joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8bdb0e
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ecx, edi
mov dword [esp], esp
xchg dl, cl
xchg byte [esp + 2], bh
mov al, ah
rdtsc
jmp 0x8bdb1b
and eax, edi
or ax, bp
mov si, dx
xchg si, di
jmp 0x8bdaf8
lea esp, [esp + 2]
setl al
xchg byte [esp], bl
neg ah
mov word [esp], di
mov dh, 0xa5
jmp 0x8bdf30
xchg dl, ah
push di
mov dword [esp + 4], ecx
neg bx
bswap ebx
bsf si, si
jmp 0x8bdb91
mov esi, 0x890807d3
lea esp, [esp + 0x19]
neg edi
mov cx, word [esp + 1]
mov dh, bl
mov eax, 0x8570907c
jmp 0x8bdb45
add esp, 6
ror eax, cl
push word [esp + 1]
mov cx, word [esp + 5]
call 0x8bdbbc
cmpsb byte [esi], byte es:[edi]
ror dword [ecx - reloc.iphlpapi.dll_GetAdaptersInfo], 1
je 0x8bdbbc
mov dword [esp + 4], ecx
push dword [esp + 5]
stc
mov byte [esp], ah
add eax, 0x242488f9
lea esp, [esp + 3]
mov si, bp
jmp 0x8bdb7b
bsr ecx, esi
mov ax, 0xa734
btr cx, ax
push word [esp]
jmp 0x8bdbc1
mov dh, 0x4b
clc
jmp 0x8bdba6
rdtsc
mov ebx, ecx
neg ebp
mov ecx, 0x6022acd0
mov ecx, 0x95f823a4
rcl dh, 5
jmp 0x8bdc1b
xchg bx, ax
pushal
mov bh, byte [esp + 0x19]
mov dword [esp + 0x19], ebp
dec ebp
xchg word [esp + 0x12], cx
jmp 0x8bdb62
rcr dl, cl
mov si, 0xce5e
mov ax, bx
mov edi, 0x4a2b9174
xchg cl, dl
lea ebx, [eax*4]
jmp 0x8bdcac
pop dword [esp + 2]
lea eax, [ebp + 0x92]
rdtsc
push ebx
mov edx, ebx
lea ebp, [eax + ecx]
jmp 0x8bdbf2
cmc
lea esi, [ebp*4]
add esp, 6
bswap edx
pop ecx
jmp 0x8bdc71
inc bh
mov ax, word [esp + 0x14]
mov ebx, 0x1929be5a
ror bl, cl
mov si, word [esp + 0x19]
clc
jmp 0x8bdc2f
or ch, 0x91
pop bp
cpuid
xchg word [esp], bp
mov bp, word [esp + 2]
jmp 0x8bdc8f
mov edx, 0xe3fa3d76
lea esi, [ebp*4]
add esp, 6
xchg word [esp + 1], dx
mov ecx, 0x5ceed79c
pop dword [esp]
jmp 0x8bdc5b
pop ax
call fcn.008bdd0e
pushal
btc edx, esp
mov ecx, dword [esp + 6]
lea edx, [ecx + esi]
inc dh
lea edi, [eax + edx]
jmp 0x8bdcd6
mov dx, sp
xchg ecx, esi
bsr eax, edi
mov bp, word [esp + 4]
sub esp, 0xe
xchg bh, ah
jmp 0x8bdc45
pop esi
mov word [esp + 0x18], dx
mov word [esp + 0x11], sp
inc dx
pushal
jmp 0x8bdce9
push esp
mov dl, byte [esp + 0x1c]
mov ah, byte [esp + 0x1a]
add esi, esp
bt di, di
mov bl, 0xef
jmp 0x8bdcc0
lea esp, [esp + 0x41]
lea edi, reloc.iphlpapi.dll_GetAdaptersInfo
mov esi, 0xd9f77217
xchg bl, bh
lea ebx, [esp + ebx]
mov ecx, dword [esp]
jmp 0x8bdd85
mov bx, 0xeff4
call fcn.008bdd59
mov ebx, 0xe3f0db1c
rol edx, cl
lea ebx, [ebp*4]
jmp 0x8bddb6
mov dl, byte [esp]
rcl bl, 5
xchg esi, ebx
bswap ebp
mov eax, 0x9dac3548
pushal
jmp 0x8bde35
rdtsc
setbe ch
pop ebx
push word [esp + 4]
pop ebx
cpuid
jmp 0x8bde0e
mov ecx, dword [esp]
mov bx, 0xd83d
pop di
lea ebx, [eax*4]
mov bl, al
bswap ecx
jmp 0x8bdbdc
mov ecx, dword [esp + 0xe]
cmp ax, bp
push dword [esp + 0x11]
call fcn.008bdefe
cmp byte [0x11e69f0c], 0x66
xchg ecx, eax
xchg cx, ax
mov dword [esp + 1], edx
and esi, 0x95e0240f
stc
bswap edi
mov dword [esp + 0xb], eax
jmp 0x8bddf8
mov dx, 0xaffa
mov dl, bl
xchg edx, ecx
push word [esp + 0xd]
bswap esi
pop ebx
jmp 0x8bddc8
neg al
