joyce8/EMBER2024-capa huggingface dataset:
Function at 0x770568
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 4
push 0x20
push edx
lea edx, [esp + 0x14]
push edx
call fcn.0079dec8
add esp, 0xc
xor esi, esi
xor ecx, ecx
xor edx, edx
jmp 0x7705d1
xor eax, eax
mov edi, esi
mov ebp, dword [esp]
shl edi, 4
lea ebx, [esp + edx*4 + 0xc]
lea edi, [ebp + edi]
mov bl, byte [ebx + eax]
lea edi, [edi + ecx*4]
mov byte [edi + eax + 0x14], bl
inc eax
cmp eax, 4
jl 0x77059c
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x7705c9
cmp ecx, 4
jl 0x77059a
cmp ecx, 4
jne 0x7705d1
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x7705dc
cmp esi, 0xa
jle 0x7705be
cmp esi, 0xa
jg 0x77076f
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov al, byte [edx + 0x44a168]
xor byte [esp + 0xc], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 0xa]
mov dl, byte [eax + 0x44a168]
xor byte [esp + 0xd], dl
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov al, byte [edx + 0x44a168]
xor byte [esp + 0xe], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 8]
mov dl, byte [eax + 0x44a168]
xor byte [esp + 0xf], dl
mov eax, dword [esp + 4]
mov dl, byte [eax + 0x44a368]
xor byte [esp + 0xc], dl
inc dword [esp + 4]
cmp dword [esp + 8], 8
je 0x77067f
mov edx, 1
cmp edx, dword [esp + 8]
jge 0x77071d
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x77065f
inc edx
cmp edx, dword [esp + 8]
jl 0x77065d
jmp 0x77071d
mov edx, 1
jmp 0x77069d
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x770688
inc edx
mov eax, dword [esp + 8]
sar eax, 1
jns 0x7706a8
adc eax, 0
cmp edx, eax
jl 0x770686
mov eax, dword [esp + 8]
sar eax, 1
jns 0x7706b7
adc eax, 0
xor edx, edx
mov dl, byte [esp + eax*4 + 8]
mov dl, byte [edx + 0x44a168]
xor byte [esp + eax*4 + 0xc], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov dl, byte [edx + 0x44a168]
xor byte [esp + eax*4 + 0xd], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xa]
mov dl, byte [edx + 0x44a168]
xor byte [esp + eax*4 + 0xe], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov dl, byte [edx + 0x44a168]
xor byte [esp + eax*4 + 0xf], dl
mov edx, eax
inc edx
cmp edx, dword [esp + 8]
jge 0x77071d
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x770702
inc edx
cmp edx, dword [esp + 8]
jl 0x770700
xor edx, edx
jmp 0x77075b
xor eax, eax
mov ebx, esi
shl ebx, 4
mov edi, dword [esp]
lea ebx, [edi + ebx]
lea ebx, [ebx + ecx*4]
lea edi, [ebx + eax + 0x14]
lea ebx, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
mov byte [edi], bl
inc eax
cmp eax, 4
jl 0x770725
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x770753
cmp ecx, 4
jl 0x770723
cmp ecx, 4
jne 0x77075b
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x770766
cmp esi, 0xa
jle 0x770748
cmp esi, 0xa
jle 0x7705e5
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x770778
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
shl ebx, 2
add edx, edi
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx ebp, byte [edx + 1]
mov bl, byte [edx]
lea ebp, [ebp*4 + 0x44c786]
lea ebx, [ebx*4 + 0x44c386]
mov bl, byte [ebx + eax]
xor bl, byte [ebp + eax]
movzx ebp, byte [edx + 2]
movzx edx, byte [edx + 3]
lea ebp, [ebp*4 + 0x44cb86]
lea edx, [edx*4 + 0x44cf86]
xor bl, byte [ebp + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x77078a
