joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004a660
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
push 0x200000
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edx
xor ebp, ebp
push eax
mov dword [esp + 0x20], ebp
call fcn.1004a460
mov edi, eax
cmp edi, ebp
je 0x1004a703
mov ebx, dword [esp + 0x10]
cmp ebx, ebp
jle 0x1004a703
mov eax, dword [esp + 0x20]
cmp dword [eax + 0x18], 0x10
jb 0x1004a6a1
mov eax, dword [eax + 4]
jmp 0x1004a6a4
add eax, 4
push ebp
push 0x80
push 2
push ebp
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1004a6d5
push edi
call fcn.1001b03f
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
push ebp
lea ecx, [esp + 0x20]
push ecx
push ebx
push edi
push esi
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1001b03f
add esp, 4
cmp dword [esp + 0x1c], ebx
jne 0x1004a703
mov ebp, 1
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 0x10

Function at 0x1004a740
Capabilities:
Get file version info

Disassembly:
sub esp, 0x134
mov eax, dword [0x1005b030]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x144]
mov ebx, ecx
push 0x34
mov eax, 0x4e4
lea ebp, [ebx + 4]
push 0
push ebp
mov word [ebx + 0x3e], ax
call fcn.1001c860
lea edx, [esp + 0x44]
add esp, 0xc
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1004a781
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x3c]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
ja 0x1004a7ae
xor eax, eax
jmp 0x1004a849
push esi
call fcn.1001a524
add esp, 4
push eax
push esi
mov dword [ebx + 0x38], eax
push 0
lea eax, [esp + 0x44]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1004a7a7
lea edx, [esp + 0x14]
push edx
mov edx, dword [ebx + 0x38]
mov ecx, 0x5c
lea eax, [esp + 0x14]
mov word [esp + 0x10], cx
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1004a7a7
mov esi, dword [esp + 0x10]
push edi
mov ecx, 0xd
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, 7
mov esi, 0x10055808
lea edi, [esp + 0x20]
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebx + 0x38]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2a]
push edx
push eax
call sub.VERSION.dll_VerQueryValueA
pop edi
test eax, eax
je 0x1004a83d
cmp dword [esp + 0x14], 4
jb 0x1004a83d
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov dword [ebx + 0x3c], edx
xor eax, eax
cmp dword [ebp], 0xfeef04bd
sete al
mov ecx, dword [esp + 0x13c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001a52f
add esp, 0x134
ret 4
Function at 0x1004a9d0
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x220]
sub esp, 0x220
push 0xffffffffffffffff
push 0x10051239
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1005b030]
xor eax, ebp
mov dword [ebp + 0x21c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x228]
mov edi, dword [ebp + 0x22c]
xor ebx, ebx
mov dword [ebp - 0x28], ebx
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x10055934
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], esi
mov byte [esi + 4], bl
call fcn.10001ed0
mov eax, 1
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
cmp edi, ebx
jne 0x1004aa5e
push 0x104
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x1004aa69
push edi
lea ecx, [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp]
push eax
mov dword [ebp - 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
je 0x1004ab7d
push edi
push 2
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp - 0x1c]
mov esi, eax
push esi
push edi
push ecx
lea edx, [ebp]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [ebp - 0x2c]
push ecx
mov eax, 0x5c
lea edx, [ebp - 0x20]
mov word [ebp - 0x14], ax
push edx
lea eax, [ebp - 0x14]
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 0x20]
mov cx, word [eax + 0xc]
mov si, word [eax + 0xa]
mov di, word [eax + 8]
mov bx, word [eax + 0xe]
push 0x103
lea edx, [ebp + 0x105]
push 0
push edx
mov word [ebp + 0x20e], cx
mov byte [ebp + 0x104], 0
call fcn.1001c860
mov eax, dword [str._d._d._d._d]
mov ecx, dword [0x10055848]
mov edx, dword [0x1005584c]
mov dword [ebp + 0x210], eax
movzx eax, word [ebp + 0x20e]
push eax
mov dword [ebp + 0x214], ecx
mov dword [ebp + 0x218], edx
movzx ecx, bx
push ecx
movzx edx, di
push edx
movzx eax, si
push eax
lea ecx, [ebp + 0x210]
push ecx
lea edx, [ebp + 0x104]
push edx
call fcn.1001a983
