joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bed0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov ecx, 0x4c2810
call fcn.0040c475
test al, al
jne 0x46bef9
xor eax, eax
jmp 0x46c0d3
mov ecx, dword [ebp - 4]
mov eax, dword [0x4c2870]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [0x4c2884]
mov eax, dword [eax + ecx*4]
lea ecx, [ebp + 0xc]
mov edi, dword [eax]
mov esi, dword [edi]
mov bl, byte [edi + 0x90]
mov dword [ebp - 8], esi
mov byte [ebp + 0xb], bl
call fcn.0041ba1d
cmp dword [edi + 0x48], 0
jl 0x46bf3a
push dword [edi + 0x48]
call fcn.0046dcc3
movzx eax, bl
mov ebx, dword [ebp + 0xc]
cmp eax, 0x12
jg 0x46c01e
je 0x46bfdb
test eax, eax
je 0x46bfcb
jle 0x46bef2
cmp eax, 4
jle 0x46c064
cmp eax, 8
je 0x46bfab
cmp eax, 0x10
je 0x46bf95
cmp eax, 0x11
jne 0x46bef2
mov eax, dword [ebp + 0xc]
test eax, eax
js 0x46bef2
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.0041b3b0
push 1
push 0
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x46c0bc
cmp dword [ebp + 0xc], 0
jl 0x46bef2
push dword [ebp + 0xc]
push 0
push 0x111d
jmp 0x46bfbf
cmp dword [ebp + 0xc], 0
jl 0x46bef2
push dword [ebp + 0xc]
push 0
push 0x2001
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x46c0bc
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x46c086
jmp 0x46bef2
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jl 0x46bef2
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.0041b3b0
test byte [edi + 0x92], 0x20
jne 0x46c0bc
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi]
call esi
push 5
push dword [edi]
call esi
push dword [edi]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x46c0bc
cmp eax, 0x13
je 0x46c071
cmp eax, 0x14
je 0x46bf6d
cmp eax, 0x17
je 0x46c064
cmp eax, 0x18
je 0x46c046
jle 0x46bef2
cmp eax, 0x1b
jle 0x46c064
jmp 0x46bef2
test ebx, ebx
js 0x46bef2
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0xb
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
push ebx
mov dword [edi + 0x48], ebx
call fcn.0041b3b0
jmp 0x46c0b1
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xfffffffe
je 0x46bef2
mov eax, 0xfe000000
cmp ebx, eax
jne 0x46c093
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.0041b3b0
jmp 0x46c0bc
push ebx
push 0
push 0x1001
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
push ebx
push 0
push 0x1026
push dword [ebp - 8]
call esi
push 1
push edi
push dword [ebp - 4]
call fcn.0046eb59
cmp dword [0x4c20ec], 0
je 0x46c0d0
cmp byte [ebp + 0xb], 8
jne 0x46c0d0
or eax, 0xffffffff
jmp 0x46c0d3
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x46d87c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov ecx, 0x4c2810
call fcn.0040c475
test al, al
jne 0x46d8a6
xor eax, eax
jmp 0x46d9d9
mov ecx, dword [ebp - 0xc]
mov eax, dword [0x4c2870]
push ebx
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov eax, dword [0x4c2884]
push esi
mov eax, dword [eax + ecx*4]
mov esi, dword [ebp + 0xc]
mov ecx, dword [sym.imp.USER32.dll_SendMessageW]
push edi
mov edi, dword [eax]
mov ebx, dword [edi]
cmp esi, 0xffffffff
je 0x46d941
movzx eax, byte [edi + 0x90]
dec eax
dec eax
je 0x46d90d
dec eax
je 0x46d910
sub eax, 3
je 0x46d908
dec eax
je 0x46d903
sub eax, 3
je 0x46d8fb
sub eax, 0xc
jne 0x46d92e
jmp 0x46d9d6
or esi, 0x4000000
jmp 0x46d92e
or esi, 3
jmp 0x46d92e
or esi, 0xe
jmp 0x46d92e
or esi, 4
push 0
test esi, 0x800
je 0x46d91e
push 1
jmp 0x46d926
or esi, 0x10000
push 0
push 0xcf
push ebx
call ecx
or esi, 0x50000000
push esi
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
cmp esi, 0xffffffff
je 0x46d97e
push esi
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [0x4c2884]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax]
cmp byte [eax + 0x90], 0x13
jne 0x46d97e
push esi
push 0
push 0x1036
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], eax
mov al, byte [edi + 0x93]
mov ecx, dword [ebp + 8]
cmp al, 0xff
je 0x46d9a1
movzx eax, al
cmp eax, dword [ecx + 0x190]
je 0x46d9a1
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x46d9aa
push 1
push edi
push ecx
call fcn.0046eb59
mov al, byte [edi + 0x90]
cmp al, 2
je 0x46d9bd
cmp al, 3
je 0x46d9bd
cmp esi, 0xffffffff
je 0x46d9ce
push 0x27
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
cmp dword [ebp - 4], eax
setne al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x46eea9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x44
push 0
mov ebx, 0x4c4ee0
push ebx
call fcn.00422450
push 0x10
push 0
mov esi, 0x4c4f24
push esi
call fcn.00422450
add esp, 0x18
xor eax, eax
push esi
push ebx
inc eax
mov dword [0x4c4f0c], eax
mov word [0x4c4f10], ax
xor eax, eax
push eax
push eax
push 0x20
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x4c4ee0], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
pop ebx
test eax, eax
je 0x46ef0e
push dword [0x4c4f24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret 4