inc eax
cmp eax, 4
jl 0x770788
mov ecx, esi
push 0x10
shl ecx, 4
lea eax, [esp + 4]
add ecx, edi
push eax
add ecx, 0x14
push ecx
call fcn.0079dec8
add esp, 0xc
inc esi
cmp esi, 0xa
jl 0x770786
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x772e70
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax]
cmp edx, 0x11
jle 0x772e90
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x44], ecx
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x38], ecx
xor ecx, ecx
mov dword [eax + edx*4], ecx
dec edx
cmp edx, 0x11
jg 0x772e77
cmp dword [eax], 0x11
jbe 0x772eac
mov dword [eax], 0x11
jmp 0x772e9f
dec dword [eax]
cmp dword [eax], 0
je 0x772eac
mov edx, dword [eax]
cmp dword [eax + edx*4], 0
je 0x772e9d
ret

Function at 0x77373c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [esi]
cmp eax, dword [ebx]
jae 0x773784
mov eax, 1
jmp 0x77375c
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi]
jbe 0x773752
mov ecx, dword [ebx]
mov edx, eax
sub ecx, dword [esi]
shl ecx, 2
shl edx, 2
push ecx
shl eax, 2
add edx, ebx
push edx
add eax, edi
push eax
call fcn.0079dec8
add esp, 0xc
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x7737ea
mov ecx, dword [esi]
cmp ecx, dword [ebx]
jbe 0x7737c3
mov eax, 1
jmp 0x77379b
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebx]
jbe 0x773791
mov ecx, dword [esi]
mov edx, eax
sub ecx, dword [ebx]
shl ecx, 2
shl edx, 2
push ecx
shl eax, 2
add edx, esi
push edx
add eax, edi
push eax
call fcn.0079dec8
add esp, 0xc
mov eax, dword [esi]
mov dword [edi], eax
jmp 0x7737ea
mov eax, dword [ebx]
test eax, eax
jbe 0x7737d6
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
jne 0x7737d6
dec eax
test eax, eax
ja 0x7737c9
mov dword [edi], eax
test eax, eax
jbe 0x7737ea
mov ecx, dword [esi + eax*4]
xor ecx, dword [ebx + eax*4]
mov dword [edi + eax*4], ecx
dec eax
test eax, eax
ja 0x7737dc
pop edi
pop esi
pop ebx
ret
Function at 0x77d304
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xffffff70
xor eax, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
xor edx, edx
mov dword [esp + 8], edx
mov esi, dword [esp + 8]
jmp 0x77d381
xor eax, eax
mov edx, dword [esp]
add edx, esi
add edx, eax
mov cl, byte [edx + 1]
mov byte [esp + eax + 0x19], cl
mov bl, byte [edx]
sub bl, cl
mov byte [esp + eax + 0x18], bl
mov dl, byte [edx + 2]
sub dl, cl
mov byte [esp + eax + 0x1a], dl
add eax, 3
cmp eax, 0x78
jl 0x77d32f
mov ebx, 3
mov cl, byte [esp + ebx + 0x18]
sub cl, byte [esp + ebx + 0x15]
movsx ecx, cl
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 8]
add dword [esp + edx*4 + 0xc], eax
inc ebx
cmp ebx, 0x78
jl 0x77d35b
add esi, 0x780
mov eax, dword [esp + 4]
add eax, 0xffffff88
cmp esi, eax
jl 0x77d32d
inc dword [esp + 8]
cmp dword [esp + 8], 2
jle 0x77d327
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp edx, eax
jb 0x77d3ad
cmp eax, dword [esp + 0x14]
ja 0x77d3ad
xor eax, eax
jmp 0x77d3b9
mov eax, 1
cmp edx, dword [esp + 0x14]
jbe 0x77d3b9
inc eax
add esp, 0x90
pop esi
pop ebx
ret
Function at 0x7cfa15
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100530bb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10075518]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x10066274
call fcn.0080d9df
push 4
mov dword [ebp - 4], 0
call fcn.007f75ef
