joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10179c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10179d8c
test eax, eax
je 0x10179d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x10194ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x10179d73
lea edi, [eax + 4]
jmp 0x10179cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x10179cec
mov dword [ebp - 4], 2
jmp 0x10179d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10179d03
mov dword [ebp - 4], 1
jmp 0x10179d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x10179d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x10179d46
mov byte [ecx], 0x3d
jmp 0x10179d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x10179d5d
mov byte [ecx], 0x3d
jmp 0x10179d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10179cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10179d65
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10179d8c
test eax, eax
je 0x10179d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x10194ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x10179d73
lea edi, [eax + 4]
jmp 0x10179cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x10179cec
mov dword [ebp - 4], 2
jmp 0x10179d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10179d03
mov dword [ebp - 4], 1
jmp 0x10179d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x10179d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x10179d46
mov byte [ecx], 0x3d
jmp 0x10179d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x10179d5d
mov byte [ecx], 0x3d
jmp 0x10179d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10179cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10293ab2
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 0xa7], 0x4e
jmp 0x103cae72
push 0x3e62dede
call fcn.102a2ff4
mov byte [esp + 0xa6], 0x1f
jmp 0x102287c2
mov byte [esp + 0xa9], 0x91
jmp 0x10437081
mov byte [esp + 0xa8], 0x4a
jmp 0x10341f8f
mov byte [esp + 0xaa], 0x75
jmp loc.1005771c

Function at 0x102a4654
Capabilities:
Check http status code
Hash data with crc32
Parse pe header

Disassembly:
push 0x90c1a890
call fcn.103de729
Function at 0x102f5978
Capabilities:
Authenticate hmac

Disassembly:
push ecx
jmp 0x102eeb36
mov word [ebp - 0xca0], dx
call fcn.10079580
add esp, 0xc
push 0x3f
setns cl
jmp 0x103fa237
push esi
jmp 0x10244b1e
call fcn.10079580
add esp, 0xc
push 0x206
shrd ax, dx, 0x32
rcl al, cl
mov eax, ebp
lea eax, [ebp - 0xc9e]
clc
test bp, 0x1441
stc
xor edx, edx
jmp 0x1048d2df
mov dword [ebp - 0xf00], esi
jmp 0x104d80a3
push ebp
add ah, 0x49
mov ebp, esp
rcl dh, 0xa9
and eax, 0x285e52dd
shrd dx, bp, 0xd
push 0xffffffffffffffff
push 0x100ead21
rcl edx, 0xc0
bsr edx, edi
mov eax, dword fs:[0]
sbb edx, edi
push eax
and edx, esi
xor edx, 0x1e8009ee
rcl ax, 0x47
sub esp, 0xefc
sal al, 0x41
add dl, 0xc0
mov eax, dword [0x1014bde0]
xor eax, ebp
rcl dh, cl
rcl dx, 0xae
test edi, 0x6413a20
mov dword [ebp - 0x10], eax
push ebx
bsr edx, ebp
bts edx, ebx
push esi
stc
push edi
push eax
xor dl, cl
rcr dl, 0xce
lea eax, [ebp - 0xc]
sar dx, cl
btr edx, 0x25
mov dword fs:[0], eax
jmp 0x10463d90
call fcn.10079580
add esp, 0xc
jmp 0x1035d2e4
mov dword [ebp - 0xef8], eax
jmp 0x103fdf71
mov word [ebp - 0x490], ax
jmp 0x102e806d
lea ecx, [ebp - 0xee7]
jmp 0x10267e9d
mov word [ebp - 0xa98], cx
call fcn.10079580
add esp, 0xc
sar ecx, 0xa8
mov ch, 0x58
push 0x206
btr cx, dx
sub ecx, esi
lea ecx, [ebp - 0x48e]
xor eax, eax
push esi
jmp 0x104628d4
push eax
jmp 0x1024b56c
push edx
jmp 0x1033d7a4
push ecx
jmp 0x1033e566
mov eax, dword [ebp + 0xc]
cwd
cmp sp, bx
push 0x206
bswap dx
shr dx, cl
xor esi, esi
movzx edx, di
neg dx
shl edx, 0x78
lea edx, [ebp - 0xa96]
cmp ax, dx
sub ecx, ecx
jmp 0x10486a4c
push esi
jmp 0x1045e99b
push esi
jmp 0x1042f7fe
mov byte [ebp - 0xee8], 0
jmp 0x103091d1
Function at 0x1034e370
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x7fb6f1fb
call fcn.10451c62
Function at 0x10356584
Capabilities:
Encode data using xor