Function at 0x46ef12
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov edx, dword [ebx + 4]
push edi
push 3
mov edi, ecx
mov dword [ebp + 8], edx
pop esi
cmp dword [ebx + 0x190], eax
je 0x46efc8
cmp dword [edi + 0x84], esi
jl 0x46efc2
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x46efb3
cmp dword [ecx + 4], edx
jne 0x46efb3
mov dl, byte [ecx + 0x90]
cmp dl, 0xb
je 0x46efb0
mov dh, byte [ecx + 0x93]
movzx eax, dh
cmp eax, dword [ebx + 0x190]
je 0x46ef82
cmp byte [ebx + 0x198], 0
je 0x46efb0
cmp dh, 0xff
je 0x46efb0
cmp dl, 0xa
je 0x46efb0
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x46efb0
cmp byte [eax + 0x90], 0x1a
jne 0x46efb0
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc esi
cmp esi, dword [edi + 0x84]
jle 0x46ef42
mov eax, dword [ebp + 0xc]
push 3
pop esi
mov dword [ebx + 0x190], eax
cmp dword [edi + 0x84], esi
jl 0x46f055
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x46f046
cmp dword [ecx + 4], edx
jne 0x46f046
cmp byte [ecx + 0x90], 0xb
je 0x46f046
movzx eax, byte [ecx + 0x93]
cmp eax, dword [ebx + 0x190]
jne 0x46f046
test byte [ecx + 0x92], 0x20
jne 0x46f046
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
push 4
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x46f046
cmp byte [eax + 0x90], 0x1a
jne 0x46f046
push 1
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc esi
cmp esi, dword [edi + 0x84]
jle 0x46efd4
mov eax, dword [ebp + 0xc]
push 0
push eax
push 0x130c
push dword [ebx + 0x188]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x46f2ac
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
cmp word [eax], di
je 0x46f3c6
push edi
push edi
push 3
push edi
push edi
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x46f2e3
xor eax, eax
jmp 0x46f3f5
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x46f306
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46f2dc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x46f2dc
lea eax, [ebp - 8]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea eax, [ebp - 4]
push eax
push 0x48e9bc
xor edi, edi
push edi
push edi
push dword [ebp - 8]
mov dword [ebp - 4], edi
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x46f2dc
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push ecx
call dword [eax + 0xc]
lea eax, [ebp - 0x24]
push eax
push 0x18
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
cmp dword [edx], edi
jne 0x46f3a2
cmp dword [ecx], edi
jne 0x46f3a2
mov eax, dword [ebp - 0x20]
mov dword [edx], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
push 0x2000
push dword [ecx]
push dword [edx]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
jmp 0x46f3cb
mov eax, edi
mov dword [ebp + 0xc], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x64], 0
je 0x46f3e0
push dword [esi + 0x64]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 0xc]
push eax
push edi
mov dword [esi + 0x64], eax
mov esi, dword [esi]
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x46fd33
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x4c2810
push edi
mov ecx, esi
call fcn.0041b63a
mov ecx, dword [0x4c2870]
mov eax, dword [ecx + eax*4]
mov ebx, dword [eax]
cmp dword [ebp + 0xc], edi
jne 0x46fd8a
xor esi, esi
cmp dword [ebx + 0x1a0], esi
je 0x46fdee
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push esi
push edi
push dword [ebp - 4]
push dword [ebp - 8]
push esi
push dword [ebx + 0x1a0]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x46fe08
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0041b812
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x46fdee
mov ecx, dword [0x4c2884]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx]
mov cl, byte [eax + 0x90]
cmp cl, 0xe
je 0x46fdee
cmp cl, 0xf
je 0x46fdee
cmp cl, 0x13
je 0x46fdee
cmp cl, 0x10
je 0x46fdee
xor esi, esi
cmp dword [eax + 0xc], esi
je 0x46fdee
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x4c2884]
mov ecx, dword [ebp + 8]
push esi
push dword [ebx]
mov eax, dword [eax + ecx*4]
push dword [ebp - 4]
mov eax, dword [eax]
push dword [ebp - 8]
push esi
push dword [eax + 0xc]
jmp 0x46fd82
movzx ecx, word [ebp + 0x14]
movzx eax, word [ebp + 0x10]
shl ecx, 0x10
or ecx, eax
push ecx
push dword [ebp + 0xc]
push 0x7b
push edi
call dword [sym.imp.USER32.dll_DefDlgProcW]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x85654e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0x8565f7
lea esp, [esp + 1]
mov dword [esp], esp
pushal
call 0x856521
mov byte [esp + 1], dh
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp + 1]
jmp 0x856619
sbb esi, ebp
jmp 0x856627
lea ebp, [ebx*4]
bsf ebp, eax
rdtsc
jmp 0x85666b
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
pushfd
jmp 0x856005
jae 0x8565ff
lea ebp, [ebx*4]
bsf ebp, eax
jmp 0x8566b6
lea esp, [esp + 1]
jmp 0x85667d
mov ebp, dword [esp + 0x2c]
lea esi, [edx*4]
sub esp, 5
jl 0x856655
jge 0x85669b
lea esi, [esp + 4]
rdtsc
adc bh, 0xd3
jne 0x8566d0
je 0x8566d0
mov dword [0x21d2b727], eax
rcr bl, 0x58
into
test eax, 0x2435be58
push edi
mov esi, 0x24648d89
add ebx, ebp
fsubr qword [edx]
stosb byte es:[edi], al
cmp byte [edi - 0x56], bl
push esp
dec eax
iretd
lea esp, [esp + 1]
jmp 0x85667d
rdtsc
jmp 0x85666b
sub esp, 0xbc
jmp 0x8566d2
jmp 0x8566ba
mov edi, esp
not ecx
lea ebx, [esp + eax]
mov ecx, ebp
mov ax, word [esp]
call fcn.008566f4
ljmp 0x6659
invalid

