joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103cf8e7
Capabilities:
Authenticate hmac

Disassembly:
mov ebx, dword [0x100eb2f8]
xadd al, al
shld ecx, ebx, 0x72
bsf edx, esp
push edi
cbw
test ebp, 0x7d3a3e76
bt cx, 0x99
mov eax, 0x4c
rcl dx, cl
mov word [esp + 0x1b4], ax
push edi
sub cx, 0x1fd0
btc ax, bx
mov eax, 0x4d
btc dx, 0xbc
cmc
ror edx, cl
push edi
sbb dx, bp
shl dx, 0x7c
test bx, dx
mov word [esp + 0x1c2], ax
sar ah, cl
and ecx, 0x569037b4
shrd ecx, edx, 3
mov eax, 0x65
xor dl, 0x46
push edi
test esp, 0x7df6457e
mov word [esp + 0x1cc], ax
rol ch, 0x27
lea eax, [esp + 0x24]
or dx, 0xef5
sub dh, cl
push eax
test eax, edi
mov ecx, 0x48
btr edx, esi
mov edx, 0x32
clc
cmc
cmp dx, 0x75a8
mov word [esp + 0x1c6], cx
mov ecx, eax
rcr ecx, cl
mov word [esp + 0x1c8], dx
rcr edx, cl
rol dl, cl
push edi
shr ecx, 0xae
mov ecx, 0x75
clc
or dx, 0x487a
cdq
mov edx, 0x74
test dl, 0x29
jmp 0x103be14d
push edi
push eax
jmp 0x10418bb7
sub eax, dword [0x1016a860]
sar eax, 7
clc
cmp esp, edx
cmp esi, eax
jmp 0x10450178
sub eax, dword [0x1016a848]
clc
sar eax, 6
clc
test esp, 0x5ecd286f
cmp dword [esp + 0x18], eax
jb 0x101c5cbd
call fcn.10073483
mov ecx, dword [esp + 0x14]
bswap edi
cdq
mov edx, dword [0x1016a848]
movsx esi, bx
lea esi, [ecx + edx]
jmp 0x10334eb6
mov dword [esp + 0x20], edi
jmp 0x104840dc
mov dword [esp + 0x18], esi
jle 0x1003fefa
mov dword [esp + 0x14], edi
jmp 0x10181890
cmp ebx, edi
jmp 0x10296e79
cmp ebx, edi
jmp 0x10266431
push eax
or al, ch
btc ax, 0x65
sub esp, 0x4e8
mov eax, dword [0x10149de0]
cmp esi, 0x11560d2b
xor eax, esp
cmc
cmp si, 0x45a6
mov dword [esp + 0x4e0], eax
cmc
bsf ax, ax
push ebx
push esi
sbb ax, 0xc71
shl al, 0x67
push edi
rol eax, 0xd2
btr ax, 0x75
mov eax, dword [0x10149de0]
xor eax, esp
stc
cmc
push eax
not eax
lea eax, [esp + 0x4f8]
cmc
clc
mov dword fs:[0], eax
stc
push 0x103
rol ax, 3
shrd ax, si, 0xa9
sub edi, edi
bswap ax
not eax
mov ax, bx
lea eax, [esp + 0x1e1]
jmp 0x101760d9
mov ecx, 0x10
lea edi, [esp + 0x2c]
jmp 0x100467d3
jmp 0x101c5c9d
jle 0x103dd310
mov dword [esp + 0x14], edi
jmp 0x103607a2
push ebp
mov ebp, esp
rcr eax, cl
lahf
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e8b2b
neg al
sbb eax, edi
mov eax, dword fs:[0]
clc
jmp 0x103275a5
mov eax, dword [0x1016a864]
clc
sbb bh, bh
mov ebx, eax
cmp cx, 0x36de
stc
sub ebx, dword [0x1016a860]
sub esi, esi
sar ebx, 7
jmp 0x102c734a
mov byte [esp + 0x1e8], 0
call fcn.10078150
mov eax, dword [0x1016a84c]
movzx ebx, sp
mov ebx, eax
stc
sub ebx, dword [0x1016a848]
clc
add esp, 0xc
stc
cmp bp, dx
sar ebx, 6
cmp si, bp
jmp 0x102f7ff2
jb 0x10450183
call fcn.10073483
mov edx, dword [esp + 0x14]
mov eax, dword [0x1016a860]
lea esi, [edx + eax]
mov ecx, 0x20
xchg edi, edi
mov di, 0x2442
cmovns edi, ebp
lea edi, [esp + 0x12c]
jmp 0x10006097
