joyce8/EMBER2024-capa huggingface dataset:
Function at 0x680261a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x680310d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c8
lea ecx, [ebp - 0x1b8]
call fcn.68014ea3
mov dword [ebp - 4], 0
mov byte [ebp - 0x1b0], 0x64
mov byte [ebp - 0x1af], 0x3a
mov byte [ebp - 0x1ae], 0x5c
mov byte [ebp - 0x1ad], 0x4e
mov byte [ebp - 0x1ac], 0x42
mov byte [ebp - 0x1ab], 0x2e
mov byte [ebp - 0x1aa], 0x49
mov byte [ebp - 0x1a9], 0x4e
mov byte [ebp - 0x1a8], 0x49
mov byte [ebp - 0x1a7], 0
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x1b8]
call fcn.68014ec5
push 0xc8
push 0
push 0x68056fc8
call fcn.6802f606
add esp, 0xc
mov byte [ebp - 0x2c4], 0
push 0x103
push 0
lea ecx, [ebp - 0x2c3]
push ecx
call fcn.6802f606
add esp, 0xc
push 0
push 0x104
lea edx, [ebp - 0x2c4]
push edx
push 0x6803c81c
push 0x6803c820
lea ecx, [ebp - 0x1b8]
call fcn.680154ee
lea eax, [ebp - 0x2c4]
push eax
call fcn.68020170
test eax, eax
jne 0x680262b3
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b8]
call fcn.68014eb0
mov eax, dword [ebp - 0x2cc]
jmp 0x68026371
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1a4]
push edx
push 0x6803c82c
lea eax, [ebp - 0x2c4]
push eax
call fcn.68025960
add esp, 0x10
cmp dword [ebp - 0x10], 0
jne 0x68026303
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b8]
call fcn.68014eb0
mov eax, dword [ebp - 0x2d0]
jmp 0x68026371
mov dword [ebp - 0x2c8], 0
jmp 0x6802631e
mov ecx, dword [ebp - 0x2c8]
add ecx, 1
mov dword [ebp - 0x2c8], ecx
mov edx, dword [ebp - 0x2c8]
cmp edx, dword [ebp - 0x10]
jge 0x6802634f
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [ebp + eax*4 - 0x1a4]
push ecx
call dword [0x6803231c]
add esp, 4
mov edx, dword [ebp - 0x2c8]
mov dword [edx*4 + 0x68056fc8], eax
jmp 0x6802630f
mov dword [ebp - 0x2d4], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b8]
call fcn.68014eb0
mov eax, dword [ebp - 0x2d4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x68026380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x680310ea
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
lea ecx, [ebp - 0x24]
call fcn.68014ea3
mov dword [ebp - 4], 0
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x3a
mov byte [ebp - 0x1a], 0x5c
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x18], 0x42
mov byte [ebp - 0x17], 0x2e
mov byte [ebp - 0x16], 0x49
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
call fcn.68014ec5
push 0xa
push 0x50
push 0x6803c830
push 0x6803c834
lea ecx, [ebp - 0x24]
call fcn.680155b8
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.68014eb0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x68026420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x680310fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
lea ecx, [ebp - 0x24]
call fcn.68014ea3
mov dword [ebp - 4], 0
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x3a
mov byte [ebp - 0x1a], 0x5c
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x18], 0x42
mov byte [ebp - 0x17], 0x2e
mov byte [ebp - 0x16], 0x49
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
call fcn.68014ec5
push 0xa
push 0x50
push 0x6803c840
push 0x6803c844
lea ecx, [ebp - 0x24]
call fcn.680155b8
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.68014eb0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x680264c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6803110e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
lea ecx, [ebp - 0x24]
call fcn.68014ea3
mov dword [ebp - 4], 0
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x3a
mov byte [ebp - 0x16], 0x5c
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x2e
mov byte [ebp - 0x12], 0x49
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x10], 0x49
mov byte [ebp - 0xf], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
call fcn.68014ec5
push 0xa
push 1
push 0x6803c858
push 0x6803c860
lea ecx, [ebp - 0x24]
call fcn.680155b8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
sbb ecx, ecx
add ecx, 1
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.68014eb0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x68026570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68031120
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
lea ecx, [ebp - 0x24]
