joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbc62c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0xbc62e0
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0xbc62fe
push 2
call fcn.00bd4331
pop ecx
mov esi, eax
test eax, eax
jne 0xbc62f5
xor eax, eax
jmp 0xbc644f
mov dword [esi + 4], 2
jmp 0xbc6303
mov edx, dword [ebp + 8]
mov esi, dword [edx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
add eax, ebx
mov dword [ebp - 4], eax
push 0xc7
push 0x5f8e8c
mov edx, dword [ebp + 0x10]
inc edx
push edx
call fcn.00b8502d
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xbc633a
mov eax, 0x41
jmp 0xbc641b
cmp dword [ebp + 0x10], 0
mov edx, dword [ebp - 8]
jne 0xbc634f
mov dword [esi + 4], 2
jmp 0xbc63eb
test byte [ebx], 0x80
je 0xbc63c4
mov dword [esi + 4], 0x102
xor ecx, ecx
mov cl, byte [ebx]
cmp ecx, 0xff
jne 0xbc6371
cmp dword [ebp + 0x10], 1
je 0xbc6371
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 1]
add ebx, ecx
add edx, ecx
jmp 0xbc6383
mov byte [edx], 0
dec edx
dec eax
dec ebx
cmp byte [ebx], 0
jne 0xbc638c
test eax, eax
jne 0xbc637d
test eax, eax
jne 0xbc63a5
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov byte [edi + eax], 0
inc dword [ebp + 0x10]
jmp 0xbc63eb
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
inc ecx
mov byte [edx], cl
dec edx
test eax, eax
jle 0xbc63eb
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
mov byte [edx], cl
dec edx
test eax, eax
jg 0xbc63b4
jmp 0xbc63eb
mov dword [esi + 4], 2
cmp byte [ebx], 0
jne 0xbc63da
cmp dword [ebp + 0x10], 1
je 0xbc63da
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
push eax
push ebx
mov edx, dword [ebp - 8]
push edx
call fcn.00cbbfb1
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0xbc63f9
push eax
call fcn.00b851ed
pop ecx
mov edx, dword [ebp - 8]
mov dword [esi + 8], edx
mov ecx, dword [ebp + 0x10]
mov dword [esi], ecx
cmp dword [ebp + 8], 0
je 0xbc640f
mov edi, dword [ebp + 8]
mov dword [edi], esi
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov eax, esi
jmp 0xbc644f
push 0x103
push 0x5f8ea2
push eax
push 0xc2
push 0xd
call fcn.00bbd2f1
add esp, 0x14
test esi, esi
je 0xbc644d
cmp dword [ebp + 8], 0
je 0xbc6446
mov edx, dword [ebp + 8]
cmp esi, dword [edx]
je 0xbc644d
push esi
call fcn.00bd4381
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0xbfec49
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x28]
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0x10]
mov ebx, edx
sar ebx, 1
jns 0xbfec67
adc ebx, 0
mov dword [ebp - 4], eax
lea eax, [ebx + eax]
mov dword [ebp - 8], eax
and edx, 1
add ebx, edx
push esi
mov edx, dword [ebp + 0x20]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
push edi
push ebx
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00bfea69
add esp, 0x1c
push esi
mov edx, dword [ebp + 0x24]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
push edi
push ebx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.00bfea69
add esp, 0x1c
xor ecx, ecx
mov eax, dword [ebp + 0x20]
mov edx, eax
mov eax, dword [ebp + 0x24]
cmp esi, ecx
jle 0xbfecc4
mov bl, byte [eax]
xor byte [edx], bl
inc ecx
inc edx
inc eax
cmp esi, ecx
jg 0xbfecb9
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0xc6be49
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0xc6be4f
ret
