joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10225c92
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], al
pushal
lea esp, [esp + 0x30]
jne 0x10223298
cmp bl, al
bt edx, 1
sub edi, edi
bt cx, 0xa
test dh, bl
jmp 0x1022ad1d
clc
cmp dword [esp + 0x20], esi
push 0xab7e7544
pushal
lea esp, [esp + 0x24]
jbe fcn.1022381e
call fcn.1022fad6

Function at 0x10225f9d
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
call fcn.10070f00
cmc
pushfd
add esp, 0x1c
pushfd
push 0xef7887b4
lea esp, [esp + 8]
jmp fcn.10238704

Function at 0x102263be
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1022f9bf
mov byte [esp + 4], 0xa2
mov dword [esp + 4], 0xab71a56d
mov byte [esp + 0x10], bh
mov word [esp + 0x7a4], 0x56
mov byte [esp], dl
mov byte [esp], bh
mov byte [esp + 8], dh
mov word [esp + 0x7a6], 0x69
mov byte [esp], bh
call fcn.10225ce6

Function at 0x10226855
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0x7b6], bx
call fcn.102173ea

Function at 0x10226906
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
pushfd
lea esp, [esp + 0x34]
call fcn.10003b22
pushfd
jmp 0x1022a0e3
jmp loc.10219648

Function at 0x10226a21
Capabilities:
Packed with generic packer

Disassembly:
pushal
add esp, 0x3c
pushfd
mov byte [esp], dh
pushfd
lea esp, [esp + 8]
jmp fcn.10238704

Function at 0x10226a3c
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0x8e8], 0x4d
lea esp, [esp + 0x88]
jae 0x10223fbe
pushal
mov word [esp + 0x882], di
call fcn.10230f9f

Function at 0x1022758f
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0x986], 0x75
call fcn.1021efea

Function at 0x102275b2
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x1022a8ff
pushal
lea esp, [esp + 0x2c]
jbe fcn.1022381e
pushfd
push esi
push 0x7dfd5791
push dword [esp + edi*4 + 0x94]
pop dword [esp + 8]
pushfd
push ecx
mov dword [esp + 0xc], 8
mov word [esp], cx
lea esp, [esp + 0xc]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
pushfd
stc
test cl, cl
jmp 0x10239943
cmp eax, ebx
mov byte [esp], 0x2b
pushfd
pushfd
push 0xf5b094c1
mov dword [esp + 0x28], eax
pushal
push dword [esp]
mov word [esp], 0x2703
mov dword [esp + 0x44], esi
push 0x5c6a231d
lea esp, [esp + 0x38]
je 0x1021e157
pushfd
jmp 0x10218451

Function at 0x10227618
Capabilities:
Packed with generic packer

Disassembly:
push 0xad6c6bb1
call fcn.10230caa
lea esp, [esp + 0x54]
jnp 0x1022a6af
mov word [esp + 0x93e], 0x6c
jmp loc.10219b3a
pushfd
mov word [esp], sp
pushfd
mov word [esp + 0x946], 0x6c
jmp 0x10226474

Function at 0x10227687
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0x894], 0x54
mov byte [esp + 8], ch
mov word [esp + 0x896], ax
mov byte [esp + 8], dl
call fcn.1022edbb
lea esp, [esp + 0x20]
je 0x1022c56e
mov ax, 0x7e9d
mov al, dl
pushfd
jmp 0x10233c5c
mov dword [esp], edi
cwde
cwde
lea eax, [esp + 0xa0]
pushfd
call fcn.102176aa

Function at 0x10228ed4
Capabilities:
Packed with generic packer

Disassembly:
push edx
mov word [esp], 0x699a
mov dword [esp + 0xc], eax
push dword [esp]
push dword [esp + 0x30]
pop dword [esp + 0xc]
call fcn.1021aef4
Function at 0x1022905d
Capabilities:
Enumerate processes
Packed with generic packer

Disassembly:
mov word [esp], sp
mov word [esp + 0x78e], bx
mov byte [esp], 0x6e
mov byte [esp], ch
mov byte [esp], 0x80
mov word [esp], 0x3cd8
lea esp, [esp + 0x54]
jmp loc.1005bb80