Disassembly:
push 0x7fb6f1fb
call fcn.10451c62
sbb byte [esi], dl
outsd dx, dword [esi]
pop edx
add ch, byte [edi + 0x3b102b03]
pop ebx
fbstp tbyte [edx + 0x6a00afef]
fucomp st(7)
scasd eax, dword es:[edi]
add byte [edx - 0x23], ch
out dx, eax
salc
xor eax, 0xedefa2d7
xchg ebx, eax
in eax, 0x9a
adc ch, bl
and cl, bl
scasb al, byte es:[edi]
adc byte [ecx + 0x103d3776], bh
cdq
jge 0x1035659c
push ebx
out dx, eax
sub dword [esi + ebx*4 - 0x4e], ebx
out dx, eax
invalid
Function at 0x1035d2d1
Capabilities:
Authenticate hmac

Disassembly:
call fcn.10079580
mov edi, dword [ebp + 8]
add esp, 0xc
jmp loc.10038539
push 0x90c1a890
call fcn.103de729
sub dl, byte [esi]
add byte [esi], dh
mov edx, 0x49aa4ac6
push 0x1ff
lea edx, [ebp - 0x287]
jmp 0x1041e4d6
push esi
jmp 0x1044d754
push edx
mov dword [ebp - 0xea8], esi
jmp 0x1048d3d8
mov byte [ebp - 0x288], 0
jmp 0x1033d6f0

Function at 0x1035e652
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x7fb6f1fb
call fcn.10451c62
test bp, 0xb22
Function at 0x10378794
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov byte [ebp - 0x24], 0x6b
jmp 0x104b84c5
push ebp
xchg ah, ah
mov ebp, esp
rcl ax, 0x6e
push 0xffffffffffffffff
btc ax, dx
stc
push 0x100e93f8
movsx eax, di
mov eax, dword fs:[0]
push eax
rcl ah, cl
sub esp, 0x8e0
shrd ax, bx, 0xee
neg eax
sal ah, 0x2c
mov eax, dword [0x1014bde0]
test dh, 0xcf
xor eax, ebp
mov dword [ebp - 0x14], eax
cmp bx, cx
push ebx
push esi
btr bx, bx
mov ebx, 0xef30b71
push edi
neg bl
push eax
lea eax, [ebp - 0xc]
sar bx, cl
shl bx, cl
mov dword fs:[0], eax
cmovne ax, dx
bsr eax, edi
mov eax, dword [ebp + 8]
bts ebx, edx
movsx ebx, bp
sal bh, 0x23
mov dword [ebp - 0x888], eax
mov al, 0xe9
bsr eax, eax
inc eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x898], ecx
ror bx, cl
sbb bl, cl
push eax
or bl, dl
lea ecx, [ebp - 0x24]
setge bl
xor esi, esi
not bl
cmovae bx, di
mov ebx, 0x719c673a
mov ebx, 0x69
jmp 0x104cceb0
mov dword [ebp - 0x874], esi
jmp 0x10341941
mov dword [ebp - 0x890], edx
jmp 0x103c12fa
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x72
jmp loc.1002ebad
push ecx
jmp 0x10460f14

Function at 0x1037ebb9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x3e62dede
call fcn.102a2ff4