mov dword [esp + 0x18], edi
jmp 0x1037db99
mov dword [esp + 0x1c], edi
jmp 0x1047b462
Function at 0x103d06ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [ebp - 4], 6
bsf eax, edi
bswap ax
mov eax, dword [ebp - 0x118c]
lea eax, [eax - 0x10]
xor cx, di
setbe ch
lea ecx, [eax + 0xc]
cmp di, dx
test di, 0x7825
stc
or edx, 0xffffffff
cmp eax, ebp
jmp loc.103b6c4a
push ebx
jmp 0x104855a3
or edx, 0xffffffff
clc
cmp ecx, esp
lock xadd dword [ecx], edx
jmp 0x1024a5e2
dec edx
test edx, edx
jmp 0x103da255
add eax, 0xfffffff0
and ecx, ebx
movsx cx, dh
lea ecx, [eax + 0xc]
cmp bp, 0x330b
jmp 0x101f86b7
push ecx
jmp 0x101cd566
je 0x103d409c
push 0x104
mov ecx, edi
lea ecx, [ebp - 0x520]
jmp 0x1032488b
push 0xb059c7dd
call fcn.104aea3b
cmc
cmp eax, ebx
jmp 0x103a5402
mov esi, dword [0x100eb3fc]
mov byte [ebp - 4], 7
not cl
mov eax, dword [ebp - 0x117c]
jmp 0x10256e27
jg 0x100283e7
mov ecx, dword [eax]
movzx dx, al
movsx dx, dh
movzx edx, bx
mov edx, dword [ecx]
push eax
cmovp eax, edi
xchg al, al
cbw
mov eax, dword [edx + 4]
jmp loc.100283e5
push eax
jmp loc.10044a55
Function at 0x103dd293
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xb059c7dd
call fcn.104aea3b
Function at 0x10424951
Capabilities:
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push eax
rcl al, 0x73
lea eax, [esp + 0x2d8]
clc
cmc
mov dword fs:[0], eax
xadd ax, ax
cmc
mov eax, dword [ebp + 8]
cmp esp, 0x581a6923
xor esi, esi
test esi, 0x95d1366
cmp ecx, 0x62ff34cd
cmp dword [ebp + 0xc], esi
jmp 0x1048ca73
mov byte [esp + 0x141], 0xc4
jmp 0x1033c530
mov byte [esp + 0x173], bl
xchg bl, bl
mov bl, 0xd1
jmp 0x1026ad09
mov byte [esp + 0x143], 0xe4
mov byte [esp + 0x144], 0x6d
jmp 0x10392ecb
mov byte [esp + 0x14e], 0xa6
jmp 0x1002d4ec
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x2e0], esi
mov cl, 0xbe
mov bl, 0x37
not al
mov al, al
mov al, 0xaf
jmp 0x10401b01
mov byte [esp + 0x13d], cl
jmp 0x1049a817
mov byte [esp + 0x149], 0x97
mov byte [esp + 0x14a], 0x62
mov byte [esp + 0x14b], 0x12
jmp 0x104ba0e8
mov byte [esp + 0x13c], 0xb
jmp 0x1023ec9f
mov byte [esp + 0x142], 0xb9
jmp 0x101ed6ff
push ebp
bsf bp, ax
xor bp, si
bt ebp, 0xb3
mov ebp, esp
and eax, edi
btr ax, ax
and esp, 0xfffffff8
xor ah, 0xde
btc ax, dx
cmp edi, ebp
push 0xffffffffffffffff
rol eax, cl
push 0x100e706b
mov eax, dword fs:[0]
cmp bh, al
push eax
rcl al, 0x3b
cmc
shl eax, 0xd
lea esp, [esp - 0x2c8]
bt eax, 0x34
mov eax, dword [0x10149de0]
stc
test esp, esi
xor eax, esp
jmp 0x10424951
call fcn.10007210
mov edx, dword [eax]
not cl
mov ecx, 0x48ac56a3
mov ecx, eax
jmp 0x104b78cd
mov byte [esp + 0x147], 0x24
jmp 0x104854f5
mov byte [esp + 0x145], 0x50
jmp 0x103c159f
mov byte [esp + 0x140], 0xc8
jmp 0x101cc917
mov byte [esp + 0x13f], 0xba
jmp 0x10399945
mov byte [esp + 0x146], 0x62
jmp 0x1038a1ca
jne 0x10378471