call fcn.68014ea3
mov dword [ebp - 4], 0
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x3a
mov byte [ebp - 0x16], 0x5c
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x2e
mov byte [ebp - 0x12], 0x49
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x10], 0x49
mov byte [ebp - 0xf], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
call fcn.68014ec5
push 0xa
push 0x452
push 0x6803c86c
push 0x6803c870
lea ecx, [ebp - 0x24]
call fcn.680155b8
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.68014eb0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x680282c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6803119e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
lea ecx, [ebp - 0x24]
call fcn.68014ea3
mov dword [ebp - 4], 0
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x3a
mov byte [ebp - 0x16], 0x5c
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x2e
mov byte [ebp - 0x12], 0x49
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x10], 0x49
mov byte [ebp - 0xf], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
call fcn.68014ec5
push 0xa
push 0
push 0x6803d59c
push 0x6803d5a8
lea ecx, [ebp - 0x24]
call fcn.680155b8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x68028358
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.68014eb0
mov eax, dword [ebp - 0x28]
jmp 0x68028371
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.68014eb0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x68028380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x680311b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
lea ecx, [ebp - 0x24]
call fcn.68014ea3
mov dword [ebp - 4], 0
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x3a
mov byte [ebp - 0x16], 0x5c
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x2e
mov byte [ebp - 0x12], 0x49
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x10], 0x49
mov byte [ebp - 0xf], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
call fcn.68014ec5
push 0xa
push 1
push 0x6803d5b8
push 0x6803d5c0
lea ecx, [ebp - 0x24]
call fcn.680155b8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x68028418
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.68014eb0
mov eax, dword [ebp - 0x28]
jmp 0x68028431
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.68014eb0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x68028440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x680311c2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
lea ecx, [ebp - 0x24]
call fcn.68014ea3
mov dword [ebp - 4], 0
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x3a
mov byte [ebp - 0x1a], 0x5c
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x18], 0x42
mov byte [ebp - 0x17], 0x32
mov byte [ebp - 0x16], 0x2e
mov byte [ebp - 0x15], 0x49
mov byte [ebp - 0x14], 0x4e
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
call fcn.68014ec5
push 0xa
push 2
push 0x6803d5d0
push 0x6803d5d8
lea ecx, [ebp - 0x24]
call fcn.680155b8
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.68014eb0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x680295a0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x68054cec]
mov eax, dword [eax]
push ebx
push esi
add eax, 0x70
push edi
push eax
call fcn.6802b367
mov esi, eax
pop ecx
mov dword [ebp - 4], esi
cmp esi, 0xfffffffe
je 0x68029677
lea eax, [esi + 0x1d0]
push 0
push eax
call fcn.6802b3a0
push dword [ebp + 8]
lea eax, [esi + 0x1d4]
push eax
call fcn.6802b3c3
push dword [ebp + 0x14]
lea eax, [esi + 0x1d6]
push eax
call fcn.6802b3e8
push dword [ebp + 0x18]
lea eax, [esi + 0x1d7]
push eax
call fcn.6802b3e8
add esp, 0x20
cmp byte [ebp + 0x1c], 0x1f
lea eax, [esi + 0x1d8]
jbe 0x68029614
push 0x1f
jmp 0x68029617
push dword [ebp + 0x1c]
push eax
call fcn.6802b3e8
pop ecx
pop ecx
push dword [ebp + 0xc]
lea eax, [esi + 0x1d9]
push eax
call fcn.6802b3e8
push dword [ebp + 0x10]
lea eax, [esi + 0x1da]
push eax
call fcn.6802b3e8
push dword [ebp + 0x20]
lea eax, [esi + 0x1db]
push eax
call fcn.6802b3e8
add esp, 0x18
add esi, 0x1dc
cmp byte [ebp + 0x24], 7
jbe 0x6802965f
push 7
jmp 0x68029662
push dword [ebp + 0x24]
push esi
call fcn.6802b3e8
pop ecx
pop ecx
pushal
mov esi, dword [ebp - 4]
mov ecx, esi
call dword [0x68054d48]
popal
pop edi
pop esi
pop ebx
leave
ret

