joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10059e50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005d6eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x324
cmp dword [ebp + 8], 0
jne 0x10059e7b
xor al, al
jmp 0x10059ff9
mov eax, dword [ebp + 8]
push eax
call fcn.10058f30
add esp, 4
cmp eax, 2
je 0x10059e93
xor al, al
jmp 0x10059ff9
mov byte [ebp - 0x118], 0
xor ecx, ecx
mov word [ebp - 0x117], cx
mov byte [ebp - 0x324], 0
push 0x103
push 0
lea edx, [ebp - 0x323]
push edx
call fcn.1003d8e0
add esp, 0xc
mov byte [ebp - 0x21c], 0
push 0xff
push 0
lea eax, [ebp - 0x21b]
push eax
call fcn.1003d8e0
add esp, 0xc
push 0
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1003df3a
add esp, 0x14
mov byte [ebp - 0x114], 0
push 0x103
push 0
lea edx, [ebp - 0x113]
push edx
call fcn.1003d8e0
add esp, 0xc
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10059f44
mov ecx, dword [ebp + 8]
push ecx
push 0x10064b34
push 0x103
lea edx, [ebp - 0x114]
push edx
call fcn.1003d95a
add esp, 0x10
jmp 0x10059f5c
push 0x103
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100590e0
add esp, 0xc
lea ecx, [ebp - 0x32c]
call fcn.10059260
mov dword [ebp - 4], 0
mov byte [ebp - 0x32d], 1
push 0
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x32c]
call fcn.100592e0
mov byte [ebp - 0x32d], al
movzx eax, byte [ebp - 0x32d]
test eax, eax
je 0x10059fd5
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x32c]
call fcn.10059b10
mov byte [ebp - 0x32d], al
push 0
lea ecx, [ebp - 0x32c]
call fcn.10059290
movzx eax, byte [ebp - 0x32d]
test eax, eax
jne 0x10059fd5
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dl, byte [ebp - 0x32d]
mov byte [ebp - 0x32e], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x32c]
call fcn.10059e30
mov al, byte [ebp - 0x32e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1005a010
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005d6fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
cmp dword [ebp + 8], 0
jne 0x1005a038
xor al, al
jmp 0x1005a0c0
mov eax, dword [ebp + 8]
push eax
call fcn.10058f30
add esp, 4
cmp eax, 1
je 0x1005a04d
xor al, al
jmp 0x1005a0c0
lea ecx, [ebp - 0x14]
call fcn.10059260
mov dword [ebp - 4], 0
mov byte [ebp - 0x15], 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x14]
call fcn.100592e0
mov byte [ebp - 0x15], al
movzx edx, byte [ebp - 0x15]
test edx, edx
je 0x1005a0a8
push 0
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.100595e0
mov byte [ebp - 0x15], al
push 0
lea ecx, [ebp - 0x14]
call fcn.10059290
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
jne 0x1005a0a8
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, byte [ebp - 0x15]
mov byte [ebp - 0x16], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10059e30
mov al, byte [ebp - 0x16]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1008f293
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0x380]
pushfd
bt edi, edi
cmp dword [edx + 0xc], 0
jmp 0x102986fe
pushfd
lea esp, [esp + 0xc]
jne 0x1026c6ea
call fcn.1034513a
push 0x581c1bc4
call fcn.10004611
jne 0x1020e2c1
rol dword [edi - 0x75c3dbb4], 0xc
and al, 0x8b
push ebp
or byte [eax - 0x64], dl
mov byte [0x573cde41], al
cmp bl, byte [ecx + 0x21]
aam 0x77
arpl cx, cx
or dword [ecx], ebp
xchg edi, eax
pop es
add eax, 0x3b5c7464
xlatb
invalid
jmp 0x1020e228

