joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d3ec3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100d3f0d
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x100d3eb4
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100d3ec3
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x104d9b66
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100d3f14
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.100bad8a
cmp eax, dword [ebp + 0xc]
pop eax
je 0x100d3fb3
add edi, 4
add eax, 2
dec ecx
jne 0x100d3ef9
call 0x100d3f60
loope 0x100d3f56
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100d3fb0
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100d3fc1
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100d3f74
cmp eax, ecx
ja 0x100d3f74
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100d3ffe
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100d3ff4
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.100bb269
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x403000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00403aac
test esi, esi
jne 0x403038
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403bb0
jmp 0x403056
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402ee4
mov edi, eax
test esi, esi
je 0x403056
cmp dword [ebx], 0
je 0x403056
dec esi
jmp 0x40303f
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x403850
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x408034], 0
je 0x4038b1
cmp word [0x408310], 0xd7b2
jne 0x403879
cmp dword [0x408318], 0
jbe 0x403879
mov eax, 0x40830c
call dword [0x408328]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4038dc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x407018], 0
jne 0x4038cd
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403f28
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x4060c4
Capabilities:
Check mutex on windows
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x4045c8
call fcn.004044dc
xor eax, eax
push ebp
push 0x4061d6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4061e4
push 0xffffffffffffffff
push 0x100000
call sub.kernel32.dll_OpenMutexW
mov ebx, eax
test ebx, ebx
jbe 0x40613c
push 0
push 0x406200
call sub.user32.dll_FindWindowW
test eax, eax
je 0x40613c
push 0
push 0
push 0x10
push eax
call sub.user32.dll_SendMessageW
push 0x7530
push ebx
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0xffffffff
je 0x4061bb
cmp eax, 0x102
je 0x4061bb
push 0x3e8
call sub.kernel32.dll_Sleep_1
call fcn.00402fa0
cmp eax, 2
jle 0x406193
lea edx, [ebp - 0x14]
mov eax, 2
call fcn.00403000
mov eax, dword [ebp - 0x14]
mov edx, 0x406220
call fcn.00403ca0
jne 0x406193
push 1
push 0
push 0
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.00403000
mov eax, dword [ebp - 0x18]
call fcn.00403b00
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x4061bb
push 1
push 0
push 0x406234
lea edx, [ebp - 0x1c]
mov eax, 1
call fcn.00403000
mov eax, dword [ebp - 0x1c]
call fcn.00403b00
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4061dd
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403aa4
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x41a8a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x20dd3766
lea esp, [esp + 0xc]
jne 0x424b7f
neg al
cmp cl, 0x96
bswap ax
inc ah
mov eax, dword [ebp + 0x34]
pushfd
clc
cmp eax, dword [ebp + 0x38]
pushfd
push 0xe8f897ba
pushal
lea esp, [esp + 0x2c]
jle 0x424b7f
setno bl
inc ebx
mov ebx, dword [ebp + 0x3c]
call fcn.00425e34
xor edx, 0xea78349
pushal
push dword [esp + 0x28]
popfd
mov byte [esp + 0x14], 0x81
push dword [esp]
push dword [esp + 0x30]
ret 0x34
jnp 0x429c86
seto bh
mov ebx, dword [ebp + 0x3c]
movzx ebx, bl
mov ebx, dword [ebp + 0x3c]
jmp fcn.0041f530

Function at 0x41ace7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], ah
mov esi, dword [esi + 0x1b0d0]
pushfd
pushfd
lea esp, [esp + 0x18]
jbe 0x443a1b
pushal
lea esi, [esi - 0x1da0b861]
call fcn.0042c179
call fcn.004279fb
rdtsc
cwde
rdtsc
movzx ax, cl
mov dword [ebp - 4], 0x813c10
mov dh, 0xc1
not ah
jmp 0x43f5d4