Function at 0x8565c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x10], esi
call 0x85654e
call 0x8565c5
mov dword [esp], esp
lea esp, [esp + 2]
xchg dword [esp + 4], eax
pushfd
call 0x8565af
sbb bl, byte [ecx + 0x769b6809]
jl 0x85658e
or dword [eax - 0x65], ebp
jbe 0x85660f
cli
push 0x5e08fa0f
fisttp word [edi + 0x2a]
fld dword [ecx]
mov dl, 0xff
invalid
je 0x8565c6
push dword [esp + 2]
jb 0x85656d
add dh, byte [edx - 0x38]
mov dword [esp + 0x10], esi
call 0x856576
lodsd eax, dword [esi]
call fcn.008565cc
mov edx, 0x46cbac3e
ror dword [eax + 0x15e68313], 0x94
push ss
add dword [eax + 3], 0x74ff66ba
and al, 3
push dword [esp + 3]
jmp 0x85657b
pop esp
cmp edx, esi
cmp edi, ebx
push ecx
rcl byte [ebx - 0x36]
Function at 0x8565cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0085659f
mov dword [ebp - 0x2b], 0x74b34fbc
lea esp, [si + 0x24]
lea esp, [esp + 1]
mov dword [esp], esp
pushal
invalid
sar edi, cl
invalid
push dword [esp]
lea eax, [eax - 0x3d]
jmp 0x85671c
mov dword [esp + 0xc], ebp
jmp 0x856534
add dl, ch
add eax, 0x59cea7b4
pushfd
mov byte [esp], bl
pushfd
pushfd
xchg dword [esp + 0x20], eax
call fcn.008566ea
mov ax, di
jmp 0x85674d
dec ebp
mov edx, ebp
bsf ax, bp
jb 0x856790
jae 0x85677a
out dx, eax
outsd dx, dword [esi]
call [edx - 0x7ff87a97]
push ss
jno 0x8566e3
mov bp, 0x1f8c
xchg cx, ax
adc byte [edi], cl
test dword [ebx + 0x56fffffd], edi
lea esp, [esp + 0x1c]
jmp 0x8565ee
bsf dx, si
mov al, 0x3f
mov ax, 0x98a5
jmp 0x85679a
bsf dx, si
mov al, 0x3f
mov ax, 0x98a5
jmp 0x8567e0
lea esp, [esp + 0x20]
sub ebp, 0x20ce41e1
stc
ja 0x8567ca
jbe 0x85682a
pushfd
xchg bh, dl
jmp 0x8567d7
lea eax, [edi + 0x4f75e472]
stc
setae dl
pushfd
xchg bh, dl
mov bx, sp
jmp 0x856806
not ebp
pushal
pop eax
mov eax, dword [esp + 8]
push edx
mov bx, word [esp + 8]
jmp 0x85679c
lea edx, [edx*4]
btr ax, bp
jmp 0x8568d3
pop word [esp]
mov edx, dword [esp]
lea esp, [esp + 2]
inc ebp
rdtsc
jmp 0x8567f0
lea eax, [edi + 0x4f75e472]
stc
setae dl
jmp 0x8567ab
pushfd
jmp 0x856851
stc
pushfd
add ebp, dword [esi]
xchg ebx, eax
rdtsc
cmp ax, dx
jmp 0x85689c
pushfd
jmp 0x856882
rol ebp, 0
neg ebx
ja 0x85684f
stc
jmp 0x856839
movzx eax, byte [ebp - 1]
mov edx, eax
jmp 0x8568bb
jo 0x85685f
pushfd
jmp 0x856882
jmp 0x8568f0
mov edx, edi
mov dh, bl
mov bl, 0x76
mov bh, ch
cmc
jg 0x8568a5
mov bl, 0xec
neg edx
not dx
jmp 0x85692b
jne 0x85690d
dec eax
xchg bl, bh
jmp 0x856910
rcr edx, cl
jmp 0x856915
mov bl, 0xec
neg edx
not dx
jmp 0x8568da
dec eax
xchg bl, bh
jmp 0x856878
add al, cl
mov dh, byte [esp]
call fcn.0085692f
pop ebp
fimul word [ebx + ebp - 0x1a]
add byte [edi + reloc.kernel32.dll_GetProcAddress], ch
pop edx
rcr edx, cl
jmp 0x856915