Function at 0x1009bc5f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
call fcn.1002c7e0
mov dl, bl
xor ch, ah
clc
mov edx, dword [eax]
das
mov dword [ebp - 0x6c], edx
test dl, 0x47
pushfd
mov eax, dword [ebp - 0x6c]
movsx dx, al
mov dword [ebp - 0x70], eax
aam 0xc0
rcl cx, 4
btr ax, 1
mov ecx, dword [ebp - 0x18]
sar al, 3
bsf dx, ax
movzx dx, al
rdtsc
add ecx, 0x310
mov word [esp], cx
pushal
rdtsc
mov dword [ebp - 0x18], ecx
seto ah
pop edx
mov edx, dword [ebp - 0x70]
movsx ax, bl
pop eax
pushal
mov eax, dword [edx + 0x30c]
lea esp, [esp + 0x3c]
jo 0x102919e0
clc
pushfd
mov byte [esp], 0x98
imul eax, eax, 0x30c
push dword [esp]
add eax, dword [ebp - 0x18]
push ebx
pushfd
mov dword [ebp - 0x18], eax
mov byte [esp + 8], bl
lea esp, [esp + 0x10]
jmp 0x10125b30
or cx, bx
clc
mov ecx, dword [ebp - 0x68]
bt bp, 3
cmc
add ecx, 1
pushal
push eax
mov dword [ebp - 0x68], ecx
lea esp, [esp + 0x24]
bt eax, edi
bt dx, dx
pushfd
imul eax, eax, 0x30c
pushal
pushal
pushfd
clc
add eax, dword [ebp - 0x18]
mov dword [esp + 4], 0x5b31599
mov word [esp], si
call fcn.1013e286
add al, 0xe5
inc eax
jmp 0x10291a81
inc eax
invalid
Function at 0x100a410c
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx dx, cl
mov edx, dword [ebp - 0xb0]
bswap cx
push edx
mov cx, 0xbb09
bswap cx
setl ch
mov eax, dword [ebp - 0xb4]
setg ch
bswap cx
pushfd
lea ecx, [ebx - 0x523c0548]
mov ecx, dword [eax]
jmp 0x102dc08d
setae ah
rdtsc
rdtsc
mov ecx, dword [ebp - 0xa0]
pop eax
rdtsc
lahf
push ecx
jmp 0x10275f21
mov word [esp], sp
lea esp, [esp + 0x24]
call fcn.1003b370
bsr dx, bp
bts edx, eax
add esp, 0xc
pushfd
jmp 0x1037a002
pop eax
pushfd
mov eax, dword [ebp - 0xb8]
pushal
push dword [esp + 4]
call fcn.1036939a
add byte [esi + 0x22978cf1], 0x7d
fadd dword [ebx]
mov cs, word [ecx + 0x14]
iretd
rdtsc
jmp 0x10098060
mov dword [esp], ecx
movsx ecx, cl
seta ch
mov ecx, dword [ebp - 0x52c]
pushal
mov dword [esp + 4], 0x5f0ec14b
lea esp, [esp + 0x20]
call fcn.1001bb80
rol cl, 3
bsf edx, esi
and ch, 0x8f
pushfd
add eax, dword [ebp - 0x74]
not edx
rcl cl, cl
mov dword [ebp - 0x1d8], eax
setnp dl
btr dx, 0xe
btr cx, 0xb
shr edx, 0x1c
mov edx, dword [ebp - 0x1d8]
push esp
bt esp, edx
movsx eax, dl
add edx, 2
movsx ax, bl
mov dword [ebp - 0x1dc], edx
pushfd
pushal
pop eax
mov dword [esp + 0x24], 0x104
setae cl
mov eax, dword [ebp - 0x1dc]
push 0x334ff8ac
movzx cx, al
mov dword [esp + 0x24], eax
lea ecx, [ebp - 0x7f0b59e6]
lea ecx, [ebp + 0x2da42232]
bswap cx
not ch
lea ecx, [ebp - 0x1d0]
push 0xaefb36bc
mov dword [esp + 0x24], ecx
jmp 0x101d8f03
mov edx, dword [ebp - 0x1dc]
pop eax
sets al
push 0xd066cf35
lahf
mov dword [esp], edx
push 0xbc871c43
jmp 0x1021152d

Function at 0x100bf124
Capabilities:
Read file on windows

Disassembly:
lea esp, [esp + 0x30]
call fcn.1003be2f
btc cx, bx
add esp, 0x10
bswap cx
call fcn.101b9033
push 0x5a1ef5c8
call fcn.10001cf2
dec edi
add bl, al
invalid
mov dword [esp + 8], eax
pushal
push 0xc6f8f9a2
push 0x76ed9cd4
jmp 0x100af47f