Function at 0x102290ed
Capabilities:
Enumerate processes
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], 0x23
mov word [esp], 0xe1d8
lea esp, [esp + 0x54]
jl 0x1022b242
mov word [esp + 0x8fa], 0x73
pushal
call fcn.10229838
call fcn.10219fee
pushal
push esi
mov word [esp + 0x91e], 0x73
pushal
pushfd
call fcn.1005c383

Function at 0x10229524
Capabilities:
Packed with generic packer

Disassembly:
pushfd
push ebp
push edx
mov dword [esp + ecx*4 + 0x94], eax
setne al
push 0xdba9987d
not al
mov dword [esp + 0x24], esi
push edx
mov eax, dword [esp + 0x28]
call fcn.1022c124
test cl, 0x66
bt sp, di
stc
pushal
test eax, eax
mov dword [esp + 4], 0x46167e74
lea esp, [esp + 0x20]
jmp 0x10228bee
lea esp, [esp + 0x28]
je 0x1021e157
movsx cx, al
mov ch, dh
pushfd
lea ecx, [esp + 0x2d0]
call fcn.10219236
lea esp, [esp + 8]
jge 0x1021b42c
push 0xc48fc5f8
push dword [esp]
mov dword [esp + ecx*4 + 0x90], eax
pushal
movsx eax, dl
movsx ax, cl
mov dword [esp + 0x3c], esi
pushfd
not al
not ah
mov eax, dword [esp + 0x40]
mov word [esp + 4], di
jmp 0x10235162
jmp 0x1023688b
mov dword [esp + 4], 0xdd49dd47
push dword [esp + eax*4 + 0x80]
pop dword [esp + 0x28]
call fcn.1021ee8a
not al
pushfd
mov byte [esp], dh
cwde
lea eax, [esp + 0x38]
mov byte [esp], 0x31
mov word [esp], 0x3efe
mov word [esp], ax
pushal
mov dword [esp + 0x20], eax
pushal
jmp 0x1022f6f9

Function at 0x10229e2c
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0x82c], 0x69
mov byte [esp], ah
mov word [esp + 0x82e], ax
mov byte [esp], dh
mov word [esp + 0x830], 0x77
call fcn.10230d40

Function at 0x10229ea5
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 4], eax
push dword [esp]
mov byte [esp + 4], 0xd6
push dword [esp + 0x34]
pop dword [esp + 4]
jmp loc.1021ca11

Function at 0x1022a067
Capabilities:
Enumerate processes
Packed with generic packer

Disassembly:
mov byte [esp], cl
test eax, eax
mov byte [esp], bh
push 0xc0e42cb1
jmp fcn.102195f3

Function at 0x1022ab12
Capabilities:
Packed with generic packer

Disassembly:
cmc
jmp 0x10232790
jmp loc.1021c361
cmc
cmp dword [esp + 0x2c], esi
jmp 0x1022cef3

Function at 0x1022af7c
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x50]
call fcn.10070f00
pushal
pushal
jmp 0x102386fd
bt cx, ax
add esp, 0x58

Function at 0x1022b86b
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [esp + 0xba8]
pushal
pushfd
mov dword [esp + 0x24], eax
mov byte [esp + 4], dh
push 0xa900f4b9
lea esp, [esp + 0x28]
call fcn.1006e24b
sal cx, cl
sub ch, 0xd2
test eax, eax
not cl
pop ecx
push 0x17147984
lea esp, [esp + 4]
jbe 0x102172ed
jmp 0x1023930b
lea eax, [edx*8 + 0x2c80434]
call fcn.10234a2d
call fcn.10225736
Function at 0x1022b980
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x54]
call fcn.10070f00
pushal
mov dword [esp + 0x1c], 0x103
movzx ax, cl
movsx eax, dl
pushfd
bswap ax
lea eax, [esp + 0x9cc]
pushfd
lea esp, [esp + 0x24]
jl 0x1022aedf
push 0x4b871cd8
mov dword [esp], edi
push 0x3cfd1530
mov word [esp], bp
jmp 0x10229c2e

Function at 0x1022be00
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1022d1bc
call fcn.1021e2b0
lea eax, [esp + 0x978]
call fcn.102175b8
push ebp
mov byte [esp], 0xf9
mov word [esp + 0x8a0], bx
push esi
mov word [esp], 0x89fe
mov word [esp + 0x8a6], ax
call fcn.1022ae48

Function at 0x1022be3c
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0x9e4], cx
mov word [esp + 0x10], 0x8055
mov word [esp], 0x9b46
call fcn.10219c6e