Function at 0xc8870d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x563c6d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00c45625
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x563c84
call fcn.00c45289
mov eax, ebx
call fcn.00c2d821
mov edi, eax
dec edi
test edi, edi
jl 0xc887c5
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00c2d7f5
mov edx, dword [0x52bfac]
call fcn.00c443e1
test al, al
je 0xc887c1
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00c2d7f5
lea edx, [ebp - 0x14]
call fcn.00c8ecbd
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00c45625
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00c452fd
inc esi
dec edi
jne 0xc88773
mov al, byte [0x563c88]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x563c94
mov eax, dword [ebp - 0xc]
call fcn.00c37e21
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00c4501d
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00c8ecbd
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x563c84
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f0]
call fcn.00c8ecbd
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x563c84
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x563c84
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x563ca0
call fcn.00c33e11
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x563c74
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00c44fa9
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00c44fa9
lea eax, [ebp - 0x14]
call fcn.00c44f85
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00c44fa9
ret
Function at 0xcccf85
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0xcccfb3
mov eax, ebx
call fcn.00ccda3d
cmp dword [ebx + 0x3c], 0
je 0xcccfac
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0xccd024
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0xccd016
cmp dword [ebx + 8], 0
je 0xcccfd5
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0xcccfe7
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0xccd016
cmp dword [ebx + 8], 0
je 0xcccfc8
cmp eax, 3
je 0xcccffa
dec eax
jne 0xcccfc8
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0xcccfc8
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0xcccfc8
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0xccd042
cmp dword [ebx + 0x10], 0xcc
je 0xccd042
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00ccd04d
pop ebx
ret
Function at 0xf73f5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt eax, edi
jne 0xf73f66
mov al, ch
jmp 0xf73f68
mov word [esp], ax
mov byte [esp], dh
add bl, dl
jmp 0xf73f45
mov al, ch
inc ebp
jmp 0xf73f6f
mov dx, di
lea eax, [ebx - 0x8f]
mov edx, 0x8090e20b
lea edx, [ecx + esi]
mov edx, dword [esp]
jmp 0xf73fa6
bts dx, dx
jae 0xf73f90
pushfd
xchg byte [esp], dh
lea eax, [ecx*4]
btr dx, bx
rdtsc
jmp 0xf73fc3

Function at 0xf76f56
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0f64888
jmp 0xf76fa9
push dword [esp + 3]
jno 0xf76f40
jo 0xf76fd3
call 0xf77013
pushfd
jmp 0xf76e8a
mov ecx, 0xb1149c77
bswap eax
xchg ch, bh
shl bh, 2
jmp 0xf76ffd
push dword [esp + 3]
jmp 0xf76f9e
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp]
sub esp, 0x1b
jg 0xf77052
jle 0xf77057
xor esi, dword [ebp + 0x3bf4c25]
and al, 0x57
mov esi, 0x124648d
lea esp, [esp + 1]
xchg dword [esp + 0x18], ebx
call fcn.00f76fc4
je 0xf76fd9
jne 0xf76fd9
add edx, 0x6ad79243
