joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ed10
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x468318
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x42ed49
inc eax
mov dword [esi + 0x10], eax
jmp 0x42ee5c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x42ed5d
mov eax, 0xffffffc7
jmp 0x42ee5e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x42ed6e
cmp dword [esi + 8], eax
jne 0x42ed5d
cmp dword [esi + 8], eax
jne 0x42ed87
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x42ed87
mov eax, 0xffffffc7
jmp 0x42ee5e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x42ed9b
push eax
mov ecx, ebx
call fcn.0042e540
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.004037c0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x42edcc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.004037e0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0042dcb0
test eax, eax
mov dword [esp + 0x38], eax
je 0x42edff
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4807f0
call fcn.004039c0
mov eax, dword [esp + 0x38]
jmp 0x42ee5e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0042eb70
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x42ee43
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0042eb90
mov esi, eax
test esi, esi
jne 0x42ee73
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0042eb70
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x42ee15
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4807f0
call fcn.004039c0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4807f0
call fcn.004039c0
mov eax, esi
jmp 0x42ee5e

Function at 0x431f20
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x431f80
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x431f80
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x431f80
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x431f80
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x431fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x4380a0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x468948
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.004617ef
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00437a40
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0046171d
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0045dfd8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0045dfd8
push 1
push 0
push 0
mov ecx, esi
call fcn.0045df80
push 1
push 0
push 1
mov ecx, esi
call fcn.0045df80
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00461861
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x438220
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x468968
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.004617ef
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00437a40
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0046171d
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x4382e4
cmp dword [esp + 0x40], 1
jne 0x4382e2
cmp ecx, eax
jge 0x4382e4
mov eax, ecx
cmp eax, 0xc8
jge 0x4382f0
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.004380a0
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00461861
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x438a60
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4689d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045c3f8
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00461a97
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00462fb3
test eax, eax
je 0x438b7c
mov ecx, dword [esp + 0x3c]
call fcn.00461ac4
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x438b40
push edi
mov ecx, esi
call fcn.0045f128
mov ecx, esi
call fcn.00438ce0
cmp dword [esp + 0x38], 1
jne 0x438b75
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0045f263
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43b5b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43b5e3
push esi
call fcn.0043e6a0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43b5dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43b669
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43b652
mov eax, dword [esi + 8]
test eax, eax
je 0x43b607
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43b64e
cmp eax, 2
je 0x43b652
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43b5fa
cmp eax, 3
je 0x43b62d
cmp eax, 1
jne 0x43b5fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43b5fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43b5fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043b690
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43b678
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043b690
add esp, 4
pop esi
ret

Function at 0x446950
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4469b6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4469b6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x446997
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x446d40
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x446d78
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x447a60
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x447aa9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x447f20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x468ed0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00447ad0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00447b50
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00447b50
lea ecx, [esi + 0xc]
call fcn.0045add5
lea ecx, [esi + 0x10]
call fcn.0045add5
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004490e0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004490e0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004490e0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0045ae4a
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0045ae4a
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x45d1ee
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45d226
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045b2a5
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045b27d
jmp 0x45d232
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45e8e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45e922
call fcn.0046465e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45e922
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45e919
xor eax, eax
jmp 0x45e92a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045e930
pop edi
pop esi
pop ebx
ret 4

Function at 0x464b8e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x464bbc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x464bda
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00464af4
jmp 0x464bda
mov eax, dword [esi + 0x14]
test eax, eax
je 0x464bda
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00464af4
test edi, edi
mov eax, edi
jne 0x464bc4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x7c3155b6
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0xbc2145b
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x14fc22a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dx, 0x520f
cmp byte [edi], 0x23
pushal
jmp 0x14fceaa
push dword [esp]
lea esp, [esp + 0x28]
jne 0x14fc328
call fcn.0276f2b5
jmp 0x2770103
pushal
mov dword [esp + 0x1c], 0xffd88761
pushal
pushfd
call fcn.02776484
pop ds
retf 0x711e

Function at 0x14fea11
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
jne 0x176be2e
sal di, 0xa
dec edi
mov di, 0xca8b
jmp 0x1516bea
mov edi, dword [edx + 0x24]
pushfd
add edi, eax
cmc
cmp dx, 0xb9c2
mov byte [esp], dh
movzx ecx, word [edi + ecx*2]
lea esp, [esp + 4]