Function at 0x41bb03
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf11d430c
mov dword [esp], ebx
pushfd
push edx
mov dword [esp + 4], edi
call fcn.004125ab
lea eax, [ebp - 0x9cb0]
pushal
mov byte [esp], cl
push dword [esp + 4]
lea esp, [esp + 0x24]
call fcn.00407dbc
lea eax, [ebp + 0x2eba6990]
setno dh
push 0xeca9d49
push dword [ebp - 0x9cb0]
pop dword [esp]
rdtsc
bswap dx
not ah
xchg dh, al
push 0x413488
push 0x4cec4c1f
rdtsc
lea edx, [ebp - 0x9cb4]
bswap ax
movzx ax, cl
call fcn.00427967
pushfd
pushfd
mov dword [esp + 8], 0x86b84247
pushfd
mov dword [esp], ebx
lea esp, [esp + 0xc]
jmp 0x419545
wait
not ax
cwde
pushfd
movsx ax, bl
lea eax, [ebp - 0x9cac]
jmp 0x4220dd
lea esp, [esp + 8]
call fcn.00407dbc
aad 0xe2
ror eax, cl
clc
push dword [ebp - 0x9cac]
sbb ah, 0x73
rol ah, cl
xor al, 0xf4
push 0x413478
or ah, 1
fld qword [ebp + 0x4c]
sub ah, 0x22
rol ah, 1
adc ah, 0x52
add esp, 0xfffffff4
movzx eax, bl
movsx eax, dl
lahf
fstp xword [esp]
bswap eax
bswap eax
wait
movsx ax, bl
jmp 0x41aacc

Function at 0x41c1a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x41c248
push esi
lea esp, [esp + 0x10]
call fcn.00406b50
lahf
xchg dx, ax
push dword [ebp - 0x9cb4]
rdtsc
movsx ax, cl
lahf
push 0x413498
rdtsc
lahf
not ax
cdq
lea edx, [ebp - 0x9cb8]
movzx ax, dl
setge al
pushal
mov eax, dword [ebp + 0x58]
pushal
lea esp, [esp + 0x40]
call fcn.00406b50
pushal
push dword [ebp - 0x9cb8]
pop dword [esp + 0x1c]
movzx dx, dl
mov dword [esp + 0x18], 0x4134a8
lahf
not dh
lea edx, [ebp - 0x9cbc]
pop eax
not ah
jmp 0x429e1f

Function at 0x41c6c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
fstp qword [eax]
rdtsc
rdtsc
not dx
movzx edx, al
wait
movzx cx, al
pushal
lea ecx, [ebp - 0x9ccc]
rdtsc
lahf
not bl
not bh
mov edx, 1
movzx ax, al
mov eax, dword [ebp - 0x1c]
push dword [esp]
push ebx
pop ebx
mov ebx, dword [eax]
pushfd
pushfd
mov dword [esp + 0x2c], 0x43962d
pushfd
call fcn.0041c0f3
Function at 0x41f6e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xa1b4c635
mov word [esp + 4], 0xec52
lea esp, [esp + 8]
call fcn.00407e1c
rdtsc
mov eax, dword [ebp - 0x30]
pushal
not cl
bswap bx
fstp qword [eax]
rdtsc
mov dl, bh
pushfd
setl cl
wait
bswap edx
lea ecx, [ebp - 0x9cd0]
push 0x82bdab69
mov edx, 2
movsx eax, al
mov eax, dword [ebp - 0x1c]
movzx ebx, dl
push dword [esp + 8]
mov ebx, dword [eax]
call fcn.0041ac3c
popfd
push esi
test eax, 0x42444c7
or al, 0xc6
and eax, 0x34ff9ccc
and al, 0x60
pushfd
lea esp, [esp + 0x30]
jmp fcn.00413393

Function at 0x42133b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
xchg ah, dl
xchg dl, al
lea edx, [ebp - 0x9cb4]
not ah
push dword [esp + 4]
mov eax, dword [ebp + 0x54]
mov word [esp], di
lea esp, [esp + 0x40]
call fcn.00406b50
bswap edx
pushfd
movsx dx, cl
lea edx, [edx*2 - 0x2857bbf]
push dword [ebp - 0x9cb4]
pop dword [esp]
pushfd
pushfd
mov dword [esp + 4], 0x413498
xchg dh, al
lea edx, [ebp - 0x9cb8]
pop eax
cwde
mov eax, dword [ebp + 0x58]
push 0xfb79cd73
push 0x335a41ae
pushfd
lea esp, [esp + 0xc]
call fcn.00406b50
pushal
lea esp, [esp + 0x20]
jmp fcn.00428d5f