Function at 0x1022be56
Capabilities:
Packed with generic packer

Disassembly:
mov edi, 0x22c
push 0x770f859
mov word [esp + 8], 0x9746
pushal
lea esp, [esp + 0x2c]
je 0x1022c56e
test ebx, 0x5a98b353
push 0x11f6cb70
cmp eax, esi
pushfd
push ebp
lea esp, [esp + 0xc]
je 0x1022c56e
call fcn.1021eea4

Function at 0x1022c136
Capabilities:
Enumerate processes
Packed with generic packer

Disassembly:
mov word [esp + 0x76e], bx
mov dword [esp + 4], 0x94e8156f
push edi
mov byte [esp], 0x12
push dword [esp]
lea esp, [esp + 0x3c]
jmp loc.1005bb80

Function at 0x1022c668
Capabilities:
Enumerate processes
Packed with generic packer

Disassembly:
push 0xa06bcda0
pushfd
pushfd
lea esp, [esp + 0x3c]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
pushfd
or ebx, 0xffffffff
ror di, cl
btr di, 3
jmp loc.1021a146
push dword [esp]
mov dword [esp + 0x30], 2
jmp 0x10226554

Function at 0x1022d140
Capabilities:
Enumerate processes
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x10]
jb 0x1022ee4a
setns ah
movzx ax, cl
pushfd
lea eax, [esp + 0xa0]
pushal
mov dword [esp + 0x20], eax
jmp 0x10219fa2
pushal
mov eax, dword [esp + 0x34]
movzx cx, cl
pushal
movzx cx, bl
push dword [esp + eax*4 + 0x78]
pop dword [esp + 0x3c]
pop ecx
jmp 0x1005c3b0

Function at 0x1022e715
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x10234c98
mov byte [esp], ah
lea esp, [esp + 0x2c]
je 0x102172ed
setnp ah
lea eax, [esp + 0xba4]
pushfd
pushal
pushfd
pushfd
mov dword [esp + 0x28], eax
mov word [esp + 0x10], 0x4ddd
pushfd
pushfd
lea esp, [esp + 0x30]
call fcn.1006e24b
call fcn.10230210

Function at 0x1022ec47
Capabilities:
Packed with generic packer

Disassembly:
call fcn.102291a6
push edi
mov al, ch
lea eax, [esp + 0xa0]
pushal
pushal
mov byte [esp + 4], 0x67
mov dword [esp + 0x3c], esi
jmp 0x10229cf6
pushfd
lea esp, [esp + 0x2c]
je 0x1022c56e
movzx ax, bl
bswap ax
lea eax, [ecx + 0x4bd20a87]
jmp 0x10229de8

Function at 0x1022ecd4
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0x89c], 0x6e
pushfd
pushfd
mov word [esp + 0x8a6], 0x36
call fcn.10236a4b

Function at 0x1022edbb
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x80]
jg 0x10236c74
jmp loc.1021b6b4
jmp fcn.10233503
Function at 0x1022ef34
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0x868], dx
push 0xb8751dbb
pushal
push dword [esp + 8]
lea esp, [esp + 0x40]
jmp fcn.1023166f
lea esp, [esp + 0x24]
je 0x102172ed
call fcn.102397a6
pushfd
push 0x612817fc
mov word [esp + 0x866], ax
jmp 0x1022c8ef

Function at 0x1022f1d4
Capabilities:
Packed with generic packer

Disassembly:
push 0xdbffe41d
push dword [esp]
mov dword [esp + 0xf4], edi
mov byte [esp + 4], 0xc6
jmp 0x10234b0f
lea esp, [esp + 0x50]
call sub.KERNEL32.dll_Process32FirstW
pushal
mov byte [esp], al
mov word [esp], si
lea esp, [esp + 0x20]
jmp fcn.1022c55a

Function at 0x1022f35a
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 4], 0xebc3
mov word [esp + 0x9d0], 0x57
call fcn.1022e909
jmp 0x102295e3

Function at 0x1022f748
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp], 0x75f5
mov dword [esp + 0x2c], eax
pushfd
jmp loc.1021a7f6

Function at 0x10230210
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
mov cx, 0xca05
mov ecx, dword [esp + 4]
mov word [esp], ax
lea esp, [esp + 8]
jbe 0x102172ed
movsx ax, al
mov cx, di
lea eax, [esp + 0x7efaa357]
mov dword [esp + 0x14], esi
mov al, ch
pushfd
bswap ax
mov eax, dword [esp + 0x18]
jmp fcn.10217fdd