jmp 0xf78cfe
add edx, 0x35e40907
jmp 0xf78d4a
call 0xf770e9
xchg word [esp + 0xb], dx
lea esp, [esp + 3]
jmp 0xf770b1
pushfd
lea eax, [ecx + edx]
adc al, 0xa8
jmp 0xf78d43
xchg byte [esp], al
mov edx, dword [edx - 0x69e020ab]
xchg ah, al
jmp 0xf78d2d
clc
jae 0xf78d60
sbb al, dh
jmp 0xf77022
jae 0xf78d0b
xchg byte [esp], al
jmp 0xf78d0e
not ax
bswap eax
jmp 0xf78d67
sbb al, dh
jmp 0xf77022
dec eax
ja 0xf78dc7
setne al
jmp 0xf78dca
neg ax
jp 0xf78db0
jnp 0xf78db0
setne al
mov esp, esi
jmp 0xf78d6f

Function at 0xf814b1
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0xf68034
pushfd
or dword [esp], 0x100
popfd
cpuid
nop
jmp 0xf6804b
pop ebx
ret
jmp 0xf81502
jmp 0xf68028

Function at 0xf99a9d
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x28]
setne cl
call fcn.00f99a09
inc esp
and al, 1
jmp 0xf99a1f
call fcn.00f9a0c0
loopne 0xf99b10
loop 0xf99a2b
je 0xf99a5a
idiv byte [ecx - 0x17]
mov byte [ebx - 0x39], bh
fdivr dword [ebx]
adc cl, byte [ebp + 0x24648d1c]
add al, 0x5b
add byte [eax], al
xchg ecx, eax
add al, 0x9a
std
or al, 0xbf
sub dword [ecx + 0x6b34021], esi
xor byte [ebx], dh
Function at 0xf99c9d
Capabilities:
Encode data using base64

Disassembly:
push si
jmp 0xf98e6a
cmp al, 0x2f
jmp 0xf9909b
call int.00f98e54
mov dl, 0x20
inc edi
mov dl, 0x76
sub al, 0xb7
daa
inc edx
mov cl, 0xc
sub al, byte [ebp - 0xc]
out 0xe, eax
enter 0xffffffffffffe96b, 0x79
push cs
add byte [eax], al
adc cl, byte [edi + 0x26897a1f]
mov eax, 0x20d1b620
xchg edi, eax
invalid
and eax, ebp
cmp byte [edx], cl
add byte [eax], al
inc ebx
rol dword [ebx + 0x26], cl
aad 0x11
fist dword [edx + ecx*8 - 0x53]
pop esp
jmp 0xf9869b
call fcn.00f992d1
fstp qword [esi - 0x34]
stosd dword es:[edi], eax
fldcw word [0xb54623b3]
jb 0xf986d3
and dword [eax - 0x5d], esp
fiadd dword [ebx - 0x4e16fc01]
cmp edi, 3
jmp 0xf9915a
lock not dword fs:[bp + si - 0x279f]
push cs
cwde
push cs
imul ebx, dword [eax + 0x5de8755a], 0xe700000a
outsd dx, dword [esi]
call [edx - 0x7ff04a97]
push ss
jno 0xf98647
aaa
mov ebp, 0x91661f8c
xchg edx, eax
sbb byte [esi - 0xa57e717], cl
cmc
in al, 0x17
jmp 0xf990c4
mov word [esp], ax
lea esp, [esp + 2]
pop eax
jmp fcn.00f9852d
jne 0xf98543
call fcn.00f98e88
ja 0xf9868b
movzx edx, dl
call fcn.00f990e8
pushal
invalid
pushfd
push dword [esp + 2]
lea esp, [esp + 8]
cmp dl, 0x39
jmp 0xf990a6
push 0x3e
jmp 0xf98501
jmp 0xf9a357
cmp bl, 0x2f
jne 0xf99c9b
je 0xf9a3b1
popal
call 0x5ae1b5a8
mov dword [0xcf0ffc95], eax
xor al, 0x27
dec esi
jmp 0xf9a3de
leave
test al, 0x5b
out dx, al
mov edx, 0x7cba4f28
sbb esi, dword [edx + 0x6d]
jl 0xf99c98
movzx edx, bl
call 0xf99c9d
pushal
clc
call fcn.00f9a3e6
fst dword [edx + ecx*8 - 0x53]
pop esp
loop 0xf99cb3
rcl dword [ecx + 0x30], 0xc3
jle 0xf99c3a
inc edi
xlatb
mov dl, 0x41
invalid
xor eax, 0xafeb3d82
lea esp, [esp + 4]
cmp bl, 0x39
ja 0xf99cd0
jmp 0xf99c4c
jbe 0xf99c54
sbb cl, byte [esi + 0x24967b1c]
mov byte [ebx], ah
mov bl, 0xd6
and eax, 0x9011e690
nop
out 0x11, al
nop
adc ecx, dword [edx - 0x16a863db]
loopne 0xf99cc5
pushfd
push edi
jmp 0xf9a3a1
add byte [eax], al
dec esp
salc
inc esp
and ebx, esi
imul ebx, esi, 0x4dbedb4b
cli
outsb dx, byte [esi]
jns 0xf99d28
fisubr word [ecx - 0x22]
dec ebx
fstp xword [esi + 0x796efa4d]
pop eax
jmp 0xf9a42e
or eax, dword [eax + 0x2de939f9]
pop es
add byte [eax], al
mov esp, 0x20d1b620