Function at 0x4278be
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
call fcn.00407dbc
cwde
lea eax, [ecx - 0x6e50f617]
mov eax, 0xff9e3d57
push dword [ebp - 0x9cb0]
pushal
not ax
mov dword [esp + 0x1c], 0x413488
xchg ah, dh
lea edx, [ebp - 0x9cb4]
jmp 0x4260f8
pushfd
pushal
mov eax, dword [ebp + 0x54]
push 0xdcbcc543
push dword [esp + 0xc]
push 0x360290d6
pushfd
lea esp, [esp + 0x50]
call fcn.00406b50
lahf
not dl
push dword [ebp - 0x9cb4]
rdtsc
push 0x413498
lea eax, [esi - 0x79192309]
cwde
lea edx, [ebp - 0x9cb8]
lea eax, [esi + 0x1504350b]
lea eax, [edi - 0x398df6fd]
mov eax, dword [ebp + 0x58]
pushal
lea esp, [esp + 0x20]
call fcn.00406b50
pushal
pushfd
pushal
lea esp, [esp + 0x44]
jmp fcn.00428d5f
jmp 0x4201fd

Function at 0x427945
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x4133a8
rdtsc
lea edx, [ebp - 0x9c88]
push ebp
mov eax, dword [ebp - 0x34]
pushal
push 0x78dfdbfc
mov eax, dword [eax]
pushfd
pushfd
jmp 0x42e347
lea esp, [esp + 0x30]
call fcn.00406b50
setbe ah
lea eax, [ebp + 0x7a16a2d1]
push dword [ebp - 0x9c88]
Function at 0x42b6bb
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr ax, 0xe
btr ax, di
fld qword [ebp + 0xc]
sets ah
pushal
btr ax, sp
fcomp qword [ebp + 0x2c]
stc
pushfd
movsx ax, al
fnstsw ax
pushfd
push dword [esp + 0x14]
sahf
jmp 0x42788b
sahf
jmp 0x426916
setp ah
jmp 0x41c93f
push esp
push esi
mov byte [esp], cl
lea esp, [esp + 0x50]
jne 0x4263ff
bswap ebx
not bl
movsx bx, bl
mov ebx, 1
push edi
push dword [esp]
push edi
lea esp, [esp + 0xc]
jmp 0x424b8b
push dword [esp]
push dword [esp + 0xc]
lea esp, [esp + 0x34]
jne 0x42c5a0
xor eax, ecx
cwde
btc ax, dx
mov eax, dword [ebp + 0x34]
test si, 0x7755
cmp eax, dword [ebp + 0x38]
jmp 0x444a1b
stc
sahf
push edx
lea esp, [esp + 4]
jne 0x4263ff
bts ax, 0xb
fld qword [ebp + 0x1c]
bswap ax
pushal
pushal
fcomp qword [ebp + 0x2c]
bt bp, di
bswap ax
movzx ax, bl
btr ax, 8
fnstsw ax
pushfd
pushfd
jmp 0x4211d7
sahf
push 0xd47a31f0
lea esp, [esp + 0x38]
je 0x426925
setae al
fld qword [ebp + 0x14]
stc
fcomp qword [ebp + 0x2c]
stc
movsx ax, al
fnstsw ax
bt di, 0xc
stc
jmp 0x429f04
cmc
pushfd
cmc
clc
fld qword [ebp + 0x1c]
jmp 0x446fa7
jle 0x42c5a0
bswap bx
mov ebx, dword [ebp + 0x3c]
jmp 0x4417ec
push eax
inc ebx
mov byte [esp], dl
pushal
lea esp, [esp + 0x24]
jmp 0x424b8b
jmp 0x441541
fcomp qword [ebp + 0x2c]
cmc
cmc
fnstsw ax
bt dx, 5
sahf
call fcn.0041a8a0