Function at 0x10385c9b
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
push 0x7fb6f1fb
call fcn.10451c62
mov byte [ebp - 0x122], 0x67
jmp loc.100469f6
Function at 0x103efb7c
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
call fcn.10072ae4
cdq
bswap di
cmp bh, dh
jmp 0x103f0afc
jne 0x103fd521
lea eax, [esp + 0x10]
xchg edi, edi
push eax
mov edi, 0x206d09d3
cmovs edi, edx
mov edi, 0x1016c7a4
jmp 0x103fd51c
push eax
mov eax, dword [edx + 4]
jmp 0x10457044
mov edx, dword [esp + 0x10]
jmp 0x1040dd5e
je 0x102e329c
lea ecx, [esp + 0x128]
jmp 0x104344c2
jg 0x10457046
mov ecx, dword [eax]
movsx edx, si
cwd
mov edx, dword [ecx]
jmp 0x101e8a28
push eax
call fcn.10075460
mov esi, eax
lea esp, [esp + 8]
test esi, esi
jmp 0x10326509
je 0x103ae1cf
mov eax, edi
push 0x5c
jmp 0x10247656
mov eax, esi
dec cl
lea edx, [eax + 1]
jmp 0x103b82f6
call fcn.104a3a02
lea esp, [esp + 4]
test eax, eax
jmp 0x1028c0d4
call fcn.1003e2f0
add esp, 4
test si, si
test eax, eax
jmp 0x101bc868
je 0x103ae1cf
inc esi
mov dx, dx
mov eax, esi
movsx edx, sp
inc edx
not edx
mov dword [esp + 0x30], esi
mov edx, esi
movsx edx, di
lea edx, [eax + 1]
jmp 0x1047fe85
call fcn.10021c60
push eax
jmp 0x1049454c
lock xadd dword [ecx], edx
jmp 0x1046e295
test cl, cl
jne 0x1047fe88
sub eax, edx
jmp 0x1023344d
push edx
jmp 0x102fcc07
add edx, 0x1194
mov dword [esp + 0x28], edx
jmp 0x101fde6c
mov dword [esp + 0x14], eax
jmp 0x1042f4d4
mov edx, dword [esp + 0x10]
jmp 0x10374f49
mov cl, byte [eax]
jmp 0x103d69c0
jne 0x103b82f6
sub eax, edx
jmp 0x1002b439
inc eax
test cl, cl
jmp 0x103c6a26
or edx, 0xffffffff
jmp 0x10363ebc
push 0x3e62dede
call fcn.102a2ff4
call fcn.1006b111
xor ecx, ecx
cmp eax, esi
mov cl, 0xdc
setne cl
test di, 0x5a2f
stc
cmp ecx, esi
jne 0x103efbac
push 0x80004005
call fcn.100056a0
mov edx, dword [eax]
bswap cx
mov cl, 0xa6
mov ecx, eax
lahf
mov eax, dword [edx + 0xc]
jmp 0x104abe78
mov ecx, 0x1b58
shld di, si, 0x80
rol di, 0x5e
idiv ecx
shl cl, cl
lea ecx, [esp + 0x24]
lea edi, [esp + 0x17c]
jmp 0x1037b792
call fcn.1004ad70
mov dword [esp + 0x9a0], 0xffffffff
sub cx, 0x4a6a
mov eax, dword [esp + 0x14]
rol ecx, cl
btc cx, 0xa6
add eax, 0xfffffff0
or ch, 0x1f
ror ecx, cl
lea ecx, [eax + 0xc]
test edx, edi
jmp 0x103e0270
push edx
lea edx, [esp + 0x380]
jmp 0x102f4dfc
mov dword [esp + 0x9a0], esi
jmp 0x103544f1
push ecx
push esi
jmp 0x1001537c
call eax
mov ecx, dword [ebp + 0x18]
cwde
movsx ax, bl
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
jmp 0x1004a738
dec edx
cmp edi, 0x2e71050c
test edx, edx
jmp 0x1023a19d
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
jmp 0x1036ba7a
call fcn.10072ad2
add esp, 4
jmp 0x1017ffc8
call eax
add eax, 0x10
jmp 0x10383d94