Function at 0x680296ae
Capabilities:
Packed with generic packer

Disassembly:
push 0xc
push 0x68041e48
call fcn.6802f730
and dword [ebp - 4], 0
mov eax, dword [0x68054cec]
mov eax, dword [eax]
add eax, 0x70
push eax
call fcn.6802b367
pop ecx
cmp eax, 0xfffffffe
je 0x68029727
add eax, 0x12c
push eax
call fcn.6802b367
pop ecx
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, 0xfffffffe
je 0x68029727
push dword [ebp + 8]
lea eax, [esi + 0x4cc]
push eax
call fcn.6802b3a0
pop ecx
pop ecx
test eax, eax
je 0x68029727
push 1
add esi, 0x490
push esi
call fcn.6802b3e8
pop ecx
pop ecx
test eax, eax
je 0x68029727
pushal
mov ecx, dword [ebp - 0x1c]
call dword [0x68054d54]
popal
jmp 0x68029727
or dword [ebp - 4], 0xffffffff
call fcn.6802f76b
ret

Function at 0x6802ad2e
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x680834af
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
call fcn.680251f0
clc
push 0x482ee470
test eax, eax
lea esp, [esp + 4]
je 0x680f0e1e
mov ax, sp
mov eax, dword [ebp - 0x1c]
jmp 0x680ba181
cmp dword [ebp - 0x28], 0
jmp 0x6808c20b
je 0x680e65d7
pushfd
mov byte [esp], 0x13
pushfd
mov dword [esp + 4], 2
pushfd
push dword [esi + eax]
pop dword [esp + 4]
pushfd
pushal
lea esp, [esp + 0x28]
jmp fcn.680a1fc6
mov dword [ebp - 0x20], eax
lea edx, [ecx*2 + 0x1b4d9d5b]
call fcn.680e6c07
call fcn.680b612d
call fcn.680eda3d
call fcn.680bda92
lea esp, [esp + 0x28]
jne 0x680e0ed8
clc
cmp dword [esi + eax + 8], 3
pushal
jmp 0x6809204d
pushal
pushal
push edi
lea esp, [esp + 0x44]
jne 0x680e0ed8
test di, 0x1336
cmp ch, cl
cmc
test dl, al
cmp dword [esi + eax + 8], 3
pushfd
mov byte [esp], al
lea esp, [esp + 4]
jne 0x680e0ed8
cmp cl, dl
push ebp
test ah, bl
mov dword [ebp - 0x28], 1
mov byte [esp], cl
mov byte [esp], 0xf8
cmp dword [ebp - 0x28], 0
push ebp
call fcn.680b761b
mov dword [esp + 0x20], ecx
push esp
mov byte [esp], dl
mov dword [esp + 0x20], 0x33001
push dword [esp + 0xc]
pushfd
pushfd
lea esp, [esp + 0x2c]
call fcn.68007290
neg dx
add esp, 8
xchg dh, ch
not cl
jmp 0x6808db05
jmp 0x68086a21
pushal
push dword [eax + esi + 8]
pop dword [esp + 0x1c]
call fcn.6809cc49
push edx
push edx
call fcn.680f62b9
jmp 0x680e306a
cwde
pushfd
cwde
mov eax, dword [ebp - 0x1c]
pushal
pushfd
jmp 0x680a9a02

Function at 0x680857db
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
jne 0x680e0ed8
stc
call fcn.680b2142

Function at 0x6808a413
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x4c]
call fcn.6802f5fa
cmc
aad 0x43
add esp, 0xc
test ax, 0xdb81
adc cl, ah
shr dl, cl
xchg al, cl
mov ecx, dword [ebp - 8]
sar dh, 3
test al, ch
mov byte [ecx], 0xe9
rdtsc
jmp 0x680e51b5
bsr eax, esi
mov edx, 0x68014810
bswap ax
sub edx, dword [ebp - 8]
sal ah, 1
sub edx, 5
movsx ax, dl
cwde
mov eax, dword [ebp - 8]
jmp 0x680d2c2e
Function at 0x6808be62
Capabilities:
Encode data using xor