mov edi, eax
add esp, 4
test edi, edi
je 0x7cfa95
call fcn.0080d453
mov dword [edi], eax
call fcn.0080d212
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0080d147
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x7cfa8b
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0080d16f
jmp 0x7cfa97
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7d1215
Capabilities:
Encode data using xor

Disassembly:
push esi
or eax, 0xffffffff
mov ecx, 0xc
push edi
lea ebx, [ebx]
movzx edi, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x100668a0]
inc edx
dec ecx
jne 0x7d1225
pop edi
not eax
pop esi
ret
Function at 0x7d1245
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [edx]
mov edx, dword [edx + 4]
push ebx
push esi
mov ecx, eax
mov esi, eax
shr esi, 0x10
and ecx, 0xff0000
or ecx, esi
mov esi, eax
and esi, 0xff00
shl eax, 0x10
or esi, eax
shl esi, 8
mov eax, edx
push edi
mov edi, dword [ebp + 8]
shr ecx, 8
or ecx, esi
mov esi, edx
shr esi, 0x10
and eax, 0xff0000
or eax, esi
mov esi, edx
shl esi, 0x10
and edx, 0xff00
or esi, edx
shl esi, 8
shr eax, 8
or eax, esi
mov esi, dword [edi]
mov edi, dword [edi + 4]
mov edx, esi
mov ebx, esi
shr ebx, 0x10
and edx, 0xff0000
or edx, ebx
mov ebx, esi
shl ebx, 0x10
and esi, 0xff00
or ebx, esi
shl ebx, 8
mov esi, edi
shr edx, 8
or edx, ebx
mov ebx, edi
shr ebx, 0x10
and esi, 0xff0000
or esi, ebx
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 8]
shl ebx, 8
shr esi, 8
or esi, ebx
mov ebx, dword [edi + 8]
mov dword [ebp - 4], ebx
mov edi, ebx
and edi, 0xff0000
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp - 8], edi
mov edi, dword [ebp - 4]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp - 8]
shl ebx, 8
or edi, ebx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0xc]
mov edi, ebx
mov dword [ebp + 8], ebx
and edi, 0xff0000
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp - 8], edi
mov edi, dword [ebp + 8]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp - 8]
shl ebx, 8
or edi, ebx
mov dword [ebp - 8], edi
mov edi, 0x10
mov dword [ebp + 8], 0xe3779b90
nop
dec edi
mov dword [ebp - 0xc], edi
mov edi, ecx
shr edi, 5
add edi, dword [ebp - 8]
mov ebx, ecx
shl ebx, 4
add ebx, dword [ebp - 4]
xor edi, ebx
mov ebx, dword [ebp + 8]
add ebx, ecx
xor edi, ebx
sub eax, edi
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
add edi, esi
add ebx, edx
xor edi, ebx
mov ebx, dword [ebp + 8]
add dword [ebp + 8], 0x61c88647
add ebx, eax
xor edi, ebx
sub ecx, edi
mov edi, dword [ebp - 0xc]
test edi, edi
jne 0x7d1365
mov esi, ecx
and esi, 0xff0000
mov edx, ecx
shr edx, 0x10
or esi, edx
mov edx, ecx
shl ecx, 0x10
shr esi, 8
and edx, 0xff00
or edx, ecx
shl edx, 8
or esi, edx
mov edx, dword [ebp + 0xc]
mov dword [edx], esi
mov ecx, eax
mov esi, eax
shr esi, 0x10
and ecx, 0xff0000
or ecx, esi
mov esi, eax
and esi, 0xff00
shl eax, 0x10
or esi, eax
shl esi, 8
shr ecx, 8
pop edi
or ecx, esi
pop esi
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7d1705
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [edx]
mov edx, dword [edx + 4]
push ebx
push esi
mov eax, ecx
mov esi, ecx
shr esi, 0x10
and eax, 0xff0000
or eax, esi
mov esi, ecx
and esi, 0xff00
shl ecx, 0x10
or esi, ecx
shl esi, 8
mov ecx, edx
push edi
mov edi, dword [ebp + 8]
shr eax, 8
or eax, esi
mov esi, edx
