joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe3abf6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
lea esp, [esp + 0x30]
jne 0xe3ca25
pushfd
test dx, dx
bt edi, eax
test al, bh
cmp dword [ebp - 0x70], 0
push 0x780d50f8
pushfd
push 0x804ec87
pushfd
lea esp, [esp + 0x14]
je 0xe3ca25
cmc
cmp dword [ebp - 0x90], 0
pushal
call fcn.00e393a3
lea esp, [esp + 0x34]
je 0xe38f98
sar ah, 7
movzx eax, dl
shld ax, cx, cl
mov eax, dword [ebp - 0x44]
cmc
push 0xa681f951
push dword [esp]
sub ecx, ecx
sal cl, 5
ror cl, 5
mov cl, byte [eax + 0xa]
clc
mov dword [esp + 4], 0xf9217303
test ecx, ecx
pushal
jmp 0xe3678d

Function at 0xe3ac62
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x34]
jne 0xe38fe0
jmp 0xe33848

Function at 0xe3ac98
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x4a17bfdf
mov eax, dword [ebp - 0x104]
not cl
setb cl
bswap cx
mov ecx, dword [eax + 0x3c]
pushfd
call fcn.00e37621

Function at 0xe3adaf
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
xor eax, eax
sub esp, 0xfffffff8
cmc
pushal
clc
mov al, byte [edx + 9]
cmp al, cl
cmp eax, 0x4c
pushfd
lea esp, [esp + 0x24]
jne 0xe3ca25
jmp 0xe3a17f

Function at 0xe3adb4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x38]
jbe 0xe335cd
dec eax
aam 0x64
mov eax, dword [ebp - 0xbc]
xor cl, 0xe9
cmc
add eax, dword [ebp - 0x74]
rol cl, cl
shr cx, 1
add ecx, ecx
inc ch
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x48], 0
jmp 0xe34183

Function at 0xe3addb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
jmp 0xe38725
call fcn.00e329f1
cmp eax, dword [ebp - 0x88]
jmp 0xe36acd

Function at 0xe3ae69
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
lea esp, [esp + 0x2c]
je 0xe359a6
btc dx, bx
shl dl, 4
ror al, 2
or al, 0x9f
mov eax, dword fs:[0x30]
shrd dx, ax, 0xd
cmp ax, cx
bsf edx, esp
mov eax, dword [eax + 0xc]
shr dh, 1
xor ch, 0xe2
mov dword [ebp - 0xf4], eax
btr dx, 0xf
mov dword [ebp - 0xf8], 0
btc cx, 5
pushal
xor eax, esp
mov dword [ebp - 0xf0], 0
btc ax, ax
shrd ax, ax, cl
adc ah, 0xb7
sar dx, 0xb
mov eax, dword [ebp - 0xf4]
sal cx, cl
pop ecx
add cl, 0xea
or cl, al
mov ecx, dword [eax + 0xc]
call fcn.00e3c06f
jmp 0xe32b87

Function at 0xe3af41
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp - 0xdc]
pushfd
mov word [esp], dx
mov dword [ecx], eax
lahf
lea eax, [esi + 0x5657ef8]
lea eax, [ebp - 0x128]
call fcn.00e3ab50
mov dword [ebp - 0xb4], eax
push dword [esp]
cmp dword [ebp - 0x12c], 0
push dword [esp]
push esi
lea esp, [esp + 0x10]
je 0xe34450
not cl
mov dword [ebp - 0x12c], 0
bswap eax
pushfd
mov ecx, dword [ebp - 0x7c]
jmp 0xe349af

Function at 0xe3b0a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp bl, 0x4c
pushfd
pushfd
lea esp, [esp + 0xc]
jne 0xe321d4
sal bl, cl
call fcn.00e3251c

