joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10051657
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0x1008da5d
cwde
rdtsc
cwde
mov esi, dword [edi + 4]
push 0x9e272e79
rdtsc
mov eax, esi
lea edx, [ecx*2 - 0x5614081a]
setg dl
pushal
call int.1007f9aa

Function at 0x10059d79
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x44]
call fcn.1000caf2
stc
add esp, 0x18
cmp cl, 0xc9
test eax, eax
pushal
lea esp, [esp + 0x20]
jne 0x1006b13d
pushal
btr eax, 9
lea ebx, [ecx - 0x7e920b13]
mov edx, dword [ebp + 4]
pushfd
cwde
mov eax, edx
push esi
adc cx, 0xab15
test bh, dh
lea ebx, [eax + 2]
not ch
ror cl, cl
call fcn.100597f5

Function at 0x1005c770
Capabilities:
Packed with generic packer

Disassembly:
cmc
cmp eax, ebp
pushfd
jmp 0x1005c4fa

Function at 0x10066f22
Capabilities:
Packed with generic packer

Disassembly:
add eax, 0xfffffff5
stc
clc
clc
cmp eax, ebp
jmp 0x10084942

Function at 0x1006dfac
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
pushal
add esp, 0x38
stc
cmp dl, cl
pushfd
cmp dl, ch
test eax, eax
push dword [esp]
lea esp, [esp + 8]
jne 0x10133ef9
rdtsc
not dl
mov bx, 0xeec9
mov edx, dword [ebp + 4]
push ebx
pushfd
mov eax, edx
movsx bx, al
setl bl
not ebx
lea ebx, [eax + 2]
pushfd
pushal
lea esp, [esp + 0x2c]
jmp 0x100d264f
lea esp, [esp + 0x28]
call fcn.1000caf2
test cl, ah
jmp 0x1006989b
rdtsc
lea eax, [esp + 0xa0]
test cl, 0xf4
add dx, cx
lea edx, [eax + 2]

Function at 0x1007056a
Capabilities:
Packed with generic packer

Disassembly:
push 0x86c4fbca
mov dword [esp + 0x24], eax
pushal
mov byte [esp + 4], ch
lea esp, [esp + 0x44]
call fcn.1000c94b
movzx dx, cl
seta cl
movsx edx, dl
lea edx, [ebp*2 + 0x2e61b649]
push 4
setg cl
bswap edx
lea ecx, [esp + 0x24]
movsx dx, dl
push ecx
movsx dx, dl
lea edx, [esp + 0x25c]
push 0x3fe5b1b3
pushal
pushal
mov dword [esp + 0x40], edx
push ecx
lea esp, [esp + 0x44]
call fcn.1000caf2
clc
jmp 0x101215db
bt di, 2
add esp, 0x18
push edi
stc
test eax, eax
mov word [esp], 0xf1c9
lea esp, [esp + 4]
jne 0x1006b13d
pushfd
push 0xf7798753
mov al, 1
pushfd
push dword [esp]
lea esp, [esp + 0x10]
jmp fcn.1004523a

Function at 0x1007e7d2
Capabilities:
Check for software breakpoints

Disassembly:
test ch, bh
xor edx, 0xe157aaf
clc
jmp 0x100a542f
xor ebp, 0xeabcff35
cmc
xor eax, 0x49a10939
stc
xor ecx, 0x92b71622
invalid
or dword [ecx - 0xe7e06b7], esp
and dl, byte [esi]
mov bh, 0x92
call fcn.100fd557
shr byte [eax + 0x3e], 0x55
jl 0x1007e884
or esp, edx
leave
mov edi, 0x9651cea7
push 0xffffffffffffffa8
xor cl, byte [ebx + 0x3521657d]
pop ebx
outsb dx, byte [esi]
lodsb al, byte [esi]
inc eax
mov ebx, 0x5c978280
push edi
fdivr dword [0xd1225350]
sub dl, byte [ebx - 0x28]
jecxz 0x1007e876
and dword [esi], 0x60
inc edi
cmp al, 0xcc
sub al, 0xd4
rcr bh, cl
cdq
cli
jle 0x1007e87c
sbb dword [eax], 0x5f2963cc
or al, 0xa8
sbb dword [esi + esi*8], ebx
xchg ebp, eax
iretd
xor esi, 0xb2f8d40e
jmp 0x1007e873
Function at 0x100a5f7d
Capabilities:
Packed with generic packer