Function at 0x10230249
Capabilities:
Packed with generic packer

Disassembly:
push eax
push esi
push 0xf9175242
pushfd
mov dword [esp + 8], esi
push dword [esp]
mov dword [esp + 8], edi
call fcn.10226f67
lea esp, [esp + 0x28]
je 0x102172ed
setb ah
movzx ax, al
push 0x104
push esi
pop eax
cwde
lea eax, [esp + 0xdb8]
jmp 0x10226058
pushal
jmp 0x10229781

Function at 0x10230caa
Capabilities:
Enumerate processes
Packed with generic packer

Disassembly:
mov word [esp + 0x950], 0x79
pushfd
mov word [esp + 0x956], 0x73
pushfd
pushfd
mov word [esp + 0x960], 0x69
pushal
mov byte [esp], ah
mov word [esp + 0x982], 0x6e
push 0x55b1a15b
jmp 0x10239819

Function at 0x10230d40
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], 0xf7
mov byte [esp], 0xb
mov word [esp + 0x836], ax
mov byte [esp], ch
call fcn.1021eb69
jmp 0x10225a23

Function at 0x10230f7a
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x10229c37
push 0x9124ac36
mov byte [esp + 4], 0xce
mov dword [esp + 0x8c], eax
lea eax, [ebp + 0x3364b003]
not al
lea eax, [esp + 0x8b0]
jmp 0x102295f9

Function at 0x10231b90
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [ebx - 0x52884c92]
lea eax, [esp + 0x7ec]
mov word [esp], di
lea esp, [esp + 0x60]
jmp 0x1023808e
push dword [esp + 4]
lea esp, [esp + 0x50]
call fcn.10070f00
stc
pushal
mov byte [esp + 0xc], 0xa
add esp, 0x38
test dh, 0x70
cmp dword [esp + 0xa4], esi
call fcn.10231e31
mov byte [esp], 0xaf
mov dword [esp + 0xc], 0x41d26ca5
mov dword [esp + 0xb8], eax
jmp 0x10229c75

Function at 0x10231e31
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
je 0x102172ed
clc
test dl, 0x78
cmp dword [esp + 0xa4], 4
push 0xbd8c8882
jmp loc.102198eb
Function at 0x102326a4
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x1023435d
mov word [esp], di
mov byte [esp + 0x14], 0x3d
mov word [esp + 0x950], 0x53
call fcn.10236d8e

Function at 0x102326f9
Capabilities:
Packed with generic packer

Disassembly:
movsx di, bl
mov di, word [esp]
lea edi, [esp + 0x14]
call fcn.10224bf0

Function at 0x10232748
Capabilities:
Enumerate processes
Packed with generic packer

Disassembly:
mov word [esp + 0x7b2], dx
call fcn.1021a994

Function at 0x10232755
Capabilities:
Enumerate processes
Packed with generic packer

Disassembly:
mov byte [esp], ch
pushal
call fcn.10232a88

Function at 0x10232dcb
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], ah
mov byte [esp + 4], cl
mov word [esp + 0x9b0], si
jmp 0x10228593

Function at 0x10232f7c
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 8], 0xac
mov dword [esp + 0xf4], edi
mov byte [esp], 0x84
jmp 0x102257e8

Function at 0x10233204
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x10235eba
call fcn.10217794

Function at 0x10233380
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], bl
mov word [esp + 0xdf4], si
mov word [esp], 0xe0d4
lea esp, [esp + 0x28]
call fcn.10070f00
test cx, bp
bt cx, cx
pushal
add esp, 0x38
push 0x34c3a332
cmp dword [esp + 0xa8], esi
push eax
push 0x78df1879
push dword [esp + 8]
lea esp, [esp + 0x10]
je 0x102172ed
test dh, 0x21
pushal
cmc
cmc
cmp dword [esp + 0xc4], 4
pushal
call fcn.10237e9f
jmp 0x1022a1dc

Function at 0x10233484
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushfd
lea esp, [esp + 0x14]
je 0x102172ed
lahf
call fcn.1022b86b

Function at 0x10233749
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0x73a], 0x73
jmp loc.1021b9f7
mov word [esp + 0x732], 0x63
pushfd
mov byte [esp], 0x1c
mov byte [esp], 0x63
mov word [esp + 0x738], ax
jmp 0x1022803a