push 0x80004005
jmp 0x1037846c
mov dword [esp + 0x1c], edx
jle 0x103a4f28
call fcn.10062dcf
sub ecx, ecx
cmp eax, esi
not cl
setne cl
cmp ecx, esi
jmp 0x103c771d
mov dword [esp + 0x24], ecx
jmp 0x103c8de3
mov dl, 0xac
mov cl, 0x53
mov byte [esp + 0x172], bl
jmp 0x101dbb1e
mov dword [esp + 0x2c0], eax
push ebx
push esi
push edi
not ah
rol al, 0xf8
mov eax, dword [0x10149de0]
cmc
xor eax, esp
jmp 0x10179401
mov byte [esp + 0x148], al
jmp 0x102424dd
mov dword [esp + 0x28], eax
jmp 0x103e44d9
mov byte [esp + 0x13e], 0x1a
jmp 0x103bce77
mov eax, dword [edx + 0xc]
jmp 0x1021dbbf
mov byte [esp + 0x14c], 0x7d
mov byte [esp + 0x14d], 0xe8
jmp 0x101f8c78
Function at 0x1042d88d
Capabilities:
Execute anti-debugging instructions

Disassembly:
call edi
cmp byte [ebp - 0x1171], bl
jmp 0x103fca21
push edx
jmp 0x10417266
push eax
jmp 0x103da23b
push ecx
setge al
movsx edx, bx
push 0x10111d96
movsx edx, ax
lea edx, [ebp - 0x140]
push edx
mov eax, esi
lea eax, [ebp - 0x20]
jmp 0x10287af6
call fcn.10232978
add esp, 0x1c
cbw
jmp 0x1048bfe4
jne 0x104aead4
cmp eax, ebx
jmp 0x10470007
push 0x10111d96
movzx ax, bh
cmove eax, ebx
lea edx, [ebp - 0x11a8]
bswap ax
movsx eax, cx
mov ax, 0x671d
push edx
cwde
bswap ax
lea eax, [ebp - 0x20]
jmp 0x1049dbe0
call edi
cmp byte [ebp - 0x1171], bl
jmp 0x1036a814
jne 0x1048bfe4
cmp eax, ebx
jbe 0x1048bfe4
mov ecx, dword [ebp - 0x1178]
push ecx
lea edx, [ebp - 0xa58]
xchg cl, ah
lahf
push edx
lea eax, [ebp - 0xc58]
push eax
movsx cx, ch
cmovs cx, cx
lea ecx, [ebp - 0x788]
movzx edx, si
push ecx
movsx dx, ch
setg dl
cdq
push 0xc
setle dl
not dx
lea edx, [ebp - 0x18]
jmp 0x104949a6
mov byte [ebp - 0x1171], 1
jmp 0x1033c10b
push 0xb059c7dd
call fcn.104aea3b
push eax
jmp 0x101cced0
jbe 0x104aead4
mov ecx, dword [ebp - 0x1178]
movzx edx, di
cwd
push ecx
not dx
lea edx, [ebp - 0xa58]
xchg ah, cl
lahf
push edx
mov cl, 0x80
lea eax, [ebp - 0xc58]
cmovo dx, cx
cwd
push eax
xchg cx, dx
seta dl
cdq
lea ecx, [ebp - 0x788]
not dl
jmp 0x10046425
lea eax, [ebp - 0xc58]
mov cx, si
push eax
cdq
cbw
not ecx
push 0x200
lea ecx, [ebp - 0xf60]
jmp 0x1032fa7e
push 0x4d
jmp 0x102441ca
push eax
call edi
cmp byte [ebp - 0x1171], bl
jmp 0x10036fba
lea eax, [ebp - 0xc58]
movsx ecx, sp
push eax
mov dh, 0xb6
push 0x200
cbw
lahf
xchg dl, dl
lea ecx, [ebp - 0xf60]
push ecx
jmp 0x103b1ae6
Function at 0x1043343b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
movzx ebp, dx
cwde
mov ebp, esp
mov al, 0x97
movzx ax, dh
bswap ax
mov eax, 0x1900
jmp 0x1043343b
mov word [ebp - 0x58], cx
mov edx, 0x61
and ax, sp
sub eax, 0x51232e7c
sar cx, 0x74
mov word [ebp - 0x56], dx
rdtsc
bsf ax, si
cbw
mov eax, 0x67
mov word [ebp - 0x54], ax
cwde
mov ecx, 0x69
adc dl, 7
ror edx, 0x41
and dh, 0xb4
mov word [ebp - 0x52], cx
xor dl, 0
mov edx, 0x63
sbb ecx, esi
xadd ah, al