Disassembly:
test dh, 0x44
xor ebx, 0xca75e6d6
push dword [esp + 8]
jmp 0x10109c26
std
push dword [esp + 0x2c]
popfd
pushfd
push dword [esp + 0x34]
ret 0x38
jmp 0x100c3805
sbb esi, dword [ebx + 0x4e]
xor dword [esi], edx
add eax, 0x8d35dc78
mov dword [0xef57746f], eax
jae 0x100c3742
invalid
invalid
imul ebx, dword [edi], 0x98d3cb46
das
je 0x100c372d
adc dword [eax], esp
xor esi, 0x5870a704
pushal
xor eax, 0x2c687b17
jmp 0x10064ac6
sbb byte [ecx], bl
mov edx, 0xb9784bc2
out dx, al
jg 0x100c3822
or al, 0xb6
mov edi, 0x480f187f
and eax, 0xcdb4ed9c
test al, 0xe3
jno 0x100c3769
out 0x33, eax
sbb ecx, dword [0x98fb6005]
cmpsb byte [esi], byte es:[edi]
scasb al, byte es:[edi]
aaa
popal
and al, 0x59
ljmp 0x7e1e
pushfd
pushfd
lea esp, [esp + 0x4c]
call fcn.1000c94b
setle al
xchg cx, ax
lahf
push esi
lea ecx, [ebx*8 + 0x7f1e48b2]
call fcn.100e9304
push 0x75ee266e
sub al, 0x33
mov edx, 0x292129f1
add byte [eax + 0x6e], ch
out dx, al
jne 0x100c3855
xor edi, dword [edx + 0x292129f1]
and dword [ecx], ebp
mov es, word [edx + 0x54]
xchg esi, eax
insb byte es:[edi], dx
popal
jp 0x100c37c3
add eax, 0x119f9522
jb 0x100c387b
fiadd word [esi + 0x7a403c26]
imul ecx, dword [edx], 0x63c2cfc9
add ah, ah
jb 0x100c386f
outsd dx, dword [esi]
jns 0x100c382d
push esi
push ds
int 0xaf
scasd eax, dword es:[edi]
xchg ebx, eax
cmp ebx, dword [edi]
aad 0xdb
inc ebx
pop esp
adc byte [eax - 0x20b8a6ac], bh
faddp st(0)
invalid
inc ebp
sbb al, 0
xchg ecx, eax
mov edx, 0xe8abe124
invalid
ret
xor edx, 0x21f0495d
jmp 0x1006981d

Function at 0x100a7399
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
call fcn.1000caf2
cmc
test cl, 0x5c
pushal
add esp, 0x38
bt edx, ebx
ja 0x100e9287
test eax, eax
pushfd
push 0xd62bb14e
lea esp, [esp + 8]
jne 0x1006b13d
xadd dx, ax
mov edx, dword [ebp + 4]
call fcn.10101ff8
clc
test eax, eax
call fcn.1012c84a