shr esi, 0x10
and ecx, 0xff0000
or ecx, esi
mov esi, edx
shl esi, 0x10
and edx, 0xff00
or esi, edx
shl esi, 8
shr ecx, 8
or ecx, esi
mov esi, dword [edi]
mov edi, dword [edi + 4]
mov edx, esi
mov ebx, esi
shr ebx, 0x10
and edx, 0xff0000
or edx, ebx
mov ebx, esi
shl ebx, 0x10
and esi, 0xff00
or ebx, esi
shl ebx, 8
mov esi, edi
shr edx, 8
or edx, ebx
mov ebx, edi
shr ebx, 0x10
and esi, 0xff0000
or esi, ebx
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 8]
shl ebx, 8
shr esi, 8
or esi, ebx
mov ebx, dword [edi + 8]
mov dword [ebp - 4], ebx
mov edi, ebx
and edi, 0xff0000
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp - 8], edi
mov edi, dword [ebp - 4]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp - 8]
shl ebx, 8
or edi, ebx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0xc]
mov edi, ebx
mov dword [ebp + 8], ebx
and edi, 0xff0000
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp - 8], edi
mov edi, dword [ebp + 8]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp - 8]
shl ebx, 8
or edi, ebx
mov dword [ebp - 8], edi
mov edi, 0x10
mov dword [ebp + 8], 0
nop
sub dword [ebp + 8], 0x61c88647
dec edi
mov dword [ebp - 0xc], edi
mov edi, ecx
shr edi, 5
add edi, esi
mov ebx, ecx
shl ebx, 4
add ebx, edx
xor edi, ebx
mov ebx, dword [ebp + 8]
add ebx, ecx
xor edi, ebx
add eax, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 8]
mov ebx, eax
shl ebx, 4
add ebx, dword [ebp - 4]
xor edi, ebx
mov ebx, dword [ebp + 8]
add ebx, eax
xor edi, ebx
add ecx, edi
mov edi, dword [ebp - 0xc]
test edi, edi
jne 0x7d1825
mov esi, eax
and esi, 0xff0000
mov edx, eax
shr edx, 0x10
or esi, edx
mov edx, eax
shl eax, 0x10
shr esi, 8
and edx, 0xff00
or edx, eax
shl edx, 8
or esi, edx
mov edx, dword [ebp + 0xc]
mov dword [edx], esi
mov eax, ecx
mov esi, ecx
shr esi, 0x10
and eax, 0xff0000
or eax, esi
mov esi, ecx
and esi, 0xff00
shl ecx, 0x10
or esi, ecx
shl esi, 8
shr eax, 8
pop edi
or eax, esi
pop esi
mov dword [edx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7dd045
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x7f5eb5
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x7f5ece
mov edi, ebx
mov ebx, eax
jmp 0x7f5ed0
mov edi, eax
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jg 0x7f5ee0
mov eax, esi
jmp 0x7f5eea
push eax
push esi
call fcn.007d2065
add esp, 8
test eax, eax
jne 0x7f5ef2
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x7f5f10
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [ebx + 4]
jl 0x7f5ef9
cmp eax, dword [edi + 4]
jge 0x7f5f27
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x7f5f15
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x7f5f4b
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
or ecx, 0xffffffff
mov edx, dword [eax]
sub eax, 4
test edx, edx
jne 0x7f5f4b
add dword [esi + 4], ecx
cmp dword [esi + 4], edx
jg 0x7f5f3a
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x813ab5
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100530bb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10075518]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x10066424
call fcn.0080d9df
push 4
mov dword [ebp - 4], 0
call fcn.007f75ef
mov edi, eax
add esp, 4
test edi, edi
je 0x813b35
call fcn.0080d453
mov dword [edi], eax
call fcn.0080d212