Function at 0x42c183
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
call fcn.00406b50
movzx ax, al
push dword [ebp - 0x9cb4]
movzx ax, al
mov ah, 0xa3
push 0x413498
movzx dx, cl
xchg ah, dh
mov dl, 0x67
lahf
lea edx, [ebp - 0x9cb8]
lea eax, [ebx*4 + 0x3f69c56c]
lahf
push eax
mov eax, dword [ebp + 0x58]
lea esp, [esp + 4]

Function at 0x43730b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x4134b8
movsx dx, cl
lahf
push dword [ebp - 0x10]
mov dl, bl
rdtsc
lea eax, [ebp - 0x20]
pushal
mov edx, 0x1e
pushfd
push dword [esp]
push dword [esp]
lea esp, [esp + 0x2c]
call fcn.00403d48
movzx dx, bl
lea ecx, [edx*2 - 0x7fcf5285]
mov eax, dword [0x414574]
bswap dx
pushfd
movzx cx, cl
setbe dl
mov byte [eax], 0x2e
cdq
cdq
setno ah
mov dword [esp], 1
rdtsc
lahf
call fcn.0041d4ef
mov byte [esp + 0xc], 3
mov byte [esp], dh
lea esp, [esp + 0x18]
call fcn.00406b50
movzx edx, al
push 0x13228e9c
lea edx, [0x1f2e8d72]
not dh
push dword [ebp - 0x9cbc]
pop dword [esp]
movsx dx, bl
lahf
jmp 0x42117b

Function at 0x43c542
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push dword [esp + 4]
push 0x762d2cde
lea esp, [esp + 0x30]
call fcn.00407dbc
cwde
push dword [ebp - 0x9cac]
add ax, 0x1a70
btc ax, ax
ror ah, 2
push 0x413478
jp 0x44237c
fld qword [ebp + 0x4c]
rcr ax, cl
movsx ax, al
pushfd
add esp, 0xfffffff8
lahf
mov ax, ax
lea eax, [edx + 0x4869036f]
lea eax, [edx - 0x305a3178]
fstp xword [esp]
cwde
lahf
wait
push 0x98e429a1
pushfd
lea eax, [ebp - 0x9cb0]
jmp 0x423983
Function at 0x43ca53
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
seto dl
mov al, al
mov dword [esp], 0x413488
pushfd
cwde
movsx ax, bl
movzx ax, bl
lea edx, [ebp - 0x9cb4]
lahf
lahf
mov eax, dword [ebp + 0x54]
mov byte [esp], dh
push dword [esp]
jmp fcn.0041f427
fld qword [ebp + 0x4c]
bts eax, ecx
pushal
pushal
shl ax, 0xc
add esp, 0x38
lea eax, [0xfa59aef5]
pushfd
fstp xword [esp + 4]
lea eax, [esp + 0x1fe33269]
pop eax
wait
pushal
lea eax, [ebp*8 - 0x279d9bb1]
lea eax, [ebp - 0x9cb0]
pushfd
push edx
jmp 0x441608
lea edx, [ebp - 0x9cb8]
lea eax, [eax + 0x533eb9c5]
pushfd
bswap eax
mov eax, dword [ebp + 0x58]
push 0x29a83d4b
push 0xd32a8943
lea esp, [esp + 0xc]
call fcn.00406b50
pushal
pushfd
push 0x79c64b8f
push ecx
lea esp, [esp + 0x2c]
jmp fcn.00428d5f
lea esp, [esp + 0x28]
call fcn.00407dbc
pushal
movsx edx, dl
not dl
push dword [esp]
push dword [ebp - 0x9cb0]
pop dword [esp + 0x20]
lea esp, [esp + 0x20]
jnp 0x41f8c8
movzx dx, cl
xchg al, dl
pushfd
mov dword [esp], 0x413488
lea edx, [ebx - 0x4b4e24ce]
pushfd
lea edx, [ebp - 0x9cb4]
push dword [esp]
pushal
mov eax, dword [ebp + 0x54]
mov word [esp + 0xc], 0xe1e6
lea esp, [esp + 0x28]
call fcn.00406b50
movsx ax, cl
push dword [ebp - 0x9cb4]
xchg edx, eax
push 0x413498
jmp 0x43f6c4