Disassembly:
lea eax, [edi + 0xa6c7a69]
pushal
add edx, 0x14
pushfd
bswap eax
call fcn.680b7099
mov dword [ebp - 0x10], 0x246
mov byte [esp], al
mov dword [ebp - 0xc], 0x184
test byte [ecx], al
add byte [eax], al
call fcn.680a03d1
xor edi, dword [ebp + esi*2 + 0x61]
jbe 0x6808be18
adc eax, 0xf4243ad8
sbb al, 0xd2
mov cl, 0x99
inc ecx
xlatb
out 0xe8, al
push dword [ecx + 0x1f9a433]
cmpsb byte [esi], byte es:[edi]
mov ch, 0x85
xor eax, 0x2f0aad3e
test dword [0x2f0aad3e], esi
sbb dword [esi - 0x14578afe], ebx
pop ecx
push cs
stosd dword es:[edi], eax
jo 0x6808be6f
xor edx, esi
cld
loop 0x6808beb8
inc ebx
leave
int3
fldcw word [edx + 0x32fb572c]
push ecx
jle 0x6808bed9
pop ebx
rol ch, cl
inc edi
or al, 0xa5
jl 0x6808be95
add eax, 0xf600adde
pop ecx
mov dh, 0x99
insd dword es:[edi], dx
xor byte [ecx - 0x38], ch
sbb al, cl
test dword [ecx - 0x18], esp
rcr byte [ecx], 0xa8
popal
call 0x85b0d89f
sbb eax, 0xf7071491
pop ds
sbb eax, 0x714911d
neg dword [edi]
mov bl, 0xa7
in al, dx
dec esp
out dx, eax
in eax, dx
sub byte [edi], al
out 0x42, al
wait
cdq
jle 0x6808bede
in al, 0x83
push eax
test byte [0x8f6ba51e], cl
add esp, dword [ebx + 0xa]
and bh, ah
mov dword [0x4eca82bd], eax
int3

Function at 0x68090b8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x2c]
jne 0x680e0ed8
push edi
pushfd
cmp dword [esi + eax + 8], 3
push 0xc8af64de
pushfd
push ebp
lea esp, [esp + 0x14]
jno 0x68081a9f
jne 0x680e0ed8
stc
call fcn.680e0ecc
call fcn.680bca4b
call fcn.6809c20a
mov dh, 0xcc
int3
push ebp
pushal
jmp 0x680b98f3
mov eax, dword [ebp - 0x1c]
jmp 0x680606f1

Function at 0x68092417
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [ebp + eax*8 - 0x38]
push dword [esp]
mov eax, dword [ebp + eax*8 - 0x34]
pushfd
jmp 0x68090b2a
clc
jmp 0x680a662b
mov dword [ebp - 4], eax
lahf
push dword [esp + 4]
push ecx
mov ax, 0xfb74
lea eax, [ebp - 8]
jmp 0x680f4583
call fcn.680dbf2d
movzx ax, cl
pushal
pop eax
lea esp, [esp + 0x1c]
popal
pushal
lea esp, [esp + 0x20]
jmp 0x68083db6
mov dword [esp], 0x42cc7861
push dword [esp]
push dword [0x68055584]
pop dword [esp + 0x3c]
jmp 0x68092412
pushal
push edi
mov dword [esp + 0x3c], eax
jmp 0x68096872
Function at 0x68094c86
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x1c]
call fcn.6801fc30
bt bp, 0xa
jmp 0x680b2a21
test bl, 0xfa
cmp eax, 0xffffffff
call fcn.680d8df2
cmp eax, ecx
push 0x10a26cfc
mov word [esp], bx
lea esp, [esp + 0x48]
jb 0x680b9769
jmp 0x680e04e9
jmp 0x680b057e
push edi
invalid
push 0x7fda1a99
cmp eax, esi
mov byte [esp], bl
call fcn.680b5c29
rep insb byte es:[edi], dx
stosb byte es:[edi], al
sub bh, dl
pop edi
xchg ebx, eax
pop ds
scasb al, byte es:[edi]
or ch, byte [ecx + 0xa43d5fe]
cmp edi, esp
js 0x680b2a9c
jecxz 0x680b2a79
mov bl, 0xbb
call 0x77d1a155
inc eax
aas
xor dword [edx + 0x2a722bc2], ebx
inc esp
mov cl, 0xff
pop esi
dec eax
sub eax, 0x16c81375
xchg byte [eax - 0x20], bl
nop
dec esp
mov edx, 0x3cfb7955
dec ecx
add dword [0x150753b4], edx
invalid
lahf
mov al, 0x64
call 0x675dfa3
mov ch, 0x6a
sahf
push dword [ecx - 0x1f343a9a]
mov ah, 0x3e
sbb byte [ebx - 0x4ef04d69], ah
movsb byte es:[edi], byte [esi]
fistp dword [esi]
lodsb al, byte [esi]
jp 0x680b2a18
jge 0x680b2a7e
retf 0xac29
mov esp, 0xccaf42bf
dec esp
sti
movsb byte es:[edi], byte [esi]
loop 0x680b2b04
salc
mov bl, 0x8d
and al, 0x28
je 0x6809665f
jmp 0x680e0b3e
xchg edx, eax
ret 0xd1f6
stc
bt sp, 2
stc
cmp dword [edx], ebx
call fcn.6809a0ac
not cl
xchg ch, al
mov eax, dword [esi + 4]
setno cl
mov ecx, dword [esi]
movzx si, cl
not si
push eax
movsx ax, al
pushfd
movsx ax, al
xchg dword [esp], ecx
call fcn.680da15b
pushal
mov word [esp], cx
inc eax
mov byte [esp], dh
push esi
pushal
cmc
add edx, 0xc
bt cx, bp
jmp 0x680b2920

Function at 0x680965b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pushfd
mov dword [ebp - 0x18], 0x4f797265
pushfd
mov dword [ebp - 0x14], 0x63656a62
mov byte [esp + 8], 0x54
mov dword [esp], esi
mov byte [esp], 0x19
mov word [ebp - 0x10], 0x74
lea esp, [esp + 0x2c]
jg 0x680b9ba3
pushfd
push ebp
pushal
lea esp, [esp + 0x28]
call fcn.6801ff00
pushal
test eax, eax
push dword [esp]
push 0x87bf7ae7
mov byte [esp], al
lea esp, [esp + 0x28]
jne 0x680bb116
pushal
cmp ax, di
bt bp, 2
sub eax, eax
pushfd
lea esp, [esp + 0x24]
leave
pushal
push dword [esp + 0x20]
ret 0x24

Function at 0x680b6eb4
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x680a6f45
push esi
inc ebx
xchg byte [eax - 0x5c9022e7], dl
dec esi
mov ebx, 0xaeb0c2cf
loop 0x6809c0ed
sbb bl, bh
ja 0x6809c0c8
stc
dec esi
invalid
mov byte [esp], 0xeb
mov word [esp], di
pushfd
lea esp, [esp + 0x40]
call fcn.6802ad40
pushal
call fcn.68059a71
in eax, 0x38
jns 0x6809c0e5
sti
jmp ebp
pop eax
popal
dec ecx
mov ecx, 0x39bd6d21
jg 0x6809c0e9
fcom st(1)
js 0x6809c068
sbb al, 0x81
enter 0xffffffffffffaac4, 0xe
and dword [ebp + 0x4f6824f3], esp
and al, 0x68
dec edi
mov al, byte [ebx]
pop eax
das
add ebx, dword [eax + 0x2f]
ret 0x26cc
int3
mov byte [esp + 8], 0x15
pushal
mov dword [esp + 0x40], 5
push esi
mov dword [esp + 0x40], esi
mov byte [esp + 4], 0xc1
mov dword [esp], 0x80b756f
jmp 0x680ca6c7
push dword [ebp - 4]
pop dword [esp + 0x24]
jmp 0x68095f8d
mov byte [esp + 0x14], cl
mov dword [esp + 0x3c], 0xffffffff
jmp 0x6809c0b2
Function at 0x680ba5aa
Capabilities:
Encode data using xor