in al, 0xc2
pop ebp
int 0x94
salc
sub al, 0x3f
pop esi
jmp 0xf99cba
lea esp, [esp + 8]
cmp bl, 0x2b
jne 0xf99c19
push ebx
jmp 0xf9a38b
push ebx
jmp 0xf9a3fc
sub esi, 0x47
jmp 0xf99cba
lea esp, [esp + 4]
push 0x3f
jmp 0xf99c49
cmp bl, 0x5a
call fcn.00f99cd5
leave
arpl bx, si
xchg esi, eax
sal dword gs:[ecx], 1
movsb byte es:[edi], byte [esi]
cmp bl, byte [ebp - 0x54]
pop ds
push ecx
rcl byte [ebx - 0x36]
lea esp, gs:[esp + 2]
cmp al, 0x2b
jne 0xf98517
jmp 0xf9976c
Function at 0x100efb6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [esp]
push dword [esp + 4]
mov dword [esp + 3], edi
pop ax
jmp 0x100efd4
setg dl
bts ax, di
mov dl, 0x32
setl dh
or ecx, edx
push word [esp + 1]
jmp 0x100ef3b
mov ecx, dword [esp + 3]
rdtsc
xchg byte [esp + 1], cl
mov cx, word [esp]
lea esi, [0xa98248d8]
not bl
jmp 0x100eea3
and esi, 0xdc60f53a
mov cx, 0x4525
push word [esp + 2]
jmp 0x100ef19
clc
clc
mov cl, al
mov si, word [esp]
cpuid
pop word [esp + 1]
jmp 0x100eedc
mov ax, cx
mov dh, byte [esp]
stc
pushfd
cmc
pop word [esp]
jmp 0x100ef9a
xchg dword [esp], esi
xchg ebx, esi
xchg word [esp], si
lea esp, [esp + 5]
std
xchg si, ax
jmp 0x100ef03
xchg edi, ebp
mov bh, ch
lea ecx, [edi - 0xb6]
lea ecx, [ecx*4]
mov cl, 0xd3
mov ebp, 0x251bef92
jmp 0x100eef2
ror bx, 6
cpuid
sub esp, 0xf
call fcn.0100ef6b
mov ecx, dword [esp + 0xa]
mov eax, dword [esp + 5]
call 0x100efb6
bound ebx, qword [ebx + 0x66]
mov ecx, 0x748871fa
and al, 1
pushfd
jmp 0x100efe9
bsf ebx, ebp
mov cx, bp
cpuid
pop dword [esp]
mov eax, edx
lea ecx, [ebx + 0x24]
jmp 0x100eec4
std
neg bx
push word [esp + 0xb]
xchg dword [esp + 7], eax
not ax
stc
jmp 0x100fd32
mov edx, 0x433bef30
lea edi, [eax + ebx]
pushal
xchg bl, dh
mov ch, bh
jmp 0x100f06b
push dword [esp + 4]
bsf edx, esi
xchg ecx, eax
lea esp, [esp]
mov cl, byte [esp + 3]
mov edx, dword [esp + 3]
jmp 0x100f000
pop word [esp + 5]
mov si, word [esp]
cld
mov dl, byte [esp + 5]
cmp edi, 0x8181607c
xchg ch, al
jmp 0x100f016
mov esi, ebp
neg bx
lea esp, [esp + 0x12]
pop ebp
mov byte [esp + 6], bh
jmp 0x100f10c
lea eax, [esi - 0xcecf]
mov ch, 0xda
xchg bh, bl
push dword [esp + 0x1e]
mov ebp, 0xb18f5683
mov byte [esp + 0x2c], ah
jmp 0x100f055
mov bx, word [esp + 0x13]
xchg word [esp + 0x17], bx
lea esp, [esp + 0x1d]
call fcn.0100f0ac
das
and dword ss:[edi], ecx
mov byte [0x5d665366], al
cpuid
push bx
pop bp
mov dword [esp + 0x18], esp
bsf si, di
mov ebx, esp
jmp 0x100f084
push si
lea ebx, [edi - 0x28]
xchg dword [esp + 0xa], edx
mov esi, 0xb6f25e98
rdtsc
btc edx, eax
jmp 0x100f09a
xchg word [esp + 0x17], cx
xchg dh, cl
mov edx, dword [esp + 0x10]
push dx
bts si, ax
mov ah, byte [esp + 0x10]
jmp 0x100f0c9
add esp, 3
xchg word [esp + 5], dx
btr ebp, ebx
setb cl
std
xchg dx, di
jmp 0x100f03d
mov al, 0x44
push dword [esp + 3]
mov byte [esp + 5], dh
mov ecx, dword [esp + 2]
bt ecx, ebx
bsr bp, di
jmp 0x100f197
mov edx, 0x4f45545d
rcr ecx, cl
mov ah, 0xd5
xchg dword [esp + 4], ecx
setp al
rdtsc
jmp 0x100f22e
lea esp, [esp + 0xe]
xchg edi, ecx
setge dl
bsr eax, ebx
xchg bh, ah
push dword [esp + 3]
jmp 0x100f864
push word [esp + 3]
adc ah, 0x23
mov al, dl
push bp
xchg dword [esp + 3], edi
pop word [esp + 0x10]
jmp 0x100f92c
Function at 0x100f5ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 0x10]
sub esp, 0xe
mov dword [esp + 0x20], ebp
pop eax
push edi