lea eax, [ebp + 0x104]
add esp, 0x24
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004ab50
mov ecx, dword [ebp - 0x18]
sub eax, edx
push eax
lea eax, [ebp + 0x104]
push eax
call fcn.10001ed0
mov esi, dword [ebp - 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [ebp - 0x18]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x21c]
xor ecx, ebp
call fcn.1001a52f
add ebp, 0x220
mov esp, ebp
pop ebp
ret
Function at 0x10088e71
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
je 0x100f0b9c
xchg ah, ch
lahf
jmp 0x10219106
push 0x884d799
lea esp, [esp + 0xc]
call fcn.1001ae40
neg ax
add esp, 0xc
setg ah
rdtsc
rdtsc
bt bx, 9
mov edx, dword [ebp - 0xac]
lahf
clc
imul edx, edx, 0x2c
cwde
mov byte [ebp + edx - 0x36], 0
setbe ah
call fcn.100c9282
into
sbb ch, al
mov ch, 0x60
lea edi, [esi + 0x6d]
fimul word [esi - 0x7be853c2]
adc eax, 0x757416d6
int1
jns 0x1009ae1b
or al, 0xf
lahf
les ecx, [edi]
xor dword [edi], ecx
xor dword [esi + 0xf], esp
mov edx, 0x958b09e3
push esp
invalid
pop ebp
imul ebp, dword [eax + 0x4b05ba7a], 0xb85bc145
ret
not ch
lea ecx, [ebx*4 - 0x522bf1b7]
lea ecx, [ebp - 0x308]
call fcn.100b2116
lea eax, [edi*4 - 0x470117e3]
mov eax, dword [ebp - 0xac]
lea ecx, [ebx*4 - 0x47599a15]
imul eax, eax, 0x2c
bswap cx
lea ecx, [esp - 0x60b5aaa2]
not ch
not cx
lea ecx, [ebp + eax - 0x3e]
push edx
mov dword [esp], ecx
pushfd
push dword [esp]
jmp 0x1009ae08
bt eax, esp
ror cx, cl
imul eax, eax, 0x2c
pushal
push dword [esp]
mov dword [esp], 0xec29d57e
lea ecx, [ebp + eax - 0x3e]
lea esp, [esp + 0x24]
jne 0x1020c0eb
push ecx
pushfd
push ebx
mov dword [esp + 8], ecx
jmp 0x10213ed6
add esp, 8
test dh, bh
clc
test eax, eax
pushfd
lea esp, [esp + 4]
je 0x100f0b9c
push 0xd7bbbd27
sub edx, edx
pushal
mov eax, dword [ebp - 0xac]
lea esp, [esp + 0x24]
jbe 0x101b5c7a
btc ecx, esp
imul eax, eax, 0x2c
bt ebx, 7
lea ecx, [ebp - 0x3f96de81]
bswap cx
movsx cx, bl
lea ecx, [ebp + eax - 0x3e]
btc ax, bp
bts eax, 0x10
push esp
mov dword [ecx], edx
pushal
pop eax
mov dword [ecx + 4], edx
cdq
lahf
mov dword [esp + 0x1c], 8
cwde
setbe dl
btr dx, di
xchg dl, al
lea edx, [ebp - 0x308]
cwde
pushal
not eax
mov dword [esp + 0x38], edx
lea esp, [esp + 0x38]
jp 0x100c7582
movsx cx, bl
mov eax, dword [ebp - 0xac]
movsx cx, cl
jmp 0x100d0c3e
rcr cx, cl
btc ecx, edx
call fcn.101193d0
push 0xe203ad6c
call fcn.10002ee5
xor eax, 0xbf0fb56d
stosb byte es:[edi], al
pop ecx
mov edi, dword [ebx - 0x5b]
push esp
ret 0x9db2
push 0x7533e31c
jle 0x1020c0e1
daa
xor eax, 0x7514ac7e
fdivr dword [ebp - 0xf]
inc eax
pop eax
scasb al, byte es:[edi]
xlatb
mov edi, 0x2535b957
retf
lds ecx, [ecx + 0x43]
dec ecx
inc ebx
les eax, [ebx]
jle 0x1020c0e5
add edi, dword [esi - 3]
jns 0x1020c0a2
jp 0x1020c14c
pushal
mov dword [esp + 0x1c], ecx
call fcn.100e3a25
lodsb al, byte [esi]
pop ebp
dec esp
jge 0x1020c0e2
push esp
inc edi
jae 0x1020c0a2
nop
jle 0x1020c12e
sbb ah, dh
and edi, dword [edx + 0x3c0bcd4a]
test byte [ebx], dh
push esp
invalid
invalid
outsb dx, byte [esi]
add cl, byte [esi - 0x5a]
ljmp 0x87c1
pushal
lea esp, [esp + 0x28]
call fcn.1001ae40
stc
rcl ecx, cl
ror dh, 4
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [esp], eax
mov cl, ch
bswap cx
ja 0x100ad140
lea ecx, [ebp - 0x308]
pushfd
pushfd
mov dword [esp + 4], ecx
push edx
pushfd
lea esp, [esp + 0xc]
call fcn.10027a65
stc
jmp 0x10140087
Function at 0x100b5388
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
shl dword [ebp + 0x103d7b8b], 1
aas
mov edi, dword [ebx + 0x3d]
adc byte [edi], bh
jno 0x100b533d
pop ss
imul ebx, eax, 0x21786f6b
mov eax, dword [0xb1f43bad]
and byte [edi], ch
fcompp
pop esi
push 0xf6c8758d
or eax, 0x9993316f
jle 0x100b5325
outsd dx, dword [esi]
xor dword [ebx + 0x68e27e99], edx
push edx
inc esi
cld
insb byte es:[edi], dx
push 0x6cfc4652
in al, dx
jg 0x100b537e
invalid
xchg esp, eax
loope 0x100b531f
lahf
mov al, byte [0x199a1adc]
push esp
call fcn.100fc140
test al, 0xaf
loop 0x100b531d
jg 0x100b53fe
sbb dword [edi], eax
cmp dword [0x9e6dff97], esp
add dword [edx - 0x3f], edx
push edx
inc edx
or byte [ebx + 0x3e], 0xa1
invalid
push 0x34
out dx, al
xor al, 0xee
loope 0x100b53ff
pop ebp
sbb dword [esi], esp
push 0xd1ff114d
sub al, byte [0x14a5e766]
mov dword [0xc4577b20], eax
mul byte [edi + ecx*8]
xor al, ah
invalid