Disassembly:
push dword [0x68055584]
pop dword [esp + 0x48]
push ebp
add eax, 0x24448f68
dec eax
call fcn.680a3735
jne 0x68083b6a
lcall 0xc9d7, 0x23cf40ee
add byte [ecx], bh
mov eax, 0x85506993
adc al, 0x61
not byte [edx - 0x19]
mov edx, 0x278797fc
out 0xba, eax
cld
xchg edi, eax
xchg dword [edi], esp
push edi
dec ebx
sub eax, 0xf8ac3
cmp cl, bh
mov dh, 0x86
xchg esi, eax
jo 0x68083b8a
push ebp
xor al, ch
test byte [ebx], 0xa0
ror dword [edx - 0x45921890], 1
mov byte [esi + 0x2e6981f3], dl
jl 0x68083b9e
sub al, byte [ebx + ebp*8 - 0x70]
fild word [ebp + ebp + 0x4e]
out dx, eax
and dword [eax], ebp
pop eax
idiv byte [ecx]
popfd
sub al, 5
stosb byte es:[edi], al
xchg edi, eax
nop
xor dword [0xb541fc70], edi
aaa
in al, 0x1d
mov esp, 0x70d19789
aad 0x66
and dl, byte [esi]
dec ebp
xchg ebx, eax
and eax, 0x6f952635
out dx, eax
inc edx
out dx, eax
mov ch, byte [edx + 0x49c7ad2]
ja 0x68083c4d
mov al, byte [0xe89317e4]
jo 0x68083bef
mov cl, 0xa5
add al, 0x65
and dl, byte [esi - 0x547122f0]
or bh, byte [edi]
in eax, 0xf3
push ss
fidivr word [eax]
mov ebp, edi
in eax, dx
and eax, 0xbe7db69
xchg dword [edx + 0x3e0d1e90], esi
js 0x68083c83
call 0x9e332f53
cmp eax, dword [esi + 0x40]
pop esp
daa
sal dword [esp + ebp*4 + 0x45e13a2a], 1
sal dword [esi - 0x3b80937e], cl
loop 0x68083c47
lds edi, [ebx]
in eax, 0xe3
stosb byte es:[edi], al
jae 0x68083c8e
in al, dx
outsd dx, dword [esi]
lodsb al, byte [esi]
mov ecx, 0x1d788e79
add eax, 0xa4a20503
xlatb
mov dh, 0xc3
cmpsb byte [esi], byte es:[edi]
mov esi, 0x9831f838
sbb ebx, dword [edi - 0x23]
salc
xor dword [eax - 0x2922a0e5], ebx
cmp eax, dword [ecx + 0x745bfd96]
add dl, 0x4c
test eax, 0xca179b15
mov esp, eax
sbb eax, 0xe2f9445e
push ss
push 0xba6984ce
xchg esp, eax
dec ebp
push ecx
invalid
inc eax
adc ah, byte [0xce8015eb]
fcomp dword [ebx - 0x293c707e]
int1
inc esp
mov ebx, 0x4e98353e
clc
invalid
ret
mov dword [esp + 0x4c], eax
jmp 0x68083b67