rcr cl, 0x38
mov eax, 0x2e
sub cl, 1
movsx ecx, cx
sar cx, 0xdf
mov ecx, 0x74
cmp cx, cx
cmp dh, 0
mov word [ebp - 0x50], dx
btr dx, 0x40
mov word [ebp - 0x4e], ax
mov eax, ecx
rol dx, cl
cwd
mov edx, 0x78
mov word [ebp - 0x4c], cx
jmp loc.10046b86
call fcn.10079fe0
mov eax, dword [0x10149de0]
bt ecx, edi
add dx, 0x58c1
neg dh
xor eax, ebp
cmc
shr dh, 0x2b
btr edx, edx
mov dword [ebp - 4], eax
sbb cl, 0xee
shld ecx, edi, 0x68
push esi
rol ah, cl
push edi
mov al, al
test ax, di
mov eax, 0x2e
btr ecx, edx
sub cl, ah
sal edx, 0xe5
mov word [ebp - 0x28], ax
shr ch, cl
ror dx, 0x95
cmovge eax, edx
mov ecx, 0x74
rdtsc
sar ax, cl
mov eax, ecx
sal dx, 0x5f
mov word [ebp - 0x26], cx
xor ecx, ecx
sbb edx, 0x7b956190
shl dx, cl
ror dh, cl
mov word [ebp - 0x22], ax
lahf
mov word [ebp - 0x20], cx
cdq
shld eax, ecx, 0xfc
mov edx, 0x78
adc ah, bh
rcr ecx, 0xb2
btc eax, esp
mov word [ebp - 0x24], dx
mov ch, 2
shld cx, dx, 0x31
sal ch, cl
mov edx, 0x53
ror cl, 2
movzx eax, ax
mov word [ebp - 0x44], dx
not ecx
mov eax, 0x65
mov word [ebp - 0x42], ax
sal eax, cl
add cx, si
shrd cx, bx, 0xfc
mov ecx, 0x74
sar ah, cl
mov edx, ecx
ror ah, cl
shl eax, 0x91
adc ah, dl
mov word [ebp - 0x40], cx
setl ah
mov word [ebp - 0x3e], dx
shl dx, 0xc0
mov eax, 0x69
sbb cx, 0x3f6d
mov word [ebp - 0x3c], ax
shrd dx, si, 0x4d
bts dx, cx
xor eax, eax
rcr dl, 0x61
shl dx, 0x76
mov word [ebp - 0x36], ax
bts edx, eax
mov ecx, 0x6e
mov word [ebp - 0x3a], cx
sal ch, cl
mov ecx, 0x76
bts dx, cx
mov word [ebp - 0x7c], cx
mov edx, 0x67
mov word [ebp - 0x38], dx
mov eax, 0x72
mov word [ebp - 0x78], ax
mov ecx, 0x31
clc
mov word [ebp - 0x76], cx
stc
btc edx, 0x24
sub al, 0x75
mov edx, 0x65
mov word [ebp - 0x7a], dx
mov eax, 0x30
cwd
mov word [ebp - 0x72], ax
bts edx, ecx
mov ecx, 0x39
shl al, cl
btr eax, esp
mov word [ebp - 0x70], cx
cmp esi, ebp
btr cx, 0x88
mov edx, 0x32
mov word [ebp - 0x74], dx
neg ecx
mov word [ebp - 0x6e], dx
mov eax, 0x37
mov word [ebp - 0x6c], ax
cmp dx, ax
rcl dh, cl
sub eax, eax
bswap edx
mov ecx, 0x30
mov word [ebp - 0x6a], cx
or dx, bp
adc dx, 0x2a4
ror dl, cl
mov word [ebp - 0x66], ax
adc edx, edi
rcr cx, 0x18
setb ch
mov edx, 0x31
shr cx, cl
rcl cx, 0x2d
mov word [ebp - 0x68], dx
btr ecx, 0xa9
mov ecx, 0x6d
cwd
sar al, cl
jmp 0x1038c3e0
Function at 0x1043d963
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x160
and dl, al
mov eax, dword [0x10149de0]
xor eax, ebp
setb dl
mov dword [ebp - 4], eax
push ebx
mov al, 0x6c
xchg bl, bl
mov bl, 0x4d
mov dl, 0x74
mov bl, cl
mov bl, 0x6f
push esi
jmp 0x103ff0be
push edi
mov di, 0x313a
movzx edi, sp
mov edi, ecx
xchg cl, cl
mov cl, 0x69
jmp 0x10422b96
mov byte [ebp - 0x1d], al
jmp loc.1000203b
push ebp
add ax, cx
sar bp, 0xc0
mov ebp, esp
jmp 0x103924f1

Function at 0x1045cc9e
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push 0xffa8bc6f