Function at 0x100d11ff
Capabilities:
Encode data using xor

Disassembly:
lahf
setns al
mov eax, dword [ebp - 0xb8]
jmp 0x101496f0
and dword [0x9f0acadf], esi
add al, byte [edx]
mov esp, 0x3ff42c9
inc ecx
inc eax
add dword [ebp - 0x77], edi
mov dword [esp], eax
add al, 0x24
pushal
pushfd
pushfd
mov dword [esp + 0x24], 0x10200873
pushal
call fcn.10186477
or eax, 0x20f4c114
rol byte [edx - 0x50], cl
fisttp word [esp + edi*8]
mov edi, dword [edx + 0x3cf14afd]
out dx, eax
adc esi, 0x9c17a4c7
salc
outsb dx, byte [esi]
imul ebx, ebx, 0x20fecdca
inc edi
or eax, 0x3263f9b
xor bl, byte [ecx]
dec eax
sub dword [ecx - 0x76cacdf9], edx
cmp byte [esi - 0x6c12f209], ch
mov bl, 0xd1
loope 0x101496f1
mov bh, 8
jecxz 0x10149758
pop esi
mov bl, 0x29
jle 0x101496df
or dword gs:[edi + 0x5769858], edx
mov byte [ebx - 0x47], bl
int3
push ecx
and al, 0x82
adc edx, dword [eax - 0x676faf32]
hlt

Function at 0x100d97b4
Capabilities:
Encode data using xor

Disassembly:
cmc
cmp dword [ebp - 0x10], 0xffffffff
mov byte [esp], 0xda
push dword [esp]
jmp 0x1010752d