mov bh, 0x87
xchg word [esp], cx
mov eax, ebx
not edi
rdtsc
jmp 0x8bdddf
Function at 0x8bdbbc
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ecx, edi
mov dword [esp], esp
xchg dl, cl
xchg byte [esp + 2], bh
mov al, ah
rdtsc
jmp 0x8bdb1b
and eax, edi
or ax, bp
mov si, dx
xchg si, di
jmp 0x8bdaf8
lea esp, [esp + 2]
setl al
xchg byte [esp], bl
neg ah
mov word [esp], di
mov dh, 0xa5
jmp 0x8bdf30
xchg dl, ah
push di
mov dword [esp + 4], ecx
neg bx
bswap ebx
bsf si, si
jmp 0x8bdb91
mov esi, 0x890807d3
lea esp, [esp + 0x19]
neg edi
mov cx, word [esp + 1]
mov dh, bl
mov eax, 0x8570907c
jmp 0x8bdb45
add esp, 6
ror eax, cl
push word [esp + 1]
mov cx, word [esp + 5]
call 0x8bdbbc
cmpsb byte [esi], byte es:[edi]
ror dword [ecx - reloc.iphlpapi.dll_GetAdaptersInfo], 1
je 0x8bdbbc
mov dword [esp + 4], ecx
push dword [esp + 5]
stc
mov byte [esp], ah
add eax, 0x242488f9
lea esp, [esp + 3]
mov si, bp
jmp 0x8bdb7b
bsr ecx, esi
mov ax, 0xa734
btr cx, ax
push word [esp]
jmp 0x8bdbc1
mov dh, 0x4b
clc
jmp 0x8bdba6
rdtsc
mov ebx, ecx
neg ebp
mov ecx, 0x6022acd0
mov ecx, 0x95f823a4
rcl dh, 5
jmp 0x8bdc1b
xchg bx, ax
pushal
mov bh, byte [esp + 0x19]
mov dword [esp + 0x19], ebp
dec ebp
xchg word [esp + 0x12], cx
jmp 0x8bdb62
rcr dl, cl
mov si, 0xce5e
mov ax, bx
mov edi, 0x4a2b9174
xchg cl, dl
lea ebx, [eax*4]
jmp 0x8bdcac
pop dword [esp + 2]
lea eax, [ebp + 0x92]
rdtsc
push ebx
mov edx, ebx
lea ebp, [eax + ecx]
jmp 0x8bdbf2
cmc
lea esi, [ebp*4]
add esp, 6
bswap edx
pop ecx
jmp 0x8bdc71
inc bh
mov ax, word [esp + 0x14]
mov ebx, 0x1929be5a
ror bl, cl
mov si, word [esp + 0x19]
clc
jmp 0x8bdc2f
or ch, 0x91
pop bp
cpuid
xchg word [esp], bp
mov bp, word [esp + 2]
jmp 0x8bdc8f
mov edx, 0xe3fa3d76
lea esi, [ebp*4]
add esp, 6
xchg word [esp + 1], dx
mov ecx, 0x5ceed79c
pop dword [esp]
jmp 0x8bdc5b
pop ax
call fcn.008bdd0e
pushal
btc edx, esp
mov ecx, dword [esp + 6]
lea edx, [ecx + esi]
inc dh
lea edi, [eax + edx]
jmp 0x8bdcd6
mov dx, sp
xchg ecx, esi
bsr eax, edi
mov bp, word [esp + 4]
sub esp, 0xe
xchg bh, ah
jmp 0x8bdc45
pop esi
mov word [esp + 0x18], dx
mov word [esp + 0x11], sp
inc dx
pushal
jmp 0x8bdce9
push esp
mov dl, byte [esp + 0x1c]
mov ah, byte [esp + 0x1a]
add esi, esp
bt di, di
mov bl, 0xef
jmp 0x8bdcc0
lea esp, [esp + 0x41]
lea edi, reloc.iphlpapi.dll_GetAdaptersInfo
mov esi, 0xd9f77217
xchg bl, bh
lea ebx, [esp + ebx]
mov ecx, dword [esp]
jmp 0x8bdd85
mov bx, 0xeff4
call fcn.008bdd59
mov ebx, 0xe3f0db1c
rol edx, cl
lea ebx, [ebp*4]
jmp 0x8bddb6
mov dl, byte [esp]
rcl bl, 5
xchg esi, ebx
bswap ebp
mov eax, 0x9dac3548
pushal
jmp 0x8bde35
rdtsc
setbe ch
pop ebx
push word [esp + 4]
pop ebx
cpuid
jmp 0x8bde0e
mov ecx, dword [esp]
mov bx, 0xd83d
pop di
lea ebx, [eax*4]
mov bl, al
bswap ecx
jmp 0x8bdbdc
mov ecx, dword [esp + 0xe]
cmp ax, bp
push dword [esp + 0x11]
call fcn.008bdefe
cmp byte [0x11e69f0c], 0x66
xchg ecx, eax
xchg cx, ax
mov dword [esp + 1], edx
and esi, 0x95e0240f
stc
bswap edi
mov dword [esp + 0xb], eax
jmp 0x8bddf8
mov dx, 0xaffa
mov dl, bl
xchg edx, ecx
push word [esp + 0xd]
bswap esi