Function at 0x103f5505
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions
Hash data with crc32
Parse pe header

Disassembly:
push 0x7fb6f1fb
call fcn.10451c62
rcr edx, cl
Function at 0x1043584a
Capabilities:
Reference processor manufacturer constants

Disassembly:
mov byte [ebp - 0x2b], 0x6c
jmp 0x10319677
mov byte [ebp - 0x1f], 0x6e
jmp 0x1037d56c
je 0x10422198
xor al, al
pop edi
test edi, edi
pop esi
pop ebx
cmp ebp, ebp
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10072a46
mov esp, ebp
movsx ebp, di
pop ebp
jmp loc.1007afdf
mov byte [ebp - 0x20], 0x45
jmp 0x101cc34c
mov byte [ebp - 0x28], 0x2e
jmp 0x102cf632
je 0x1031a22b
xor eax, eax
cwd
and ch, 0xc5
bt bx, bp
mov dword [ebp - 0x2c], eax
rcr ch, 0xb8
stc
xadd ebx, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
shr al, 0xaf
mov eax, 0x40000000
cpuid
cmp esi, esp
jmp 0x10498dca
mov byte [ebp - 0x26], 0x6c
jmp 0x103d0965
mov byte [ebp - 0x29], 0x32
jmp 0x101ef4fa
mov byte [ebp - 0x30], 0x6b
mov byte [ebp - 0x2f], bl
jmp 0x1042ae4c
mov byte [ebp - 0x24], 0
jmp 0x103a436f
call fcn.10072a46
mov esp, ebp
movsx ebp, bp
pop ebp
ret
mov byte [ebp - 0x27], 0x64
jmp 0x1023aac2
mov byte [ebp - 0x2a], 0x33
jmp 0x10242eed
lea ecx, [ebp - 0x30]
not bh
mov ebx, 0x65
jmp 0x10397949
jne 0x10422198
cmp dword [ebp - 0x28], 0x666f736f
jne 0x10422198
cmp dword [ebp - 0x24], 0x76482074
jne 0x10422198
mov eax, 0x40000003
mov cl, ah
cpuid
jmp 0x103e1717
push esi
jmp 0x10403d56
sar eax, 0x1f
test edx, esi
push edi
cmp si, bp
test al, 1
jmp 0x1022e5e8
mov byte [ebp - 0x1e], 0x75
jmp loc.1003fc2f
push ecx
jmp 0x10250cef
call fcn.1048e786
lea edx, [ebp - 0x20]
mov esi, eax
push edx
jmp 0x1034e3d7
mov byte [ebp - 0x25], 0x6c
jmp 0x102af69e
mov byte [ebp - 0x2d], 0x6e
jmp 0x1049e34b
mov dword [ebp - 0x2c], 0
test esi, 0x6d6c5c94
stc
test di, si
mov dword [esi], eax
cmc
clc
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
cmp si, sp
clc
mov dword [esi + 0xc], edx
test byte [ebp - 0x2c], 1
jmp 0x101cebfd
mov byte [ebp - 0x6d], 0
jmp 0x101e37e7
mov al, 1
and ecx, 0x64f04ad9
ror cx, cl
pop edi
stc
pop esi
pop ebx
sbb ch, bl
xor ecx, 0x32526d7c
xchg cl, cl
mov ecx, dword [ebp - 4]
clc
cmp cx, 0x334e
cmp ebx, ecx
xor ecx, ebp
jmp 0x102b2f3b
mov byte [ebp - 0x2e], 0x72
jmp 0x103dba5f
push ebp
rol bp, 0xe4
mov ebp, esp
xadd ah, dl
sbb edx, 0x3fa14b32
sub esp, 0x94
mov eax, dword [0x1014bde0]
sub edx, 0x28de42b3
rcr cl, 0x7c
rol dx, cl
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, 1
bsr bx, sp
cpuid
test dh, 0x40
cmc
push esi
xor si, 0x5480
lea esi, [ebp - 0x30]
clc
mov dword [esi], eax
mov dword [esi + 4], ebx
ror ax, cl
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
rol ax, 0xe
mov eax, dword [ebp - 0x28]
cmc
cmp bp, 0x7f7d
jmp 0x1036607a
mov dword [esi], eax
test edi, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
clc
test si, 0x436c
cmc
cmp dword [ebp - 0x2c], 0x7263694d
jmp 0x10344695
mov byte [ebp - 0x2c], bl
jmp 0x101b58bc