Function at 0x100dbb64
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
cmp dh, 0x2c
pushal
shr eax, 1
push dword [esp]
pushfd
test cl, dl
push 0x8071b585
test cl, 1
pushfd
lea esp, [esp + 0x34]
je 0x100dbb96
push 0x93d71f3c
bt cx, sp
xor eax, 0xedb88320
add esp, 4
pushal
pushfd
test al, 1
pushal
pushfd
mov word [esp + 0xc], di
lea esp, [esp + 0x48]
je 0x1018c544
bt dx, di
shr eax, 1
bt sp, 1
cmp bp, 0x8d1
xor eax, 0xedb88320
pushfd
mov byte [esp], 0x4a
lea esp, [esp + 4]
jmp 0x101c9206
test ax, 0x6ace
cmp ax, ax
push edx
shr eax, 1
add esp, 4
push 0x8748d342
test al, 1
push edx
jmp 0x10018066
clc
call fcn.101c91fe
int 0x93
add al, 0x6f
pushfd
iretd
test ebp, 0xc524b455
cmp bp, 0x1f46
pushfd
clc
test al, 1
push dword [esp]
lea esp, [esp + 8]
je 0x10118f9a
cmc
pushfd
bt bp, 0xd
shr eax, 1
cmc
cmp bh, dh
stc
xor eax, 0xedb88320
mov byte [esp], 0xb2
push dword [esp]
pushfd
pushfd
lea esp, [esp + 0x10]
jmp 0x10118fa7
Function at 0x100e0f23
Capabilities:
Packed with generic packer

Disassembly:
cmp ecx, dword [ebp + 0xc]
pushfd
push 0x84861511
call fcn.1015bad5
sbb al, dh
popal
xchg edx, eax
jl 0x100c0110
fmul dword [edx + 0x36]
adc eax, dword es:[ebx]
hlt
inc edi
call [ebx]
fxch st(6)
cli
jae 0x100c014f
add cl, dl
adc ebp, ebp
xor byte [edx], dl
fistp dword [ebx + ecx*4 - 0x4a]
and ebp, dword [edx + 0x7f7d1a18]
jl 0x100c0174
mov ecx, 0x1ecaee6a
dec edx
sub dword [edx - 0x56114577], ebx
jmp [ecx]
daa
sbb al, 0xde
out dx, al
mov ebx, 0x6a87b0e3
sbb dword [ebp - 0x60], ecx
pop ss
invalid
dec ebp
cwde
dec dword [ebx - 0x572a5498]
mov bl, cl
xchg esi, eax
xchg edx, eax
push ebx
push esp
push esp
push edx
push 0x4200be13
call fcn.100034e3
dec esp
push eax
xchg edx, eax
stosd dword es:[edi], eax
pop esp
dec ebx
clc
salc
sub dword [edi], 0x62
int3
pushal
push dword [esp + 4]
push 0x6db852b8
mov dword [ebp - 4], 0
push ecx
mov word [esp], ax
push 0x8840d7bf
mov dword [ebp - 8], 0
pushfd
mov byte [esp + 4], 0xaf
push dword [esp + 8]
mov byte [esp + 4], 0xa5
lea esp, [esp + 0x38]
jmp 0x101020b8
jmp 0x101cb49c
push ebx
mov ecx, dword [ebp - 8]
jmp 0x100c00d3
lea esp, [esp + 0x24]
jmp 0x100d6125

Function at 0x1010fa59
Capabilities:
Packed with generic packer

Disassembly:
in al, dx
xor byte [edi + 0x76], dh
iretd
outsd dx, dword [esi]
jb 0x1010fa82
jecxz 0x1010fa8b
invalid
ficomp dword [eax]
pop eax
invalid
call fcn.10173acf
inc ebp
sbb eax, 0x5bedbc0c
dec eax
cmp ah, ah
adc edi, dword [edi - 0x50]
mov esp, 0x3a485bed
in al, 0x13
jg 0x1010fa1a
popal
dec ebp
cdq
pushfd
xor byte [eax - 0x75], al
jle 0x1010fa04
shr dword [ebx - 0x6a7400c4], cl
jbe 0x1010fa1f
sub al, dl
jg 0x1010fadb
daa
jecxz 0x1010fa55
jecxz 0x1010fa61
push cs
sbb eax, 0xf5cc90ad
pop ebx
pop edx
sbb bl, al
js 0x1010fa47
cmp ebx, dword [edx]
pop edi
pop edx
int3
cmp esp, edi
pop edx
std
ret