Function at 0x151412a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
lea esp, [esp + 0x18]
jne 0x14fc331
jmp 0x1769a6c
pushal
pushal
mov dword [esp + 0x3c], edi
jmp 0x2773e90
or al, 0x6b
out 0x44, eax
retf
mov word [esp], si
mov byte [esp], cl
mov dword [esp + 0x38], ebx
call fcn.0277645f
test eax, 0x3d386df2
mov gs, word [edi - 0x40]
aas
outsb dx, byte [esi]
sub eax, 0x85aefc8a
push 0xffffffffffffffa2
or dl, bl
fadd qword ss:[edx - 3]
scasw ax, word es:[edi]
adc dword [esi - 0x6e94f8ad], esp
int1
js 0x2773e68
mov dword [0xce1fcacc], eax
invalid
Function at 0x1514205
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ecx, edx
cmp cl, 0xa0
push ebx
cmc
mov dword [ebp - 0x10], ecx
bswap ecx
neg ch
pop ecx
mov ecx, dword [ebp + 0xc]
test dx, 0xfdbc
bt dx, 1
cmp ecx, 0xffff
pushfd
pushfd
mov word [esp], dx
lea esp, [esp + 0x2c]
jbe 0x14fe205
dec cl
pushfd
xchg ecx, edi
mov edi, dword [edx + 0x24]
xadd cx, bx
cmp ah, al
add edi, eax
cmc
mov ebx, dword [edx + 0x20]
pushal
sal cl, 5
sal cx, cl
movzx cx, cl
add ebx, eax
movsx cx, cl
lea ecx, [esp - 0x7c9cecc4]
bsf cx, sp
mov dword [ebp - 8], 0
test ch, 0xec
rol cx, cl
pushfd
mov ecx, dword [edx + 0x18]
test ch, ah
clc
stc
cmp ecx, dword [ebp - 8]
mov word [esp + 4], bx
lea esp, [esp + 0x28]
jbe 0x1514103
add si, dx
sub ecx, 1
pushal
or edi, ebx
mov dword [ebp - 4], ecx
xadd di, cx
mov ecx, dword [ebp - 8]
stc
neg si
add ecx, dword [ebp - 4]
cmp ebp, edx
shr ecx, 1
neg di
mov edi, dword [ebx + ecx*4]
shl si, cl
lea esi, [edx*8 + 0x751502e9]
shl si, cl
add edi, eax
push 0x4c41ad16
mov esi, dword [ebp + 0xc]
jmp 0x1516595
pushfd
cmc
clc
test edx, edx
mov byte [esp], 0xad
pushfd
mov dword [esp], 0x96b5472a
lea esp, [esp + 8]
je 0x1514103
shld cx, si, cl
pushal
btr cx, dx
not cx
add edx, eax
or ch, 0xfd
mov ecx, dword [esi + 0x7c]
pushfd
jmp 0x14fd854
stc
push 0xd21146a5
push 0xc153235d
cmp dl, cl
sub ecx, dword [edx + 0x10]
push esp
cmp ecx, dword [edx + 0x14]
mov byte [esp], bl
pushal
push 0x5a53ca31
call fcn.0276f640
mov byte [esp], bh
lea esp, [esp + 8]
je 0x1514103
sbb dl, 0xea
mov esi, dword [eax + 0x3c]
sal edx, cl
lea edx, [0xb91c91a8]
cmc
rol edx, 7
add esi, eax
btc dx, si
bsf edx, esi
mov edx, dword [esi + 0x78]
pushfd
sub esp, 0xfffffffc
jp 0x14fdb96
jl 0x1766004
clc
test edx, edx
jmp 0x15148a5
das
call fcn.0176aa84
inc eax
daa
sbb ebp, dword [esi + 0x32]
mov ah, 0x70
div byte [ebp + 0x26]
notrack jmp 0x15148cf
inc edx
or ebx, dword [edx]
dec edi
dec ecx
jnp 0x151488c
and edx, dword [eax + ebp*4 - 0x6e]
in eax, dx
push esp
pop esi
mov ecx, dword [ebx]
mov esp, 0xa57580d4
cmp ch, al
mov dword [0x1e47e40d], eax
xor al, 0x26
inc ebx
adc byte [edi], dh
sub byte [0xc5540e9e], 0x4c
push ds
or al, 0xf2
jg 0x15148ac
out 0x51, eax
in al, 0x94
ret 0x2838
pushal
push 0xd30006b0
test edx, edx
jmp 0x277646d
test ch, ah
mov dword [ebp - 0x10], ecx
setne cl
test al, 0x5f
bswap ecx
push 0xf07d1ec4
mov ecx, dword [ebp + 0xc]
stc
clc
cmp ecx, 0xffff
call fcn.01769bf6
jmp fcn.014feb80
mov byte [esp + 4], 0x59
lea esp, [esp + 0x44]
je 0x1514103
bts ecx, eax
add edx, eax
clc
shr cx, 0xd
bts cx, si
add cx, dx
mov ecx, dword [esi + 0x7c]
pushal
push ecx
mov word [esp + 0xc], 0x6882
jmp 0x27776c9
pushal
jmp 0x276fc62
add ecx, edx
pushal
push dword [esp + 4]
jmp 0x1768e49
Function at 0x1769935
Capabilities:
Resolve function by parsing pe exports