call fcn.1024dadc
sar al, cl
Function at 0x1045f25f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xb09c726b
call fcn.104aea3b
Function at 0x10473f9c
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov esi, ebx
clc
cmp ecx, 0x2960675a
sub esi, eax
stc
cmp esi, 0x104
jmp 0x103cb98e
ret
mov eax, dword [ecx + 0x3c]
clc
add eax, ecx
cmp dword [eax], 0x4550
jmp 0x10313d1a
je 0x1045c1cc
mov eax, dword [eax + 0x7c]
stc
push ebx
jmp 0x101f32b8
push edi
cmc
stc
cmp bh, bh
or edi, 0xffffffff
clc
test bp, 0x1ed7
mov dword [ebp - 0x11c], eax
jmp 0x10343f6c
test cl, cl
jne 0x10340040
pop edi
pop ebx
xor eax, eax
shl cl, 0x8d
and cl, 0x32
pop esi
bsf ecx, eax
rcl cl, cl
dec ch
mov ecx, dword [ebp - 4]
cmp ax, cx
xor ecx, ebp
jmp 0x102eadfc
cmp edi, dword [ecx + edx + 0x14]
jmp 0x1031daac
mov edx, dword [ebp - 0x10c]
sub edi, 0x5db22da3
jmp 0x1003ab9e
call fcn.1007168f
mov esp, ebp
jmp 0x103b742f
ret
jne 0x1045c1cc
mov edx, dword [eax + 0x78]
mov dword [ebp - 0x114], edx
cmc
stc
test edx, edx
jmp 0x101f0280
je 0x1045c1cc
mov eax, 0x5a4d
clc
jmp 0x10352242
jae 0x103cc443
mov eax, dword [ecx + edx + 0x1c]
jmp 0x100541d6
je 0x103cc443
cmp cl, 0x2e
je 0x100142fb
mov cl, byte [ebx + 1]
jmp 0x103c718f
mov dword [ebp - 0x110], edi
jmp 0x10445f75
cmp word [ecx], ax
jmp 0x1045c1c6
jl 0x10242482
jmp 0x10277b9b
je 0x10242482
lea ebx, [eax - 1]
test edi, ebx
mov eax, dword [ecx + edx + 0x20]
cmc
add eax, ecx
test ebp, eax
mov dword [ebp - 0x10c], 0
clc
mov dword [ebp - 0x118], eax
test edx, 0x67657ecd
stc
cmp dx, 0x2751
test ebx, ebx
jmp 0x10390a30
pop ebp
jmp 0x10171183
inc ebx
cmp di, 0x3470
jmp 0x10207180
jae 0x103cc443
mov esi, dword [ecx + edx + 0x1c]
lea eax, [esi + eax*4]
mov eax, dword [eax + ecx]
test al, ch
test eax, eax
jne 0x103e402a
pop edi
ror ch, cl
pop ebx
shld esi, esi, 0xef
rol si, 0xca
bts esi, edx
sub eax, eax
jmp 0x1041bb0e
je 0x1045c1cc
test esi, esi
jmp 0x10317c9b
cmp eax, edx
jmp 0x104899c5
pop esi
and ecx, ebp
xadd cl, ch
shl cl, cl
mov ecx, dword [ebp - 4]
cmp esp, edi
xor ecx, ebp
jmp 0x1048f7c0
cmp esi, 0xffff
ja 0x1045fcee
sub esi, dword [ecx + edx + 0x10]
neg ax
sbb ah, 0xf8
cbw
mov eax, esi
cmp eax, dword [ecx + edx + 0x14]
jmp 0x103cc429
je 0x101b493e
xor eax, eax
movzx esi, di
btr ecx, esi
cmc
pop esi
not cx
rcr ch, cl
shld ecx, edx, 0xed
mov ecx, dword [ebp - 4]
cmc
xor ecx, ebp
call fcn.1007168f
mov esp, ebp
pop ebp
jmp 0x102f15e3
mov eax, dword [ecx + edx + 0x18]
test eax, eax
jmp 0x1039e978
add eax, ecx
mov ecx, dword [ebp - 4]
sar esi, 0xf5
pop edi
pop ebx
xor ecx, ebp
jmp 0x10046f73
push ebp
stc
btc cx, 0xff
dec ch
mov ebp, esp
or ch, 0xc9
lea esp, [esp - 0x120]
or ah, bl
mov eax, dword [0x10149de0]
xor eax, ebp
movsx ecx, bx
and ecx, ecx
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