Function at 0x100e0627
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x44]
jne 0x10335669
pushfd
mov edx, dword [ebp + 0x18]
not ax
pop eax
not ax
mov dword [edx], 0xfffffffc
bswap eax
lea eax, [ebp - 0x214]
push 0x751379c3
mov dword [esp], eax
call fcn.1027ca3a
pushal
push ebx
mov dword [esp + 0x20], 2
pushfd
pushfd
lea ecx, [ecx - 0x7433cef5]
movzx cx, dl
mov dword [esp + 0x24], 0
mov cx, word [esp + 8]
pushfd
mov ecx, dword [ebp - 0x224]
push dword [esp + 0x10]
mov byte [esp], 0xdb
mov dword [esp + 0x28], ecx
pushfd
lea esp, [esp + 0x2c]
call fcn.1003c44f
clc
push 0xd886accb
add esp, 0x10
lea edx, [ebp + 0xee4ff1f]
mov dh, ch
mov edx, dword [ebp - 0x224]
call fcn.101c49d6
push ecx
or dword [edi + eax*8 - 0x1f], 0x9d42979c
fcom dword [ebx + 0x3e]
fst dword [ebx + eax*8 - 0x4a5268b1]
xor esi, 0x56
jns 0x1028fa51
and eax, 0x8bbca454
daa
or byte [edi + 0x67], bh
aaa
push esp
movsb byte es:[edi], byte [esi]
mov esp, 0x7f08278b
aaa
adc eax, 0xe71bef80
push ss
mov byte [ebx - 0x2b], dl
stc
sbb dl, byte [ebx - 0x79277bd7]
inc ebx
popfd
test dword [edx], esp
xor esi, dword [ecx]
invalid
jmp 0x1028f9dc

Function at 0x100f3435
Capabilities:
Packed with generic packer

Disassembly:
movzx eax, al
pushal
cmc
test eax, eax
push esp
call fcn.101b5110
mov eax, 0x4abf3499
invalid
Function at 0x100f37cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ch
pushal
mov dword [esp + 0x3c], eax
lea esp, [esp + 0x3c]
jne 0x101d2659
pushfd
pushal
pushal
lea esp, [esp + 0x44]
call fcn.1003b370
pushfd
pushal
pushal
push dword [esp]
lea esp, [esp + 0x48]
jmp 0x101e01d1
jmp 0x10164f98
jmp 0x100b2187
lea esp, [esp + 0x50]
call fcn.1003b370
cmp di, 0x2c72
pushfd
and al, 0xfd
add esp, 0x10
cmc
not dh
mov eax, dword [ebp - 0xac]
movzx edx, dl
rcl dl, 5
bt dx, bp
btr dx, si
imul eax, eax, 0x2c
pushfd
push 0x8786450c
mov byte [ebp + eax - 0x50], 0
xchg edx, ecx
pop ecx
mov dword [esp], 0x10
lahf
movzx eax, bl
btc cx, 0xe
lea ecx, [ebp - 0x1d0]
mov dh, 0x6b
push ecx
pushal
rol ax, cl
mov edx, dword [ebp - 0xac]
rol al, cl
ror eax, cl
imul edx, edx, 0x2c
cwde
lea eax, [ebp + edx - 0x4f]
jmp 0x10115210
ja 0x100bafe3
call fcn.1003b370
pushfd
lea esp, [esp + 4]
jmp 0x101e01d1

Function at 0x100f4a3b
Capabilities:
Encode data using xor

Disassembly:
pushal
lea esp, [esp + 0x2c]
jae 0x1012f41c
ror dh, 1
lea ecx, [ecx*4 - 0x47753d9d]
not dx
mov edx, dword [ebp - 8]
or al, 0x8d
arpl dx, ax
mov bh, byte [eax - 0x742d089a]
push ebp
clc
not ah
pushfd
imul edx, edx, 0x28
pushfd
push ecx
btr cx, 1
mov eax, dword [ebp - 8]
bt edx, ebx
imul eax, eax, 0x28
shl esi, cl
adc ch, 6
aad 6
shld cx, si, cl
pop ecx
mov ecx, dword [ebp + 0x10]
call fcn.102f9bde
xor edx, dword [edi + edi*4 + 0x1a]
add eax, 0xe035baa0
jnp 0x100f4a6e
push ecx
dec esp
out 0xb6, eax
and ch, byte [edx - 0x40]
sub byte [edx], bh
cmpsd dword [esi], dword es:[edi]
push ecx
jb 0x100f4a49
retf 0x292

Function at 0x10100f87
Capabilities:
Read file on windows

Disassembly:
setae ah
mov eax, dword [ebp - 0x24]
jmp fcn.10006066
pushal
mov dword [esp + 0x40], edx
movzx ax, al
movsx eax, cl
sets al
mov dword [esp + 0x3c], 1
jmp 0x10098b9d

Function at 0x10101f6f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
call fcn.1003b370
lea ecx, [edi + 0x207182b]
add esp, 0xc
rdtsc
jmp 0x10343220
cwde
rdtsc
mov ecx, dword [ebp - 0x4d0]
mov ax, 0xb764
pushal
call fcn.10172a62