pop ebx
jmp 0x8bddc8
neg al
mov bh, 0x87
xchg word [esp], cx
mov eax, ebx
not edi
rdtsc
jmp 0x8bdddf
Function at 0x8bdefe
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr bh, cl
rdtsc
lea esi, [esi*4]
mov ebx, eax
lea ebx, [eax + ebp]
xchg byte [esp], ch
jmp 0x8bde73
rdtsc
mov ah, 0x17
push bx
mov bx, 0xac08
mov si, ax
popal
jmp 0x8bde47
mov cx, 0xb962
mov dword [esp], edi
pop word [esp]
bsr esi, edi
xchg word [esp], cx
sub esp, 0x13
jmp 0x8bdebb
push word [esp + 0x10]
std
xchg ecx, edi
mov ebp, 0x93a842e8
xchg dh, al
ror ah, 0
jmp 0x8bde63
push di
pushfd
xchg ecx, esi
lea esp, [esp + 2]
clc
bsf di, di
jmp 0x8bdee5
mov byte [esp + 7], al
lea esp, [esp + 9]
cpuid
cpuid
lea esp, [esp + 5]
cpuid
jmp 0x8bdea4
lea edi, [eax + ecx]
setg al
xchg dword [esp], edi
mov si, word [esp]
add al, ah
jmp 0x8bdf0c
mov cx, 0x970a
mov ebp, dword [esp + 7]
mov word [esp + 5], cx
rcl bp, cl
pop dword [esp]
jmp 0x8bdecf
mov edx, 0x657d2928
xchg byte [esp], dl
mov dword [esp + 2], esp
jmp 0x8bde90
mov dword [esp], ecx
rcl eax, cl
xchg bl, al
pop edi
mov bl, 7
lea ecx, [edx + ebp]
jmp 0x8bdf59
mov dl, 0xca
dec ebx
mov al, byte [esp + 1]
bsr ebp, edx
mov cl, bh
xchg edi, ebx
jmp 0x8bdfa7
xchg dl, al
lea esi, [edx + edx]
mov edx, dword [esp]
rol cl, 3
lea esi, reloc.iphlpapi.dll_GetAdaptersInfo
lea esp, [esp + 1]
jmp 0x8bdf43
lea ebx, [eax + esi]
neg esi
sub esp, 0x11
seto bl
jmp 0x8bdfcc
dec dx
xchg ch, al
mov di, 0x723
lea edi, [eax + esi]
xchg byte [esp], al
mov byte [esp], al
jmp 0x8bdf70
cpuid
xchg byte [esp], bl
mov ax, 0x29fc
mov esi, edx
pushfd
pop edx
jmp 0x8bdf86
pop dx
bswap edx
setl dh
pop ax
setp cl
jmp 0x8bdfe5
mov ebp, 0x23be008c
dec ch
xchg dword [esp + 2], edx
neg al
lea esi, [esi*4]
mov bx, ax
jmp 0x8bdfb6
mov cx, 0x1c59
xchg word [esp + 0xa], bp
add esp, 9
pop ebx
setl cl
bswap eax
jmp 0x8bfa62
xchg di, ax
xor ax, 0x446f
mov bx, si
rdtsc
lea eax, [edx + ebp]
setb bh
mov ax, cx
jmp 0x8be82c
mov cx, word [esp]
ror cl, cl
btc ebp, ecx
mov cl, 0x2b
bsf di, si
mov esi, 0x5efdb569
jmp 0x8be8ad
mov esi, eax
mov ebp, 0x1a1c8c5b
setg bh
cpuid
xchg ecx, esi
neg dh
jmp 0x8beef4

Function at 0x8be140
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
setne ch
bsf eax, esi
setne ah
push dword [esp]
sbb ch, al
jmp 0x8be123
mov dh, byte [esp + 0xd]
inc ebx
mov bp, word [esp + 0xf]
xchg edx, esi
btr ax, bx
pop word [esp + 0xb]
jmp 0x8be0f6
mov byte [esp + 2], bh
rcl ax, cl
bswap edi
lea edx, [ebx*4]
lea esi, [esi*4]
jmp 0x8be151
mov dx, di
add esp, 0xb
neg bh
xchg dword [esp + 2], eax
sub esp, 0x1a
jmp 0x8be10c
popal
dec edi
clc
mov bl, ch
mov byte [esp + 3], bl
rol ecx, cl
jmp 0x8be175
Function at 0x8be450
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edi
jmp 0x8be49c
xchg word [esp], ax
bts esi, esi
mov word [esp + 1], bx
push edx
mov bh, 0x8c
sub esp, 0xa
jmp 0x8be576
mov edx, eax
bswap ecx
pop word [esp + 1]
mov ecx, esi
mov dword [esp + 7], ecx
xchg esi, ebp
jmp 0x8be4fe
mov ebp, 0x7fe90e95
rdtsc
mov ebx, esp
not eax
sub esp, 3
mov bp, 0x7e74
jmp 0x8be4c4
sub esp, 0
ror ch, 6