Function at 0x104372c5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x6162a9d3
call fcn.1037a6cd
Function at 0x1044ec6b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x10302aed
mov dl, byte [ecx + 1]
cmp cx, bp
test ah, 0x57
stc
cmp dl, byte [esi + 1]
jmp 0x1031b33e
jne 0x1022c1e8
test dl, dl
jmp 0x10184cf4
mov ecx, dword [ebp - 4]
cmp edx, 0x5ec50cde
rcl di, 0xd7
pop edi
cmp cx, 0x4cf
clc
pop esi
or bl, dh
xor bx, si
add bl, 0xde
xor ecx, ebp
test esp, esi
bts ebx, ecx
and bl, cl
xor eax, eax
cmovno ebx, esp
bswap ebx
setnp bh
pop ebx
jmp 0x1021f67d
call fcn.10072a46
mov esp, ebp
movsx ebp, dx
bswap bp
pop ebp
jmp 0x100065e7
push 0
jmp 0x104cf814
sbb ecx, ecx
jmp 0x1037a1f8
je 0x102f2e62
cmp dword [edi + eax + 0x18], 0
mov dword [ebp - 0xd8], 0
jmp 0x102f2e5c
jg 0x103f4d2c
mov ecx, dword [edi + eax + 0x10]
cmp ebx, ecx
jb 0x101def24
mov edx, dword [edi + eax + 0x14]
lea edx, [edx + ecx - 1]
cmp bx, ax
cmc
cmp ebx, edx
jmp 0x103cc997
jne 0x103f4d46
sub ecx, ecx
jmp 0x103adbcb
jne 0x1022c1e8
lea ecx, [ecx + 2]
lea esi, [esi + 2]
jmp 0x1034325c
test dl, dl
jmp 0x10302ae7
sbb ecx, 0xffffffff
jmp 0x100197ff
pop edi
jmp 0x1039a922
mov eax, esi
pop esi
pop ebx
movzx cx, bh
rcr cl, 0xc9
and cx, cx
mov ecx, dword [ebp - 4]
jmp 0x103f8dd2
jmp 0x100197ff
ja 0x101def24
sub ebx, ecx
inc ch
mov esi, dword [esi + ebx*4]
add esi, eax
add ecx, edi
lea ecx, [eax + edi]
test dl, 0x29
cmp ebp, ecx
cmp esi, ecx
jmp 0x103cf96b
jb 0x103820e6
mov edx, dword [ebp - 0xe4]
cmc
lea eax, [eax + edx]
cmc
lea eax, [eax + edi]
cmp esi, eax
jmp 0x1049993c
mov byte [ebp - 0x70], 0
call fcn.10079580
push 0x63
mov ecx, 0xc46148b
movsx ecx, bp
lea ecx, [ebp - 0xd3]
jmp 0x10035cc1
mov edx, dword [ebp - 0xd8]
btc si, cx
or si, cx
ror si, 0xe3
mov ecx, dword [ecx + edx*4]
mov esi, ebx
add ecx, eax
rol dl, cl
mov dl, byte [ecx]
cmp sp, cx
cmp dl, byte [esi]
jmp 0x101b6842
xor ecx, ebp
jmp 0x104c7f7c
mov byte [ebp - 0xa], cl
shrd edx, ebx, 0x28
adc dx, 0x2a07
mov byte [ebp - 9], cl
xor edx, 0x7e3d2391
adc ch, 0xfa
mov ecx, dword [eax + 0x3c]
push ebx
sar ebx, 0x87
bsf dx, ax
mov ebx, dword [ebp + 0xc]
add ecx, eax
push esi
btc esi, ebx
or si, dx
mov byte [ebp - 0xc], 0x2e
or dx, di
rcr dl, 0x6e
cwd
mov byte [ebp - 0xb], 0x64
stc
adc dx, cx
mov byte [ebp - 8], 0
push edi
mov edi, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
movzx edx, cx
bswap esi
mov esi, dword [edi + eax + 0x1c]
mov edx, dword [edi + eax + 0x24]
cmp esp, ecx
mov dword [ebp - 0xe4], ecx
bswap ecx
mov ecx, dword [edi + eax + 0x20]
cmp edi, esp
lea esi, [esi + eax]
test bx, sp
clc
lea ecx, [ecx + eax]
cmp bp, dx
lea edx, [edx + eax]
stc
mov dword [ebp - 0xdc], esi
cmp di, 0x111d
mov dword [ebp - 0xe8], ecx
cmc
clc
mov dword [ebp - 0xe0], edx
cmp dx, di
test ebx, 0xffff0000
jmp 0x102cdfe4
push ebp
mov ebp, esp