Function at 0xe3b173
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
pushfd
lea esp, [esp + 0x4c]
je 0xe34d80
call fcn.00e38bba
Function at 0xe3b1d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
bt esi, 0x16
pushfd
test eax, eax
pushfd
mov byte [esp + 8], al
call fcn.00e33335
push dword [esp]
lea esp, [esp + 0x28]
je 0xe35674
bts ax, dx
mov eax, dword [ebp - 0x104]
test bl, 0xc5
bt esi, 0x1b
jbe 0xe36433
mov ecx, dword [eax + 0x30]
pushal
push dword [esp]
pushfd
sub edx, edx
bswap dx
ror dl, 2
mov dx, word [ecx + 2]
pushfd
stc
pushfd
cmp edx, 0x45
jmp 0xe35666
mov byte [esp], 0x65
lea esp, [esp + 0x30]
jne 0xe3b389
daa
mov eax, dword [ebp - 0x104]
shl cl, cl
not cx
sbb ch, 0x74
mov ecx, dword [eax + 0x30]
clc
cmp di, 0xe5b5
sub edx, edx
not dx
bt di, si
mov dx, word [ecx + 4]
clc
cmp edx, 0x72
pushal
call fcn.00e3a11d
test ch, ah
dec cl
not cx
mov ecx, dword [eax + 0x30]
pushfd
call fcn.00e32186
bsr eax, eax
mov eax, dword [ebp - 0x44]
push dword [esp]
pushal
call fcn.00e3645a
jmp 0xe34015

Function at 0xe3b292
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0xe3ca25
lahf
lea eax, [ebp - 0x128]
pushal
mov dword [esp + 0x1c], eax
pushal
pushfd
jmp 0xe3b792

Function at 0xe3b359
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00e3abf6
cmp dh, cl
test edx, edx
pushal
jmp 0xe35bae

Function at 0xe3b443
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx ax, al
mov eax, dword [ebp - 0xec]
mov word [esp + 4], 0x5a56
call fcn.00e39aa4

Function at 0xe3b459
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00e3c0b6
bsr cx, sp
mov eax, dword [ebp - 0x100]
pushfd
bswap cx
mov ecx, dword [eax + 0x30]
test ah, ah
pushal
pushal
sub edx, edx
xor dh, 0x6f
mov dx, word [ecx + 8]
clc
cmp edx, 0x4c
push 0x66f89203
push edi
lea esp, [esp + 0x4c]
jne 0xe38fe0

Function at 0xe3b7b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
push 0xbdd90cce
lea esp, [esp + 0x18]
je 0xe39b4b
or al, ah
lahf
shl dl, 4
bswap dx
mov edx, dword [ebp - 8]
neg al
mov eax, dword [ebp - 0x64]
shld ecx, edx, 5
mov ecx, dword [ebp - 0xbc]
call fcn.00e3b1d6
bt edx, 0x18
call fcn.00e33f8f

Function at 0xe3b7e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
push 0xbdd90cce
lea esp, [esp + 0x18]
je 0xe39b4b
or al, ah
lahf
shl dl, 4
bswap dx
mov edx, dword [ebp - 8]
neg al
mov eax, dword [ebp - 0x64]
shld ecx, edx, 5
mov ecx, dword [ebp - 0xbc]
call fcn.00e3b1d6
bt edx, 0x18
call fcn.00e33f8f

Function at 0xe3b864
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [eax + 0x30]
push ebx
cmp ch, bl
stc
mov word [esp + 4], bp
xor edx, edx
rcl dh, cl
rol dh, cl
mov dx, word [ecx + 0xa]
call fcn.00e3c20a

Function at 0xe3b9b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 8], 0x1a
test edx, edx
pushfd
call fcn.00e3466d
pushfd
mov word [esp], 0x82df
mov dword [ebp - 0x88], ecx
jmp 0xe3c928
call fcn.00e39a9f