Function at 0x10233f5a
Capabilities:
Enumerate processes
Packed with generic packer

Disassembly:
mov eax, dword [esp + 0xa8]
pushfd
pushfd
inc dword [esp + 0x2c]
pushfd
pushfd
mov dword [esp + ecx*4 + 0x9c], eax
lea esp, [esp + 0x14]

Function at 0x102345bf
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 4], 0x1f
mov byte [esp + 8], al
mov word [esp + 0x900], 0x34
jmp fcn.10218f2b
jmp 0x1022616a

Function at 0x102349af
Capabilities:
Packed with generic packer

Disassembly:
pushfd
push 0xe21c424f
lea esp, [esp + 0x2c]
call sub.KERNEL32.dll_Process32FirstW
push esp
push 0x4c819d74
pushfd
pushal
lea esp, [esp + 0x2c]
jmp fcn.1022c55a

Function at 0x10234ade
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
je 0x1022c56e
setb ah
bswap ax
push edi
lea eax, [edi - 0x2aa03a53]
lahf
mov ax, si
lea eax, [esp + 0xa0]
push 0xb557bcf3
jmp loc.1021c5e7
Function at 0x10234ea7
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov byte [esp], dl
mov dword [esp + 0xd0], edi
pushfd
pushfd
push esp
mov byte [esp], ch
lea esp, [esp + 0x38]
call sub.KERNEL32.dll_Process32FirstW
bt cx, 0xf
push ecx
jmp 0x102378be
pushal
lea esp, [esp + 0x20]
je 0x10219751
movsx eax, dl
not ah
lea eax, [esp + 0xc0]
pushfd
mov dword [esp], eax
call fcn.1021d5cf
call fcn.10238e8a
mov word [esp + 0x10], 0xf27e
mov dword [esp + 0xe0], eax
movzx ax, dl
lea eax, [ebp + 0x47fcd56b]
lea eax, [esp + 0x824]
mov byte [esp], 0x63
call fcn.1021e127
pushfd
mov byte [esp], cl
mov word [esp + 0x8b0], 0x34
pushfd
call fcn.1021c7e8
lea eax, [esp + 0x9d4]
push dword [esp]
call fcn.1021d9e0
mov byte [esp], dl
mov word [esp + 0x962], 0x61
call fcn.1022ab18
cmp eax, esi
push esp
lea esp, [esp + 8]
jp 0x10235297
pushfd
pushfd
lea esp, [esp + 8]
je 0x10219751
pushfd
lea eax, [ebx - 0x60d4bf95]
push 0x19fd2b0d
lea eax, [esp + 0xc8]
mov byte [esp + 4], ch
call fcn.1023a263

Function at 0x1023564f
Capabilities:
Enumerate processes
Packed with generic packer

Disassembly:
mov word [esp + 0x900], 0x45
pushfd
lea esp, [esp + 0x38]
jmp 0x10231090

Function at 0x10235e97
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushfd
lea esp, [esp + 0x50]
jb 0x10226494
jmp fcn.10224a29

Function at 0x1023653b
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1005beba
push esi
mov dword [esp + 4], ebx
mov word [esp + 0x9a6], cx
pushfd
call fcn.10232dcb
pushfd
pushfd
stosd dword es:[edi], eax
mov byte [esp + 4], 0x5d
push dword [esp + 4]
mov byte [esp + 0xc], al
pushfd
lea esp, [esp + 0x30]
jmp 0x10228d95
jmp 0x1023575e

Function at 0x10236663
Capabilities:
Enumerate processes
Packed with generic packer

Disassembly:
push dword [esp + 0x30]
pop dword [esp + 0xc]
mov byte [esp + 8], 0xc2
push ebp
mov byte [esp + 8], 0xbf
push dword [esp]
lea esp, [esp + 0x14]
jmp fcn.1021972f

Function at 0x10237e17
Capabilities:
Enumerate processes

Disassembly:
lea esp, [esp + 8]
jne 0x1021a166
cwde
lea eax, [esp + 0x9c]
pushal
mov dword [esp + 0x1c], eax
pushfd
push dword [esp + 0x4c]
pop dword [esp + 0x1c]
push 0x3592536d
call fcn.102263fa

Function at 0x10237e9f
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x44]
je 0x102172ed
call fcn.102282e6