add esp, 0xb
bswap edx
rcl bh, cl
cld
jmp 0x8be546
mov esi, ebp
mov esi, ebp
lea ebx, reloc.iphlpapi.dll_GetAdaptersInfo
sub esp, 0xd
dec dl
add esp, 0x15
jmp 0x8be4ea
inc ah
setae al
rdtsc
dec ah
bswap ebp
call fcn.008be52b
rcl ah, 0
add esp, 0
push word [esp + 4]
xchg bx, bp
add esp, 7
add esp, 0
jmp 0x8be58f
bswap ebx
mov al, byte [esp + 0xf]
xchg word [esp + 2], bp
lea eax, [ebx + esi]
btc ax, si
push word [esp + 0xe]
jmp 0x8be517
lea ebx, [ebx + esi]
mov dh, byte [esp + 1]
rdtsc
btc eax, esp
mov dl, byte [esp]
mov ebx, edi
jmp 0x8be5f3
ror bh, cl
lea ecx, [edx*4]
setne dh
jmp 0x8be621
add esp, 1
mov ch, dl
lea esp, [esp]
add esp, 0
sub esp, 1
sub esp, 3
jmp 0x8be5bf
mov di, word [esp + 1]
rdtsc
xchg byte [esp], ch
lea ebp, reloc.iphlpapi.dll_GetAdaptersInfo
rdtsc
mov word [esp], dx
jmp 0x8be5d5
pushfd
bsr ax, sp
lea eax, [eax*4]
not edi
jmp 0x8be64c
lea ebp, [ebp + 0xd8]
sub bp, di
lea esp, [esp + 2]
cmc
pop di
shl eax, 0x18
jmp 0x8be60b
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
xchg di, bx
call fcn.008be636
insb byte es:[edi], dx
jae 0x8be6d1
jb 0x8be6c2
insd dword es:[edi], dx
jo 0x8be6a3
add byte [esi + 0xf], ah
mov esp, 0x8adaf7db
iretd
je 0x8be6ec
imul ebp, dword [ebp + 0x53], reloc.iphlpapi.dll_GetAdaptersInfo
mov ebp, 0xeb596660
popal
inc edi
je 0x8be712
imul ebp, dword [ebp + 0x54], reloc.iphlpapi.dll_GetAdaptersInfo
insd dword es:[edi], dx
add byte gs:[edi], cl
mov byte [0x8b24148b], al
add al, 0x24
punpcklbw mm1, dword [ebp - 0x14fcdb9c]
adc eax, 0x89be5724
sub byte [esi + 0x5b], ah
pop bx
invalid

Function at 0x8be6ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
mov word [esp + 0xa], di
mov dl, byte [esp + 4]
bts si, di
mov byte [esp + 0xd], ch
inc bh
bsr eax, esp
xchg dword [esp + 8], edi
bswap ebp
jmp 0x8be437

Function at 0x8c1b06
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
add esp, 0xb
push word [esp + 3]
push dword [esp + 0x11]
pushfd
jmp 0x8c1ae9
Function at 0x8c2111
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
rol ecx, 0x1a
lea ecx, [ecx + edi]
mov cx, word [esp]
jmp 0x8c20f0
xchg word [esp + 2], cx
push word [esp + 3]
push dword [esp + 5]
mov si, 0xe97b
mov ch, byte [esp + 5]
lea esp, [esp + 0xc]
jmp 0x8c20a8
lea eax, [esi*4]
bt edx, esp
lea esp, [esp]
clc
jmp 0x8c2131
mov ebp, 0x9baeacea
lea eax, [esp + 0xee]
lea esp, [esp]
mov al, byte [esp]
cld
rcl bl, 0
jmp 0x8c20da
xchg al, ah
not ebx
mov edx, dword [esp + 2]
jmp 0x8c20be
neg dx
lea esp, [esp]
mov byte [esp], bl
add esp, 0
bts edx, ecx
jmp 0x8c2144
xchg byte [esp], cl
mov eax, edi
xchg al, bl
mov edx, 0x2b5d1317
lea esp, [esp]
mov ecx, edx
jmp 0x8c211b
mov byte [esp], cl
sub esp, 0x13
mov ebp, dword [esp + 1]
mov edi, eax
lea ebx, [ebx + 0x35]
add esp, 0xc
jmp 0x8c21c0
sub ebx, 0x339b450a
xchg byte [esp + 2], dh
xchg cl, al
xchg byte [esp + 2], bl
jmp 0x8c2199
mov ch, byte [esp + 5]
rdtsc
mov bx, word [esp + 1]
sete ch
pop word [esp]
mov dl, dh
jmp 0x8c216d
mov di, si
add esp, 2
mov bx, di
mov edx, ebp
xchg byte [esp], cl
mov edi, dword [esp]
jmp 0x8c22b8
cld