Function at 0x100b497f
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x20]
call fcn.1000caf2
stc
test sp, bx
jmp 0x100e7af9
add esp, 0x18
jmp 0x100f95f6
cmp ah, 0x73
mov edx, dword [ebp + 4]
test si, 0xcb1c
lea eax, [esp - 0x39092d0c]
setbe ah
or eax, ebx
mov eax, edx
test bp, bx
bswap bx
xchg bx, cx
call fcn.10050ac7
sbb dword [eax - 0x534a229a], eax
jb 0x1007d9b5
mov byte [0x36972fd8], al
lds ebx, [edi - 0x76]
in eax, dx
push ebx
xor dword [ecx + 0x55], 0xffffff84
push ecx
pushal
int1
and dword [ebx - 0x1c], esp
not dword [esp + ebx]
cmp eax, 0x90a0774
inc ebx
push cs
add bl, byte [edi]
int3
wait
invalid
test eax, eax
pushal
lea esp, [esp + 0x20]
jne 0x1006b13d
shr cl, 7
cdq
jmp 0x1007d94b
lea esp, [esp + 0x34]
call fcn.1000c94b
bswap ax
push esi
bswap cx
not eax
lea eax, [esp + 0x1e0]
pushfd
lea ecx, [edx - 0x5bd2aed]
not ch
lea ecx, [edi*2 - 0x28f9a99a]
mov dword [esp], eax
movzx ecx, bl
setns cl
lea ecx, [esp + 0x45c]
pushal
mov byte [esp], bl
mov dword [esp + 0x1c], ecx
mov byte [esp + 4], 0x8a
mov byte [esp], 0x2f
jmp 0x1004edfa
jmp 0x1005d064
jmp 0x1008bbf3
Function at 0x100b81e0
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x1010f706
lea esp, [esp + 0x14]
je 0x1008da5d
bts ax, bx
pushfd
mov esi, dword [edi + 4]
bts dx, dx
mov eax, esi
bswap cx
lea edx, [eax + 2]
bt cx, bx
movsx cx, bl
bsr cx, bp
bswap cx
lea esp, [esp + 4]
inc cx
push 0x3ec1516a
pushal
adc ch, bl
mov cx, word [eax]
stc
cmp ah, 0xca
add eax, 2
cmp sp, cx
cmp cx, bp
call fcn.100908bc