Function at 0xe3bbe9
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushal
lea esp, [esp + 0x28]
jne 0xe321d4
cmp bl, 0x44
jmp 0xe39bc5
mov word [esp], 0x732e
jmp 0xe3a1d6
Function at 0xe3bc02
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
je 0xe35cc8
shld cx, cx, cl
das
sbb ecx, 0x45e33447
mov eax, dword [ebp - 0x104]
neg cl
lea ecx, [ecx*2 + 0x7c99377d]
mov ecx, dword [eax + 0x30]
stc
stc
xor edx, edx
jmp 0xe3859d
shr dh, cl
sub dl, 0x15
clc
mov dx, word [ecx + 6]
test ah, 0xe2
cmp edx, 0x4e
call fcn.00e38d98
clc
sub eax, eax
adc al, 0x6d
cmp bl, cl
dec al
sal al, 3
mov al, byte [edx + 6]
jmp 0xe39469
jmp 0xe3b941
cmp eax, 0x2e
push esp
lea esp, [esp + 8]
jne 0xe3ca25
btc cx, dx
pushal
seto ch
mov ecx, dword [ebp - 0x44]
clc
xor edx, edx
or dl, 0x21
or dl, 0x44
push esi
inc dl
mov dl, byte [ecx + 7]
call fcn.00e38fc6
jmp 0xe35ad2

Function at 0xe3bc95
Capabilities:
Execute anti-debugging instructions

Disassembly:
test al, 0x3b
mov dword [ecx + eax*4], edx
lea esp, [esp + 4]

Function at 0xe3be99
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push 0x65bff4cb
call fcn.00e3438b
mov dl, byte [ecx + 0xa]
call fcn.00e3b359
pushal
mov dword [edx + 1], eax
xadd ax, dx
aam 0xf2
mov edx, dword [ebp - 0xac]
neg ax
add edx, 0x10001f04
pushfd
rcl ax, 0xf
mov eax, dword [ebp - 0x9c]
stc
mov dword [edx + 1], eax
bt esp, ebp
sub al, 0x31
bsr ax, dx
mov eax, dword [ebp - 0xc]
push dword [esp + 8]
test ax, 0x83c7
add esp, 0x30
jae 0xe326e3
pushfd
mov dword [edx + 6], eax
aad 0xe
shr dh, cl
mov edx, dword [ebp - 0xac]
btc eax, 0x1a
sar eax, 3
cwde
add edx, 0x10001f1a
pushal
mov eax, dword [ebp - 0xb8]
jmp fcn.00e39058
aad 0xa7
shld eax, esi, 0xd
bts ax, 1
and ax, di
add edx, 0x10001efc
cmp cl, ch
shrd ax, di, 5
add al, bh
bt bx, 0xf
mov eax, dword [ebp - 0x7c]
jnp 0xe3c5f3
push edx
pushfd
mov dword [eax], edx
rol dx, 2
neg al
bt ebx, ecx
ror dx, 1
mov edx, dword [ebp - 0xac]
inc al
add edx, 0x10001f34
bt bx, 0xd
shld ax, ax, cl
aad 0xa5
mov eax, dword [ebp - 0xdc]
cmc
bt ax, sp
test al, al
sub eax, edx
bt edx, esp
mov byte [esp + 4], ah
sub eax, 5
jmp 0xe3601a
lea esp, [esp + 8]
je 0xe3ca25
pushfd
movsx dx, al
mov edx, dword [ebp - 0xac]
pushfd
lea esp, [esp + 8]
jmp 0xe3b3d1
jmp 0xe3c962
clc
mov dword [eax], edx
bts ax, cx
neg dx
inc dx
cwde
mov edx, dword [ebp - 0xac]
aaa
add edx, 0x10001f34
inc ah
bsf ax, si
das
rcl eax, cl
mov eax, dword [ebp - 0xdc]
pushfd
push ebp
call fcn.00e38ee0
Function at 0xe3bffd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], al
lea esp, [esp + 8]
je 0xe38c4d
movzx ax, dl
shrd ax, sp, 0xf
cmp sp, sp
mov eax, dword [ebp - 0x104]
movzx cx, bl
movsx cx, cl
stc
movzx cx, dl
mov ecx, dword [eax + 0x30]
call fcn.00e33f47
lea esp, [esp + 0xc]
je 0xe3ca25
call fcn.00e32216
cmp edx, 0x6c
jmp 0xe3435c
jmp 0xe32b45
jmp 0xe34c5b
lea esp, [esp + 0x20]
je 0xe3ca25
call fcn.00e3590d
push 0x61f87b09
lea esp, [esp + 4]
je 0xe3ca25
bt cx, bp
cmp dword [ebp - 0x90], 0
pushal
jmp 0xe348a7
test edx, edx
pushfd
mov word [esp + 4], 0x974a
pushfd
lea esp, [esp + 0x10]
je 0xe38f98
and eax, esi
bsr eax, eax
mov eax, dword [ebp - 0x44]
cmc
stc
pushal
bt bp, dx
xor ecx, ecx
adc cl, 0x18
shl cl, 1
mov cl, byte [eax + 0xa]
test si, dx
test ecx, ecx
push dword [esp + 0xc]
lea esp, [esp + 0x24]
jne 0xe3ca25
cmc
pushal
cmp dword [ebp - 0x70], 0
lea esp, [esp + 0x20]
jo 0xe3548b
je 0xe3ca25
clc
push esi
bt ebx, edx
test bl, 0x5f
cmp dword [ebp - 0x90], 0
push dword [esp]
pushfd
jmp 0xe32e5c
stc
jmp 0xe38f57