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0080d147
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x813b2b
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0080d16f
jmp 0x813b37
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa03845
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
jmp 0xa03821
lea esp, [esp + 3]
ror edi, 0
shl ebx, cl
jmp 0xa03870
bswap ebx
mov bx, 0x9998
mov bl, 0xa6
mov dh, ch
jmp 0xa03856
sub esp, 7
jbe 0xa0381d
ja 0xa03807
mov bl, 0xa6
mov dh, ch
jmp 0xa03856
lea esp, [esp + 0xc]
not edi
lea eax, [ecx*4]
cmp eax, 0x81f9fa5b
jmp 0xa038c6
jo 0xa0382c
bswap ebx
mov bx, 0x9998
jmp 0xa0384c
xchg ebx, eax
pushal
jmp 0xa038ad
lea ebx, [eax*4]
mov ebx, 0x6a94d1f9
jmp 0xa038ed
rol edi, 0
jo 0xa0387f
lea ebx, [eax*4]
mov ebx, 0x6a94d1f9
xchg edx, ebx
jmp 0xa038cd
jl 0xa0387a
xchg ebx, eax
pushal
jmp 0xa0387d
rdtsc
call fcn.00a03907
not edi
lea edx, [esi + ebp]
btr ax, si
jl 0xa039b4
setnp al
jmp 0xa03998
xchg edx, ebx
rdtsc
lea esp, [esp + 0x20]
jmp 0xa038d4
jmp 0xa039b9
add edi, dword [esi]
mov bx, ax
rdtsc
mov bx, word [esp]
mov dh, bh
jmp 0xa03982
setnp al
jmp 0xa03998
movzx ebx, byte [edi - 1]
sub esp, 0xe
jmp 0xa03a0c
xchg edx, eax
xchg dword [esp + 8], edx
call fcn.00a039f4
aas
mov eax, 0x3fb8492e
adc edx, dword [ebp + 0x1a9f6c05]
test byte [edi], dh
push ds
xchg dword [esp + 4], edx
not edx
mov dx, word [esp]
mov al, byte [esp]
push dword [esp + 4]
ret 8
jge 0xa039c6
xchg edx, eax
xchg dword [esp + 8], edx
jmp 0xa039cc
Function at 0xa04f3b
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0x6c51272c
jmp 0xa05381
jmp 0xa04f49
inc dh
jp 0xa04f25
inc eax
pushal
jmp 0xa04f57
inc eax
pushal
lea edx, [ebp - 0xf811]
jmp 0xa04faf
lea edx, [ebp - 0xf811]
rol edx, 1
clc
jmp 0xa04fb2
jl 0xa04f8c
jge 0xa04f8c
scasb al, byte es:[edi]
das
mov edi, 0xc4b029da
inc eax
salc
mov cl, 0x40
invalid
sub bl, cl
jmp 0xa04fd4
sub esp, 0
mov edx, ebx
clc
jmp 0xa04fdd
rol edx, 1
clc
rdtsc
inc al
jmp 0xa04f76
clc
jmp 0xa04fdd
mov ah, 0xb1
jmp 0xa0502c
js 0xa04f94
sub esp, 0
mov edx, ebx
jmp 0xa04fb8
mov dl, bl
btr ax, ax
jb 0xa04fbb
mov ah, 0xb1
jmp 0xa0502c
lea esp, [esp + 0x20]
not dl
mov ax, word [esp]
mov ax, word [esp]
neg ah
jmp 0xa05053
lea eax, [esp + edi]
neg dl
pushal
jmp 0xa0503d
add dl, 0x84
lea eax, [ecx + 0xbc18]
mov al, bh
setno ah
pushal
jmp 0xa04fe9
neg eax
jo 0xa050ac
mov eax, esi
mov ax, 0x158f
not ah
neg ax
jmp 0xa05077
jp 0xa05013
mov esi, 0xeb3c048d
mov esp, 0xfc58b66
enter 0xffffffffffff8b66, 0xffffffffffffffc1
lea eax, [esp + edi]
jmp 0xa05016
mov ax, bp
bswap eax
mov ax, cx
bsf ax, bx
jbe 0xa05092
ja 0xa0507c
bnd ja 0xa05054
xor byte [ecx - 0x69], 0xea
add eax, 0xf766d4f6
fadd st(0)
ret 0xeb00
not ah
neg ax
rol dl, 0
jmp 0xa0505a
mov ax, 0x50c2
sub esp, 0xb
pop eax
jmp 0xa050b4
mov ax, 0x50c2
sub esp, 0xb
pop eax
lea esp, [esp + 3]
jmp 0xa057e4
mov eax, esi
mov ax, 0x158f
jmp 0xa05072
lea esp, [esp + 3]
jmp 0xa057e4
lea eax, [esi*4]
bswap eax
mov eax, dword [esp]
mov eax, 0xe4f27033
mov ah, bh
xchg al, ah
jmp 0xa052e2
jg 0xa050ff
bswap eax
mov ax, 0x2892
jmp 0xa05162
bswap eax
mov ax, 0x2892
mov ah, byte [esp]
mov dx, 0x3a89
bswap eax
lea eax, [edi*4]
jmp 0xa05131
not ax
xchg al, dh
mov dh, bl
dec bl
rdtsc
call 0xa05142
movsd dword es:[edi], dword [esi]
sub esp, 0x1e
lea esp, [esp + 2]