cwde
lea esp, [esp - 0xe8]
xadd cl, dl
mov eax, dword [0x1014bde0]
dec dl
xor eax, ebp
clc
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
sar cl, 0x87
btr dx, bp
mov cl, 0x6c
jmp 0x1040ea65
ret
ja 0x103820e6
push 0x63
movzx eax, si
lea eax, [ebp - 0x6f]
jmp 0x10224013
call fcn.10072a46
mov esp, ebp
pop ebp
jmp 0x1046cd95
push eax
jmp 0x103f4c41
Function at 0x10455976
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x4d
jmp 0x101f4af2
push eax
call fcn.1041437d
add esp, 0x1c
xchg si, si
cmovo si, dx
push ebx
bswap esi
xchg al, al
cwde
lea esi, [ebp - 0x58]
lea eax, [ebp - 0x520]
jmp 0x103882fb
je 0x101f4aff
mov ecx, dword [ebp - 0x1178]
push ecx
jmp 0x103a30e7
push edx
call fcn.102acb96
add esp, 0x1c
cwde
movsx esi, ax
push ebx
jmp 0x103e9a4d
je 0x101ca0de
mov edx, dword [ebp - 0x1178]
cbw
push edx
cmovnp dx, si
setg ch
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x950]
cwde
cbw
push ecx
lea edx, [ebp - 0x788]
movsx eax, bp
push edx
jmp 0x104101aa
call fcn.10028690
add esp, 4
not ah
bswap eax
lea eax, [ebp - 0x520]
jmp 0x103b56c1
call fcn.100286e0
test al, al
jmp 0x101ee194
push ecx
call fcn.1045a340
add esp, 0x1c
push ebx
cmovno si, dx
xchg si, ax
mov ax, bp
lea esi, [ebp - 0x50]
bswap eax
cbw
mov al, 0x5d
lea eax, [ebp - 0x520]
jmp 0x1020fc33
lea eax, [ebp - 0x950]
mov dx, cx
push eax
lea ecx, [ebp - 0x788]
movsx edx, bx
bswap edx
cmovs edx, ebp
push ecx
mov edx, edx
push 3
xchg dx, dx
lea edx, [ebp - 0x18]
jmp 0x101c051c
call fcn.10028690
add esp, 4
bswap ax
lea eax, [ebp - 0x520]
jmp 0x103418fa
lea edx, [ebp - 0x520]
not cx
mov cx, ax
push edx
jmp 0x1037a147
call fcn.100286e0
test al, al
jmp 0x10203730
lea esi, [ebp - 0x30]
mov ax, bp
setno al
xchg ah, ah
lea eax, [ebp - 0x520]
jmp 0x1002e642
push 3
setnp ah
lea eax, [ebp - 0x18]
jmp 0x104e4fe2
push 0x3e62dede
call fcn.102a2ff4
push 0x4d
jmp 0x1035baed
push 0x4d
jmp 0x101ca0ce
Function at 0x10490f42
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.10019a70
push edi
mov ecx, 0xa8
lea esi, [ebp - 0x51c]
cmovl dx, cx
mov edx, edi
lea edx, [ebp - 0x570]
jmp 0x104a7eac
mov byte [ebp - 0x22], 0x63
jmp 0x10244bd5
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x6f
jmp 0x103d96d5
mov byte [ebp - 0x1b], 0x2e
mov byte [ebp - 0x1a], 0x56
jmp 0x102e81f4
mov byte [ebp - 0x19], 0x43
jmp loc.10019646
mov byte [ebp - 0x24], 0x4d
mov byte [ebp - 0x23], 0x69
jmp 0x10210b5d
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x6f
jmp 0x10496618
mov byte [ebp - 0x1c], 0x74
jmp 0x1025d4d0
push 0x3e62dede
call fcn.102a2ff4
mov byte [ebp - 4], 1
jmp 0x101e114a
mov byte [ebp - 0x1d], 0x66
jmp 0x104565eb
call fcn.10019a70
mov byte [ebp - 4], 3
not al
mov dl, 0x39
mov cl, 0x30
mov al, 0x6d
jmp 0x103183c4
mov byte [ebp - 4], 2
jmp 0x104996f5
Function at 0x104ae86c
Capabilities:
Authenticate hmac