Function at 0x10121514
Capabilities:
Packed with generic packer

Disassembly:
cmp bp, 0x9248
jmp 0x10166da5
rcr dword [esi - 0x20], 1
and dword [ebp + 0x4a5e5a1], ebx
ljmp 0x9c9b
call fcn.10223a01
sbb ecx, esi
loop 0x100fa39a
mov esi, 0x38855aa9
and al, 0x92
sal dl, 0xe0
jmp 0x100fa487
sbb ecx, dword [ecx - 0x76d0d97d]
stc
mov ebp, 0x34f6b7ba
jb 0x100fa503
jno 0x100fa4e2
push cs
int3
add eax, 0x24448f10
sbb byte [esi - 0x77], ah
sub al, 0x24
invalid
jmp 0x101f74a6
jmp 0x10190145
pushal
jmp 0x1017c1f2
test ecx, ecx
pushfd
jmp 0x100fa404
push 0xc6d8cbc7
pushal
lea esp, [esp + 0x28]
jne 0x10149854
push 0x52f2fb5e
push 0x89ff9ed3
pushfd
lea esp, [esp + 0xc]
jmp fcn.101aded0
lea esp, [esp + 0x20]
call fcn.10006b40
movsx ecx, dl
not ch
not cx
sub ch, 0xf9
movzx ecx, al
jmp 0x101ba018
mov dword [esp + 0x2c], eax
bswap cx
lea ecx, [eax*8 - 0x12a3bc01]
mov word [esp], si
movzx ecx, dl
mov ecx, dword [ebp - 0x858]
lea esp, [esp + 0x2c]
jns 0x101401f4
pushal
lea esp, [esp + 0x20]
call fcn.10006b40
ror ecx, cl
shl cx, cl
movsx cx, bl
inc cl
movzx ecx, al
cmc
pushal
add esp, 0x20
jg 0x100cef18
test ecx, ecx
jmp 0x1011c1ef
push 0x68a73a14
test al, 0x38
test ecx, ecx
jmp 0x101791da
pushal
lea esp, [esp + 0x20]
jne 0x10149854
pushal
pushal
mov dword [esp + 8], 0x40fcb48c
push dword [esp]
lea esp, [esp + 0x44]
jmp fcn.101aded0
Function at 0x101287f5
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], ah
call fcn.100d97c5
cmp esi, dword [edx]
arpl di, cx
shr dword [edi + 0x1e], 0xb
jns 0x100bbc67
push edx
fistp word [edx - 0x4351b804]
mov ah, 0x6b
jmp 0x12f16abf
mov bh, dh
loope 0x100bbcd5
int 0xb9
cmc
mov al, byte [0xd99e109b]
inc esp
sar dl, cl
invalid
popal
in al, dx
not edx
add bl, al
push edx
pop esp
ljmp 0x2864
mov ch, cl
sub byte fs:[ecx + 0x570ec2be], bl
inc ebp
adc byte [eax + 0x2702cd4e], cl
mov byte [esi - 0x33], cl
add ah, byte [edi]
xor cl, byte [edi - 7]
cmpsb byte [esi], byte es:[edi]
in eax, 0x8f
dec ebp
add ah, byte [edx]
loope 0x100bbd1c
loop 0x100bbcb3
dec ecx
scasd eax, dword es:[edi]
xchg byte [ebp + eax + 0x6a], dl
jo 0x100bbd42
sub dh, byte [edx - 0x51]
xor al, 0x51
pop esi
sbb byte [ebx + esi*2 + 0xd], al
int1
jns 0x100bbcc9
cwde
div dl
push ecx
salc
insd dword es:[edi], dx
dec ebp
popfd
inc eax
cmova edx, dword [ebx + 0x5f]
push ebp
mov ebp, 0xb97b8d98
xor al, 0xce
sub eax, 0x2de39ae9
cld
xor ah, byte [edx]
cli
retf 0x58f9
js 0x100bbcbe
cmp dword [esi + 0x10], edi
mov esp, 0x4aea1aec
inc esp
or eax, 0xf5df402a
lcall 0xf688, 0x8922d127
mov ecx, 0x991b7684
add ch, byte [esp + eax*8 + 0x47e6903d]
sub edi, dword [ebp*2 - 0x19ad61f6]
sti
sub al, 0xfd
insd dword es:[edi], dx
or bl, byte [esi + 0x2cfbe652]
std
loop 0x100bbd9e
pop edi
mov cl, 6
out 0xa2, al
sahf
pushal
push edi
outsd dx, dword [esi]
retf 0x1f02
and al, 0x24
call fcn.1001a983
lea eax, [ebx + 0x250b064b]
add esp, 0xc
cdq
pushal
setne ah
cdq
movzx edx, word [ebp - 0x1d4]
cwde
movsx ax, bl
mov dword [esp + 0x1c], edx
jmp loc.10012445
setne ah
das
mov eax, dword [ebp - 0x54]
movzx cx, bl
rcr ch, cl
xchg dl, ch
add eax, 0xf8
bt dx, cx
push 0x8caf81de
pushal
shrd cx, bp, cl
mov dword [ebp - 0x48], eax
cmc
aam 0x8a
lea edx, [edi*4 + 0x4c30c720]
cmc
mov ecx, dword [ebp - 0x54]
cdq
cmp dl, 0x8f
cwde
shrd dx, cx, 4
mov edx, dword [ecx + 0x78]
sub cx, 0xf6ca
mov dword [ebp - 0x4c], edx
shr ecx, 8
mov eax, dword [ebp - 0x54]
lea ecx, [esi - 0x1440739a]
mov ecx, dword [eax + 0x7c]
jmp 0x100bbc30