Function at 0x1010a292
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x2c]
jmp 0x100fd8ea
Function at 0x10129ec4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 4]
jmp loc.10021744
push 0xbcaa34bc
pushal
lea esp, [esp + 0x24]
jle 0x100fab77
not ah
daa
mov ecx, dword [ebp + 0x10]
rcl ah, cl
not al
adc dh, 0xf4
sub ecx, dword [ebp - 4]
bsr ax, di
push ecx
bt di, 1
pushal
mov word [esp + 4], 0xc243
mov edx, dword [ebp + 0xc]
add cx, 0x90e1
and eax, 0xf986ee82
add edx, dword [ebp - 4]
rol ch, cl
aam 0xd
push 0xf1fc5d1b
jmp 0x1015889c
seto dh
shl al, cl
lahf
mov ecx, dword [ebp + 0xc]
rdtsc
rdtsc
dec eax
cwde
add ecx, dword [ebp - 4]
clc
adc dx, 0x282d
mov al, 0x7e
push ecx
rcl ch, 4
push esp
mov edx, dword [ebp + 8]
pop ecx
sbb ax, cx
add edx, dword [ebp - 4]
lahf
setp ah
lahf
not ecx
push edx
xchg al, dh
jmp 0x10319c2f
add eax, dword [ebp - 4]
call fcn.100bed23
clc
push 0xdfe216f
push ebx
sub al, al
mov byte [esp], 0x69
mov byte [esp], ch
lea esp, [esp + 8]
jmp loc.1001473f
lea esp, [esp + 0x28]
jnp 0x100e0657
push 0x1988306c
lea esp, [esp + 4]
jle 0x100fab77
push 0xacf0ec73
mov ecx, dword [ebp + 0x10]
bswap ax
pop eax
cmp ah, bl
sub ecx, dword [ebp - 4]
sar dl, cl
setne dh
push ecx
sets al
mov edx, dword [ebp + 0xc]
shr ecx, cl
add al, bl
add edx, dword [ebp - 4]
mov ch, 0x28
cmp dl, al
push edx
sar ah, cl
das
not ax
shld cx, si, 8
mov eax, dword [ebp + 8]
rol cl, 2
sub ch, 0xd9
jmp 0x101c3a8e
movsx cx, al
mov ecx, dword [ebp - 8]
jmp 0x101d3e4c
mov dword [esp + 0x20], edx
sub cx, 0xd20b
shr ecx, cl
mov eax, dword [ebp + 8]
or cl, 0xd7
jmp 0x10110480
add eax, dword [ebp - 4]
mov ecx, edx
push eax
jmp 0x101d98d0
pushfd
pushal
lea esp, [esp + 0x24]
call fcn.100215d0
pushal
lea esp, [esp + 0x20]
jmp 0x1008939e
jmp 0x10148793
mov eax, dword [ebp - 8]
mov ch, 0x2b
lea edx, [eax*8 - 0x7987394c]
pushal
mov edx, dword [eax]
pop ecx
mov ecx, dword [ebp - 8]
bswap ax
mov eax, dword [edx + 0x10]
push 0xa456f40b
or esi, esp
push esi
movsb byte es:[edi], byte [esi]
Function at 0x10130626
Capabilities:
Hash data with crc32