Function at 0xe3c003
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xc], bp
mov dword [esp + 0x50], ecx
call fcn.00e34fe1

Function at 0xe3c01a
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dword [ecx], 0
push esi
call fcn.00e39d02
call fcn.00e33de1
shld cx, cx, 0xa
ror cl, 6
mov dword [ebp - 0x130], eax
shld cx, dx, 7
cmp dx, sp
mov ecx, dword [ebp - 0x130]
bt sp, 0xf
jmp 0xe34eac

Function at 0xe3c0b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
je 0xe33541
pushal
jmp 0xe321ca

Function at 0xe3c10a
Capabilities:
Execute anti-debugging instructions

Disassembly:
test si, 0xd5e7
xor edx, edx
push ecx
push 0xa0446f2a
mov dx, word [ecx + 6]
cmp dh, 0x2e
cmp edx, 0x4e
mov byte [esp], 0xc6
push 0xc056e24c
lea esp, [esp + 0x50]
jne 0xe3b389
sal ch, 3
das
mov eax, dword [ebp - 0x104]
pushal
pushal
mov ecx, dword [eax + 0x30]
stc
pushfd
call fcn.00e34eba

Function at 0xe3c162
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, edx
cmp di, 0x906
adc dl, dh
mov dx, word [ecx + 0x16]
test bh, 0x30
mov byte [esp + 4], 0x65
bt si, sp
pushfd
cmp edx, 0x4c
push dword [esp]
lea esp, [esp + 0x28]
jne 0xe3b389
lea esp, [esp + 0x50]
je 0xe33c69
bsf ecx, esi
xor ax, 0x9d6b
pushal
bts ax, 0xd
mov eax, dword [ebp - 0x104]
shr cl, cl
mov ecx, dword [eax + 0x30]
clc
mov word [esp], bp
stc
jmp 0xe33c3f

Function at 0xe3c20a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x38]
jne 0xe38fe0
cwde
mov cx, 0xe7e3
setle ah
mov eax, dword [ebp - 0x100]
not cx
bswap cx
mov ecx, dword [eax + 0x30]
pushal
push 0xafcf5126
pushfd
lea esp, [esp + 0x28]
jmp 0xe3a517
stc
cmp edx, 0x2e
pushfd
pushal
jmp 0xe34d1b

Function at 0xe3c2ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
je 0xe34b21
xadd ah, ch
dec al
pushal
jmp 0xe35dea