Function at 0x8566f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x856741
not al
rdtsc
jmp 0x85672b
rdtsc
mov ax, di
jmp 0x85674d
mov dword [esp], eax
rcr bx, cl
jg 0x8566f6
not al
jmp 0x856700
Function at 0x862c3f
Capabilities:
Decompress data using aplib

Disassembly:
clc
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
jmp 0x862c56
xor edi, edi
cmp ecx, edi
je 0x862f67
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x862f67
mov esi, dword [ebp + 0xc]
lea ebx, [edx - 1]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], ebx
test edx, edx
je 0x862f67
lea edx, [esi - 1]
mov dword [esp + 0x2c], edx
test esi, esi
je 0x862f67
mov dl, byte [ecx]
mov ebx, dword [esp + 0x1c]
mov byte [eax], dl
inc eax
inc ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], ecx
jmp fcn.00862cb7
sbb eax, 0xa55633a3
pop ebp
xchg cx, ax
adc byte [ebx - 0x791667f3], cl
add byte [ecx - 0x7916670f], al
add byte [ecx + 0x1a3e78f1], al
push ss
mov edx, dword [0x86e970]
call fcn.008657c8
and dword ss:[eax - 0x5d], esp
jo 0x865841
jo 0x86578d
hlt
jmp 0x8855c0
jmp 0x8657f6
sub eax, 0x23326915
outsb dx, byte [esi]
push ss
add byte [esi + 0x7c8e7314], al
mov bh, 0x9e
jmp 0x862c3e
jmp 0x865824
push ax
lea esp, [esp + 2]
jmp 0x8657de
Function at 0x875be8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x875c09
push edx
rdtsc
jmp 0x875c4f
push word [esp + 5]
jg 0x875bea
push edx
rdtsc
jmp 0x875c4f
lea esp, [esp + 0xc]
add bl, 0x88
call fcn.0087645f
pop esp
fmul dword [esi + 0x29]
fcomp dword [edi - 0x4b]
movsb byte es:[edi], byte [esi]
xlatb
or dword ds:[eax - 0x17f9137d], ebp
sbb bl, dh
invalid