Function at 0x1014f20e
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x1018b3d3
pushal
mov byte [esp + 4], 6
lea esp, [esp + 0x44]
jge fcn.100dcffc
cwde
mov eax, dword [ebp - 4]
sal ecx, cl
clc
mov ecx, dword [ebp + 0x10]
pushal
clc
cmp ecx, dword [eax + 0xc]
mov word [esp + 4], 0xfe11
lea esp, [esp + 0x20]
ja 0x100af268
jb 0x100eaf13
aaa
aas
movsx eax, bl
aam 0xe7
mov edx, dword [ebp - 4]
sub ch, ch
sbb al, 0xea
rcl ch, 5
mov eax, dword [edx + 0xc]
bt ebx, 0x1f
bt edx, 2
lea ecx, [ecx - 0x8a1aca8]
mov ecx, dword [ebp - 4]
pushfd
pushfd
pushfd
pushfd
add eax, dword [ecx + 8]
mov byte [esp], cl
cmp ax, 0xa4ae
cmp dword [ebp + 0x10], eax
pushal
call fcn.1008fb62
push 0x898dac49
push dword [esp]
pushal
lea esp, [esp + 0x28]
jb 0x100eaf13
call fcn.10107b30
push es
pushal
xchg edx, eax
cld
sub dword [eax], ebx
invalid
Function at 0x1015637e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
lea esp, [esp + 0x30]
call fcn.1001ae40
cwde
add esp, 0xc
rdtsc
not dl
mov edx, dword [ebp - 0xac]
bts cx, ax
btc cx, di
jmp 0x101c580a
btc eax, 8
imul edx, edx, 0x2c
cmc
setbe ah
lea eax, [ebx - 0x6f944565]
btc eax, ebp
mov byte [ebp + edx - 0x36], 0
lea edx, [edx - 0x332dec86]
movzx cx, cl
cwde
bt dx, cx
mov eax, dword [ebp - 0xac]
not dh
imul eax, eax, 0x2c
btr dx, si
mov dh, 0x5b
movzx ecx, al
bswap dx
mov ecx, dword [ebp - 0xc0]
rcl dl, 1
mov dword [ebp + eax - 0x60], ecx
mov ecx, 0x9f05fad6
cwde
ror dl, cl
mov edx, dword [ebp - 0xac]
movsx eax, dl
mov ch, 0xf7
xchg cx, ax
imul edx, edx, 0x2c
not al
clc
rcl ecx, 1
bswap ecx
mov eax, dword [ebp - 0xc4]
lea ecx, [esi - 0x6d6028ef]
push 0xb3f271c6
pushal
pushal
mov dword [ebp + edx - 0x5c], eax
rdtsc
bswap dx
pushfd
mov dword [esp + 0x44], 8
btc cx, dx
pop eax
movzx dx, dl
btc ax, 3
mov ecx, dword [ebp - 0xb8]
btc eax, esi
btr edx, 0xa
mov dword [esp + 0x3c], ecx
movzx ax, cl
pop edx
mov edx, dword [ebp - 0xac]
btc eax, 0xb
imul edx, edx, 0x2c
pop eax
lea eax, [ebp + edx - 0x58]
mov byte [esp], 0x9d
jmp 0x10214f73
mov word [esp + 4], 0xf346
mov dword [esp + 0x30], eax
mov byte [esp], 0x18
lea esp, [esp + 0x30]
call fcn.1001ae40
push esp
lea esp, [esp + 4]
jmp 0x10224f47
rdtsc
and cl, dl
add esp, 0xc
bswap cx
cmc
setbe al
mov ecx, dword [ebp - 0xac]
lea eax, [ebp*8 - 0x10a39e03]
bts ax, dx
ror ah, 3
bts eax, ebp
imul ecx, ecx, 0x2c
push 0xc4f57edd
mov byte [ebp + ecx - 0x50], 0
stc
bt cx, ax
mov dword [esp], 0x10
not ch
rol ecx, cl
lea edx, [ebp - 0x1d0]
rol cl, 6
jge 0x1015892b
bts eax, edi
push edx
bt dx, 9
ror ch, 5
movsx cx, cl
mov eax, dword [ebp - 0xac]
btc cx, 2
bts ecx, 7
ror ch, cl
cmc
imul eax, eax, 0x2c
pushal
pushfd
lea esp, [esp + 0x24]
jle 0x100e69cf
lea ecx, [ebp + eax - 0x4f]
call fcn.101922a3
push 0xa2013658
call fcn.100034e3
xor byte [esp + ecx], 0xfb
jmp 0x379d9b40