stc
test bp, cx
push esi
mov esi, dword [ebp + 0xc]
cmp bx, 0x13ad
mov dword [ebp - 0x120], esi
test ecx, ecx
jmp 0x103e2a5c
jb 0x1046f581
mov esi, dword [ebp - 0x11c]
test di, si
cmc
add esi, edx
test esi, esi
cmp eax, esi
jae 0x1046f581
lea eax, [eax + ecx]
movsx bx, bl
mov cl, byte [eax]
sbb bx, 0x4d75
test ch, 0xe5
mov ebx, eax
stc
clc
test ebp, 0xcd323a5
test cl, cl
jmp 0x1034003a
call fcn.1007168f
mov esp, ebp
pop ebp
ret
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5f6115e8
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x14b43e8d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x100012a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a6a3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1008400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.CAnnoId.0
mov dword [ebx + 4], 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebx + 8], vtable.CAnnoViewObserver.0
lea edi, [ebx + 0x20]
mov dword [ebx], vtable.CAnnoApp.0
mov dword [ebx + 8], vtable.CAnnoApp.1.0
xor eax, eax
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 4
mov byte [edi + 0xc], 1
mov dword [edi + 0x10], 0xffffffff
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 7
mov word [edi + 0x14], ax
mov dword [edi + 0x2c], 0xffffffff
mov word [edi + 0x30], ax
lea esi, [ebx + 0x54]
mov byte [ebp - 4], 2
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.10069221
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [esi + 8], edi
mov dword [esi + 0xc], 0x3f800000
mov byte [ebx + 0x64], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x68], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ab50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006aefd
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x1008400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x88], ebx
cmp dword [ebp + 8], 0x2001
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x84], ecx
je 0x1000aba0
xor dl, dl
xor eax, eax
mov byte [ecx], dl
jmp 0x1000ac9b
mov esi, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x80], edi
test esi, esi
jne 0x1000abb4
lea esi, [edi + 1]
jmp 0x1000ac95
mov eax, dword [ebx + 0x78]
cmp byte [eax + 0x7c], 0
je 0x1000abfc
mov esi, dword [eax + 0xc]
cmp esi, dword [eax + 0x10]
je 0x1000abf9
mov ebx, dword [esi]
test ebx, ebx
je 0x1000acb9
mov eax, dword [ebx]
mov edi, dword [eax + 0x1c]
mov ecx, edi
call dword [0x1006f584]
mov ecx, ebx
call edi
mov ebx, dword [ebp - 0x88]
add esi, 4
mov edi, dword [ebp - 0x80]
or edi, eax
mov dword [ebp - 0x80], edi
mov eax, dword [ebx + 0x78]
cmp esi, dword [eax + 0x10]
jne 0x1000abc5
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x7c]
call fcn.10004e80
mov dword [ebp - 4], 0
lea edx, [ebp - 0x64]
mov ecx, dword [ebx + 0x78]