Function at 0x680c39c7
Capabilities:
Packed with generic packer

Disassembly:
pushfd
push ebx
push dword [esi + eax]
pop dword [esp + 0x40]
push dword [esp + 4]
lea esp, [esp + 0x44]
jmp fcn.680a1fc6
jmp 0x680f4955
and al, 0x1c
add al, byte [eax]
add byte [eax], al
pushal
jmp 0x680a3ea9
mov word [0x68055330], ax
call fcn.6802a33d
sbb eax, 0xfa734636
pop edi
enter 0x4ab, 0xa
mov ebx, dword [eax - 0x11]
inc ecx
call 0x70079a11
loopne 0x680f4906
stosb byte es:[edi], al
insb byte es:[edi], dx
xchg esp, eax
fistp dword [ebx + eax*4 + 0xaa2715f]
add edx, dword [esp + eax*8 - 0x58dc44b5]
mov ebp, edx
not dword [edx + 0x3067c86e]
popal
outsb dx, byte [esi]
sub eax, 0x259ed41f
inc ebx
in al, dx
pop esp
cmpsd dword [esi], dword es:[edi]
push ebx
sub ah, bh
cmpsb byte [esi], byte es:[edi]
mov bh, byte [ebx + 0x34]
js 0x680f49a4
bound eax, qword fs:[ebp + 0x60e2f4ab]
bound eax, qword [ebp + 0x60e2f4ab]
dec ecx
retf
Function at 0x680ce420
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ax
ror ah, 7
clc
aaa
mov eax, dword [esi + 0x28]
cmc
cmp edi, eax
jmp 0x680b96d1
lea esp, [esp + 0x10]
je 0x680e6141
push 0x26a70173
push ebp
inc edi
cmc
test cl, 0x53
mov byte [esp], 0x7c
pushfd
add eax, 0xc
mov byte [esp + 4], ah
bt bx, 0xf
call fcn.680def9c
mov dword [esp + 0x3c], 0x5b7ccb31
pushfd
lea esp, [esp + 0x40]
jmp fcn.68010838
jae 0x680e30c1
lea edx, [ecx + 0x6ff385f6]
not dl
push edi
dec eax
adc dl, cl
sub dh, cl
bsf dx, bp
shl dl, cl
mov edx, edi
cmp dh, bh
jmp 0x680df492
pushfd
jmp 0x680b7f4f
pushal
cmp edi, eax
pushal
mov byte [esp + 8], 0xaa
lea esp, [esp + 0x44]
jae 0x680e30bb
daa
lea ecx, [edi + edi*2]
or ax, si
movzx ax, al
add ecx, ecx
mov ax, si
push esi
shld ax, bp, cl
cmp dh, 0xa6
add ecx, ecx
add esp, 4
bt eax, 0x1a
bt cx, dx
stc
test ebx, ebx
push esi
lea esp, [esp + 4]
je 0x68094210
setb al
lea eax, [esp - 0x435d6876]
push 0
lahf
pushal
movsx eax, dl
mov dword [esp + 0x1c], edx
cwde
pushfd
lea eax, [edx + ecx + 5]
mov byte [esp + 4], 0xdd
mov byte [esp + 8], dl
call fcn.68088fb1

Function at 0x680d0914
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [esp + 0xc], 0x81
mov word [ebp - 4], 0x6c
jmp 0x680d62ef
mov dword [esp], 0xb08255fc
mov dword [ebp - 0x1c], 0x7551775a
lea esp, [esp + 0x3c]
jnp 0x680dd025
mov dword [ebp - 0x18], 0x4f797265
push 0x177c0eea
push ecx
mov dword [ebp - 0x14], 0x63656a62
mov byte [esp], 0x5c
mov word [ebp - 0x10], 0x74
call fcn.680f0070
pushal
call fcn.680965b7

Function at 0x680db9fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
test bl, 0xed
cmp dword [esi + eax + 8], 3
push ebp
push 0x2b3a826a
mov dword [esp], eax
jmp 0x680f48d1
lea esp, [esp + 0xc]
jne 0x680e0ed8
jmp 0x680adab1
lea esp, [esp + 8]
jne 0x680e0ed8
push ebp
pushal
push dword [esp + 8]
clc
mov dword [ebp - 0x28], 1
mov dword [esp + 4], edi
cmc
cmp ebx, esp
cmp dword [ebp - 0x28], 0
push dword [esp]
push ebx
pushfd
lea esp, [esp + 0x34]
je 0x680e65d7
pushal
mov dword [esp + 0x1c], 2

Function at 0x680e0ecc
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
mov dword [ebp - 0x28], 1
lea esp, [esp + 4]