Function at 0xe3c3c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub eax, edx
stc
call fcn.00e3afdb
test di, dx
jmp 0xe32cb4
Function at 0xe3c3fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0x44]
push esp
pushal
sub eax, eax
mov byte [esp], 0xd3
lea esp, [esp + 0x24]
jmp 0xe3a185
call fcn.00e3a554
lea esp, [esp + 8]
jo 0xe39535
je 0xe3a19b
jmp 0xe371fe

Function at 0xe3c52b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x90], 0
pushal
call fcn.00e38824
jmp 0xe369e6
mov byte [esp], al
lea esp, [esp + 4]
je 0xe3b96e
pushfd
lea esp, [esp + 4]
jmp 0xe38af9

Function at 0xe3c5f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
add dx, 0x8087
mov edx, dword [ecx + 0x34]
call fcn.00e37309

Function at 0xe3c68d
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00e3a943
cmp bl, 0x6c
pushfd
push 0x109461bd
push 0x66ce54b0
lea esp, [esp + 0x10]
je 0xe32d92
clc
call fcn.00e38970
shrd dx, si, 1
rcl dl, 3
mov dx, word [ecx + 6]
test dh, ch
test ah, ah
cmp edx, 0x6e
pushal
mov byte [esp], dh
call fcn.00e3bc02
push 0xc1181aea
mov byte [esp], 0xab
jmp 0xe32cc1
or dl, ah
rcr dl, cl
bsf edx, edx
dec dl
mov edx, dword [ebp - 0x104]
cmc
pushfd
stc
add edx, 0x3c
bt bx, cx
cmp dword [ebp - 0x108], edx
push edi
mov byte [esp], 0x9c
mov word [esp + 4], 0x1140
lea esp, [esp + 8]
je 0xe370d0
stc
bswap ax
clc
inc al
mov eax, dword [ebp - 0x108]
pushfd
test al, dh
pushfd
pushfd
cmp eax, dword [ebp - 0xf8]
jmp 0xe3209b
rcl cl, cl
mov ecx, dword [ebp - 0x108]
cdq
pushal
jmp 0xe3b2af
seto al
mov eax, dword [ebp - 0xf4]
bts cx, si
jmp 0xe38d73
not dh
mov ecx, dword [eax + 0xc]
shld dx, di, cl
mov dword [ebp - 0xfc], ecx
lea esp, [esp + 0xc]
je 0xe371c6
aas
daa
mov eax, dword [ebp - 0xfc]
ror edx, 0xd
not dh
mov dword [ebp - 0x100], eax
xadd cx, dx
mov ecx, dword [ebp - 0x100]
call fcn.00e3c5f8
pushal
mov ecx, dword [eax + 0x3c]
push 0xf2ff0a4f
mov dword [esp + 4], ebx
mov dword [ebp - 0x108], ecx
pushfd
push dword [esp + 0x10]
lea esp, [esp + 0x34]
jmp 0xe36ec9
mov word [esp], bp
sub ecx, 0x50
movzx dx, bl
mov dword [ebp - 0xec], ecx
rdtsc
mov edx, dword [ebp - 0x2c]
push dword [esp + 0xc]
movzx ax, dl
call fcn.00e3b443
jmp 0xe32edf
cmp dword [ebp - 0xfc], edx
push dword [esp]
push ecx
jmp 0xe3a8f1