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x70], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ebx + 0x78]
mov dword [ebp - 0x6c], eax
lea eax, [ecx + 0x24]
cmp edx, eax
je 0x1000ac40
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x1000ac31
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x64]
call fcn.10002800
mov ecx, dword [ebx + 0x78]
mov eax, dword [esi + 8]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp byte [ecx + 0x7c], al
sete al
inc eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x7c]
push eax
push 1
call fcn.1000b740
mov ecx, dword [ebx + 0x78]
or edi, eax
mov eax, dword [ecx + 0x40]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x1000ac78
mov eax, dword [eax + 4]
mov ecx, dword [ebx + 0x78]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x7c]
push eax
push 6
call fcn.1000b740
mov esi, eax
lea ecx, [ebp - 0x7c]
or esi, edi
call fcn.10005150
mov ecx, dword [ebp - 0x84]
mov al, 1
mov byte [ecx], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10069210
mov esp, ebp
pop ebp
ret 0xc
mov esi, 1
jmp 0x1000ac8f
Function at 0x10011f70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b553
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x1008400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CAnnoId.0
mov dword [esi + 4], 0xffffffff
mov dword [esi], vtable.CAnnoObjId.0
mov dword [ebp - 4], 0
mov dword [esi + 8], vtable.CAnnoRefCount.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], vtable.CAnnoSeriable.0
mov byte [ebp - 4], 2
mov eax, 0x12
mov dword [esi], vtable.CAnnoObj.1.0
mov dword [esi + 8], vtable.CAnnoObj.0
mov dword [esi + 0x10], vtable.CAnnoObj.2.0
mov dword [esi + 0x14], 0
push 0x24
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xffffffff
call fcn.10069221
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
call fcn.100081f0
push 0
push 0x100848d0
push 0x10084914
push 0
push eax
call sub.VCRUNTIME140.dll___RTDynamicCast
mov dword [esi + 0x2c], eax
add esp, 0x14
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], vtable.CAnnoObj::CAnnoCmdHandler.0
mov dword [esi + 0x40], esi
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0xffffffff
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0
mov dword [esi + 0x6c], 0x7fffffff
mov dword [esi + 0x68], 0x7fffffff
mov dword [esi + 0x74], SysStringLen
mov dword [esi + 0x70], SysStringLen
mov dword [esi + 0x7c], 0x7fffffff
mov dword [esi + 0x78], 0x7fffffff
mov dword [esi + 0x84], SysStringLen
mov dword [esi + 0x80], SysStringLen
mov dword [esi + 0x8c], SysStringLen
mov dword [esi + 0x88], SysStringLen
mov dword [esi + 0x94], SysStringLen
mov dword [esi + 0x90], SysStringLen
mov ecx, dword [esi + 0x2c]
mov dword [esi + 0x98], 0
test ecx, ecx
je 0x10012106
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x20], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4