Disassembly:
cmp dword [ebp - 0x414], 0
pushal
lea esp, [esp + 0x20]
jae 0x10158395
pushal
lea esp, [esp + 0x20]
jle 0x10229bec
adc eax, ecx
dec eax
adc ax, sp
mov eax, dword [ebp - 8]
pushfd
and eax, 1
pushfd
pushfd
lea esp, [esp + 0xc]
je 0x100e2302
ror cl, cl
sal ecx, 9
bswap ecx
bsr ecx, edi
mov ecx, dword [ebp - 8]
cmp bp, 0x3f4c
jb 0x10185d9b
push 0x944fd7fc
shr ecx, 1
test bl, bh
test ah, bl
bt ax, cx
xor ecx, 0xedb88320
pushal
pushal
mov dword [ebp - 8], ecx
pushfd
push esp
push ecx
lea esp, [esp + 0x50]
jmp 0x100e231d
jmp 0x10368540
test bh, bh
sub dh, 0x6c
sar dx, cl
mov edx, dword [ebp - 8]
push edx
clc
push ebp
shr edx, 1
pushal
push dword [esp]
mov dword [ebp - 8], edx
lea esp, [esp + 0x2c]
push edx
mov dword [ebp - 0x414], 8
push dword [esp + 4]
lea esp, [esp + 0x50]
jmp 0x1021f03e
pushal
lea esp, [esp + 0x20]
jle 0x10229bec
shrd ax, bx, cl
ror ah, cl
pushal
mov eax, dword [ebp - 8]
pushal
and eax, 1
call fcn.1037d636
jmp 0x10201247
call fcn.10116292
mov bh, 0xd1
jl 0x10185ddc
jb 0x10185e04
clc
inc ebx
fimul word [ecx - 0x7c]
cvtps2pd xmm0, qword [ebp + 0x24]
insb byte es:[edi], dx
adc dl, 7
jo 0x10185dee
xchg esi, eax
sub byte [edx + 0x21], ah
imul esp, dword [esi - 0x11], 0x5f37a6a4
invalid
les edx, [esi]
xor eax, 0xdac2f6c8
fdivr st(0)
test eax, 0xf5065e04
and esi, dword [ebx + 0x176b7c91]
mov bl, 0x3f
imul edx, dword [edi], 0xffffffb3
aas
fist dword [edi - 0x6d]
mov edi, 0x74ffe72b
push dword [esp + 4]
and al, 0xc
call 0x1030157d
call 0x10180f09
push 0x461eea3c
call fcn.10005576
pop esi
jmp 0x1019042c
outsd dx, dword [esi]
iretd
clc
add dword [ebp - 0x788], 1
mov dword [esp], ebp
cmp dx, bp
pushal
cmp byte [ebp - 0x789], 0
jmp 0x10296631
bt bx, bx
cmp sp, 0xceed
jmp 0x1008d4f6
pushfd
movzx ecx, dl
setne ch
not cl
mov eax, dword [ebp - 0x410]
jmp 0x1026e9a4
pushal
movsx cx, dl
mov ecx, dword [ebp - 8]
jmp 0x100919a4
pushfd
pushfd
lea esp, [esp + 0x34]
jne 0x1037d4ce
lahf
xchg dx, ax
mov edi, dword [ebp - 0x788]
xchg cl, dh
rdtsc
mov edx, dword [0x10061000]
jmp 0x101903ec
mov dword [ebp + eax*4 - 0x408], ecx
pushfd
lea esp, [esp + 0x28]
jmp 0x10014731
sar ax, cl
not cl
mov eax, dword [ebp - 0x788]
push esi
and cl, dh
rcr cl, cl
mov cl, byte [eax + 1]
clc
test bh, ch
call fcn.10114efb
test al, 0xa8
jae 0x1037d56b
leave
push esp
out dx, eax
pop edx
xchg ebp, eax
shr byte [ebx - 0x7b], 0xf0
cmp ecx, dword [edx]
salc
out dx, al
add al, 0x60
dec ecx
imul edx, esp, 0x6a
dec eax
cld
sub bh, byte [edx]
fsub qword [edx + edx*8 - 0x51d1c7a]
pop eax
salc
mov dword [ebp + 0x69], esi
push eax
salc
mov bl, al
mov ah, 0xcc
arpl sp, bp
insb byte es:[edi], dx
fcmovnb st(0), st(3)
push ebx
sub ch, cl
test eax, 0x6b29a994
jecxz 0x1037d4fa
add eax, 0x28d4c0cd
fdivr st(6)
rcr byte [edx + 0x67], cl
dec edi
jmp 0x1037d579
lcall 0x794d, 0x55618d8
jg 0x1037d57c
mov al, 0xe2
imul esi, dword [ecx - 0x3b7e1516], 0x1e
ljmp 0xce0e:0x8e1ec481
push ds
mov cs, word [esi]
into
les esi, [ebp + 0x5b]
in al, dx
in eax, dx
mov bh, byte [eax - 0x6c59e7a6]
sub ch, ah
jmp dword [ebx]
Function at 0x1013093d
Capabilities:
List tcp connections and listeners

Disassembly:
mov dword [ebp - 0x14], ecx
not dh
pop edx
bswap dx
mov edx, dword [ebp - 0x14]
jno 0x101411ed
push esi
mov dword [esp], edx
jmp 0x101bc7bd
lea esp, [esp + 8]
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
movsx dx, al
mov dword [ebp - 0xc], eax
movzx cx, cl
pushfd
lea ecx, [ebp + 0x7ec350ad]
bswap cx
mov ecx, dword [ebp - 4]
not dl
jmp 0x100c1634
pushfd
mov dword [esp], edx
call fcn.103391ea
pushfd
push 0x98e773d2
mov byte [esp], dh
lea esp, [esp + 8]
call fcn.1003ad90
pushfd
bsr ax, bp
rol al, cl
add esp, 8
push 0x7a78a20c
setno al
mov byte [esp], bh
mov eax, dword [ebp - 8]
push dword [esp]
jmp 0x1023edce
call 0x10158f5e

