joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b2c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428dd8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4300b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 4], 1
mov byte [ebp - 0x40], 0x58
mov byte [ebp - 0x3f], 0x42
mov byte [ebp - 0x3e], 0x37
mov byte [ebp - 0x3d], 0x37
mov byte [ebp - 0x1c], 0x4c
mov byte [ebp - 0x1b], 0x32
mov byte [ebp - 0x1a], 0x4a
mov byte [ebp - 0x19], 0x4d
mov byte [ebp - 0x18], 0x4e
mov byte [ebp - 0x17], 0x43
mov byte [ebp - 0x16], 0x52
mov byte [ebp - 0x15], 0x55
mov byte [ebp - 0x3c], 0x42
mov byte [ebp - 0x3b], 0x34
mov byte [ebp - 0x3a], 0x5f
mov byte [ebp - 0x39], 0x39
mov byte [ebp - 0x38], 0x41
mov byte [ebp - 0x37], 0x39
mov byte [ebp - 0x36], 0x59
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x56
mov byte [ebp - 0x48], 0x34
mov byte [ebp - 0x47], 0x46
mov byte [ebp - 0x46], 0x4f
mov byte [ebp - 0x45], 0x59
mov byte [ebp - 0x44], 0x36
mov byte [ebp - 0x43], 0x31
mov byte [ebp - 0x42], 0x55
mov byte [ebp - 0x30], 0x55
mov byte [ebp - 0x2f], 0x47
mov byte [ebp - 0x2e], 0x54
mov byte [ebp - 0x2d], 0x33
mov byte [ebp - 0x2c], 0x45
mov byte [ebp - 0x2b], 0x35
mov byte [ebp - 0x2a], 0x53
mov byte [ebp - 0x29], 0x43
mov byte [ebp - 0x28], 0x50
mov byte [ebp - 0x27], 0x34
mov byte [ebp - 0x26], 0x44
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x5a
mov byte [ebp - 0x23], 0x48
mov byte [ebp - 0x22], 0x4f
mov byte [ebp - 0x21], 0x39
mov byte [ebp - 0x20], 0x36
mov byte [ebp - 0x14], 0x32
mov byte [ebp - 0x13], 0x50
mov byte [ebp - 0x12], 0x33
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x3c]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
lea edx, [ebp + 0xc]
push edx
call fcn.00401b10
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x40]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x50], esp
lea eax, [ebp + 0x30]
push eax
call fcn.00401b10
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x54]
call fcn.00409190
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401b50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x30]
call fcn.00401b50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fefb
mov esp, ebp
pop ebp
ret 0x44

Function at 0x40fefb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4300b4]
jne 0x40ff05
repz ret
jmp fcn.0041140c
Function at 0x41e70d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00411ccd
and dword [ebp - 4], 0
cmp dword [0x4317dc], 0
mov ebx, eax
jne 0x41e7be
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41e86f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41e86f
push eax
call fcn.00411c5b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4317dc], eax
call esi
push eax
call fcn.00411c5b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4317e0], eax
call esi
push eax
call fcn.00411c5b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4317e4], eax
call esi
push eax
call fcn.00411c5b
pop ecx
mov dword [0x4317ec], eax
test eax, eax
je 0x41e7be
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00411c5b
pop ecx
mov dword [0x4317e8], eax
mov eax, dword [0x4317e8]
cmp eax, ebx
je 0x41e816
cmp dword [0x4317ec], ebx
je 0x41e816
push eax
call fcn.00411cd6
push dword [0x4317ec]
mov esi, eax
call fcn.00411cd6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41e816