xchg dword [esp + 0x1c], ebx
bsr eax, edx
mov dx, di
jmp 0xa05183
mov ah, byte [esp]
mov dx, 0x3a89
bswap eax
jmp 0xa0510e
cmc
sub esp, 5
lea esp, [esp + 1]
lea ebx, [ebx - 0x2a]
dec dx
mov edx, 0x8ca06dc4
call fcn.00a0516d
sbb dword [esi + 0x21a66b0c], ebx
outsd dx, dword [esi]
jbe 0xa05207
mov al, byte [0x8b661ae3]
adc al, 0x24
mov dx, word [esp]
lea eax, [esp + 0x24ab]
jmp 0xa05212
mov dx, word [esp]
lea eax, [esp + 0x24ab]
dec edi
sbb dx, 0x8763
jmp 0xa050e9
sub cl, dl
mov ax, 0x5bb2
neg edx
jo 0xa05207
jno 0xa051a9
mov edx, dword [esp]
mov dx, sp
adc dl, 0x2d
jmp 0xa05315
jmp 0xa05357
pushfd
mov dx, 0x5cd6
jmp 0xa05323
shl eax, 2
mov dx, si
mov dx, 0x5159
jmp 0xa05341
bsf edx, ebx
mov edx, 0x2b243312
lea esp, [esp + 4]
mov edx, dword [esp]
jmp 0xa053a2
dec edx
js 0xa05317
pushfd
mov dx, 0x5cd6
shl eax, 2
mov dx, si
mov dx, 0x5159
jmp 0xa05341
mov dx, word [esp]
lea edx, [esp + edx]
jmp 0xa0538a
xchg dl, dh
sub dh, 0x9a
ja 0xa0536b
jbe 0xa053d5
mov eax, dword [eax - 0x6bb0eca2]
setnp dl
mov dh, byte [esp]
mov edx, ebp
jmp 0xa04210
mov dh, 0xd1
mov edx, esi
jmp 0xa041d8
mov dx, word [esp]
lea edx, [esp + edx]
jmp 0xa0538a
mov ah, bh
jmp 0xa050d0
bswap eax
mov eax, dword [esp]
mov eax, 0xe4f27033
jmp 0xa0542c
ror dl, 0
jle 0xa050bd
lea eax, [esi*4]
jmp 0xa055fd
Function at 0xa17c28
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], bh
mov dword [esp + 4], esp
call 0xa17ce6
push 0xf0a0adbc
jmp 0xa17cc3
call 0xa17d1a
mov ebp, dword [esp + 0x30]
not al
not dh
lea edi, [esp + 4]
jmp 0xa17d7a
and bx, dx
jmp 0xa17d5e
sub esp, 0xbc
mov esi, esp
bswap eax
lea edx, [esi*4]
jmp 0xa17d9e
xchg bl, al
setle ch
inc cx
js 0xa17d55
and bx, dx
jmp 0xa17d5e
clc
jnp fcn.00a17d88
jp fcn.00a17d88

Function at 0xa17c45
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], edx
call fcn.00a17c22

Function at 0xa17c94
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
push dword [esp + 2]
jmp 0xa17c7e
ja 0xa17c5e
mov dword [esp + 4], edi
lea esp, [esp + 4]
call fcn.00a17ca7
outsb dx, byte [esi]
out dx, al
jl 0xa17cac
neg byte [edi + edi*2]
pop dword [esp]
pop word [esp]
mov byte [esp], ch
lea esp, [esp + 2]
mov dword [esp], esi
jmp 0xa17c53
add edx, 0xba484c4f
jmp 0xa18609
push dword [esp + 0x18]
ret 0x1c
bsr eax, ebp
jmp 0xa189a1
mov eax, 0xa7fabbb5
lea eax, [0x6d58c0ad]
call fcn.00a1881a
mov cl, byte [edi]
lahf
cli
or edi, edi
and byte [eax + 0x4aa05136], ah
pop ebp
lodsb al, byte [esi]
mov edi, 0x24548786
xchg dword [esp + 0x18], edx
xchg dl, ah
lea edx, [ebx*4]
xchg dl, dh
inc bx
jmp 0xa183fc
call 0xa1865e
btc ax, sp
jg 0xa1896f
setl al
jmp 0xa18a9d
setl al
jmp 0xa18a9d
jno 0xa18612
mov eax, 0xa7fabbb5
lea eax, [0x6d58c0ad]
jmp 0xa188c0
neg bl
call 0xa18a6d

Function at 0xa17d0d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
pop dword [esp]
xchg dword [esp + 4], edx
call fcn.00a17cec
bswap edi
mov dword [esp], ebx
jmp 0xa17cc8

Function at 0xa17d1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
pop dword [esp]
xchg dword [esp + 4], edx
call fcn.00a17cec
bswap edi
mov dword [esp], ebx
jmp 0xa17cc8

Function at 0xa18f7d
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts ax, di
call fcn.00a18632
pop ebx
sub esp, 0x14
pop dword [esp + 0xa]
lea edx, [edx - 0x2c]
xchg ebx, eax
stc
jmp 0xa18afb
jmp 0xa18ba8