Function at 0x101355ef
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov byte [esp + 8], al
lea esp, [esp + 0x2c]
call sub.IPHLPAPI.DLL_GetTcpTable
pushfd
pushal
jmp 0x101c13b1
jmp 0x100d9651
pushal
mov dword [ebp - 0x14], eax
push edi
mov dword [esp + 0x44], 0x1013482f
call fcn.1023f373
add al, 0x44
outsd dx, dword [esi]
dec ecx
in al, 0x9f
push 0xfffffffffffffff5
mov al, 0x5b
popal
pop esp
inc edi
push ss
inc edx
mov cs, word [ebx - 0x2ccc6d05]
loope 0x101c13d0
aam 0xfc
and al, 0x4c
push edi
lea eax, [esi - 0x76]
enter 0x2f0, 0x1d
cmp al, 0x98
int3

Function at 0x10146e50
Capabilities:
Packed with generic packer

Disassembly:
not ecx
jmp 0x101bb1fc
mov cx, si
mov dword [esp], 0
not ch
mov ecx, dword [ebp - 0x80]
jnp 0x101ee097
push ecx
call fcn.101b4766
push ds
and bl, ch
or byte [ebx - 0x509bc6a2], dh
cmp dl, byte [ebp - 0x6a693470]
push ecx
mov ecx, 0x2a5dbf0f
movsx ebx, word [ebp + 0x2a]
mov byte [ebx + ebp*2 + 0x18e529eb], ah
js 0x101bb228
xchg esi, eax
jle 0x101bb27f
pop eax
scasd eax, dword es:[di]
loope 0x101bb292
pushfd
mov eax, 0x5d49cf2e
insb byte es:[edi], dx
test al, 0xc
mov ah, 0xa7
not esp
sti
pop esp
mov dword gs:[ebx - 0x73], edi
cmp dword [ecx - 0x3a92a884], esp
out dx, al
xchg dword [eax - 0x1493b75e], edi
mov bl, 0x89
sub dword [ecx + 0x72], ebp
iretd
xor dh, byte [ecx - 0x63]
popfd
aas
adc bl, 0xfd
popfd
nop
lodsb al, byte [esi]
sbb al, 0xf9
cli
dec edi
and al, 0xc3
mov al, 5
mov eax, dword [0x57a9d0ff]
add eax, 0xa9d0ffa1
push edi
dec ecx
add bh, ah
or ecx, ebx
fdiv dword [ebp - 1]
mov byte [0xd53e1ef0], al
mov al, byte [0x46637b6f]
outsd dx, dword [esi]
jnp 0x101bb30c
inc esi
test eax, 0xd6fd89e3
xchg esi, eax
test dword [ecx - 0x2ca86f9], ecx
fsubr qword [eax + 0x14]
mov al, 0xfc
js 0x101bb2e1
push eax
cmp eax, 0x3f1af7e5
lds ecx, ss:[ebx]
xor esp, dword [ebx + 0x6fe7c97b]
sub al, 0x6a
pop edx
int1
adc byte [eax + 0x3f], 0x51
or eax, 0xa72cb179
jbe 0x101bb341
dec eax
js 0x101bb32d
sbb bh, byte [edi]
aaa
jge 0x101bb2a6
jmp 0x101bb310
std
lodsd eax, dword [esi]
in al, 0xd3
xchg byte [esi], ch
mov ch, 0xb1
jbe 0x101bb379
inc esi
push eax
adc al, 0xa2
loop 0x101bb35c
dec ebx
popal
mov eax, dword [0x7e6a54ad]
pushal
push 0x64
pop esi
mov dl, 0x70
sub dword [ebx + 0xbbedacd], esp
pushfd
or al, byte [esi]
mov esi, 0x60a9c0b
invalid
hlt
retf
push 0xffffffffffffffe8
iretd
pushfd
push esp
call fcn.1031d709
das
outsd dx, dword [esi]
mov edx, 0xf6fb0015
xchg ecx, eax
mov esp, 0xd161e227
iretd
Function at 0x10173d96
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr dh, cl
test bl, dl
sub eax, eax
neg ecx
mov dword [ebp - 0x78], eax
btc cx, 1
adc dh, 0xca
lea ecx, [esi - 0x5038c81e]
rol cx, cl
mov dword [ebp - 0x74], eax
shr dl, 2
rcr cl, cl
mov dword [ebp - 0x70], eax
push 0xbb589242
mov dword [ebp - 0x6c], eax
add ch, 0xc7
shld edx, edx, 0x18
xor dl, 0xb9
and dh, bl
mov dword [ebp - 0x68], eax
clc
shrd cx, si, cl
rcr dl, cl
mov dword [ebp - 0x64], eax
daa
mov dword [ebp - 0x78], 0x18
rdtsc
aam 0xb9
btc cx, dx
lea esp, [esp + 0xc]
jbe 0x1031890e
mov ecx, dword [ebp - 0x5c]
shl ah, cl
shl ecx, 4
xchg dx, ax
cwde
not edx
pushfd
mov edx, dword [ebp - 0x1c]
pushal
mov eax, dword [edx + ecx + 4]
xchg dl, ch
mov dword [ebp - 0x90], eax
movzx dx, cl
call fcn.101d888f
mov dword [ebp - 0x94], 0
sar dl, 2
not edx
push 0xe2d8a14b
mov dword [ebp - 0x7c], 0
jmp 0x100a7b9e
xor al, 0xb9
setl ah
bswap cx
cwde
mov ecx, dword [ebp - 0x5c]
rdtsc
shl ecx, 4
setne al
mov edx, dword [ebp - 0x1c]
movsx ax, al
not al
jmp 0x102a3122