test edi, edi
je 0x41e816
call esi
test eax, eax
je 0x41e80d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41e80d
test byte [ebp - 0xc], 1
jne 0x41e816
or dword [ebp + 0x10], 0x200000
jmp 0x41e84f
mov eax, dword [0x4317e0]
cmp eax, ebx
je 0x41e84f
push eax
call fcn.00411cd6
pop ecx
test eax, eax
je 0x41e84f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41e84f
mov eax, dword [0x4317e4]
cmp eax, ebx
je 0x41e84f
push eax
call fcn.00411cd6
pop ecx
test eax, eax
je 0x41e84f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4317dc]
call fcn.00411cd6
pop ecx
test eax, eax
je 0x41e86f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41e871
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5bb0dbf
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3ee06d84
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x406dcf
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x864
push ebp
mov ebp, dword [esp + 0x880]
mov eax, ecx
mov dword [esp + 4], eax
cmp ebp, 0x18
ja 0x406fad
push ebx
push esi
xor ebx, ebx
lea esi, [eax + 0xf4]
push edi
mov edi, ebx
push dword [esp + 0x87c]
mov ecx, esi
call fcn.00410551
test al, al
je 0x406e2d
lea eax, [esi + 0x10]
cmp dword [eax + 0x30], ebp
jne 0x406e2d
push 0x10
push dword [esp + 0x888]
push eax
call fcn.004215b2
add esp, 0xc
test eax, eax
je 0x406fb7
inc edi
add esi, 0x84
cmp edi, 4
jb 0x406df9
mov esi, 0x800
lea eax, [esp + 0x74]
push esi
push eax
push dword [esp + 0x888]
call fcn.00413150
xor eax, eax
mov ecx, ebp
inc eax
shl eax, cl
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x20]
push eax
push 0x10
push dword [esp + 0x898]
lea eax, [esp + 0x8c]
push eax
call fcn.004271c0
pop ecx
push eax
lea eax, [esp + 0x90]
push eax
call fcn.0040727f
push esi
lea eax, [esp + 0x78]
push eax
call fcn.00410775
mov edx, dword [esp + 0x10]
push dword [esp + 0x87c]
mov ecx, dword [edx + 0x304]
lea edi, [edx + 0xf4]
mov eax, ecx
and eax, 3
imul eax, eax, 0x84
add edi, eax
lea eax, [ecx + 1]
mov dword [edx + 0x304], eax
mov ecx, edi
mov dword [edi + 0x40], ebp
call fcn.00406960
push 0x10
push dword [esp + 0x888]
lea eax, [edi + 0x10]
push eax
call fcn.00422c30
push 0x20
pop ebp
push ebp
lea eax, [esp + 0x24]
push eax
lea esi, [edi + 0x20]
push esi
call fcn.00422c30
push ebp
lea eax, [esp + 0x50]
push eax
lea eax, [edi + 0x44]
push eax
call fcn.00422c30
push ebp
lea eax, [esp + 0x7c]
push eax
lea eax, [edi + 0x64]
push eax
call fcn.00422c30
add esp, 0x30
push ebx
push 1
push ebp
push esi
call fcn.00410686
cmp dword [esp + 0x890], ebx
je 0x406f3b
push ebp
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x898]
call fcn.00422c30
add esp, 0xc
mov esi, dword [esp + 0x894]
test esi, esi
je 0x406f6e
push 8
push ebx
push esi
call fcn.00421020
add esp, 0xc
mov al, byte [esp + ebx + 0x34]
mov ecx, ebx
and ecx, 7
xor byte [ecx + esi], al
inc ebx
cmp ebx, ebp
jb 0x406f52
push ebp
lea eax, [esp + 0x38]
push eax
call fcn.00410775
cmp dword [esp + 0x888], 0
pop edi
pop esi
pop ebx
je 0x406fa2
push dword [esp + 0x87c]
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push 0x100
push eax
push dword [esp + 0x878]
add ecx, 0x30c
call fcn.0040fba0
push ebp
lea eax, [esp + 0xc]
push eax
call fcn.00410775
pop ebp
add esp, 0x864
ret 0x20
push 0x20
pop ebp
push ebp
lea eax, [esi + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00422c30