Function at 0x8808e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dx
push word [esp + 3]
mov ax, 0xe05e
lea esp, [esp + 3]
jmp 0x880908
xchg ecx, eax
adc byte [esi + 0xdff10e1], al
pushfd
out dx, eax
lea ebx, [edi + 0x50]
sub esp, 5
jns 0x8808ab
js 0x8808cc
bnd je 0x8808da
lea edi, [esi + ecx*4 - 0x1c]
popal
int1
nop
arpl word [edi - 0xa659ce0], ax
in al, 0x17

Function at 0x880b60
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub dh, dl
je 0x880b78
jne 0x880b78
ror byte [eax], 1
stosb byte es:[edi], al
mov ebp, 0x5eb3e14c
xchg byte [ebx + ecx*8 - 0x29], bh
pop ds
jne 0x880bc2
sub bl, 0xe8
jmp 0x880b4a
mov edx, dword [esp]
mov edx, 0x73ee070f
lea edx, [ebp*4]
jmp 0x880bae
lea esp, [esp + 4]
inc al
mov dx, word [esp]
jmp 0x880b62
shl dl, cl
jae 0x880b98
mov dl, ch
jmp 0x880bba
invalid

Function at 0x884211
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x863d05
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x863d1f
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x863d0e
pop esi
jmp 0x863d2a
ret 4
lea esp, [esp + 4]
jmp 0x863cf8

Function at 0x89d3a5
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [edx - 8], edi
mov di, word [esp]
jmp 0x89d425
mov word [esp + 1], sp
jmp 0x89d38f
mov eax, dword [edx]
clc
jmp 0x89d404
add esi, 0xfffffffc
mov dword [esi], eax
pop esi
mov al, 7
cmc
jmp 0x89d3ca
mov edi, dword [ecx]
sub esp, 0xd
pop dword [esp + 3]
lea esp, [esp + 1]
jmp 0x89d44b
mov dword [edx - 4], edi
dec edi
bsf di, bp
lea edi, [edx - 0x874d]
jmp 0x89d3ee
mov edi, dword [ecx - 4]
push esi
mov esi, ecx
jmp 0x89d3e0
mov ebx, edx
add ebx, 4
mov eax, dword [ebx]
pop ebx
jmp 0x89d453
mov dword [ecx], eax
xor ax, sp
push ebx
jmp 0x89d42d
mov dword [edx], edi
sub esp, 2
lea edi, [eax + edi]
lea esp, [esp + 2]
mov edi, dword [ecx + 4]
jmp 0x89d468
mov dword [ecx + 4], eax
push ebx
jmp 0x89d4a5
lea esp, [esp + 0x20]
add ecx, 0x10
jmp 0x89d52a
mov dword [edx + 4], edi
lea esp, [esp + 0x10]
sub ebx, 4
pushal
jmp 0x89d48f
jl 0x862868
mov al, byte [esp]
mov eax, dword [ebp - 8]
jmp 0x862852
sub edx, 0x10
push sp
lea esp, [esp + 2]
cmp dword [ebp - 4], ebx
jmp 0x89d4c8
Function at 0x89d428
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [edx - 8], edi
mov di, word [esp]
jmp 0x89d425
mov word [esp + 1], sp
jmp 0x89d38f
mov eax, dword [edx]
clc
jmp 0x89d404
add esi, 0xfffffffc
mov dword [esi], eax
pop esi
mov al, 7
cmc
jmp 0x89d3ca
mov edi, dword [ecx]
sub esp, 0xd
pop dword [esp + 3]
lea esp, [esp + 1]
jmp 0x89d44b
mov dword [edx - 4], edi
dec edi
bsf di, bp
lea edi, [edx - 0x874d]
jmp 0x89d3ee
mov edi, dword [ecx - 4]
push esi
mov esi, ecx
jmp 0x89d3e0
mov ebx, edx
add ebx, 4
mov eax, dword [ebx]
pop ebx
jmp 0x89d453
mov dword [ecx], eax
xor ax, sp
push ebx
jmp 0x89d42d
mov dword [edx], edi
sub esp, 2
lea edi, [eax + edi]
lea esp, [esp + 2]
mov edi, dword [ecx + 4]
jmp 0x89d468
mov dword [ecx + 4], eax
push ebx
jmp 0x89d4a5
lea esp, [esp + 0x20]
add ecx, 0x10
jmp 0x89d52a
mov dword [edx + 4], edi
lea esp, [esp + 0x10]
sub ebx, 4
pushal
jmp 0x89d48f
jl 0x862868
mov al, byte [esp]
mov eax, dword [ebp - 8]
jmp 0x862852
sub edx, 0x10
push sp
lea esp, [esp + 2]
cmp dword [ebp - 4], ebx
jmp 0x89d4c8