Function at 0x1015ffa5
Capabilities:
Parse pe header

Disassembly:
mov byte [esp], bh
mov dword [esp + 0x50], 0
call fcn.10142610

Function at 0x1015ffb5
Capabilities:
Parse pe header

Disassembly:
xor edx, esi
add ecx, dword [eax + 0x3c]
shl dh, 1
lea edx, [ebp*4 + 0x5da7fd12]
mov dword [ebp - 0x54], ecx
shr edx, 0xf
clc
inc dx
lea edx, [ecx + 0x2c6c84e3]
mov edx, dword [ebp - 0x54]
push esi
cmp dword [edx], 0x4550
mov byte [esp], 0xfd
pushal
call fcn.10224b7e
shr dword [ecx + 0x68bc0c9c], 1
adc al, 5
mov al, 0x63
sar dword [ebx + ebp*2], 1
invalid
pushal
push 0x90507a68
cmp edx, 0x5a4d
push 0x203d27c5
mov byte [esp + 4], dh
lea esp, [esp + 0x2c]
je 0x101af513
pushfd
sub eax, eax
push dword [esp]
pushal
lea esp, [esp + 0x28]
jmp loc.1000fc63
not eax
not ch
mov eax, dword [ebp - 0x44]
add dx, 0x2123
mov ecx, dword [ebp + 0xc]
jmp 0x100ed422
Function at 0x1019c283
Capabilities:
Encode data using xor