pop ecx
jmp 0x100f28b
xchg byte [esp + 0xd], ch
cpuid
xchg dword [esp + 7], eax
mov ax, cx
btr ecx, ebp
bt edx, esi
jmp 0x100f248
mov edx, 0xc0c21d9c
lea esi, [edx - 0x3213]
clc
mov dword [esp + 0x17], esi
jmp 0x100f2d7
xchg byte [esp + 0x1b], cl
bsf edx, esp
rcl ch, 5
pop dx
bswap esi
push word [esp + 0xa]
jmp 0x100f273
cld
mov al, 0x8e
sub esi, 0xd1c34eae
mov eax, edx
pop ebx
jmp 0x100f2fb
clc
push bx
mov dh, bh
cpuid
bsr bp, bx
mov byte [esp + 0xa], cl
jmp 0x100f2a0
pop dword [esp + 0x13]
xchg bl, al
pop ebp
mov ah, 0x85
std
and ch, dl
jmp 0x100f2b6
mov bh, byte [esp + 4]
pop word [esp + 8]
sete bl
seto ch
pop ebp
jmp 0x100f311
lea edx, [ebx*4]
mov dword [esp + 0x12], esi
mov al, 0xe0
pop dword [esp + 4]
std
rdtsc
jmp 0x100f2e5
bsf esi, ecx
mov ebx, esp
xchg dh, ch
xchg dl, ah
pop ecx
mov dl, al
jmp 0x100f323
xchg word [esp + 3], dx
bsf ebp, esi
mov ch, byte [esp + 1]
lea ebp, [esi*4]
jmp 0x100f36c
lea ebx, [eax*4]
xchg esi, ebp
mov si, 0xc73c
mov edi, edx
pop dword [esp + 0xc]
xchg ecx, eax
jmp 0x100f25e
mov byte [esp + 1], al
bt dx, sp
mov ah, 0xc
pop dword [esp]
not bh
jmp 0x100f392
cmc
lea edx, [edx + esi]
clc
rdtsc
mov dx, 0x5b1b
bts ecx, ecx
jmp 0x100f356
not cl
add esp, 0
xchg byte [esp], al
mov bx, word [esp + 1]
mov cl, ch
jmp 0x100f3cf
setb bl
dec ecx
mov cl, byte [esp + 4]
mov al, 0xb
bsr eax, eax
lea ebx, [eax*4]
jmp 0x100f37c
sub esp, 0x1f
bswap eax
lea ebx, [ecx + edi]
mov esi, dword [esp + 6]
add esp, 2
cpuid
jmp 0x100f33c
cpuid
bsr cx, bx
setp ah
xchg bh, al
sub esp, 0x19
push dword [esp + 0x10]
jmp 0x100f4f8
not cx
cmc
mov ebx, dword [esp]
rcl edi, 0x10
not esi
sub cl, 0x3f
jmp 0x100f3b9
pop si
add esp, 0xd
inc ecx
mov ebx, 0x6aedb10
jmp 0x100f44d
lea ebp, [ecx + esi]
mov dh, byte [esp + 0x13]
push dword [esp + 0x10]
pop word [esp + 0x11]
add esp, 0xf
bswap esi
jmp 0x100f406
bsr edx, eax
rdtsc
lea ecx, [edi + 0xfc]
neg ebx
btr di, si
inc dl
jmp 0x100f476
lea edx, [esi + 0x61f5e97c]
push sp
mov bx, 0xebaf
cmc
inc eax
not di
jmp 0x100f433
mov edi, edx
lea ebx, [eax*4]
stc
lea eax, [esi - 0x4d65206]
jmp 0x100f485
xchg ah, ch
cld
rdtsc
cmc
ror ax, cl
mov ax, 0x331c
jmp 0x100f460
mov cx, 0xcd46
xchg ch, ah
mov eax, dword [esp]
lea esp, [esp + 1]
and al, 1
call fcn.0100f4d6
pop esp
enter 0x395e, 0xffffffffffffffc8
jl 0x100f490
cmc
pushfd
outsd dx, dword [esi]
les edx, [edi + eax*4]
cmp dword cs:[eax], ebx
xchg byte [esp + 0xd], ch
xchg word [esp + 0x10], si
popal
bswap ebp
mov dword [esp + 7], ebx
mov di, dx
jmp 0x100f41c
push dword [esp + 8]
sub esp, 0x17
not bx
inc bl
mov dx, bp
mov dword [esp + 6], ebp
jmp 0x100f4a8
dec cl
pop ebp
neg ah
mov ecx, 0x21d1110e
jmp 0x100f3f5

Function at 0x101196e
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
Function at 0x10004100
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10096018]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, edi
call fcn.10003880
test byte [0x1009a17c], 1
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [0x1009a17e]
je 0x10004142
test al, al
jne 0x10004142
mov word [0x1009a17c], 0x100
jmp 0x1000414b
cmp byte [0x1009a17d], 0
je 0x10004198
cmp dword [edi + 0x34], 0
jne 0x10004157
cmp dword [edi + 0x30], 0
je 0x10004198
lea eax, [ebp - 8]
mov byte [0x1009a17e], 1
push eax
push 0x40
push 1
push 0x410660
call esi
push 0
mov byte [0x410660], 0xc3
push dword [ebp - 8]