lea ebp, reloc.iphlpapi.dll_GetAdaptersInfo
lea esp, [esp + 2]
xchg edi, eax
mov di, sp
mov dword [esp], edi
jmp 0x8c2183
lea ecx, [edi*4]
rdtsc
mov ax, 0x4867
xchg ebp, edi
jmp 0x8c222a
pop eax
pushal
lea ebx, [ebp*4]
sub esp, 0x1a
lea esp, [esp + 0x57]
jmp 0x8c21d4
rcr bh, cl
dec esi
bswap esi
lea esp, [esp]
pushal
pop word [esp + 0x15]
jmp 0x8c21ea
cpuid
lea edi, [eax - 0x7e]
mov si, word [esp]
sub esp, 0x1e
xchg si, dx
jmp 0x8c2277
bt si, bx
mov bx, word [esp]
btc ecx, eax
mov bx, word [esp]
mov cx, bp
mov bl, dh
jmp 0x8c2214
rdtsc
not ah
mov bl, 0x7c
std
lea esp, [esp]
xchg dh, al
jmp 0x8c2204
xchg cx, bx
bsf di, dx
bswap esi
call fcn.008c2261
mov bx, 0xb05c
xchg bl, ah
add esp, 3
pushal
and bp, 0x997c
jmp 0x8c22a1
mov bx, 0x206
lea esp, [esp + 0x22]
pop dword [esp + 2]
mov eax, esp
mov dword [esp], ecx
call fcn.008c22c7
jp 0x8c223c
sub esp, 3
pop cx
in al, dx
add esp, dword [esi + 0x59]
mov bh, 0x5c
cld
lea esp, [esp]
rdtsc
jmp 0x8c2253

Function at 0x8c2325
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [eax + ebx]
pop ax
xchg dh, ch
mov al, byte [esp + 2]
push dx
mov edx, esi
jmp 0x8c234d
pop dword [esp + 4]
bswap eax
rdtsc
pop dword [esp]
jmp 0x8c2309
xchg word [esp + 5], bx
xchg edx, edi
std
lea ebp, reloc.iphlpapi.dll_GetAdaptersInfo
cld
mov word [esp + 3], cx
jmp 0x8c235e
mov ah, byte [esp]
xchg bp, bx
add esp, 1
rdtsc
push ax
mov ebx, ebp
jmp 0x8c2332
push dword [esp + 6]
mov edx, dword [esp + 0xa]
btr di, sp
mov ecx, ebp
xchg dword [esp + 4], ebx
mov edx, dword [esp + 7]
jmp 0x8c3320
std
mov ebx, dword [esp + 6]
setae bl
mov edi, ecx
not ecx
neg di
xchg cl, ch
mov cx, bx
jmp 0x8c2a87
mov dword [esp + 7], ecx
mov word [esp + 8], si
lea edx, [eax + ebx]
xchg dword [esp + 7], edx
mov dl, byte [esp + 4]
setne ah
jmp 0x8c3049
Function at 0x8c244f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebx
jmp 0x8c2456
sub esp, 0xe
mov si, word [esp + 0x22]
rol cl, cl
mov dx, sp
lea esp, [esp + 0x12]
jmp 0x8c249b
mov esi, 0xb9841ff5
push dword [esp + 0xe]
popal
dec al
shr bx, cl
jmp 0x8c24b0
mov ebx, 0xd135d0c
cmp esi, ebp
bsf di, si
xchg byte [esp + 0x12], cl
ror bp, cl
xchg ebx, eax
jmp 0x8c2485
xchg edi, esi
mov ch, 0x51
rcl ebx, cl
xchg edi, eax
mov dx, word [esp]
rdtsc
jmp 0x8c24ed
mov byte [esp], al
sub esp, 0xc
add esp, 0xb
push dword [esp + 1]
rdtsc
add esp, 6
jmp 0x8c254f
cpuid
xchg dx, di
lea ebp, [eax*4]
pushfd
neg ch
mov edx, ecx
jmp 0x8c24c8
not al
lea ebx, reloc.iphlpapi.dll_GetAdaptersInfo
sub esp, 0x1a
call fcn.008c2522
cpuid
sub bl, 0xcb
mov ax, word [esp]
mov ax, word [esp]
xchg ecx, eax
jmp 0x8c2736
push word [esp + 1]
mov ecx, 0xe4570dc1
setnp dh
pop dx
xchg byte [esp], cl
xchg byte [esp], dl
bts cx, sp
jmp 0x8c25c4
bswap edx
xchg dh, ch
bswap edi
bswap esi
pushfd
cld
jmp 0x8c25e8
lea edi, [esi + 0x97]
mov dl, byte [esp]
lea ebp, [ecx + ebp]
xchg dl, dh
adc bl, 0xc8
mov bx, 0x7018
jmp 0x8c2698

Function at 0x8c2c4b
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x8c2b40
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x8c2b56
push dword [esp + 3]
