]
test eax, eax
je 0x45ac48
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push edi
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
push eax
push edi
push edi
push 4
push 1
push esi
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x60], xmm0
call dword [0x417018]
push 3
push 2
push 0x20019
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 0x72657665
push eax
lea eax, [esp + 0x40]
mov dword [esp + 0x64], 0x656e6f79
push eax
mov byte [esp + 0x6c], 0
call dword [0x417004]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x38]
push eax
push 1
call dword [0x417008]
test eax, eax
jne 0x45ac48
push eax
push eax
push eax
lea eax, [esp + 0xf4]
push eax
push 1
push 4
push esi
mov esi, dword [0x417010]
call esi
push edi
push dword [esp + 0x1c]
lea eax, [esp + 0xf0]
push edi
push eax
push VariantCopy
push 4
push dword [esp + 0x28]
call esi
test eax, eax
mov ecx, 1
cmove edi, ecx
mov ecx, dword [esp + 0x4ec]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0045bc6f
mov esp, ebp
pop ebp
ret
Function at 0x45ac60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4f8
mov eax, dword [0x4211d0]
xor eax, esp
mov dword [esp + 0x4f4], eax
push esi
mov esi, ecx
mov dword [esp + 0x64], 0x696d6441
lea ecx, [esp + 0x54]
mov dword [esp + 0x68], 0x7473696e
push edi
mov dword [esp + 0x70], 0x6f746172
lea edx, [ecx + 1]
mov word [esp + 0x74], 0x7372
mov byte [esp + 0x76], 0
mov dword [esp + 0x58], 0x52525543
mov dword [esp + 0x5c], 0x5f544e45
mov dword [esp + 0x60], 0x52455355
mov word [esp + 0x64], 0x5c
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45acc8
sub ecx, edx
mov edx, esi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x45acd6
sub edx, edi
lea eax, [edx + 1]
add eax, ecx
push eax
call fcn.0045c170
lea edx, [esp + 0x5c]
mov dword [esp + 0x14], eax
mov edi, eax
add esp, 4
mov eax, edx
sub edi, eax
nop dword [eax + eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [edi + edx - 1], cl
test cl, cl
jne 0x45ad00
mov edx, esi
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x45ad10
mov edi, dword [esp + 0x10]
sub esi, edx
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45ad20
mov ecx, esi
lea eax, [esp + 0xf9]
mov dword [esp + 0x1c], esi
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
push 0x3ff
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0045ea20
push 0x7f
lea eax, [esp + 0x89]
mov byte [esp + 0x108], 0
push 0
push eax
mov dword [esp + 0x3c], 0x400
call fcn.0045ea20
add esp, 0x18
mov byte [esp + 0x78], 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], 0x80
xor edi, edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x2c], 0
push eax
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push eax
push edi
call dword [0x41701c]
test eax, eax
je 0x45ae7e
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push edi
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
push eax
push edi
push edi
push 4
push 1
push esi
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x60], xmm0
call dword [0x417018]
push 3
push 2
push 0xf003f
lea eax, [esp + 0x64]
mov dword [esp + 0x64], 0x72657665
push eax
lea eax, [esp + 0x40]
mov dword [esp + 0x6c], 0x656e6f79
push eax
mov byte [esp + 0x74], 0
call dword [0x417004]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x38]
push eax
push 1
call dword [0x417008]
test eax, eax
jne 0x45ae7e
push eax
push eax
push eax
lea eax, [esp + 0x104]
push eax
push 1
push 4
push esi
mov esi, dword [0x417010]
call esi
push edi
push dword [esp + 0x1c]
lea eax, [esp + 0x100]
push edi
push eax
push VariantCopy
push 4
push dword [esp + 0x28]
call esi
test eax, eax
mov ecx, 1
cmove edi, ecx
mov ecx, dword [esp + 0x4fc]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0045bc6f
mov esp, ebp
pop ebp
ret
Function at 0x45aea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
mov eax, dword [0x4211d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov esi, ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x45aecc
pop eax
lea eax, [ebp - 0x460]
push 0x400
push 0
push eax
call fcn.0045ea20
push 0x400
lea eax, [ebp - 0x860]
push 0
push eax
call fcn.0045ea20
add esp, 0x18
mov dword [ebp - 0x86c], 3
lea eax, [ebp - 0x864]
mov dword [ebp - 0x868], 0x400
push eax
push 1
push 0
push esi
push SysReAllocString
call dword [section..rdata]
test eax, eax
jne 0x45b04c
movaps xmm0, xmmword [0x41e910]
lea eax, [ebp - 0x868]
push eax
lea eax, [ebp - 0x460]
mov dword [ebp - 0x1c], 0x7465536e
push eax
lea eax, [ebp - 0x86c]
mov dword [ebp - 0x18], 0x676e6974
push eax
push 0
lea eax, [ebp - 0x2c]
mov word [ebp - 0x14], 0x73
push eax
push dword [ebp - 0x864]
movups xmmword [ebp - 0x2c], xmm0
call dword [0x417030]
test eax, eax
jne 0x45b040
mov al, byte [ebp - 0x458]
cmp al, 0xd
je 0x45af89
cmp al, 5
jne 0x45b040
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45af90
sub ecx, edx
lea eax, [ecx + 0x18]
cmp eax, 0x18
jbe 0x45afd3
xor esi, esi
mov al, byte [ebp + esi - 0x448]
lea esi, [esi + 1]
mov edx, edi
mov byte [ebp + esi - 0x861], al
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x45afc0
sub edx, ecx
lea ecx, [esi + 0x18]
lea eax, [edx + 0x18]
cmp ecx, eax
jb 0x45afa3
lea edx, [ebp - 0x60]
mov dword [ebp - 0x10], 0x3a706f74
lea ecx, [ebp - 0x860]
mov dword [ebp - 0xc], 0x32393834
mov byte [ebp - 8], 0
call fcn.0045a4c0
push eax
push ebx
call dword [0x417040]
test eax, eax
jne 0x45b021
push dword [ebp - 0x864]
call dword [0x417024]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045bc6f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x860]
push eax
call fcn.0045ddf0
add esp, 8
push dword [ebp - 0x864]
test eax, eax
jne 0x45b005
jmp 0x45b046
push dword [ebp - 0x864]
call dword [0x417024]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045bc6f
mov esp, ebp
pop ebp
ret
Function at 0x84bd20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.MzY1
lea edi, [esi - 0x28b000]
push edi
jmp 0x84bd3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x84bd41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84bd30
mov eax, 1
add ebx, ebx
jne 0x84bd53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x84bd64
jne 0x84bd83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84bd83
dec eax
add ebx, ebx
jne 0x84bd70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x84bd48
add ebx, ebx
jne 0x84bd7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x84bdd5
xor ecx, ecx
sub eax, 3
jb 0x84bd9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x84be0a
sar eax, 1
mov ebp, eax
jmp 0x84bda6
add ebx, ebx
jne 0x84bda6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84bd74
inc ecx
add ebx, ebx
jne 0x84bdb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84bd74
add ebx, ebx
jne 0x84bdc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x84bdb6
jne 0x84bdd2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x84bdb6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x84bdf4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x84bde6
jmp 0x84bd36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x84bdf4
add edi, ecx
jmp 0x84bd36
pop esi
mov edi, esi
mov ecx, 0x6794
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x84be12
cmp byte [edi], 0x24
jne 0x84be12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x84be17
lea edi, [esi + 0x448000]
mov eax, dword [edi]
or eax, eax
je 0x84be8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x44d320]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x44d438]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x84be44
mov ecx, edi
jns 0x84be73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x44d43c]
or eax, eax
je 0x84be89
mov dword [ebx], eax
add ebx, 4
jmp 0x84be61
call dword [esi + 0x44d44c]
mov ebp, dword [esi + 0x44d440]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x84bec3
sub esp, 0xffffff80
jmp 0x4ecaf5
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40596d
pop dword [ebp - 0x1c]
mov eax, 0xf21f7277
add eax, 0xe20e6f6
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xa0e05b0f
sub dword [ebp - 0x2c], 0x528e15c4
mov dword [ebp - 0x28], 0x22ed7750
add dword [ebp - 0x28], 0xf45d4f5
mov dword [ebp - 0x24], 0xe4bdd3
sub dword [ebp - 0x24], 0xb49879a5
mov dword [ebp - 0x20], 0x32057281
add dword [ebp - 0x20], 0xcdfa8d7f
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x4039073
add eax, 0xfc3cdfed
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xa0d46eb9
add dword [ebp - 0x2c], 0xd39dfa9d
mov dword [ebp - 0x28], 0x1d81d4bc
sub dword [ebp - 0x28], 0xdc157347
mov dword [ebp - 0x24], 0x1e5ba9e7
add dword [ebp - 0x24], 0x4513c285
mov dword [ebp - 0x20], 0x157e333
add dword [ebp - 0x20], 0xfea81ccd
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x358df
push 0
call eax
mov ecx, 0x435a
mov ebx, eax
mov esi, 0x77ca399c
add esi, 0x8876c664
add esi, dword [ebp - 0x1c]
mov edi, 0x9d6e8c67
add edi, 0xe99d64c0
xor dword [ebp - 0x18], 0xafaf7d64
mov edx, dword [esi]
add dword [ebp - 4], eax
sub edx, edi
mov dword [ebx], edx
xor dword [ebp - 0x18], esi
add ebx, 0xf26539fc
add ebx, 0xd9ac608
add esi, 4
loop 0x405a84
add eax, 0x1003b
xor ebx, ebx
add ebx, eax
add eax, 0xb77c4afc
sub eax, 0xb77c4af7
mov ecx, 0x6db861bd
sub ecx, 0x6d7861bd
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x87f4da
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0x861515

Function at 0xb22b38
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf bx, ax
mov ebp, 0xbe2857ca
xchg dx, bx
btr edi, edx
jmp 0xb22b80
bsr cx, bp
mov edx, dword [esp + 0x27]
lea ebx, [ecx*4]

Function at 0xb22dff
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
jmp 0xb22e64
mov edi, 0x5d2a2d88
push word [esp + 0x11]
mov ebx, eax
rdtsc
popal
jmp 0xb22e47
lea ebp, [ebp + 0x53c997af]
btc ebp, ebx
xchg byte [esp], dl
mov si, dx
not ch
sub esp, 0xe
jmp 0xb22e2d
mov dl, dh
mov word [esp + 2], sp
lea ebx, [esp + edi]
pop dword [esp + 0x14]
mov dword [esp + 0x19], ecx
mov dh, byte [esp + 0x17]
jmp 0xb22e02
Function at 0xb23310
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, bx
add esp, 0xb
bswap edx
pop cx
setle bh
mov edi, ebp
jmp 0xb2331c
pop bx
mov di, word [esp + 1]
neg dx
jmp 0xb232f9
mov cl, 0x42
rdtsc
lea ecx, [esi + 0xcd]
lea ebx, [ecx - 0x412823dd]
xor dl, ch
lea ecx, [ecx - 0x73]
jmp 0xb2336f
shr ebp, 0x1b
mov bx, 0x3563
lea edi, [ecx + 0xb]
cld
mov esi, 0x22f6f574
mov si, dx
jmp 0xb233df
rol dx, cl
mov cx, 0xcd55
mov bl, bh
mov ecx, ebp
mov cx, dx
xor dl, ch
jmp 0xb2334c
setle bh
inc edi
btc esi, ebx
ror dh, 7
lea ecx, [ebp + 0xf]
mov bl, bh
jmp 0xb233c0
cpuid
bswap ebp
lea edx, [esi*4]
mov ebp, 0x633e8bee
jmp 0xb23381
sub bl, ah
rdtsc
btc edi, edi
bsf ax, ax
xor ebp, esi
mov di, dx
jmp 0xb23397
cmc
mov edx, ebp
push esp
xchg dword [esp], edi
cpuid
cmc
jmp 0xb233f0
mov dl, byte [esp]
xchg ebx, ebp
xchg ah, bl
mov edx, esi
lea ecx, [ebx + edi]
shr ebp, 0xd
jmp 0xb233ae
rcr ebp, 0xf
not esi
mov di, word [esp + 2]
neg ebx
mov di, sp
lea ebp, [ebp*4]
jmp 0xb23459
pop bp
sete dh
xchg si, bp
lea ebx, [esi - 0xdd]
sub edi, eax
rcr ebp, 7
jmp 0xb2356d
setle bh
add esp, 1
btc esi, edi
xchg byte [esp], al
lea edi, [edi + edi]
sub esp, 0xe
jmp 0xb2342f
pop ax
mov edi, eax
mov bl, bh
xchg word [esp + 1], cx
call fcn.00b2348a
mov dword [esp + 1], ecx
xchg bx, cx
cmc
stc
pop si
mov edx, 0x2a79a696
jmp 0xb234f8
inc cx
xchg word [esp + 0xa], bp
not dh
push dword [esp + 8]
mov ecx, 0x55e9a1fa
lea ecx, [esi*4]
jmp 0xb234a6
pop word [esp + 1]
lea ebp, [edx + esi]
xchg dx, si
xchg edx, ecx
mov edi, ebp
rdtsc
jmp 0xb23554
mov bh, byte [esp + 5]
not dx
btr esi, edx
lea eax, [ebp*4]
xchg esi, edi
cpuid
jmp 0xb234dd
xchg ebx, esi
bsr cx, bp
mov dword [esp + 0x21], ecx
cpuid
inc bp
sub esp, 0xa
jmp 0xb23584
push dword [esp]
ror esi, 0x13
inc edi
pop bp
xchg word [esp + 3], ax
jmp 0xb235ca
neg ebx
pop ebx
setbe dh
xchg edx, ebp
neg cx
sub esp, 0x14
jmp 0xb23529
mov esi, dword [esp + 0xb]
mov si, bx
add esp, 2
mov cx, 0x8ce9
push dword [esp + 6]
rcr ebp, 0x1f
jmp 0xb23512
mov esi, 0xddb88c54
lea esp, [esp + 3]
popal
mov di, word [esp + 4]
xchg dword [esp], ebp
inc bp
jmp 0xb2353c
add esp, 1
not di
rdtsc
mov ebx, ecx
cmc
rdtsc
jmp 0xb23655
mov word [esp + 6], di
lea esp, [esp + 0xd]
xchg ecx, edx
mov ebp, esi
lea esi, [esi*4]
mov cx, word [esp]
jmp 0xb235a5
mov si, word [esp]
not bp
mov si, sp
lea esp, [esp]
xchg byte [esp], bl
call fcn.00b235e4
nop
adc al, byte [eax + 0x13dd12e7]
mov ah, byte [0x9e8dc754]
movsd dword es:[edi], dword [esi]
mov byte [ebx + 0x242c889c], ch
lea ebx, [esi - 0x6354775b]