Disassembly:
das
push esi
not ah
shld ax, cx, cl
bswap eax
push edi
rcl ah, 4
bt bp, si
xor ax, 0x99c7
aaa
push ebx
pushal
movsx eax, cl
mov al, byte [esp + 4]
movzx ax, dl
mov dword [esp + 0x1c], edx
daa
mov eax, dword [ebp + 8]
pushfd
mov byte [esp], 0x1a
test eax, eax
push ecx
pushfd
jmp fcn.015141a1
rol ax, cl
aam 0xbc
btr ax, cx
shld ax, cx, 2
push ebp
not bp
test bl, ah
dec ebp
mov ebp, esp
aam 0xb4
clc
or al, ah
btr ax, 2
sub esp, 0x18
sete ah
ja 0x1768e6f
push esi
aaa
jmp 0x27759be
and ah, 0xcd
push edi
movzx ax, cl
rol ax, 9
rol ah, 5
push ebx
rol ax, cl
push edx
mov ah, dl
mov eax, dword [ebp + 8]
clc
stc
bt si, 0xf
test eax, eax
pushfd
call fcn.01514205

Function at 0x1769f05
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x176c174
cmp ecx, 0xffff
jmp 0x1764612
lea esp, [esp + 0x28]
jbe 0x14fe205
rol di, cl
mov edi, dword [edx + 0x24]
not ch
movzx cx, al
add edi, eax
shr bl, cl
mov ebx, dword [edx + 0x20]
sbb cl, 0x1a
lea ecx, [ebp + 0x16623832]
add ebx, eax
movzx ecx, cl
setp cl
mov dword [ebp - 8], 0
adc cx, 0x6683
mov ecx, dword [edx + 0x18]
bt ebx, eax
bt esi, edi
clc
cmp ecx, dword [ebp - 8]
call fcn.01515aea

Function at 0x276f640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], ah
test edi, edi
lea esp, [esp + 4]
pushfd
jmp 0x14fc561
movzx di, al
bt cx, dx
mov edi, dword [edx + 0x1c]
stc
add edi, eax
clc
stc
pushfd
clc
mov edi, dword [edi + ecx*4]
jmp 0x15115ec
lea esp, [esp + 0x34]
jae 0x1514103
push 0xe0bf6865
lea esp, [esp + 4]
jmp 0x1516c01

Function at 0x277495f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [edx + 0x1c]
push 0x362c4c19
test ch, 0x51
cmc
add edi, eax
test ah, ch
mov dword [esp], 0xe8155030
bt cx, 2
mov edi, dword [edi + ecx*4]
mov byte [esp + 4], ch
test edi, edi
pushal
mov dword [esp], 0xd8ca0472
mov byte [esp], ah
lea esp, [esp + 0x28]
je 0x1514103
cmp cl, 0xfc
cmp dl, bh
push 0xa69ba797
pushfd
add eax, edi
clc
clc
test sp, 0x9b7a
cmp eax, edx
call fcn.02772bab

Function at 0x2775007
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x28]
jne 0x176be2e
sbb di, ax
mov edi, dword [edx + 0x24]
cmp si, dx
jmp 0x2774ff1
pushal
stc
add edi, eax
cmp ch, ah
cmp ch, ch
movzx ecx, word [edi + ecx*2]
neg edi
mov edi, dword [edx + 0x1c]
jmp 0x27770c5
mov byte [esp], 0xd5
lea esp, [esp + 0x58]
ja 0x14ff6d8
pushfd
lea esp, [esp + 4]
jb 0x1764f0e
test al, dl
clc
cmp byte [edi - 1], 0
push 0x52b73bf1
pushal
pushfd
jmp 0x14fc665
Function at 0x27777f2
Capabilities:
Encode data using xor