Function at 0x10237f89
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushfd
call fcn.102369b4
jmp loc.1021ef1d
mov word [esp + 8], di
lea esp, [esp + 0x20]
je 0x1021e157
movsx cx, dl
lea ecx, [esp + 0x2cc]
push eax
mov dword [esp], ecx
jmp 0x10231375
Function at 0x1023844d
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1022f6d6
pushfd
mov byte [esp], bl
call fcn.1021a07f
mov dword [esp + 8], eax
push edx
pushfd
push dword [esp + 0x3c]
pop dword [esp + 0xc]
pushal
jmp 0x1022c981
jmp 0x1022d44b
push 0x2609b8ae
mov dword [esp + 0xd4], edi
lea esp, [esp + 0x30]
js 0x1022f801
pushfd
push dword [esp]
mov byte [esp], 0x70
lea esp, [esp + 8]
call sub.KERNEL32.dll_Process32FirstW
pushfd
pushal
pushal
lea esp, [esp + 0x44]
jmp fcn.1022c55a
jmp loc.1021be47
mov word [esp + 0x7b8], 0x43
mov byte [esp], cl
lea esp, [esp + 0x70]
jl 0x10227fe7
pushal
mov word [esp + 0x76a], 0x20
mov dword [esp], 0x6044bd8d
mov byte [esp + 4], ch
mov word [esp + 0x76c], 0x56
lea esp, [esp + 0x20]
jno 0x1021bd67
mov word [esp + 0x74e], 0x69
call fcn.10217808

Function at 0x102384e7
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x2c]
je 0x1022c56e
pushal
jmp loc.1005c475

Function at 0x1023904c
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x10224188
mov byte [esp], bh
mov dword [esp + 0xf4], eax
setl ah
cwde
movsx ax, bl
lea eax, [esp + 0x954]
jmp 0x10236c42
cwde
lea eax, [esp + 0x7a0]
jmp 0x1022357f
lea eax, [esp + 0x908]
call fcn.10229171
mov word [esp + 0x89c], 0x6e
lea esp, [esp + 0x5c]
je 0x1022a9a1
push esi
mov word [esp + 0x846], 0x74
call fcn.10237c01
jmp 0x1022d007
mov dword [esp + 0xa8], eax
jmp 0x1022638e
mov word [esp + 0x842], 0x74
pushfd
jmp 0x102190fd
jmp 0x1022b956
mov dword [esp + 0xf0], eax
bswap ax
movsx ax, cl
jmp 0x102243e5

Function at 0x10239ddc
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
je 0x102172ed
call fcn.10230b11

Function at 0x1023a1ff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp + 0x7c8], 0x45
push edx
call fcn.1022da89

Function at 0x1023a20f
Capabilities:
Encode data using xor
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x48]
jne 0x10233f74
bt di, ax
clc
cmp dword [esp + 0x20], 5
call fcn.1022453f

Function at 0x1023a228
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 8], eax
jmp fcn.1021b695
Function at 0x10043130
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100432c1
pushal
mov esi, section.UPX1
lea edi, [esi - 0x30000]
push edi
or ebp, 0xffffffff
jmp 0x1004315a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10043161
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10043150
mov eax, 1
add ebx, ebx
jne 0x10043173
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10043168
jne 0x10043184
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10043168
xor ecx, ecx
sub eax, 3
jb 0x10043198
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1004320a
mov ebp, eax
add ebx, ebx
jne 0x100431a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x100431b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x100431d4
inc ecx
add ebx, ebx
jne 0x100431c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100431b5
jne 0x100431d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100431b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100431f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100431e5
jmp 0x10043156
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100431f4
add edi, ecx
jmp 0x10043156
pop esi
mov edi, esi
mov ecx, 0xb58
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10043212
cmp byte [edi], 1
jne 0x10043212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x10043217
lea edi, [esi + 0x3f000]
mov eax, dword [edi]
or eax, eax
je 0x1004328f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x43974]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x43a14]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10043244
mov ecx, edi
jns 0x10043273
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x43a18]
or eax, eax
je 0x10043289
mov dword [ebx], eax
add ebx, 4
jmp 0x10043261
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100432c0
cmp al, 0xef
ja 0x100432b3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10043295
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100432a2
popal
jmp 0x1000cdd7
Function at 0x433000
Capabilities:
Check for software breakpoints
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x1c1c0797
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x5e8c1ce0
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219