add esp, 0xc
lea eax, [esp + 0x14]
push ebx
push ebx
push ebp
push eax
call fcn.00410686
push ebp
lea eax, [esi + 0x44]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00422c30
push ebp
lea eax, [esi + 0x64]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00422c30
add esp, 0x18
jmp 0x406f1d
Function at 0x40de35
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
inc eax
mov cl, bl
cmp esi, eax
jbe 0x40de52
xor cl, byte [eax + edx]
inc eax
cmp eax, esi
jb 0x40de4a
cmp cl, byte [edx]
jne 0x40de8d
push esi
push edx
push 0xffffffffffffffff
call fcn.00406773
not eax
mov ecx, ebx
cmp dword [ecx + 0x440044], eax
jne 0x40de73
cmp dword [ecx + 0x440040], esi
je 0x40de7e
add ecx, 0xc
inc ebx
cmp ecx, 0x48
jb 0x40de63
jmp 0x40de8d
imul eax, ebx, 0xc
mov ecx, dword [eax + 0x440048]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
pop esi
pop ebx
ret 0xc

Function at 0x40f5f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [edi - 0x3a]
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0040edb8
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040ed6d
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040edb8
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040ed6d
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0040edb8
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040ed6d
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.0040eda8
add al, 0xdf
mov ebp, 0xfacca580
invalid
Function at 0x40f8c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.0040edb8
pop ecx
push eax
push dword [ebp + 0x18]
sbb bh, bh
jne 0x40f93f
cmp dword [ebp - 0x398], 0
je 0x40fc66
cmp dword [ebp + 0xc], 1
je 0x40fc66
cmp dword [ebp + 0xc], 8
jne 0x40fc2e
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.0040edb8
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040ed6d
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
invalid
jmp [edx - 1]
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.0040eda8
pop edx
fmulp st(4)
iretd
call fcn.0040eda8
in al, dx
in al, 0xcb
rol dword [eax - 0x5435b], 0xff
add byte [edx], ch
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.0040eda8
pop ecx
div dword [esi]
adc al, byte [eax - 0x22f5b]
inc dword [eax]
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
Function at 0x40f927
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb bh, bh
jne 0x40f93f
call fcn.0040ed6d
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
add byte [eax - 0x5225b], al
inc dword [eax]
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.0040edb8
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
invalid
sal bl, 0xff

Function at 0x40f9ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [ebx - 0x7a76f33c]
cld
invalid
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5173297d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..rdata
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5884660c
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x45fdec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x45fde8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x45fde8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc
Function at 0x10099f47
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pop dword [esp + 5]
lea esp, [esp + 2]
mov dword [esp + 0x20], esp