Disassembly:
push 0x49437160
mov dword [esp + 0x20], eax
call fcn.014fde7a
jmp dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pushfd
mov esp, ebp
push esi
bswap bp
pop ebp
pop ebp
pushal
push 0xc5b62228
pushfd
mov byte [esp], ch
push dword [esp + 0x28]
ret 0x34
not dl
mov edi, ebx
pop edx
mov di, 0x6368
pop ebx
push edi
lea esi, [edx*8 + 0x2ae13518]
mov edi, dword [esp + 4]
pop esi
pushal
mov esi, dword [esp + 0x24]
jmp 0x14ff030
ror edi, cl
shrd dx, sp, 0xd
xadd esi, ebx
xor eax, eax
bswap edx
jmp 0x1511654
pushfd
pushfd
lea esp, [esp + 8]
jne 0x176be2e
sbb edi, 0x444133d4
mov edi, dword [edx + 0x24]
cmc
add edi, eax
cmp cx, sp
movzx ecx, word [edi + ecx*2]
pushfd
mov di, word [esp]
bsr edi, esp
pop edi
mov edi, dword [edx + 0x1c]
call fcn.01511ff0
push ebx
xchg esi, eax
mov ch, 0x4e
push ss
mov ah, 0x70
salc
or eax, 0xb7a63e75
in al, 0xda
jle 0x151657b
sbb byte [eax], dh
popfd
dec ebx
sti
jno 0x1516588
nop
inc ebx
dec edx
pop ebx
mov byte [0xc7a6c196], al
stosb byte es:[edi], al
adc ebp, dword [ecx]
inc ecx
xlatb
lodsd eax, dword [esi]
invalid
shrd cx, sp, cl
mov ch, bl
mov edi, eax
sub cx, 0x6f06
loope 0x1516505
fisttp qword [ecx - 0x167e9939]
push es
outsd dx, dword [esi]
shr cl, cl
mov ecx, 0x104
add al, 1
add byte [eax], al
bt bp, si
call fcn.015149ab
pushfd
mov dword [esp + 0x24], eax
not al
pushal
call fcn.014fc3b0
nop
mov esp, 0xb4157be2
jo 0x1516578
sal dword [edi - 0x4afc91c2], 1
std
aad 0xd8
or dword [ebp + 0x18f34651], esp
in eax, dx
or al, 0xed
scasd eax, dword es:[edi]
xchg ebp, eax
sbb al, 0x47
mov ecx, 0x89a376e8
jg 0x1516618
cld
inc esi
leave
mov ebx, 0xe2321a51
imul edx, dword [eax - 0x2603edf9], 0xc9d60df0
push ebx
cmp ch, byte [esi + 0x41dba98a]
aas
inc esi
mov esp, 0x4ae0dc5c
int3
mov eax, dword [0xe9ef2ea3]
lcall 0x1b46, 0xe464a15f
inc esp
xchg dword [ecx], edi
push ds
ret 0x50ed
pushal
test bh, 0xd6
cmc
cmp ecx, dword [ebp - 8]
pushal
mov byte [esp + 8], al
lea esp, [esp + 0x40]
jbe 0x1514103
lea edi, [esp - 0x3fd400c3]
shld si, cx, cl
sbb si, dx
sub ecx, 1
cmp al, 0x2a
inc si
sub di, 0x719c
mov dword [ebp - 4], ecx
push 0xab3b0ac6
call fcn.0176be01
popfd
xor dword [edi + 0x708f2b50], 0xffffffa3
cmpsb byte [esi], byte es:[edi]
or dword [edi - 0x1ec1f36d], ebp
invalid
jmp 0x15164c6
pushal
jmp 0x14fc7f0
lea esp, [esp + 0xc]
jb 0x1764f0e
cmc
cmc
cmp byte [edi - 1], 0
jle 0x176b8ae
push 0x8847c813
lea esp, [esp + 4]
jne 0x176be2e
bsf di, bp
mov edi, dword [edx + 0x24]
stc
clc
cmp al, ch
cmp bp, di
add edi, eax
stc
cmc
movzx ecx, word [edi + ecx*2]
btc di, dx
test si, 0x646d
mov edi, dword [edx + 0x1c]
test dh, bh
pushal
add edi, eax
pushal
mov edi, dword [edi + ecx*4]
cmc
test dl, ah
test edi, edi
mov word [esp + 8], dx
call fcn.02773b87
or ah, ah
pop ebx
scasb al, byte es:[edi]
add cl, byte [esi + 0xfcc366f]
xor dword [edx + 0x2e83ee06], 0x7f50314d
or al, 0x2a
xor byte [ecx - 0x50abdde8], 0x92
mov esp, 0x38d629a2
pop ss
sbb byte [ecx - 0x1a5972ef], cl
adc eax, 0xe0bc4ae5
cmp esp, ecx
invalid