Function at 0x43cb8b
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx ax, cl
clc
fnstsw ax
mov dword [esp], ebx
sahf
push dword [esp]
mov byte [esp], 0x80
lea esp, [esp + 0x28]
jne 0x42b6cb
bt di, 8
push 0x822991e2
fld qword [ebp + 0x24]
pushal
movsx ax, bl
pushfd
fcomp qword [ebp + 0x2c]
clc
bts ax, 0xe
bt edx, esp
fnstsw ax
pushfd
push dword [esp]
call fcn.0042b6bb

Function at 0x43dac6
Capabilities:
Encode data using xor

Disassembly:
inc eax
movzx cx, dl
add ch, al
xchg ch, dl
sal dh, 6
mov dword [ebp - 0x10], eax
lea esp, [esp + 8]

Function at 0x451d0c
Capabilities:
Encode data using xor

Disassembly:
or dword [edi], 0xffffff90
add byte [eax], al
and al, 0x2c
mov dword [esp + 0x18], ebx
call fcn.0044f0ef
adc edx, ecx
lock sub byte [ebx], cl
ja 0x44c3e0
jne 0x44c37b
pop eax
inc eax
adc cl, byte [eax + 0x31]
pop ds
loopne 0x44c39d
mov bh, byte [ecx + ebx*4 - 0x14dac77d]
fiadd dword [ebp - 0x2d11f897]
mov ch, 0x8d
jo 0x44c40d
invalid
std
dec ecx
sbb dh, ch
leave
stc
sub eax, 0xa2cdbfb7
sbb al, al
xor al, 0x7f
cmc
and eax, 0x69889f69
mov al, 0xe3
enter 0xffffffffffffcaf8, 0xe
or bh, dl
ja 0x44c45f
int3
loopne 0x44c393
cmc
in al, 0xa4
movsb byte es:[edi], byte [esi]
mov esi, 0xd89b5e7b
xor esp, dword [0x8a388ee0]
cmpsb byte [esi], byte es:[edi]
jle 0x44c412
xor dword [edi + 0x3f], esp
adc dword [esi + 0x7c], ecx
retf 0x2201
into
xchg esi, eax
out dx, al
xlatb
nop
inc esi
xchg esp, eax
test dword [edi - 0x50], esp
mov ah, 0xe6
das
push ebp
test dword [esi - 0x61], edx
lds eax, [esi]
out dx, eax
xchg esp, eax
invalid
pushfd
lea esp, [esp + 0x34]
jne 0x45560a
pushal
mov dword [esp + 0x1c], edi
jmp 0x44c3ae
Function at 0x1b4583e1
Capabilities:
Encode data using xor

Disassembly:
call 0x1b45835a
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1b45838a
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1b4583a6
xor edx, 0
jmp 0x1b4583b1
xor edx, edx
jmp 0x1b4583c8
jmp 0x1b4583d4
xor eax, eax
push 0x8427d7c0
call 0x1b4583e1
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x1b45841d
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1b4583f6
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1b458434
add eax, 0
jno 0x1b458439
add esi, 0
ret 0x10

Function at 0x1b4591a2
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x1b4591c4
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x1b459366
cmp edi, dword [ebp + 0x10]
jb 0x1b459366
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.1b458c8e
inc edi
jmp 0x1b45924d
jmp 0x1b45925a
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.1b458c8e
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.1b458c8e
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x1b4592ae
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x1b459292
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.1b4592dc
add dword [eax], 0x39
jle 0x1b4592b8
sub al, 0xf5
mov ch, al
call fcn.1b4592f1
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10