Function at 0xe3c79c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0x120]
call fcn.00e371d8
Function at 0xe3ca6c
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc ax, ax
btc ax, cx
das
mov eax, dword [ebp - 0x44]
push 0x7e681f41
mov dword [esp], 0xcf38efb0
bt bp, cx
cmc
sub ecx, ecx
adc cl, al
sub cl, bh
mov cl, byte [eax + 9]
pushfd
mov byte [esp], bl
cmp ecx, 0x6c
mov byte [esp], 0x76
push esp
pushal
lea esp, [esp + 0x2c]
je 0xe3a19b
movzx dx, dl
bswap dx
shld dx, si, 2
or dl, cl
mov edx, dword [ebp - 0x44]
call fcn.00e3adaf
bsr dx, di
mov edx, dword [ebp - 0x44]
cmp esp, ebp
bt sp, bp
pushal
xor eax, eax
dec al
add al, cl
rcl al, cl
mov al, byte [edx + 8]
mov byte [esp + 4], 0x1f
stc
push edx
cmp eax, 0x6c
pushfd
lea esp, [esp + 0x28]
je 0xe33dff
bswap cx
bts cx, 4
bts cx, 5
mov ecx, dword [ebp - 0x44]
call fcn.00e366eb
add edx, 0x100022f6
call fcn.00e35c0b
clc
adc ecx, esp
pushfd
mov ecx, dword [ebp - 0x44]
mov word [esp], si
cmc
sub edx, edx
sub dl, bl
shr dl, 6
mov dl, byte [ecx + 0xa]
call fcn.00e3bffd
and edx, 0xffff
stc
cmc
clc
test edx, edx
pushfd
lea esp, [esp + 0x40]
jne 0xe3928c
pushal
lea esp, [esp + 0x20]
jmp fcn.00e372c1
stc
cmp ch, cl
stc
cmp ecx, 0x44
mov dword [esp + 4], 0xc8f77585
lea esp, [esp + 8]
jne 0xe3ca25
test bh, 0x13
jmp 0xe39c0d

Function at 0xe3caa2
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00e321da
mov byte [esp], 0x55
pushfd
cmp edx, 0x4c
mov byte [esp + 4], cl
pushal
jmp 0xe333aa
Function at 0x6283700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0628378f
jae 0x628370e
xor ecx, ecx
call fcn.0628378f
jae 0x628373d
xor eax, eax
call fcn.0628378f
jae 0x628374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0628378f
adc al, al
jae 0x628372f
jne 0x6283779
stosb byte es:[edi], al
jmp 0x6283711
call fcn.0628379b
sub ecx, ebx
jne 0x6283756
call fcn.06283799
jmp 0x6283775
lodsb al, byte [esi]
shr eax, 1
je 0x6283783
adc ecx, ecx
jmp 0x6283772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.06283799
cmp eax, 0x7d00
jae 0x6283772
cmp ah, 5
jae 0x6283773
cmp eax, 0x7f
ja 0x6283774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6283711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x62decb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffffffffffff
lea edx, [ebx + 8]
push dword [edx + 0x34]
lea esi, [edx - 8]
add dword [esp], ebx
pop ecx
add edx, dword [ecx + 0x78]
add esi, dword [edx + 0x18]
pop ecx
lodsd eax, dword [esi]
add ecx, 1
cmp dword [edx + 0x10], ecx
lea edi, [eax + ebx + 4]
je 0x62ded30
nop
cmc
and al, 0xff
xor eax, eax
imul eax, eax, 0xf
push eax
movzx eax, byte [edi - 4]
neg eax
sub edi, 0xfffffff1
add dword [esp], eax
lea edi, [edi - 0xe]
pop eax
cmp byte [edi - 4], 0xa
jmp 0x62dee3e
ret
add ecx, ecx
add edi, ebx
add ecx, ebx
mov esi, dword [edx + 1]
mov ax, word [ecx + esi]
cwde
push dword [edi + eax*4]
add dword [esp], ebx
pop esi
mov eax, dword [esp]
add esp, 8
jmp eax
ja 0x62dece1
mov eax, 0xfc8e2a94
xor dword [esp - 4], eax
mov eax, dword [esp + 4]
sub dword [esp - 4], eax
jne 0x62decce
add edx, 0x1b
push dword [edx - 7]
pop edi
jmp 0x62ded49

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405e0f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a2c], 0
push esi
jne 0x405e46
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405e20
mov dword [ecx*4 + 0x422a28], eax
inc ecx
cmp ecx, 0x100
jl 0x405e1b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e77
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a28]
xor eax, esi
inc ecx
dec edx
jne 0x405e59
pop edi
not eax
pop esi
ret 0xc

Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x421870
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
out 0xe4, al
pushal
invalid
mov eax, 0x49693df2
outsd dx, dword [esi]
xlatb
xor dh, al
push ebp
inc ecx
lodsb al, byte [esi]
dec eax
cmp eax, 0xd129564c
push ecx
inc ebx
je 0x401115
jae 0x401109
inc ebx
adc al, 0x4d
enter 0xffffffffffffb6d4, 0x74
arpl word [ecx + 0x19], sp
sbb eax, 0x8be92571
cmp eax, edi
inc esp
jo 0x40110d
insd dword es:[edi], dx
xchg byte [esi], ch
pop esi
mov eax, dword [0x5d2f7b11]
js 0x401126
pop es
mov al, 0x42
mov ebx, 0x5908efd7
mov dword [edi], esp
xor cl, byte [ebp - 0x3b85f7ea]
pushfd
inc eax
mov byte [0x303bb0e5], al
in al, 5
cld
fdiv dword gs:[ebp + 0x50424d89]
int 0xcd
sub dword [eax + 0x1d9a7cbf], edx
xor eax, 0x9823d519
mov bl, byte [eax + eax*8]
mov bl, byte [eax - 0x6cc966c6]
or byte [edx], al
cmp al, 0x71
mov eax, dword [0x2e70f7]
mov bp, 0x1aa3
pop eax
movsd dword es:[edi], dword [esi]
retf 0x8914
mov bh, 0x6f
sub dword [esi + 0x5f147049], eax
dec ecx
jo 0x401124
pop edi
js 0x401185
loope 0x401099
test esi, edi
mov ebp, 0x8fa11336
insb byte es:[edi], dx
or eax, 0x129b801e
aas
xchg ecx, eax
xchg ecx, eax
int1
ret 0x6fe
stc
sub bl, byte [edx - 0x59]
cld
rcl byte [ebp + 0x3ef3089e], 0xac
lodsb al, byte ds:[esi]
sbb esp, dword [edi*4 + 0x4d65d23f]
shr byte [ecx + 0x64], 1
lea esi, [edx]
popal
fsubr st(4)
cmp al, 0xf7
xor al, 0x29
inc esi
xor bl, al
scasb al, byte es:[edi]
inc esi
clc
sub edx, dword [0xc8fa6513]
test dword [ebp - 0x69], 0x126730c7
sbb byte [eax + 0x47917d13], cl
cmp cl, al
out 0xf5, eax
popfd
cmp al, 0xb0
loopne 0x40115e
and esp, 0x5ac4e273
in al, 0x73
loop 0x40114d
pop edx
out dx, al
fimul word [ecx - 0x7a]
sti
ja 0x401143
pop ebx
jb 0x401187
jns 0x4011e9
xlatb
xchg edx, eax
push edi
not dl
cdq
pop ebp
push ebx
xor bl, bh
ret 0x229b
cli
jmp 0x9a643413
Function at 0x10286ca0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10286981
mov dword [esp + 0x28], eax
jmp 0x102869fb
call 0x10285c15
jmp 0x10286a8a
call 0x10285c44
jmp 0x10286ac6
mov dword [esp + 0x28], eax
jmp 0x10286a57
mov dword [esp + 0x28], eax
jmp 0x10286bef
pop ecx
jmp 0x102869a1
sub ecx, 0x100170e5
mov dword [ecx + 0x10017de9], eax
jmp 0x102869ff
lea esp, [esp + 4]
ret
popal
popfd
jmp 0x102869e5
movzx ebx, byte [eax]
add ebx, 0x7e6fed85
cmp ebx, 0x7e6fee51
jmp 0x10286aa8
cmp dword [esp + 4], 0
jmp 0x10286a82
inc dword [esp + 8]
popfd
ret 4
popal
popfd
jmp 0x10286aeb
movzx ebx, byte [eax]
add ebx, 0x5c6d0dad
jmp 0x10286ad5