mov dword [esp + 0x24], esi
jmp 0x8c2baa
Function at 0x408769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40c190
cmp edx, dword [eax]
je 0x40878b
add eax, 8
inc ecx
cmp eax, 0x40c220
jl 0x40877c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40c190]
jne 0x4088b9
mov eax, dword [0x40cbb0]
cmp eax, 1
je 0x408893
test eax, eax
jne 0x4087bc
cmp dword [0x40c0e4], 1
je 0x408893
cmp edx, 0xfc
je 0x4088b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4087f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00409670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00409490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x408836
lea eax, [ebp - 0x1a4]
push eax
call fcn.00409490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b45c
push edi
call fcn.00409f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00409670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00409680
lea eax, [ebp - 0xa0]
push 0x40b43c
push eax
call fcn.00409680
push dword [esi + 0x40c194]
lea eax, [ebp - 0xa0]
push eax
call fcn.00409680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00409e75
add esp, 0x2c
pop edi
jmp 0x4088b9
lea eax, [ebp + 8]
lea esi, [esi + 0x40c194]
push 0
push eax
push dword [esi]
call fcn.00409490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x930054
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x93005a
pop ebp
sub ebp, 6
sub ebp, 0x530054
jmp 0x9300b8
mov ebx, dword [esi + 0x486ebe51]
mov esi, 0x22de486e
dec eax
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
test byte ds:[eax + 0x54b8ee], 0x53
add byte [ebx], al
lds eax, [ecx + 0x93c0]
add byte [ecx + 0x619], bh
jmp 0x9300c1
mov eax, 0x530054
add eax, ebp
add eax, 0x93
mov ecx, 0x619
mov edx, 0xcbf5682c
xor byte [eax], dl
inc eax
dec ecx
jne 0x9300d8
jmp 0x9300eb
inc esi
insb byte es:[edi], dx
inc esp
sub al, 0x3c
sub al, 0x2c
inc esp
sub al, 0xe0
add byte [edi + ebx], ch
in al, dx
jl 0x9300ce
mov ecx, 0x2c656d54
jl 0x9300a9
loope 0x9300ab
movsd dword es:[edi], dword [esi]
adc byte [esp + ebp], ch
sub al, 0xad
in eax, dx
aam 0x2c
sub al, 0x2c
das
loope 0x9300a6
sub ch, byte [esp + ebp]
sub al, 0x96
add al, 0x2c
sub al, 0x2c
fcmovne st(0), st(6)
das
in al, 0xa7
lodsd eax, dword [esi]
and byte [esp + ebp], ch
sub al, 0x2f
jmp 0x1a4145a7
Function at 0x413769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x417190
cmp edx, dword [eax]
je 0x41378b
add eax, 8
inc ecx
cmp eax, 0x417220
jl 0x41377c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x417190]
jne 0x4138b9
mov eax, dword [0x417bb0]
cmp eax, 1
je 0x413893
test eax, eax
jne 0x4137bc
cmp dword [0x4170e4], 1
je 0x413893
cmp edx, 0xfc
je 0x4138b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4137f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00414670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00414490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x413836
lea eax, [ebp - 0x1a4]
push eax
call fcn.00414490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41645c
push edi