push 1
push 0x410660
call esi
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [0xcc18c84]
mov dword [0x1009a178], eax
mov al, byte [0x1009a17e]
test al, al
je 0x1000420c
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, eax
sub edx, dword [0xcc18c84]
cmp byte [0x8f15f0], 1
jne 0x100041c4
mov ecx, dword [0x1009a3fc]
cmp byte [ecx + 0x44], 0
mov ecx, 1
jne 0x100041c9
mov ecx, 0x64
mov eax, dword [0x1009a178]
add eax, ecx
cmp eax, edx
jae 0x1000420c
lea eax, [ebp - 8]
mov dword [0x1009a178], edx
push eax
push 0x40
push 1
push 0x410660
mov byte [0x1009a17e], 0
call esi
push 0
mov byte [0x410660], 0x83
push dword [ebp - 8]
push 1
push 0x410660
call esi
mov byte [0x1009a17d], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1007a095
mov esp, ebp
pop ebp
ret
Function at 0x100067e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007bc45
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10096018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.cod4x_021.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x1000683e
push str.cod4x_not_21.1_detected_n
push 7
call fcn.10007ca0
mov dword [0x1009a39c], 0x57bb20
mov dword [0x1009a3a0], 0x42f7f0
jmp 0x100069f4
push str.cod4x_21.1_detected_n
push 7
call fcn.10007ca0
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x29
push str.55_89_E5_53_81_EC_84_00_00_00_C7_04_24_02
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.100076c0
mov dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0xd
push str.cod4x_021.dll
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.100076c0
mov byte [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
call fcn.10059360
mov ecx, dword [0x10099cc4]
sub esp, 0x18
mov dword [0x1009a39c], eax
mov dword [ebp - 0x1c], esp
lea eax, [ecx + 0x443dde0]
mov dword [0x1009603c], eax
lea eax, [ecx + 0x227a28]
mov dword [0x10096038], eax
lea eax, [ecx + 0x2116c]
mov ecx, esp
mov dword [0x10099d14], eax
push 0x3b
push str.55_89_E5_83_EC_18_B8_38_E3_74_00_D9_80_9C_F3_04_00_D9_5D_F4
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.100076c0
mov dword [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0xd
push str.cod4x_021.dll
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.100076c0
mov byte [ebp - 4], 3
mov dword [ebp - 4], 0xffffffff
call fcn.10059360
cmp dword [0x1009a39c], 0
mov dword [0x1009a3a0], eax
je 0x100069e8
test eax, eax
je 0x100069e8
mov esi, dword [0x10099cc4]
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, 0x43580
push eax
push 0x40
push 1
push esi
call edi
push 0
push dword [ebp - 0x14]
mov byte [esi], 0xc3
push 1
push esi
call edi
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x452bfa
call edi
mov eax, dword [0x1008297c]
mov ecx, 0x452bfa
push 0
mov dword [ecx], eax
movzx eax, byte [0x10082980]
mov byte [ecx + 4], al
push dword [ebp - 0x14]
push 5
push ecx
call edi
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x434200
call edi
mov eax, dword [0x10082984]
mov ecx, 0x434200
push 0
mov dword [ecx], eax
movzx eax, byte [0x10082988]
mov byte [ecx + 4], al
push dword [ebp - 0x14]
push 5
push ecx
call edi
jmp 0x100069f7
push str.Failed_to_find_necessary_cod4x_21.1_addresses__Notify_the_developer_about_this__n
push 3
call fcn.10013fe0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007a095
mov esp, ebp
pop ebp
ret