dec esp
mov edi, 0x34a62b03
push ebx
scasb al, byte es:[edi]
imul edx, dword [edi - 0x42], 0xffffff89
sub byte [ebx + 0x68], cl
add byte [eax], al
add byte [eax], al
pushfd
jmp 0x10286a39
jne 0x10286a4f
pushal
jmp 0x10285c10
pop eax
sub eax, 0xebd2cc85
jmp 0x10286c90
je 0x10286a6c
jne 0x10285bde
mov dword [ecx + 0x10017faf], eax
jmp 0x10286a5e
mov ecx, dword [esp]
lea esp, [esp + 4]
sub ecx, 0x10017178
jmp 0x10286ab0
cmp ebx, 0x5c6d0e79
jmp 0x10286b5c
lea esp, [esp + 4]
ret
push eax
call fcn.1027273d
jmp 0x10285c3f
les ebx, [ebp - 0x39]
push edi
xor al, cl
or eax, 0x7c83d5fa
and al, 4
add bl, ch
aas
pop ebx
invalid
je 0x10286b39
jne 0x10285c70
call 0x10286bc7
pop edi
pop edi
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
outsb dx, byte [esi]
js 0x10286c2e
je 0x10286bc7
jmp 0x10286b05
popal
jmp 0x10286c09
popfd
lea esp, [esp + 4]
ret
adc byte [ecx + 0x1805b81], cl
adc bl, ch
fsubr st(3)
jmp 0x10286c61
sub esp, dword [eax + reloc.RASAPI32.dll_RasHangUpA]
push edi
fisttp qword [ebp + 0x14]
out 0x57, eax
cmpsd dword [esi], dword es:[edi]
mov esp, 0xbf8436db
xchg byte [ecx - 0x59107f3d], al
cli
cmp ebx, 0xfaa6f04c
je 0x10286cb7
jne 0x10285cce
call 0x10286ca0
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
stc
shr bl, 1
jmp 0x10286bb6
Function at 0x10362ae3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esi + 0xe9]
jmp 0x10362b11
neg cl
add esp, 4
xchg dl, dh
lea esp, [esp + 4]
pop dx
mov bl, dl
jmp 0x10362b26
bsf eax, ebp
xchg ebp, eax
bswap ecx
mov bp, dx
lea esp, [esp + 2]
jmp 0x10362b54
mov esi, dword [esp + 7]
rdtsc
shr bh, 3
adc bh, dl
bswap edi
rcr ebp, 0xd
jmp 0x10362f58
xchg ah, bh
push si
xchg word [esp], di
btr edx, ecx
xchg ebx, ecx
mov ebp, esi
jmp 0x10362be8
neg cx
push esp
lea edx, [edx*4]
sub esp, 0x15
popal
xchg edx, ecx
jmp 0x10362b92
cmc
call 0x10362bbb
nop
add al, 0x9a
std
or al, 0xb8
mov cl, 0x21
inc eax
mov bl, 0x18
xor byte [ebx], dh
sub al, byte [ebp - 0xc]
mov al, 0x2a
bt ebp, ebp
xchg edi, ebp
xchg byte [esp], cl
mov esi, edi
mov si, word [esp + 2]
jmp 0x10362bd1
pop dword [esp]
mov bp, word [esp + 1]
std
xchg word [esp], dx
push word [esp]
not bh
jmp 0x10362ba8
xchg word [esp + 6], di
pop dword [esp + 2]
push cx
xchg cl, al
xchg ah, al
pop word [esp + 1]
jmp 0x10362c15
mov dword [esp + 4], ebp
bswap edi
rdtsc
push dword [esp + 8]
mov byte [esp + 0xb], bl
mov esi, 0xffa2cace
jmp 0x10362c49
mov ecx, dword [esp + 7]
bsf di, si
xchg byte [esp + 4], cl
lea ebx, [edx + edx]
neg ah
mov cl, 0x6b
jmp 0x10362e8d