Disassembly:
push 0x7fb6f1fb
call fcn.10451c62
dec ebx
push ecx
mov fs, word [ecx]
pop ds
dec ebp
dec ecx
cmp al, 0x7a
add dword [ebx + 0x10be4d04], edi
jb 0x104ae863
cld
mov ebp, 0x83c8df2e
xor dh, byte [ebx - 0x6f0a71e8]
mov ah, 0x31
invalid

Function at 0x104e1565
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x7fb6f1fb
call fcn.10451c62
rdtsc
Function at 0x4556c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
or ebp, 0xffffffff
jmp 0x4556e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4556e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4556d8
mov eax, 1
add ebx, ebx
jne 0x4556fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45570c
jne 0x45572b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45572b
dec eax
add ebx, ebx
jne 0x455718
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4556f0
add ebx, ebx
jne 0x455727
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x45577d
xor ecx, ecx
sub eax, 3
jb 0x455743
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4557b2
sar eax, 1
mov ebp, eax
jmp 0x45574e
add ebx, ebx
jne 0x45574e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45571c
inc ecx
add ebx, ebx
jne 0x45575c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45571c
add ebx, ebx
jne 0x455769
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45575e
jne 0x45577a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45575e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45579c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45578e
jmp 0x4556de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45579c
add edi, ecx
jmp 0x4556de
pop esi
mov edi, esi
mov ecx, 0x743
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4557ba
cmp byte [edi], 1
jne 0x4557ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4557bf
lea edi, [esi + 0x4f000]
mov eax, dword [edi]
or eax, eax
je 0x45582e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x55b08]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x55bd0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4557ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x55bd4]
or eax, eax
je 0x455828
mov dword [ebx], eax
add ebx, 4
jmp 0x455809
call dword [esi + 0x55be4]
mov ebp, dword [esi + 0x55bd8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x455862
sub esp, 0xffffff80
jmp 0x40bbf4