call fcn.10099f0b
push dword [esp + 7]
jnp 0x10099f62
mov byte [esp + 5], al
mov byte [esp + 9], ah
jmp 0x10099f81
mov byte [esp + 5], al
jmp 0x10099f97
mov byte [esp + 9], ah
push dword [esp + 8]
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]

Function at 0x1009a2c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 8], eax
call 0x1009a1de
sub esp, 0x13
btr edx, edx
lea esp, [esp + 0xb]
xchg dword [esp + 3], eax
rdtsc
jmp 0x1009a1f9
Function at 0x1009aaae
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
lea edx, [eax*4]
jmp 0x1009b71a
rdtsc
rcl dx, cl
lea eax, [0x504f7fe8]
jmp 0x1009ab31
bts eax, eax
sub bl, 0xcf
rdtsc
mov ax, cx
jmp 0x1009ab6d
jmp 0x1009ab20
jmp 0x1009ab8c
mov edx, 0xd3d687c4
jmp 0x10099ed5
mov eax, ebx
mov dh, 0x59
stc
jns 0x1009ab4c
js 0x1009ab4c
shl eax, 2
lea edx, [edi*4]
inc dl
jnp 0x1009ab4e
mov edx, 0xd3d687c4
jmp 0x10099ed5
shr ah, 0
jmp 0x1009adb8
shr ah, 0
lea esp, [esp + 4]
sub bl, 0x91
neg ah
jo 0x1009ab4a
rdtsc
rcl dx, cl
lea eax, [0x504f7fe8]
bts eax, eax
jmp 0x1009ab34
rol dx, cl
js 0x1009af91
clc
xchg dx, ax
mov ax, word [esp]
xchg dx, ax
jmp 0x1009afc3
movzx ebx, byte [edi]
jmp 0x1009af76
clc
xchg dx, ax
jmp 0x1009af9a
mov ax, word [esp]
xchg dx, ax
mov eax, edi
rol eax, 0x17
mov ah, 0x40
not al
clc
ja 0x1009afc7
mov eax, dword [esp]
jmp 0x1009b010
mov eax, edi
jmp 0x1009afa3
jmp 0x1009b00d
mov eax, 0x330b5f7b
jmp 0x1009aff7
mov eax, 0x330b5f7b
rcr dl, 0
jmp 0x1009b02c
rcr dl, 0
jmp 0x1009b02c
mov eax, dword [esp]
sub bl, cl
je 0x1009afc9
jne 0x1009afd5
inc ax
not al
bts ax, bx
mov eax, 0xaaf4b0c3
jmp 0x1009b0c7
mov dl, bl
mov ax, 0x3f69
clc
jge 0x1009b016
jl 0x1009b03f
sbb al, 0x98
push cs
imul ebx, dword [eax + 0x6664752a], 0x66d0f640
bts eax, ebx
inc ax
not al
bts ax, bx
jmp 0x1009b409
jmp 0x1009b0a7
not eax
mov ax, 0xc4cc
pushal
rol dl, 0
jno 0x1009b07b
jo 0x1009b1d5
sub al, byte [ebp - 0xc]
out 0xb8, eax
dec esi
cmp eax, 0x1b46869
mov eax, 0x68693d4e
mov ah, 1
mov eax, edi
mov ah, bl
mov eax, 0x3c5a05e2
mov ax, 0x6d4
mov eax, dword [esp]
jmp 0x1009b15f
mov ax, 0xcb23
mov eax, dword [esp]
ror dl, 0
mov ax, cx
jmp 0x1009b091
lea eax, [edx*4]
jmp 0x1009b180
lea esp, [esp + 0x20]
xor dl, 0xd1
mov ah, 0xbc
call fcn.1009b1b9
invalid
mov eax, 0x68693d4e
mov ah, 1
mov eax, edi
call fcn.1009b0d6
bswap eax
pop word [esp]
lea eax, [edx + esi]
mov ax, word [esp]
mov ax, word [esp]
jmp 0x1009b215
lea esp, [esp + 0xc]
dec dl
mov ax, di
jmp 0x1009b21d
push word [esp]
jl 0x1009b1ff
jge 0x1009b1ff
lea eax, [ebp + 0xd6e1]
mov ax, word [esp]
setnp ah
call fcn.1009b327
or dword [ecx + 0x778b7819], ecx
test eax, 0x2adfb82a
ret 0x8bcb
invalid
mov eax, 0xaaf4b0c3
mov ax, 0xcb23
jmp 0x1009b0cb
pop ecx
lea edi, [ebp - 0xa6]
mov edi, dword [esp]
lea esp, [esp + 4]
jmp 0x1009b746
rol bl, 0
xchg dx, ax
mov ax, word [esp]
inc eax
jbe 0x1009adb5
ja 0x1009abb4
xchg al, dl
rdtsc
mov edx, dword [esp]
bsf ax, sp
jmp 0x1009b92c
pop esi
popfd
jmp 0x1009af8c
mov edx, dword [esp]
xor bl, 0xb9
lea edx, [ebp*4]
call 0x1009b8f3
and al, 0xa0
push ecx
mov al, byte [0x4ddd5a12]
adc al, 0xe7
push esi
movsb byte es:[edi], byte [esi]
mov esp, 0xbfb136db
mov ecx, edx
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x1009b703
jl 0x1009b74d
mov edx, dword [esp]
jmp 0x1009b750
Function at 0x100a0954
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x100a09f7