Function at 0x100c5d0c
Capabilities:
Packed with generic packer

Disassembly:
cdq
lea eax, [esp + 0x28]
test sp, 0xd19d
shrd cx, bp, 6
movsx dx, al
lea edx, [eax + 2]
pushal
mov cx, word [eax]
stc
call fcn.100ec816
out dx, eax
aad 0xcc
and ecx, dword [ebx - 0x7e]
cmp dword [eax + 0x2bc49ea6], edx
dec ebx
cmp esp, 0x2a
mov ebp, 0x93831e06
fmul qword [eax - 0x9ac0f69]
jmp 0x1006b18a
xor edx, dword [ebx + 0x7d99c556]
pop edi
jb 0x1006b1e5
adc bl, byte [eax - 0x12]
outsd dx, dword [esi]
and bl, bh
pop ecx
int3
push edx
mov edi, dword [0xb29f666c]
push ebx
insb byte es:[edi], dx
lahf
mov dl, 0x53
insb byte es:[di], dx
salc
ret
aaa
aaa
ljmp 0xb9a6
ror dword [ecx], 1
out 0xc0, al
mov ch, 0xb8
scasd eax, dword es:[edi]
imul esi, dword [esi - 0x3bc3cb05], 0x507658fe
and al, 0xfa
jnp 0x1006b25b
xor al, 0x3c
invalid
add eax, 0x77fd4e7f
mov eax, 0xb2707855
jle 0x1006b199
jg 0x1006b24b
std
ja 0x1006b1b8
push ebp
js 0x1006b273
mov dl, 0x7e
xchg ebx, eax
sub dword [0x7361e02e], ebp
loop 0x1006b23a
loopne 0x1006b26c
jae 0x1006b1ef
sub al, 0x8b
adc esi, dword [edi - 0x5c7cc636]
adc dword [eax + 0x77cc1c51], esi
lahf
mov edx, dword [ebx]
mov bh, 0xca
cmp dword [ebx + 0x51b011a3], eax
sbb al, 0xcc
ja 0x1006b1bb
jmp 0x1006b1d3
sbb ecx, dword [eax - 0x2229a255]
jl 0x1006b2b2
fnstsw word [ebp + esi*2 - 0x26]
cli
loope 0x1006b208
invalid
imul esp, dword [ebp + ebx*2 + 0x12edd30d], 0x68
daa
adc byte [ebp + 0x1fac7516], dl
push 0x16951027
xchg ebp, eax
push ss
jne 0x1006b1fb
pop ds
salc
jno 0x1006b2c4
or byte [edi + 0x49223279], al
xor bl, cl
sbb ah, bh
movsb byte es:[edi], byte [esi]
cmpsb byte [esi], byte es:[edi]
jmp 0x1006b26d
imul esi, esp, 0xffffffe2
hlt
sbb edx, eax
add bh, ah
push cs
jnp 0x1006b26f
jl 0x1006b248
ja 0x1006b287
int3
leave
div ch
sub ebp, dword [ebx + 0x18]
in eax, dx
into
loopne 0x1006b235
xor al, 0xe1
in eax, dx
loope 0x1006b27a
pop edi
inc esi
or bh, bh
lahf
sahf
dec edi
push eax
cmp dword [esi], edi
mov byte [0x6045338c], al
loop 0x1006b28b
int3
adc edx, eax
ja 0x1006b280
stc
mov dh, 0xca
sbb dword [bp + di + 0x75], esi
sbb al, 0x25
xchg byte [edx - 0x27], bl
frstor dword [edi - 0x70]
nop
rol eax, 1
adc ch, byte [edx + 0x45]
and ebp, dword [edx + 0xb]
popal
add eax, 0xd0e6dbd
pop ds
nop
adc byte [esi + 0x745ec5f1], ch
hlt
lea esp, [esp + 0x28]
jne 0x1006b13d
jmp loc.100035e8
jmp 0x100a9537
Function at 0x100ca1db
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add cl, bl
mov ecx, dword [esp + 0x40]
pushal
sub esp, 0xffffffe0
xor ecx, esp
call fcn.10101677
call fcn.10064afa
push 0x12
cwde
or al, 0xe5
stosb byte es:[edi], al
mov ah, 0x5f
jecxz 0x10045e71
out dx, eax
or dword [edi - 0x24f640a], esi
cld
scasb al, byte es:[edi]
pop edi
aas
mov al, 0x75
pop ebx
fucom st(7)
aad 0xed
lodsb al, byte [esi]
mov byte [0x98161e0], al
div dword [eax - 0x5a513945]
dec ebx
adc byte [ecx*8 + 0x7710ee8], dl
fxch st(3)
add ebx, dword [ecx + 0x10]
enter 0xffffffffffffa5ff, 0xffffffffffffffed
aam 0xab
in al, 0xc5
mov dword [ebx + 0x7d], ebp
jl 0x10045de8
ret 0x94a8
mov ebp, 0x6818cb48
mov al, byte [0x2f5248c6]
nop
outsd dx, dword [esi]
dec ecx
out 0x1f, eax
push ds
add al, 0xfa
cmp ebp, dword [edx]
invalid
sub eax, esi
bts si, sp
shld esi, esp, cl
not si
shr esi, 0x16
sar eax, 1
btc si, bp
add eax, 0xfffffff4
bswap si
push ecx
movsx esi, dl
lea esi, [edx*4 + 0x347eebef]
mov esi, dword [esp + 4]
pushfd
push esp
lea esp, [esp + 0x10]
js 0x10045e0b
movsx cx, al
pushfd
mov dword [esp], 0xc
not ch
bswap cx
bswap cx
sets cl
lea ecx, [esp + 4]
pushal
mov word [esp + 4], sp
pushal
mov dword [esp + 0x3c], ecx
pushfd
mov byte [esp], 0x8f
call fcn.1005be3b
test cx, cx
jmp 0x100f3047
btr cx, 2
rcl cx, 1
mov dword [esp + 0x4a], eax
bswap cx
shld cx, bp, cl
add cx, 0x824f
or cl, 0xc7
mov dword [esp + 0x4e], eax
pushfd
and cl, 0xdb
mov dword [esp + 0x56], eax
setge ch
rol cl, cl
pushfd
bswap cx
mov dword [esp + 0x5e], eax
rcl ch, 4
mov dword [esp + 0x62], eax
pushfd
movsx cx, cl
mov dword [esp + 0x6a], eax
shld cx, dx, cl
add cl, dh
btr cx, dx
inc cx
mov dword [esp + 0x6e], eax
and ch, ah
movzx cx, al
pushfd
push 0x549fe155
mov dword [esp + 0x7a], eax
shr ch, cl
sub cl, 0xc5
shld cx, bp, 7
movsx cx, dl
mov word [esp + 0x7e], ax
setno cl
aas
bsf cx, ax
rcl ch, cl
mov eax, edx
movsx cx, bl
test ebx, eax
xor cl, 0x64
mov dword [esp + 0x3c], esi
and si, ax
mov word [esp + 0x40], 0x4e
shl esi, cl
and si, cx
mov word [esp + 0x42], 0x4b
btc cx, 3
inc cx
mov word [esp + 0x44], 0x44
rol cl, 2
mov word [esp + 0x46], 0x61
cmc
shrd si, di, 0xf
movsx cx, al
dec si
mov word [esp + 0x48], 0x65
btc cx, 0xe
xchg si, cx
mov word [esp + 0x4a], 0x6d
shld si, dx, 0xe
or esi, 0x4d8fd0ff
neg cl
mov word [esp + 0x4c], 0x6f
adc si, 0xcef
mov word [esp + 0x4e], 0x6e
test cl, 8
not si
shr ch, 1
clc
mov word [esp + 0x50], 0x2e
ror cl, cl
movzx si, al
mov word [esp + 0x52], 0x64
xor si, 0x855b
bswap cx
shrd cx, ax, 3
not cl
mov word [esp + 0x58], 0
btr si, 1
sal si, cl
add cx, 0x9a15
btc si, 0xa
lea esi, [eax + 2]
sub esp, 0xffffffc4
shrd cx, cx, cl
setl cl
mov cx, word [eax]
cmp al, cl
clc
pushfd
add eax, 2
jmp 0x100c8a81
pushal
mov byte [esp], dl
lea esp, [esp + 0x24]
jne 0x100ca329
jmp 0x10099a13
Function at 0x100ce8cb
Capabilities:
Packed with generic packer

Disassembly:
shr cl, 4
lea ebx, [eax + 2]
cmp cl, 0x91
add cl, 0xc9
neg ch
not cl
mov cx, word [eax]
stc
pushfd
add eax, 2
pushal
test cx, cx
push edi
call fcn.1008cebc
push edx
pushal
lea esp, [esp + 0x20]
call fcn.1000caf2
cmc
test ecx, ebp
add esp, 0x18
cmp bl, cl
pushfd
test eax, eax
mov byte [esp], 0x85
push 0xb518e936
push 0xc562130
call fcn.1005f995
pushal
pushfd
pop dword [esp + 0x1c]
push dword [esp + 8]
pushfd
xor dword [esp + 0x24], 0x884
clc
xor eax, 0x3eb67895
jmp 0x10066f94
xor edi, 0x956ad687
cmp esp, ecx
xor esi, 0x65ff621a
call fcn.1011b47d
call fcn.100fa3b7
call 0x1006b6ee
stc
test eax, eax
pushfd
lea esp, [esp + 4]
jne 0x1006b13d
rdtsc
mov edx, dword [ebp + 4]
rol cl, 1
daa
mov eax, edx
jmp 0x10058e7a
push 0xdd239e5c
push dword [esp + 0xc]
lea esp, [esp + 0x14]
call fcn.1000c94b
movsx ecx, bl
push ebx
movzx dx, bl
lea ecx, [eax*4 + 0x62b0cf94]
lea ecx, [esp + 0x70]
bswap dx
push ecx
bswap edx
jae 0x1006ba69
movsx dx, cl
movzx dx, al
lea edx, [esp + 0x4b4]
jmp 0x10064938

Function at 0x100d5d5f
Capabilities:
Packed with generic packer

Disassembly:
bswap cx
not ecx
push 0xb
movzx ecx, cl
movsx cx, bl
lea ecx, [esp + 0x118]
pushal
mov dword [esp + 0x1c], ecx
push 0x44d52618
lea esp, [esp + 0x20]
jmp 0x100b493e
push 0xd11bb177
push dword [esp]
pushfd
lea esp, [esp + 0x14]
jl 0x100b6682
not cl
jmp 0x10061be6

Function at 0x100e0f16
Capabilities:
Packed with generic packer

Disassembly:
push 0x46a35656
mov dword [esp + 4], ecx
pushal
push dword [esp]
push dword [esp]
lea esp, [esp + 0x2c]
jmp 0x100b493e

Function at 0x100e64d0
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x48]
jne 0x1006b13d
or ah, 0xeb
push ebx
mov edx, dword [ebp + 4]
bt esp, ebx
mov eax, edx
clc
lea ebx, [eax + 2]
sar cl, cl
shrd cx, si, cl
rol ch, 2
mov cx, word [eax]
clc
mov word [esp], bp
add eax, 2
bt ax, 3
jmp loc.10003773
test eax, eax
pushal
pushfd
jmp 0x1010f757
jmp 0x100827ae

Function at 0x100ec4a8
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x34]
call fcn.1000caf2
stc
add esp, 0x18
clc
test eax, eax
push 0xab6c96fa
push dword [esp]
pushfd
mov byte [esp + 8], 0xd7
lea esp, [esp + 0xc]
jne 0x1006b13d
xor al, bh
bt bp, sp
mov edx, dword [ebp + 4]
das
mov ah, 0x98
bsf bx, dx
mov eax, edx
setnp ch
sal ch, 7
call fcn.100ab751
xor esi, 0x54a04858
clc
xor ebp, 0xdefbae77
clc
xor ecx, 0xcb10400c
jmp 0x101227ac
push dword [esp + 0x30]
popfd
mov byte [esp + 0xc], bh
push ebx
push dword [esp + 0x38]
ret 0x3c
Function at 0x100ec816
Capabilities:
Packed with generic packer

Disassembly:
push ecx
mov byte [esp], al
lea esp, [esp + 0x2c]
jne 0x1006b153
btc cx, sp
bswap cx
shrd si, cx, cl
mov ecx, dword [ebp + 4]
btc esi, 3
movsx esi, al
movsx si, bl
lea esi, [eax - 0x6e1d0425]
sub eax, edx
sar dl, cl
and dh, cl
shl dx, 7
sar eax, 1
btc si, 2
btr esi, edi
mov esi, eax
aas
neg dh
lea eax, [edi + edi]
inc dx
bsr edx, edi
rcr dl, 1
sal dx, 0xa
push esi
cmc
cmc
rcr dh, cl
add ecx, eax
pushfd
movzx edx, dl
mov dword [esp], ecx
bswap edx
mov dx, sp
lea edx, [esp + 0x450]
call fcn.1010286e
add eax, 2
mov word [esp], bp
clc
mov byte [esp], 0x19
pushfd
test cx, cx
jmp 0x100a4412

Function at 0x100ecc97
Capabilities:
Packed with generic packer

Disassembly:
push 0xe0047d82
mov dword [esp + 0x20], ecx
pushal
pushfd
mov byte [esp + 0xc], 0x80
lea esp, [esp + 0x44]
jmp 0x100b493e
jmp 0x1007f572

Function at 0x100f9fa5
Capabilities:
Packed with generic packer

Disassembly:
setb dh
lea edx, [esp + 0x280]
push dword [esp]
pushfd
mov byte [esp], 0xd5
mov byte [esp + 4], dl
mov dword [esp + 0x28], edx
mov byte [esp + 4], 0x8a
push dword [esp]
lea esp, [esp + 0x2c]
call fcn.1000caf2
test bh, 0xa7
pushal
test dx, 0x1bea
add esp, 0x38
stc
pushfd
test eax, eax
push 0xf63e39ff
lea esp, [esp + 8]
jne 0x1006b13d
push 0xe9b7f24a
pushal
not al
mov al, 1
pushal
mov byte [esp], dh
lea esp, [esp + 0x44]
jmp fcn.1004523a

Function at 0x100fa05a
Capabilities:
Packed with generic packer

Disassembly:
movsx cx, bl
pushal
lea eax, [esp + 0x200]
lea ecx, [0x3053b6ee]
mov dword [esp + 0x1c], eax
lea ecx, [ecx - 0x189686cc]
bswap ecx
mov byte [esp], 0xe4
jmp 0x100f7173
lea ecx, [esp + 0x478]
pushfd
jmp 0x1010323a
mov dword [esp + 0x2c], edx
mov dword [esp + 8], 0x29ed6ac7
mov byte [esp], bh
lea esp, [esp + 0x2c]
call fcn.1000c94b
xchg cx, ax
lea ecx, [ebp - 0x5038c846]
push esi
jmp 0x100712ca
push 0xa58b4d7b
pushfd
mov dword [esp + 0x24], ecx
push 0x14ca3bc2
push 0x91cf72da
push ebp
mov word [esp], 0xc518
lea esp, [esp + 0x30]
call fcn.1000caf2
cmp ch, 0xe
stc
clc
stc
add esp, 0x18
cmc
test eax, eax
pushfd
pushfd
pushfd
pushal
lea esp, [esp + 0x2c]
jne 0x1006b13d
rdtsc
btr cx, cx
not al
mov edx, dword [ebp + 4]
call fcn.101239d8
inc edx
mov dl, byte [ecx]
mov ecx, 0x42e37ff
mov esp, 0xb9417922
sub al, ch
xor al, 0x55
and ch, byte [ecx]
jmp 0xc3a91cc3

Function at 0x1010286e
Capabilities:
Encode data using xor

Disassembly:
push dword [esp]
pushfd
mov dword [esp + 8], edx
call fcn.100cc6df
sal byte [edi + 0x4e], 1
add al, 0xdd
arpl word [ebx + eax*8 - 0x16], cx
loopne 0x1010289e
push cs
push ebp
outsb dx, byte [esi]
dec edx
pop ecx
invalid
enter 0xffffffffffffd478, 0x30
or dl, dh
ljmp 0x983c

Function at 0x1010b6de
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], 0xde
lea esp, [esp + 0x2c]
je 0x1008da5d
bsr si, cx
movzx ebx, dl
mov si, bx
lea edi, [ebx - 0x66e7d77e]
sub al, al
xor cl, al
adc esi, esp
lea ecx, [esp + 0x55b46564]
lea ecx, [eax - 0x4808abc4]
mov ecx, dword [esp + 0x254]
xadd di, si
xchg bp, di
movsx bp, cl
pop edi
sub bp, 0xb8e8
sar esi, 0xb
neg bx
pop esi
or bx, 0x1d8e
adc bl, 0x29
xchg bp, bx
rcl bh, 6
pop ebp
call fcn.100b1e6f
Function at 0x10112b71
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
jl 0x10050917
not cx
pushfd
pushfd
mov dword [esp + 4], 0xc
pushal
pushfd
setg ch
lea ecx, [esp + 0x100]
setne dl
call fcn.100a7ca9

Function at 0x10112b9c
Capabilities:
Packed with generic packer

Disassembly:
push 0x705c31af
mov byte [esp + 8], al
lea esp, [esp + 0x50]
call fcn.1000caf2
clc
bt bp, sp
add esp, 0x18
clc
cmp ebp, ebp
stc
test eax, eax
push 0xbcde6f30
lea esp, [esp + 4]
jne 0x1006b13d
bts edx, edi
cdq
rdtsc
mov edx, dword [ebp + 4]
shld ax, bx, 1
mov eax, edx
pushal
stc
lea ebx, [eax + 2]
call int.10111ca6

Function at 0x10114d24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bswap dx
lea edx, [ecx + edi*2]
not ah
movsx eax, bl
pushfd
mov dword [esp + 8], edx
lahf
jmp loc.10006b1f

Function at 0x1011a66d
Capabilities:
Encode data using xor

Disassembly:
xor esi, 0xfb1de93c
jmp 0x100e3e9d

Function at 0x1011bdf3
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
jne 0x1004522a
aaa
lahf
shl cl, 2
sar ax, cl
lea eax, [esp + 0x1d0]
btr dx, cx
lea edx, [eax + 2]
clc
inc cx
mov cx, word [eax]
test ax, ax
cmp bh, 0xe7
jmp loc.10003bd4

Function at 0x1012c84a
Capabilities:
Packed with generic packer

Disassembly:
test cx, cx
mov byte [esp], al
lea esp, [esp + 4]
jne 0x10092ea1
pushal
sub eax, ebx
call fcn.100c015a
lea ebx, [eax + 2]
adc cx, di
rcr cx, 9
mov cx, word [eax]
stc
pushfd
add eax, 2
cmp di, 0xf628
jmp 0x1006bb30
lea esp, [esp + 4]
jne 0x1006b13d
not cl
mov edx, dword [ebp + 4]
test dl, 0xc2
mov eax, edx
shl cl, 7
rcl ch, 1
stc
jmp 0x10090b29

Function at 0x10130722
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
call fcn.1000caf2
test al, 0xa7
cmc
cmc
bt bp, dx
add esp, 0x18
bt bx, sp
stc
jmp 0x1006ba6e

Function at 0x10134b8f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [eax + 2]
pushfd
mov byte [esp + 4], dl
push ebp
pushal
lea esp, [esp + 0x2c]
jmp fcn.10083d0e
lea esp, [esp + 0x30]
jne 0x10082f32
not al
cdq
mov ebp, dword [ebp + 4]
not ah
rdtsc
movzx edx, bl
rdtsc
mov eax, ebp
movzx dx, bl
not dh
push ebp
jmp 0x1010bde9
Function at 0x10052ed
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x10016d0
call 0x10054f0
xor ebx, ebx
push ebx
mov edi, dword [0x1001038]
call edi
cmp word [eax], 0x5a4d
jne 0x100532a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100532a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1005342
cmp eax, 0x20b
je 0x100532f
mov dword [ebp - 0x1c], ebx
jmp 0x1005356
cmp dword [ecx + 0x84], 0xe
jbe 0x100532a
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1005350
cmp dword [ecx + 0x74], 0xe
jbe 0x100532a
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [0x1001214]
pop ecx
or dword [0x100d324], 0xffffffff
or dword [0x100d328], 0xffffffff
call dword [0x1001218]
mov ecx, dword [0x100c1d0]
mov dword [eax], ecx
call dword [0x100121c]
mov ecx, dword [0x100c1cc]
mov dword [eax], ecx
mov eax, dword [0x1001220]
mov eax, dword [eax]
mov dword [0x100d32c], eax
call 0x10054e6
cmp dword [0x100c088], ebx
jne 0x10053b1
push 0x10054e6
call dword [0x1001224]
pop ecx
call fcn.010054cf
push 0x100c010
push 0x100c00c
call fcn.010054c4
mov eax, dword [0x100c1c8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x100c1c4]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [0x100122c]
mov dword [ebp - 0x38], eax
push 0x100c008
push section..data
call fcn.010054c4
add esp, 0x24
mov eax, dword [0x4d001230]
pop edx
nop
add byte [ebx], al
add byte [eax], al
add byte [eax + eax], al
add byte [eax], al
invalid

Function at 0x433005
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x5e004d9f
nop
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..text_1
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3a4473ce
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219