mov byte [esp], ch
mov cl, 0x1a
not dh
lea esp, [esp]
mov ch, byte [esp]
jmp 0xb23607
xchg byte [esp], al
lea esp, [esp + 1]
mov ax, 0xadd5
mov di, word [esp]
mov ecx, 0x8b8fd68c
not ecx
jmp 0xb23627
Function at 0xb23749
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
cmc
mov eax, 0x9acf259c
jmp 0xb237ad
neg ch
neg ch
inc dx
not dx
mov di, word [esp + 2]
jmp 0xb2380e
pop word [esp]
lea edi, [ebx + edi]
btc ebx, ebx
neg ch
xchg ebp, esi
mov eax, dword [esp]
jmp 0xb23797
mov word [esp + 8], di
bswap eax
lea ebx, [ecx + 0x3b]
mov bp, 0xc86f
stc
jmp 0xb23d97
mov edx, dword [esp]
sub esp, 0x12
pop esi
xchg dword [esp + 7], esi
mov dx, word [esp + 9]
pop word [esp + 7]
jmp 0xb237d7
xchg cx, di
mov ebp, ecx
mov byte [esp + 1], bh
xchg esi, edi
mov word [esp], dx
jmp 0xb237ed
pop word [esp + 7]
mov word [esp + 0x21], dx
xchg word [esp + 1], dx
lea esp, [esp + 0x1a]
jmp 0xb2394b
sub esp, 0x12
mov bl, bh
pop bp
mov ax, word [esp + 0x22]
push word [esp + 0x2e]
lea esp, [esp + 8]
jmp 0xb23842
mov bl, bh
mov si, 0xbd6b
mov bp, dx
mov ebp, dword [esp + 0x1e]
rdtsc
mov word [esp + 0x1a], bx
jmp 0xb2385d
btr ebx, edx
lea esp, [esp + 0x15]
mov dx, 0xca27
sub esp, 0x18
btc esi, edi
pop word [esp + 6]
jmp 0xb23885
mov esi, ecx
push edx
lea ebx, [eax + ebx]
push dword [esp + 0xb]
lea edi, [esp + eax]
rol bp, cl
jmp 0xb23922
pop ax
lea edx, [esi + edi]
mov dx, word [esp]
call fcn.00b23962
fistp word [eax - 0x32]
test eax, 0x2435b058
push edi
mov esi, 0xedbd0f66
bsr bp, bp
btc edx, ebx
cpuid
xchg ah, bl
pop word [esp + 2]
bsr si, bp
jmp 0xb238bc
mov dword [esp + 0xa], esi
shr dh, 7
mov word [esp + 0xc], sp
lea ebx, [ecx + 0x159f699b]
neg dh
btr esi, edx
jmp 0xb238e6
rol cx, cl
xchg word [esp + 3], dx
mov cx, word [esp + 0x14]
mov word [esp + 2], sp
sub esp, 0x10
bswap eax
jmp 0xb238ce
xchg byte [esp + 4], al
mov byte [esp + 0x11], ch
lea edi, [esi - 0x65]
mov di, 0x6cb9
btc edi, edi
sete ah
jmp 0xb23909
pop word [esp + 9]
lea ebp, [edx*4]
pop si
mov byte [esp + 0x10], ah
cld
lea eax, [ebp*4]
jmp 0xb238a4
sub esp, 0x1c
stc
lea ebp, [ecx*4]
xchg ecx, eax
xchg dword [esp + 8], ebx
rdtsc
jmp 0xb2397e
setae bh
mov al, ah
inc edx
mov dl, 0xf4
lea esp, [esp + 3]
mov word [esp + 8], dx
jmp 0xb23b8f

Function at 0xb23962
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [esp + 0x11]
xor eax, esi
mov byte [esp + 0x27], ah
jmp 0xb23b46
sub esp, 0x1a
mov bl, 0x88
mov ecx, 0xbf883950
call fcn.00b239ea
pop es
test dword [0xb75e8f7c], edx
movsb byte es:[edi], byte ss:[esi]
ret
xchg di, dx
neg eax
mov esi, 0xd500b82a
xchg edx, edi
setbe bh
clc
jmp 0xb2399d
mov bl, bh
cpuid
bsr dx, cx
lea esp, [esp]
lea ebx, [ebx + edi]
xchg edi, ebx
jmp 0xb239bc
neg bx
mov cl, ch
setae ch
lea edi, [edx + edx]
xchg ebp, ebx
mov edx, dword [esp]
jmp 0xb239d8
add esp, 1
rdtsc
add esp, 0
neg si
bswap eax
mov esi, 0xefbbfb60
jmp 0xb23a16
pop ax
add esp, 3
add esi, ebp
btc ecx, edi
cpuid
mov di, dx
jmp 0xb23aa3
cpuid
push word [esp + 4]
lea edi, [ecx - 0x63]
mov byte [esp + 5], dh
cpuid
mov dword [esp], ecx
jmp 0xb23abf
xor cx, 0x387c
popal
mov di, 0x426b
rdtsc
bsr di, bp
add esp, 6
jmp 0xb23b14