Function at 0x89d797
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + 0x86c79c]
jmp 0x89d7a4
pushal
mov word [esp + 0x1a], cx
mov byte [esp + 8], dl
jmp 0x89d7ea

Function at 0x89d99d
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x89d9a7
lea esp, [esp + 4]
xor edi, dword [edx*4 + 0x86d79c]
jmp 0x89d9d4
Function at 0x89dc3e
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x89dc7a
lea esp, [esp + 4]
push ebx
call esi
push edi
clc
jmp 0x89dc64

Function at 0x89dc54
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.0089dcf3
xor al, ah
invalid
call fcn.008790d6
fucompi st(1)
clc
dec esp
cld
invalid
lea esp, [esp + 0x24]
jmp 0x89dc21
mov word [esp + 1], bx
lea esp, [esp + 4]
push 4
call fcn.0089dc3e
mov word [esp], si
cmc
jmp 0x89dc9b
lea esp, [esp + 4]
and al, 4
test eax, eax
jne 0x862983
call fcn.0089dc85
cld
jge 0x89dc9c
je 0x89dc38
arpl si, cx
dec esi
fdivr qword [ebx - 0x59a057aa]
ror dword [ebp - 0x72fddb9c], 1
and al, 0x24

Function at 0x89e7b5
Capabilities:
Decompress data using aplib

Disassembly:
cmp edi, dword [eax + 0xc]
call fcn.0089e989
inc edi
jbe 0x862f48
ljmp 0xbf8f:0xe49fd6e
pushfd
jmp 0x89e8b8
call fcn.0089e84d
invalid
lea esp, [esp + 8]
push esi
jmp 0x89e7d7
push edi
mov edi, dword [ebp + 8]
call fcn.008841ae
jmp 0x89e842
push esp
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0x89e824
movzx ecx, word [edx + 4]
mov si, 0x76c0
mov esi, 0x14c
cmp cx, si
jmp 0x89e7fc
jne 0x862fba
je 0x863027
sbb eax, 0xa7540d9d
dec edx
insd dword es:[edi], dx
out dx, al
jl 0x89e855
not byte [eax]
jg 0x89e884
int1
ljmp 0xfe6a
mov edx, eax
call fcn.0088524b
mov ecx, ebx
jmp 0x89e812
add byte [eax], al
add byte [eax], al
jmp 0x89e8a9
push edx
mov edx, ebp
lea edx, [edx - 8]
mov dword [edx], esi
jmp 0x89e88f
pop edx
mov esi, dword [esp]
mov esi, dword [edx + 0x38]
jmp 0x89e8ce
mov esi, dword [edx + 0x3c]
lea ecx, [edx*4]
mov ecx, dword [edx + 0x54]
jmp 0x89e881
mov esi, 0x8664
cmc
jmp 0x89e8f0
mov dword [ebp - 4], esi
lea esp, [esp + 4]
jmp 0x862fa4
cmp cx, si
pushfd
lea esp, [esp + 8]
je 0x863027
call fcn.0089e8da
mov eax, 0x47b4ad3d
mov dword [0xfb9c0e8a], eax
push ss
xchg ecx, eax
pop ds
mov dword [0x4ca55633], eax
mov dx, bp

Function at 0x89e84d
Capabilities:
Decompress data using aplib

Disassembly:
mov si, word [esp + 2]
lea esi, [ebx*4]

Function at 0x89e8da
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x89e939
lea esp, [esp + 4]
jmp 0x862fa4
lea ecx, [edi - 0x20]
push word [esp]
mov byte [esp], ch
lea esp, [esp + 2]
mov ecx, dword [ebp + 8]
jmp 0x89e923

Function at 0x8a0af4
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xd
lea esp, [esp + 3]
jmp 0x8a0ae3
cmp dword [ebp + 0xc], 1
call 0x8a0ac4
push dx
call 0x8a0af4
or byte [ebp - 0x14fddb9c], 0x34
mov esi, 0x1a333bb6
push esp
xor eax, 0xd2c8ad39
and dword [edx], eax
and byte [edx + 0x436609f5], dh
jo 0x8a0abb
sub esp, 0xd
lea esp, [esp + 3]
jmp 0x8a0ac2

Function at 0xae0a1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
popal
lea esi, [ebp*4]
not edi
inc ecx
sub esp, 0x1c
jmp 0xae09aa