Function at 0x10186efd
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx cx, dl
jmp 0x10315b33
out dx, eax
mov edi, 0x843225a
ljmp 0x8274
pushfd
lea ecx, [ebp - 0x888]
cwde
push 0x9b89b33c
rdtsc
mov dword [ebp - 0x474], ecx
lahf
lea eax, [edx + 0x3e37dffb]
cdq
lea esp, [esp + 8]
jl 0x1028d3d3
mov esp, 0x6a001791
add al, ch
fmul qword [esi + 0x22]
add byte [edi + 0x5f], bl
push 0
call fcn.103390fa
pop edi
pop edi
sub ah, ch
sar bl, 0x56
loope 0x10114213
push edi
inc edx
jge 0x101141d3
jecxz 0x101141ff
sahf
push cs
jmp 0xf74a328d
cwd
setno dh
mov dx, word [ebp - 0x3d8]
pushfd
mov word [ebp - 0x478], dx
bswap ax
movzx cx, al
pushal
lea edx, [ecx + 0x93acd15]
mov ax, word [ebp - 0x3d6]
mov byte [esp + 4], 0x23
movzx edx, bl
xchg dh, ch
mov word [ebp - 0x476], ax
setnp dh
lea esp, [esp + 0x24]
jbe 0x101141f0
lahf
pushfd
lea ecx, [ebp - 0x888]
xchg al, dl
rdtsc
seto dl
not edx
mov dword [ebp - 0x474], ecx
cdq
lahf
bswap ecx
mov dword [esp], 0
lea edx, [edi + 0x3b266f1f]
push edi
jmp 0x10367d0a
lea esp, [esp + 0xc]
jge 0x1015ebaf
pushal
lahf
pop eax
lahf
mov eax, dword [ebp - 0x300]
mov byte [esp], 0xc1
lea esp, [esp + 0x1c]
jmp loc.10007600
cmp dword [ebp - 0x300], 0
pushfd
push 0xd67cff17
jmp 0x101721ec
call fcn.1002159e
lea esp, [esp + 0x14]
call fcn.1000de70
not ecx
jmp 0x100d7dc5
mov byte [ebp - 4], 1
mov cl, 0xce
not cx
lea ecx, [ebp - 0xa4]
pushal
lea esp, [esp + 0x20]
call fcn.10003370
pushfd
lea ecx, [esp + 0x6fd911d]
not ah
movzx eax, word [ebp - 0x478]
setl dl
pop ecx
setno ch
cdq
setp ch
mov cl, 0x94
setbe cl
pushal
mov dword [esp + 0x1c], edx
lea ecx, [ebp*8 + 0x3591ce6b]
movzx ecx, cl
movzx edx, bl
xchg dword [esp + 0x18], eax
pushal
xchg dx, ax
mov edx, dword [ebp - 0x474]
lea eax, [0x12aabd52]
xchg dword [esp + 0x34], edx
call fcn.100bf69c

Function at 0x10198963
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebp - 0x128]
not cl
pushal
bt sp, bx
Function at 0x1019a1e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dx
mov word [ebp - 0x4c], ax
pushfd
aam 0x3c
mov ecx, 0x72
dec ah
setns al
daa
dec dh
mov word [ebp - 0x4a], cx
inc dl
rol dl, 1
and cx, ax
adc ah, bl
mov edx, 0x33
adc ecx, 0x8edf12e1
mov word [ebp - 0x48], dx
aaa
sal al, cl
mov eax, 0x32
btr cx, 2
sar cx, cl
not cx
mov word [ebp - 0x46], ax
clc
daa
cmp cl, cl
mov ecx, 0x2e
sbb dh, 0x12
cmp dh, bh
mov word [esp + 8], cx
xchg ah, dh
mov word [ebp - 0x44], cx
clc
daa
daa
mov edx, 0x64
cmc
xchg al, cl
mov word [ebp - 0x42], dx
shr cx, 0xe
mov eax, 0x6c
clc
rol ch, 3
shrd ecx, esi, cl
lea ecx, [ecx + 0x6ac54d32]
mov word [ebp - 0x40], ax
pushfd
neg al
or ch, cl
cmc
mov ecx, 0x6c
test cl, 0x92
mov word [ebp - 0x3e], cx
sub esp, 0xffffffd4
aam 1
sbb ax, 0xd959
sub edx, edx
clc
sbb eax, ecx
mov word [ebp - 0x3c], dx
add ah, 1
mov eax, 0x73
neg dl
mov word [ebp - 0xa4], ax
sub cx, 0xbdc8
bswap ecx
lea ecx, [edi*4 - 0x788c14e9]
cmc
mov ecx, 0x68
movsx ax, al
not al
rcl al, 3
shl al, cl
mov word [ebp - 0xa2], cx
push ebp
mov edx, 0x65
not cl
xchg cx, ax
mov word [ebp - 0xa0], dx
mov dl, 0xd5
cdq
aas
mov eax, 0x6c
pushfd
bsf edx, eax
adc ch, 0x24
cmc
mov word [ebp - 0x9e], ax
movsx ax, dl
shrd ecx, ebx, 1
and ax, 0x3295
adc dl, 0x86
mov ecx, 0x6c
rdtsc
rdtsc
sal ah, cl
aas
mov word [ebp - 0x9c], cx
clc
rcr dx, cl
sal dl, 7
mov edx, 0x33
call fcn.100f448a
cli
mov al, 0x1b
cmpsb byte [esi], byte es:[edi]
and dword [edi], ebx
and ch, ch
or byte [ebx + 0x5bf0b232], dl
jle 0x1019a306
insb byte es:[edi], dx
add byte [eax], al
add byte [edi], cl
xor dword [edi], ecx
xor edx, edx
hlt
invalid

Function at 0x1019bf17
Capabilities:
Encode data using xor

Disassembly:
jmp 0x101f61e2
mov dword [esp + 0x20], ecx
pushal
push esi
jmp 0x102075e5

Function at 0x101a51ce
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov dword [ebp - 0x4c], 0
push esp
pushfd
push edi
mov dword [ebp - 0x10], 0xffffffff
push dword [esp]
lea esp, [esp + 0x38]
jle 0x10086cb3
mov dword [ebp - 0x4c], 0
push ebx
push dword [esp]
pushfd
lea esp, [esp + 0xc]
jmp 0x1012ed4f

Function at 0x101b0bf6
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
bswap eax
sete ah
mov dword [esp + 0x38], edx
pushfd
bswap ax
mov al, 0x54
mov dword [esp + 0x38], 0
not ah
call int.10103b0d
push ds
dec esi
test eax, 0x35baaff4
and bl, cl
div cl
cmp al, 0xc7
xchg edx, eax
adc dword [ebp - 0x33], ebp
outsd dx, dword [esi]
xchg ecx, ebx
shr byte [edi - 0x53512f81], 4
mov ch, 0x4d
enter 0xffffffffffffe7c2, 0xffffffffffffffcf
das
or eax, 0xa77b0cfb
pop es
lodsb al, byte [esi]
idiv cl
add ecx, dword [esp + edi*8 - 0x347ada1d]
sub byte [esi + edx*2 + 0x73], dh
popfd
dec esi
fimul word [edx]
stc
movsb byte es:[edi], byte [esi]
pop ds
lodsd eax, dword [esi]
mov dl, 0x8d
outsd dx, dword [esi]
cmp bh, byte [ebp - 0x43]
test dword [ecx - 0x7a], ebp
aad 0x91
pushal
invalid