call fcn.00414f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00414670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00414680
lea eax, [ebp - 0xa0]
push 0x41643c
push eax
call fcn.00414680
push dword [esi + 0x417194]
lea eax, [ebp - 0xa0]
push eax
call fcn.00414680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00414e75
add esp, 0x2c
pop edi
jmp 0x4138b9
lea eax, [ebp + 8]
lea esi, [esi + 0x417194]
push 0
push eax
push dword [esi]
call fcn.00414490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x10005510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000551f
pop dword [ebp - 0x24]
mov eax, 0x8aadfc0e
sub eax, 0x7aada6ef
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x38d56
push 0
mov eax, 0xe122ced6
sub eax, 0xd121ce92
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x226f0a43
sub ecx, 0x226ebb9a
xor ebx, ebx
add ebx, eax
mov esi, 0x10019800
add esi, dword [ebp - 0x24]
mov edx, 0xcffe19db
mov dword [ebp - 0x20], 0xed2014de
mov edi, dword [esi]
xor dword [ebp - 0xc], 0x62ca7cc0
sub edi, edx
sub dword [ebp - 0xc], 0xf4b559c1
mov dword [ebx], edi
sub dword [ebp - 0x14], edi
add ebx, 0xa3eab566
add ebx, 0x5c154a9e
add esi, 0x4a733a16
add esi, 0xb58cc5ee
loop 0x10005574
add eax, 0xdd4c9d15
add eax, 0x22b49062
xor ebx, ebx
add ebx, eax
add eax, 0x78711ced
add eax, 0x878ee318
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x115ba058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x115ba1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x115ba07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x115ba06a
add dl, dl
jne 0x115ba089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x115ba0dc
xor eax, eax
add dl, dl
jne 0x115ba096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x115ba17d
add dl, dl
jne 0x115ba0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x115ba0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x115ba0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x115ba0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x115ba0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x115ba075
mov eax, 1
add dl, dl
jne 0x115ba0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x115ba0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x115ba0e1
sub eax, ebx
mov ebx, 1
jne 0x115ba128
mov ecx, 1
add dl, dl
jne 0x115ba10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x115ba119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x115ba105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x115ba075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x115ba13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x115ba14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x115ba136
cmp eax, 0x7d00
jae 0x115ba16d
cmp eax, 0x500
jb 0x115ba168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x115ba075
cmp eax, 0x7f
ja 0x115ba170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x115ba075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x115ba19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x115ba075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10