Disassembly:
push edx
xchg ecx, eax
xor ebx, dword [esi]
outsd dx, dword [esi]
mov bl, ch
sub ecx, dword cs:[ebx - 0x2daafb24]
push esp
into
or ecx, dword [ebx + ecx*8]
or ch, bh
pop ebp
movsd dword es:[edi], dword [esi]
inc ebx
dec edi
cdq
pop eax
push 0x1b6efb1
xchg edx, eax
in al, dx
dec ebp
into
mov bh, byte [eax - 0x7a]
add al, ch
aas
mov esi, 0xa573587c
rol dword [esp + esi], cl
and byte [eax - 0x43], dl
sub ebx, dword [0xb2a5b487]
bnd jnp 0x1019c216
pop esi
std
cmc
loop 0x1019c201
salc
sbb al, 0x2f
div ecx
push es
invalid
mov byte [esp + 4], bh
lea esp, [esp + 0x30]
jne 0x1011fdf9
call fcn.101f1438
nop
push 0x58
mov bh, dh
sub byte [edx], dl
add eax, 0xf9cb9cef
sub dword [eax + 0x69ad63e5], ebx
and al, 0xd5
leave
jo 0x1019c2b3
loop 0x1019c2ad
std
outsb dx, byte [esi]
jecxz 0x1019c235
xor dword [edx + 0x31], 0x68653f72
out 0x62, al
scasb al, byte es:[edi]
inc bp
jb 0x1019c2e7
jb 0x1019c2f7
push 0x66ae62e6
inc ebp
pop es
outsd dx, dword [esi]
xchg ecx, eax
sbb al, 3
push 0x4d2918e8
xor esp, dword [ecx + 0x541b7190]
push eax
or al, 0x86
lodsd eax, dword [esi]
jb 0x1019c32d
dec edx
cmpsb byte [esi], byte es:[edi]
inc esp
add al, 0x48
cmp al, 0x27
invalid
mov cl, 0xb2
sahf
mov ecx, ss
pop ds
add eax, 0x8d791365
xchg esi, eax
mov ch, 0xdb
scasd eax, dword es:[edi]
mov ss, eax
cmp byte [esi - 0x767336d4], al
cmp eax, 0xb76a6d29
jnp 0x1019c37d
sar byte [eax], 1
xchg byte [ecx + ecx*8], ch
mov word [ecx + 0x6a6d293d], cs
mov bh, 0x7b
js 0x1019c31a
adc al, 0x8c
int3
mov esp, cs
xchg ebx, eax
das
loopne 0x1019c321
sbb al, 0x62
nop
sbb eax, 0x2d530125
and dl, 1
sbb al, 0xac
inc esp
push ss
dec ebx
nop
pop eax
mul dword [ebp + 0x4f391a79]
xor eax, 0x1434706b
jns 0x1019c33d
cmp dword [edi + 0x35], ecx
imul esi, dword [eax + 0x34], 0x14
cli
js 0x1019c2f2
and byte [edx], ah
mov ebp, 0xcdd04ddf
sbb bl, byte [eax + esi*4 + 0x14]
xchg ebp, eax
and byte [esi + 0x29314b0], dh
call 0xb5dcd65b
xchg ebx, eax
add ch, al
pop ss
adc eax, ebx
movsd dword es:[edi], dword [esi]
adc al, 0xb1
rcl byte [ebp + 0x21a11fe3], cl
invalid
invalid
adc dh, ch
pop edx
loopne 0x1019c35c
mov esi, 0xf995a7fd
mov ecx, 0x7a858c47
and ecx, esi
out 0x6a, eax
pop ecx
mov byte [edx], 0x7b
mov edi, 0x2362526d
stosd dword es:[edi], eax
leave
dec ebx
jp 0x1019c419
cmpsb byte [esi], byte es:[edi]
lea ebp, [ebx - 0xa]
sub dword [0x99ab9df9], eax
push 0x6eac23b7
stc
add byte [ecx - 0x26], dh
pop esp
xor dword [edi + 0x1d], edx
in eax, dx
adc eax, 0x5b234b17
push ds
dec ebp
adc byte [ecx + 0x584d0e4], ah
xchg byte [esi], ah
daa
invalid
mov ebx, 0x2c8b73cd
sbb ebp, dword [eax - 0x5fb42f37]
mov ah, 0xf7
pop esp
push ss
test al, 0x8b
add al, 0x12
mov eax, 0x7fdfdb55
test eax, 0xd7da4c88
mov eax, 0x60b971d9
and eax, 0xd80b93cf
aaa
inc ecx
std
or eax, 0x65251857
int 1
fbstp tbyte [eax]
stosd dword es:[edi], eax
push cs
cmp al, 0xd3
mov ebp, 0xa8d372fd
out 9, eax
push edx
sub al, 0xb7
mov bh, 0x44
inc esp
stosb byte es:[edi], al
les edi, [edi - 0x31527ed0]
stosd dword es:[edi], eax
xchg ecx, eax
clc
mov al, 0x83
jecxz 0x1019c45b
adc dword [edi + 0xb], 0x67
jne 0x1019c45a
salc
mov dword [0xb86add6c], eax
invalid