lea ebp, [esp + 4]
lea ecx, [ebx*4]
xchg ebx, ecx
mov eax, 0x1ac14281
bt eax, edi
jno 0x100a09c2
jo 0x100a09ac
mov ebp, 0x45b6d343
mov cl, 0x85
add al, 0x9a
std
or al, 0xf3
xor eax, 0xb34021b1
push esp
xor bl, ch
rol byte [ecx + 0xbcec], cl
add bl, ch
mov bh, 0x27
inc edx
mov cl, 0xe
sub al, 0xa8
pop ecx
test al, 0x1a
inc ebp
hlt
jmp 0x100a097e
sub esp, 0xbc
jmp 0x100a09da
jmp 0x100a09ac
mov ecx, 0x9a9ba35b
jmp 0x100a0a21
mov edi, esp
neg eax
je 0x100a09c4
mov ecx, 0x9a9ba35b
neg ax
setns bl
jmp 0x100a0a27
mov esi, dword [esp + 0x30]
sets ah
mov ebp, dword [esp]
adc ecx, 0x1333057d
jp 0x100a09aa
jnp 0x100a09aa
mov bx, 0xf59
add ah, dl
jbe 0x100a0a42
dec ah
jmp 0x100a0a2c
neg ax
setns bl
mov ecx, esi
pushfd
jmp 0x100a0a0b
xchg dx, ax
xchg ebx, eax
lea edx, [esi*4]
call fcn.100a0e83
test byte [edi], dh
push ds
imul ecx, dword [eax + 0x66ccfe2b], 0x8dc38792
adc al, 0xb5
add byte [eax], al
add byte [eax], al
dec ah
xchg dx, ax
xchg ebx, eax
lea edx, [esi*4]
not ax
xor edx, 0x9b300dfb
jmp 0x100a0ec4
inc esi
xchg dh, bl
mov dl, byte [esp]
inc ebx
jne 0x100a0efa
neg ax
mov ax, word [esp]
jmp 0x100a0f37
neg ax
mov ax, word [esp]
not bx
call 0x100a0efc
cmpsd dword es:[esi], dword es:[edi]
aaa
push edx
mov eax, dword [0xe8eb5a1e]
bswap eax
stc
mov eax, ebp
xchg dword [esp], eax
pushal
jmp 0x100a0f4d
jmp 0x100a0ee4
add esi, 0x5c8debeb
lea ebx, [ebx - 0x29]
lea eax, [0xdecbe167]
jmp 0x100a1061
not bx
jmp 0x100a0f12
xchg dx, bx
lea ebx, [esi - 0x22cc3c48]
mov bx, 0x743
mov byte [esp + 0x1d], dh
lea eax, [eax + 0x1f]
lea ebx, [ecx + edi]
jmp 0x100a11a4
sub esp, 0x12
jmp 0x100a1023
jmp 0x100a0fcc
lea edx, [eax*4]
xchg ebx, eax
rdtsc
call 0x100a0fed
sbb byte [edi + 0x58996a0f], bl
jb 0x100a1007
jl 0x100a0feb
ror bl, cl
mov bx, dx
cmc
jmp 0x100a0f78
mov dx, 0x6409
and ax, cx
bswap ebx
jmp 0x100a0f82
xchg dword [esp], eax
btc edx, esp
mov bh, 0x18
call fcn.100a1049
pop edx
fdiv qword [edx + 0x15]
in al, 1
test eax, 0x48d6bc8
enter 0xffffffffffff8d6b, 4
lea eax, [eax]
add byte [eax], al
add byte [esi - 0x75], ah
sbb al, 0x24
lea eax, [edi*4]
rdtsc
shl dl, 6
jmp 0x100a0fd7
add byte [esi + 0x3bb100f1], dl
mov ebp, 0x77c7342d
or al, 0x9f
out 0x11, al
nop
bsr ebx, esi
ror bl, cl
mov bx, dx
cmc
sub esp, 0x12
lea esp, [esp + 2]
rol esi, 0
ror edx, cl
je 0x100a0f80
mov dx, 0x6409
and ax, cx
bswap ebx
lea edx, [eax*4]
xchg ebx, eax
jmp 0x100a0f8b
mov ebx, eax
neg dx
js 0x100a1017
bsr ebx, esi
jmp 0x100a0f9c
not edx
mov bx, 0x28c7
push dword [esp + 0x20]
ret 0x24
mov dh, bl
bswap edx
lea edx, [ebp*4]
xchg dword [esp + 0x20], eax
bt bx, si
bt bx, si
jmp 0x100a108d

Function at 0x100aecac
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x1008f13d
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x1008f157
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x1008f146
pop esi
jmp 0x1008f162
ret 4
jmp 0x1008f130

Function at 0x100dd3da
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
jmp 0x100dd3ff
and dword [eax + 4], 0
call fcn.100dd452
Function at 0x100dd408
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 8]
and dword [eax], 0
mov dword [eax + 8], 0x67452301
jmp 0x100dd43c
mov dword [eax + 0xc], 0xefcdab89
push ebx
mov word [esp + 1], bp
jmp 0x100dd457
lea esp, [esp + 4]
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret